git.sur5r.net Git - freertos/blob - FreeRTOS-Plus/Source/WolfSSL/src/internal.c

   1 /* internal.c
   2  *
   3  * Copyright (C) 2006-2015 wolfSSL Inc.
   4  *
   5  * This file is part of wolfSSL. (formerly known as CyaSSL)
   6  *
   7  * wolfSSL is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 2 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * wolfSSL is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22
  23 #ifdef HAVE_CONFIG_H
  24     #include <config.h>
  25 #endif
  26
  27 #include <wolfssl/wolfcrypt/settings.h>
  28
  29 #include <wolfssl/internal.h>
  30 #include <wolfssl/error-ssl.h>
  31 #include <wolfssl/wolfcrypt/asn.h>
  32 #include <wolfssl/wolfcrypt/dh.h>
  33 #ifdef NO_INLINE
  34     #include <wolfssl/wolfcrypt/misc.h>
  35 #else
  36     #include <wolfcrypt/src/misc.c>
  37 #endif
  38
  39 #ifdef HAVE_LIBZ
  40     #include "zlib.h"
  41 #endif
  42
  43 #ifdef HAVE_NTRU
  44     #include "ntru_crypto.h"
  45 #endif
  46
  47 #if defined(DEBUG_WOLFSSL) || defined(SHOW_SECRETS) || defined(CHACHA_AEAD_TEST)
  48     #ifdef FREESCALE_MQX
  49         #include <fio.h>
  50     #else
  51         #include <stdio.h>
  52     #endif
  53 #endif
  54
  55 #ifdef __sun
  56     #include <sys/filio.h>
  57 #endif
  58
  59 #ifndef TRUE
  60     #define TRUE  1
  61 #endif
  62 #ifndef FALSE
  63     #define FALSE 0
  64 #endif
  65
  66 #ifdef _MSC_VER
  67     /* disable for while(0) cases at the .c level for now */
  68     #pragma warning(disable:4127)
  69 #endif
  70
  71 #if defined(WOLFSSL_CALLBACKS) && !defined(LARGE_STATIC_BUFFERS)
  72     #error \
  73 WOLFSSL_CALLBACKS needs LARGE_STATIC_BUFFERS, please add LARGE_STATIC_BUFFERS
  74 #endif
  75
  76 #if defined(HAVE_SECURE_RENEGOTIATION) && defined(HAVE_RENEGOTIATION_INDICATION)
  77     #error Cannot use both secure-renegotiation and renegotiation-indication
  78 #endif
  79
  80 static int BuildMessage(WOLFSSL* ssl, byte* output, int outSz,
  81                         const byte* input, int inSz, int type);
  82
  83 #ifndef NO_WOLFSSL_CLIENT
  84     static int DoHelloVerifyRequest(WOLFSSL* ssl, const byte* input, word32*,
  85                                                                         word32);
  86     static int DoServerHello(WOLFSSL* ssl, const byte* input, word32*, word32);
  87     static int DoServerKeyExchange(WOLFSSL* ssl, const byte* input, word32*,
  88                                                                         word32);
  89     #ifndef NO_CERTS
  90         static int DoCertificateRequest(WOLFSSL* ssl, const byte* input, word32*,
  91                                                                         word32);
  92     #endif
  93     #ifdef HAVE_SESSION_TICKET
  94         static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32*,
  95                                                                         word32);
  96     #endif
  97 #endif
  98
  99
 100 #ifndef NO_WOLFSSL_SERVER
 101     static int DoClientHello(WOLFSSL* ssl, const byte* input, word32*, word32);
 102     static int DoClientKeyExchange(WOLFSSL* ssl, byte* input, word32*, word32);
 103     #if !defined(NO_RSA) || defined(HAVE_ECC)
 104         static int DoCertificateVerify(WOLFSSL* ssl, byte*, word32*, word32);
 105     #endif
 106 #endif
 107
 108
 109 #ifdef WOLFSSL_DTLS
 110     static INLINE int DtlsCheckWindow(DtlsState* state);
 111     static INLINE int DtlsUpdateWindow(DtlsState* state);
 112 #endif
 113
 114
 115 typedef enum {
 116     doProcessInit = 0,
 117 #ifndef NO_WOLFSSL_SERVER
 118     runProcessOldClientHello,
 119 #endif
 120     getRecordLayerHeader,
 121     getData,
 122     runProcessingOneMessage
 123 } processReply;
 124
 125 #ifndef NO_OLD_TLS
 126 static int SSL_hmac(WOLFSSL* ssl, byte* digest, const byte* in, word32 sz,
 127                     int content, int verify);
 128
 129 #endif
 130
 131 #ifndef NO_CERTS
 132 static int BuildCertHashes(WOLFSSL* ssl, Hashes* hashes);
 133 #endif
 134
 135 static void PickHashSigAlgo(WOLFSSL* ssl,
 136                                 const byte* hashSigAlgo, word32 hashSigAlgoSz);
 137
 138 #ifndef WOLFSSL_HAVE_MIN
 139 #define WOLFSSL_HAVE_MIN
 140
 141     static INLINE word32 min(word32 a, word32 b)
 142     {
 143         return a > b ? b : a;
 144     }
 145
 146 #endif /* WOLFSSL_HAVE_MIN */
 147
 148
 149 int IsTLS(const WOLFSSL* ssl)
 150 {
 151     if (ssl->version.major == SSLv3_MAJOR && ssl->version.minor >=TLSv1_MINOR)
 152         return 1;
 153
 154     return 0;
 155 }
 156
 157
 158 int IsAtLeastTLSv1_2(const WOLFSSL* ssl)
 159 {
 160     if (ssl->version.major == SSLv3_MAJOR && ssl->version.minor >=TLSv1_2_MINOR)
 161         return 1;
 162     if (ssl->version.major == DTLS_MAJOR && ssl->version.minor <= DTLSv1_2_MINOR)
 163         return 1;
 164
 165     return 0;
 166 }
 167
 168
 169 #ifdef HAVE_NTRU
 170
 171 static byte GetEntropy(ENTROPY_CMD cmd, byte* out)
 172 {
 173     /* TODO: add locking? */
 174     static RNG rng;
 175
 176     if (cmd == INIT)
 177         return (wc_InitRng(&rng) == 0) ? 1 : 0;
 178
 179     if (out == NULL)
 180         return 0;
 181
 182     if (cmd == GET_BYTE_OF_ENTROPY)
 183         return (wc_RNG_GenerateBlock(&rng, out, 1) == 0) ? 1 : 0;
 184
 185     if (cmd == GET_NUM_BYTES_PER_BYTE_OF_ENTROPY) {
 186         *out = 1;
 187         return 1;
 188     }
 189
 190     return 0;
 191 }
 192
 193 #endif /* HAVE_NTRU */
 194
 195 /* used by ssl.c too */
 196 void c32to24(word32 in, word24 out)
 197 {
 198     out[0] = (in >> 16) & 0xff;
 199     out[1] = (in >>  8) & 0xff;
 200     out[2] =  in & 0xff;
 201 }
 202
 203
 204 #ifdef WOLFSSL_DTLS
 205
 206 static INLINE void c32to48(word32 in, byte out[6])
 207 {
 208     out[0] = 0;
 209     out[1] = 0;
 210     out[2] = (in >> 24) & 0xff;
 211     out[3] = (in >> 16) & 0xff;
 212     out[4] = (in >>  8) & 0xff;
 213     out[5] =  in & 0xff;
 214 }
 215
 216 #endif /* WOLFSSL_DTLS */
 217
 218
 219 /* convert 16 bit integer to opaque */
 220 static INLINE void c16toa(word16 u16, byte* c)
 221 {
 222     c[0] = (u16 >> 8) & 0xff;
 223     c[1] =  u16 & 0xff;
 224 }
 225
 226
 227 #if !defined(NO_OLD_TLS) || defined(HAVE_CHACHA) || defined(HAVE_AESCCM) \
 228     || defined(HAVE_AESGCM)
 229 /* convert 32 bit integer to opaque */
 230 static INLINE void c32toa(word32 u32, byte* c)
 231 {
 232     c[0] = (u32 >> 24) & 0xff;
 233     c[1] = (u32 >> 16) & 0xff;
 234     c[2] = (u32 >>  8) & 0xff;
 235     c[3] =  u32 & 0xff;
 236 }
 237 #endif
 238
 239
 240 /* convert a 24 bit integer into a 32 bit one */
 241 static INLINE void c24to32(const word24 u24, word32* u32)
 242 {
 243     *u32 = (u24[0] << 16) | (u24[1] << 8) | u24[2];
 244 }
 245
 246
 247 /* convert opaque to 16 bit integer */
 248 static INLINE void ato16(const byte* c, word16* u16)
 249 {
 250     *u16 = (word16) ((c[0] << 8) | (c[1]));
 251 }
 252
 253
 254 #if defined(WOLFSSL_DTLS) || defined(HAVE_SESSION_TICKET)
 255
 256 /* convert opaque to 32 bit integer */
 257 static INLINE void ato32(const byte* c, word32* u32)
 258 {
 259     *u32 = (c[0] << 24) | (c[1] << 16) | (c[2] << 8) | c[3];
 260 }
 261
 262 #endif /* WOLFSSL_DTLS */
 263
 264
 265 #ifdef HAVE_LIBZ
 266
 267     /* alloc user allocs to work with zlib */
 268     static void* myAlloc(void* opaque, unsigned int item, unsigned int size)
 269     {
 270         (void)opaque;
 271         return XMALLOC(item * size, opaque, DYNAMIC_TYPE_LIBZ);
 272     }
 273
 274
 275     static void myFree(void* opaque, void* memory)
 276     {
 277         (void)opaque;
 278         XFREE(memory, opaque, DYNAMIC_TYPE_LIBZ);
 279     }
 280
 281
 282     /* init zlib comp/decomp streams, 0 on success */
 283     static int InitStreams(WOLFSSL* ssl)
 284     {
 285         ssl->c_stream.zalloc = (alloc_func)myAlloc;
 286         ssl->c_stream.zfree  = (free_func)myFree;
 287         ssl->c_stream.opaque = (voidpf)ssl->heap;
 288
 289         if (deflateInit(&ssl->c_stream, Z_DEFAULT_COMPRESSION) != Z_OK)
 290             return ZLIB_INIT_ERROR;
 291
 292         ssl->didStreamInit = 1;
 293
 294         ssl->d_stream.zalloc = (alloc_func)myAlloc;
 295         ssl->d_stream.zfree  = (free_func)myFree;
 296         ssl->d_stream.opaque = (voidpf)ssl->heap;
 297
 298         if (inflateInit(&ssl->d_stream) != Z_OK) return ZLIB_INIT_ERROR;
 299
 300         return 0;
 301     }
 302
 303
 304     static void FreeStreams(WOLFSSL* ssl)
 305     {
 306         if (ssl->didStreamInit) {
 307             deflateEnd(&ssl->c_stream);
 308             inflateEnd(&ssl->d_stream);
 309         }
 310     }
 311
 312
 313     /* compress in to out, return out size or error */
 314     static int myCompress(WOLFSSL* ssl, byte* in, int inSz, byte* out, int outSz)
 315     {
 316         int    err;
 317         int    currTotal = (int)ssl->c_stream.total_out;
 318
 319         ssl->c_stream.next_in   = in;
 320         ssl->c_stream.avail_in  = inSz;
 321         ssl->c_stream.next_out  = out;
 322         ssl->c_stream.avail_out = outSz;
 323
 324         err = deflate(&ssl->c_stream, Z_SYNC_FLUSH);
 325         if (err != Z_OK && err != Z_STREAM_END) return ZLIB_COMPRESS_ERROR;
 326
 327         return (int)ssl->c_stream.total_out - currTotal;
 328     }
 329
 330
 331     /* decompress in to out, returnn out size or error */
 332     static int myDeCompress(WOLFSSL* ssl, byte* in,int inSz, byte* out,int outSz)
 333     {
 334         int    err;
 335         int    currTotal = (int)ssl->d_stream.total_out;
 336
 337         ssl->d_stream.next_in   = in;
 338         ssl->d_stream.avail_in  = inSz;
 339         ssl->d_stream.next_out  = out;
 340         ssl->d_stream.avail_out = outSz;
 341
 342         err = inflate(&ssl->d_stream, Z_SYNC_FLUSH);
 343         if (err != Z_OK && err != Z_STREAM_END) return ZLIB_DECOMPRESS_ERROR;
 344
 345         return (int)ssl->d_stream.total_out - currTotal;
 346     }
 347
 348 #endif /* HAVE_LIBZ */
 349
 350
 351 void InitSSL_Method(WOLFSSL_METHOD* method, ProtocolVersion pv)
 352 {
 353     method->version    = pv;
 354     method->side       = WOLFSSL_CLIENT_END;
 355     method->downgrade  = 0;
 356 }
 357
 358
 359 /* Initialze SSL context, return 0 on success */
 360 int InitSSL_Ctx(WOLFSSL_CTX* ctx, WOLFSSL_METHOD* method)
 361 {
 362     XMEMSET(ctx, 0, sizeof(WOLFSSL_CTX));
 363
 364     ctx->method   = method;
 365     ctx->refCount = 1;          /* so either CTX_free or SSL_free can release */
 366     ctx->heap     = ctx;        /* defaults to self */
 367     ctx->timeout  = WOLFSSL_SESSION_TIMEOUT;
 368     ctx->minDowngrade = TLSv1_MINOR;     /* current default */
 369
 370     if (InitMutex(&ctx->countMutex) < 0) {
 371         WOLFSSL_MSG("Mutex error on CTX init");
 372         return BAD_MUTEX_E;
 373     }
 374
 375 #ifndef NO_DH
 376     ctx->minDhKeySz = MIN_DHKEY_SZ;
 377 #endif
 378
 379 #ifdef HAVE_ECC
 380     ctx->eccTempKeySz = ECDHE_SIZE;
 381 #endif
 382
 383 #ifndef WOLFSSL_USER_IO
 384     ctx->CBIORecv = EmbedReceive;
 385     ctx->CBIOSend = EmbedSend;
 386     #ifdef WOLFSSL_DTLS
 387         if (method->version.major == DTLS_MAJOR) {
 388             ctx->CBIORecv   = EmbedReceiveFrom;
 389             ctx->CBIOSend   = EmbedSendTo;
 390             ctx->CBIOCookie = EmbedGenerateCookie;
 391         }
 392     #endif
 393 #endif /* WOLFSSL_USER_IO */
 394
 395 #ifdef HAVE_NETX
 396     ctx->CBIORecv = NetX_Receive;
 397     ctx->CBIOSend = NetX_Send;
 398 #endif
 399
 400 #ifdef HAVE_NTRU
 401     if (method->side == WOLFSSL_CLIENT_END)
 402         ctx->haveNTRU = 1;           /* always on cliet side */
 403                                      /* server can turn on by loading key */
 404 #endif
 405 #ifdef HAVE_ECC
 406     if (method->side == WOLFSSL_CLIENT_END) {
 407         ctx->haveECDSAsig  = 1;        /* always on cliet side */
 408         ctx->haveStaticECC = 1;        /* server can turn on by loading key */
 409     }
 410 #endif
 411
 412 #ifdef HAVE_CAVIUM
 413     ctx->devId = NO_CAVIUM_DEVICE;
 414 #endif
 415
 416 #ifndef NO_CERTS
 417     ctx->cm = wolfSSL_CertManagerNew();
 418     if (ctx->cm == NULL) {
 419         WOLFSSL_MSG("Bad Cert Manager New");
 420         return BAD_CERT_MANAGER_ERROR;
 421     }
 422 #endif
 423
 424 #if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER)
 425     ctx->ticketHint = SESSION_TICKET_HINT_DEFAULT;
 426 #endif
 427
 428     return 0;
 429 }
 430
 431
 432 /* In case contexts are held in array and don't want to free actual ctx */
 433 void SSL_CtxResourceFree(WOLFSSL_CTX* ctx)
 434 {
 435     XFREE(ctx->method, ctx->heap, DYNAMIC_TYPE_METHOD);
 436     if (ctx->suites)
 437         XFREE(ctx->suites, ctx->heap, DYNAMIC_TYPE_SUITES);
 438
 439 #ifndef NO_DH
 440     XFREE(ctx->serverDH_G.buffer, ctx->heap, DYNAMIC_TYPE_DH);
 441     XFREE(ctx->serverDH_P.buffer, ctx->heap, DYNAMIC_TYPE_DH);
 442 #endif
 443 #ifndef NO_CERTS
 444     XFREE(ctx->privateKey.buffer, ctx->heap, DYNAMIC_TYPE_KEY);
 445     XFREE(ctx->certificate.buffer, ctx->heap, DYNAMIC_TYPE_CERT);
 446     XFREE(ctx->certChain.buffer, ctx->heap, DYNAMIC_TYPE_CERT);
 447     wolfSSL_CertManagerFree(ctx->cm);
 448 #endif
 449 #ifdef HAVE_TLS_EXTENSIONS
 450     TLSX_FreeAll(ctx->extensions);
 451 #endif
 452 }
 453
 454
 455 void FreeSSL_Ctx(WOLFSSL_CTX* ctx)
 456 {
 457     int doFree = 0;
 458
 459     if (LockMutex(&ctx->countMutex) != 0) {
 460         WOLFSSL_MSG("Couldn't lock count mutex");
 461         return;
 462     }
 463     ctx->refCount--;
 464     if (ctx->refCount == 0)
 465         doFree = 1;
 466     UnLockMutex(&ctx->countMutex);
 467
 468     if (doFree) {
 469         WOLFSSL_MSG("CTX ref count down to 0, doing full free");
 470         SSL_CtxResourceFree(ctx);
 471         FreeMutex(&ctx->countMutex);
 472         XFREE(ctx, ctx->heap, DYNAMIC_TYPE_CTX);
 473     }
 474     else {
 475         (void)ctx;
 476         WOLFSSL_MSG("CTX ref count not 0 yet, no free");
 477     }
 478 }
 479
 480
 481 /* Set cipher pointers to null */
 482 void InitCiphers(WOLFSSL* ssl)
 483 {
 484 #ifdef BUILD_ARC4
 485     ssl->encrypt.arc4 = NULL;
 486     ssl->decrypt.arc4 = NULL;
 487 #endif
 488 #ifdef BUILD_DES3
 489     ssl->encrypt.des3 = NULL;
 490     ssl->decrypt.des3 = NULL;
 491 #endif
 492 #ifdef BUILD_AES
 493     ssl->encrypt.aes = NULL;
 494     ssl->decrypt.aes = NULL;
 495 #endif
 496 #ifdef HAVE_CAMELLIA
 497     ssl->encrypt.cam = NULL;
 498     ssl->decrypt.cam = NULL;
 499 #endif
 500 #ifdef HAVE_HC128
 501     ssl->encrypt.hc128 = NULL;
 502     ssl->decrypt.hc128 = NULL;
 503 #endif
 504 #ifdef BUILD_RABBIT
 505     ssl->encrypt.rabbit = NULL;
 506     ssl->decrypt.rabbit = NULL;
 507 #endif
 508 #ifdef HAVE_CHACHA
 509     ssl->encrypt.chacha = NULL;
 510     ssl->decrypt.chacha = NULL;
 511 #endif
 512 #ifdef HAVE_POLY1305
 513     ssl->auth.poly1305 = NULL;
 514 #endif
 515     ssl->encrypt.setup = 0;
 516     ssl->decrypt.setup = 0;
 517 #ifdef HAVE_ONE_TIME_AUTH
 518     ssl->auth.setup    = 0;
 519 #endif
 520 }
 521
 522
 523 /* Free ciphers */
 524 void FreeCiphers(WOLFSSL* ssl)
 525 {
 526     (void)ssl;
 527 #ifdef BUILD_ARC4
 528     #ifdef HAVE_CAVIUM
 529     if (ssl->devId != NO_CAVIUM_DEVICE) {
 530         wc_Arc4FreeCavium(ssl->encrypt.arc4);
 531         wc_Arc4FreeCavium(ssl->decrypt.arc4);
 532     }
 533     #endif
 534     XFREE(ssl->encrypt.arc4, ssl->heap, DYNAMIC_TYPE_CIPHER);
 535     XFREE(ssl->decrypt.arc4, ssl->heap, DYNAMIC_TYPE_CIPHER);
 536 #endif
 537 #ifdef BUILD_DES3
 538     #ifdef HAVE_CAVIUM
 539     if (ssl->devId != NO_CAVIUM_DEVICE) {
 540         wc_Des3_FreeCavium(ssl->encrypt.des3);
 541         wc_Des3_FreeCavium(ssl->decrypt.des3);
 542     }
 543     #endif
 544     XFREE(ssl->encrypt.des3, ssl->heap, DYNAMIC_TYPE_CIPHER);
 545     XFREE(ssl->decrypt.des3, ssl->heap, DYNAMIC_TYPE_CIPHER);
 546 #endif
 547 #ifdef BUILD_AES
 548     #ifdef HAVE_CAVIUM
 549     if (ssl->devId != NO_CAVIUM_DEVICE) {
 550         wc_AesFreeCavium(ssl->encrypt.aes);
 551         wc_AesFreeCavium(ssl->decrypt.aes);
 552     }
 553     #endif
 554     XFREE(ssl->encrypt.aes, ssl->heap, DYNAMIC_TYPE_CIPHER);
 555     XFREE(ssl->decrypt.aes, ssl->heap, DYNAMIC_TYPE_CIPHER);
 556 #endif
 557 #ifdef HAVE_CAMELLIA
 558     XFREE(ssl->encrypt.cam, ssl->heap, DYNAMIC_TYPE_CIPHER);
 559     XFREE(ssl->decrypt.cam, ssl->heap, DYNAMIC_TYPE_CIPHER);
 560 #endif
 561 #ifdef HAVE_HC128
 562     XFREE(ssl->encrypt.hc128, ssl->heap, DYNAMIC_TYPE_CIPHER);
 563     XFREE(ssl->decrypt.hc128, ssl->heap, DYNAMIC_TYPE_CIPHER);
 564 #endif
 565 #ifdef BUILD_RABBIT
 566     XFREE(ssl->encrypt.rabbit, ssl->heap, DYNAMIC_TYPE_CIPHER);
 567     XFREE(ssl->decrypt.rabbit, ssl->heap, DYNAMIC_TYPE_CIPHER);
 568 #endif
 569 #ifdef HAVE_CHACHA
 570     XFREE(ssl->encrypt.chacha, ssl->heap, DYNAMIC_TYPE_CIPHER);
 571     XFREE(ssl->decrypt.chacha, ssl->heap, DYNAMIC_TYPE_CIPHER);
 572 #endif
 573 #ifdef HAVE_POLY1305
 574     XFREE(ssl->auth.poly1305, ssl->heap, DYNAMIC_TYPE_CIPHER);
 575 #endif
 576 }
 577
 578
 579 void InitCipherSpecs(CipherSpecs* cs)
 580 {
 581     cs->bulk_cipher_algorithm = INVALID_BYTE;
 582     cs->cipher_type           = INVALID_BYTE;
 583     cs->mac_algorithm         = INVALID_BYTE;
 584     cs->kea                   = INVALID_BYTE;
 585     cs->sig_algo              = INVALID_BYTE;
 586
 587     cs->hash_size   = 0;
 588     cs->static_ecdh = 0;
 589     cs->key_size    = 0;
 590     cs->iv_size     = 0;
 591     cs->block_size  = 0;
 592 }
 593
 594 static void InitSuitesHashSigAlgo(Suites* suites, int haveECDSAsig,
 595                                                   int haveRSAsig, int haveAnon)
 596 {
 597     int idx = 0;
 598
 599     if (haveECDSAsig) {
 600         #ifdef WOLFSSL_SHA512
 601             suites->hashSigAlgo[idx++] = sha512_mac;
 602             suites->hashSigAlgo[idx++] = ecc_dsa_sa_algo;
 603         #endif
 604         #ifdef WOLFSSL_SHA384
 605             suites->hashSigAlgo[idx++] = sha384_mac;
 606             suites->hashSigAlgo[idx++] = ecc_dsa_sa_algo;
 607         #endif
 608         #ifndef NO_SHA256
 609             suites->hashSigAlgo[idx++] = sha256_mac;
 610             suites->hashSigAlgo[idx++] = ecc_dsa_sa_algo;
 611         #endif
 612         #ifndef NO_SHA
 613             suites->hashSigAlgo[idx++] = sha_mac;
 614             suites->hashSigAlgo[idx++] = ecc_dsa_sa_algo;
 615         #endif
 616     }
 617
 618     if (haveRSAsig) {
 619         #ifdef WOLFSSL_SHA512
 620             suites->hashSigAlgo[idx++] = sha512_mac;
 621             suites->hashSigAlgo[idx++] = rsa_sa_algo;
 622         #endif
 623         #ifdef WOLFSSL_SHA384
 624             suites->hashSigAlgo[idx++] = sha384_mac;
 625             suites->hashSigAlgo[idx++] = rsa_sa_algo;
 626         #endif
 627         #ifndef NO_SHA256
 628             suites->hashSigAlgo[idx++] = sha256_mac;
 629             suites->hashSigAlgo[idx++] = rsa_sa_algo;
 630         #endif
 631         #ifndef NO_SHA
 632             suites->hashSigAlgo[idx++] = sha_mac;
 633             suites->hashSigAlgo[idx++] = rsa_sa_algo;
 634         #endif
 635     }
 636
 637     if (haveAnon) {
 638         #ifdef HAVE_ANON
 639             suites->hashSigAlgo[idx++] = sha_mac;
 640             suites->hashSigAlgo[idx++] = anonymous_sa_algo;
 641         #endif
 642     }
 643
 644     suites->hashSigAlgoSz = (word16)idx;
 645 }
 646
 647 void InitSuites(Suites* suites, ProtocolVersion pv, word16 haveRSA,
 648                 word16 havePSK, word16 haveDH, word16 haveNTRU,
 649                 word16 haveECDSAsig, word16 haveStaticECC, int side)
 650 {
 651     word16 idx = 0;
 652     int    tls    = pv.major == SSLv3_MAJOR && pv.minor >= TLSv1_MINOR;
 653     int    tls1_2 = pv.major == SSLv3_MAJOR && pv.minor >= TLSv1_2_MINOR;
 654     int    haveRSAsig = 1;
 655
 656     (void)tls;  /* shut up compiler */
 657     (void)tls1_2;
 658     (void)haveDH;
 659     (void)havePSK;
 660     (void)haveNTRU;
 661     (void)haveStaticECC;
 662
 663     if (suites == NULL) {
 664         WOLFSSL_MSG("InitSuites pointer error");
 665         return;
 666     }
 667
 668     if (suites->setSuites)
 669         return;      /* trust user settings, don't override */
 670
 671     if (side == WOLFSSL_SERVER_END && haveStaticECC) {
 672         haveRSA = 0;   /* can't do RSA with ECDSA key */
 673         (void)haveRSA; /* some builds won't read */
 674     }
 675
 676     if (side == WOLFSSL_SERVER_END && haveECDSAsig) {
 677         haveRSAsig = 0;     /* can't have RSA sig if signed by ECDSA */
 678         (void)haveRSAsig;   /* non ecc builds won't read */
 679     }
 680
 681 #ifdef WOLFSSL_DTLS
 682     if (pv.major == DTLS_MAJOR) {
 683         tls    = 1;
 684         tls1_2 = pv.minor <= DTLSv1_2_MINOR;
 685     }
 686 #endif
 687
 688 #ifdef HAVE_RENEGOTIATION_INDICATION
 689     if (side == WOLFSSL_CLIENT_END) {
 690         suites->suites[idx++] = 0;
 691         suites->suites[idx++] = TLS_EMPTY_RENEGOTIATION_INFO_SCSV;
 692     }
 693 #endif
 694
 695 #ifdef BUILD_TLS_NTRU_RSA_WITH_AES_256_CBC_SHA
 696     if (tls && haveNTRU && haveRSA) {
 697         suites->suites[idx++] = 0;
 698         suites->suites[idx++] = TLS_NTRU_RSA_WITH_AES_256_CBC_SHA;
 699     }
 700 #endif
 701
 702 #ifdef BUILD_TLS_NTRU_RSA_WITH_AES_128_CBC_SHA
 703     if (tls && haveNTRU && haveRSA) {
 704         suites->suites[idx++] = 0;
 705         suites->suites[idx++] = TLS_NTRU_RSA_WITH_AES_128_CBC_SHA;
 706     }
 707 #endif
 708
 709 #ifdef BUILD_TLS_NTRU_RSA_WITH_RC4_128_SHA
 710     if (tls && haveNTRU && haveRSA) {
 711         suites->suites[idx++] = 0;
 712         suites->suites[idx++] = TLS_NTRU_RSA_WITH_RC4_128_SHA;
 713     }
 714 #endif
 715
 716 #ifdef BUILD_TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA
 717     if (tls && haveNTRU && haveRSA) {
 718         suites->suites[idx++] = 0;
 719         suites->suites[idx++] = TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA;
 720     }
 721 #endif
 722
 723 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 724     if (tls1_2 && haveECDSAsig) {
 725         suites->suites[idx++] = ECC_BYTE;
 726         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384;
 727     }
 728 #endif
 729
 730 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 731     if (tls1_2 && haveECDSAsig) {
 732         suites->suites[idx++] = ECC_BYTE;
 733         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256;
 734     }
 735 #endif
 736
 737 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
 738     if (tls1_2 && haveRSA) {
 739         suites->suites[idx++] = ECC_BYTE;
 740         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384;
 741     }
 742 #endif
 743
 744 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 745     if (tls1_2 && haveRSA) {
 746         suites->suites[idx++] = ECC_BYTE;
 747         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256;
 748     }
 749 #endif
 750
 751 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
 752     if (tls1_2 && haveDH && haveRSA) {
 753         suites->suites[idx++] = 0;
 754         suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_256_GCM_SHA384;
 755     }
 756 #endif
 757
 758 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
 759     if (tls1_2 && haveDH && haveRSA) {
 760         suites->suites[idx++] = 0;
 761         suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_128_GCM_SHA256;
 762     }
 763 #endif
 764
 765 #ifdef BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384
 766     if (tls1_2 && haveRSA) {
 767         suites->suites[idx++] = 0;
 768         suites->suites[idx++] = TLS_RSA_WITH_AES_256_GCM_SHA384;
 769     }
 770 #endif
 771
 772 #ifdef BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256
 773     if (tls1_2 && haveRSA) {
 774         suites->suites[idx++] = 0;
 775         suites->suites[idx++] = TLS_RSA_WITH_AES_128_GCM_SHA256;
 776     }
 777 #endif
 778
 779 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
 780     if (tls1_2 && haveECDSAsig && haveStaticECC) {
 781         suites->suites[idx++] = ECC_BYTE;
 782         suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384;
 783     }
 784 #endif
 785
 786 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
 787     if (tls1_2 && haveECDSAsig && haveStaticECC) {
 788         suites->suites[idx++] = ECC_BYTE;
 789         suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256;
 790     }
 791 #endif
 792
 793 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
 794     if (tls1_2 && haveRSAsig && haveStaticECC) {
 795         suites->suites[idx++] = ECC_BYTE;
 796         suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384;
 797     }
 798 #endif
 799
 800 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
 801     if (tls1_2 && haveRSAsig && haveStaticECC) {
 802         suites->suites[idx++] = ECC_BYTE;
 803         suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256;
 804     }
 805 #endif
 806
 807 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
 808     if (tls1_2 && haveDH && havePSK) {
 809         suites->suites[idx++] = 0;
 810         suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_256_GCM_SHA384;
 811     }
 812 #endif
 813
 814 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
 815     if (tls1_2 && haveDH && havePSK) {
 816         suites->suites[idx++] = 0;
 817         suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_128_GCM_SHA256;
 818     }
 819 #endif
 820
 821 #ifdef BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384
 822     if (tls1_2 && havePSK) {
 823         suites->suites[idx++] = 0;
 824         suites->suites[idx++] = TLS_PSK_WITH_AES_256_GCM_SHA384;
 825     }
 826 #endif
 827
 828 #ifdef BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256
 829     if (tls1_2 && havePSK) {
 830         suites->suites[idx++] = 0;
 831         suites->suites[idx++] = TLS_PSK_WITH_AES_128_GCM_SHA256;
 832     }
 833 #endif
 834
 835 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
 836     if (tls1_2 && haveECDSAsig) {
 837         suites->suites[idx++] = CHACHA_BYTE;
 838         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256;
 839     }
 840 #endif
 841
 842 #ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 843     if (tls && haveRSA) {
 844         suites->suites[idx++] = CHACHA_BYTE;
 845         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256;
 846     }
 847 #endif
 848
 849 #ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
 850     if (tls && haveRSA) {
 851         suites->suites[idx++] = CHACHA_BYTE;
 852         suites->suites[idx++] = TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256;
 853     }
 854 #endif
 855
 856 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 857     if (tls1_2 && haveRSAsig) {
 858         suites->suites[idx++] = ECC_BYTE;
 859         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256;
 860     }
 861 #endif
 862
 863 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
 864     if (tls1_2 && haveECDSAsig) {
 865         suites->suites[idx++] = ECC_BYTE;
 866         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256;
 867     }
 868 #endif
 869
 870 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
 871     if (tls1_2 && haveRSAsig && haveStaticECC) {
 872         suites->suites[idx++] = ECC_BYTE;
 873         suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256;
 874     }
 875 #endif
 876
 877 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
 878     if (tls1_2 && haveECDSAsig && haveStaticECC) {
 879         suites->suites[idx++] = ECC_BYTE;
 880         suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256;
 881     }
 882 #endif
 883
 884 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 885     if (tls1_2 && haveRSAsig) {
 886         suites->suites[idx++] = ECC_BYTE;
 887         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384;
 888     }
 889 #endif
 890
 891 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
 892     if (tls1_2 && haveECDSAsig) {
 893         suites->suites[idx++] = ECC_BYTE;
 894         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384;
 895     }
 896 #endif
 897
 898 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
 899     if (tls1_2 && haveRSAsig && haveStaticECC) {
 900         suites->suites[idx++] = ECC_BYTE;
 901         suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384;
 902     }
 903 #endif
 904
 905 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
 906     if (tls1_2 && haveECDSAsig && haveStaticECC) {
 907         suites->suites[idx++] = ECC_BYTE;
 908         suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384;
 909     }
 910 #endif
 911
 912 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
 913     if (tls && haveECDSAsig) {
 914         suites->suites[idx++] = ECC_BYTE;
 915         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA;
 916     }
 917 #endif
 918
 919 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
 920     if (tls && haveECDSAsig && haveStaticECC) {
 921         suites->suites[idx++] = ECC_BYTE;
 922         suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA;
 923     }
 924 #endif
 925
 926 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
 927     if (tls && haveECDSAsig) {
 928         suites->suites[idx++] = ECC_BYTE;
 929         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA;
 930     }
 931 #endif
 932
 933 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
 934     if (tls && haveECDSAsig && haveStaticECC) {
 935         suites->suites[idx++] = ECC_BYTE;
 936         suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA;
 937     }
 938 #endif
 939
 940 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
 941     if (tls && haveECDSAsig) {
 942         suites->suites[idx++] = ECC_BYTE;
 943         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_RC4_128_SHA;
 944     }
 945 #endif
 946
 947 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
 948     if (tls && haveECDSAsig && haveStaticECC) {
 949         suites->suites[idx++] = ECC_BYTE;
 950         suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_RC4_128_SHA;
 951     }
 952 #endif
 953
 954 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
 955     if (tls && haveECDSAsig) {
 956         suites->suites[idx++] = ECC_BYTE;
 957         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA;
 958     }
 959 #endif
 960
 961 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
 962     if (tls && haveECDSAsig && haveStaticECC) {
 963         suites->suites[idx++] = ECC_BYTE;
 964         suites->suites[idx++] = TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA;
 965     }
 966 #endif
 967
 968 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
 969     if (tls && haveRSA) {
 970         suites->suites[idx++] = ECC_BYTE;
 971         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA;
 972     }
 973 #endif
 974
 975 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
 976     if (tls && haveRSAsig && haveStaticECC) {
 977         suites->suites[idx++] = ECC_BYTE;
 978         suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_256_CBC_SHA;
 979     }
 980 #endif
 981
 982 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
 983     if (tls && haveRSA) {
 984         suites->suites[idx++] = ECC_BYTE;
 985         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA;
 986     }
 987 #endif
 988
 989 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
 990     if (tls && haveRSAsig && haveStaticECC) {
 991         suites->suites[idx++] = ECC_BYTE;
 992         suites->suites[idx++] = TLS_ECDH_RSA_WITH_AES_128_CBC_SHA;
 993     }
 994 #endif
 995
 996 #ifdef BUILD_TLS_ECDHE_RSA_WITH_RC4_128_SHA
 997     if (tls && haveRSA) {
 998         suites->suites[idx++] = ECC_BYTE;
 999         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_RC4_128_SHA;
1000     }
1001 #endif
1002
1003 #ifdef BUILD_TLS_ECDH_RSA_WITH_RC4_128_SHA
1004     if (tls && haveRSAsig && haveStaticECC) {
1005         suites->suites[idx++] = ECC_BYTE;
1006         suites->suites[idx++] = TLS_ECDH_RSA_WITH_RC4_128_SHA;
1007     }
1008 #endif
1009
1010 #ifdef BUILD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
1011     if (tls && haveRSA) {
1012         suites->suites[idx++] = ECC_BYTE;
1013         suites->suites[idx++] = TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA;
1014     }
1015 #endif
1016
1017 #ifdef BUILD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
1018     if (tls && haveRSAsig && haveStaticECC) {
1019         suites->suites[idx++] = ECC_BYTE;
1020         suites->suites[idx++] = TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA;
1021     }
1022 #endif
1023
1024 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
1025     if (tls1_2 && haveECDSAsig) {
1026         suites->suites[idx++] = ECC_BYTE;
1027         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8;
1028     }
1029 #endif
1030
1031 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8
1032     if (tls1_2 && haveECDSAsig) {
1033         suites->suites[idx++] = ECC_BYTE;
1034         suites->suites[idx++] = TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8;
1035     }
1036 #endif
1037
1038 #ifdef BUILD_TLS_RSA_WITH_AES_128_CCM_8
1039     if (tls1_2 && haveRSA) {
1040         suites->suites[idx++] = ECC_BYTE;
1041         suites->suites[idx++] = TLS_RSA_WITH_AES_128_CCM_8;
1042     }
1043 #endif
1044
1045 #ifdef BUILD_TLS_RSA_WITH_AES_256_CCM_8
1046     if (tls1_2 && haveRSA) {
1047         suites->suites[idx++] = ECC_BYTE;
1048         suites->suites[idx++] = TLS_RSA_WITH_AES_256_CCM_8;
1049     }
1050 #endif
1051
1052 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
1053     if (tls1_2 && haveDH && haveRSA) {
1054         suites->suites[idx++] = 0;
1055         suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA256;
1056     }
1057 #endif
1058
1059 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
1060     if (tls1_2 && haveDH && haveRSA) {
1061         suites->suites[idx++] = 0;
1062         suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA256;
1063     }
1064 #endif
1065
1066 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
1067     if (tls && haveDH && haveRSA) {
1068         suites->suites[idx++] = 0;
1069         suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_256_CBC_SHA;
1070     }
1071 #endif
1072
1073 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
1074     if (tls && haveDH && haveRSA) {
1075         suites->suites[idx++] = 0;
1076         suites->suites[idx++] = TLS_DHE_RSA_WITH_AES_128_CBC_SHA;
1077     }
1078 #endif
1079
1080 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA256
1081     if (tls1_2 && haveRSA) {
1082         suites->suites[idx++] = 0;
1083         suites->suites[idx++] = TLS_RSA_WITH_AES_256_CBC_SHA256;
1084     }
1085 #endif
1086
1087 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256
1088     if (tls1_2 && haveRSA) {
1089         suites->suites[idx++] = 0;
1090         suites->suites[idx++] = TLS_RSA_WITH_AES_128_CBC_SHA256;
1091     }
1092 #endif
1093
1094 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA
1095     if (tls && haveRSA) {
1096         suites->suites[idx++] = 0;
1097         suites->suites[idx++] = TLS_RSA_WITH_AES_256_CBC_SHA;
1098     }
1099 #endif
1100
1101 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA
1102     if (tls && haveRSA) {
1103         suites->suites[idx++] = 0;
1104         suites->suites[idx++] = TLS_RSA_WITH_AES_128_CBC_SHA;
1105     }
1106 #endif
1107
1108 #ifdef BUILD_TLS_RSA_WITH_NULL_SHA
1109     if (tls && haveRSA) {
1110         suites->suites[idx++] = 0;
1111         suites->suites[idx++] = TLS_RSA_WITH_NULL_SHA;
1112     }
1113 #endif
1114
1115 #ifdef BUILD_TLS_RSA_WITH_NULL_SHA256
1116     if (tls && haveRSA) {
1117         suites->suites[idx++] = 0;
1118         suites->suites[idx++] = TLS_RSA_WITH_NULL_SHA256;
1119     }
1120 #endif
1121
1122 #ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA
1123     if (tls && havePSK) {
1124         suites->suites[idx++] = 0;
1125         suites->suites[idx++] = TLS_PSK_WITH_AES_256_CBC_SHA;
1126     }
1127 #endif
1128
1129 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
1130     if (tls && haveDH && havePSK) {
1131         suites->suites[idx++] = 0;
1132         suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_256_CBC_SHA384;
1133     }
1134 #endif
1135
1136 #ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384
1137     if (tls && havePSK) {
1138         suites->suites[idx++] = 0;
1139         suites->suites[idx++] = TLS_PSK_WITH_AES_256_CBC_SHA384;
1140     }
1141 #endif
1142
1143 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
1144     if (tls && haveDH && havePSK) {
1145         suites->suites[idx++] = 0;
1146         suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_128_CBC_SHA256;
1147     }
1148 #endif
1149
1150 #ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256
1151     if (tls && havePSK) {
1152         suites->suites[idx++] = 0;
1153         suites->suites[idx++] = TLS_PSK_WITH_AES_128_CBC_SHA256;
1154     }
1155 #endif
1156
1157 #ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA
1158     if (tls && havePSK) {
1159         suites->suites[idx++] = 0;
1160         suites->suites[idx++] = TLS_PSK_WITH_AES_128_CBC_SHA;
1161     }
1162 #endif
1163
1164 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CCM
1165     if (tls && haveDH && havePSK) {
1166         suites->suites[idx++] = ECC_BYTE;
1167         suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_128_CCM;
1168     }
1169 #endif
1170
1171 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CCM
1172     if (tls && haveDH && havePSK) {
1173         suites->suites[idx++] = ECC_BYTE;
1174         suites->suites[idx++] = TLS_DHE_PSK_WITH_AES_256_CCM;
1175     }
1176 #endif
1177
1178 #ifdef BUILD_TLS_PSK_WITH_AES_128_CCM
1179     if (tls && havePSK) {
1180         suites->suites[idx++] = ECC_BYTE;
1181         suites->suites[idx++] = TLS_PSK_WITH_AES_128_CCM;
1182     }
1183 #endif
1184
1185 #ifdef BUILD_TLS_PSK_WITH_AES_256_CCM
1186     if (tls && havePSK) {
1187         suites->suites[idx++] = ECC_BYTE;
1188         suites->suites[idx++] = TLS_PSK_WITH_AES_256_CCM;
1189     }
1190 #endif
1191
1192 #ifdef BUILD_TLS_PSK_WITH_AES_128_CCM_8
1193     if (tls && havePSK) {
1194         suites->suites[idx++] = ECC_BYTE;
1195         suites->suites[idx++] = TLS_PSK_WITH_AES_128_CCM_8;
1196     }
1197 #endif
1198
1199 #ifdef BUILD_TLS_PSK_WITH_AES_256_CCM_8
1200     if (tls && havePSK) {
1201         suites->suites[idx++] = ECC_BYTE;
1202         suites->suites[idx++] = TLS_PSK_WITH_AES_256_CCM_8;
1203     }
1204 #endif
1205
1206 #ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA384
1207     if (tls && haveDH && havePSK) {
1208         suites->suites[idx++] = 0;
1209         suites->suites[idx++] = TLS_DHE_PSK_WITH_NULL_SHA384;
1210     }
1211 #endif
1212
1213 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA384
1214     if (tls && havePSK) {
1215         suites->suites[idx++] = 0;
1216         suites->suites[idx++] = TLS_PSK_WITH_NULL_SHA384;
1217     }
1218 #endif
1219
1220 #ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA256
1221     if (tls && haveDH && havePSK) {
1222         suites->suites[idx++] = 0;
1223         suites->suites[idx++] = TLS_DHE_PSK_WITH_NULL_SHA256;
1224     }
1225 #endif
1226
1227 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA256
1228     if (tls && havePSK) {
1229         suites->suites[idx++] = 0;
1230         suites->suites[idx++] = TLS_PSK_WITH_NULL_SHA256;
1231     }
1232 #endif
1233
1234 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA
1235     if (tls && havePSK) {
1236         suites->suites[idx++] = 0;
1237         suites->suites[idx++] = TLS_PSK_WITH_NULL_SHA;
1238     }
1239 #endif
1240
1241 #ifdef BUILD_SSL_RSA_WITH_RC4_128_SHA
1242     if (haveRSA ) {
1243         suites->suites[idx++] = 0;
1244         suites->suites[idx++] = SSL_RSA_WITH_RC4_128_SHA;
1245     }
1246 #endif
1247
1248 #ifdef BUILD_SSL_RSA_WITH_RC4_128_MD5
1249     if (haveRSA ) {
1250         suites->suites[idx++] = 0;
1251         suites->suites[idx++] = SSL_RSA_WITH_RC4_128_MD5;
1252     }
1253 #endif
1254
1255 #ifdef BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA
1256     if (haveRSA ) {
1257         suites->suites[idx++] = 0;
1258         suites->suites[idx++] = SSL_RSA_WITH_3DES_EDE_CBC_SHA;
1259     }
1260 #endif
1261
1262 #ifdef BUILD_TLS_RSA_WITH_HC_128_MD5
1263     if (tls && haveRSA) {
1264         suites->suites[idx++] = 0;
1265         suites->suites[idx++] = TLS_RSA_WITH_HC_128_MD5;
1266     }
1267 #endif
1268
1269 #ifdef BUILD_TLS_RSA_WITH_HC_128_SHA
1270     if (tls && haveRSA) {
1271         suites->suites[idx++] = 0;
1272         suites->suites[idx++] = TLS_RSA_WITH_HC_128_SHA;
1273     }
1274 #endif
1275
1276 #ifdef BUILD_TLS_RSA_WITH_HC_128_B2B256
1277     if (tls && haveRSA) {
1278         suites->suites[idx++] = 0;
1279         suites->suites[idx++] = TLS_RSA_WITH_HC_128_B2B256;
1280     }
1281 #endif
1282
1283 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_B2B256
1284     if (tls && haveRSA) {
1285         suites->suites[idx++] = 0;
1286         suites->suites[idx++] = TLS_RSA_WITH_AES_128_CBC_B2B256;
1287     }
1288 #endif
1289
1290 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_B2B256
1291     if (tls && haveRSA) {
1292         suites->suites[idx++] = 0;
1293         suites->suites[idx++] = TLS_RSA_WITH_AES_256_CBC_B2B256;
1294     }
1295 #endif
1296
1297 #ifdef BUILD_TLS_RSA_WITH_RABBIT_SHA
1298     if (tls && haveRSA) {
1299         suites->suites[idx++] = 0;
1300         suites->suites[idx++] = TLS_RSA_WITH_RABBIT_SHA;
1301     }
1302 #endif
1303
1304 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
1305     if (tls && haveRSA) {
1306         suites->suites[idx++] = 0;
1307         suites->suites[idx++] = TLS_RSA_WITH_CAMELLIA_128_CBC_SHA;
1308     }
1309 #endif
1310
1311 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
1312     if (tls && haveDH && haveRSA) {
1313         suites->suites[idx++] = 0;
1314         suites->suites[idx++] = TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA;
1315     }
1316 #endif
1317
1318 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
1319     if (tls && haveRSA) {
1320         suites->suites[idx++] = 0;
1321         suites->suites[idx++] = TLS_RSA_WITH_CAMELLIA_256_CBC_SHA;
1322     }
1323 #endif
1324
1325 #ifdef BUILD_TLS_DHE_WITH_RSA_CAMELLIA_256_CBC_SHA
1326     if (tls && haveDH && haveRSA) {
1327         suites->suites[idx++] = 0;
1328         suites->suites[idx++] = TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA;
1329     }
1330 #endif
1331
1332 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
1333     if (tls && haveRSA) {
1334         suites->suites[idx++] = 0;
1335         suites->suites[idx++] = TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256;
1336     }
1337 #endif
1338
1339 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
1340     if (tls && haveDH && haveRSA) {
1341         suites->suites[idx++] = 0;
1342         suites->suites[idx++] = TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256;
1343     }
1344 #endif
1345
1346 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
1347     if (tls && haveRSA) {
1348         suites->suites[idx++] = 0;
1349         suites->suites[idx++] = TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256;
1350     }
1351 #endif
1352
1353 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
1354     if (tls && haveDH && haveRSA) {
1355         suites->suites[idx++] = 0;
1356         suites->suites[idx++] = TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256;
1357     }
1358 #endif
1359
1360     suites->suiteSz = idx;
1361
1362     InitSuitesHashSigAlgo(suites, haveECDSAsig, haveRSAsig, 0);
1363 }
1364
1365
1366 #ifndef NO_CERTS
1367
1368
1369 void InitX509Name(WOLFSSL_X509_NAME* name, int dynamicFlag)
1370 {
1371     (void)dynamicFlag;
1372
1373     if (name != NULL) {
1374         name->name        = name->staticName;
1375         name->dynamicName = 0;
1376 #ifdef OPENSSL_EXTRA
1377         XMEMSET(&name->fullName, 0, sizeof(DecodedName));
1378 #endif /* OPENSSL_EXTRA */
1379     }
1380 }
1381
1382
1383 void FreeX509Name(WOLFSSL_X509_NAME* name)
1384 {
1385     if (name != NULL) {
1386         if (name->dynamicName)
1387             XFREE(name->name, NULL, DYNAMIC_TYPE_SUBJECT_CN);
1388 #ifdef OPENSSL_EXTRA
1389         if (name->fullName.fullName != NULL)
1390             XFREE(name->fullName.fullName, NULL, DYNAMIC_TYPE_X509);
1391 #endif /* OPENSSL_EXTRA */
1392     }
1393 }
1394
1395
1396 /* Initialize wolfSSL X509 type */
1397 void InitX509(WOLFSSL_X509* x509, int dynamicFlag)
1398 {
1399     InitX509Name(&x509->issuer, 0);
1400     InitX509Name(&x509->subject, 0);
1401     x509->version        = 0;
1402     x509->pubKey.buffer  = NULL;
1403     x509->sig.buffer     = NULL;
1404     x509->derCert.buffer = NULL;
1405     x509->altNames       = NULL;
1406     x509->altNamesNext   = NULL;
1407     x509->dynamicMemory  = (byte)dynamicFlag;
1408     x509->isCa           = 0;
1409 #ifdef HAVE_ECC
1410     x509->pkCurveOID = 0;
1411 #endif /* HAVE_ECC */
1412 #ifdef OPENSSL_EXTRA
1413     x509->pathLength     = 0;
1414     x509->basicConstSet  = 0;
1415     x509->basicConstCrit = 0;
1416     x509->basicConstPlSet = 0;
1417     x509->subjAltNameSet = 0;
1418     x509->subjAltNameCrit = 0;
1419     x509->authKeyIdSet   = 0;
1420     x509->authKeyIdCrit  = 0;
1421     x509->authKeyId      = NULL;
1422     x509->authKeyIdSz    = 0;
1423     x509->subjKeyIdSet   = 0;
1424     x509->subjKeyIdCrit  = 0;
1425     x509->subjKeyId      = NULL;
1426     x509->subjKeyIdSz    = 0;
1427     x509->keyUsageSet    = 0;
1428     x509->keyUsageCrit   = 0;
1429     x509->keyUsage       = 0;
1430     #ifdef WOLFSSL_SEP
1431         x509->certPolicySet  = 0;
1432         x509->certPolicyCrit = 0;
1433     #endif /* WOLFSSL_SEP */
1434 #endif /* OPENSSL_EXTRA */
1435 }
1436
1437
1438 /* Free wolfSSL X509 type */
1439 void FreeX509(WOLFSSL_X509* x509)
1440 {
1441     if (x509 == NULL)
1442         return;
1443
1444     FreeX509Name(&x509->issuer);
1445     FreeX509Name(&x509->subject);
1446     if (x509->pubKey.buffer)
1447         XFREE(x509->pubKey.buffer, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
1448     XFREE(x509->derCert.buffer, NULL, DYNAMIC_TYPE_SUBJECT_CN);
1449     XFREE(x509->sig.buffer, NULL, DYNAMIC_TYPE_SIGNATURE);
1450     #ifdef OPENSSL_EXTRA
1451         XFREE(x509->authKeyId, NULL, 0);
1452         XFREE(x509->subjKeyId, NULL, 0);
1453     #endif /* OPENSSL_EXTRA */
1454     if (x509->altNames)
1455         FreeAltNames(x509->altNames, NULL);
1456     if (x509->dynamicMemory)
1457         XFREE(x509, NULL, DYNAMIC_TYPE_X509);
1458 }
1459
1460 #endif /* NO_CERTS */
1461
1462
1463 /* init everything to 0, NULL, default values before calling anything that may
1464    fail so that desctructor has a "good" state to cleanup */
1465 int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
1466 {
1467     int  ret;
1468     byte haveRSA = 0;
1469     byte havePSK = 0;
1470     byte haveAnon = 0;
1471
1472     (void) haveAnon;
1473
1474     XMEMSET(ssl, 0, sizeof(WOLFSSL));
1475
1476     ssl->ctx     = ctx; /* only for passing to calls, options could change */
1477     ssl->version = ctx->method->version;
1478
1479 #ifndef NO_RSA
1480     haveRSA = 1;
1481 #endif
1482
1483     ssl->buffers.inputBuffer.buffer = ssl->buffers.inputBuffer.staticBuffer;
1484     ssl->buffers.inputBuffer.bufferSize  = STATIC_BUFFER_LEN;
1485
1486     ssl->buffers.outputBuffer.buffer = ssl->buffers.outputBuffer.staticBuffer;
1487     ssl->buffers.outputBuffer.bufferSize  = STATIC_BUFFER_LEN;
1488
1489 #ifdef KEEP_PEER_CERT
1490     InitX509(&ssl->peerCert, 0);
1491 #endif
1492
1493 #ifdef HAVE_ECC
1494     ssl->eccTempKeySz = ctx->eccTempKeySz;
1495     ssl->pkCurveOID = ctx->pkCurveOID;
1496 #endif
1497
1498     ssl->timeout = ctx->timeout;
1499     ssl->rfd = -1;   /* set to invalid descriptor */
1500     ssl->wfd = -1;
1501
1502     ssl->IOCB_ReadCtx  = &ssl->rfd;  /* prevent invalid pointer access if not */
1503     ssl->IOCB_WriteCtx = &ssl->wfd;  /* correctly set */
1504
1505 #ifdef HAVE_NETX
1506     ssl->IOCB_ReadCtx  = &ssl->nxCtx;  /* default NetX IO ctx, same for read */
1507     ssl->IOCB_WriteCtx = &ssl->nxCtx;  /* and write */
1508 #endif
1509 #ifdef WOLFSSL_DTLS
1510     ssl->dtls_expected_rx = MAX_MTU;
1511 #endif
1512
1513     ssl->verifyCallback    = ctx->verifyCallback;
1514     ssl->options.side      = ctx->method->side;
1515     ssl->options.downgrade    = ctx->method->downgrade;
1516     ssl->options.minDowngrade = ctx->minDowngrade;
1517
1518     if (ssl->options.side == WOLFSSL_SERVER_END)
1519         ssl->options.haveDH = ctx->haveDH;
1520
1521     ssl->options.haveNTRU      = ctx->haveNTRU;
1522     ssl->options.haveECDSAsig  = ctx->haveECDSAsig;
1523     ssl->options.haveStaticECC = ctx->haveStaticECC;
1524
1525 #ifndef NO_PSK
1526     havePSK = ctx->havePSK;
1527     ssl->options.havePSK   = ctx->havePSK;
1528     ssl->options.client_psk_cb = ctx->client_psk_cb;
1529     ssl->options.server_psk_cb = ctx->server_psk_cb;
1530 #endif /* NO_PSK */
1531
1532 #ifdef HAVE_ANON
1533     haveAnon = ctx->haveAnon;
1534     ssl->options.haveAnon = ctx->haveAnon;
1535 #endif
1536
1537     ssl->options.serverState = NULL_STATE;
1538     ssl->options.clientState = NULL_STATE;
1539     ssl->options.connectState = CONNECT_BEGIN;
1540     ssl->options.acceptState  = ACCEPT_BEGIN;
1541     ssl->options.handShakeState  = NULL_STATE;
1542     ssl->options.processReply = doProcessInit;
1543
1544 #ifndef NO_DH
1545     ssl->options.minDhKeySz = ctx->minDhKeySz;
1546 #endif
1547
1548 #ifdef WOLFSSL_DTLS
1549     ssl->dtls_timeout_init              = DTLS_TIMEOUT_INIT;
1550     ssl->dtls_timeout_max               = DTLS_TIMEOUT_MAX;
1551     ssl->dtls_timeout                   = ssl->dtls_timeout_init;
1552 #endif
1553
1554     ssl->options.sessionCacheOff      = ctx->sessionCacheOff;
1555     ssl->options.sessionCacheFlushOff = ctx->sessionCacheFlushOff;
1556
1557     ssl->options.verifyPeer = ctx->verifyPeer;
1558     ssl->options.verifyNone = ctx->verifyNone;
1559     ssl->options.failNoCert = ctx->failNoCert;
1560     ssl->options.sendVerify = ctx->sendVerify;
1561
1562     #ifndef NO_OLD_TLS
1563         ssl->hmac = SSL_hmac; /* default to SSLv3 */
1564     #else
1565         ssl->hmac = TLS_hmac;
1566     #endif
1567
1568     ssl->heap = ctx->heap;    /* defaults to self */
1569
1570     ssl->options.dtls = ssl->version.major == DTLS_MAJOR;
1571     ssl->options.partialWrite  = ctx->partialWrite;
1572     ssl->options.quietShutdown = ctx->quietShutdown;
1573     ssl->options.groupMessages = ctx->groupMessages;
1574
1575 #ifndef NO_DH
1576     if (ssl->options.side == WOLFSSL_SERVER_END) {
1577         ssl->buffers.serverDH_P = ctx->serverDH_P;
1578         ssl->buffers.serverDH_G = ctx->serverDH_G;
1579     }
1580 #endif
1581 #ifndef NO_CERTS
1582     /* ctx still owns certificate, certChain, key, dh, and cm */
1583     ssl->buffers.certificate = ctx->certificate;
1584     ssl->buffers.certChain = ctx->certChain;
1585     ssl->buffers.key = ctx->privateKey;
1586 #endif
1587
1588 #ifdef WOLFSSL_DTLS
1589     ssl->buffers.dtlsCtx.fd = -1;
1590 #endif
1591
1592     ssl->cipher.ssl = ssl;
1593
1594 #ifdef HAVE_CAVIUM
1595     ssl->devId = ctx->devId;
1596 #endif
1597
1598 #ifdef HAVE_TLS_EXTENSIONS
1599 #ifdef HAVE_MAX_FRAGMENT
1600     ssl->max_fragment = MAX_RECORD_SIZE;
1601 #endif
1602 #endif
1603
1604     /* default alert state (none) */
1605     ssl->alert_history.last_rx.code  = -1;
1606     ssl->alert_history.last_rx.level = -1;
1607     ssl->alert_history.last_tx.code  = -1;
1608     ssl->alert_history.last_tx.level = -1;
1609
1610     InitCiphers(ssl);
1611     InitCipherSpecs(&ssl->specs);
1612
1613     /* all done with init, now can return errors, call other stuff */
1614
1615     /* hsHashes */
1616     ssl->hsHashes = (HS_Hashes*)XMALLOC(sizeof(HS_Hashes), ssl->heap,
1617                                                            DYNAMIC_TYPE_HASHES);
1618     if (ssl->hsHashes == NULL) {
1619         WOLFSSL_MSG("HS_Hashes Memory error");
1620         return MEMORY_E;
1621     }
1622
1623 #ifndef NO_OLD_TLS
1624 #ifndef NO_MD5
1625     wc_InitMd5(&ssl->hsHashes->hashMd5);
1626 #endif
1627 #ifndef NO_SHA
1628     ret = wc_InitSha(&ssl->hsHashes->hashSha);
1629     if (ret != 0) {
1630         return ret;
1631     }
1632 #endif
1633 #endif
1634 #ifndef NO_SHA256
1635     ret = wc_InitSha256(&ssl->hsHashes->hashSha256);
1636     if (ret != 0) {
1637         return ret;
1638     }
1639 #endif
1640 #ifdef WOLFSSL_SHA384
1641     ret = wc_InitSha384(&ssl->hsHashes->hashSha384);
1642     if (ret != 0) {
1643         return ret;
1644     }
1645 #endif
1646 #ifdef WOLFSSL_SHA512
1647     ret = wc_InitSha512(&ssl->hsHashes->hashSha512);
1648     if (ret != 0) {
1649         return ret;
1650     }
1651 #endif
1652
1653     /* increment CTX reference count */
1654     if (LockMutex(&ctx->countMutex) != 0) {
1655         WOLFSSL_MSG("Couldn't lock CTX count mutex");
1656         return BAD_MUTEX_E;
1657     }
1658     ctx->refCount++;
1659     UnLockMutex(&ctx->countMutex);
1660
1661     /* arrays */
1662     ssl->arrays = (Arrays*)XMALLOC(sizeof(Arrays), ssl->heap,
1663                                                            DYNAMIC_TYPE_ARRAYS);
1664     if (ssl->arrays == NULL) {
1665         WOLFSSL_MSG("Arrays Memory error");
1666         return MEMORY_E;
1667     }
1668     XMEMSET(ssl->arrays, 0, sizeof(Arrays));
1669
1670 #ifndef NO_PSK
1671     if (ctx->server_hint[0]) {   /* set in CTX */
1672         XSTRNCPY(ssl->arrays->server_hint, ctx->server_hint, MAX_PSK_ID_LEN);
1673         ssl->arrays->server_hint[MAX_PSK_ID_LEN - 1] = '\0';
1674     }
1675 #endif /* NO_PSK */
1676
1677     /* RNG */
1678     ssl->rng = (RNG*)XMALLOC(sizeof(RNG), ssl->heap, DYNAMIC_TYPE_RNG);
1679     if (ssl->rng == NULL) {
1680         WOLFSSL_MSG("RNG Memory error");
1681         return MEMORY_E;
1682     }
1683
1684     if ( (ret = wc_InitRng(ssl->rng)) != 0) {
1685         WOLFSSL_MSG("RNG Init error");
1686         return ret;
1687     }
1688
1689     /* suites */
1690     ssl->suites = (Suites*)XMALLOC(sizeof(Suites), ssl->heap,
1691                                    DYNAMIC_TYPE_SUITES);
1692     if (ssl->suites == NULL) {
1693         WOLFSSL_MSG("Suites Memory error");
1694         return MEMORY_E;
1695     }
1696     if (ctx->suites)
1697         *ssl->suites = *ctx->suites;
1698     else
1699         XMEMSET(ssl->suites, 0, sizeof(Suites));
1700
1701
1702 #ifndef NO_CERTS
1703     /* make sure server has cert and key unless using PSK or Anon */
1704     if (ssl->options.side == WOLFSSL_SERVER_END && !havePSK && !haveAnon)
1705         if (!ssl->buffers.certificate.buffer || !ssl->buffers.key.buffer) {
1706             WOLFSSL_MSG("Server missing certificate and/or private key");
1707             return NO_PRIVATE_KEY;
1708         }
1709 #endif
1710 #ifdef HAVE_SECRET_CALLBACK
1711     ssl->sessionSecretCb  = NULL;
1712     ssl->sessionSecretCtx = NULL;
1713 #endif
1714
1715     /* make sure server has DH parms, and add PSK if there, add NTRU too */
1716     if (ssl->options.side == WOLFSSL_SERVER_END)
1717         InitSuites(ssl->suites, ssl->version, haveRSA, havePSK,
1718                    ssl->options.haveDH, ssl->options.haveNTRU,
1719                    ssl->options.haveECDSAsig, ssl->options.haveStaticECC,
1720                    ssl->options.side);
1721     else
1722         InitSuites(ssl->suites, ssl->version, haveRSA, havePSK, TRUE,
1723                    ssl->options.haveNTRU, ssl->options.haveECDSAsig,
1724                    ssl->options.haveStaticECC, ssl->options.side);
1725
1726     return 0;
1727 }
1728
1729
1730 /* free use of temporary arrays */
1731 void FreeArrays(WOLFSSL* ssl, int keep)
1732 {
1733     if (ssl->arrays && keep) {
1734         /* keeps session id for user retrieval */
1735         XMEMCPY(ssl->session.sessionID, ssl->arrays->sessionID, ID_LEN);
1736         ssl->session.sessionIDSz = ssl->arrays->sessionIDSz;
1737     }
1738     XFREE(ssl->arrays, ssl->heap, DYNAMIC_TYPE_ARRAYS);
1739     ssl->arrays = NULL;
1740 }
1741
1742
1743 /* In case holding SSL object in array and don't want to free actual ssl */
1744 void SSL_ResourceFree(WOLFSSL* ssl)
1745 {
1746     /* Note: any resources used during the handshake should be released in the
1747      * function FreeHandshakeResources(). Be careful with the special cases
1748      * like the RNG which may optionally be kept for the whole session. (For
1749      * example with the RNG, it isn't used beyond the handshake except when
1750      * using stream ciphers where it is retained. */
1751
1752     FreeCiphers(ssl);
1753     FreeArrays(ssl, 0);
1754     wc_FreeRng(ssl->rng);
1755     XFREE(ssl->rng, ssl->heap, DYNAMIC_TYPE_RNG);
1756     XFREE(ssl->suites, ssl->heap, DYNAMIC_TYPE_SUITES);
1757     XFREE(ssl->hsHashes, ssl->heap, DYNAMIC_TYPE_HASHES);
1758     XFREE(ssl->buffers.domainName.buffer, ssl->heap, DYNAMIC_TYPE_DOMAIN);
1759
1760 #ifndef NO_DH
1761     XFREE(ssl->buffers.serverDH_Priv.buffer, ssl->heap, DYNAMIC_TYPE_DH);
1762     XFREE(ssl->buffers.serverDH_Pub.buffer, ssl->heap, DYNAMIC_TYPE_DH);
1763     /* parameters (p,g) may be owned by ctx */
1764     if (ssl->buffers.weOwnDH || ssl->options.side == WOLFSSL_CLIENT_END) {
1765         XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap, DYNAMIC_TYPE_DH);
1766         XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap, DYNAMIC_TYPE_DH);
1767     }
1768 #endif
1769 #ifndef NO_CERTS
1770     if (ssl->buffers.weOwnCert)
1771         XFREE(ssl->buffers.certificate.buffer, ssl->heap, DYNAMIC_TYPE_CERT);
1772     if (ssl->buffers.weOwnCertChain)
1773         XFREE(ssl->buffers.certChain.buffer, ssl->heap, DYNAMIC_TYPE_CERT);
1774     if (ssl->buffers.weOwnKey)
1775         XFREE(ssl->buffers.key.buffer, ssl->heap, DYNAMIC_TYPE_KEY);
1776 #endif
1777 #ifndef NO_RSA
1778     if (ssl->peerRsaKey) {
1779         wc_FreeRsaKey(ssl->peerRsaKey);
1780         XFREE(ssl->peerRsaKey, ssl->heap, DYNAMIC_TYPE_RSA);
1781     }
1782 #endif
1783     if (ssl->buffers.inputBuffer.dynamicFlag)
1784         ShrinkInputBuffer(ssl, FORCED_FREE);
1785     if (ssl->buffers.outputBuffer.dynamicFlag)
1786         ShrinkOutputBuffer(ssl);
1787 #ifdef WOLFSSL_DTLS
1788     if (ssl->dtls_pool != NULL) {
1789         DtlsPoolReset(ssl);
1790         XFREE(ssl->dtls_pool, ssl->heap, DYNAMIC_TYPE_NONE);
1791     }
1792     if (ssl->dtls_msg_list != NULL) {
1793         DtlsMsgListDelete(ssl->dtls_msg_list, ssl->heap);
1794         ssl->dtls_msg_list = NULL;
1795     }
1796     XFREE(ssl->buffers.dtlsCtx.peer.sa, ssl->heap, DYNAMIC_TYPE_SOCKADDR);
1797     ssl->buffers.dtlsCtx.peer.sa = NULL;
1798 #endif
1799 #if defined(KEEP_PEER_CERT) || defined(GOAHEAD_WS)
1800     FreeX509(&ssl->peerCert);
1801 #endif
1802 #if defined(OPENSSL_EXTRA) || defined(GOAHEAD_WS)
1803     wolfSSL_BIO_free(ssl->biord);
1804     if (ssl->biord != ssl->biowr)        /* in case same as write */
1805         wolfSSL_BIO_free(ssl->biowr);
1806 #endif
1807 #ifdef HAVE_LIBZ
1808     FreeStreams(ssl);
1809 #endif
1810 #ifdef HAVE_ECC
1811     if (ssl->peerEccKey) {
1812         if (ssl->peerEccKeyPresent)
1813             wc_ecc_free(ssl->peerEccKey);
1814         XFREE(ssl->peerEccKey, ssl->heap, DYNAMIC_TYPE_ECC);
1815     }
1816     if (ssl->peerEccDsaKey) {
1817         if (ssl->peerEccDsaKeyPresent)
1818             wc_ecc_free(ssl->peerEccDsaKey);
1819         XFREE(ssl->peerEccDsaKey, ssl->heap, DYNAMIC_TYPE_ECC);
1820     }
1821     if (ssl->eccTempKey) {
1822         if (ssl->eccTempKeyPresent)
1823             wc_ecc_free(ssl->eccTempKey);
1824         XFREE(ssl->eccTempKey, ssl->heap, DYNAMIC_TYPE_ECC);
1825     }
1826 #endif
1827 #ifdef HAVE_PK_CALLBACKS
1828     #ifdef HAVE_ECC
1829         XFREE(ssl->buffers.peerEccDsaKey.buffer, ssl->heap, DYNAMIC_TYPE_ECC);
1830     #endif /* HAVE_ECC */
1831     #ifndef NO_RSA
1832         XFREE(ssl->buffers.peerRsaKey.buffer, ssl->heap, DYNAMIC_TYPE_RSA);
1833     #endif /* NO_RSA */
1834 #endif /* HAVE_PK_CALLBACKS */
1835 #ifdef HAVE_TLS_EXTENSIONS
1836     TLSX_FreeAll(ssl->extensions);
1837 #endif
1838 #ifdef HAVE_NETX
1839     if (ssl->nxCtx.nxPacket)
1840         nx_packet_release(ssl->nxCtx.nxPacket);
1841 #endif
1842 }
1843
1844 #ifdef WOLFSSL_TI_HASH
1845 static void HashFinal(WOLFSSL * ssl) {
1846     byte dummyHash[32] ;
1847 #ifndef NO_MD5
1848     wc_Md5Final(&(ssl->hsHashes->hashMd5), dummyHash) ;
1849 #endif
1850 #ifndef NO_SHA
1851     wc_ShaFinal(&(ssl->hsHashes->hashSha), dummyHash) ;
1852 #endif
1853 #ifndef NO_SHA256
1854     wc_Sha256Final(&(ssl->hsHashes->hashSha256), dummyHash) ;
1855 #endif
1856 }
1857 #else
1858
1859     #define HashFinal(ssl)
1860
1861 #endif
1862
1863 /* Free any handshake resources no longer needed */
1864 void FreeHandshakeResources(WOLFSSL* ssl)
1865 {
1866
1867     HashFinal(ssl) ;
1868 #ifdef HAVE_SECURE_RENEGOTIATION
1869     if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled) {
1870         WOLFSSL_MSG("Secure Renegotiation needs to retain handshake resources");
1871         return;
1872     }
1873 #endif
1874
1875     /* input buffer */
1876     if (ssl->buffers.inputBuffer.dynamicFlag)
1877         ShrinkInputBuffer(ssl, NO_FORCED_FREE);
1878
1879     /* suites */
1880     XFREE(ssl->suites, ssl->heap, DYNAMIC_TYPE_SUITES);
1881     ssl->suites = NULL;
1882
1883     /* hsHashes */
1884     XFREE(ssl->hsHashes, ssl->heap, DYNAMIC_TYPE_HASHES);
1885     ssl->hsHashes = NULL;
1886
1887     /* RNG */
1888     if (ssl->specs.cipher_type == stream || ssl->options.tls1_1 == 0) {
1889         wc_FreeRng(ssl->rng);
1890         XFREE(ssl->rng, ssl->heap, DYNAMIC_TYPE_RNG);
1891         ssl->rng = NULL;
1892     }
1893
1894 #ifdef WOLFSSL_DTLS
1895     /* DTLS_POOL */
1896     if (ssl->options.dtls && ssl->dtls_pool != NULL) {
1897         DtlsPoolReset(ssl);
1898         XFREE(ssl->dtls_pool, ssl->heap, DYNAMIC_TYPE_DTLS_POOL);
1899         ssl->dtls_pool = NULL;
1900     }
1901 #endif
1902
1903     /* arrays */
1904     if (ssl->options.saveArrays == 0)
1905         FreeArrays(ssl, 1);
1906
1907 #ifndef NO_RSA
1908     /* peerRsaKey */
1909     if (ssl->peerRsaKey) {
1910         wc_FreeRsaKey(ssl->peerRsaKey);
1911         XFREE(ssl->peerRsaKey, ssl->heap, DYNAMIC_TYPE_RSA);
1912         ssl->peerRsaKey = NULL;
1913     }
1914 #endif
1915
1916 #ifdef HAVE_ECC
1917     if (ssl->peerEccKey)
1918     {
1919         if (ssl->peerEccKeyPresent) {
1920             wc_ecc_free(ssl->peerEccKey);
1921             ssl->peerEccKeyPresent = 0;
1922         }
1923         XFREE(ssl->peerEccKey, ssl->heap, DYNAMIC_TYPE_ECC);
1924         ssl->peerEccKey = NULL;
1925     }
1926     if (ssl->peerEccDsaKey)
1927     {
1928         if (ssl->peerEccDsaKeyPresent) {
1929             wc_ecc_free(ssl->peerEccDsaKey);
1930             ssl->peerEccDsaKeyPresent = 0;
1931         }
1932         XFREE(ssl->peerEccDsaKey, ssl->heap, DYNAMIC_TYPE_ECC);
1933         ssl->peerEccDsaKey = NULL;
1934     }
1935     if (ssl->eccTempKey)
1936     {
1937         if (ssl->eccTempKeyPresent) {
1938             wc_ecc_free(ssl->eccTempKey);
1939             ssl->eccTempKeyPresent = 0;
1940         }
1941         XFREE(ssl->eccTempKey, ssl->heap, DYNAMIC_TYPE_ECC);
1942         ssl->eccTempKey = NULL;
1943     }
1944 #endif
1945 #ifndef NO_DH
1946     XFREE(ssl->buffers.serverDH_Priv.buffer, ssl->heap, DYNAMIC_TYPE_DH);
1947     ssl->buffers.serverDH_Priv.buffer = NULL;
1948     XFREE(ssl->buffers.serverDH_Pub.buffer, ssl->heap, DYNAMIC_TYPE_DH);
1949     ssl->buffers.serverDH_Pub.buffer = NULL;
1950     /* parameters (p,g) may be owned by ctx */
1951     if (ssl->buffers.weOwnDH || ssl->options.side == WOLFSSL_CLIENT_END) {
1952         XFREE(ssl->buffers.serverDH_G.buffer, ssl->heap, DYNAMIC_TYPE_DH);
1953         ssl->buffers.serverDH_G.buffer = NULL;
1954         XFREE(ssl->buffers.serverDH_P.buffer, ssl->heap, DYNAMIC_TYPE_DH);
1955         ssl->buffers.serverDH_P.buffer = NULL;
1956     }
1957 #endif
1958 #ifndef NO_CERTS
1959     if (ssl->buffers.weOwnCert) {
1960         XFREE(ssl->buffers.certificate.buffer, ssl->heap, DYNAMIC_TYPE_CERT);
1961         ssl->buffers.certificate.buffer = NULL;
1962     }
1963     if (ssl->buffers.weOwnCertChain) {
1964         XFREE(ssl->buffers.certChain.buffer, ssl->heap, DYNAMIC_TYPE_CERT);
1965         ssl->buffers.certChain.buffer = NULL;
1966     }
1967     if (ssl->buffers.weOwnKey) {
1968         XFREE(ssl->buffers.key.buffer, ssl->heap, DYNAMIC_TYPE_KEY);
1969         ssl->buffers.key.buffer = NULL;
1970     }
1971 #endif
1972 #ifdef HAVE_PK_CALLBACKS
1973     #ifdef HAVE_ECC
1974         XFREE(ssl->buffers.peerEccDsaKey.buffer, ssl->heap, DYNAMIC_TYPE_ECC);
1975         ssl->buffers.peerEccDsaKey.buffer = NULL;
1976     #endif /* HAVE_ECC */
1977     #ifndef NO_RSA
1978         XFREE(ssl->buffers.peerRsaKey.buffer, ssl->heap, DYNAMIC_TYPE_RSA);
1979         ssl->buffers.peerRsaKey.buffer = NULL;
1980     #endif /* NO_RSA */
1981 #endif /* HAVE_PK_CALLBACKS */
1982 }
1983
1984
1985 void FreeSSL(WOLFSSL* ssl)
1986 {
1987     FreeSSL_Ctx(ssl->ctx);  /* will decrement and free underyling CTX if 0 */
1988     SSL_ResourceFree(ssl);
1989     XFREE(ssl, ssl->heap, DYNAMIC_TYPE_SSL);
1990 }
1991
1992
1993 #ifdef WOLFSSL_DTLS
1994
1995 int DtlsPoolInit(WOLFSSL* ssl)
1996 {
1997     if (ssl->dtls_pool == NULL) {
1998         DtlsPool *pool = (DtlsPool*)XMALLOC(sizeof(DtlsPool),
1999                                              ssl->heap, DYNAMIC_TYPE_DTLS_POOL);
2000         if (pool == NULL) {
2001             WOLFSSL_MSG("DTLS Buffer Pool Memory error");
2002             return MEMORY_E;
2003         }
2004         else {
2005             int i;
2006
2007             for (i = 0; i < DTLS_POOL_SZ; i++) {
2008                 pool->buf[i].length = 0;
2009                 pool->buf[i].buffer = NULL;
2010             }
2011             pool->used = 0;
2012             ssl->dtls_pool = pool;
2013         }
2014     }
2015     return 0;
2016 }
2017
2018
2019 int DtlsPoolSave(WOLFSSL* ssl, const byte *src, int sz)
2020 {
2021     DtlsPool *pool = ssl->dtls_pool;
2022     if (pool != NULL && pool->used < DTLS_POOL_SZ) {
2023         buffer *pBuf = &pool->buf[pool->used];
2024         pBuf->buffer = (byte*)XMALLOC(sz, ssl->heap, DYNAMIC_TYPE_DTLS_POOL);
2025         if (pBuf->buffer == NULL) {
2026             WOLFSSL_MSG("DTLS Buffer Memory error");
2027             return MEMORY_ERROR;
2028         }
2029         XMEMCPY(pBuf->buffer, src, sz);
2030         pBuf->length = (word32)sz;
2031         pool->used++;
2032     }
2033     return 0;
2034 }
2035
2036
2037 void DtlsPoolReset(WOLFSSL* ssl)
2038 {
2039     DtlsPool *pool = ssl->dtls_pool;
2040     if (pool != NULL) {
2041         buffer *pBuf;
2042         int i, used;
2043
2044         used = pool->used;
2045         for (i = 0, pBuf = &pool->buf[0]; i < used; i++, pBuf++) {
2046             XFREE(pBuf->buffer, ssl->heap, DYNAMIC_TYPE_DTLS_POOL);
2047             pBuf->buffer = NULL;
2048             pBuf->length = 0;
2049         }
2050         pool->used = 0;
2051     }
2052     ssl->dtls_timeout = ssl->dtls_timeout_init;
2053 }
2054
2055
2056 int DtlsPoolTimeout(WOLFSSL* ssl)
2057 {
2058     int result = -1;
2059     if (ssl->dtls_timeout <  ssl->dtls_timeout_max) {
2060         ssl->dtls_timeout *= DTLS_TIMEOUT_MULTIPLIER;
2061         result = 0;
2062     }
2063     return result;
2064 }
2065
2066
2067 int DtlsPoolSend(WOLFSSL* ssl)
2068 {
2069     int ret;
2070     DtlsPool *pool = ssl->dtls_pool;
2071
2072     if (pool != NULL && pool->used > 0) {
2073         int i;
2074         for (i = 0; i < pool->used; i++) {
2075             int sendResult;
2076             buffer* buf = &pool->buf[i];
2077
2078             DtlsRecordLayerHeader* dtls = (DtlsRecordLayerHeader*)buf->buffer;
2079
2080             word16 message_epoch;
2081             ato16(dtls->epoch, &message_epoch);
2082             if (message_epoch == ssl->keys.dtls_epoch) {
2083                 /* Increment record sequence number on retransmitted handshake
2084                  * messages */
2085                 c32to48(ssl->keys.dtls_sequence_number, dtls->sequence_number);
2086                 ssl->keys.dtls_sequence_number++;
2087             }
2088             else {
2089                 /* The Finished message is sent with the next epoch, keep its
2090                  * sequence number */
2091             }
2092
2093             if ((ret = CheckAvailableSize(ssl, buf->length)) != 0)
2094                 return ret;
2095
2096             XMEMCPY(ssl->buffers.outputBuffer.buffer, buf->buffer, buf->length);
2097             ssl->buffers.outputBuffer.idx = 0;
2098             ssl->buffers.outputBuffer.length = buf->length;
2099
2100             sendResult = SendBuffered(ssl);
2101             if (sendResult < 0) {
2102                 return sendResult;
2103             }
2104         }
2105     }
2106     return 0;
2107 }
2108
2109
2110 /* functions for managing DTLS datagram reordering */
2111
2112 /* Need to allocate space for the handshake message header. The hashing
2113  * routines assume the message pointer is still within the buffer that
2114  * has the headers, and will include those headers in the hash. The store
2115  * routines need to take that into account as well. New will allocate
2116  * extra space for the headers. */
2117 DtlsMsg* DtlsMsgNew(word32 sz, void* heap)
2118 {
2119     DtlsMsg* msg = NULL;
2120
2121     msg = (DtlsMsg*)XMALLOC(sizeof(DtlsMsg), heap, DYNAMIC_TYPE_DTLS_MSG);
2122
2123     if (msg != NULL) {
2124         msg->buf = (byte*)XMALLOC(sz + DTLS_HANDSHAKE_HEADER_SZ,
2125                                                      heap, DYNAMIC_TYPE_NONE);
2126         if (msg->buf != NULL) {
2127             msg->next = NULL;
2128             msg->seq = 0;
2129             msg->sz = sz;
2130             msg->fragSz = 0;
2131             msg->msg = msg->buf + DTLS_HANDSHAKE_HEADER_SZ;
2132         }
2133         else {
2134             XFREE(msg, heap, DYNAMIC_TYPE_DTLS_MSG);
2135             msg = NULL;
2136         }
2137     }
2138
2139     return msg;
2140 }
2141
2142 void DtlsMsgDelete(DtlsMsg* item, void* heap)
2143 {
2144     (void)heap;
2145
2146     if (item != NULL) {
2147         if (item->buf != NULL)
2148             XFREE(item->buf, heap, DYNAMIC_TYPE_NONE);
2149         XFREE(item, heap, DYNAMIC_TYPE_DTLS_MSG);
2150     }
2151 }
2152
2153
2154 void DtlsMsgListDelete(DtlsMsg* head, void* heap)
2155 {
2156     DtlsMsg* next;
2157     while (head) {
2158         next = head->next;
2159         DtlsMsgDelete(head, heap);
2160         head = next;
2161     }
2162 }
2163
2164
2165 void DtlsMsgSet(DtlsMsg* msg, word32 seq, const byte* data, byte type,
2166                                               word32 fragOffset, word32 fragSz)
2167 {
2168     if (msg != NULL && data != NULL && msg->fragSz <= msg->sz &&
2169                     fragOffset <= msg->sz && (fragOffset + fragSz) <= msg->sz) {
2170
2171         msg->seq = seq;
2172         msg->type = type;
2173         msg->fragSz += fragSz;
2174         /* If fragOffset is zero, this is either a full message that is out
2175          * of order, or the first fragment of a fragmented message. Copy the
2176          * handshake message header with the message data. Zero length messages
2177          * like Server Hello Done should be saved as well. */
2178         if (fragOffset == 0)
2179             XMEMCPY(msg->buf, data - DTLS_HANDSHAKE_HEADER_SZ,
2180                                             fragSz + DTLS_HANDSHAKE_HEADER_SZ);
2181         else {
2182             /* If fragOffet is non-zero, this is an additional fragment that
2183              * needs to be copied to its location in the message buffer. Also
2184              * copy the total size of the message over the fragment size. The
2185              * hash routines look at a defragmented message if it had actually
2186              * come across as a single handshake message. */
2187             XMEMCPY(msg->msg + fragOffset, data, fragSz);
2188         }
2189         c32to24(msg->sz, msg->msg - DTLS_HANDSHAKE_FRAG_SZ);
2190     }
2191 }
2192
2193
2194 DtlsMsg* DtlsMsgFind(DtlsMsg* head, word32 seq)
2195 {
2196     while (head != NULL && head->seq != seq) {
2197         head = head->next;
2198     }
2199     return head;
2200 }
2201
2202
2203 DtlsMsg* DtlsMsgStore(DtlsMsg* head, word32 seq, const byte* data,
2204         word32 dataSz, byte type, word32 fragOffset, word32 fragSz, void* heap)
2205 {
2206
2207     /* See if seq exists in the list. If it isn't in the list, make
2208      * a new item of size dataSz, copy fragSz bytes from data to msg->msg
2209      * starting at offset fragOffset, and add fragSz to msg->fragSz. If
2210      * the seq is in the list and it isn't full, copy fragSz bytes from
2211      * data to msg->msg starting at offset fragOffset, and add fragSz to
2212      * msg->fragSz. The new item should be inserted into the list in its
2213      * proper position.
2214      *
2215      * 1. Find seq in list, or where seq should go in list. If seq not in
2216      *    list, create new item and insert into list. Either case, keep
2217      *    pointer to item.
2218      * 2. If msg->fragSz + fragSz < sz, copy data to msg->msg at offset
2219      *    fragOffset. Add fragSz to msg->fragSz.
2220      */
2221
2222     if (head != NULL) {
2223         DtlsMsg* cur = DtlsMsgFind(head, seq);
2224         if (cur == NULL) {
2225             cur = DtlsMsgNew(dataSz, heap);
2226             if (cur != NULL) {
2227                 DtlsMsgSet(cur, seq, data, type, fragOffset, fragSz);
2228                 head = DtlsMsgInsert(head, cur);
2229             }
2230         }
2231         else {
2232             DtlsMsgSet(cur, seq, data, type, fragOffset, fragSz);
2233         }
2234     }
2235     else {
2236         head = DtlsMsgNew(dataSz, heap);
2237         DtlsMsgSet(head, seq, data, type, fragOffset, fragSz);
2238     }
2239
2240     return head;
2241 }
2242
2243
2244 /* DtlsMsgInsert() is an in-order insert. */
2245 DtlsMsg* DtlsMsgInsert(DtlsMsg* head, DtlsMsg* item)
2246 {
2247     if (head == NULL || item->seq < head->seq) {
2248         item->next = head;
2249         head = item;
2250     }
2251     else if (head->next == NULL) {
2252         head->next = item;
2253     }
2254     else {
2255         DtlsMsg* cur = head->next;
2256         DtlsMsg* prev = head;
2257         while (cur) {
2258             if (item->seq < cur->seq) {
2259                 item->next = cur;
2260                 prev->next = item;
2261                 break;
2262             }
2263             prev = cur;
2264             cur = cur->next;
2265         }
2266         if (cur == NULL) {
2267             prev->next = item;
2268         }
2269     }
2270
2271     return head;
2272 }
2273
2274 #endif /* WOLFSSL_DTLS */
2275
2276 #ifndef NO_OLD_TLS
2277
2278 ProtocolVersion MakeSSLv3(void)
2279 {
2280     ProtocolVersion pv;
2281     pv.major = SSLv3_MAJOR;
2282     pv.minor = SSLv3_MINOR;
2283
2284     return pv;
2285 }
2286
2287 #endif /* NO_OLD_TLS */
2288
2289
2290 #ifdef WOLFSSL_DTLS
2291
2292 ProtocolVersion MakeDTLSv1(void)
2293 {
2294     ProtocolVersion pv;
2295     pv.major = DTLS_MAJOR;
2296     pv.minor = DTLS_MINOR;
2297
2298     return pv;
2299 }
2300
2301 ProtocolVersion MakeDTLSv1_2(void)
2302 {
2303     ProtocolVersion pv;
2304     pv.major = DTLS_MAJOR;
2305     pv.minor = DTLSv1_2_MINOR;
2306
2307     return pv;
2308 }
2309
2310 #endif /* WOLFSSL_DTLS */
2311
2312
2313
2314
2315 #ifdef USE_WINDOWS_API
2316
2317     word32 LowResTimer(void)
2318     {
2319         static int           init = 0;
2320         static LARGE_INTEGER freq;
2321         LARGE_INTEGER        count;
2322
2323         if (!init) {
2324             QueryPerformanceFrequency(&freq);
2325             init = 1;
2326         }
2327
2328         QueryPerformanceCounter(&count);
2329
2330         return (word32)(count.QuadPart / freq.QuadPart);
2331     }
2332
2333 #elif defined(HAVE_RTP_SYS)
2334
2335     #include "rtptime.h"
2336
2337     word32 LowResTimer(void)
2338     {
2339         return (word32)rtp_get_system_sec();
2340     }
2341
2342
2343 #elif defined(MICRIUM)
2344
2345     word32 LowResTimer(void)
2346     {
2347         NET_SECURE_OS_TICK  clk;
2348
2349         #if (NET_SECURE_MGR_CFG_EN == DEF_ENABLED)
2350             clk = NetSecure_OS_TimeGet();
2351         #endif
2352         return (word32)clk;
2353     }
2354
2355
2356 #elif defined(MICROCHIP_TCPIP_V5)
2357
2358     word32 LowResTimer(void)
2359     {
2360         return (word32) TickGet();
2361     }
2362
2363
2364 #elif defined(MICROCHIP_TCPIP)
2365
2366     #if defined(MICROCHIP_MPLAB_HARMONY)
2367
2368         #include <system/tmr/sys_tmr.h>
2369
2370         word32 LowResTimer(void)
2371         {
2372             return (word32) SYS_TMR_TickCountGet();
2373         }
2374
2375     #else
2376
2377         word32 LowResTimer(void)
2378         {
2379             return (word32) SYS_TICK_Get();
2380         }
2381
2382     #endif
2383
2384 #elif defined(FREESCALE_MQX)
2385
2386     word32 LowResTimer(void)
2387     {
2388         TIME_STRUCT mqxTime;
2389
2390         _time_get_elapsed(&mqxTime);
2391
2392         return (word32) mqxTime.SECONDS;
2393     }
2394
2395 #elif defined(WOLFSSL_TIRTOS)
2396
2397     word32 LowResTimer(void)
2398     {
2399         return (word32) Seconds_get();
2400     }
2401
2402 #elif defined(USER_TICKS)
2403 #if 0
2404     word32 LowResTimer(void)
2405     {
2406         /*
2407         write your own clock tick function if don't want time(0)
2408         needs second accuracy but doesn't have to correlated to EPOCH
2409         */
2410     }
2411 #endif
2412
2413 #elif defined(TIME_OVERRIDES)
2414
2415     /* use same asn time overrides unless user wants tick override above */
2416
2417     #ifndef HAVE_TIME_T_TYPE
2418         typedef long time_t;
2419     #endif
2420     extern time_t XTIME(time_t * timer);
2421
2422     word32 LowResTimer(void)
2423     {
2424         return (word32) XTIME(0);
2425     }
2426
2427 #else /* !USE_WINDOWS_API && !HAVE_RTP_SYS && !MICRIUM && !USER_TICKS */
2428
2429     #include <time.h>
2430
2431     word32 LowResTimer(void)
2432     {
2433         return (word32)time(0);
2434     }
2435
2436
2437 #endif /* USE_WINDOWS_API */
2438
2439
2440 /* add output to md5 and sha handshake hashes, exclude record header */
2441 static int HashOutput(WOLFSSL* ssl, const byte* output, int sz, int ivSz)
2442 {
2443     const byte* adj = output + RECORD_HEADER_SZ + ivSz;
2444     sz -= RECORD_HEADER_SZ;
2445
2446 #ifdef HAVE_FUZZER
2447     if (ssl->fuzzerCb)
2448         ssl->fuzzerCb(ssl, output, sz, FUZZ_HASH, ssl->fuzzerCtx);
2449 #endif
2450 #ifdef WOLFSSL_DTLS
2451     if (ssl->options.dtls) {
2452         adj += DTLS_RECORD_EXTRA;
2453         sz  -= DTLS_RECORD_EXTRA;
2454     }
2455 #endif
2456 #ifndef NO_OLD_TLS
2457 #ifndef NO_SHA
2458     wc_ShaUpdate(&ssl->hsHashes->hashSha, adj, sz);
2459 #endif
2460 #ifndef NO_MD5
2461     wc_Md5Update(&ssl->hsHashes->hashMd5, adj, sz);
2462 #endif
2463 #endif
2464
2465     if (IsAtLeastTLSv1_2(ssl)) {
2466         int ret;
2467
2468 #ifndef NO_SHA256
2469         ret = wc_Sha256Update(&ssl->hsHashes->hashSha256, adj, sz);
2470         if (ret != 0)
2471             return ret;
2472 #endif
2473 #ifdef WOLFSSL_SHA384
2474         ret = wc_Sha384Update(&ssl->hsHashes->hashSha384, adj, sz);
2475         if (ret != 0)
2476             return ret;
2477 #endif
2478 #ifdef WOLFSSL_SHA512
2479         ret = wc_Sha512Update(&ssl->hsHashes->hashSha512, adj, sz);
2480         if (ret != 0)
2481             return ret;
2482 #endif
2483     }
2484
2485     return 0;
2486 }
2487
2488
2489 /* add input to md5 and sha handshake hashes, include handshake header */
2490 static int HashInput(WOLFSSL* ssl, const byte* input, int sz)
2491 {
2492     const byte* adj = input - HANDSHAKE_HEADER_SZ;
2493     sz += HANDSHAKE_HEADER_SZ;
2494
2495 #ifdef WOLFSSL_DTLS
2496     if (ssl->options.dtls) {
2497         adj -= DTLS_HANDSHAKE_EXTRA;
2498         sz  += DTLS_HANDSHAKE_EXTRA;
2499     }
2500 #endif
2501
2502 #ifndef NO_OLD_TLS
2503 #ifndef NO_SHA
2504     wc_ShaUpdate(&ssl->hsHashes->hashSha, adj, sz);
2505 #endif
2506 #ifndef NO_MD5
2507     wc_Md5Update(&ssl->hsHashes->hashMd5, adj, sz);
2508 #endif
2509 #endif
2510
2511     if (IsAtLeastTLSv1_2(ssl)) {
2512         int ret;
2513
2514 #ifndef NO_SHA256
2515         ret = wc_Sha256Update(&ssl->hsHashes->hashSha256, adj, sz);
2516         if (ret != 0)
2517             return ret;
2518 #endif
2519 #ifdef WOLFSSL_SHA384
2520         ret = wc_Sha384Update(&ssl->hsHashes->hashSha384, adj, sz);
2521         if (ret != 0)
2522             return ret;
2523 #endif
2524 #ifdef WOLFSSL_SHA512
2525         ret = wc_Sha512Update(&ssl->hsHashes->hashSha512, adj, sz);
2526         if (ret != 0)
2527             return ret;
2528 #endif
2529     }
2530
2531     return 0;
2532 }
2533
2534
2535 /* add record layer header for message */
2536 static void AddRecordHeader(byte* output, word32 length, byte type, WOLFSSL* ssl)
2537 {
2538     RecordLayerHeader* rl;
2539
2540     /* record layer header */
2541     rl = (RecordLayerHeader*)output;
2542     rl->type    = type;
2543     rl->pvMajor = ssl->version.major;       /* type and version same in each */
2544     rl->pvMinor = ssl->version.minor;
2545
2546     if (!ssl->options.dtls)
2547         c16toa((word16)length, rl->length);
2548     else {
2549 #ifdef WOLFSSL_DTLS
2550         DtlsRecordLayerHeader* dtls;
2551
2552         /* dtls record layer header extensions */
2553         dtls = (DtlsRecordLayerHeader*)output;
2554         c16toa(ssl->keys.dtls_epoch, dtls->epoch);
2555         c32to48(ssl->keys.dtls_sequence_number++, dtls->sequence_number);
2556         c16toa((word16)length, dtls->length);
2557 #endif
2558     }
2559 }
2560
2561
2562 /* add handshake header for message */
2563 static void AddHandShakeHeader(byte* output, word32 length, byte type,
2564                                WOLFSSL* ssl)
2565 {
2566     HandShakeHeader* hs;
2567     (void)ssl;
2568
2569     /* handshake header */
2570     hs = (HandShakeHeader*)output;
2571     hs->type = type;
2572     c32to24(length, hs->length);         /* type and length same for each */
2573 #ifdef WOLFSSL_DTLS
2574     if (ssl->options.dtls) {
2575         DtlsHandShakeHeader* dtls;
2576
2577         /* dtls handshake header extensions */
2578         dtls = (DtlsHandShakeHeader*)output;
2579         c16toa(ssl->keys.dtls_handshake_number++, dtls->message_seq);
2580         c32to24(0, dtls->fragment_offset);
2581         c32to24(length, dtls->fragment_length);
2582     }
2583 #endif
2584 }
2585
2586
2587 /* add both headers for handshake message */
2588 static void AddHeaders(byte* output, word32 length, byte type, WOLFSSL* ssl)
2589 {
2590     if (!ssl->options.dtls) {
2591         AddRecordHeader(output, length + HANDSHAKE_HEADER_SZ, handshake, ssl);
2592         AddHandShakeHeader(output + RECORD_HEADER_SZ, length, type, ssl);
2593     }
2594 #ifdef WOLFSSL_DTLS
2595     else  {
2596         AddRecordHeader(output, length+DTLS_HANDSHAKE_HEADER_SZ, handshake,ssl);
2597         AddHandShakeHeader(output + DTLS_RECORD_HEADER_SZ, length, type, ssl);
2598     }
2599 #endif
2600 }
2601
2602
2603 /* return bytes received, -1 on error */
2604 static int Receive(WOLFSSL* ssl, byte* buf, word32 sz)
2605 {
2606     int recvd;
2607
2608     if (ssl->ctx->CBIORecv == NULL) {
2609         WOLFSSL_MSG("Your IO Recv callback is null, please set");
2610         return -1;
2611     }
2612
2613 retry:
2614     recvd = ssl->ctx->CBIORecv(ssl, (char *)buf, (int)sz, ssl->IOCB_ReadCtx);
2615     if (recvd < 0)
2616         switch (recvd) {
2617             case WOLFSSL_CBIO_ERR_GENERAL:        /* general/unknown error */
2618                 return -1;
2619
2620             case WOLFSSL_CBIO_ERR_WANT_READ:      /* want read, would block */
2621                 return WANT_READ;
2622
2623             case WOLFSSL_CBIO_ERR_CONN_RST:       /* connection reset */
2624                 #ifdef USE_WINDOWS_API
2625                 if (ssl->options.dtls) {
2626                     goto retry;
2627                 }
2628                 #endif
2629                 ssl->options.connReset = 1;
2630                 return -1;
2631
2632             case WOLFSSL_CBIO_ERR_ISR:            /* interrupt */
2633                 /* see if we got our timeout */
2634                 #ifdef WOLFSSL_CALLBACKS
2635                     if (ssl->toInfoOn) {
2636                         struct itimerval timeout;
2637                         getitimer(ITIMER_REAL, &timeout);
2638                         if (timeout.it_value.tv_sec == 0 &&
2639                                                 timeout.it_value.tv_usec == 0) {
2640                             XSTRNCPY(ssl->timeoutInfo.timeoutName,
2641                                     "recv() timeout", MAX_TIMEOUT_NAME_SZ);
2642                             WOLFSSL_MSG("Got our timeout");
2643                             return WANT_READ;
2644                         }
2645                     }
2646                 #endif
2647                 goto retry;
2648
2649             case WOLFSSL_CBIO_ERR_CONN_CLOSE:     /* peer closed connection */
2650                 ssl->options.isClosed = 1;
2651                 return -1;
2652
2653             case WOLFSSL_CBIO_ERR_TIMEOUT:
2654 #ifdef WOLFSSL_DTLS
2655                 if (DtlsPoolTimeout(ssl) == 0 && DtlsPoolSend(ssl) == 0)
2656                     goto retry;
2657                 else
2658 #endif
2659                     return -1;
2660
2661             default:
2662                 return recvd;
2663         }
2664
2665     return recvd;
2666 }
2667
2668
2669 /* Switch dynamic output buffer back to static, buffer is assumed clear */
2670 void ShrinkOutputBuffer(WOLFSSL* ssl)
2671 {
2672     WOLFSSL_MSG("Shrinking output buffer\n");
2673     XFREE(ssl->buffers.outputBuffer.buffer - ssl->buffers.outputBuffer.offset,
2674           ssl->heap, DYNAMIC_TYPE_OUT_BUFFER);
2675     ssl->buffers.outputBuffer.buffer = ssl->buffers.outputBuffer.staticBuffer;
2676     ssl->buffers.outputBuffer.bufferSize  = STATIC_BUFFER_LEN;
2677     ssl->buffers.outputBuffer.dynamicFlag = 0;
2678     ssl->buffers.outputBuffer.offset      = 0;
2679 }
2680
2681
2682 /* Switch dynamic input buffer back to static, keep any remaining input */
2683 /* forced free means cleaning up */
2684 void ShrinkInputBuffer(WOLFSSL* ssl, int forcedFree)
2685 {
2686     int usedLength = ssl->buffers.inputBuffer.length -
2687                      ssl->buffers.inputBuffer.idx;
2688     if (!forcedFree && usedLength > STATIC_BUFFER_LEN)
2689         return;
2690
2691     WOLFSSL_MSG("Shrinking input buffer\n");
2692
2693     if (!forcedFree && usedLength)
2694         XMEMCPY(ssl->buffers.inputBuffer.staticBuffer,
2695                ssl->buffers.inputBuffer.buffer + ssl->buffers.inputBuffer.idx,
2696                usedLength);
2697
2698     XFREE(ssl->buffers.inputBuffer.buffer - ssl->buffers.inputBuffer.offset,
2699           ssl->heap, DYNAMIC_TYPE_IN_BUFFER);
2700     ssl->buffers.inputBuffer.buffer = ssl->buffers.inputBuffer.staticBuffer;
2701     ssl->buffers.inputBuffer.bufferSize  = STATIC_BUFFER_LEN;
2702     ssl->buffers.inputBuffer.dynamicFlag = 0;
2703     ssl->buffers.inputBuffer.offset      = 0;
2704     ssl->buffers.inputBuffer.idx = 0;
2705     ssl->buffers.inputBuffer.length = usedLength;
2706 }
2707
2708 int SendBuffered(WOLFSSL* ssl)
2709 {
2710     if (ssl->ctx->CBIOSend == NULL) {
2711         WOLFSSL_MSG("Your IO Send callback is null, please set");
2712         return SOCKET_ERROR_E;
2713     }
2714
2715     while (ssl->buffers.outputBuffer.length > 0) {
2716         int sent = ssl->ctx->CBIOSend(ssl,
2717                                       (char*)ssl->buffers.outputBuffer.buffer +
2718                                       ssl->buffers.outputBuffer.idx,
2719                                       (int)ssl->buffers.outputBuffer.length,
2720                                       ssl->IOCB_WriteCtx);
2721         if (sent < 0) {
2722             switch (sent) {
2723
2724                 case WOLFSSL_CBIO_ERR_WANT_WRITE:        /* would block */
2725                     return WANT_WRITE;
2726
2727                 case WOLFSSL_CBIO_ERR_CONN_RST:          /* connection reset */
2728                     ssl->options.connReset = 1;
2729                     break;
2730
2731                 case WOLFSSL_CBIO_ERR_ISR:               /* interrupt */
2732                     /* see if we got our timeout */
2733                     #ifdef WOLFSSL_CALLBACKS
2734                         if (ssl->toInfoOn) {
2735                             struct itimerval timeout;
2736                             getitimer(ITIMER_REAL, &timeout);
2737                             if (timeout.it_value.tv_sec == 0 &&
2738                                                 timeout.it_value.tv_usec == 0) {
2739                                 XSTRNCPY(ssl->timeoutInfo.timeoutName,
2740                                         "send() timeout", MAX_TIMEOUT_NAME_SZ);
2741                                 WOLFSSL_MSG("Got our timeout");
2742                                 return WANT_WRITE;
2743                             }
2744                         }
2745                     #endif
2746                     continue;
2747
2748                 case WOLFSSL_CBIO_ERR_CONN_CLOSE: /* epipe / conn closed */
2749                     ssl->options.connReset = 1;  /* treat same as reset */
2750                     break;
2751
2752                 default:
2753                     return SOCKET_ERROR_E;
2754             }
2755
2756             return SOCKET_ERROR_E;
2757         }
2758
2759         if (sent > (int)ssl->buffers.outputBuffer.length) {
2760             WOLFSSL_MSG("SendBuffered() out of bounds read");
2761             return SEND_OOB_READ_E;
2762         }
2763
2764         ssl->buffers.outputBuffer.idx += sent;
2765         ssl->buffers.outputBuffer.length -= sent;
2766     }
2767
2768     ssl->buffers.outputBuffer.idx = 0;
2769
2770     if (ssl->buffers.outputBuffer.dynamicFlag)
2771         ShrinkOutputBuffer(ssl);
2772
2773     return 0;
2774 }
2775
2776
2777 /* Grow the output buffer */
2778 static INLINE int GrowOutputBuffer(WOLFSSL* ssl, int size)
2779 {
2780     byte* tmp;
2781     byte  hdrSz = ssl->options.dtls ? DTLS_RECORD_HEADER_SZ :
2782                                       RECORD_HEADER_SZ;
2783     byte  align = WOLFSSL_GENERAL_ALIGNMENT;
2784     /* the encrypted data will be offset from the front of the buffer by
2785        the header, if the user wants encrypted alignment they need
2786        to define their alignment requirement */
2787
2788     if (align) {
2789        while (align < hdrSz)
2790            align *= 2;
2791     }
2792
2793     tmp = (byte*) XMALLOC(size + ssl->buffers.outputBuffer.length + align,
2794                           ssl->heap, DYNAMIC_TYPE_OUT_BUFFER);
2795     WOLFSSL_MSG("growing output buffer\n");
2796
2797     if (!tmp) return MEMORY_E;
2798     if (align)
2799         tmp += align - hdrSz;
2800
2801     if (ssl->buffers.outputBuffer.length)
2802         XMEMCPY(tmp, ssl->buffers.outputBuffer.buffer,
2803                ssl->buffers.outputBuffer.length);
2804
2805     if (ssl->buffers.outputBuffer.dynamicFlag)
2806         XFREE(ssl->buffers.outputBuffer.buffer -
2807               ssl->buffers.outputBuffer.offset, ssl->heap,
2808               DYNAMIC_TYPE_OUT_BUFFER);
2809     ssl->buffers.outputBuffer.dynamicFlag = 1;
2810     if (align)
2811         ssl->buffers.outputBuffer.offset = align - hdrSz;
2812     else
2813         ssl->buffers.outputBuffer.offset = 0;
2814     ssl->buffers.outputBuffer.buffer = tmp;
2815     ssl->buffers.outputBuffer.bufferSize = size +
2816                                            ssl->buffers.outputBuffer.length;
2817     return 0;
2818 }
2819
2820
2821 /* Grow the input buffer, should only be to read cert or big app data */
2822 int GrowInputBuffer(WOLFSSL* ssl, int size, int usedLength)
2823 {
2824     byte* tmp;
2825     byte  hdrSz = DTLS_RECORD_HEADER_SZ;
2826     byte  align = ssl->options.dtls ? WOLFSSL_GENERAL_ALIGNMENT : 0;
2827     /* the encrypted data will be offset from the front of the buffer by
2828        the dtls record header, if the user wants encrypted alignment they need
2829        to define their alignment requirement. in tls we read record header
2830        to get size of record and put actual data back at front, so don't need */
2831
2832     if (align) {
2833        while (align < hdrSz)
2834            align *= 2;
2835     }
2836     tmp = (byte*) XMALLOC(size + usedLength + align, ssl->heap,
2837                           DYNAMIC_TYPE_IN_BUFFER);
2838     WOLFSSL_MSG("growing input buffer\n");
2839
2840     if (!tmp) return MEMORY_E;
2841     if (align)
2842         tmp += align - hdrSz;
2843
2844     if (usedLength)
2845         XMEMCPY(tmp, ssl->buffers.inputBuffer.buffer +
2846                     ssl->buffers.inputBuffer.idx, usedLength);
2847
2848     if (ssl->buffers.inputBuffer.dynamicFlag)
2849         XFREE(ssl->buffers.inputBuffer.buffer - ssl->buffers.inputBuffer.offset,
2850               ssl->heap,DYNAMIC_TYPE_IN_BUFFER);
2851
2852     ssl->buffers.inputBuffer.dynamicFlag = 1;
2853     if (align)
2854         ssl->buffers.inputBuffer.offset = align - hdrSz;
2855     else
2856         ssl->buffers.inputBuffer.offset = 0;
2857     ssl->buffers.inputBuffer.buffer = tmp;
2858     ssl->buffers.inputBuffer.bufferSize = size + usedLength;
2859     ssl->buffers.inputBuffer.idx    = 0;
2860     ssl->buffers.inputBuffer.length = usedLength;
2861
2862     return 0;
2863 }
2864
2865
2866 /* check available size into output buffer, make room if needed */
2867 int CheckAvailableSize(WOLFSSL *ssl, int size)
2868 {
2869
2870     if (size < 0) {
2871         WOLFSSL_MSG("CheckAvailableSize() called with negative number");
2872         return BAD_FUNC_ARG;
2873     }
2874
2875     if (ssl->buffers.outputBuffer.bufferSize - ssl->buffers.outputBuffer.length
2876                                              < (word32)size) {
2877         if (GrowOutputBuffer(ssl, size) < 0)
2878             return MEMORY_E;
2879     }
2880
2881     return 0;
2882 }
2883
2884
2885 /* do all verify and sanity checks on record header */
2886 static int GetRecordHeader(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
2887                            RecordLayerHeader* rh, word16 *size)
2888 {
2889     if (!ssl->options.dtls) {
2890 #ifdef HAVE_FUZZER
2891         if (ssl->fuzzerCb)
2892             ssl->fuzzerCb(ssl, input + *inOutIdx, RECORD_HEADER_SZ, FUZZ_HEAD,
2893                     ssl->fuzzerCtx);
2894 #endif
2895         XMEMCPY(rh, input + *inOutIdx, RECORD_HEADER_SZ);
2896         *inOutIdx += RECORD_HEADER_SZ;
2897         ato16(rh->length, size);
2898     }
2899     else {
2900 #ifdef WOLFSSL_DTLS
2901         /* type and version in same sport */
2902         XMEMCPY(rh, input + *inOutIdx, ENUM_LEN + VERSION_SZ);
2903         *inOutIdx += ENUM_LEN + VERSION_SZ;
2904         ato16(input + *inOutIdx, &ssl->keys.dtls_state.curEpoch);
2905         *inOutIdx += 4; /* advance past epoch, skip first 2 seq bytes for now */
2906         ato32(input + *inOutIdx, &ssl->keys.dtls_state.curSeq);
2907         *inOutIdx += 4;  /* advance past rest of seq */
2908         ato16(input + *inOutIdx, size);
2909         *inOutIdx += LENGTH_SZ;
2910 #ifdef HAVE_FUZZER
2911         if (ssl->fuzzerCb)
2912             ssl->fuzzerCb(ssl, input + *inOutIdx - LENGTH_SZ - 8 - ENUM_LEN -
2913                            VERSION_SZ, ENUM_LEN + VERSION_SZ + 8 + LENGTH_SZ,
2914                            FUZZ_HEAD, ssl->fuzzerCtx);
2915 #endif
2916 #endif
2917     }
2918
2919     /* catch version mismatch */
2920     if (rh->pvMajor != ssl->version.major || rh->pvMinor != ssl->version.minor){
2921         if (ssl->options.side == WOLFSSL_SERVER_END &&
2922             ssl->options.acceptState == ACCEPT_BEGIN)
2923             WOLFSSL_MSG("Client attempting to connect with different version");
2924         else if (ssl->options.side == WOLFSSL_CLIENT_END &&
2925                                  ssl->options.downgrade &&
2926                                  ssl->options.connectState < FIRST_REPLY_DONE)
2927             WOLFSSL_MSG("Server attempting to accept with different version");
2928         else {
2929             WOLFSSL_MSG("SSL version error");
2930             return VERSION_ERROR;              /* only use requested version */
2931         }
2932     }
2933
2934 #ifdef WOLFSSL_DTLS
2935     if (ssl->options.dtls) {
2936         if (DtlsCheckWindow(&ssl->keys.dtls_state) != 1)
2937             return SEQUENCE_ERROR;
2938     }
2939 #endif
2940
2941     /* record layer length check */
2942 #ifdef HAVE_MAX_FRAGMENT
2943     if (*size > (ssl->max_fragment + MAX_COMP_EXTRA + MAX_MSG_EXTRA)) {
2944         SendAlert(ssl, alert_fatal, record_overflow);
2945         return LENGTH_ERROR;
2946     }
2947 #else
2948     if (*size > (MAX_RECORD_SIZE + MAX_COMP_EXTRA + MAX_MSG_EXTRA))
2949         return LENGTH_ERROR;
2950 #endif
2951
2952     /* verify record type here as well */
2953     switch (rh->type) {
2954         case handshake:
2955         case change_cipher_spec:
2956         case application_data:
2957         case alert:
2958             break;
2959         case no_type:
2960         default:
2961             WOLFSSL_MSG("Unknown Record Type");
2962             return UNKNOWN_RECORD_TYPE;
2963     }
2964
2965     /* haven't decrypted this record yet */
2966     ssl->keys.decryptedCur = 0;
2967
2968     return 0;
2969 }
2970
2971
2972 static int GetHandShakeHeader(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
2973                               byte *type, word32 *size, word32 totalSz)
2974 {
2975     const byte *ptr = input + *inOutIdx;
2976     (void)ssl;
2977
2978     *inOutIdx += HANDSHAKE_HEADER_SZ;
2979     if (*inOutIdx > totalSz)
2980         return BUFFER_E;
2981
2982     *type = ptr[0];
2983     c24to32(&ptr[1], size);
2984
2985     return 0;
2986 }
2987
2988
2989 #ifdef WOLFSSL_DTLS
2990 static int GetDtlsHandShakeHeader(WOLFSSL* ssl, const byte* input,
2991                                   word32* inOutIdx, byte *type, word32 *size,
2992                                   word32 *fragOffset, word32 *fragSz,
2993                                   word32 totalSz)
2994 {
2995     word32 idx = *inOutIdx;
2996
2997     *inOutIdx += HANDSHAKE_HEADER_SZ + DTLS_HANDSHAKE_EXTRA;
2998     if (*inOutIdx > totalSz)
2999         return BUFFER_E;
3000
3001     *type = input[idx++];
3002     c24to32(input + idx, size);
3003     idx += BYTE3_LEN;
3004
3005     ato16(input + idx, &ssl->keys.dtls_peer_handshake_number);
3006     idx += DTLS_HANDSHAKE_SEQ_SZ;
3007
3008     c24to32(input + idx, fragOffset);
3009     idx += DTLS_HANDSHAKE_FRAG_SZ;
3010     c24to32(input + idx, fragSz);
3011
3012     return 0;
3013 }
3014 #endif
3015
3016
3017 #ifndef NO_OLD_TLS
3018 /* fill with MD5 pad size since biggest required */
3019 static const byte PAD1[PAD_MD5] =
3020                               { 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
3021                                 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
3022                                 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
3023                                 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
3024                                 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36,
3025                                 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36, 0x36
3026                               };
3027 static const byte PAD2[PAD_MD5] =
3028                               { 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
3029                                 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
3030                                 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
3031                                 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
3032                                 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c,
3033                                 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c, 0x5c
3034                               };
3035
3036 /* calculate MD5 hash for finished */
3037 #ifdef WOLFSSL_TI_HASH
3038 #include <wolfssl/wolfcrypt/hash.h>
3039 #endif
3040
3041 static void BuildMD5(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
3042 {
3043
3044     byte md5_result[MD5_DIGEST_SIZE];
3045
3046 #ifdef WOLFSSL_SMALL_STACK
3047         Md5* md5   = (Md5*)XMALLOC(sizeof(Md5), NULL, DYNAMIC_TYPE_TMP_BUFFER);
3048         Md5* md5_2 = (Md5*)XMALLOC(sizeof(Md5), NULL, DYNAMIC_TYPE_TMP_BUFFER);
3049 #else
3050         Md5 md5[1];
3051         Md5 md5_2[1];
3052 #endif
3053
3054     /* make md5 inner */
3055     md5[0] = ssl->hsHashes->hashMd5 ; /* Save current position */
3056
3057     wc_Md5Update(&ssl->hsHashes->hashMd5, sender, SIZEOF_SENDER);
3058     wc_Md5Update(&ssl->hsHashes->hashMd5, ssl->arrays->masterSecret,SECRET_LEN);
3059     wc_Md5Update(&ssl->hsHashes->hashMd5, PAD1, PAD_MD5);
3060     wc_Md5GetHash(&ssl->hsHashes->hashMd5, md5_result);
3061     wc_Md5RestorePos(&ssl->hsHashes->hashMd5, md5) ; /* Restore current position */
3062
3063     /* make md5 outer */
3064     wc_InitMd5(md5_2) ;
3065     wc_Md5Update(md5_2, ssl->arrays->masterSecret,SECRET_LEN);
3066     wc_Md5Update(md5_2, PAD2, PAD_MD5);
3067     wc_Md5Update(md5_2, md5_result, MD5_DIGEST_SIZE);
3068     wc_Md5Final(md5_2, hashes->md5);
3069
3070 #ifdef WOLFSSL_SMALL_STACK
3071     XFREE(md5, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3072     XFREE(md5_2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3073 #endif
3074
3075 }
3076
3077
3078 /* calculate SHA hash for finished */
3079 static void BuildSHA(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
3080 {
3081     byte sha_result[SHA_DIGEST_SIZE];
3082
3083 #ifdef WOLFSSL_SMALL_STACK
3084         Sha* sha = (Sha*)XMALLOC(sizeof(Sha), NULL, DYNAMIC_TYPE_TMP_BUFFER);
3085         Sha* sha2 = (Sha*)XMALLOC(sizeof(Sha), NULL, DYNAMIC_TYPE_TMP_BUFFER);
3086 #else
3087         Sha sha[1];
3088         Sha sha2[1] ;
3089 #endif
3090     /* make sha inner */
3091     sha[0] = ssl->hsHashes->hashSha ; /* Save current position */
3092
3093     wc_ShaUpdate(&ssl->hsHashes->hashSha, sender, SIZEOF_SENDER);
3094     wc_ShaUpdate(&ssl->hsHashes->hashSha, ssl->arrays->masterSecret,SECRET_LEN);
3095     wc_ShaUpdate(&ssl->hsHashes->hashSha, PAD1, PAD_SHA);
3096     wc_ShaGetHash(&ssl->hsHashes->hashSha, sha_result);
3097     wc_ShaRestorePos(&ssl->hsHashes->hashSha, sha) ; /* Restore current position */
3098
3099     /* make sha outer */
3100     wc_InitSha(sha2) ;
3101     wc_ShaUpdate(sha2, ssl->arrays->masterSecret,SECRET_LEN);
3102     wc_ShaUpdate(sha2, PAD2, PAD_SHA);
3103     wc_ShaUpdate(sha2, sha_result, SHA_DIGEST_SIZE);
3104     wc_ShaFinal(sha2, hashes->sha);
3105
3106 #ifdef WOLFSSL_SMALL_STACK
3107     XFREE(sha, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3108     XFREE(sha2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3109 #endif
3110
3111 }
3112 #endif
3113
3114 /* Finished doesn't support SHA512, not SHA512 cipher suites yet */
3115 static int BuildFinished(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
3116 {
3117     int ret = 0;
3118 #ifdef WOLFSSL_SMALL_STACK
3119     #ifdef WOLFSSL_SHA384
3120         Sha384* sha384 = (Sha384*)XMALLOC(sizeof(Sha384), NULL,                                                                        DYNAMIC_TYPE_TMP_BUFFER);
3121     #endif
3122 #else
3123     #ifdef WOLFSSL_SHA384
3124         Sha384 sha384[1];
3125     #endif
3126 #endif
3127
3128 #ifdef WOLFSSL_SMALL_STACK
3129     if (ssl == NULL
3130     #ifdef WOLFSSL_SHA384
3131         || sha384 == NULL
3132     #endif
3133         ) {
3134     #ifdef WOLFSSL_SHA384
3135         XFREE(sha384, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3136     #endif
3137         return MEMORY_E;
3138     }
3139 #endif
3140
3141     /* store current states, building requires get_digest which resets state */
3142 #ifdef WOLFSSL_SHA384
3143     sha384[0] = ssl->hsHashes->hashSha384;
3144 #endif
3145
3146 #ifndef NO_TLS
3147     if (ssl->options.tls) {
3148         ret = BuildTlsFinished(ssl, hashes, sender);
3149     }
3150 #endif
3151 #ifndef NO_OLD_TLS
3152     if (!ssl->options.tls) {
3153         BuildMD5(ssl, hashes, sender);
3154         BuildSHA(ssl, hashes, sender);
3155     }
3156 #endif
3157
3158     /* restore */
3159     if (IsAtLeastTLSv1_2(ssl)) {
3160     #ifdef WOLFSSL_SHA384
3161         ssl->hsHashes->hashSha384 = sha384[0];
3162     #endif
3163     }
3164
3165 #ifdef WOLFSSL_SMALL_STACK
3166 #ifdef WOLFSSL_SHA384
3167     XFREE(sha384, NULL, DYNAMIC_TYPE_TMP_BUFFER);
3168 #endif
3169 #endif
3170
3171     return ret;
3172 }
3173
3174
3175     /* cipher requirements */
3176     enum {
3177         REQUIRES_RSA,
3178         REQUIRES_DHE,
3179         REQUIRES_ECC_DSA,
3180         REQUIRES_ECC_STATIC,
3181         REQUIRES_PSK,
3182         REQUIRES_NTRU,
3183         REQUIRES_RSA_SIG
3184     };
3185
3186
3187
3188     /* Does this cipher suite (first, second) have the requirement
3189        an ephemeral key exchange will still require the key for signing
3190        the key exchange so ECHDE_RSA requires an rsa key thus rsa_kea */
3191     static int CipherRequires(byte first, byte second, int requirement)
3192     {
3193
3194         if (first == CHACHA_BYTE) {
3195
3196         switch (second) {
3197
3198         case TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 :
3199             if (requirement == REQUIRES_RSA)
3200                 return 1;
3201             break;
3202
3203         case TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 :
3204             if (requirement == REQUIRES_ECC_DSA)
3205                 return 1;
3206             break;
3207
3208         case TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 :
3209             if (requirement == REQUIRES_RSA)
3210                 return 1;
3211             if (requirement == REQUIRES_DHE)
3212                 return 1;
3213             break;
3214             }
3215         }
3216
3217         /* ECC extensions */
3218         if (first == ECC_BYTE) {
3219
3220         switch (second) {
3221
3222 #ifndef NO_RSA
3223         case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA :
3224             if (requirement == REQUIRES_RSA)
3225                 return 1;
3226             break;
3227
3228         case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA :
3229             if (requirement == REQUIRES_ECC_STATIC)
3230                 return 1;
3231             if (requirement == REQUIRES_RSA_SIG)
3232                 return 1;
3233             break;
3234
3235 #ifndef NO_DES3
3236         case TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA :
3237             if (requirement == REQUIRES_RSA)
3238                 return 1;
3239             break;
3240
3241         case TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA :
3242             if (requirement == REQUIRES_ECC_STATIC)
3243                 return 1;
3244             if (requirement == REQUIRES_RSA_SIG)
3245                 return 1;
3246             break;
3247 #endif
3248
3249 #ifndef NO_RC4
3250         case TLS_ECDHE_RSA_WITH_RC4_128_SHA :
3251             if (requirement == REQUIRES_RSA)
3252                 return 1;
3253             break;
3254
3255         case TLS_ECDH_RSA_WITH_RC4_128_SHA :
3256             if (requirement == REQUIRES_ECC_STATIC)
3257                 return 1;
3258             if (requirement == REQUIRES_RSA_SIG)
3259                 return 1;
3260             break;
3261 #endif
3262 #endif /* NO_RSA */
3263
3264 #ifndef NO_DES3
3265         case TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA :
3266             if (requirement == REQUIRES_ECC_DSA)
3267                 return 1;
3268             break;
3269
3270         case TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA :
3271             if (requirement == REQUIRES_ECC_STATIC)
3272                 return 1;
3273             break;
3274 #endif
3275 #ifndef NO_RC4
3276         case TLS_ECDHE_ECDSA_WITH_RC4_128_SHA :
3277             if (requirement == REQUIRES_ECC_DSA)
3278                 return 1;
3279             break;
3280
3281         case TLS_ECDH_ECDSA_WITH_RC4_128_SHA :
3282             if (requirement == REQUIRES_ECC_STATIC)
3283                 return 1;
3284             break;
3285 #endif
3286 #ifndef NO_RSA
3287         case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA :
3288             if (requirement == REQUIRES_RSA)
3289                 return 1;
3290             break;
3291
3292         case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA :
3293             if (requirement == REQUIRES_ECC_STATIC)
3294                 return 1;
3295             if (requirement == REQUIRES_RSA_SIG)
3296                 return 1;
3297             break;
3298 #endif
3299
3300         case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA :
3301             if (requirement == REQUIRES_ECC_DSA)
3302                 return 1;
3303             break;
3304
3305         case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA :
3306             if (requirement == REQUIRES_ECC_STATIC)
3307                 return 1;
3308             break;
3309
3310         case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA :
3311             if (requirement == REQUIRES_ECC_DSA)
3312                 return 1;
3313             break;
3314
3315         case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA :
3316             if (requirement == REQUIRES_ECC_STATIC)
3317                 return 1;
3318             break;
3319
3320         case TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 :
3321             if (requirement == REQUIRES_ECC_DSA)
3322                 return 1;
3323             break;
3324
3325         case TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 :
3326             if (requirement == REQUIRES_ECC_DSA)
3327                 return 1;
3328             break;
3329
3330         case TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 :
3331             if (requirement == REQUIRES_ECC_STATIC)
3332                 return 1;
3333             break;
3334
3335         case TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 :
3336             if (requirement == REQUIRES_ECC_STATIC)
3337                 return 1;
3338             break;
3339
3340 #ifndef NO_RSA
3341         case TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 :
3342             if (requirement == REQUIRES_RSA)
3343                 return 1;
3344             break;
3345
3346         case TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 :
3347             if (requirement == REQUIRES_RSA)
3348                 return 1;
3349             break;
3350
3351         case TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 :
3352             if (requirement == REQUIRES_ECC_STATIC)
3353                 return 1;
3354             if (requirement == REQUIRES_RSA_SIG)
3355                 return 1;
3356             break;
3357
3358         case TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 :
3359             if (requirement == REQUIRES_ECC_STATIC)
3360                 return 1;
3361             if (requirement == REQUIRES_RSA_SIG)
3362                 return 1;
3363             break;
3364
3365         case TLS_RSA_WITH_AES_128_CCM_8 :
3366         case TLS_RSA_WITH_AES_256_CCM_8 :
3367             if (requirement == REQUIRES_RSA)
3368                 return 1;
3369             if (requirement == REQUIRES_RSA_SIG)
3370                 return 1;
3371             break;
3372
3373         case TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 :
3374         case TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 :
3375             if (requirement == REQUIRES_RSA)
3376                 return 1;
3377             if (requirement == REQUIRES_RSA_SIG)
3378                 return 1;
3379             break;
3380
3381         case TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 :
3382         case TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 :
3383             if (requirement == REQUIRES_RSA_SIG)
3384                 return 1;
3385             if (requirement == REQUIRES_ECC_STATIC)
3386                 return 1;
3387             break;
3388 #endif
3389
3390         case TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 :
3391         case TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8 :
3392             if (requirement == REQUIRES_ECC_DSA)
3393                 return 1;
3394             break;
3395
3396         case TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 :
3397         case TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 :
3398             if (requirement == REQUIRES_ECC_DSA)
3399                 return 1;
3400             break;
3401
3402         case TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 :
3403         case TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 :
3404             if (requirement == REQUIRES_ECC_DSA)
3405                 return 1;
3406             if (requirement == REQUIRES_ECC_STATIC)
3407                 return 1;
3408             break;
3409
3410         case TLS_PSK_WITH_AES_128_CCM:
3411         case TLS_PSK_WITH_AES_256_CCM:
3412         case TLS_PSK_WITH_AES_128_CCM_8:
3413         case TLS_PSK_WITH_AES_256_CCM_8:
3414             if (requirement == REQUIRES_PSK)
3415                 return 1;
3416             break;
3417
3418         case TLS_DHE_PSK_WITH_AES_128_CCM:
3419         case TLS_DHE_PSK_WITH_AES_256_CCM:
3420             if (requirement == REQUIRES_PSK)
3421                 return 1;
3422             if (requirement == REQUIRES_DHE)
3423                 return 1;
3424             break;
3425
3426         default:
3427             WOLFSSL_MSG("Unsupported cipher suite, CipherRequires ECC");
3428             return 0;
3429         }   /* switch */
3430         }   /* if     */
3431         if (first != ECC_BYTE) {   /* normal suites */
3432         switch (second) {
3433
3434 #ifndef NO_RSA
3435         case SSL_RSA_WITH_RC4_128_SHA :
3436             if (requirement == REQUIRES_RSA)
3437                 return 1;
3438             break;
3439
3440         case TLS_NTRU_RSA_WITH_RC4_128_SHA :
3441             if (requirement == REQUIRES_NTRU)
3442                 return 1;
3443             break;
3444
3445         case SSL_RSA_WITH_RC4_128_MD5 :
3446             if (requirement == REQUIRES_RSA)
3447                 return 1;
3448             break;
3449
3450         case SSL_RSA_WITH_3DES_EDE_CBC_SHA :
3451             if (requirement == REQUIRES_RSA)
3452                 return 1;
3453             break;
3454
3455         case TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA :
3456             if (requirement == REQUIRES_NTRU)
3457                 return 1;
3458             break;
3459
3460         case TLS_RSA_WITH_AES_128_CBC_SHA :
3461             if (requirement == REQUIRES_RSA)
3462                 return 1;
3463             break;
3464
3465         case TLS_RSA_WITH_AES_128_CBC_SHA256 :
3466             if (requirement == REQUIRES_RSA)
3467                 return 1;
3468             break;
3469
3470         case TLS_NTRU_RSA_WITH_AES_128_CBC_SHA :
3471             if (requirement == REQUIRES_NTRU)
3472                 return 1;
3473             break;
3474
3475         case TLS_RSA_WITH_AES_256_CBC_SHA :
3476             if (requirement == REQUIRES_RSA)
3477                 return 1;
3478             break;
3479
3480         case TLS_RSA_WITH_AES_256_CBC_SHA256 :
3481             if (requirement == REQUIRES_RSA)
3482                 return 1;
3483             break;
3484
3485         case TLS_RSA_WITH_NULL_SHA :
3486         case TLS_RSA_WITH_NULL_SHA256 :
3487             if (requirement == REQUIRES_RSA)
3488                 return 1;
3489             break;
3490
3491         case TLS_NTRU_RSA_WITH_AES_256_CBC_SHA :
3492             if (requirement == REQUIRES_NTRU)
3493                 return 1;
3494             break;
3495 #endif
3496
3497         case TLS_PSK_WITH_AES_128_GCM_SHA256 :
3498         case TLS_PSK_WITH_AES_256_GCM_SHA384 :
3499         case TLS_PSK_WITH_AES_128_CBC_SHA256 :
3500         case TLS_PSK_WITH_AES_256_CBC_SHA384 :
3501         case TLS_PSK_WITH_AES_128_CBC_SHA :
3502         case TLS_PSK_WITH_AES_256_CBC_SHA :
3503         case TLS_PSK_WITH_NULL_SHA384 :
3504         case TLS_PSK_WITH_NULL_SHA256 :
3505         case TLS_PSK_WITH_NULL_SHA :
3506             if (requirement == REQUIRES_PSK)
3507                 return 1;
3508             break;
3509
3510         case TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 :
3511         case TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 :
3512         case TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 :
3513         case TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 :
3514         case TLS_DHE_PSK_WITH_NULL_SHA384 :
3515         case TLS_DHE_PSK_WITH_NULL_SHA256 :
3516             if (requirement == REQUIRES_DHE)
3517                 return 1;
3518             if (requirement == REQUIRES_PSK)
3519                 return 1;
3520             break;
3521
3522 #ifndef NO_RSA
3523         case TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 :
3524             if (requirement == REQUIRES_RSA)
3525                 return 1;
3526             if (requirement == REQUIRES_DHE)
3527                 return 1;
3528             break;
3529
3530         case TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 :
3531             if (requirement == REQUIRES_RSA)
3532                 return 1;
3533             if (requirement == REQUIRES_DHE)
3534                 return 1;
3535             break;
3536
3537         case TLS_DHE_RSA_WITH_AES_128_CBC_SHA :
3538             if (requirement == REQUIRES_RSA)
3539                 return 1;
3540             if (requirement == REQUIRES_DHE)
3541                 return 1;
3542             break;
3543
3544         case TLS_DHE_RSA_WITH_AES_256_CBC_SHA :
3545             if (requirement == REQUIRES_RSA)
3546                 return 1;
3547             if (requirement == REQUIRES_DHE)
3548                 return 1;
3549             break;
3550
3551         case TLS_RSA_WITH_HC_128_MD5 :
3552             if (requirement == REQUIRES_RSA)
3553                 return 1;
3554             break;
3555
3556         case TLS_RSA_WITH_HC_128_SHA :
3557             if (requirement == REQUIRES_RSA)
3558                 return 1;
3559             break;
3560
3561         case TLS_RSA_WITH_HC_128_B2B256:
3562             if (requirement == REQUIRES_RSA)
3563                 return 1;
3564             break;
3565
3566         case TLS_RSA_WITH_AES_128_CBC_B2B256:
3567         case TLS_RSA_WITH_AES_256_CBC_B2B256:
3568             if (requirement == REQUIRES_RSA)
3569                 return 1;
3570             break;
3571
3572         case TLS_RSA_WITH_RABBIT_SHA :
3573             if (requirement == REQUIRES_RSA)
3574                 return 1;
3575             break;
3576
3577         case TLS_RSA_WITH_AES_128_GCM_SHA256 :
3578         case TLS_RSA_WITH_AES_256_GCM_SHA384 :
3579             if (requirement == REQUIRES_RSA)
3580                 return 1;
3581             break;
3582
3583         case TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 :
3584         case TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 :
3585             if (requirement == REQUIRES_RSA)
3586                 return 1;
3587             if (requirement == REQUIRES_DHE)
3588                 return 1;
3589             break;
3590
3591         case TLS_RSA_WITH_CAMELLIA_128_CBC_SHA :
3592         case TLS_RSA_WITH_CAMELLIA_256_CBC_SHA :
3593         case TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256 :
3594         case TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256 :
3595             if (requirement == REQUIRES_RSA)
3596                 return 1;
3597             break;
3598
3599         case TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA :
3600         case TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA :
3601         case TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 :
3602         case TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 :
3603             if (requirement == REQUIRES_RSA)
3604                 return 1;
3605             if (requirement == REQUIRES_RSA_SIG)
3606                 return 1;
3607             if (requirement == REQUIRES_DHE)
3608                 return 1;
3609             break;
3610 #endif
3611 #ifdef HAVE_ANON
3612         case TLS_DH_anon_WITH_AES_128_CBC_SHA :
3613             if (requirement == REQUIRES_DHE)
3614                 return 1;
3615             break;
3616 #endif
3617
3618         default:
3619             WOLFSSL_MSG("Unsupported cipher suite, CipherRequires");
3620             return 0;
3621         }  /* switch */
3622         }  /* if ECC / Normal suites else */
3623
3624         return 0;
3625     }
3626
3627
3628 #ifndef NO_CERTS
3629
3630
3631 /* Match names with wildcards, each wildcard can represent a single name
3632    component or fragment but not mulitple names, i.e.,
3633    *.z.com matches y.z.com but not x.y.z.com
3634
3635    return 1 on success */
3636 static int MatchDomainName(const char* pattern, int len, const char* str)
3637 {
3638     char p, s;
3639
3640     if (pattern == NULL || str == NULL || len <= 0)
3641         return 0;
3642
3643     while (len > 0) {
3644
3645         p = (char)XTOLOWER((unsigned char)*pattern++);
3646         if (p == 0)
3647             break;
3648
3649         if (p == '*') {
3650             while (--len > 0 &&
3651                          (p = (char)XTOLOWER((unsigned char)*pattern++)) == '*')
3652                 ;
3653
3654             if (len == 0)
3655                 p = '\0';
3656
3657             while ( (s = (char)XTOLOWER((unsigned char) *str)) != '\0') {
3658                 if (s == p)
3659                     break;
3660                 if (s == '.')
3661                     return 0;
3662                 str++;
3663             }
3664         }
3665         else {
3666             if (p != (char)XTOLOWER((unsigned char) *str))
3667                 return 0;
3668         }
3669
3670         if (*str != '\0')
3671             str++;
3672
3673         if (len > 0)
3674             len--;
3675     }
3676
3677     return *str == '\0';
3678 }
3679
3680
3681 /* try to find an altName match to domain, return 1 on success */
3682 static int CheckAltNames(DecodedCert* dCert, char* domain)
3683 {
3684     int        match = 0;
3685     DNS_entry* altName = NULL;
3686
3687     WOLFSSL_MSG("Checking AltNames");
3688
3689     if (dCert)
3690         altName = dCert->altNames;
3691
3692     while (altName) {
3693         WOLFSSL_MSG("    individual AltName check");
3694
3695         if (MatchDomainName(altName->name,(int)XSTRLEN(altName->name), domain)){
3696             match = 1;
3697             break;
3698         }
3699
3700         altName = altName->next;
3701     }
3702
3703     return match;
3704 }
3705
3706
3707 #if defined(KEEP_PEER_CERT) || defined(SESSION_CERTS)
3708
3709 /* Copy parts X509 needs from Decoded cert, 0 on success */
3710 int CopyDecodedToX509(WOLFSSL_X509* x509, DecodedCert* dCert)
3711 {
3712     int ret = 0;
3713
3714     if (x509 == NULL || dCert == NULL)
3715         return BAD_FUNC_ARG;
3716
3717     x509->version = dCert->version + 1;
3718
3719     XSTRNCPY(x509->issuer.name, dCert->issuer, ASN_NAME_MAX);
3720     x509->issuer.name[ASN_NAME_MAX - 1] = '\0';
3721     x509->issuer.sz = (int)XSTRLEN(x509->issuer.name) + 1;
3722 #ifdef OPENSSL_EXTRA
3723     if (dCert->issuerName.fullName != NULL) {
3724         XMEMCPY(&x509->issuer.fullName,
3725                                        &dCert->issuerName, sizeof(DecodedName));
3726         x509->issuer.fullName.fullName = (char*)XMALLOC(
3727                         dCert->issuerName.fullNameLen, NULL, DYNAMIC_TYPE_X509);
3728         if (x509->issuer.fullName.fullName != NULL)
3729             XMEMCPY(x509->issuer.fullName.fullName,
3730                      dCert->issuerName.fullName, dCert->issuerName.fullNameLen);
3731     }
3732 #endif /* OPENSSL_EXTRA */
3733
3734     XSTRNCPY(x509->subject.name, dCert->subject, ASN_NAME_MAX);
3735     x509->subject.name[ASN_NAME_MAX - 1] = '\0';
3736     x509->subject.sz = (int)XSTRLEN(x509->subject.name) + 1;
3737 #ifdef OPENSSL_EXTRA
3738     if (dCert->subjectName.fullName != NULL) {
3739         XMEMCPY(&x509->subject.fullName,
3740                                       &dCert->subjectName, sizeof(DecodedName));
3741         x509->subject.fullName.fullName = (char*)XMALLOC(
3742                        dCert->subjectName.fullNameLen, NULL, DYNAMIC_TYPE_X509);
3743         if (x509->subject.fullName.fullName != NULL)
3744             XMEMCPY(x509->subject.fullName.fullName,
3745                    dCert->subjectName.fullName, dCert->subjectName.fullNameLen);
3746     }
3747 #endif /* OPENSSL_EXTRA */
3748
3749     XMEMCPY(x509->serial, dCert->serial, EXTERNAL_SERIAL_SIZE);
3750     x509->serialSz = dCert->serialSz;
3751     if (dCert->subjectCNLen < ASN_NAME_MAX) {
3752         XMEMCPY(x509->subjectCN, dCert->subjectCN, dCert->subjectCNLen);
3753         x509->subjectCN[dCert->subjectCNLen] = '\0';
3754     }
3755     else
3756         x509->subjectCN[0] = '\0';
3757
3758 #ifdef WOLFSSL_SEP
3759     {
3760         int minSz = min(dCert->deviceTypeSz, EXTERNAL_SERIAL_SIZE);
3761         if (minSz > 0) {
3762             x509->deviceTypeSz = minSz;
3763             XMEMCPY(x509->deviceType, dCert->deviceType, minSz);
3764         }
3765         else
3766             x509->deviceTypeSz = 0;
3767         minSz = min(dCert->hwTypeSz, EXTERNAL_SERIAL_SIZE);
3768         if (minSz != 0) {
3769             x509->hwTypeSz = minSz;
3770             XMEMCPY(x509->hwType, dCert->hwType, minSz);
3771         }
3772         else
3773             x509->hwTypeSz = 0;
3774         minSz = min(dCert->hwSerialNumSz, EXTERNAL_SERIAL_SIZE);
3775         if (minSz != 0) {
3776             x509->hwSerialNumSz = minSz;
3777             XMEMCPY(x509->hwSerialNum, dCert->hwSerialNum, minSz);
3778         }
3779         else
3780             x509->hwSerialNumSz = 0;
3781     }
3782 #endif /* WOLFSSL_SEP */
3783     {
3784         int minSz = min(dCert->beforeDateLen, MAX_DATE_SZ);
3785         if (minSz != 0) {
3786             x509->notBeforeSz = minSz;
3787             XMEMCPY(x509->notBefore, dCert->beforeDate, minSz);
3788         }
3789         else
3790             x509->notBeforeSz = 0;
3791         minSz = min(dCert->afterDateLen, MAX_DATE_SZ);
3792         if (minSz != 0) {
3793             x509->notAfterSz = minSz;
3794             XMEMCPY(x509->notAfter, dCert->afterDate, minSz);
3795         }
3796         else
3797             x509->notAfterSz = 0;
3798     }
3799
3800     if (dCert->publicKey != NULL && dCert->pubKeySize != 0) {
3801         x509->pubKey.buffer = (byte*)XMALLOC(
3802                               dCert->pubKeySize, NULL, DYNAMIC_TYPE_PUBLIC_KEY);
3803         if (x509->pubKey.buffer != NULL) {
3804             x509->pubKeyOID = dCert->keyOID;
3805             x509->pubKey.length = dCert->pubKeySize;
3806             XMEMCPY(x509->pubKey.buffer, dCert->publicKey, dCert->pubKeySize);
3807         }
3808         else
3809             ret = MEMORY_E;
3810     }
3811
3812     if (dCert->signature != NULL && dCert->sigLength != 0) {
3813         x509->sig.buffer = (byte*)XMALLOC(
3814                                 dCert->sigLength, NULL, DYNAMIC_TYPE_SIGNATURE);
3815         if (x509->sig.buffer == NULL) {
3816             ret = MEMORY_E;
3817         }
3818         else {
3819             XMEMCPY(x509->sig.buffer, dCert->signature, dCert->sigLength);
3820             x509->sig.length = dCert->sigLength;
3821             x509->sigOID = dCert->signatureOID;
3822         }
3823     }
3824
3825     /* store cert for potential retrieval */
3826     x509->derCert.buffer = (byte*)XMALLOC(dCert->maxIdx, NULL,
3827                                           DYNAMIC_TYPE_CERT);
3828     if (x509->derCert.buffer == NULL) {
3829         ret = MEMORY_E;
3830     }
3831     else {
3832         XMEMCPY(x509->derCert.buffer, dCert->source, dCert->maxIdx);
3833         x509->derCert.length = dCert->maxIdx;
3834     }
3835
3836     x509->altNames       = dCert->altNames;
3837     dCert->weOwnAltNames = 0;
3838     x509->altNamesNext   = x509->altNames;  /* index hint */
3839
3840     x509->isCa = dCert->isCA;
3841 #ifdef OPENSSL_EXTRA
3842     x509->pathLength = dCert->pathLength;
3843     x509->keyUsage = dCert->extKeyUsage;
3844
3845     x509->basicConstSet = dCert->extBasicConstSet;
3846     x509->basicConstCrit = dCert->extBasicConstCrit;
3847     x509->basicConstPlSet = dCert->extBasicConstPlSet;
3848     x509->subjAltNameSet = dCert->extSubjAltNameSet;
3849     x509->subjAltNameCrit = dCert->extSubjAltNameCrit;
3850     x509->authKeyIdSet = dCert->extAuthKeyIdSet;
3851     x509->authKeyIdCrit = dCert->extAuthKeyIdCrit;
3852     if (dCert->extAuthKeyIdSrc != NULL && dCert->extAuthKeyIdSz != 0) {
3853         x509->authKeyId = (byte*)XMALLOC(dCert->extAuthKeyIdSz, NULL, 0);
3854         if (x509->authKeyId != NULL) {
3855             XMEMCPY(x509->authKeyId,
3856                                  dCert->extAuthKeyIdSrc, dCert->extAuthKeyIdSz);
3857             x509->authKeyIdSz = dCert->extAuthKeyIdSz;
3858         }
3859         else
3860             ret = MEMORY_E;
3861     }
3862     x509->subjKeyIdSet = dCert->extSubjKeyIdSet;
3863     x509->subjKeyIdCrit = dCert->extSubjKeyIdCrit;
3864     if (dCert->extSubjKeyIdSrc != NULL && dCert->extSubjKeyIdSz != 0) {
3865         x509->subjKeyId = (byte*)XMALLOC(dCert->extSubjKeyIdSz, NULL, 0);
3866         if (x509->subjKeyId != NULL) {
3867             XMEMCPY(x509->subjKeyId,
3868                                  dCert->extSubjKeyIdSrc, dCert->extSubjKeyIdSz);
3869             x509->subjKeyIdSz = dCert->extSubjKeyIdSz;
3870         }
3871         else
3872             ret = MEMORY_E;
3873     }
3874     x509->keyUsageSet = dCert->extKeyUsageSet;
3875     x509->keyUsageCrit = dCert->extKeyUsageCrit;
3876     #ifdef WOLFSSL_SEP
3877         x509->certPolicySet = dCert->extCertPolicySet;
3878         x509->certPolicyCrit = dCert->extCertPolicyCrit;
3879     #endif /* WOLFSSL_SEP */
3880 #endif /* OPENSSL_EXTRA */
3881 #ifdef HAVE_ECC
3882     x509->pkCurveOID = dCert->pkCurveOID;
3883 #endif /* HAVE_ECC */
3884
3885     return ret;
3886 }
3887
3888 #endif /* KEEP_PEER_CERT || SESSION_CERTS */
3889
3890
3891 static int DoCertificate(WOLFSSL* ssl, byte* input, word32* inOutIdx,
3892                                                                     word32 size)
3893 {
3894     word32 listSz;
3895     word32 begin = *inOutIdx;
3896     int    ret = 0;
3897     int    anyError = 0;
3898     int    totalCerts = 0;    /* number of certs in certs buffer */
3899     int    count;
3900     buffer certs[MAX_CHAIN_DEPTH];
3901
3902 #ifdef WOLFSSL_SMALL_STACK
3903     char*                  domain = NULL;
3904     DecodedCert*           dCert  = NULL;
3905     WOLFSSL_X509_STORE_CTX* store  = NULL;
3906 #else
3907     char                   domain[ASN_NAME_MAX];
3908     DecodedCert            dCert[1];
3909     WOLFSSL_X509_STORE_CTX  store[1];
3910 #endif
3911
3912     #ifdef WOLFSSL_CALLBACKS
3913         if (ssl->hsInfoOn) AddPacketName("Certificate", &ssl->handShakeInfo);
3914         if (ssl->toInfoOn) AddLateName("Certificate", &ssl->timeoutInfo);
3915     #endif
3916
3917     if ((*inOutIdx - begin) + OPAQUE24_LEN > size)
3918         return BUFFER_ERROR;
3919
3920     c24to32(input + *inOutIdx, &listSz);
3921     *inOutIdx += OPAQUE24_LEN;
3922
3923 #ifdef HAVE_MAX_FRAGMENT
3924     if (listSz > ssl->max_fragment) {
3925         SendAlert(ssl, alert_fatal, record_overflow);
3926         return BUFFER_E;
3927     }
3928 #else
3929     if (listSz > MAX_RECORD_SIZE)
3930         return BUFFER_E;
3931 #endif
3932
3933     if ((*inOutIdx - begin) + listSz != size)
3934         return BUFFER_ERROR;
3935
3936     WOLFSSL_MSG("Loading peer's cert chain");
3937     /* first put cert chain into buffer so can verify top down
3938        we're sent bottom up */
3939     while (listSz) {
3940         word32 certSz;
3941
3942         if (totalCerts >= MAX_CHAIN_DEPTH)
3943             return MAX_CHAIN_ERROR;
3944
3945         if ((*inOutIdx - begin) + OPAQUE24_LEN > size)
3946             return BUFFER_ERROR;
3947
3948         c24to32(input + *inOutIdx, &certSz);
3949         *inOutIdx += OPAQUE24_LEN;
3950
3951         if ((*inOutIdx - begin) + certSz > size)
3952             return BUFFER_ERROR;
3953
3954         certs[totalCerts].length = certSz;
3955         certs[totalCerts].buffer = input + *inOutIdx;
3956
3957 #ifdef SESSION_CERTS
3958         if (ssl->session.chain.count < MAX_CHAIN_DEPTH &&
3959                                        certSz < MAX_X509_SIZE) {
3960             ssl->session.chain.certs[ssl->session.chain.count].length = certSz;
3961             XMEMCPY(ssl->session.chain.certs[ssl->session.chain.count].buffer,
3962                     input + *inOutIdx, certSz);
3963             ssl->session.chain.count++;
3964         } else {
3965             WOLFSSL_MSG("Couldn't store chain cert for session");
3966         }
3967 #endif
3968
3969         *inOutIdx += certSz;
3970         listSz -= certSz + CERT_HEADER_SZ;
3971
3972         totalCerts++;
3973         WOLFSSL_MSG("    Put another cert into chain");
3974     }
3975
3976     count = totalCerts;
3977
3978 #ifdef WOLFSSL_SMALL_STACK
3979     dCert = (DecodedCert*)XMALLOC(sizeof(DecodedCert), NULL,
3980                                                        DYNAMIC_TYPE_TMP_BUFFER);
3981     if (dCert == NULL)
3982         return MEMORY_E;
3983 #endif
3984
3985     /* verify up to peer's first */
3986     while (count > 1) {
3987         buffer myCert = certs[count - 1];
3988         byte* subjectHash;
3989
3990         InitDecodedCert(dCert, myCert.buffer, myCert.length, ssl->heap);
3991         ret = ParseCertRelative(dCert, CERT_TYPE, !ssl->options.verifyNone,
3992                                 ssl->ctx->cm);
3993         #ifndef NO_SKID
3994             subjectHash = dCert->extSubjKeyId;
3995         #else
3996             subjectHash = dCert->subjectHash;
3997         #endif
3998
3999         if (ret == 0 && dCert->isCA == 0) {
4000             WOLFSSL_MSG("Chain cert is not a CA, not adding as one");
4001         }
4002         else if (ret == 0 && ssl->options.verifyNone) {
4003             WOLFSSL_MSG("Chain cert not verified by option, not adding as CA");
4004         }
4005         else if (ret == 0 && !AlreadySigner(ssl->ctx->cm, subjectHash)) {
4006             buffer add;
4007             add.length = myCert.length;
4008             add.buffer = (byte*)XMALLOC(myCert.length, ssl->heap,
4009                                         DYNAMIC_TYPE_CA);
4010             WOLFSSL_MSG("Adding CA from chain");
4011
4012             if (add.buffer == NULL)
4013                 return MEMORY_E;
4014             XMEMCPY(add.buffer, myCert.buffer, myCert.length);
4015
4016             ret = AddCA(ssl->ctx->cm, add, WOLFSSL_CHAIN_CA,
4017                         ssl->ctx->verifyPeer);
4018             if (ret == 1) ret = 0;   /* SSL_SUCCESS for external */
4019         }
4020         else if (ret != 0) {
4021             WOLFSSL_MSG("Failed to verify CA from chain");
4022         }
4023         else {
4024             WOLFSSL_MSG("Verified CA from chain and already had it");
4025         }
4026
4027 #if defined(HAVE_OCSP) || defined(HAVE_CRL)
4028         if (ret == 0) {
4029             int doCrlLookup = 1;
4030             (void)doCrlLookup;
4031 #ifdef HAVE_OCSP
4032             if (ssl->ctx->cm->ocspEnabled && ssl->ctx->cm->ocspCheckAll) {
4033                 WOLFSSL_MSG("Doing Non Leaf OCSP check");
4034                 ret = CheckCertOCSP(ssl->ctx->cm->ocsp, dCert);
4035                 doCrlLookup = (ret == OCSP_CERT_UNKNOWN);
4036                 if (ret != 0) {
4037                     doCrlLookup = 0;
4038                     WOLFSSL_MSG("\tOCSP Lookup not ok");
4039                 }
4040             }
4041 #endif /* HAVE_OCSP */
4042
4043 #ifdef HAVE_CRL
4044             if (doCrlLookup && ssl->ctx->cm->crlEnabled
4045                                                  && ssl->ctx->cm->crlCheckAll) {
4046                 WOLFSSL_MSG("Doing Non Leaf CRL check");
4047                 ret = CheckCertCRL(ssl->ctx->cm->crl, dCert);
4048
4049                 if (ret != 0) {
4050                     WOLFSSL_MSG("\tCRL check not ok");
4051                 }
4052             }
4053 #endif /* HAVE_CRL */
4054         }
4055 #endif /* HAVE_OCSP || HAVE_CRL */
4056
4057         if (ret != 0 && anyError == 0)
4058             anyError = ret;   /* save error from last time */
4059
4060         FreeDecodedCert(dCert);
4061         count--;
4062     }
4063
4064     /* peer's, may not have one if blank client cert sent by TLSv1.2 */
4065     if (count) {
4066         buffer myCert = certs[0];
4067         int    fatal  = 0;
4068
4069         WOLFSSL_MSG("Verifying Peer's cert");
4070
4071         InitDecodedCert(dCert, myCert.buffer, myCert.length, ssl->heap);
4072         ret = ParseCertRelative(dCert, CERT_TYPE, !ssl->options.verifyNone,
4073                                 ssl->ctx->cm);
4074         if (ret == 0) {
4075             WOLFSSL_MSG("Verified Peer's cert");
4076             fatal = 0;
4077         }
4078         else if (ret == ASN_PARSE_E) {
4079             WOLFSSL_MSG("Got Peer cert ASN PARSE ERROR, fatal");
4080             fatal = 1;
4081         }
4082         else {
4083             WOLFSSL_MSG("Failed to verify Peer's cert");
4084             if (ssl->verifyCallback) {
4085                 WOLFSSL_MSG("\tCallback override available, will continue");
4086                 fatal = 0;
4087             }
4088             else {
4089                 WOLFSSL_MSG("\tNo callback override available, fatal");
4090                 fatal = 1;
4091             }
4092         }
4093
4094 #ifdef HAVE_SECURE_RENEGOTIATION
4095         if (fatal == 0 && ssl->secure_renegotiation
4096                        && ssl->secure_renegotiation->enabled) {
4097
4098             if (ssl->keys.encryptionOn) {
4099                 /* compare against previous time */
4100                 if (XMEMCMP(dCert->subjectHash,
4101                             ssl->secure_renegotiation->subject_hash,
4102                             SHA_DIGEST_SIZE) != 0) {
4103                     WOLFSSL_MSG("Peer sent different cert during scr, fatal");
4104                     fatal = 1;
4105                     ret   = SCR_DIFFERENT_CERT_E;
4106                 }
4107             }
4108
4109             /* cache peer's hash */
4110             if (fatal == 0) {
4111                 XMEMCPY(ssl->secure_renegotiation->subject_hash,
4112                         dCert->subjectHash, SHA_DIGEST_SIZE);
4113             }
4114         }
4115 #endif
4116
4117 #if defined(HAVE_OCSP) || defined(HAVE_CRL)
4118         if (fatal == 0) {
4119             int doCrlLookup = 1;
4120             (void)doCrlLookup;
4121 #ifdef HAVE_OCSP
4122             if (ssl->ctx->cm->ocspEnabled) {
4123                 ret = CheckCertOCSP(ssl->ctx->cm->ocsp, dCert);
4124                 doCrlLookup = (ret == OCSP_CERT_UNKNOWN);
4125                 if (ret != 0) {
4126                     WOLFSSL_MSG("\tOCSP Lookup not ok");
4127                     fatal = 0;
4128                 }
4129             }
4130 #endif /* HAVE_OCSP */
4131
4132 #ifdef HAVE_CRL
4133             if (doCrlLookup && ssl->ctx->cm->crlEnabled) {
4134                 WOLFSSL_MSG("Doing Leaf CRL check");
4135                 ret = CheckCertCRL(ssl->ctx->cm->crl, dCert);
4136                 if (ret != 0) {
4137                     WOLFSSL_MSG("\tCRL check not ok");
4138                     fatal = 0;
4139                 }
4140             }
4141 #endif /* HAVE_CRL */
4142         }
4143 #endif /* HAVE_OCSP || HAVE_CRL */
4144
4145 #ifdef KEEP_PEER_CERT
4146         {
4147         /* set X509 format for peer cert even if fatal */
4148         int copyRet = CopyDecodedToX509(&ssl->peerCert, dCert);
4149         if (copyRet == MEMORY_E)
4150             fatal = 1;
4151         }
4152 #endif
4153
4154 #ifndef IGNORE_KEY_EXTENSIONS
4155         if (dCert->extKeyUsageSet) {
4156             if ((ssl->specs.kea == rsa_kea) &&
4157                 (dCert->extKeyUsage & KEYUSE_KEY_ENCIPHER) == 0) {
4158                 ret = KEYUSE_ENCIPHER_E;
4159             }
4160             if ((ssl->specs.sig_algo == rsa_sa_algo ||
4161                     (ssl->specs.sig_algo == ecc_dsa_sa_algo &&
4162                          !ssl->specs.static_ecdh)) &&
4163                 (dCert->extKeyUsage & KEYUSE_DIGITAL_SIG) == 0) {
4164                 WOLFSSL_MSG("KeyUse Digital Sig not set");
4165                 ret = KEYUSE_SIGNATURE_E;
4166             }
4167         }
4168
4169         if (dCert->extExtKeyUsageSet) {
4170             if (ssl->options.side == WOLFSSL_CLIENT_END) {
4171                 if ((dCert->extExtKeyUsage &
4172                         (EXTKEYUSE_ANY | EXTKEYUSE_SERVER_AUTH)) == 0) {
4173                     WOLFSSL_MSG("ExtKeyUse Server Auth not set");
4174                     ret = EXTKEYUSE_AUTH_E;
4175                 }
4176             }
4177             else {
4178                 if ((dCert->extExtKeyUsage &
4179                         (EXTKEYUSE_ANY | EXTKEYUSE_CLIENT_AUTH)) == 0) {
4180                     WOLFSSL_MSG("ExtKeyUse Client Auth not set");
4181                     ret = EXTKEYUSE_AUTH_E;
4182                 }
4183             }
4184         }
4185 #endif /* IGNORE_KEY_EXTENSIONS */
4186
4187         if (fatal) {
4188             FreeDecodedCert(dCert);
4189         #ifdef WOLFSSL_SMALL_STACK
4190             XFREE(dCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4191         #endif
4192             ssl->error = ret;
4193             return ret;
4194         }
4195         ssl->options.havePeerCert = 1;
4196
4197 #ifdef WOLFSSL_SMALL_STACK
4198         domain = (char*)XMALLOC(ASN_NAME_MAX, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4199         if (domain == NULL) {
4200             FreeDecodedCert(dCert);
4201             XFREE(dCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4202             return MEMORY_E;
4203         }
4204 #endif
4205         /* store for callback use */
4206         if (dCert->subjectCNLen < ASN_NAME_MAX) {
4207             XMEMCPY(domain, dCert->subjectCN, dCert->subjectCNLen);
4208             domain[dCert->subjectCNLen] = '\0';
4209         }
4210         else
4211             domain[0] = '\0';
4212
4213         if (!ssl->options.verifyNone && ssl->buffers.domainName.buffer) {
4214             if (MatchDomainName(dCert->subjectCN, dCert->subjectCNLen,
4215                                 (char*)ssl->buffers.domainName.buffer) == 0) {
4216                 WOLFSSL_MSG("DomainName match on common name failed");
4217                 if (CheckAltNames(dCert,
4218                                  (char*)ssl->buffers.domainName.buffer) == 0 ) {
4219                     WOLFSSL_MSG("DomainName match on alt names failed too");
4220                     ret = DOMAIN_NAME_MISMATCH; /* try to get peer key still */
4221                 }
4222             }
4223         }
4224
4225         /* decode peer key */
4226         switch (dCert->keyOID) {
4227         #ifndef NO_RSA
4228             case RSAk:
4229                 {
4230                     word32 idx = 0;
4231                     int    keyRet = 0;
4232
4233                     if (ssl->peerRsaKey == NULL) {
4234                         ssl->peerRsaKey = (RsaKey*)XMALLOC(sizeof(RsaKey),
4235                                                    ssl->heap, DYNAMIC_TYPE_RSA);
4236                         if (ssl->peerRsaKey == NULL) {
4237                             WOLFSSL_MSG("PeerRsaKey Memory error");
4238                             keyRet = MEMORY_E;
4239                         } else {
4240                             keyRet = wc_InitRsaKey(ssl->peerRsaKey,
4241                                                    ssl->ctx->heap);
4242                         }
4243                     } else if (ssl->peerRsaKeyPresent) {
4244                         /* don't leak on reuse */
4245                         wc_FreeRsaKey(ssl->peerRsaKey);
4246                         ssl->peerRsaKeyPresent = 0;
4247                         keyRet = wc_InitRsaKey(ssl->peerRsaKey, ssl->heap);
4248                     }
4249
4250                     if (keyRet != 0 || wc_RsaPublicKeyDecode(dCert->publicKey,
4251                                &idx, ssl->peerRsaKey, dCert->pubKeySize) != 0) {
4252                         ret = PEER_KEY_ERROR;
4253                     }
4254                     else {
4255                         ssl->peerRsaKeyPresent = 1;
4256                         #ifdef HAVE_PK_CALLBACKS
4257                             #ifndef NO_RSA
4258                                 ssl->buffers.peerRsaKey.buffer =
4259                                        (byte*)XMALLOC(dCert->pubKeySize,
4260                                                ssl->heap, DYNAMIC_TYPE_RSA);
4261                                 if (ssl->buffers.peerRsaKey.buffer == NULL)
4262                                     ret = MEMORY_ERROR;
4263                                 else {
4264                                     XMEMCPY(ssl->buffers.peerRsaKey.buffer,
4265                                            dCert->publicKey, dCert->pubKeySize);
4266                                     ssl->buffers.peerRsaKey.length =
4267                                             dCert->pubKeySize;
4268                                 }
4269                             #endif /* NO_RSA */
4270                         #endif /*HAVE_PK_CALLBACKS */
4271                     }
4272                 }
4273                 break;
4274         #endif /* NO_RSA */
4275         #ifdef HAVE_NTRU
4276             case NTRUk:
4277                 {
4278                     if (dCert->pubKeySize > sizeof(ssl->peerNtruKey)) {
4279                         ret = PEER_KEY_ERROR;
4280                     }
4281                     else {
4282                         XMEMCPY(ssl->peerNtruKey, dCert->publicKey,
4283                                                              dCert->pubKeySize);
4284                         ssl->peerNtruKeyLen = (word16)dCert->pubKeySize;
4285                         ssl->peerNtruKeyPresent = 1;
4286                     }
4287                 }
4288                 break;
4289         #endif /* HAVE_NTRU */
4290         #ifdef HAVE_ECC
4291             case ECDSAk:
4292                 {
4293                     if (ssl->peerEccDsaKey == NULL) {
4294                         /* alloc/init on demand */
4295                         ssl->peerEccDsaKey = (ecc_key*)XMALLOC(sizeof(ecc_key),
4296                                               ssl->ctx->heap, DYNAMIC_TYPE_ECC);
4297                         if (ssl->peerEccDsaKey == NULL) {
4298                             WOLFSSL_MSG("PeerEccDsaKey Memory error");
4299                             return MEMORY_E;
4300                         }
4301                         wc_ecc_init(ssl->peerEccDsaKey);
4302                     } else if (ssl->peerEccDsaKeyPresent) {
4303                         /* don't leak on reuse */
4304                         wc_ecc_free(ssl->peerEccDsaKey);
4305                         ssl->peerEccDsaKeyPresent = 0;
4306                         wc_ecc_init(ssl->peerEccDsaKey);
4307                     }
4308                     if (wc_ecc_import_x963(dCert->publicKey, dCert->pubKeySize,
4309                                         ssl->peerEccDsaKey) != 0) {
4310                         ret = PEER_KEY_ERROR;
4311                     }
4312                     else {
4313                         ssl->peerEccDsaKeyPresent = 1;
4314                         #ifdef HAVE_PK_CALLBACKS
4315                             #ifdef HAVE_ECC
4316                                 ssl->buffers.peerEccDsaKey.buffer =
4317                                        (byte*)XMALLOC(dCert->pubKeySize,
4318                                                ssl->heap, DYNAMIC_TYPE_ECC);
4319                                 if (ssl->buffers.peerEccDsaKey.buffer == NULL)
4320                                     ret = MEMORY_ERROR;
4321                                 else {
4322                                     XMEMCPY(ssl->buffers.peerEccDsaKey.buffer,
4323                                            dCert->publicKey, dCert->pubKeySize);
4324                                     ssl->buffers.peerEccDsaKey.length =
4325                                             dCert->pubKeySize;
4326                                 }
4327                             #endif /* HAVE_ECC */
4328                         #endif /*HAVE_PK_CALLBACKS */
4329                     }
4330                 }
4331                 break;
4332         #endif /* HAVE_ECC */
4333             default:
4334                 break;
4335         }
4336
4337         FreeDecodedCert(dCert);
4338     }
4339
4340 #ifdef WOLFSSL_SMALL_STACK
4341     XFREE(dCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4342
4343     store = (WOLFSSL_X509_STORE_CTX*)XMALLOC(sizeof(WOLFSSL_X509_STORE_CTX),
4344                                                  NULL, DYNAMIC_TYPE_TMP_BUFFER);
4345     if (store == NULL) {
4346         XFREE(domain, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4347         return MEMORY_E;
4348     }
4349 #endif
4350
4351     if (anyError != 0 && ret == 0)
4352         ret = anyError;
4353
4354     if (ret != 0) {
4355         if (!ssl->options.verifyNone) {
4356             int why = bad_certificate;
4357
4358             if (ret == ASN_AFTER_DATE_E || ret == ASN_BEFORE_DATE_E)
4359                 why = certificate_expired;
4360             if (ssl->verifyCallback) {
4361                 int ok;
4362
4363                 store->error = ret;
4364                 store->error_depth = totalCerts;
4365                 store->discardSessionCerts = 0;
4366                 store->domain = domain;
4367                 store->userCtx = ssl->verifyCbCtx;
4368 #ifdef KEEP_PEER_CERT
4369                 store->current_cert = &ssl->peerCert;
4370 #else
4371                 store->current_cert = NULL;
4372 #endif
4373 #ifdef FORTRESS
4374                 store->ex_data = ssl;
4375 #endif
4376                 ok = ssl->verifyCallback(0, store);
4377                 if (ok) {
4378                     WOLFSSL_MSG("Verify callback overriding error!");
4379                     ret = 0;
4380                 }
4381                 #ifdef SESSION_CERTS
4382                 if (store->discardSessionCerts) {
4383                     WOLFSSL_MSG("Verify callback requested discard sess certs");
4384                     ssl->session.chain.count = 0;
4385                 }
4386                 #endif
4387             }
4388             if (ret != 0) {
4389                 SendAlert(ssl, alert_fatal, why);   /* try to send */
4390                 ssl->options.isClosed = 1;
4391             }
4392         }
4393         ssl->error = ret;
4394     }
4395 #ifdef WOLFSSL_ALWAYS_VERIFY_CB
4396     else {
4397         if (ssl->verifyCallback) {
4398             int ok;
4399
4400             store->error = ret;
4401             store->error_depth = totalCerts;
4402             store->discardSessionCerts = 0;
4403             store->domain = domain;
4404             store->userCtx = ssl->verifyCbCtx;
4405 #ifdef KEEP_PEER_CERT
4406             store->current_cert = &ssl->peerCert;
4407 #endif
4408             store->ex_data = ssl;
4409
4410             ok = ssl->verifyCallback(1, store);
4411             if (!ok) {
4412                 WOLFSSL_MSG("Verify callback overriding valid certificate!");
4413                 ret = -1;
4414                 SendAlert(ssl, alert_fatal, bad_certificate);
4415                 ssl->options.isClosed = 1;
4416             }
4417             #ifdef SESSION_CERTS
4418             if (store->discardSessionCerts) {
4419                 WOLFSSL_MSG("Verify callback requested discard sess certs");
4420                 ssl->session.chain.count = 0;
4421             }
4422             #endif
4423         }
4424     }
4425 #endif
4426
4427     if (ssl->options.verifyNone &&
4428                               (ret == CRL_MISSING || ret == CRL_CERT_REVOKED)) {
4429         WOLFSSL_MSG("Ignoring CRL problem based on verify setting");
4430         ret = ssl->error = 0;
4431     }
4432
4433     if (ret == 0 && ssl->options.side == WOLFSSL_CLIENT_END)
4434         ssl->options.serverState = SERVER_CERT_COMPLETE;
4435
4436     if (ssl->keys.encryptionOn) {
4437         *inOutIdx += ssl->keys.padSz;
4438     }
4439
4440 #ifdef WOLFSSL_SMALL_STACK
4441     XFREE(store,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
4442     XFREE(domain, NULL, DYNAMIC_TYPE_TMP_BUFFER);
4443 #endif
4444
4445     return ret;
4446 }
4447
4448 #endif /* !NO_CERTS */
4449
4450
4451 static int DoHelloRequest(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
4452                                                     word32 size, word32 totalSz)
4453 {
4454     (void)input;
4455
4456     if (size) /* must be 0 */
4457         return BUFFER_ERROR;
4458
4459     if (ssl->keys.encryptionOn) {
4460         /* access beyond input + size should be checked against totalSz */
4461         if (*inOutIdx + ssl->keys.padSz > totalSz)
4462             return BUFFER_E;
4463
4464         *inOutIdx += ssl->keys.padSz;
4465     }
4466
4467     if (ssl->options.side == WOLFSSL_SERVER_END) {
4468         SendAlert(ssl, alert_fatal, unexpected_message); /* try */
4469         return FATAL_ERROR;
4470     }
4471 #ifdef HAVE_SECURE_RENEGOTIATION
4472     else if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled) {
4473         ssl->secure_renegotiation->startScr = 1;
4474         return 0;
4475     }
4476 #endif
4477     else {
4478         return SendAlert(ssl, alert_warning, no_renegotiation);
4479     }
4480 }
4481
4482
4483 int DoFinished(WOLFSSL* ssl, const byte* input, word32* inOutIdx, word32 size,
4484                                                       word32 totalSz, int sniff)
4485 {
4486     word32 finishedSz = (ssl->options.tls ? TLS_FINISHED_SZ : FINISHED_SZ);
4487
4488     if (finishedSz != size)
4489         return BUFFER_ERROR;
4490
4491     /* check against totalSz */
4492     if (*inOutIdx + size + ssl->keys.padSz > totalSz)
4493         return BUFFER_E;
4494
4495     #ifdef WOLFSSL_CALLBACKS
4496         if (ssl->hsInfoOn) AddPacketName("Finished", &ssl->handShakeInfo);
4497         if (ssl->toInfoOn) AddLateName("Finished", &ssl->timeoutInfo);
4498     #endif
4499
4500     if (sniff == NO_SNIFF) {
4501         if (XMEMCMP(input + *inOutIdx, &ssl->hsHashes->verifyHashes,size) != 0){
4502             WOLFSSL_MSG("Verify finished error on hashes");
4503             return VERIFY_FINISHED_ERROR;
4504         }
4505     }
4506
4507 #ifdef HAVE_SECURE_RENEGOTIATION
4508     if (ssl->secure_renegotiation) {
4509         /* save peer's state */
4510         if (ssl->options.side == WOLFSSL_CLIENT_END)
4511             XMEMCPY(ssl->secure_renegotiation->server_verify_data,
4512                     input + *inOutIdx, TLS_FINISHED_SZ);
4513         else
4514             XMEMCPY(ssl->secure_renegotiation->client_verify_data,
4515                     input + *inOutIdx, TLS_FINISHED_SZ);
4516     }
4517 #endif
4518
4519     /* force input exhaustion at ProcessReply consuming padSz */
4520     *inOutIdx += size + ssl->keys.padSz;
4521
4522     if (ssl->options.side == WOLFSSL_CLIENT_END) {
4523         ssl->options.serverState = SERVER_FINISHED_COMPLETE;
4524         if (!ssl->options.resuming) {
4525             ssl->options.handShakeState = HANDSHAKE_DONE;
4526             ssl->options.handShakeDone  = 1;
4527
4528 #ifdef WOLFSSL_DTLS
4529             if (ssl->options.dtls) {
4530                 /* Other side has received our Finished, go to next epoch */
4531                 ssl->keys.dtls_epoch++;
4532                 ssl->keys.dtls_sequence_number = 1;
4533             }
4534 #endif
4535         }
4536     }
4537     else {
4538         ssl->options.clientState = CLIENT_FINISHED_COMPLETE;
4539         if (ssl->options.resuming) {
4540             ssl->options.handShakeState = HANDSHAKE_DONE;
4541             ssl->options.handShakeDone  = 1;
4542
4543 #ifdef WOLFSSL_DTLS
4544             if (ssl->options.dtls) {
4545                 /* Other side has received our Finished, go to next epoch */
4546                 ssl->keys.dtls_epoch++;
4547                 ssl->keys.dtls_sequence_number = 1;
4548             }
4549 #endif
4550         }
4551     }
4552
4553     return 0;
4554 }
4555
4556
4557 /* Make sure no duplicates, no fast forward, or other problems; 0 on success */
4558 static int SanityCheckMsgReceived(WOLFSSL* ssl, byte type)
4559 {
4560     /* verify not a duplicate, mark received, check state */
4561     switch (type) {
4562
4563 #ifndef NO_WOLFSSL_CLIENT
4564         case hello_request:
4565             if (ssl->msgsReceived.got_hello_request) {
4566                 WOLFSSL_MSG("Duplicate HelloRequest received");
4567                 return DUPLICATE_MSG_E;
4568             }
4569             ssl->msgsReceived.got_hello_request = 1;
4570
4571             break;
4572 #endif
4573
4574 #ifndef NO_WOLFSSL_SERVER
4575         case client_hello:
4576             if (ssl->msgsReceived.got_client_hello) {
4577                 WOLFSSL_MSG("Duplicate ClientHello received");
4578                 return DUPLICATE_MSG_E;
4579             }
4580             ssl->msgsReceived.got_client_hello = 1;
4581
4582             break;
4583 #endif
4584
4585 #ifndef NO_WOLFSSL_CLIENT
4586         case server_hello:
4587             if (ssl->msgsReceived.got_server_hello) {
4588                 WOLFSSL_MSG("Duplicate ServerHello received");
4589                 return DUPLICATE_MSG_E;
4590             }
4591             ssl->msgsReceived.got_server_hello = 1;
4592
4593             break;
4594 #endif
4595
4596 #ifndef NO_WOLFSSL_CLIENT
4597         case hello_verify_request:
4598             if (ssl->msgsReceived.got_hello_verify_request) {
4599                 WOLFSSL_MSG("Duplicate HelloVerifyRequest received");
4600                 return DUPLICATE_MSG_E;
4601             }
4602             ssl->msgsReceived.got_hello_verify_request = 1;
4603
4604             break;
4605 #endif
4606
4607 #ifndef NO_WOLFSSL_CLIENT
4608         case session_ticket:
4609             if (ssl->msgsReceived.got_session_ticket) {
4610                 WOLFSSL_MSG("Duplicate SessionTicket received");
4611                 return DUPLICATE_MSG_E;
4612             }
4613             ssl->msgsReceived.got_session_ticket = 1;
4614
4615             break;
4616 #endif
4617
4618         case certificate:
4619             if (ssl->msgsReceived.got_certificate) {
4620                 WOLFSSL_MSG("Duplicate Certificate received");
4621                 return DUPLICATE_MSG_E;
4622             }
4623             ssl->msgsReceived.got_certificate = 1;
4624
4625 #ifndef NO_WOLFSSL_CLIENT
4626             if (ssl->options.side == WOLFSSL_CLIENT_END) {
4627                 if ( ssl->msgsReceived.got_server_hello == 0) {
4628                     WOLFSSL_MSG("No ServerHello before Cert");
4629                     return OUT_OF_ORDER_E;
4630                 }
4631             }
4632 #endif
4633 #ifndef NO_WOLFSSL_SERVER
4634             if (ssl->options.side == WOLFSSL_SERVER_END) {
4635                 if ( ssl->msgsReceived.got_client_hello == 0) {
4636                     WOLFSSL_MSG("No ClientHello before Cert");
4637                     return OUT_OF_ORDER_E;
4638                 }
4639             }
4640 #endif
4641             break;
4642
4643 #ifndef NO_WOLFSSL_CLIENT
4644         case server_key_exchange:
4645             if (ssl->msgsReceived.got_server_key_exchange) {
4646                 WOLFSSL_MSG("Duplicate ServerKeyExchange received");
4647                 return DUPLICATE_MSG_E;
4648             }
4649             ssl->msgsReceived.got_server_key_exchange = 1;
4650
4651             if ( ssl->msgsReceived.got_server_hello == 0) {
4652                 WOLFSSL_MSG("No ServerHello before Cert");
4653                 return OUT_OF_ORDER_E;
4654             }
4655
4656             break;
4657 #endif
4658
4659 #ifndef NO_WOLFSSL_CLIENT
4660         case certificate_request:
4661             if (ssl->msgsReceived.got_certificate_request) {
4662                 WOLFSSL_MSG("Duplicate CertificateRequest received");
4663                 return DUPLICATE_MSG_E;
4664             }
4665             ssl->msgsReceived.got_certificate_request = 1;
4666
4667             break;
4668 #endif
4669
4670 #ifndef NO_WOLFSSL_CLIENT
4671         case server_hello_done:
4672             if (ssl->msgsReceived.got_server_hello_done) {
4673                 WOLFSSL_MSG("Duplicate ServerHelloDone received");
4674                 return DUPLICATE_MSG_E;
4675             }
4676             ssl->msgsReceived.got_server_hello_done = 1;
4677
4678             if (ssl->msgsReceived.got_certificate == 0) {
4679                 if (ssl->specs.kea == psk_kea ||
4680                     ssl->specs.kea == dhe_psk_kea ||
4681                     ssl->options.usingAnon_cipher) {
4682                     WOLFSSL_MSG("No Cert required");
4683                 } else {
4684                     WOLFSSL_MSG("No Certificate before ServerHelloDone");
4685                     return OUT_OF_ORDER_E;
4686                 }
4687             }
4688             if (ssl->msgsReceived.got_server_key_exchange == 0) {
4689                 if (ssl->specs.static_ecdh == 1 ||
4690                     ssl->specs.kea == rsa_kea ||
4691                     ssl->specs.kea == ntru_kea) {
4692                     WOLFSSL_MSG("No KeyExchange required");
4693                 } else {
4694                     WOLFSSL_MSG("No ServerKeyExchange before ServerDone");
4695                     return OUT_OF_ORDER_E;
4696                 }
4697             }
4698             break;
4699 #endif
4700
4701 #ifndef NO_WOLFSSL_SERVER
4702         case certificate_verify:
4703             if (ssl->msgsReceived.got_certificate_verify) {
4704                 WOLFSSL_MSG("Duplicate CertificateVerify received");
4705                 return DUPLICATE_MSG_E;
4706             }
4707             ssl->msgsReceived.got_certificate_verify = 1;
4708
4709             if ( ssl->msgsReceived.got_certificate == 0) {
4710                 WOLFSSL_MSG("No Cert before CertVerify");
4711                 return OUT_OF_ORDER_E;
4712             }
4713             break;
4714 #endif
4715
4716 #ifndef NO_WOLFSSL_SERVER
4717         case client_key_exchange:
4718             if (ssl->msgsReceived.got_client_key_exchange) {
4719                 WOLFSSL_MSG("Duplicate ClientKeyExchange received");
4720                 return DUPLICATE_MSG_E;
4721             }
4722             ssl->msgsReceived.got_client_key_exchange = 1;
4723
4724             if (ssl->msgsReceived.got_client_hello == 0) {
4725                 WOLFSSL_MSG("No ClientHello before ClientKeyExchange");
4726                 return OUT_OF_ORDER_E;
4727             }
4728             break;
4729 #endif
4730
4731         case finished:
4732             if (ssl->msgsReceived.got_finished) {
4733                 WOLFSSL_MSG("Duplicate Finished received");
4734                 return DUPLICATE_MSG_E;
4735             }
4736             ssl->msgsReceived.got_finished = 1;
4737
4738             if (ssl->msgsReceived.got_change_cipher == 0) {
4739                 WOLFSSL_MSG("Finished received before ChangeCipher");
4740                 return NO_CHANGE_CIPHER_E;
4741             }
4742
4743             break;
4744
4745         case change_cipher_hs:
4746             if (ssl->msgsReceived.got_change_cipher) {
4747                 WOLFSSL_MSG("Duplicate ChangeCipher received");
4748                 return DUPLICATE_MSG_E;
4749             }
4750             ssl->msgsReceived.got_change_cipher = 1;
4751
4752 #ifndef NO_WOLFSSL_CLIENT
4753             if (ssl->options.side == WOLFSSL_CLIENT_END) {
4754                 if (!ssl->options.resuming &&
4755                                  ssl->msgsReceived.got_server_hello_done == 0) {
4756                     WOLFSSL_MSG("No ServerHelloDone before ChangeCipher");
4757                     return OUT_OF_ORDER_E;
4758                 }
4759             }
4760 #endif
4761 #ifndef NO_WOLFSSL_SERVER
4762             if (ssl->options.side == WOLFSSL_SERVER_END) {
4763                 if (!ssl->options.resuming &&
4764                                ssl->msgsReceived.got_client_key_exchange == 0) {
4765                     WOLFSSL_MSG("No ClientKeyExchange before ChangeCipher");
4766                     return OUT_OF_ORDER_E;
4767                 }
4768             }
4769 #endif
4770
4771             break;
4772
4773         default:
4774             WOLFSSL_MSG("Unknown message type");
4775             return SANITY_MSG_E;
4776     }
4777
4778     return 0;
4779 }
4780
4781
4782 static int DoHandShakeMsgType(WOLFSSL* ssl, byte* input, word32* inOutIdx,
4783                           byte type, word32 size, word32 totalSz)
4784 {
4785     int ret = 0;
4786     (void)totalSz;
4787
4788     WOLFSSL_ENTER("DoHandShakeMsgType");
4789
4790     /* make sure can read the message */
4791     if (*inOutIdx + size > totalSz)
4792         return INCOMPLETE_DATA;
4793
4794     /* sanity check msg received */
4795     if ( (ret = SanityCheckMsgReceived(ssl, type)) != 0) {
4796         WOLFSSL_MSG("Sanity Check on handshake message type received failed");
4797         return ret;
4798     }
4799
4800 #ifdef WOLFSSL_CALLBACKS
4801     /* add name later, add on record and handshake header part back on */
4802     if (ssl->toInfoOn) {
4803         int add = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
4804         AddPacketInfo(0, &ssl->timeoutInfo, input + *inOutIdx - add,
4805                       size + add, ssl->heap);
4806         AddLateRecordHeader(&ssl->curRL, &ssl->timeoutInfo);
4807     }
4808 #endif
4809
4810     if (ssl->options.handShakeState == HANDSHAKE_DONE && type != hello_request){
4811         WOLFSSL_MSG("HandShake message after handshake complete");
4812         SendAlert(ssl, alert_fatal, unexpected_message);
4813         return OUT_OF_ORDER_E;
4814     }
4815
4816     if (ssl->options.side == WOLFSSL_CLIENT_END && ssl->options.dtls == 0 &&
4817                ssl->options.serverState == NULL_STATE && type != server_hello) {
4818         WOLFSSL_MSG("First server message not server hello");
4819         SendAlert(ssl, alert_fatal, unexpected_message);
4820         return OUT_OF_ORDER_E;
4821     }
4822
4823     if (ssl->options.side == WOLFSSL_CLIENT_END && ssl->options.dtls &&
4824             type == server_hello_done &&
4825             ssl->options.serverState < SERVER_HELLO_COMPLETE) {
4826         WOLFSSL_MSG("Server hello done received before server hello in DTLS");
4827         SendAlert(ssl, alert_fatal, unexpected_message);
4828         return OUT_OF_ORDER_E;
4829     }
4830
4831     if (ssl->options.side == WOLFSSL_SERVER_END &&
4832                ssl->options.clientState == NULL_STATE && type != client_hello) {
4833         WOLFSSL_MSG("First client message not client hello");
4834         SendAlert(ssl, alert_fatal, unexpected_message);
4835         return OUT_OF_ORDER_E;
4836     }
4837
4838     /* above checks handshake state */
4839     /* hello_request not hashed */
4840     if (type != hello_request) {
4841         ret = HashInput(ssl, input + *inOutIdx, size);
4842         if (ret != 0) return ret;
4843     }
4844
4845     switch (type) {
4846
4847     case hello_request:
4848         WOLFSSL_MSG("processing hello request");
4849         ret = DoHelloRequest(ssl, input, inOutIdx, size, totalSz);
4850         break;
4851
4852 #ifndef NO_WOLFSSL_CLIENT
4853     case hello_verify_request:
4854         WOLFSSL_MSG("processing hello verify request");
4855         ret = DoHelloVerifyRequest(ssl, input,inOutIdx, size);
4856         break;
4857
4858     case server_hello:
4859         WOLFSSL_MSG("processing server hello");
4860         ret = DoServerHello(ssl, input, inOutIdx, size);
4861         break;
4862
4863 #ifndef NO_CERTS
4864     case certificate_request:
4865         WOLFSSL_MSG("processing certificate request");
4866         ret = DoCertificateRequest(ssl, input, inOutIdx, size);
4867         break;
4868 #endif
4869
4870     case server_key_exchange:
4871         WOLFSSL_MSG("processing server key exchange");
4872         ret = DoServerKeyExchange(ssl, input, inOutIdx, size);
4873         break;
4874
4875 #ifdef HAVE_SESSION_TICKET
4876     case session_ticket:
4877         WOLFSSL_MSG("processing session ticket");
4878         ret = DoSessionTicket(ssl, input, inOutIdx, size);
4879         break;
4880 #endif /* HAVE_SESSION_TICKET */
4881 #endif
4882
4883 #ifndef NO_CERTS
4884     case certificate:
4885         WOLFSSL_MSG("processing certificate");
4886         ret =  DoCertificate(ssl, input, inOutIdx, size);
4887         break;
4888 #endif
4889
4890     case server_hello_done:
4891         WOLFSSL_MSG("processing server hello done");
4892         #ifdef WOLFSSL_CALLBACKS
4893             if (ssl->hsInfoOn)
4894                 AddPacketName("ServerHelloDone", &ssl->handShakeInfo);
4895             if (ssl->toInfoOn)
4896                 AddLateName("ServerHelloDone", &ssl->timeoutInfo);
4897         #endif
4898         ssl->options.serverState = SERVER_HELLODONE_COMPLETE;
4899         if (ssl->keys.encryptionOn) {
4900             *inOutIdx += ssl->keys.padSz;
4901         }
4902         if (ssl->options.resuming) {
4903             WOLFSSL_MSG("Not resuming as thought");
4904             ssl->options.resuming = 0;
4905         }
4906         break;
4907
4908     case finished:
4909         WOLFSSL_MSG("processing finished");
4910         ret = DoFinished(ssl, input, inOutIdx, size, totalSz, NO_SNIFF);
4911         break;
4912
4913 #ifndef NO_WOLFSSL_SERVER
4914     case client_hello:
4915         WOLFSSL_MSG("processing client hello");
4916         ret = DoClientHello(ssl, input, inOutIdx, size);
4917         break;
4918
4919     case client_key_exchange:
4920         WOLFSSL_MSG("processing client key exchange");
4921         ret = DoClientKeyExchange(ssl, input, inOutIdx, size);
4922         break;
4923
4924 #if !defined(NO_RSA) || defined(HAVE_ECC)
4925     case certificate_verify:
4926         WOLFSSL_MSG("processing certificate verify");
4927         ret = DoCertificateVerify(ssl, input, inOutIdx, size);
4928         break;
4929 #endif /* !NO_RSA || HAVE_ECC */
4930
4931 #endif /* !NO_WOLFSSL_SERVER */
4932
4933     default:
4934         WOLFSSL_MSG("Unknown handshake message type");
4935         ret = UNKNOWN_HANDSHAKE_TYPE;
4936         break;
4937     }
4938
4939     WOLFSSL_LEAVE("DoHandShakeMsgType()", ret);
4940     return ret;
4941 }
4942
4943
4944 static int DoHandShakeMsg(WOLFSSL* ssl, byte* input, word32* inOutIdx,
4945                           word32 totalSz)
4946 {
4947     byte   type;
4948     word32 size;
4949     int    ret = 0;
4950
4951     WOLFSSL_ENTER("DoHandShakeMsg()");
4952
4953     if (GetHandShakeHeader(ssl, input, inOutIdx, &type, &size, totalSz) != 0)
4954         return PARSE_ERROR;
4955
4956     ret = DoHandShakeMsgType(ssl, input, inOutIdx, type, size, totalSz);
4957
4958     WOLFSSL_LEAVE("DoHandShakeMsg()", ret);
4959     return ret;
4960 }
4961
4962
4963 #ifdef WOLFSSL_DTLS
4964
4965 static INLINE int DtlsCheckWindow(DtlsState* state)
4966 {
4967     word32 cur;
4968     word32 next;
4969     DtlsSeq window;
4970
4971     if (state->curEpoch == state->nextEpoch) {
4972         next = state->nextSeq;
4973         window = state->window;
4974     }
4975     else if (state->curEpoch < state->nextEpoch) {
4976         next = state->prevSeq;
4977         window = state->prevWindow;
4978     }
4979     else {
4980         return 0;
4981     }
4982
4983     cur = state->curSeq;
4984
4985     if ((next > DTLS_SEQ_BITS) && (cur < next - DTLS_SEQ_BITS)) {
4986         return 0;
4987     }
4988     else if ((cur < next) && (window & ((DtlsSeq)1 << (next - cur - 1)))) {
4989         return 0;
4990     }
4991
4992     return 1;
4993 }
4994
4995
4996 static INLINE int DtlsUpdateWindow(DtlsState* state)
4997 {
4998     word32 cur;
4999     word32* next;
5000     DtlsSeq* window;
5001
5002     if (state->curEpoch == state->nextEpoch) {
5003         next = &state->nextSeq;
5004         window = &state->window;
5005     }
5006     else {
5007         next = &state->prevSeq;
5008         window = &state->prevWindow;
5009     }
5010
5011     cur = state->curSeq;
5012
5013     if (cur < *next) {
5014         *window |= ((DtlsSeq)1 << (*next - cur - 1));
5015     }
5016     else {
5017         *window <<= (1 + cur - *next);
5018         *window |= 1;
5019         *next = cur + 1;
5020     }
5021
5022     return 1;
5023 }
5024
5025
5026 static int DtlsMsgDrain(WOLFSSL* ssl)
5027 {
5028     DtlsMsg* item = ssl->dtls_msg_list;
5029     int ret = 0;
5030
5031     /* While there is an item in the store list, and it is the expected
5032      * message, and it is complete, and there hasn't been an error in the
5033      * last messge... */
5034     while (item != NULL &&
5035             ssl->keys.dtls_expected_peer_handshake_number == item->seq &&
5036             item->fragSz == item->sz &&
5037             ret == 0) {
5038         word32 idx = 0;
5039         ssl->keys.dtls_expected_peer_handshake_number++;
5040         ret = DoHandShakeMsgType(ssl, item->msg,
5041                                  &idx, item->type, item->sz, item->sz);
5042         ssl->dtls_msg_list = item->next;
5043         DtlsMsgDelete(item, ssl->heap);
5044         item = ssl->dtls_msg_list;
5045     }
5046
5047     return ret;
5048 }
5049
5050
5051 static int DoDtlsHandShakeMsg(WOLFSSL* ssl, byte* input, word32* inOutIdx,
5052                           word32 totalSz)
5053 {
5054     byte type;
5055     word32 size;
5056     word32 fragOffset, fragSz;
5057     int ret = 0;
5058
5059     WOLFSSL_ENTER("DoDtlsHandShakeMsg()");
5060     if (GetDtlsHandShakeHeader(ssl, input, inOutIdx, &type,
5061                                &size, &fragOffset, &fragSz, totalSz) != 0)
5062         return PARSE_ERROR;
5063
5064     if (*inOutIdx + fragSz > totalSz)
5065         return INCOMPLETE_DATA;
5066
5067     /* Check the handshake sequence number first. If out of order,
5068      * add the current message to the list. If the message is in order,
5069      * but it is a fragment, add the current message to the list, then
5070      * check the head of the list to see if it is complete, if so, pop
5071      * it out as the current message. If the message is complete and in
5072      * order, process it. Check the head of the list to see if it is in
5073      * order, if so, process it. (Repeat until list exhausted.) If the
5074      * head is out of order, return for more processing.
5075      */
5076     if (ssl->keys.dtls_peer_handshake_number >
5077                                 ssl->keys.dtls_expected_peer_handshake_number) {
5078         /* Current message is out of order. It will get stored in the list.
5079          * Storing also takes care of defragmentation. */
5080         ssl->dtls_msg_list = DtlsMsgStore(ssl->dtls_msg_list,
5081                         ssl->keys.dtls_peer_handshake_number, input + *inOutIdx,
5082                         size, type, fragOffset, fragSz, ssl->heap);
5083         *inOutIdx += fragSz;
5084         ret = 0;
5085     }
5086     else if (ssl->keys.dtls_peer_handshake_number <
5087                                 ssl->keys.dtls_expected_peer_handshake_number) {
5088         /* Already saw this message and processed it. It can be ignored. */
5089         *inOutIdx += fragSz;
5090         ret = 0;
5091     }
5092     else if (fragSz < size) {
5093         /* Since this branch is in order, but fragmented, dtls_msg_list will be
5094          * pointing to the message with this fragment in it. Check it to see
5095          * if it is completed. */
5096         ssl->dtls_msg_list = DtlsMsgStore(ssl->dtls_msg_list,
5097                         ssl->keys.dtls_peer_handshake_number, input + *inOutIdx,
5098                         size, type, fragOffset, fragSz, ssl->heap);
5099         *inOutIdx += fragSz;
5100         ret = 0;
5101         if (ssl->dtls_msg_list != NULL &&
5102             ssl->dtls_msg_list->fragSz >= ssl->dtls_msg_list->sz)
5103             ret = DtlsMsgDrain(ssl);
5104     }
5105     else {
5106         /* This branch is in order next, and a complete message. */
5107         ssl->keys.dtls_expected_peer_handshake_number++;
5108         ret = DoHandShakeMsgType(ssl, input, inOutIdx, type, size, totalSz);
5109         if (ret == 0 && ssl->dtls_msg_list != NULL)
5110             ret = DtlsMsgDrain(ssl);
5111     }
5112
5113     WOLFSSL_LEAVE("DoDtlsHandShakeMsg()", ret);
5114     return ret;
5115 }
5116 #endif
5117
5118
5119 #if !defined(NO_OLD_TLS) || defined(HAVE_CHACHA) || defined(HAVE_AESCCM) \
5120     || defined(HAVE_AESGCM)
5121 static INLINE word32 GetSEQIncrement(WOLFSSL* ssl, int verify)
5122 {
5123 #ifdef WOLFSSL_DTLS
5124     if (ssl->options.dtls) {
5125         if (verify)
5126             return ssl->keys.dtls_state.curSeq; /* explicit from peer */
5127         else
5128             return ssl->keys.dtls_sequence_number - 1; /* already incremented */
5129     }
5130 #endif
5131     if (verify)
5132         return ssl->keys.peer_sequence_number++;
5133     else
5134         return ssl->keys.sequence_number++;
5135 }
5136 #endif
5137
5138
5139 #ifdef HAVE_AEAD
5140 static INLINE void AeadIncrementExpIV(WOLFSSL* ssl)
5141 {
5142     int i;
5143     for (i = AEAD_EXP_IV_SZ-1; i >= 0; i--) {
5144         if (++ssl->keys.aead_exp_IV[i]) return;
5145     }
5146 }
5147
5148
5149 #if defined(HAVE_POLY1305) && defined(HAVE_CHACHA)
5150 /*more recent rfc's concatonate input for poly1305 differently*/
5151 static int Poly1305Tag(WOLFSSL* ssl, byte* additional, const byte* out,
5152                        byte* cipher, word16 sz, byte* tag)
5153 {
5154     int ret       = 0;
5155     int paddingSz = 0;
5156     int msglen    = (sz - ssl->specs.aead_mac_size);
5157     word32 keySz  = 32;
5158     int blockSz   = 16;
5159     byte padding[16];
5160
5161     if (msglen < 0)
5162         return INPUT_CASE_ERROR;
5163
5164     XMEMSET(padding, 0, sizeof(padding));
5165
5166     if ((ret = wc_Poly1305SetKey(ssl->auth.poly1305, cipher, keySz)) != 0)
5167         return ret;
5168
5169     /* additional input to poly1305 */
5170     if ((ret = wc_Poly1305Update(ssl->auth.poly1305, additional, blockSz)) != 0)
5171         return ret;
5172
5173     /* cipher input */
5174     if ((ret = wc_Poly1305Update(ssl->auth.poly1305, out, msglen)) != 0)
5175         return ret;
5176
5177     /* handle padding for cipher input to make it 16 bytes long */
5178     if (msglen % 16 != 0) {
5179           paddingSz = (16 - (sz - ssl->specs.aead_mac_size) % 16);
5180           if (paddingSz < 0)
5181               return INPUT_CASE_ERROR;
5182
5183           if ((ret = wc_Poly1305Update(ssl->auth.poly1305, padding, paddingSz))
5184                  != 0)
5185               return ret;
5186     }
5187
5188     /* add size of AD and size of cipher to poly input */
5189     XMEMSET(padding, 0, sizeof(padding));
5190     padding[0] = blockSz;
5191
5192     /* 32 bit size of cipher to 64 bit endian */
5193     padding[8]  =  msglen       & 0xff;
5194     padding[9]  = (msglen >> 8) & 0xff;
5195     padding[10] = (msglen >>16) & 0xff;
5196     padding[11] = (msglen >>24) & 0xff;
5197     if ((ret = wc_Poly1305Update(ssl->auth.poly1305, padding, sizeof(padding)))
5198                 != 0)
5199         return ret;
5200
5201     /* generate tag */
5202     if ((ret = wc_Poly1305Final(ssl->auth.poly1305, tag)) != 0)
5203         return ret;
5204
5205     return ret;
5206 }
5207
5208
5209 /* Used for the older version of creating AEAD tags with Poly1305 */
5210 static int Poly1305TagOld(WOLFSSL* ssl, byte* additional, const byte* out,
5211                        byte* cipher, word16 sz, byte* tag)
5212 {
5213     int ret       = 0;
5214     int msglen    = (sz - ssl->specs.aead_mac_size);
5215     word32 keySz  = 32;
5216     byte padding[8]; /* used to temporarly store lengths */
5217
5218 #ifdef CHACHA_AEAD_TEST
5219       printf("Using old version of poly1305 input.\n");
5220 #endif
5221
5222     if (msglen < 0)
5223         return INPUT_CASE_ERROR;
5224
5225     if ((ret = wc_Poly1305SetKey(ssl->auth.poly1305, cipher, keySz)) != 0)
5226         return ret;
5227
5228     /* add TLS compressed length and additional input to poly1305 */
5229     additional[AEAD_AUTH_DATA_SZ - 2] = (msglen >> 8) & 0xff;
5230     additional[AEAD_AUTH_DATA_SZ - 1] =  msglen       & 0xff;
5231     if ((ret = wc_Poly1305Update(ssl->auth.poly1305, additional,
5232                    AEAD_AUTH_DATA_SZ)) != 0)
5233         return ret;
5234
5235     /* length of additional input plus padding */
5236     XMEMSET(padding, 0, sizeof(padding));
5237     padding[0] = AEAD_AUTH_DATA_SZ;
5238     if ((ret = wc_Poly1305Update(ssl->auth.poly1305, padding,
5239                     sizeof(padding))) != 0)
5240         return ret;
5241
5242
5243     /* add cipher info and then its length */
5244     XMEMSET(padding, 0, sizeof(padding));
5245     if ((ret = wc_Poly1305Update(ssl->auth.poly1305, out, msglen)) != 0)
5246         return ret;
5247
5248     /* 32 bit size of cipher to 64 bit endian */
5249     padding[0] =  msglen        & 0xff;
5250     padding[1] = (msglen >>  8) & 0xff;
5251     padding[2] = (msglen >> 16) & 0xff;
5252     padding[3] = (msglen >> 24) & 0xff;
5253     if ((ret = wc_Poly1305Update(ssl->auth.poly1305, padding, sizeof(padding)))
5254         != 0)
5255         return ret;
5256
5257     /* generate tag */
5258     if ((ret = wc_Poly1305Final(ssl->auth.poly1305, tag)) != 0)
5259         return ret;
5260
5261     return ret;
5262 }
5263
5264
5265 static int  ChachaAEADEncrypt(WOLFSSL* ssl, byte* out, const byte* input,
5266                               word16 sz)
5267 {
5268     const byte* additionalSrc = input - RECORD_HEADER_SZ;
5269     int ret = 0;
5270     byte tag[POLY1305_AUTH_SZ];
5271     byte additional[CHACHA20_BLOCK_SIZE];
5272     byte nonce[AEAD_NONCE_SZ];
5273     byte cipher[CHACHA20_256_KEY_SIZE]; /* generated key for poly1305 */
5274     #ifdef CHACHA_AEAD_TEST
5275         int i;
5276     #endif
5277
5278     XMEMSET(tag, 0, sizeof(tag));
5279     XMEMSET(nonce, 0, AEAD_NONCE_SZ);
5280     XMEMSET(cipher, 0, sizeof(cipher));
5281     XMEMSET(additional, 0, CHACHA20_BLOCK_SIZE);
5282
5283     /* get nonce */
5284     c32toa(ssl->keys.sequence_number, nonce + AEAD_IMP_IV_SZ
5285            + AEAD_SEQ_OFFSET);
5286
5287     /* opaque SEQ number stored for AD */
5288     c32toa(GetSEQIncrement(ssl, 0), additional + AEAD_SEQ_OFFSET);
5289
5290     /* Store the type, version. Unfortunately, they are in
5291      * the input buffer ahead of the plaintext. */
5292     #ifdef WOLFSSL_DTLS
5293         if (ssl->options.dtls) {
5294             c16toa(ssl->keys.dtls_epoch, additional);
5295             additionalSrc -= DTLS_HANDSHAKE_EXTRA;
5296         }
5297     #endif
5298
5299     XMEMCPY(additional + AEAD_TYPE_OFFSET, additionalSrc, 3);
5300
5301     #ifdef CHACHA_AEAD_TEST
5302         printf("Encrypt Additional : ");
5303         for (i = 0; i < CHACHA20_BLOCK_SIZE; i++) {
5304             printf("%02x", additional[i]);
5305         }
5306         printf("\n\n");
5307         printf("input before encryption :\n");
5308         for (i = 0; i < sz; i++) {
5309             printf("%02x", input[i]);
5310             if ((i + 1) % 16 == 0)
5311                 printf("\n");
5312         }
5313         printf("\n");
5314     #endif
5315
5316     /* set the nonce for chacha and get poly1305 key */
5317     if ((ret = wc_Chacha_SetIV(ssl->encrypt.chacha, nonce, 0)) != 0)
5318         return ret;
5319
5320         if ((ret = wc_Chacha_Process(ssl->encrypt.chacha, cipher,
5321                     cipher, sizeof(cipher))) != 0)
5322         return ret;
5323
5324     /* encrypt the plain text */
5325     if ((ret = wc_Chacha_Process(ssl->encrypt.chacha, out, input,
5326                    sz - ssl->specs.aead_mac_size)) != 0)
5327         return ret;
5328
5329     /* get the tag : future use of hmac could go here*/
5330     if (ssl->options.oldPoly == 1) {
5331         if ((ret = Poly1305TagOld(ssl, additional, (const byte* )out,
5332                     cipher, sz, tag)) != 0)
5333             return ret;
5334     }
5335     else {
5336         if ((ret = Poly1305Tag(ssl, additional, (const byte* )out,
5337                     cipher, sz, tag)) != 0)
5338             return ret;
5339     }
5340
5341     /* append tag to ciphertext */
5342     XMEMCPY(out + sz - ssl->specs.aead_mac_size, tag, sizeof(tag));
5343
5344     AeadIncrementExpIV(ssl);
5345     ForceZero(nonce, AEAD_NONCE_SZ);
5346
5347     #ifdef CHACHA_AEAD_TEST
5348        printf("mac tag :\n");
5349         for (i = 0; i < 16; i++) {
5350            printf("%02x", tag[i]);
5351            if ((i + 1) % 16 == 0)
5352                printf("\n");
5353         }
5354        printf("\n\noutput after encrypt :\n");
5355         for (i = 0; i < sz; i++) {
5356            printf("%02x", out[i]);
5357            if ((i + 1) % 16 == 0)
5358                printf("\n");
5359         }
5360         printf("\n");
5361     #endif
5362
5363     return ret;
5364 }
5365
5366
5367 static int ChachaAEADDecrypt(WOLFSSL* ssl, byte* plain, const byte* input,
5368                            word16 sz)
5369 {
5370     byte additional[CHACHA20_BLOCK_SIZE];
5371     byte nonce[AEAD_NONCE_SZ];
5372     byte tag[POLY1305_AUTH_SZ];
5373     byte cipher[CHACHA20_256_KEY_SIZE]; /* generated key for mac */
5374     int ret = 0;
5375
5376     XMEMSET(tag, 0, sizeof(tag));
5377     XMEMSET(cipher, 0, sizeof(cipher));
5378     XMEMSET(nonce, 0, AEAD_NONCE_SZ);
5379     XMEMSET(additional, 0, CHACHA20_BLOCK_SIZE);
5380
5381     #ifdef CHACHA_AEAD_TEST
5382        int i;
5383        printf("input before decrypt :\n");
5384         for (i = 0; i < sz; i++) {
5385            printf("%02x", input[i]);
5386            if ((i + 1) % 16 == 0)
5387                printf("\n");
5388         }
5389         printf("\n");
5390     #endif
5391
5392     /* get nonce */
5393     c32toa(ssl->keys.peer_sequence_number, nonce + AEAD_IMP_IV_SZ
5394             + AEAD_SEQ_OFFSET);
5395
5396     /* sequence number field is 64-bits, we only use 32-bits */
5397     c32toa(GetSEQIncrement(ssl, 1), additional + AEAD_SEQ_OFFSET);
5398
5399     /* get AD info */
5400     additional[AEAD_TYPE_OFFSET] = ssl->curRL.type;
5401     additional[AEAD_VMAJ_OFFSET] = ssl->curRL.pvMajor;
5402     additional[AEAD_VMIN_OFFSET] = ssl->curRL.pvMinor;
5403
5404     /* Store the type, version. */
5405     #ifdef WOLFSSL_DTLS
5406         if (ssl->options.dtls)
5407             c16toa(ssl->keys.dtls_state.curEpoch, additional);
5408     #endif
5409
5410     #ifdef CHACHA_AEAD_TEST
5411         printf("Decrypt Additional : ");
5412         for (i = 0; i < CHACHA20_BLOCK_SIZE; i++) {
5413             printf("%02x", additional[i]);
5414         }
5415         printf("\n\n");
5416     #endif
5417
5418     /* set nonce and get poly1305 key */
5419     if ((ret = wc_Chacha_SetIV(ssl->decrypt.chacha, nonce, 0)) != 0)
5420         return ret;
5421
5422     if ((ret = wc_Chacha_Process(ssl->decrypt.chacha, cipher,
5423                     cipher, sizeof(cipher))) != 0)
5424         return ret;
5425
5426     /* get the tag : future use of hmac could go here*/
5427     if (ssl->options.oldPoly == 1) {
5428         if ((ret = Poly1305TagOld(ssl, additional, input, cipher,
5429                         sz, tag)) != 0)
5430             return ret;
5431     }
5432     else {
5433         if ((ret = Poly1305Tag(ssl, additional, input, cipher,
5434                         sz, tag)) != 0)
5435             return ret;
5436     }
5437
5438     /* check mac sent along with packet */
5439     if (ConstantCompare(input + sz - ssl->specs.aead_mac_size, tag,
5440                 ssl->specs.aead_mac_size) != 0) {
5441         WOLFSSL_MSG("Mac did not match");
5442         SendAlert(ssl, alert_fatal, bad_record_mac);
5443         ForceZero(nonce, AEAD_NONCE_SZ);
5444         return VERIFY_MAC_ERROR;
5445     }
5446
5447     /* if mac was good decrypt message */
5448     if ((ret = wc_Chacha_Process(ssl->decrypt.chacha, plain, input,
5449                    sz - ssl->specs.aead_mac_size)) != 0)
5450         return ret;
5451
5452     #ifdef CHACHA_AEAD_TEST
5453        printf("plain after decrypt :\n");
5454         for (i = 0; i < sz; i++) {
5455            printf("%02x", plain[i]);
5456            if ((i + 1) % 16 == 0)
5457                printf("\n");
5458         }
5459         printf("\n");
5460     #endif
5461
5462     return ret;
5463 }
5464 #endif /* HAVE_CHACHA && HAVE_POLY1305 */
5465 #endif /* HAVE_AEAD */
5466
5467
5468 static INLINE int Encrypt(WOLFSSL* ssl, byte* out, const byte* input, word16 sz)
5469 {
5470     int ret = 0;
5471
5472     (void)out;
5473     (void)input;
5474     (void)sz;
5475
5476     if (ssl->encrypt.setup == 0) {
5477         WOLFSSL_MSG("Encrypt ciphers not setup");
5478         return ENCRYPT_ERROR;
5479     }
5480
5481 #ifdef HAVE_FUZZER
5482     if (ssl->fuzzerCb)
5483         ssl->fuzzerCb(ssl, input, sz, FUZZ_ENCRYPT, ssl->fuzzerCtx);
5484 #endif
5485
5486     switch (ssl->specs.bulk_cipher_algorithm) {
5487         #ifdef BUILD_ARC4
5488             case wolfssl_rc4:
5489                 wc_Arc4Process(ssl->encrypt.arc4, out, input, sz);
5490                 break;
5491         #endif
5492
5493         #ifdef BUILD_DES3
5494             case wolfssl_triple_des:
5495                 ret = wc_Des3_CbcEncrypt(ssl->encrypt.des3, out, input, sz);
5496                 break;
5497         #endif
5498
5499         #ifdef BUILD_AES
5500             case wolfssl_aes:
5501                 ret = wc_AesCbcEncrypt(ssl->encrypt.aes, out, input, sz);
5502                 break;
5503         #endif
5504
5505         #ifdef BUILD_AESGCM
5506             case wolfssl_aes_gcm:
5507                 {
5508                     byte additional[AEAD_AUTH_DATA_SZ];
5509                     byte nonce[AEAD_NONCE_SZ];
5510                     const byte* additionalSrc = input - 5;
5511
5512                     XMEMSET(additional, 0, AEAD_AUTH_DATA_SZ);
5513
5514                     /* sequence number field is 64-bits, we only use 32-bits */
5515                     c32toa(GetSEQIncrement(ssl, 0),
5516                                             additional + AEAD_SEQ_OFFSET);
5517
5518                     /* Store the type, version. Unfortunately, they are in
5519                      * the input buffer ahead of the plaintext. */
5520                     #ifdef WOLFSSL_DTLS
5521                         if (ssl->options.dtls) {
5522                             c16toa(ssl->keys.dtls_epoch, additional);
5523                             additionalSrc -= DTLS_HANDSHAKE_EXTRA;
5524                         }
5525                     #endif
5526                     XMEMCPY(additional + AEAD_TYPE_OFFSET, additionalSrc, 3);
5527
5528                     /* Store the length of the plain text minus the explicit
5529                      * IV length minus the authentication tag size. */
5530                     c16toa(sz - AEAD_EXP_IV_SZ - ssl->specs.aead_mac_size,
5531                                                 additional + AEAD_LEN_OFFSET);
5532                     XMEMCPY(nonce,
5533                                  ssl->keys.aead_enc_imp_IV, AEAD_IMP_IV_SZ);
5534                     XMEMCPY(nonce + AEAD_IMP_IV_SZ,
5535                                      ssl->keys.aead_exp_IV, AEAD_EXP_IV_SZ);
5536                     ret = wc_AesGcmEncrypt(ssl->encrypt.aes,
5537                                  out + AEAD_EXP_IV_SZ, input + AEAD_EXP_IV_SZ,
5538                                  sz - AEAD_EXP_IV_SZ - ssl->specs.aead_mac_size,
5539                                  nonce, AEAD_NONCE_SZ,
5540                                  out + sz - ssl->specs.aead_mac_size,
5541                                  ssl->specs.aead_mac_size,
5542                                  additional, AEAD_AUTH_DATA_SZ);
5543                     if (ret == 0)
5544                         AeadIncrementExpIV(ssl);
5545                     ForceZero(nonce, AEAD_NONCE_SZ);
5546                 }
5547                 break;
5548         #endif
5549
5550         #ifdef HAVE_AESCCM
5551             case wolfssl_aes_ccm:
5552                 {
5553                     byte additional[AEAD_AUTH_DATA_SZ];
5554                     byte nonce[AEAD_NONCE_SZ];
5555                     const byte* additionalSrc = input - 5;
5556
5557                     XMEMSET(additional, 0, AEAD_AUTH_DATA_SZ);
5558
5559                     /* sequence number field is 64-bits, we only use 32-bits */
5560                     c32toa(GetSEQIncrement(ssl, 0),
5561                                             additional + AEAD_SEQ_OFFSET);
5562
5563                     /* Store the type, version. Unfortunately, they are in
5564                      * the input buffer ahead of the plaintext. */
5565                     #ifdef WOLFSSL_DTLS
5566                         if (ssl->options.dtls) {
5567                             c16toa(ssl->keys.dtls_epoch, additional);
5568                             additionalSrc -= DTLS_HANDSHAKE_EXTRA;
5569                         }
5570                     #endif
5571                     XMEMCPY(additional + AEAD_TYPE_OFFSET, additionalSrc, 3);
5572
5573                     /* Store the length of the plain text minus the explicit
5574                      * IV length minus the authentication tag size. */
5575                     c16toa(sz - AEAD_EXP_IV_SZ - ssl->specs.aead_mac_size,
5576                                                 additional + AEAD_LEN_OFFSET);
5577                     XMEMCPY(nonce,
5578                                  ssl->keys.aead_enc_imp_IV, AEAD_IMP_IV_SZ);
5579                     XMEMCPY(nonce + AEAD_IMP_IV_SZ,
5580                                      ssl->keys.aead_exp_IV, AEAD_EXP_IV_SZ);
5581                     wc_AesCcmEncrypt(ssl->encrypt.aes,
5582                         out + AEAD_EXP_IV_SZ, input + AEAD_EXP_IV_SZ,
5583                             sz - AEAD_EXP_IV_SZ - ssl->specs.aead_mac_size,
5584                         nonce, AEAD_NONCE_SZ,
5585                         out + sz - ssl->specs.aead_mac_size,
5586                         ssl->specs.aead_mac_size,
5587                         additional, AEAD_AUTH_DATA_SZ);
5588                     AeadIncrementExpIV(ssl);
5589                     ForceZero(nonce, AEAD_NONCE_SZ);
5590                 }
5591                 break;
5592         #endif
5593
5594         #ifdef HAVE_CAMELLIA
5595             case wolfssl_camellia:
5596                 wc_CamelliaCbcEncrypt(ssl->encrypt.cam, out, input, sz);
5597                 break;
5598         #endif
5599
5600         #ifdef HAVE_HC128
5601             case wolfssl_hc128:
5602                 ret = wc_Hc128_Process(ssl->encrypt.hc128, out, input, sz);
5603                 break;
5604         #endif
5605
5606         #ifdef BUILD_RABBIT
5607             case wolfssl_rabbit:
5608                 ret = wc_RabbitProcess(ssl->encrypt.rabbit, out, input, sz);
5609                 break;
5610         #endif
5611
5612         #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
5613             case wolfssl_chacha:
5614                 ret = ChachaAEADEncrypt(ssl, out, input, sz);
5615                 break;
5616         #endif
5617
5618         #ifdef HAVE_NULL_CIPHER
5619             case wolfssl_cipher_null:
5620                 if (input != out) {
5621                     XMEMMOVE(out, input, sz);
5622                 }
5623                 break;
5624         #endif
5625
5626             default:
5627                 WOLFSSL_MSG("wolfSSL Encrypt programming error");
5628                 ret = ENCRYPT_ERROR;
5629     }
5630
5631     return ret;
5632 }
5633
5634
5635
5636 static INLINE int Decrypt(WOLFSSL* ssl, byte* plain, const byte* input,
5637                            word16 sz)
5638 {
5639     int ret = 0;
5640
5641     (void)plain;
5642     (void)input;
5643     (void)sz;
5644
5645     if (ssl->decrypt.setup == 0) {
5646         WOLFSSL_MSG("Decrypt ciphers not setup");
5647         return DECRYPT_ERROR;
5648     }
5649
5650     switch (ssl->specs.bulk_cipher_algorithm) {
5651         #ifdef BUILD_ARC4
5652             case wolfssl_rc4:
5653                 wc_Arc4Process(ssl->decrypt.arc4, plain, input, sz);
5654                 break;
5655         #endif
5656
5657         #ifdef BUILD_DES3
5658             case wolfssl_triple_des:
5659                 ret = wc_Des3_CbcDecrypt(ssl->decrypt.des3, plain, input, sz);
5660                 break;
5661         #endif
5662
5663         #ifdef BUILD_AES
5664             case wolfssl_aes:
5665                 ret = wc_AesCbcDecrypt(ssl->decrypt.aes, plain, input, sz);
5666                 break;
5667         #endif
5668
5669         #ifdef BUILD_AESGCM
5670             case wolfssl_aes_gcm:
5671             {
5672                 byte additional[AEAD_AUTH_DATA_SZ];
5673                 byte nonce[AEAD_NONCE_SZ];
5674
5675                 XMEMSET(additional, 0, AEAD_AUTH_DATA_SZ);
5676
5677                 /* sequence number field is 64-bits, we only use 32-bits */
5678                 c32toa(GetSEQIncrement(ssl, 1), additional + AEAD_SEQ_OFFSET);
5679
5680                 #ifdef WOLFSSL_DTLS
5681                     if (ssl->options.dtls)
5682                         c16toa(ssl->keys.dtls_state.curEpoch, additional);
5683                 #endif
5684
5685                 additional[AEAD_TYPE_OFFSET] = ssl->curRL.type;
5686                 additional[AEAD_VMAJ_OFFSET] = ssl->curRL.pvMajor;
5687                 additional[AEAD_VMIN_OFFSET] = ssl->curRL.pvMinor;
5688
5689                 c16toa(sz - AEAD_EXP_IV_SZ - ssl->specs.aead_mac_size,
5690                                         additional + AEAD_LEN_OFFSET);
5691                 XMEMCPY(nonce, ssl->keys.aead_dec_imp_IV, AEAD_IMP_IV_SZ);
5692                 XMEMCPY(nonce + AEAD_IMP_IV_SZ, input, AEAD_EXP_IV_SZ);
5693                 if (wc_AesGcmDecrypt(ssl->decrypt.aes,
5694                             plain + AEAD_EXP_IV_SZ,
5695                             input + AEAD_EXP_IV_SZ,
5696                                 sz - AEAD_EXP_IV_SZ - ssl->specs.aead_mac_size,
5697                             nonce, AEAD_NONCE_SZ,
5698                             input + sz - ssl->specs.aead_mac_size,
5699                             ssl->specs.aead_mac_size,
5700                             additional, AEAD_AUTH_DATA_SZ) < 0) {
5701                     SendAlert(ssl, alert_fatal, bad_record_mac);
5702                     ret = VERIFY_MAC_ERROR;
5703                 }
5704                 ForceZero(nonce, AEAD_NONCE_SZ);
5705             }
5706             break;
5707         #endif
5708
5709         #ifdef HAVE_AESCCM
5710             case wolfssl_aes_ccm:
5711             {
5712                 byte additional[AEAD_AUTH_DATA_SZ];
5713                 byte nonce[AEAD_NONCE_SZ];
5714
5715                 XMEMSET(additional, 0, AEAD_AUTH_DATA_SZ);
5716
5717                 /* sequence number field is 64-bits, we only use 32-bits */
5718                 c32toa(GetSEQIncrement(ssl, 1), additional + AEAD_SEQ_OFFSET);
5719
5720                 #ifdef WOLFSSL_DTLS
5721                     if (ssl->options.dtls)
5722                         c16toa(ssl->keys.dtls_state.curEpoch, additional);
5723                 #endif
5724
5725                 additional[AEAD_TYPE_OFFSET] = ssl->curRL.type;
5726                 additional[AEAD_VMAJ_OFFSET] = ssl->curRL.pvMajor;
5727                 additional[AEAD_VMIN_OFFSET] = ssl->curRL.pvMinor;
5728
5729                 c16toa(sz - AEAD_EXP_IV_SZ - ssl->specs.aead_mac_size,
5730                                         additional + AEAD_LEN_OFFSET);
5731                 XMEMCPY(nonce, ssl->keys.aead_dec_imp_IV, AEAD_IMP_IV_SZ);
5732                 XMEMCPY(nonce + AEAD_IMP_IV_SZ, input, AEAD_EXP_IV_SZ);
5733                 if (wc_AesCcmDecrypt(ssl->decrypt.aes,
5734                             plain + AEAD_EXP_IV_SZ,
5735                             input + AEAD_EXP_IV_SZ,
5736                                 sz - AEAD_EXP_IV_SZ - ssl->specs.aead_mac_size,
5737                             nonce, AEAD_NONCE_SZ,
5738                             input + sz - ssl->specs.aead_mac_size,
5739                             ssl->specs.aead_mac_size,
5740                             additional, AEAD_AUTH_DATA_SZ) < 0) {
5741                     SendAlert(ssl, alert_fatal, bad_record_mac);
5742                     ret = VERIFY_MAC_ERROR;
5743                 }
5744                 ForceZero(nonce, AEAD_NONCE_SZ);
5745             }
5746             break;
5747         #endif
5748
5749         #ifdef HAVE_CAMELLIA
5750             case wolfssl_camellia:
5751                 wc_CamelliaCbcDecrypt(ssl->decrypt.cam, plain, input, sz);
5752                 break;
5753         #endif
5754
5755         #ifdef HAVE_HC128
5756             case wolfssl_hc128:
5757                 ret = wc_Hc128_Process(ssl->decrypt.hc128, plain, input, sz);
5758                 break;
5759         #endif
5760
5761         #ifdef BUILD_RABBIT
5762             case wolfssl_rabbit:
5763                 ret = wc_RabbitProcess(ssl->decrypt.rabbit, plain, input, sz);
5764                 break;
5765         #endif
5766
5767         #if defined(HAVE_CHACHA) && defined(HAVE_POLY1305)
5768             case wolfssl_chacha:
5769                 ret = ChachaAEADDecrypt(ssl, plain, input, sz);
5770                 break;
5771         #endif
5772
5773         #ifdef HAVE_NULL_CIPHER
5774             case wolfssl_cipher_null:
5775                 if (input != plain) {
5776                     XMEMMOVE(plain, input, sz);
5777                 }
5778                 break;
5779         #endif
5780
5781             default:
5782                 WOLFSSL_MSG("wolfSSL Decrypt programming error");
5783                 ret = DECRYPT_ERROR;
5784     }
5785
5786     return ret;
5787 }
5788
5789
5790 /* check cipher text size for sanity */
5791 static int SanityCheckCipherText(WOLFSSL* ssl, word32 encryptSz)
5792 {
5793 #ifdef HAVE_TRUNCATED_HMAC
5794     word32 minLength = ssl->truncated_hmac ? TRUNCATED_HMAC_SZ
5795                                            : ssl->specs.hash_size;
5796 #else
5797     word32 minLength = ssl->specs.hash_size; /* covers stream */
5798 #endif
5799
5800     if (ssl->specs.cipher_type == block) {
5801         if (encryptSz % ssl->specs.block_size) {
5802             WOLFSSL_MSG("Block ciphertext not block size");
5803             return SANITY_CIPHER_E;
5804         }
5805
5806         minLength++;  /* pad byte */
5807
5808         if (ssl->specs.block_size > minLength)
5809             minLength = ssl->specs.block_size;
5810
5811         if (ssl->options.tls1_1)
5812             minLength += ssl->specs.block_size;  /* explicit IV */
5813     }
5814     else if (ssl->specs.cipher_type == aead) {
5815         minLength = ssl->specs.aead_mac_size;    /* authTag size */
5816         if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
5817            minLength += AEAD_EXP_IV_SZ;          /* explicit IV  */
5818     }
5819
5820     if (encryptSz < minLength) {
5821         WOLFSSL_MSG("Ciphertext not minimum size");
5822         return SANITY_CIPHER_E;
5823     }
5824
5825     return 0;
5826 }
5827
5828
5829 #ifndef NO_OLD_TLS
5830
5831 static INLINE void Md5Rounds(int rounds, const byte* data, int sz)
5832 {
5833     Md5 md5;
5834     int i;
5835
5836     wc_InitMd5(&md5);
5837
5838     for (i = 0; i < rounds; i++)
5839         wc_Md5Update(&md5, data, sz);
5840 }
5841
5842
5843
5844 /* do a dummy sha round */
5845 static INLINE void ShaRounds(int rounds, const byte* data, int sz)
5846 {
5847     Sha sha;
5848     int i;
5849
5850     wc_InitSha(&sha);  /* no error check on purpose, dummy round */
5851
5852     for (i = 0; i < rounds; i++)
5853         wc_ShaUpdate(&sha, data, sz);
5854 }
5855 #endif
5856
5857
5858 #ifndef NO_SHA256
5859
5860 static INLINE void Sha256Rounds(int rounds, const byte* data, int sz)
5861 {
5862     Sha256 sha256;
5863     int i;
5864
5865     wc_InitSha256(&sha256);  /* no error check on purpose, dummy round */
5866
5867     for (i = 0; i < rounds; i++) {
5868         wc_Sha256Update(&sha256, data, sz);
5869         /* no error check on purpose, dummy round */
5870     }
5871
5872 }
5873
5874 #endif
5875
5876
5877 #ifdef WOLFSSL_SHA384
5878
5879 static INLINE void Sha384Rounds(int rounds, const byte* data, int sz)
5880 {
5881     Sha384 sha384;
5882     int i;
5883
5884     wc_InitSha384(&sha384);  /* no error check on purpose, dummy round */
5885
5886     for (i = 0; i < rounds; i++) {
5887         wc_Sha384Update(&sha384, data, sz);
5888         /* no error check on purpose, dummy round */
5889     }
5890 }
5891
5892 #endif
5893
5894
5895 #ifdef WOLFSSL_SHA512
5896
5897 static INLINE void Sha512Rounds(int rounds, const byte* data, int sz)
5898 {
5899     Sha512 sha512;
5900     int i;
5901
5902     wc_InitSha512(&sha512);  /* no error check on purpose, dummy round */
5903
5904     for (i = 0; i < rounds; i++) {
5905         wc_Sha512Update(&sha512, data, sz);
5906         /* no error check on purpose, dummy round */
5907     }
5908 }
5909
5910 #endif
5911
5912
5913 #ifdef WOLFSSL_RIPEMD
5914
5915 static INLINE void RmdRounds(int rounds, const byte* data, int sz)
5916 {
5917     RipeMd ripemd;
5918     int i;
5919
5920     wc_InitRipeMd(&ripemd);
5921
5922     for (i = 0; i < rounds; i++)
5923         wc_RipeMdUpdate(&ripemd, data, sz);
5924 }
5925
5926 #endif
5927
5928
5929 /* Do dummy rounds */
5930 static INLINE void DoRounds(int type, int rounds, const byte* data, int sz)
5931 {
5932     switch (type) {
5933
5934         case no_mac :
5935             break;
5936
5937 #ifndef NO_OLD_TLS
5938 #ifndef NO_MD5
5939         case md5_mac :
5940             Md5Rounds(rounds, data, sz);
5941             break;
5942 #endif
5943
5944 #ifndef NO_SHA
5945         case sha_mac :
5946             ShaRounds(rounds, data, sz);
5947             break;
5948 #endif
5949 #endif
5950
5951 #ifndef NO_SHA256
5952         case sha256_mac :
5953             Sha256Rounds(rounds, data, sz);
5954             break;
5955 #endif
5956
5957 #ifdef WOLFSSL_SHA384
5958         case sha384_mac :
5959             Sha384Rounds(rounds, data, sz);
5960             break;
5961 #endif
5962
5963 #ifdef WOLFSSL_SHA512
5964         case sha512_mac :
5965             Sha512Rounds(rounds, data, sz);
5966             break;
5967 #endif
5968
5969 #ifdef WOLFSSL_RIPEMD
5970         case rmd_mac :
5971             RmdRounds(rounds, data, sz);
5972             break;
5973 #endif
5974
5975         default:
5976             WOLFSSL_MSG("Bad round type");
5977             break;
5978     }
5979 }
5980
5981
5982 /* do number of compression rounds on dummy data */
5983 static INLINE void CompressRounds(WOLFSSL* ssl, int rounds, const byte* dummy)
5984 {
5985     if (rounds)
5986         DoRounds(ssl->specs.mac_algorithm, rounds, dummy, COMPRESS_LOWER);
5987 }
5988
5989
5990 /* check all length bytes for the pad value, return 0 on success */
5991 static int PadCheck(const byte* a, byte pad, int length)
5992 {
5993     int i;
5994     int compareSum = 0;
5995
5996     for (i = 0; i < length; i++) {
5997         compareSum |= a[i] ^ pad;
5998     }
5999
6000     return compareSum;
6001 }
6002
6003
6004 /* get compression extra rounds */
6005 static INLINE int GetRounds(int pLen, int padLen, int t)
6006 {
6007     int  roundL1 = 1;  /* round up flags */
6008     int  roundL2 = 1;
6009
6010     int L1 = COMPRESS_CONSTANT + pLen - t;
6011     int L2 = COMPRESS_CONSTANT + pLen - padLen - 1 - t;
6012
6013     L1 -= COMPRESS_UPPER;
6014     L2 -= COMPRESS_UPPER;
6015
6016     if ( (L1 % COMPRESS_LOWER) == 0)
6017         roundL1 = 0;
6018     if ( (L2 % COMPRESS_LOWER) == 0)
6019         roundL2 = 0;
6020
6021     L1 /= COMPRESS_LOWER;
6022     L2 /= COMPRESS_LOWER;
6023
6024     L1 += roundL1;
6025     L2 += roundL2;
6026
6027     return L1 - L2;
6028 }
6029
6030
6031 /* timing resistant pad/verify check, return 0 on success */
6032 static int TimingPadVerify(WOLFSSL* ssl, const byte* input, int padLen, int t,
6033                            int pLen, int content)
6034 {
6035     byte verify[MAX_DIGEST_SIZE];
6036     byte dmy[sizeof(WOLFSSL) >= MAX_PAD_SIZE ? 1 : MAX_PAD_SIZE] = {0};
6037     byte* dummy = sizeof(dmy) < MAX_PAD_SIZE ? (byte*) ssl : dmy;
6038     int  ret = 0;
6039
6040     (void)dmy;
6041
6042     if ( (t + padLen + 1) > pLen) {
6043         WOLFSSL_MSG("Plain Len not long enough for pad/mac");
6044         PadCheck(dummy, (byte)padLen, MAX_PAD_SIZE);
6045         ssl->hmac(ssl, verify, input, pLen - t, content, 1); /* still compare */
6046         ConstantCompare(verify, input + pLen - t, t);
6047
6048         return VERIFY_MAC_ERROR;
6049     }
6050
6051     if (PadCheck(input + pLen - (padLen + 1), (byte)padLen, padLen + 1) != 0) {
6052         WOLFSSL_MSG("PadCheck failed");
6053         PadCheck(dummy, (byte)padLen, MAX_PAD_SIZE - padLen - 1);
6054         ssl->hmac(ssl, verify, input, pLen - t, content, 1); /* still compare */
6055         ConstantCompare(verify, input + pLen - t, t);
6056
6057         return VERIFY_MAC_ERROR;
6058     }
6059
6060     PadCheck(dummy, (byte)padLen, MAX_PAD_SIZE - padLen - 1);
6061     ret = ssl->hmac(ssl, verify, input, pLen - padLen - 1 - t, content, 1);
6062
6063     CompressRounds(ssl, GetRounds(pLen, padLen, t), dummy);
6064
6065     if (ConstantCompare(verify, input + (pLen - padLen - 1 - t), t) != 0) {
6066         WOLFSSL_MSG("Verify MAC compare failed");
6067         return VERIFY_MAC_ERROR;
6068     }
6069
6070     if (ret != 0)
6071         return VERIFY_MAC_ERROR;
6072     return 0;
6073 }
6074
6075
6076 int DoApplicationData(WOLFSSL* ssl, byte* input, word32* inOutIdx)
6077 {
6078     word32 msgSz   = ssl->keys.encryptSz;
6079     word32 idx     = *inOutIdx;
6080     int    dataSz;
6081     int    ivExtra = 0;
6082     byte*  rawData = input + idx;  /* keep current  for hmac */
6083 #ifdef HAVE_LIBZ
6084     byte   decomp[MAX_RECORD_SIZE + MAX_COMP_EXTRA];
6085 #endif
6086
6087     if (ssl->options.handShakeDone == 0) {
6088         WOLFSSL_MSG("Received App data before a handshake completed");
6089         SendAlert(ssl, alert_fatal, unexpected_message);
6090         return OUT_OF_ORDER_E;
6091     }
6092
6093     if (ssl->specs.cipher_type == block) {
6094         if (ssl->options.tls1_1)
6095             ivExtra = ssl->specs.block_size;
6096     }
6097     else if (ssl->specs.cipher_type == aead) {
6098         if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
6099             ivExtra = AEAD_EXP_IV_SZ;
6100     }
6101
6102     dataSz = msgSz - ivExtra - ssl->keys.padSz;
6103     if (dataSz < 0) {
6104         WOLFSSL_MSG("App data buffer error, malicious input?");
6105         return BUFFER_ERROR;
6106     }
6107
6108     /* read data */
6109     if (dataSz) {
6110         int rawSz = dataSz;       /* keep raw size for idx adjustment */
6111
6112 #ifdef HAVE_LIBZ
6113         if (ssl->options.usingCompression) {
6114             dataSz = myDeCompress(ssl, rawData, dataSz, decomp, sizeof(decomp));
6115             if (dataSz < 0) return dataSz;
6116         }
6117 #endif
6118         idx += rawSz;
6119
6120         ssl->buffers.clearOutputBuffer.buffer = rawData;
6121         ssl->buffers.clearOutputBuffer.length = dataSz;
6122     }
6123
6124     idx += ssl->keys.padSz;
6125
6126 #ifdef HAVE_LIBZ
6127     /* decompress could be bigger, overwrite after verify */
6128     if (ssl->options.usingCompression)
6129         XMEMMOVE(rawData, decomp, dataSz);
6130 #endif
6131
6132     *inOutIdx = idx;
6133     return 0;
6134 }
6135
6136
6137 /* process alert, return level */
6138 static int DoAlert(WOLFSSL* ssl, byte* input, word32* inOutIdx, int* type,
6139                    word32 totalSz)
6140 {
6141     byte level;
6142     byte code;
6143
6144     #ifdef WOLFSSL_CALLBACKS
6145         if (ssl->hsInfoOn)
6146             AddPacketName("Alert", &ssl->handShakeInfo);
6147         if (ssl->toInfoOn)
6148             /* add record header back on to info + 2 byte level, data */
6149             AddPacketInfo("Alert", &ssl->timeoutInfo, input + *inOutIdx -
6150                           RECORD_HEADER_SZ, 2 + RECORD_HEADER_SZ, ssl->heap);
6151     #endif
6152
6153     /* make sure can read the message */
6154     if (*inOutIdx + ALERT_SIZE > totalSz)
6155         return BUFFER_E;
6156
6157     level = input[(*inOutIdx)++];
6158     code  = input[(*inOutIdx)++];
6159     ssl->alert_history.last_rx.code = code;
6160     ssl->alert_history.last_rx.level = level;
6161     *type = code;
6162     if (level == alert_fatal) {
6163         ssl->options.isClosed = 1;  /* Don't send close_notify */
6164     }
6165
6166     WOLFSSL_MSG("Got alert");
6167     if (*type == close_notify) {
6168         WOLFSSL_MSG("    close notify");
6169         ssl->options.closeNotify = 1;
6170     }
6171     WOLFSSL_ERROR(*type);
6172     if (ssl->keys.encryptionOn) {
6173         if (*inOutIdx + ssl->keys.padSz > totalSz)
6174             return BUFFER_E;
6175         *inOutIdx += ssl->keys.padSz;
6176     }
6177
6178     return level;
6179 }
6180
6181 static int GetInputData(WOLFSSL *ssl, word32 size)
6182 {
6183     int in;
6184     int inSz;
6185     int maxLength;
6186     int usedLength;
6187     int dtlsExtra = 0;
6188
6189
6190     /* check max input length */
6191     usedLength = ssl->buffers.inputBuffer.length - ssl->buffers.inputBuffer.idx;
6192     maxLength  = ssl->buffers.inputBuffer.bufferSize - usedLength;
6193     inSz       = (int)(size - usedLength);      /* from last partial read */
6194
6195 #ifdef WOLFSSL_DTLS
6196     if (ssl->options.dtls) {
6197         if (size < ssl->dtls_expected_rx)
6198             dtlsExtra = (int)(ssl->dtls_expected_rx - size);
6199         inSz = ssl->dtls_expected_rx;
6200     }
6201 #endif
6202
6203     if (inSz > maxLength) {
6204         if (GrowInputBuffer(ssl, size + dtlsExtra, usedLength) < 0)
6205             return MEMORY_E;
6206     }
6207
6208     if (inSz <= 0)
6209         return BUFFER_ERROR;
6210
6211     /* Put buffer data at start if not there */
6212     if (usedLength > 0 && ssl->buffers.inputBuffer.idx != 0)
6213         XMEMMOVE(ssl->buffers.inputBuffer.buffer,
6214                 ssl->buffers.inputBuffer.buffer + ssl->buffers.inputBuffer.idx,
6215                 usedLength);
6216
6217     /* remove processed data */
6218     ssl->buffers.inputBuffer.idx    = 0;
6219     ssl->buffers.inputBuffer.length = usedLength;
6220
6221     /* read data from network */
6222     do {
6223         in = Receive(ssl,
6224                      ssl->buffers.inputBuffer.buffer +
6225                      ssl->buffers.inputBuffer.length,
6226                      inSz);
6227         if (in == -1)
6228             return SOCKET_ERROR_E;
6229
6230         if (in == WANT_READ)
6231             return WANT_READ;
6232
6233         if (in > inSz)
6234             return RECV_OVERFLOW_E;
6235
6236         ssl->buffers.inputBuffer.length += in;
6237         inSz -= in;
6238
6239     } while (ssl->buffers.inputBuffer.length < size);
6240
6241     return 0;
6242 }
6243
6244
6245 static INLINE int VerifyMac(WOLFSSL* ssl, const byte* input, word32 msgSz,
6246                             int content, word32* padSz)
6247 {
6248     int    ivExtra = 0;
6249     int    ret;
6250     word32 pad     = 0;
6251     word32 padByte = 0;
6252 #ifdef HAVE_TRUNCATED_HMAC
6253     word32 digestSz = ssl->truncated_hmac ? TRUNCATED_HMAC_SZ
6254                                           : ssl->specs.hash_size;
6255 #else
6256     word32 digestSz = ssl->specs.hash_size;
6257 #endif
6258     byte   verify[MAX_DIGEST_SIZE];
6259
6260     if (ssl->specs.cipher_type == block) {
6261         if (ssl->options.tls1_1)
6262             ivExtra = ssl->specs.block_size;
6263         pad = *(input + msgSz - ivExtra - 1);
6264         padByte = 1;
6265
6266         if (ssl->options.tls) {
6267             ret = TimingPadVerify(ssl, input, pad, digestSz, msgSz - ivExtra,
6268                                   content);
6269             if (ret != 0)
6270                 return ret;
6271         }
6272         else {  /* sslv3, some implementations have bad padding, but don't
6273                  * allow bad read */
6274             int  badPadLen = 0;
6275             byte dmy[sizeof(WOLFSSL) >= MAX_PAD_SIZE ? 1 : MAX_PAD_SIZE] = {0};
6276             byte* dummy = sizeof(dmy) < MAX_PAD_SIZE ? (byte*) ssl : dmy;
6277
6278             (void)dmy;
6279
6280             if (pad > (msgSz - digestSz - 1)) {
6281                 WOLFSSL_MSG("Plain Len not long enough for pad/mac");
6282                 pad       = 0;  /* no bad read */
6283                 badPadLen = 1;
6284             }
6285             PadCheck(dummy, (byte)pad, MAX_PAD_SIZE);  /* timing only */
6286             ret = ssl->hmac(ssl, verify, input, msgSz - digestSz - pad - 1,
6287                             content, 1);
6288             if (ConstantCompare(verify, input + msgSz - digestSz - pad - 1,
6289                                 digestSz) != 0)
6290                 return VERIFY_MAC_ERROR;
6291             if (ret != 0 || badPadLen)
6292                 return VERIFY_MAC_ERROR;
6293         }
6294     }
6295     else if (ssl->specs.cipher_type == stream) {
6296         ret = ssl->hmac(ssl, verify, input, msgSz - digestSz, content, 1);
6297         if (ConstantCompare(verify, input + msgSz - digestSz, digestSz) != 0){
6298             return VERIFY_MAC_ERROR;
6299         }
6300         if (ret != 0)
6301             return VERIFY_MAC_ERROR;
6302     }
6303
6304     if (ssl->specs.cipher_type == aead) {
6305         *padSz = ssl->specs.aead_mac_size;
6306     }
6307     else {
6308         *padSz = digestSz + pad + padByte;
6309     }
6310
6311     return 0;
6312 }
6313
6314
6315 /* process input requests, return 0 is done, 1 is call again to complete, and
6316    negative number is error */
6317 int ProcessReply(WOLFSSL* ssl)
6318 {
6319     int    ret = 0, type, readSz;
6320     int    atomicUser = 0;
6321     word32 startIdx = 0;
6322 #ifdef WOLFSSL_DTLS
6323     int    used;
6324 #endif
6325
6326 #ifdef ATOMIC_USER
6327     if (ssl->ctx->DecryptVerifyCb)
6328         atomicUser = 1;
6329 #endif
6330
6331     if (ssl->error != 0 && ssl->error != WANT_READ && ssl->error != WANT_WRITE){
6332         WOLFSSL_MSG("ProcessReply retry in error state, not allowed");
6333         return ssl->error;
6334     }
6335
6336     for (;;) {
6337         switch (ssl->options.processReply) {
6338
6339         /* in the WOLFSSL_SERVER case, get the first byte for detecting
6340          * old client hello */
6341         case doProcessInit:
6342
6343             readSz = RECORD_HEADER_SZ;
6344
6345             #ifdef WOLFSSL_DTLS
6346                 if (ssl->options.dtls)
6347                     readSz = DTLS_RECORD_HEADER_SZ;
6348             #endif
6349
6350             /* get header or return error */
6351             if (!ssl->options.dtls) {
6352                 if ((ret = GetInputData(ssl, readSz)) < 0)
6353                     return ret;
6354             } else {
6355             #ifdef WOLFSSL_DTLS
6356                 /* read ahead may already have header */
6357                 used = ssl->buffers.inputBuffer.length -
6358                        ssl->buffers.inputBuffer.idx;
6359                 if (used < readSz)
6360                     if ((ret = GetInputData(ssl, readSz)) < 0)
6361                         return ret;
6362             #endif
6363             }
6364
6365 #ifdef OLD_HELLO_ALLOWED
6366
6367             /* see if sending SSLv2 client hello */
6368             if ( ssl->options.side == WOLFSSL_SERVER_END &&
6369                  ssl->options.clientState == NULL_STATE &&
6370                  ssl->buffers.inputBuffer.buffer[ssl->buffers.inputBuffer.idx]
6371                          != handshake) {
6372                 byte b0, b1;
6373
6374                 ssl->options.processReply = runProcessOldClientHello;
6375
6376                 /* sanity checks before getting size at front */
6377                 if (ssl->buffers.inputBuffer.buffer[
6378                           ssl->buffers.inputBuffer.idx + 2] != OLD_HELLO_ID) {
6379                     WOLFSSL_MSG("Not a valid old client hello");
6380                     return PARSE_ERROR;
6381                 }
6382
6383                 if (ssl->buffers.inputBuffer.buffer[
6384                           ssl->buffers.inputBuffer.idx + 3] != SSLv3_MAJOR &&
6385                     ssl->buffers.inputBuffer.buffer[
6386                           ssl->buffers.inputBuffer.idx + 3] != DTLS_MAJOR) {
6387                     WOLFSSL_MSG("Not a valid version in old client hello");
6388                     return PARSE_ERROR;
6389                 }
6390
6391                 /* how many bytes need ProcessOldClientHello */
6392                 b0 =
6393                 ssl->buffers.inputBuffer.buffer[ssl->buffers.inputBuffer.idx++];
6394                 b1 =
6395                 ssl->buffers.inputBuffer.buffer[ssl->buffers.inputBuffer.idx++];
6396                 ssl->curSize = (word16)(((b0 & 0x7f) << 8) | b1);
6397             }
6398             else {
6399                 ssl->options.processReply = getRecordLayerHeader;
6400                 continue;
6401             }
6402
6403         /* in the WOLFSSL_SERVER case, run the old client hello */
6404         case runProcessOldClientHello:
6405
6406             /* get sz bytes or return error */
6407             if (!ssl->options.dtls) {
6408                 if ((ret = GetInputData(ssl, ssl->curSize)) < 0)
6409                     return ret;
6410             } else {
6411             #ifdef WOLFSSL_DTLS
6412                 /* read ahead may already have */
6413                 used = ssl->buffers.inputBuffer.length -
6414                        ssl->buffers.inputBuffer.idx;
6415                 if (used < ssl->curSize)
6416                     if ((ret = GetInputData(ssl, ssl->curSize)) < 0)
6417                         return ret;
6418             #endif  /* WOLFSSL_DTLS */
6419             }
6420
6421             ret = ProcessOldClientHello(ssl, ssl->buffers.inputBuffer.buffer,
6422                                         &ssl->buffers.inputBuffer.idx,
6423                                         ssl->buffers.inputBuffer.length -
6424                                         ssl->buffers.inputBuffer.idx,
6425                                         ssl->curSize);
6426             if (ret < 0)
6427                 return ret;
6428
6429             else if (ssl->buffers.inputBuffer.idx ==
6430                      ssl->buffers.inputBuffer.length) {
6431                 ssl->options.processReply = doProcessInit;
6432                 return 0;
6433             }
6434
6435 #endif  /* OLD_HELLO_ALLOWED */
6436
6437         /* get the record layer header */
6438         case getRecordLayerHeader:
6439
6440             ret = GetRecordHeader(ssl, ssl->buffers.inputBuffer.buffer,
6441                                        &ssl->buffers.inputBuffer.idx,
6442                                        &ssl->curRL, &ssl->curSize);
6443 #ifdef WOLFSSL_DTLS
6444             if (ssl->options.dtls && ret == SEQUENCE_ERROR) {
6445                 ssl->options.processReply = doProcessInit;
6446                 ssl->buffers.inputBuffer.length = 0;
6447                 ssl->buffers.inputBuffer.idx = 0;
6448                 continue;
6449             }
6450 #endif
6451             if (ret != 0)
6452                 return ret;
6453
6454             ssl->options.processReply = getData;
6455
6456         /* retrieve record layer data */
6457         case getData:
6458
6459             /* get sz bytes or return error */
6460             if (!ssl->options.dtls) {
6461                 if ((ret = GetInputData(ssl, ssl->curSize)) < 0)
6462                     return ret;
6463             } else {
6464 #ifdef WOLFSSL_DTLS
6465                 /* read ahead may already have */
6466                 used = ssl->buffers.inputBuffer.length -
6467                        ssl->buffers.inputBuffer.idx;
6468                 if (used < ssl->curSize)
6469                     if ((ret = GetInputData(ssl, ssl->curSize)) < 0)
6470                         return ret;
6471 #endif
6472             }
6473
6474             ssl->options.processReply = runProcessingOneMessage;
6475             startIdx = ssl->buffers.inputBuffer.idx;  /* in case > 1 msg per */
6476
6477         /* the record layer is here */
6478         case runProcessingOneMessage:
6479
6480             #ifdef WOLFSSL_DTLS
6481             if (ssl->options.dtls &&
6482                 ssl->keys.dtls_state.curEpoch < ssl->keys.dtls_state.nextEpoch)
6483                 ssl->keys.decryptedCur = 1;
6484             #endif
6485
6486             if (ssl->keys.encryptionOn && ssl->keys.decryptedCur == 0)
6487             {
6488                 ret = SanityCheckCipherText(ssl, ssl->curSize);
6489                 if (ret < 0)
6490                     return ret;
6491
6492                 if (atomicUser) {
6493                 #ifdef ATOMIC_USER
6494                     ret = ssl->ctx->DecryptVerifyCb(ssl,
6495                                   ssl->buffers.inputBuffer.buffer +
6496                                   ssl->buffers.inputBuffer.idx,
6497                                   ssl->buffers.inputBuffer.buffer +
6498                                   ssl->buffers.inputBuffer.idx,
6499                                   ssl->curSize, ssl->curRL.type, 1,
6500                                   &ssl->keys.padSz, ssl->DecryptVerifyCtx);
6501                     if (ssl->options.tls1_1 && ssl->specs.cipher_type == block)
6502                         ssl->buffers.inputBuffer.idx += ssl->specs.block_size;
6503                         /* go past TLSv1.1 IV */
6504                     if (ssl->specs.cipher_type == aead &&
6505                             ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
6506                         ssl->buffers.inputBuffer.idx += AEAD_EXP_IV_SZ;
6507                 #endif /* ATOMIC_USER */
6508                 }
6509                 else {
6510                     ret = Decrypt(ssl, ssl->buffers.inputBuffer.buffer +
6511                                   ssl->buffers.inputBuffer.idx,
6512                                   ssl->buffers.inputBuffer.buffer +
6513                                   ssl->buffers.inputBuffer.idx,
6514                                   ssl->curSize);
6515                     if (ret < 0) {
6516                         WOLFSSL_ERROR(ret);
6517                         return DECRYPT_ERROR;
6518                     }
6519                     if (ssl->options.tls1_1 && ssl->specs.cipher_type == block)
6520                         ssl->buffers.inputBuffer.idx += ssl->specs.block_size;
6521                         /* go past TLSv1.1 IV */
6522                     if (ssl->specs.cipher_type == aead &&
6523                             ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
6524                         ssl->buffers.inputBuffer.idx += AEAD_EXP_IV_SZ;
6525
6526                     ret = VerifyMac(ssl, ssl->buffers.inputBuffer.buffer +
6527                                     ssl->buffers.inputBuffer.idx,
6528                                     ssl->curSize, ssl->curRL.type,
6529                                     &ssl->keys.padSz);
6530                 }
6531                 if (ret < 0) {
6532                     WOLFSSL_ERROR(ret);
6533                     return DECRYPT_ERROR;
6534                 }
6535                 ssl->keys.encryptSz    = ssl->curSize;
6536                 ssl->keys.decryptedCur = 1;
6537             }
6538
6539             if (ssl->options.dtls) {
6540             #ifdef WOLFSSL_DTLS
6541                 DtlsUpdateWindow(&ssl->keys.dtls_state);
6542             #endif /* WOLFSSL_DTLS */
6543             }
6544
6545             WOLFSSL_MSG("received record layer msg");
6546
6547             switch (ssl->curRL.type) {
6548                 case handshake :
6549                     /* debugging in DoHandShakeMsg */
6550                     if (!ssl->options.dtls) {
6551                         ret = DoHandShakeMsg(ssl,
6552                                             ssl->buffers.inputBuffer.buffer,
6553                                             &ssl->buffers.inputBuffer.idx,
6554                                             ssl->buffers.inputBuffer.length);
6555                     }
6556                     else {
6557 #ifdef WOLFSSL_DTLS
6558                         ret = DoDtlsHandShakeMsg(ssl,
6559                                             ssl->buffers.inputBuffer.buffer,
6560                                             &ssl->buffers.inputBuffer.idx,
6561                                             ssl->buffers.inputBuffer.length);
6562 #endif
6563                     }
6564                     if (ret != 0)
6565                         return ret;
6566                     break;
6567
6568                 case change_cipher_spec:
6569                     WOLFSSL_MSG("got CHANGE CIPHER SPEC");
6570                     #ifdef WOLFSSL_CALLBACKS
6571                         if (ssl->hsInfoOn)
6572                             AddPacketName("ChangeCipher", &ssl->handShakeInfo);
6573                         /* add record header back on info */
6574                         if (ssl->toInfoOn) {
6575                             AddPacketInfo("ChangeCipher", &ssl->timeoutInfo,
6576                                 ssl->buffers.inputBuffer.buffer +
6577                                 ssl->buffers.inputBuffer.idx - RECORD_HEADER_SZ,
6578                                 1 + RECORD_HEADER_SZ, ssl->heap);
6579                             AddLateRecordHeader(&ssl->curRL, &ssl->timeoutInfo);
6580                         }
6581                     #endif
6582
6583                     ret = SanityCheckMsgReceived(ssl, change_cipher_hs);
6584                     if (ret != 0)
6585                         return ret;
6586
6587 #ifdef HAVE_SESSION_TICKET
6588                     if (ssl->options.side == WOLFSSL_CLIENT_END &&
6589                                                   ssl->expect_session_ticket) {
6590                         WOLFSSL_MSG("Expected session ticket missing");
6591                         return SESSION_TICKET_EXPECT_E;
6592                     }
6593 #endif
6594
6595                     if (ssl->keys.encryptionOn && ssl->options.handShakeDone) {
6596                         ssl->buffers.inputBuffer.idx += ssl->keys.padSz;
6597                         ssl->curSize -= (word16) ssl->buffers.inputBuffer.idx;
6598                     }
6599
6600                     if (ssl->curSize != 1) {
6601                         WOLFSSL_MSG("Malicious or corrupted ChangeCipher msg");
6602                         return LENGTH_ERROR;
6603                     }
6604                     #ifndef NO_CERTS
6605                         if (ssl->options.side == WOLFSSL_SERVER_END &&
6606                                  ssl->options.verifyPeer &&
6607                                  ssl->options.havePeerCert)
6608                             if (!ssl->options.havePeerVerify) {
6609                                 WOLFSSL_MSG("client didn't send cert verify");
6610                                 return NO_PEER_VERIFY;
6611                             }
6612                     #endif
6613
6614
6615                     ssl->buffers.inputBuffer.idx++;
6616                     ssl->keys.encryptionOn = 1;
6617
6618                     /* setup decrypt keys for following messages */
6619                     if ((ret = SetKeysSide(ssl, DECRYPT_SIDE_ONLY)) != 0)
6620                         return ret;
6621
6622                     #ifdef WOLFSSL_DTLS
6623                         if (ssl->options.dtls) {
6624                             DtlsPoolReset(ssl);
6625                             ssl->keys.dtls_state.nextEpoch++;
6626                             ssl->keys.dtls_state.nextSeq = 0;
6627                         }
6628                     #endif
6629
6630                     #ifdef HAVE_LIBZ
6631                         if (ssl->options.usingCompression)
6632                             if ( (ret = InitStreams(ssl)) != 0)
6633                                 return ret;
6634                     #endif
6635                     ret = BuildFinished(ssl, &ssl->hsHashes->verifyHashes,
6636                                        ssl->options.side == WOLFSSL_CLIENT_END ?
6637                                        server : client);
6638                     if (ret != 0)
6639                         return ret;
6640                     break;
6641
6642                 case application_data:
6643                     WOLFSSL_MSG("got app DATA");
6644                     if ((ret = DoApplicationData(ssl,
6645                                                 ssl->buffers.inputBuffer.buffer,
6646                                                &ssl->buffers.inputBuffer.idx))
6647                                                                          != 0) {
6648                         WOLFSSL_ERROR(ret);
6649                         return ret;
6650                     }
6651                     break;
6652
6653                 case alert:
6654                     WOLFSSL_MSG("got ALERT!");
6655                     ret = DoAlert(ssl, ssl->buffers.inputBuffer.buffer,
6656                                   &ssl->buffers.inputBuffer.idx, &type,
6657                                    ssl->buffers.inputBuffer.length);
6658                     if (ret == alert_fatal)
6659                         return FATAL_ERROR;
6660                     else if (ret < 0)
6661                         return ret;
6662
6663                     /* catch warnings that are handled as errors */
6664                     if (type == close_notify)
6665                         return ssl->error = ZERO_RETURN;
6666
6667                     if (type == decrypt_error)
6668                         return FATAL_ERROR;
6669                     break;
6670
6671                 default:
6672                     WOLFSSL_ERROR(UNKNOWN_RECORD_TYPE);
6673                     return UNKNOWN_RECORD_TYPE;
6674             }
6675
6676             ssl->options.processReply = doProcessInit;
6677
6678             /* input exhausted? */
6679             if (ssl->buffers.inputBuffer.idx == ssl->buffers.inputBuffer.length)
6680                 return 0;
6681
6682             /* more messages per record */
6683             else if ((ssl->buffers.inputBuffer.idx - startIdx) < ssl->curSize) {
6684                 WOLFSSL_MSG("More messages in record");
6685                 #ifdef WOLFSSL_DTLS
6686                     /* read-ahead but dtls doesn't bundle messages per record */
6687                     if (ssl->options.dtls) {
6688                         ssl->options.processReply = doProcessInit;
6689                         continue;
6690                     }
6691                 #endif
6692                 ssl->options.processReply = runProcessingOneMessage;
6693
6694                 if (ssl->keys.encryptionOn) {
6695                     WOLFSSL_MSG("Bundled encrypted messages, remove middle pad");
6696                     ssl->buffers.inputBuffer.idx -= ssl->keys.padSz;
6697                 }
6698
6699                 continue;
6700             }
6701             /* more records */
6702             else {
6703                 WOLFSSL_MSG("More records in input");
6704                 ssl->options.processReply = doProcessInit;
6705                 continue;
6706             }
6707
6708         default:
6709             WOLFSSL_MSG("Bad process input state, programming error");
6710             return INPUT_CASE_ERROR;
6711         }
6712     }
6713 }
6714
6715
6716 int SendChangeCipher(WOLFSSL* ssl)
6717 {
6718     byte              *output;
6719     int                sendSz = RECORD_HEADER_SZ + ENUM_LEN;
6720     int                idx    = RECORD_HEADER_SZ;
6721     int                ret;
6722
6723     #ifdef WOLFSSL_DTLS
6724         if (ssl->options.dtls) {
6725             sendSz += DTLS_RECORD_EXTRA;
6726             idx    += DTLS_RECORD_EXTRA;
6727         }
6728     #endif
6729
6730     /* are we in scr */
6731     if (ssl->keys.encryptionOn && ssl->options.handShakeDone) {
6732         sendSz += MAX_MSG_EXTRA;
6733     }
6734
6735     /* check for avalaible size */
6736     if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
6737         return ret;
6738
6739     /* get ouput buffer */
6740     output = ssl->buffers.outputBuffer.buffer +
6741              ssl->buffers.outputBuffer.length;
6742
6743     AddRecordHeader(output, 1, change_cipher_spec, ssl);
6744
6745     output[idx] = 1;             /* turn it on */
6746
6747     if (ssl->keys.encryptionOn && ssl->options.handShakeDone) {
6748         byte input[ENUM_LEN];
6749         int  inputSz = ENUM_LEN;
6750
6751         input[0] = 1;  /* turn it on */
6752         sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
6753                               change_cipher_spec);
6754         if (sendSz < 0)
6755             return sendSz;
6756     }
6757
6758     #ifdef WOLFSSL_DTLS
6759         if (ssl->options.dtls) {
6760             if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
6761                 return ret;
6762         }
6763     #endif
6764     #ifdef WOLFSSL_CALLBACKS
6765         if (ssl->hsInfoOn) AddPacketName("ChangeCipher", &ssl->handShakeInfo);
6766         if (ssl->toInfoOn)
6767             AddPacketInfo("ChangeCipher", &ssl->timeoutInfo, output, sendSz,
6768                            ssl->heap);
6769     #endif
6770     ssl->buffers.outputBuffer.length += sendSz;
6771
6772     if (ssl->options.groupMessages)
6773         return 0;
6774     #ifdef WOLFSSL_DTLS
6775     else if (ssl->options.dtls) {
6776         /* If using DTLS, force the ChangeCipherSpec message to be in the
6777          * same datagram as the finished message. */
6778         return 0;
6779     }
6780     #endif
6781     else
6782         return SendBuffered(ssl);
6783 }
6784
6785
6786 #ifndef NO_OLD_TLS
6787 static int SSL_hmac(WOLFSSL* ssl, byte* digest, const byte* in, word32 sz,
6788                  int content, int verify)
6789 {
6790     byte   result[MAX_DIGEST_SIZE];
6791     word32 digestSz = ssl->specs.hash_size;            /* actual sizes */
6792     word32 padSz    = ssl->specs.pad_size;
6793     int    ret      = 0;
6794
6795     Md5 md5;
6796     Sha sha;
6797
6798     /* data */
6799     byte seq[SEQ_SZ];
6800     byte conLen[ENUM_LEN + LENGTH_SZ];     /* content & length */
6801     const byte* macSecret = wolfSSL_GetMacSecret(ssl, verify);
6802
6803 #ifdef HAVE_FUZZER
6804     if (ssl->fuzzerCb)
6805         ssl->fuzzerCb(ssl, in, sz, FUZZ_HMAC, ssl->fuzzerCtx);
6806 #endif
6807
6808     XMEMSET(seq, 0, SEQ_SZ);
6809     conLen[0] = (byte)content;
6810     c16toa((word16)sz, &conLen[ENUM_LEN]);
6811     c32toa(GetSEQIncrement(ssl, verify), &seq[sizeof(word32)]);
6812
6813     if (ssl->specs.mac_algorithm == md5_mac) {
6814         wc_InitMd5(&md5);
6815         /* inner */
6816         wc_Md5Update(&md5, macSecret, digestSz);
6817         wc_Md5Update(&md5, PAD1, padSz);
6818         wc_Md5Update(&md5, seq, SEQ_SZ);
6819         wc_Md5Update(&md5, conLen, sizeof(conLen));
6820         /* in buffer */
6821         wc_Md5Update(&md5, in, sz);
6822         wc_Md5Final(&md5, result);
6823         /* outer */
6824         wc_Md5Update(&md5, macSecret, digestSz);
6825         wc_Md5Update(&md5, PAD2, padSz);
6826         wc_Md5Update(&md5, result, digestSz);
6827         wc_Md5Final(&md5, digest);
6828     }
6829     else {
6830         ret = wc_InitSha(&sha);
6831         if (ret != 0)
6832             return ret;
6833         /* inner */
6834         wc_ShaUpdate(&sha, macSecret, digestSz);
6835         wc_ShaUpdate(&sha, PAD1, padSz);
6836         wc_ShaUpdate(&sha, seq, SEQ_SZ);
6837         wc_ShaUpdate(&sha, conLen, sizeof(conLen));
6838         /* in buffer */
6839         wc_ShaUpdate(&sha, in, sz);
6840         wc_ShaFinal(&sha, result);
6841         /* outer */
6842         wc_ShaUpdate(&sha, macSecret, digestSz);
6843         wc_ShaUpdate(&sha, PAD2, padSz);
6844         wc_ShaUpdate(&sha, result, digestSz);
6845         wc_ShaFinal(&sha, digest);
6846     }
6847     return 0;
6848 }
6849
6850 #ifndef NO_CERTS
6851 static void BuildMD5_CertVerify(WOLFSSL* ssl, byte* digest)
6852 {
6853     byte md5_result[MD5_DIGEST_SIZE];
6854
6855 #ifdef WOLFSSL_SMALL_STACK
6856         Md5* md5   = (Md5*)XMALLOC(sizeof(Md5), NULL, DYNAMIC_TYPE_TMP_BUFFER);
6857         Md5* md5_2 = (Md5*)XMALLOC(sizeof(Md5), NULL, DYNAMIC_TYPE_TMP_BUFFER);
6858 #else
6859         Md5 md5[1];
6860         Md5 md5_2[1];
6861 #endif
6862
6863     /* make md5 inner */
6864     md5[0] = ssl->hsHashes->hashMd5 ; /* Save current position */
6865     wc_Md5Update(&ssl->hsHashes->hashMd5, ssl->arrays->masterSecret,SECRET_LEN);
6866     wc_Md5Update(&ssl->hsHashes->hashMd5, PAD1, PAD_MD5);
6867     wc_Md5GetHash(&ssl->hsHashes->hashMd5, md5_result);
6868     wc_Md5RestorePos(&ssl->hsHashes->hashMd5, md5) ; /* Restore current position */
6869
6870     /* make md5 outer */
6871     wc_InitMd5(md5_2) ;
6872     wc_Md5Update(md5_2, ssl->arrays->masterSecret, SECRET_LEN);
6873     wc_Md5Update(md5_2, PAD2, PAD_MD5);
6874     wc_Md5Update(md5_2, md5_result, MD5_DIGEST_SIZE);
6875
6876     wc_Md5Final(md5_2, digest);
6877
6878 #ifdef WOLFSSL_SMALL_STACK
6879     XFREE(md5, NULL, DYNAMIC_TYPE_TMP_BUFFER);
6880     XFREE(md5_2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
6881 #endif
6882 }
6883
6884
6885 static void BuildSHA_CertVerify(WOLFSSL* ssl, byte* digest)
6886 {
6887     byte sha_result[SHA_DIGEST_SIZE];
6888
6889 #ifdef WOLFSSL_SMALL_STACK
6890         Sha* sha   = (Sha*)XMALLOC(sizeof(Sha), NULL, DYNAMIC_TYPE_TMP_BUFFER);
6891         Sha* sha2 = (Sha*)XMALLOC(sizeof(Sha), NULL, DYNAMIC_TYPE_TMP_BUFFER);
6892 #else
6893         Sha sha[1];
6894         Sha sha2[1];
6895 #endif
6896
6897     /* make sha inner */
6898     sha[0] = ssl->hsHashes->hashSha ; /* Save current position */
6899     wc_ShaUpdate(&ssl->hsHashes->hashSha, ssl->arrays->masterSecret,SECRET_LEN);
6900     wc_ShaUpdate(&ssl->hsHashes->hashSha, PAD1, PAD_SHA);
6901     wc_ShaGetHash(&ssl->hsHashes->hashSha, sha_result);
6902     wc_ShaRestorePos(&ssl->hsHashes->hashSha, sha) ; /* Restore current position */
6903
6904     /* make sha outer */
6905     wc_InitSha(sha2) ;
6906     wc_ShaUpdate(sha2, ssl->arrays->masterSecret,SECRET_LEN);
6907     wc_ShaUpdate(sha2, PAD2, PAD_SHA);
6908     wc_ShaUpdate(sha2, sha_result, SHA_DIGEST_SIZE);
6909
6910     wc_ShaFinal(sha2, digest);
6911
6912 #ifdef WOLFSSL_SMALL_STACK
6913     XFREE(sha, NULL, DYNAMIC_TYPE_TMP_BUFFER);
6914     XFREE(sha2, NULL, DYNAMIC_TYPE_TMP_BUFFER);
6915 #endif
6916
6917 }
6918 #endif /* NO_CERTS */
6919 #endif /* NO_OLD_TLS */
6920
6921
6922 #ifndef NO_CERTS
6923
6924 static int BuildCertHashes(WOLFSSL* ssl, Hashes* hashes)
6925 {
6926     /* store current states, building requires get_digest which resets state */
6927     #ifdef WOLFSSL_SHA384
6928         Sha384 sha384 = ssl->hsHashes->hashSha384;
6929     #endif
6930     #ifdef WOLFSSL_SHA512
6931         Sha512 sha512 = ssl->hsHashes->hashSha512;
6932     #endif
6933
6934     if (ssl->options.tls) {
6935 #if ! defined( NO_OLD_TLS )
6936         wc_Md5GetHash(&ssl->hsHashes->hashMd5, hashes->md5);
6937         wc_ShaGetHash(&ssl->hsHashes->hashSha, hashes->sha);
6938 #endif
6939         if (IsAtLeastTLSv1_2(ssl)) {
6940             int ret;
6941
6942             #ifndef NO_SHA256
6943                 ret = wc_Sha256GetHash(&ssl->hsHashes->hashSha256,hashes->sha256);
6944                 if (ret != 0)
6945                     return ret;
6946             #endif
6947             #ifdef WOLFSSL_SHA384
6948                 ret = wc_Sha384Final(&ssl->hsHashes->hashSha384,hashes->sha384);
6949                 if (ret != 0)
6950                     return ret;
6951             #endif
6952             #ifdef WOLFSSL_SHA512
6953                 ret = wc_Sha512Final(&ssl->hsHashes->hashSha512,hashes->sha512);
6954                 if (ret != 0)
6955                     return ret;
6956             #endif
6957         }
6958     }
6959 #if ! defined( NO_OLD_TLS )
6960     else {
6961         BuildMD5_CertVerify(ssl, hashes->md5);
6962         BuildSHA_CertVerify(ssl, hashes->sha);
6963     }
6964
6965     /* restore */
6966 #endif
6967     if (IsAtLeastTLSv1_2(ssl)) {
6968         #ifdef WOLFSSL_SHA384
6969             ssl->hsHashes->hashSha384 = sha384;
6970         #endif
6971         #ifdef WOLFSSL_SHA512
6972             ssl->hsHashes->hashSha512 = sha512;
6973         #endif
6974     }
6975
6976     return 0;
6977 }
6978
6979 #endif /* WOLFSSL_LEANPSK */
6980
6981 /* Build SSL Message, encrypted */
6982 static int BuildMessage(WOLFSSL* ssl, byte* output, int outSz,
6983                         const byte* input, int inSz, int type)
6984 {
6985 #ifdef HAVE_TRUNCATED_HMAC
6986     word32 digestSz = min(ssl->specs.hash_size,
6987                 ssl->truncated_hmac ? TRUNCATED_HMAC_SZ : ssl->specs.hash_size);
6988 #else
6989     word32 digestSz = ssl->specs.hash_size;
6990 #endif
6991     word32 sz = RECORD_HEADER_SZ + inSz + digestSz;
6992     word32 pad  = 0, i;
6993     word32 idx  = RECORD_HEADER_SZ;
6994     word32 ivSz = 0;      /* TLSv1.1  IV */
6995     word32 headerSz = RECORD_HEADER_SZ;
6996     word16 size;
6997     byte               iv[AES_BLOCK_SIZE];                  /* max size */
6998     int ret        = 0;
6999     int atomicUser = 0;
7000
7001 #ifdef WOLFSSL_DTLS
7002     if (ssl->options.dtls) {
7003         sz       += DTLS_RECORD_EXTRA;
7004         idx      += DTLS_RECORD_EXTRA;
7005         headerSz += DTLS_RECORD_EXTRA;
7006     }
7007 #endif
7008
7009 #ifdef ATOMIC_USER
7010     if (ssl->ctx->MacEncryptCb)
7011         atomicUser = 1;
7012 #endif
7013
7014     if (ssl->specs.cipher_type == block) {
7015         word32 blockSz = ssl->specs.block_size;
7016         if (ssl->options.tls1_1) {
7017             ivSz = blockSz;
7018             sz  += ivSz;
7019
7020             if (ivSz > (word32)sizeof(iv))
7021                 return BUFFER_E;
7022
7023             ret = wc_RNG_GenerateBlock(ssl->rng, iv, ivSz);
7024             if (ret != 0)
7025                 return ret;
7026
7027         }
7028         sz += 1;       /* pad byte */
7029         pad = (sz - headerSz) % blockSz;
7030         pad = blockSz - pad;
7031         sz += pad;
7032     }
7033
7034 #ifdef HAVE_AEAD
7035     if (ssl->specs.cipher_type == aead) {
7036         if (ssl->specs.bulk_cipher_algorithm != wolfssl_chacha)
7037             ivSz = AEAD_EXP_IV_SZ;
7038
7039         sz += (ivSz + ssl->specs.aead_mac_size - digestSz);
7040         XMEMCPY(iv, ssl->keys.aead_exp_IV, AEAD_EXP_IV_SZ);
7041     }
7042 #endif
7043     if (sz > (word32)outSz) {
7044         WOLFSSL_MSG("Oops, want to write past output buffer size");
7045         return BUFFER_E;
7046     }
7047     size = (word16)(sz - headerSz);    /* include mac and digest */
7048     AddRecordHeader(output, size, (byte)type, ssl);
7049
7050     /* write to output */
7051     if (ivSz) {
7052         XMEMCPY(output + idx, iv, min(ivSz, sizeof(iv)));
7053         idx += ivSz;
7054     }
7055     XMEMCPY(output + idx, input, inSz);
7056     idx += inSz;
7057
7058     if (type == handshake) {
7059         ret = HashOutput(ssl, output, headerSz + inSz, ivSz);
7060         if (ret != 0)
7061             return ret;
7062     }
7063
7064     if (ssl->specs.cipher_type == block) {
7065         word32 tmpIdx = idx + digestSz;
7066
7067         for (i = 0; i <= pad; i++)
7068             output[tmpIdx++] = (byte)pad; /* pad byte gets pad value too */
7069     }
7070
7071     if (atomicUser) {   /* User Record Layer Callback handling */
7072 #ifdef ATOMIC_USER
7073         if ( (ret = ssl->ctx->MacEncryptCb(ssl, output + idx,
7074                         output + headerSz + ivSz, inSz, type, 0,
7075                         output + headerSz, output + headerSz, size,
7076                         ssl->MacEncryptCtx)) != 0)
7077             return ret;
7078 #endif
7079     }
7080     else {
7081         if (ssl->specs.cipher_type != aead) {
7082 #ifdef HAVE_TRUNCATED_HMAC
7083             if (ssl->truncated_hmac && ssl->specs.hash_size > digestSz) {
7084             #ifdef WOLFSSL_SMALL_STACK
7085                 byte* hmac = NULL;
7086             #else
7087                 byte  hmac[MAX_DIGEST_SIZE];
7088             #endif
7089
7090             #ifdef WOLFSSL_SMALL_STACK
7091                 hmac = (byte*)XMALLOC(MAX_DIGEST_SIZE, NULL,
7092                                                        DYNAMIC_TYPE_TMP_BUFFER);
7093                 if (hmac == NULL)
7094                     return MEMORY_E;
7095             #endif
7096
7097                 ret = ssl->hmac(ssl, hmac, output + headerSz + ivSz, inSz,
7098                                                                        type, 0);
7099                 XMEMCPY(output + idx, hmac, digestSz);
7100
7101             #ifdef WOLFSSL_SMALL_STACK
7102                 XFREE(hmac, NULL, DYNAMIC_TYPE_TMP_BUFFER);
7103             #endif
7104             } else
7105 #endif
7106                 ret = ssl->hmac(ssl, output+idx, output + headerSz + ivSz, inSz,
7107                                                                        type, 0);
7108         }
7109         if (ret != 0)
7110             return ret;
7111
7112         if ( (ret = Encrypt(ssl, output + headerSz, output+headerSz,size)) != 0)
7113             return ret;
7114     }
7115
7116     return sz;
7117 }
7118
7119
7120 int SendFinished(WOLFSSL* ssl)
7121 {
7122     int              sendSz,
7123                      finishedSz = ssl->options.tls ? TLS_FINISHED_SZ :
7124                                                      FINISHED_SZ;
7125     byte             input[FINISHED_SZ + DTLS_HANDSHAKE_HEADER_SZ];  /* max */
7126     byte            *output;
7127     Hashes*          hashes;
7128     int              ret;
7129     int              headerSz = HANDSHAKE_HEADER_SZ;
7130     int              outputSz;
7131
7132     #ifdef WOLFSSL_DTLS
7133         word32 sequence_number = ssl->keys.dtls_sequence_number;
7134         word16 epoch           = ssl->keys.dtls_epoch;
7135     #endif
7136
7137     /* setup encrypt keys */
7138     if ((ret = SetKeysSide(ssl, ENCRYPT_SIDE_ONLY)) != 0)
7139         return ret;
7140
7141     /* check for available size */
7142     outputSz = sizeof(input) + MAX_MSG_EXTRA;
7143     if ((ret = CheckAvailableSize(ssl, outputSz)) != 0)
7144         return ret;
7145
7146     #ifdef WOLFSSL_DTLS
7147         if (ssl->options.dtls) {
7148             /* Send Finished message with the next epoch, but don't commit that
7149              * change until the other end confirms its reception. */
7150             headerSz += DTLS_HANDSHAKE_EXTRA;
7151             ssl->keys.dtls_epoch++;
7152             ssl->keys.dtls_sequence_number = 0;  /* reset after epoch change */
7153         }
7154     #endif
7155
7156     /* get ouput buffer */
7157     output = ssl->buffers.outputBuffer.buffer +
7158              ssl->buffers.outputBuffer.length;
7159
7160     AddHandShakeHeader(input, finishedSz, finished, ssl);
7161
7162     /* make finished hashes */
7163     hashes = (Hashes*)&input[headerSz];
7164     ret = BuildFinished(ssl, hashes,
7165                      ssl->options.side == WOLFSSL_CLIENT_END ? client : server);
7166     if (ret != 0) return ret;
7167
7168 #ifdef HAVE_SECURE_RENEGOTIATION
7169     if (ssl->secure_renegotiation) {
7170         if (ssl->options.side == WOLFSSL_CLIENT_END)
7171             XMEMCPY(ssl->secure_renegotiation->client_verify_data, hashes,
7172                     TLS_FINISHED_SZ);
7173         else
7174             XMEMCPY(ssl->secure_renegotiation->server_verify_data, hashes,
7175                     TLS_FINISHED_SZ);
7176     }
7177 #endif
7178
7179     sendSz = BuildMessage(ssl, output, outputSz, input, headerSz + finishedSz,
7180                           handshake);
7181     if (sendSz < 0)
7182         return BUILD_MSG_ERROR;
7183
7184     #ifdef WOLFSSL_DTLS
7185     if (ssl->options.dtls) {
7186         ssl->keys.dtls_epoch = epoch;
7187         ssl->keys.dtls_sequence_number = sequence_number;
7188     }
7189     #endif
7190
7191     if (!ssl->options.resuming) {
7192 #ifndef NO_SESSION_CACHE
7193         AddSession(ssl);    /* just try */
7194 #endif
7195         if (ssl->options.side == WOLFSSL_SERVER_END) {
7196             ssl->options.handShakeState = HANDSHAKE_DONE;
7197             ssl->options.handShakeDone  = 1;
7198             #ifdef WOLFSSL_DTLS
7199                 if (ssl->options.dtls) {
7200                     /* Other side will soon receive our Finished, go to next
7201                      * epoch. */
7202                     ssl->keys.dtls_epoch++;
7203                     ssl->keys.dtls_sequence_number = 1;
7204                 }
7205             #endif
7206         }
7207     }
7208     else {
7209         if (ssl->options.side == WOLFSSL_CLIENT_END) {
7210             ssl->options.handShakeState = HANDSHAKE_DONE;
7211             ssl->options.handShakeDone  = 1;
7212             #ifdef WOLFSSL_DTLS
7213                 if (ssl->options.dtls) {
7214                     /* Other side will soon receive our Finished, go to next
7215                      * epoch. */
7216                     ssl->keys.dtls_epoch++;
7217                     ssl->keys.dtls_sequence_number = 1;
7218                 }
7219             #endif
7220         }
7221     }
7222     #ifdef WOLFSSL_DTLS
7223         if (ssl->options.dtls) {
7224             if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
7225                 return ret;
7226         }
7227     #endif
7228
7229     #ifdef WOLFSSL_CALLBACKS
7230         if (ssl->hsInfoOn) AddPacketName("Finished", &ssl->handShakeInfo);
7231         if (ssl->toInfoOn)
7232             AddPacketInfo("Finished", &ssl->timeoutInfo, output, sendSz,
7233                           ssl->heap);
7234     #endif
7235
7236     ssl->buffers.outputBuffer.length += sendSz;
7237
7238     return SendBuffered(ssl);
7239 }
7240
7241 #ifndef NO_CERTS
7242 int SendCertificate(WOLFSSL* ssl)
7243 {
7244     int    sendSz, length, ret = 0;
7245     word32 i = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
7246     word32 certSz, listSz;
7247     byte*  output = 0;
7248
7249     if (ssl->options.usingPSK_cipher || ssl->options.usingAnon_cipher)
7250         return 0;  /* not needed */
7251
7252     if (ssl->options.sendVerify == SEND_BLANK_CERT) {
7253         certSz = 0;
7254         length = CERT_HEADER_SZ;
7255         listSz = 0;
7256     }
7257     else {
7258         certSz = ssl->buffers.certificate.length;
7259         /* list + cert size */
7260         length = certSz + 2 * CERT_HEADER_SZ;
7261         listSz = certSz + CERT_HEADER_SZ;
7262
7263         /* may need to send rest of chain, already has leading size(s) */
7264         if (ssl->buffers.certChain.buffer) {
7265             length += ssl->buffers.certChain.length;
7266             listSz += ssl->buffers.certChain.length;
7267         }
7268     }
7269     sendSz = length + RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
7270
7271     #ifdef WOLFSSL_DTLS
7272         if (ssl->options.dtls) {
7273             sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
7274             i      += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
7275         }
7276     #endif
7277
7278     if (ssl->keys.encryptionOn)
7279         sendSz += MAX_MSG_EXTRA;
7280
7281     /* check for available size */
7282     if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
7283         return ret;
7284
7285     /* get ouput buffer */
7286     output = ssl->buffers.outputBuffer.buffer +
7287              ssl->buffers.outputBuffer.length;
7288
7289     AddHeaders(output, length, certificate, ssl);
7290
7291     /* list total */
7292     c32to24(listSz, output + i);
7293     i += CERT_HEADER_SZ;
7294
7295     /* member */
7296     if (certSz) {
7297         c32to24(certSz, output + i);
7298         i += CERT_HEADER_SZ;
7299         XMEMCPY(output + i, ssl->buffers.certificate.buffer, certSz);
7300         i += certSz;
7301
7302         /* send rest of chain? */
7303         if (ssl->buffers.certChain.buffer) {
7304             XMEMCPY(output + i, ssl->buffers.certChain.buffer,
7305                                 ssl->buffers.certChain.length);
7306             i += ssl->buffers.certChain.length;
7307         }
7308     }
7309
7310     if (ssl->keys.encryptionOn) {
7311         byte* input;
7312         int   inputSz = i - RECORD_HEADER_SZ; /* build msg adds rec hdr */
7313
7314         input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
7315         if (input == NULL)
7316             return MEMORY_E;
7317
7318         XMEMCPY(input, output + RECORD_HEADER_SZ, inputSz);
7319         sendSz = BuildMessage(ssl, output, sendSz, input,inputSz,handshake);
7320         XFREE(input, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
7321
7322         if (sendSz < 0)
7323             return sendSz;
7324     } else {
7325         ret = HashOutput(ssl, output, sendSz, 0);
7326         if (ret != 0)
7327             return ret;
7328     }
7329
7330     #ifdef WOLFSSL_DTLS
7331         if (ssl->options.dtls) {
7332             if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
7333                 return ret;
7334         }
7335     #endif
7336
7337     #ifdef WOLFSSL_CALLBACKS
7338         if (ssl->hsInfoOn) AddPacketName("Certificate", &ssl->handShakeInfo);
7339         if (ssl->toInfoOn)
7340             AddPacketInfo("Certificate", &ssl->timeoutInfo, output, sendSz,
7341                            ssl->heap);
7342     #endif
7343
7344     if (ssl->options.side == WOLFSSL_SERVER_END)
7345         ssl->options.serverState = SERVER_CERT_COMPLETE;
7346
7347     ssl->buffers.outputBuffer.length += sendSz;
7348     if (ssl->options.groupMessages)
7349         return 0;
7350     else
7351         return SendBuffered(ssl);
7352 }
7353
7354
7355 int SendCertificateRequest(WOLFSSL* ssl)
7356 {
7357     byte   *output;
7358     int    ret;
7359     int    sendSz;
7360     word32 i = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
7361
7362     int  typeTotal = 1;  /* only 1 for now */
7363     int  reqSz = ENUM_LEN + typeTotal + REQ_HEADER_SZ;  /* add auth later */
7364
7365     if (IsAtLeastTLSv1_2(ssl))
7366         reqSz += LENGTH_SZ + ssl->suites->hashSigAlgoSz;
7367
7368     if (ssl->options.usingPSK_cipher || ssl->options.usingAnon_cipher)
7369         return 0;  /* not needed */
7370
7371     sendSz = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ + reqSz;
7372
7373     #ifdef WOLFSSL_DTLS
7374         if (ssl->options.dtls) {
7375             sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
7376             i      += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
7377         }
7378     #endif
7379     /* check for available size */
7380     if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
7381         return ret;
7382
7383     /* get ouput buffer */
7384     output = ssl->buffers.outputBuffer.buffer +
7385              ssl->buffers.outputBuffer.length;
7386
7387     AddHeaders(output, reqSz, certificate_request, ssl);
7388
7389     /* write to output */
7390     output[i++] = (byte)typeTotal;  /* # of types */
7391 #ifdef HAVE_ECC
7392     if (ssl->options.cipherSuite0 == ECC_BYTE &&
7393                      ssl->specs.sig_algo == ecc_dsa_sa_algo) {
7394         output[i++] = ecdsa_sign;
7395     } else
7396 #endif /* HAVE_ECC */
7397     {
7398         output[i++] = rsa_sign;
7399     }
7400
7401     /* supported hash/sig */
7402     if (IsAtLeastTLSv1_2(ssl)) {
7403         c16toa(ssl->suites->hashSigAlgoSz, &output[i]);
7404         i += LENGTH_SZ;
7405
7406         XMEMCPY(&output[i],
7407                          ssl->suites->hashSigAlgo, ssl->suites->hashSigAlgoSz);
7408         i += ssl->suites->hashSigAlgoSz;
7409     }
7410
7411     c16toa(0, &output[i]);  /* auth's */
7412     /* if add more to output, adjust i
7413     i += REQ_HEADER_SZ; */
7414
7415     #ifdef WOLFSSL_DTLS
7416         if (ssl->options.dtls) {
7417             if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
7418                 return ret;
7419         }
7420     #endif
7421
7422     ret = HashOutput(ssl, output, sendSz, 0);
7423     if (ret != 0)
7424         return ret;
7425
7426     #ifdef WOLFSSL_CALLBACKS
7427         if (ssl->hsInfoOn)
7428             AddPacketName("CertificateRequest", &ssl->handShakeInfo);
7429         if (ssl->toInfoOn)
7430             AddPacketInfo("CertificateRequest", &ssl->timeoutInfo, output,
7431                           sendSz, ssl->heap);
7432     #endif
7433     ssl->buffers.outputBuffer.length += sendSz;
7434     if (ssl->options.groupMessages)
7435         return 0;
7436     else
7437         return SendBuffered(ssl);
7438 }
7439 #endif /* !NO_CERTS */
7440
7441
7442 int SendData(WOLFSSL* ssl, const void* data, int sz)
7443 {
7444     int sent = 0,  /* plainText size */
7445         sendSz,
7446         ret,
7447         dtlsExtra = 0;
7448
7449     if (ssl->error == WANT_WRITE)
7450         ssl->error = 0;
7451
7452     if (ssl->options.handShakeState != HANDSHAKE_DONE) {
7453         int err;
7454         WOLFSSL_MSG("handshake not complete, trying to finish");
7455         if ( (err = wolfSSL_negotiate(ssl)) != SSL_SUCCESS)
7456             return  err;
7457     }
7458
7459     /* last time system socket output buffer was full, try again to send */
7460     if (ssl->buffers.outputBuffer.length > 0) {
7461         WOLFSSL_MSG("output buffer was full, trying to send again");
7462         if ( (ssl->error = SendBuffered(ssl)) < 0) {
7463             WOLFSSL_ERROR(ssl->error);
7464             if (ssl->error == SOCKET_ERROR_E && ssl->options.connReset)
7465                 return 0;     /* peer reset */
7466             return ssl->error;
7467         }
7468         else {
7469             /* advance sent to previous sent + plain size just sent */
7470             sent = ssl->buffers.prevSent + ssl->buffers.plainSz;
7471             WOLFSSL_MSG("sent write buffered data");
7472
7473             if (sent > sz) {
7474                 WOLFSSL_MSG("error: write() after WANT_WRITE with short size");
7475                 return ssl->error = BAD_FUNC_ARG;
7476             }
7477         }
7478     }
7479
7480 #ifdef WOLFSSL_DTLS
7481     if (ssl->options.dtls) {
7482         dtlsExtra = DTLS_RECORD_EXTRA;
7483     }
7484 #endif
7485
7486     for (;;) {
7487 #ifdef HAVE_MAX_FRAGMENT
7488         int   len = min(sz - sent, min(ssl->max_fragment, OUTPUT_RECORD_SIZE));
7489 #else
7490         int   len = min(sz - sent, OUTPUT_RECORD_SIZE);
7491 #endif
7492         byte* out;
7493         byte* sendBuffer = (byte*)data + sent;  /* may switch on comp */
7494         int   buffSz = len;                     /* may switch on comp */
7495         int   outputSz;
7496 #ifdef HAVE_LIBZ
7497         byte  comp[MAX_RECORD_SIZE + MAX_COMP_EXTRA];
7498 #endif
7499
7500         if (sent == sz) break;
7501
7502 #ifdef WOLFSSL_DTLS
7503         if (ssl->options.dtls) {
7504             len    = min(len, MAX_UDP_SIZE);
7505             buffSz = len;
7506         }
7507 #endif
7508
7509         /* check for available size */
7510         outputSz = len + COMP_EXTRA + dtlsExtra + MAX_MSG_EXTRA;
7511         if ((ret = CheckAvailableSize(ssl, outputSz)) != 0)
7512             return ssl->error = ret;
7513
7514         /* get ouput buffer */
7515         out = ssl->buffers.outputBuffer.buffer +
7516               ssl->buffers.outputBuffer.length;
7517
7518 #ifdef HAVE_LIBZ
7519         if (ssl->options.usingCompression) {
7520             buffSz = myCompress(ssl, sendBuffer, buffSz, comp, sizeof(comp));
7521             if (buffSz < 0) {
7522                 return buffSz;
7523             }
7524             sendBuffer = comp;
7525         }
7526 #endif
7527         sendSz = BuildMessage(ssl, out, outputSz, sendBuffer, buffSz,
7528                               application_data);
7529         if (sendSz < 0)
7530             return BUILD_MSG_ERROR;
7531
7532         ssl->buffers.outputBuffer.length += sendSz;
7533
7534         if ( (ret = SendBuffered(ssl)) < 0) {
7535             WOLFSSL_ERROR(ret);
7536             /* store for next call if WANT_WRITE or user embedSend() that
7537                doesn't present like WANT_WRITE */
7538             ssl->buffers.plainSz  = len;
7539             ssl->buffers.prevSent = sent;
7540             if (ret == SOCKET_ERROR_E && ssl->options.connReset)
7541                 return 0;  /* peer reset */
7542             return ssl->error = ret;
7543         }
7544
7545         sent += len;
7546
7547         /* only one message per attempt */
7548         if (ssl->options.partialWrite == 1) {
7549             WOLFSSL_MSG("Paritial Write on, only sending one record");
7550             break;
7551         }
7552     }
7553
7554     return sent;
7555 }
7556
7557 /* process input data */
7558 int ReceiveData(WOLFSSL* ssl, byte* output, int sz, int peek)
7559 {
7560     int size;
7561
7562     WOLFSSL_ENTER("ReceiveData()");
7563
7564     if (ssl->error == WANT_READ)
7565         ssl->error = 0;
7566
7567     if (ssl->error != 0 && ssl->error != WANT_WRITE) {
7568         WOLFSSL_MSG("User calling wolfSSL_read in error state, not allowed");
7569         return ssl->error;
7570     }
7571
7572     if (ssl->options.handShakeState != HANDSHAKE_DONE) {
7573         int err;
7574         WOLFSSL_MSG("Handshake not complete, trying to finish");
7575         if ( (err = wolfSSL_negotiate(ssl)) != SSL_SUCCESS)
7576             return  err;
7577     }
7578
7579 #ifdef HAVE_SECURE_RENEGOTIATION
7580 startScr:
7581     if (ssl->secure_renegotiation && ssl->secure_renegotiation->startScr) {
7582         int err;
7583         ssl->secure_renegotiation->startScr = 0;  /* only start once */
7584         WOLFSSL_MSG("Need to start scr, server requested");
7585         if ( (err = wolfSSL_Rehandshake(ssl)) != SSL_SUCCESS)
7586             return  err;
7587     }
7588 #endif
7589
7590     while (ssl->buffers.clearOutputBuffer.length == 0) {
7591         if ( (ssl->error = ProcessReply(ssl)) < 0) {
7592             WOLFSSL_ERROR(ssl->error);
7593             if (ssl->error == ZERO_RETURN) {
7594                 WOLFSSL_MSG("Zero return, no more data coming");
7595                 return 0;         /* no more data coming */
7596             }
7597             if (ssl->error == SOCKET_ERROR_E) {
7598                 if (ssl->options.connReset || ssl->options.isClosed) {
7599                     WOLFSSL_MSG("Peer reset or closed, connection done");
7600                     ssl->error = SOCKET_PEER_CLOSED_E;
7601                     WOLFSSL_ERROR(ssl->error);
7602                     return 0;     /* peer reset or closed */
7603                 }
7604             }
7605             return ssl->error;
7606         }
7607         #ifdef HAVE_SECURE_RENEGOTIATION
7608             if (ssl->secure_renegotiation &&
7609                 ssl->secure_renegotiation->startScr) {
7610                 goto startScr;
7611             }
7612         #endif
7613     }
7614
7615     if (sz < (int)ssl->buffers.clearOutputBuffer.length)
7616         size = sz;
7617     else
7618         size = ssl->buffers.clearOutputBuffer.length;
7619
7620     XMEMCPY(output, ssl->buffers.clearOutputBuffer.buffer, size);
7621
7622     if (peek == 0) {
7623         ssl->buffers.clearOutputBuffer.length -= size;
7624         ssl->buffers.clearOutputBuffer.buffer += size;
7625     }
7626
7627     if (ssl->buffers.clearOutputBuffer.length == 0 &&
7628                                            ssl->buffers.inputBuffer.dynamicFlag)
7629        ShrinkInputBuffer(ssl, NO_FORCED_FREE);
7630
7631     WOLFSSL_LEAVE("ReceiveData()", size);
7632     return size;
7633 }
7634
7635
7636 /* send alert message */
7637 int SendAlert(WOLFSSL* ssl, int severity, int type)
7638 {
7639     byte input[ALERT_SIZE];
7640     byte *output;
7641     int  sendSz;
7642     int  ret;
7643     int  outputSz;
7644     int  dtlsExtra = 0;
7645
7646     /* if sendalert is called again for nonbloking */
7647     if (ssl->options.sendAlertState != 0) {
7648         ret = SendBuffered(ssl);
7649         if (ret == 0)
7650             ssl->options.sendAlertState = 0;
7651         return ret;
7652     }
7653
7654    #ifdef WOLFSSL_DTLS
7655         if (ssl->options.dtls)
7656            dtlsExtra = DTLS_RECORD_EXTRA;
7657    #endif
7658
7659     /* check for available size */
7660     outputSz = ALERT_SIZE + MAX_MSG_EXTRA + dtlsExtra;
7661     if ((ret = CheckAvailableSize(ssl, outputSz)) != 0)
7662         return ret;
7663
7664     /* get ouput buffer */
7665     output = ssl->buffers.outputBuffer.buffer +
7666              ssl->buffers.outputBuffer.length;
7667
7668     input[0] = (byte)severity;
7669     input[1] = (byte)type;
7670     ssl->alert_history.last_tx.code = type;
7671     ssl->alert_history.last_tx.level = severity;
7672     if (severity == alert_fatal) {
7673         ssl->options.isClosed = 1;  /* Don't send close_notify */
7674     }
7675
7676     /* only send encrypted alert if handshake actually complete, otherwise
7677        other side may not be able to handle it */
7678     if (ssl->keys.encryptionOn && ssl->options.handShakeDone)
7679         sendSz = BuildMessage(ssl, output, outputSz, input, ALERT_SIZE, alert);
7680     else {
7681
7682         AddRecordHeader(output, ALERT_SIZE, alert, ssl);
7683         output += RECORD_HEADER_SZ;
7684         #ifdef WOLFSSL_DTLS
7685             if (ssl->options.dtls)
7686                 output += DTLS_RECORD_EXTRA;
7687         #endif
7688         XMEMCPY(output, input, ALERT_SIZE);
7689
7690         sendSz = RECORD_HEADER_SZ + ALERT_SIZE;
7691         #ifdef WOLFSSL_DTLS
7692             if (ssl->options.dtls)
7693                 sendSz += DTLS_RECORD_EXTRA;
7694         #endif
7695     }
7696     if (sendSz < 0)
7697         return BUILD_MSG_ERROR;
7698
7699     #ifdef WOLFSSL_CALLBACKS
7700         if (ssl->hsInfoOn)
7701             AddPacketName("Alert", &ssl->handShakeInfo);
7702         if (ssl->toInfoOn)
7703             AddPacketInfo("Alert", &ssl->timeoutInfo, output, sendSz,ssl->heap);
7704     #endif
7705
7706     ssl->buffers.outputBuffer.length += sendSz;
7707     ssl->options.sendAlertState = 1;
7708
7709     return SendBuffered(ssl);
7710 }
7711
7712 const char* wolfSSL_ERR_reason_error_string(unsigned long e)
7713 {
7714 #ifdef NO_ERROR_STRINGS
7715
7716     (void)e;
7717     return "no support for error strings built in";
7718
7719 #else
7720
7721     int error = (int)e;
7722
7723     /* pass to wolfCrypt */
7724     if (error < MAX_CODE_E && error > MIN_CODE_E) {
7725         return wc_GetErrorString(error);
7726     }
7727
7728     switch (error) {
7729
7730     case UNSUPPORTED_SUITE :
7731         return "unsupported cipher suite";
7732
7733     case INPUT_CASE_ERROR :
7734         return "input state error";
7735
7736     case PREFIX_ERROR :
7737         return "bad index to key rounds";
7738
7739     case MEMORY_ERROR :
7740         return "out of memory";
7741
7742     case VERIFY_FINISHED_ERROR :
7743         return "verify problem on finished";
7744
7745     case VERIFY_MAC_ERROR :
7746         return "verify mac problem";
7747
7748     case PARSE_ERROR :
7749         return "parse error on header";
7750
7751     case SIDE_ERROR :
7752         return "wrong client/server type";
7753
7754     case NO_PEER_CERT :
7755         return "peer didn't send cert";
7756
7757     case UNKNOWN_HANDSHAKE_TYPE :
7758         return "weird handshake type";
7759
7760     case SOCKET_ERROR_E :
7761         return "error state on socket";
7762
7763     case SOCKET_NODATA :
7764         return "expected data, not there";
7765
7766     case INCOMPLETE_DATA :
7767         return "don't have enough data to complete task";
7768
7769     case UNKNOWN_RECORD_TYPE :
7770         return "unknown type in record hdr";
7771
7772     case DECRYPT_ERROR :
7773         return "error during decryption";
7774
7775     case FATAL_ERROR :
7776         return "revcd alert fatal error";
7777
7778     case ENCRYPT_ERROR :
7779         return "error during encryption";
7780
7781     case FREAD_ERROR :
7782         return "fread problem";
7783
7784     case NO_PEER_KEY :
7785         return "need peer's key";
7786
7787     case NO_PRIVATE_KEY :
7788         return "need the private key";
7789
7790     case NO_DH_PARAMS :
7791         return "server missing DH params";
7792
7793     case RSA_PRIVATE_ERROR :
7794         return "error during rsa priv op";
7795
7796     case MATCH_SUITE_ERROR :
7797         return "can't match cipher suite";
7798
7799     case BUILD_MSG_ERROR :
7800         return "build message failure";
7801
7802     case BAD_HELLO :
7803         return "client hello malformed";
7804
7805     case DOMAIN_NAME_MISMATCH :
7806         return "peer subject name mismatch";
7807
7808     case WANT_READ :
7809     case SSL_ERROR_WANT_READ :
7810         return "non-blocking socket wants data to be read";
7811
7812     case NOT_READY_ERROR :
7813         return "handshake layer not ready yet, complete first";
7814
7815     case PMS_VERSION_ERROR :
7816         return "premaster secret version mismatch error";
7817
7818     case VERSION_ERROR :
7819         return "record layer version error";
7820
7821     case WANT_WRITE :
7822     case SSL_ERROR_WANT_WRITE :
7823         return "non-blocking socket write buffer full";
7824
7825     case BUFFER_ERROR :
7826         return "malformed buffer input error";
7827
7828     case VERIFY_CERT_ERROR :
7829         return "verify problem on certificate";
7830
7831     case VERIFY_SIGN_ERROR :
7832         return "verify problem based on signature";
7833
7834     case CLIENT_ID_ERROR :
7835         return "psk client identity error";
7836
7837     case SERVER_HINT_ERROR:
7838         return "psk server hint error";
7839
7840     case PSK_KEY_ERROR:
7841         return "psk key callback error";
7842
7843     case NTRU_KEY_ERROR:
7844         return "NTRU key error";
7845
7846     case NTRU_DRBG_ERROR:
7847         return "NTRU drbg error";
7848
7849     case NTRU_ENCRYPT_ERROR:
7850         return "NTRU encrypt error";
7851
7852     case NTRU_DECRYPT_ERROR:
7853         return "NTRU decrypt error";
7854
7855     case ZLIB_INIT_ERROR:
7856         return "zlib init error";
7857
7858     case ZLIB_COMPRESS_ERROR:
7859         return "zlib compress error";
7860
7861     case ZLIB_DECOMPRESS_ERROR:
7862         return "zlib decompress error";
7863
7864     case GETTIME_ERROR:
7865         return "gettimeofday() error";
7866
7867     case GETITIMER_ERROR:
7868         return "getitimer() error";
7869
7870     case SIGACT_ERROR:
7871         return "sigaction() error";
7872
7873     case SETITIMER_ERROR:
7874         return "setitimer() error";
7875
7876     case LENGTH_ERROR:
7877         return "record layer length error";
7878
7879     case PEER_KEY_ERROR:
7880         return "cant decode peer key";
7881
7882     case ZERO_RETURN:
7883     case SSL_ERROR_ZERO_RETURN:
7884         return "peer sent close notify alert";
7885
7886     case ECC_CURVETYPE_ERROR:
7887         return "Bad ECC Curve Type or unsupported";
7888
7889     case ECC_CURVE_ERROR:
7890         return "Bad ECC Curve or unsupported";
7891
7892     case ECC_PEERKEY_ERROR:
7893         return "Bad ECC Peer Key";
7894
7895     case ECC_MAKEKEY_ERROR:
7896         return "ECC Make Key failure";
7897
7898     case ECC_EXPORT_ERROR:
7899         return "ECC Export Key failure";
7900
7901     case ECC_SHARED_ERROR:
7902         return "ECC DHE shared failure";
7903
7904     case NOT_CA_ERROR:
7905         return "Not a CA by basic constraint error";
7906
7907     case BAD_PATH_ERROR:
7908         return "Bad path for opendir error";
7909
7910     case BAD_CERT_MANAGER_ERROR:
7911         return "Bad Cert Manager error";
7912
7913     case OCSP_CERT_REVOKED:
7914         return "OCSP Cert revoked";
7915
7916     case CRL_CERT_REVOKED:
7917         return "CRL Cert revoked";
7918
7919     case CRL_MISSING:
7920         return "CRL missing, not loaded";
7921
7922     case MONITOR_RUNNING_E:
7923         return "CRL monitor already running";
7924
7925     case THREAD_CREATE_E:
7926         return "Thread creation problem";
7927
7928     case OCSP_NEED_URL:
7929         return "OCSP need URL";
7930
7931     case OCSP_CERT_UNKNOWN:
7932         return "OCSP Cert unknown";
7933
7934     case OCSP_LOOKUP_FAIL:
7935         return "OCSP Responder lookup fail";
7936
7937     case MAX_CHAIN_ERROR:
7938         return "Maximum Chain Depth Exceeded";
7939
7940     case COOKIE_ERROR:
7941         return "DTLS Cookie Error";
7942
7943     case SEQUENCE_ERROR:
7944         return "DTLS Sequence Error";
7945
7946     case SUITES_ERROR:
7947         return "Suites Pointer Error";
7948
7949     case SSL_NO_PEM_HEADER:
7950         return "No PEM Header Error";
7951
7952     case OUT_OF_ORDER_E:
7953         return "Out of order message, fatal";
7954
7955     case BAD_KEA_TYPE_E:
7956         return "Bad KEA type found";
7957
7958     case SANITY_CIPHER_E:
7959         return "Sanity check on ciphertext failed";
7960
7961     case RECV_OVERFLOW_E:
7962         return "Receive callback returned more than requested";
7963
7964     case GEN_COOKIE_E:
7965         return "Generate Cookie Error";
7966
7967     case NO_PEER_VERIFY:
7968         return "Need peer certificate verify Error";
7969
7970     case FWRITE_ERROR:
7971         return "fwrite Error";
7972
7973     case CACHE_MATCH_ERROR:
7974         return "Cache restore header match Error";
7975
7976     case UNKNOWN_SNI_HOST_NAME_E:
7977         return "Unrecognized host name Error";
7978
7979     case KEYUSE_SIGNATURE_E:
7980         return "Key Use digitalSignature not set Error";
7981
7982     case KEYUSE_ENCIPHER_E:
7983         return "Key Use keyEncipherment not set Error";
7984
7985     case EXTKEYUSE_AUTH_E:
7986         return "Ext Key Use server/client auth not set Error";
7987
7988     case SEND_OOB_READ_E:
7989         return "Send Callback Out of Bounds Read Error";
7990
7991     case SECURE_RENEGOTIATION_E:
7992         return "Invalid Renegotiation Error";
7993
7994     case SESSION_TICKET_LEN_E:
7995         return "Session Ticket Too Long Error";
7996
7997     case SESSION_TICKET_EXPECT_E:
7998         return "Session Ticket Error";
7999
8000     case SCR_DIFFERENT_CERT_E:
8001         return "Peer sent different cert during SCR";
8002
8003     case SESSION_SECRET_CB_E:
8004         return "Session Secret Callback Error";
8005
8006     case NO_CHANGE_CIPHER_E:
8007         return "Finished received from peer before Change Cipher Error";
8008
8009     case SANITY_MSG_E:
8010         return "Sanity Check on message order Error";
8011
8012     case DUPLICATE_MSG_E:
8013         return "Duplicate HandShake message Error";
8014
8015     case SNI_UNSUPPORTED:
8016         return "Protocol version does not support SNI Error";
8017
8018     case SOCKET_PEER_CLOSED_E:
8019         return "Peer closed underlying transport Error";
8020
8021     case BAD_TICKET_KEY_CB_SZ:
8022         return "Bad user session ticket key callback Size Error";
8023
8024     case BAD_TICKET_MSG_SZ:
8025         return "Bad session ticket message Size Error";
8026
8027     case BAD_TICKET_ENCRYPT:
8028         return "Bad user ticket callback encrypt Error";
8029
8030     case DH_KEY_SIZE_E:
8031         return "DH key too small Error";
8032
8033     default :
8034         return "unknown error number";
8035     }
8036
8037 #endif /* NO_ERROR_STRINGS */
8038 }
8039
8040 void SetErrorString(int error, char* str)
8041 {
8042     XSTRNCPY(str, wolfSSL_ERR_reason_error_string(error), WOLFSSL_MAX_ERROR_SZ);
8043 }
8044
8045
8046 /* be sure to add to cipher_name_idx too !!!! */
8047 static const char* const cipher_names[] =
8048 {
8049 #ifdef BUILD_SSL_RSA_WITH_RC4_128_SHA
8050     "RC4-SHA",
8051 #endif
8052
8053 #ifdef BUILD_SSL_RSA_WITH_RC4_128_MD5
8054     "RC4-MD5",
8055 #endif
8056
8057 #ifdef BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA
8058     "DES-CBC3-SHA",
8059 #endif
8060
8061 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA
8062     "AES128-SHA",
8063 #endif
8064
8065 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA
8066     "AES256-SHA",
8067 #endif
8068
8069 #ifdef BUILD_TLS_RSA_WITH_NULL_SHA
8070     "NULL-SHA",
8071 #endif
8072
8073 #ifdef BUILD_TLS_RSA_WITH_NULL_SHA256
8074     "NULL-SHA256",
8075 #endif
8076
8077 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
8078     "DHE-RSA-AES128-SHA",
8079 #endif
8080
8081 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
8082     "DHE-RSA-AES256-SHA",
8083 #endif
8084
8085 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
8086     "DHE-PSK-AES256-GCM-SHA384",
8087 #endif
8088
8089 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
8090     "DHE-PSK-AES128-GCM-SHA256",
8091 #endif
8092
8093 #ifdef BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384
8094     "PSK-AES256-GCM-SHA384",
8095 #endif
8096
8097 #ifdef BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256
8098     "PSK-AES128-GCM-SHA256",
8099 #endif
8100
8101 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
8102     "DHE-PSK-AES256-CBC-SHA384",
8103 #endif
8104
8105 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
8106     "DHE-PSK-AES128-CBC-SHA256",
8107 #endif
8108
8109 #ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384
8110     "PSK-AES256-CBC-SHA384",
8111 #endif
8112
8113 #ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256
8114     "PSK-AES128-CBC-SHA256",
8115 #endif
8116
8117 #ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA
8118     "PSK-AES128-CBC-SHA",
8119 #endif
8120
8121 #ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA
8122     "PSK-AES256-CBC-SHA",
8123 #endif
8124
8125 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CCM
8126     "DHE-PSK-AES128-CCM",
8127 #endif
8128
8129 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CCM
8130     "DHE-PSK-AES256-CCM",
8131 #endif
8132
8133 #ifdef BUILD_TLS_PSK_WITH_AES_128_CCM
8134     "PSK-AES128-CCM",
8135 #endif
8136
8137 #ifdef BUILD_TLS_PSK_WITH_AES_256_CCM
8138     "PSK-AES256-CCM",
8139 #endif
8140
8141 #ifdef BUILD_TLS_PSK_WITH_AES_128_CCM_8
8142     "PSK-AES128-CCM-8",
8143 #endif
8144
8145 #ifdef BUILD_TLS_PSK_WITH_AES_256_CCM_8
8146     "PSK-AES256-CCM-8",
8147 #endif
8148
8149 #ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA384
8150     "DHE-PSK-NULL-SHA384",
8151 #endif
8152
8153 #ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA256
8154     "DHE-PSK-NULL-SHA256",
8155 #endif
8156
8157 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA384
8158     "PSK-NULL-SHA384",
8159 #endif
8160
8161 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA256
8162     "PSK-NULL-SHA256",
8163 #endif
8164
8165 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA
8166     "PSK-NULL-SHA",
8167 #endif
8168
8169 #ifdef BUILD_TLS_RSA_WITH_HC_128_MD5
8170     "HC128-MD5",
8171 #endif
8172
8173 #ifdef BUILD_TLS_RSA_WITH_HC_128_SHA
8174     "HC128-SHA",
8175 #endif
8176
8177 #ifdef BUILD_TLS_RSA_WITH_HC_128_B2B256
8178     "HC128-B2B256",
8179 #endif
8180
8181 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_B2B256
8182     "AES128-B2B256",
8183 #endif
8184
8185 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_B2B256
8186     "AES256-B2B256",
8187 #endif
8188
8189 #ifdef BUILD_TLS_RSA_WITH_RABBIT_SHA
8190     "RABBIT-SHA",
8191 #endif
8192
8193 #ifdef BUILD_TLS_NTRU_RSA_WITH_RC4_128_SHA
8194     "NTRU-RC4-SHA",
8195 #endif
8196
8197 #ifdef BUILD_TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA
8198     "NTRU-DES-CBC3-SHA",
8199 #endif
8200
8201 #ifdef BUILD_TLS_NTRU_RSA_WITH_AES_128_CBC_SHA
8202     "NTRU-AES128-SHA",
8203 #endif
8204
8205 #ifdef BUILD_TLS_NTRU_RSA_WITH_AES_256_CBC_SHA
8206     "NTRU-AES256-SHA",
8207 #endif
8208
8209 #ifdef BUILD_TLS_RSA_WITH_AES_128_CCM_8
8210     "AES128-CCM-8",
8211 #endif
8212
8213 #ifdef BUILD_TLS_RSA_WITH_AES_256_CCM_8
8214     "AES256-CCM-8",
8215 #endif
8216
8217 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
8218     "ECDHE-ECDSA-AES128-CCM-8",
8219 #endif
8220
8221 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8
8222     "ECDHE-ECDSA-AES256-CCM-8",
8223 #endif
8224
8225 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
8226     "ECDHE-RSA-AES128-SHA",
8227 #endif
8228
8229 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
8230     "ECDHE-RSA-AES256-SHA",
8231 #endif
8232
8233 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
8234     "ECDHE-ECDSA-AES128-SHA",
8235 #endif
8236
8237 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
8238     "ECDHE-ECDSA-AES256-SHA",
8239 #endif
8240
8241 #ifdef BUILD_TLS_ECDHE_RSA_WITH_RC4_128_SHA
8242     "ECDHE-RSA-RC4-SHA",
8243 #endif
8244
8245 #ifdef BUILD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
8246     "ECDHE-RSA-DES-CBC3-SHA",
8247 #endif
8248
8249 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
8250     "ECDHE-ECDSA-RC4-SHA",
8251 #endif
8252
8253 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
8254     "ECDHE-ECDSA-DES-CBC3-SHA",
8255 #endif
8256
8257 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256
8258     "AES128-SHA256",
8259 #endif
8260
8261 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA256
8262     "AES256-SHA256",
8263 #endif
8264
8265 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
8266     "DHE-RSA-AES128-SHA256",
8267 #endif
8268
8269 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
8270     "DHE-RSA-AES256-SHA256",
8271 #endif
8272
8273 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
8274     "ECDH-RSA-AES128-SHA",
8275 #endif
8276
8277 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
8278     "ECDH-RSA-AES256-SHA",
8279 #endif
8280
8281 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
8282     "ECDH-ECDSA-AES128-SHA",
8283 #endif
8284
8285 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
8286     "ECDH-ECDSA-AES256-SHA",
8287 #endif
8288
8289 #ifdef BUILD_TLS_ECDH_RSA_WITH_RC4_128_SHA
8290     "ECDH-RSA-RC4-SHA",
8291 #endif
8292
8293 #ifdef BUILD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
8294     "ECDH-RSA-DES-CBC3-SHA",
8295 #endif
8296
8297 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
8298     "ECDH-ECDSA-RC4-SHA",
8299 #endif
8300
8301 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
8302     "ECDH-ECDSA-DES-CBC3-SHA",
8303 #endif
8304
8305 #ifdef BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256
8306     "AES128-GCM-SHA256",
8307 #endif
8308
8309 #ifdef BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384
8310     "AES256-GCM-SHA384",
8311 #endif
8312
8313 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
8314     "DHE-RSA-AES128-GCM-SHA256",
8315 #endif
8316
8317 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
8318     "DHE-RSA-AES256-GCM-SHA384",
8319 #endif
8320
8321 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
8322     "ECDHE-RSA-AES128-GCM-SHA256",
8323 #endif
8324
8325 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
8326     "ECDHE-RSA-AES256-GCM-SHA384",
8327 #endif
8328
8329 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
8330     "ECDHE-ECDSA-AES128-GCM-SHA256",
8331 #endif
8332
8333 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
8334     "ECDHE-ECDSA-AES256-GCM-SHA384",
8335 #endif
8336
8337 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
8338     "ECDH-RSA-AES128-GCM-SHA256",
8339 #endif
8340
8341 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
8342     "ECDH-RSA-AES256-GCM-SHA384",
8343 #endif
8344
8345 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
8346     "ECDH-ECDSA-AES128-GCM-SHA256",
8347 #endif
8348
8349 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
8350     "ECDH-ECDSA-AES256-GCM-SHA384",
8351 #endif
8352
8353 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
8354     "CAMELLIA128-SHA",
8355 #endif
8356
8357 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
8358     "DHE-RSA-CAMELLIA128-SHA",
8359 #endif
8360
8361 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
8362     "CAMELLIA256-SHA",
8363 #endif
8364
8365 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
8366     "DHE-RSA-CAMELLIA256-SHA",
8367 #endif
8368
8369 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
8370     "CAMELLIA128-SHA256",
8371 #endif
8372
8373 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
8374     "DHE-RSA-CAMELLIA128-SHA256",
8375 #endif
8376
8377 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
8378     "CAMELLIA256-SHA256",
8379 #endif
8380
8381 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
8382     "DHE-RSA-CAMELLIA256-SHA256",
8383 #endif
8384
8385 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
8386     "ECDHE-RSA-AES128-SHA256",
8387 #endif
8388
8389 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
8390     "ECDHE-ECDSA-AES128-SHA256",
8391 #endif
8392
8393 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
8394     "ECDH-RSA-AES128-SHA256",
8395 #endif
8396
8397 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
8398     "ECDH-ECDSA-AES128-SHA256",
8399 #endif
8400
8401 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
8402     "ECDHE-RSA-AES256-SHA384",
8403 #endif
8404
8405 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
8406     "ECDHE-ECDSA-AES256-SHA384",
8407 #endif
8408
8409 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
8410     "ECDH-RSA-AES256-SHA384",
8411 #endif
8412
8413 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
8414     "ECDH-ECDSA-AES256-SHA384",
8415 #endif
8416
8417 #ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
8418     "ECDHE-RSA-CHACHA20-POLY1305",
8419 #endif
8420
8421 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
8422     "ECDHE-ECDSA-CHACHA20-POLY1305",
8423 #endif
8424
8425 #ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
8426     "DHE-RSA-CHACHA20-POLY1305",
8427 #endif
8428
8429 #ifdef BUILD_TLS_DH_anon_WITH_AES_128_CBC_SHA
8430     "ADH-AES128-SHA",
8431 #endif
8432
8433 #ifdef HAVE_RENEGOTIATION_INDICATION
8434     "RENEGOTIATION-INFO",
8435 #endif
8436 };
8437
8438
8439 /* cipher suite number that matches above name table */
8440 static int cipher_name_idx[] =
8441 {
8442
8443 #ifdef BUILD_SSL_RSA_WITH_RC4_128_SHA
8444     SSL_RSA_WITH_RC4_128_SHA,
8445 #endif
8446
8447 #ifdef BUILD_SSL_RSA_WITH_RC4_128_MD5
8448     SSL_RSA_WITH_RC4_128_MD5,
8449 #endif
8450
8451 #ifdef BUILD_SSL_RSA_WITH_3DES_EDE_CBC_SHA
8452     SSL_RSA_WITH_3DES_EDE_CBC_SHA,
8453 #endif
8454
8455 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA
8456     TLS_RSA_WITH_AES_128_CBC_SHA,
8457 #endif
8458
8459 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA
8460     TLS_RSA_WITH_AES_256_CBC_SHA,
8461 #endif
8462
8463 #ifdef BUILD_TLS_RSA_WITH_NULL_SHA
8464     TLS_RSA_WITH_NULL_SHA,
8465 #endif
8466
8467 #ifdef BUILD_TLS_RSA_WITH_NULL_SHA256
8468     TLS_RSA_WITH_NULL_SHA256,
8469 #endif
8470
8471 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
8472     TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
8473 #endif
8474
8475 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
8476     TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
8477 #endif
8478
8479 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
8480     TLS_DHE_PSK_WITH_AES_256_GCM_SHA384,
8481 #endif
8482
8483 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
8484     TLS_DHE_PSK_WITH_AES_128_GCM_SHA256,
8485 #endif
8486
8487 #ifdef BUILD_TLS_PSK_WITH_AES_256_GCM_SHA384
8488     TLS_PSK_WITH_AES_256_GCM_SHA384,
8489 #endif
8490
8491 #ifdef BUILD_TLS_PSK_WITH_AES_128_GCM_SHA256
8492     TLS_PSK_WITH_AES_128_GCM_SHA256,
8493 #endif
8494
8495 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
8496     TLS_DHE_PSK_WITH_AES_256_CBC_SHA384,
8497 #endif
8498
8499 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
8500     TLS_DHE_PSK_WITH_AES_128_CBC_SHA256,
8501 #endif
8502
8503 #ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA384
8504     TLS_PSK_WITH_AES_256_CBC_SHA384,
8505 #endif
8506
8507 #ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA256
8508     TLS_PSK_WITH_AES_128_CBC_SHA256,
8509 #endif
8510
8511 #ifdef BUILD_TLS_PSK_WITH_AES_128_CBC_SHA
8512     TLS_PSK_WITH_AES_128_CBC_SHA,
8513 #endif
8514
8515 #ifdef BUILD_TLS_PSK_WITH_AES_256_CBC_SHA
8516     TLS_PSK_WITH_AES_256_CBC_SHA,
8517 #endif
8518
8519 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_128_CCM
8520     TLS_DHE_PSK_WITH_AES_128_CCM,
8521 #endif
8522
8523 #ifdef BUILD_TLS_DHE_PSK_WITH_AES_256_CCM
8524     TLS_DHE_PSK_WITH_AES_256_CCM,
8525 #endif
8526
8527 #ifdef BUILD_TLS_PSK_WITH_AES_128_CCM
8528     TLS_PSK_WITH_AES_128_CCM,
8529 #endif
8530
8531 #ifdef BUILD_TLS_PSK_WITH_AES_256_CCM
8532     TLS_PSK_WITH_AES_256_CCM,
8533 #endif
8534
8535 #ifdef BUILD_TLS_PSK_WITH_AES_128_CCM_8
8536     TLS_PSK_WITH_AES_128_CCM_8,
8537 #endif
8538
8539 #ifdef BUILD_TLS_PSK_WITH_AES_256_CCM_8
8540     TLS_PSK_WITH_AES_256_CCM_8,
8541 #endif
8542
8543 #ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA384
8544     TLS_DHE_PSK_WITH_NULL_SHA384,
8545 #endif
8546
8547 #ifdef BUILD_TLS_DHE_PSK_WITH_NULL_SHA256
8548     TLS_DHE_PSK_WITH_NULL_SHA256,
8549 #endif
8550
8551 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA384
8552     TLS_PSK_WITH_NULL_SHA384,
8553 #endif
8554
8555 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA256
8556     TLS_PSK_WITH_NULL_SHA256,
8557 #endif
8558
8559 #ifdef BUILD_TLS_PSK_WITH_NULL_SHA
8560     TLS_PSK_WITH_NULL_SHA,
8561 #endif
8562
8563 #ifdef BUILD_TLS_RSA_WITH_HC_128_MD5
8564     TLS_RSA_WITH_HC_128_MD5,
8565 #endif
8566
8567 #ifdef BUILD_TLS_RSA_WITH_HC_128_SHA
8568     TLS_RSA_WITH_HC_128_SHA,
8569 #endif
8570
8571 #ifdef BUILD_TLS_RSA_WITH_HC_128_B2B256
8572     TLS_RSA_WITH_HC_128_B2B256,
8573 #endif
8574
8575 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_B2B256
8576     TLS_RSA_WITH_AES_128_CBC_B2B256,
8577 #endif
8578
8579 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_B2B256
8580     TLS_RSA_WITH_AES_256_CBC_B2B256,
8581 #endif
8582
8583 #ifdef BUILD_TLS_RSA_WITH_RABBIT_SHA
8584     TLS_RSA_WITH_RABBIT_SHA,
8585 #endif
8586
8587 #ifdef BUILD_TLS_NTRU_RSA_WITH_RC4_128_SHA
8588     TLS_NTRU_RSA_WITH_RC4_128_SHA,
8589 #endif
8590
8591 #ifdef BUILD_TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA
8592     TLS_NTRU_RSA_WITH_3DES_EDE_CBC_SHA,
8593 #endif
8594
8595 #ifdef BUILD_TLS_NTRU_RSA_WITH_AES_128_CBC_SHA
8596     TLS_NTRU_RSA_WITH_AES_128_CBC_SHA,
8597 #endif
8598
8599 #ifdef BUILD_TLS_NTRU_RSA_WITH_AES_256_CBC_SHA
8600     TLS_NTRU_RSA_WITH_AES_256_CBC_SHA,
8601 #endif
8602
8603 #ifdef BUILD_TLS_RSA_WITH_AES_128_CCM_8
8604     TLS_RSA_WITH_AES_128_CCM_8,
8605 #endif
8606
8607 #ifdef BUILD_TLS_RSA_WITH_AES_256_CCM_8
8608     TLS_RSA_WITH_AES_256_CCM_8,
8609 #endif
8610
8611 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
8612     TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
8613 #endif
8614
8615 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8
8616     TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,
8617 #endif
8618
8619 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
8620     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
8621 #endif
8622
8623 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
8624     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
8625 #endif
8626
8627 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
8628     TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
8629 #endif
8630
8631 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
8632     TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
8633 #endif
8634
8635 #ifdef BUILD_TLS_ECDHE_RSA_WITH_RC4_128_SHA
8636     TLS_ECDHE_RSA_WITH_RC4_128_SHA,
8637 #endif
8638
8639 #ifdef BUILD_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
8640     TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
8641 #endif
8642
8643 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
8644     TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
8645 #endif
8646
8647 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
8648     TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
8649 #endif
8650
8651 #ifdef BUILD_TLS_RSA_WITH_AES_128_CBC_SHA256
8652     TLS_RSA_WITH_AES_128_CBC_SHA256,
8653 #endif
8654
8655 #ifdef BUILD_TLS_RSA_WITH_AES_256_CBC_SHA256
8656     TLS_RSA_WITH_AES_256_CBC_SHA256,
8657 #endif
8658
8659 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
8660     TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
8661 #endif
8662
8663 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
8664     TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
8665 #endif
8666
8667 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
8668     TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
8669 #endif
8670
8671 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
8672     TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
8673 #endif
8674
8675 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
8676     TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
8677 #endif
8678
8679 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
8680     TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
8681 #endif
8682
8683 #ifdef BUILD_TLS_ECDH_RSA_WITH_RC4_128_SHA
8684     TLS_ECDH_RSA_WITH_RC4_128_SHA,
8685 #endif
8686
8687 #ifdef BUILD_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
8688     TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
8689 #endif
8690
8691 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_RC4_128_SHA
8692     TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
8693 #endif
8694
8695 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
8696     TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
8697 #endif
8698
8699 #ifdef BUILD_TLS_RSA_WITH_AES_128_GCM_SHA256
8700     TLS_RSA_WITH_AES_128_GCM_SHA256,
8701 #endif
8702
8703 #ifdef BUILD_TLS_RSA_WITH_AES_256_GCM_SHA384
8704     TLS_RSA_WITH_AES_256_GCM_SHA384,
8705 #endif
8706
8707 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
8708     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
8709 #endif
8710
8711 #ifdef BUILD_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
8712     TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
8713 #endif
8714
8715 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
8716     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
8717 #endif
8718
8719 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
8720     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
8721 #endif
8722
8723 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
8724     TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
8725 #endif
8726
8727 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
8728     TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
8729 #endif
8730
8731 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
8732     TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,
8733 #endif
8734
8735 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
8736     TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,
8737 #endif
8738
8739 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
8740     TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
8741 #endif
8742
8743 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
8744     TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
8745 #endif
8746
8747 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
8748     TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,
8749 #endif
8750
8751 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
8752     TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,
8753 #endif
8754
8755 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
8756     TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,
8757 #endif
8758
8759 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
8760     TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,
8761 #endif
8762
8763 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
8764     TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,
8765 #endif
8766
8767 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
8768     TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,
8769 #endif
8770
8771 #ifdef BUILD_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
8772     TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,
8773 #endif
8774
8775 #ifdef BUILD_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
8776     TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,
8777 #endif
8778
8779 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
8780     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
8781 #endif
8782
8783 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
8784     TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
8785 #endif
8786
8787 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
8788     TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,
8789 #endif
8790
8791 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
8792     TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,
8793 #endif
8794
8795 #ifdef BUILD_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
8796     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
8797 #endif
8798
8799 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
8800     TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
8801 #endif
8802
8803 #ifdef BUILD_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
8804     TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,
8805 #endif
8806
8807 #ifdef BUILD_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
8808     TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
8809 #endif
8810
8811 #ifdef BUILD_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
8812     TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
8813 #endif
8814
8815 #ifdef BUILD_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
8816     TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
8817 #endif
8818
8819 #ifdef BUILD_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
8820     TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
8821 #endif
8822
8823 #ifdef BUILD_TLS_DH_anon_WITH_AES_128_CBC_SHA
8824     TLS_DH_anon_WITH_AES_128_CBC_SHA,
8825 #endif
8826
8827 #ifdef HAVE_RENEGOTIATION_INDICATION
8828     TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
8829 #endif
8830 };
8831
8832
8833 /* returns the cipher_names array */
8834 const char* const* GetCipherNames(void)
8835 {
8836     return cipher_names;
8837 }
8838
8839
8840 /* returns the size of the cipher_names array */
8841 int GetCipherNamesSize(void)
8842 {
8843     return (int)(sizeof(cipher_names) / sizeof(char*));
8844 }
8845
8846
8847 /**
8848 Set the enabled cipher suites.
8849
8850 @param [out] suites Suites structure.
8851 @param [in]  list   List of cipher suites, only supports full name from
8852                     cipher_name[] delimited by ':'.
8853
8854 @return true on success, else false.
8855 */
8856 int SetCipherList(Suites* suites, const char* list)
8857 {
8858     int       ret          = 0;
8859     int       idx          = 0;
8860     int       haveRSAsig   = 0;
8861     int       haveECDSAsig = 0;
8862     int       haveAnon     = 0;
8863     const int suiteSz      = GetCipherNamesSize();
8864     char*     next         = (char*)list;
8865
8866     if (suites == NULL || list == NULL) {
8867         WOLFSSL_MSG("SetCipherList parameter error");
8868         return 0;
8869     }
8870
8871     if (next[0] == 0 || XSTRNCMP(next, "ALL", 3) == 0)
8872         return 1; /* wolfSSL defualt */
8873
8874     do {
8875         char*  current = next;
8876         char   name[MAX_SUITE_NAME + 1];
8877         int    i;
8878         word32 length;
8879
8880         next   = XSTRSTR(next, ":");
8881         length = min(sizeof(name), !next ? (word32)XSTRLEN(current) /* last */
8882                                          : (word32)(next - current));
8883
8884         XSTRNCPY(name, current, length);
8885         name[(length == sizeof(name)) ? length - 1 : length] = 0;
8886
8887         for (i = 0; i < suiteSz; i++) {
8888             if (XSTRNCMP(name, cipher_names[i], sizeof(name)) == 0) {
8889                 suites->suites[idx++] = (XSTRSTR(name, "CHACHA")) ? CHACHA_BYTE
8890                                       : (XSTRSTR(name, "EC"))     ? ECC_BYTE
8891                                       : (XSTRSTR(name, "CCM"))    ? ECC_BYTE
8892                                       : 0x00; /* normal */
8893
8894                 suites->suites[idx++] = (byte)cipher_name_idx[i];
8895
8896                 /* The suites are either ECDSA, RSA, PSK, or Anon. The RSA
8897                  * suites don't necessarily have RSA in the name. */
8898                 if ((haveECDSAsig == 0) && XSTRSTR(name, "ECDSA"))
8899                     haveECDSAsig = 1;
8900                 else if (XSTRSTR(name, "ADH"))
8901                     haveAnon = 1;
8902                 else if ((haveRSAsig == 0) && (XSTRSTR(name, "PSK") == NULL))
8903                     haveRSAsig = 1;
8904
8905                 ret = 1; /* found at least one */
8906                 break;
8907             }
8908         }
8909     }
8910     while (next++); /* ++ needed to skip ':' */
8911
8912     if (ret) {
8913         suites->setSuites = 1;
8914         suites->suiteSz   = (word16)idx;
8915         InitSuitesHashSigAlgo(suites, haveECDSAsig, haveRSAsig, haveAnon);
8916     }
8917
8918     return ret;
8919 }
8920
8921
8922 static void PickHashSigAlgo(WOLFSSL* ssl,
8923                              const byte* hashSigAlgo, word32 hashSigAlgoSz)
8924 {
8925     word32 i;
8926
8927     ssl->suites->sigAlgo = ssl->specs.sig_algo;
8928     ssl->suites->hashAlgo = sha_mac;
8929
8930     /* i+1 since peek a byte ahead for type */
8931     for (i = 0; (i+1) < hashSigAlgoSz; i += 2) {
8932         if (hashSigAlgo[i+1] == ssl->specs.sig_algo) {
8933             if (hashSigAlgo[i] == sha_mac) {
8934                 break;
8935             }
8936             #ifndef NO_SHA256
8937             else if (hashSigAlgo[i] == sha256_mac) {
8938                 ssl->suites->hashAlgo = sha256_mac;
8939                 break;
8940             }
8941             #endif
8942             #ifdef WOLFSSL_SHA384
8943             else if (hashSigAlgo[i] == sha384_mac) {
8944                 ssl->suites->hashAlgo = sha384_mac;
8945                 break;
8946             }
8947             #endif
8948             #ifdef WOLFSSL_SHA512
8949             else if (hashSigAlgo[i] == sha512_mac) {
8950                 ssl->suites->hashAlgo = sha512_mac;
8951                 break;
8952             }
8953             #endif
8954         }
8955     }
8956 }
8957
8958
8959 #ifdef WOLFSSL_CALLBACKS
8960
8961     /* Initialisze HandShakeInfo */
8962     void InitHandShakeInfo(HandShakeInfo* info)
8963     {
8964         int i;
8965
8966         info->cipherName[0] = 0;
8967         for (i = 0; i < MAX_PACKETS_HANDSHAKE; i++)
8968             info->packetNames[i][0] = 0;
8969         info->numberPackets = 0;
8970         info->negotiationError = 0;
8971     }
8972
8973     /* Set Final HandShakeInfo parameters */
8974     void FinishHandShakeInfo(HandShakeInfo* info, const WOLFSSL* ssl)
8975     {
8976         int i;
8977         int sz = sizeof(cipher_name_idx)/sizeof(int);
8978
8979         for (i = 0; i < sz; i++)
8980             if (ssl->options.cipherSuite == (byte)cipher_name_idx[i]) {
8981                 if (ssl->options.cipherSuite0 == ECC_BYTE)
8982                     continue;   /* ECC suites at end */
8983                 XSTRNCPY(info->cipherName, cipher_names[i], MAX_CIPHERNAME_SZ);
8984                 break;
8985             }
8986
8987         /* error max and min are negative numbers */
8988         if (ssl->error <= MIN_PARAM_ERR && ssl->error >= MAX_PARAM_ERR)
8989             info->negotiationError = ssl->error;
8990     }
8991
8992
8993     /* Add name to info packet names, increase packet name count */
8994     void AddPacketName(const char* name, HandShakeInfo* info)
8995     {
8996         if (info->numberPackets < MAX_PACKETS_HANDSHAKE) {
8997             XSTRNCPY(info->packetNames[info->numberPackets++], name,
8998                     MAX_PACKETNAME_SZ);
8999         }
9000     }
9001
9002
9003     /* Initialisze TimeoutInfo */
9004     void InitTimeoutInfo(TimeoutInfo* info)
9005     {
9006         int i;
9007
9008         info->timeoutName[0] = 0;
9009         info->flags          = 0;
9010
9011         for (i = 0; i < MAX_PACKETS_HANDSHAKE; i++) {
9012             info->packets[i].packetName[0]     = 0;
9013             info->packets[i].timestamp.tv_sec  = 0;
9014             info->packets[i].timestamp.tv_usec = 0;
9015             info->packets[i].bufferValue       = 0;
9016             info->packets[i].valueSz           = 0;
9017         }
9018         info->numberPackets        = 0;
9019         info->timeoutValue.tv_sec  = 0;
9020         info->timeoutValue.tv_usec = 0;
9021     }
9022
9023
9024     /* Free TimeoutInfo */
9025     void FreeTimeoutInfo(TimeoutInfo* info, void* heap)
9026     {
9027         int i;
9028         (void)heap;
9029         for (i = 0; i < MAX_PACKETS_HANDSHAKE; i++)
9030             if (info->packets[i].bufferValue) {
9031                 XFREE(info->packets[i].bufferValue, heap, DYNAMIC_TYPE_INFO);
9032                 info->packets[i].bufferValue = 0;
9033             }
9034
9035     }
9036
9037
9038     /* Add PacketInfo to TimeoutInfo */
9039     void AddPacketInfo(const char* name, TimeoutInfo* info, const byte* data,
9040                        int sz, void* heap)
9041     {
9042         if (info->numberPackets < (MAX_PACKETS_HANDSHAKE - 1)) {
9043             Timeval currTime;
9044
9045             /* may add name after */
9046             if (name)
9047                 XSTRNCPY(info->packets[info->numberPackets].packetName, name,
9048                         MAX_PACKETNAME_SZ);
9049
9050             /* add data, put in buffer if bigger than static buffer */
9051             info->packets[info->numberPackets].valueSz = sz;
9052             if (sz < MAX_VALUE_SZ)
9053                 XMEMCPY(info->packets[info->numberPackets].value, data, sz);
9054             else {
9055                 info->packets[info->numberPackets].bufferValue =
9056                            XMALLOC(sz, heap, DYNAMIC_TYPE_INFO);
9057                 if (!info->packets[info->numberPackets].bufferValue)
9058                     /* let next alloc catch, just don't fill, not fatal here  */
9059                     info->packets[info->numberPackets].valueSz = 0;
9060                 else
9061                     XMEMCPY(info->packets[info->numberPackets].bufferValue,
9062                            data, sz);
9063             }
9064             gettimeofday(&currTime, 0);
9065             info->packets[info->numberPackets].timestamp.tv_sec  =
9066                                                              currTime.tv_sec;
9067             info->packets[info->numberPackets].timestamp.tv_usec =
9068                                                              currTime.tv_usec;
9069             info->numberPackets++;
9070         }
9071     }
9072
9073
9074     /* Add packet name to previsouly added packet info */
9075     void AddLateName(const char* name, TimeoutInfo* info)
9076     {
9077         /* make sure we have a valid previous one */
9078         if (info->numberPackets > 0 && info->numberPackets <
9079                                                         MAX_PACKETS_HANDSHAKE) {
9080             XSTRNCPY(info->packets[info->numberPackets - 1].packetName, name,
9081                     MAX_PACKETNAME_SZ);
9082         }
9083     }
9084
9085     /* Add record header to previsouly added packet info */
9086     void AddLateRecordHeader(const RecordLayerHeader* rl, TimeoutInfo* info)
9087     {
9088         /* make sure we have a valid previous one */
9089         if (info->numberPackets > 0 && info->numberPackets <
9090                                                         MAX_PACKETS_HANDSHAKE) {
9091             if (info->packets[info->numberPackets - 1].bufferValue)
9092                 XMEMCPY(info->packets[info->numberPackets - 1].bufferValue, rl,
9093                        RECORD_HEADER_SZ);
9094             else
9095                 XMEMCPY(info->packets[info->numberPackets - 1].value, rl,
9096                        RECORD_HEADER_SZ);
9097         }
9098     }
9099
9100 #endif /* WOLFSSL_CALLBACKS */
9101
9102
9103
9104 /* client only parts */
9105 #ifndef NO_WOLFSSL_CLIENT
9106
9107     int SendClientHello(WOLFSSL* ssl)
9108     {
9109         byte              *output;
9110         word32             length, idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
9111         int                sendSz;
9112         int                idSz = ssl->options.resuming
9113                                 ? ssl->session.sessionIDSz
9114                                 : 0;
9115         int                ret;
9116
9117         if (ssl->suites == NULL) {
9118             WOLFSSL_MSG("Bad suites pointer in SendClientHello");
9119             return SUITES_ERROR;
9120         }
9121
9122 #ifdef HAVE_SESSION_TICKET
9123         if (ssl->options.resuming && ssl->session.ticketLen > 0) {
9124             SessionTicket* ticket;
9125
9126             ticket = TLSX_SessionTicket_Create(0,
9127                                    ssl->session.ticket, ssl->session.ticketLen);
9128             if (ticket == NULL) return MEMORY_E;
9129
9130             ret = TLSX_UseSessionTicket(&ssl->extensions, ticket);
9131             if (ret != SSL_SUCCESS) return ret;
9132
9133             idSz = 0;
9134         }
9135 #endif
9136
9137         length = VERSION_SZ + RAN_LEN
9138                + idSz + ENUM_LEN
9139                + ssl->suites->suiteSz + SUITE_LEN
9140                + COMP_LEN + ENUM_LEN;
9141
9142 #ifdef HAVE_TLS_EXTENSIONS
9143         length += TLSX_GetRequestSize(ssl);
9144 #else
9145         if (IsAtLeastTLSv1_2(ssl) && ssl->suites->hashSigAlgoSz) {
9146             length += ssl->suites->hashSigAlgoSz + HELLO_EXT_SZ;
9147         }
9148 #endif
9149         sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
9150
9151 #ifdef WOLFSSL_DTLS
9152         if (ssl->options.dtls) {
9153             length += ENUM_LEN;   /* cookie */
9154             if (ssl->arrays->cookieSz != 0) length += ssl->arrays->cookieSz;
9155             sendSz  = length + DTLS_HANDSHAKE_HEADER_SZ + DTLS_RECORD_HEADER_SZ;
9156             idx    += DTLS_HANDSHAKE_EXTRA + DTLS_RECORD_EXTRA;
9157         }
9158 #endif
9159
9160         if (ssl->keys.encryptionOn)
9161             sendSz += MAX_MSG_EXTRA;
9162
9163         /* check for available size */
9164         if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
9165             return ret;
9166
9167         /* get ouput buffer */
9168         output = ssl->buffers.outputBuffer.buffer +
9169                  ssl->buffers.outputBuffer.length;
9170
9171         AddHeaders(output, length, client_hello, ssl);
9172
9173             /* client hello, first version */
9174         output[idx++] = ssl->version.major;
9175         output[idx++] = ssl->version.minor;
9176         ssl->chVersion = ssl->version;  /* store in case changed */
9177
9178             /* then random */
9179         if (ssl->options.connectState == CONNECT_BEGIN) {
9180             ret = wc_RNG_GenerateBlock(ssl->rng, output + idx, RAN_LEN);
9181             if (ret != 0)
9182                 return ret;
9183
9184                 /* store random */
9185             XMEMCPY(ssl->arrays->clientRandom, output + idx, RAN_LEN);
9186         } else {
9187 #ifdef WOLFSSL_DTLS
9188                 /* send same random on hello again */
9189             XMEMCPY(output + idx, ssl->arrays->clientRandom, RAN_LEN);
9190 #endif
9191         }
9192         idx += RAN_LEN;
9193
9194             /* then session id */
9195         output[idx++] = (byte)idSz;
9196         if (idSz) {
9197             XMEMCPY(output + idx, ssl->session.sessionID,
9198                                                       ssl->session.sessionIDSz);
9199             idx += ssl->session.sessionIDSz;
9200         }
9201
9202             /* then DTLS cookie */
9203 #ifdef WOLFSSL_DTLS
9204         if (ssl->options.dtls) {
9205             byte cookieSz = ssl->arrays->cookieSz;
9206
9207             output[idx++] = cookieSz;
9208             if (cookieSz) {
9209                 XMEMCPY(&output[idx], ssl->arrays->cookie, cookieSz);
9210                 idx += cookieSz;
9211             }
9212         }
9213 #endif
9214             /* then cipher suites */
9215         c16toa(ssl->suites->suiteSz, output + idx);
9216         idx += 2;
9217         XMEMCPY(output + idx, &ssl->suites->suites, ssl->suites->suiteSz);
9218         idx += ssl->suites->suiteSz;
9219
9220             /* last, compression */
9221         output[idx++] = COMP_LEN;
9222         if (ssl->options.usingCompression)
9223             output[idx++] = ZLIB_COMPRESSION;
9224         else
9225             output[idx++] = NO_COMPRESSION;
9226
9227 #ifdef HAVE_TLS_EXTENSIONS
9228         idx += TLSX_WriteRequest(ssl, output + idx);
9229
9230         (void)idx; /* suppress analyzer warning, keep idx current */
9231 #else
9232         if (IsAtLeastTLSv1_2(ssl) && ssl->suites->hashSigAlgoSz)
9233         {
9234             int i;
9235             /* add in the extensions length */
9236             c16toa(HELLO_EXT_LEN + ssl->suites->hashSigAlgoSz, output + idx);
9237             idx += 2;
9238
9239             c16toa(HELLO_EXT_SIG_ALGO, output + idx);
9240             idx += 2;
9241             c16toa(HELLO_EXT_SIGALGO_SZ+ssl->suites->hashSigAlgoSz, output+idx);
9242             idx += 2;
9243             c16toa(ssl->suites->hashSigAlgoSz, output + idx);
9244             idx += 2;
9245             for (i = 0; i < ssl->suites->hashSigAlgoSz; i++, idx++) {
9246                 output[idx] = ssl->suites->hashSigAlgo[i];
9247             }
9248         }
9249 #endif
9250
9251         if (ssl->keys.encryptionOn) {
9252             byte* input;
9253             int   inputSz = idx - RECORD_HEADER_SZ; /* build msg adds rec hdr */
9254
9255             input = (byte*)XMALLOC(inputSz, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
9256             if (input == NULL)
9257                 return MEMORY_E;
9258
9259             XMEMCPY(input, output + RECORD_HEADER_SZ, inputSz);
9260             sendSz = BuildMessage(ssl, output, sendSz, input,inputSz,handshake);
9261             XFREE(input, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
9262
9263             if (sendSz < 0)
9264                 return sendSz;
9265         } else {
9266             ret = HashOutput(ssl, output, sendSz, 0);
9267             if (ret != 0)
9268                 return ret;
9269         }
9270
9271         #ifdef WOLFSSL_DTLS
9272             if (ssl->options.dtls) {
9273                 if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
9274                     return ret;
9275             }
9276         #endif
9277
9278         ssl->options.clientState = CLIENT_HELLO_COMPLETE;
9279
9280 #ifdef WOLFSSL_CALLBACKS
9281         if (ssl->hsInfoOn) AddPacketName("ClientHello", &ssl->handShakeInfo);
9282         if (ssl->toInfoOn)
9283             AddPacketInfo("ClientHello", &ssl->timeoutInfo, output, sendSz,
9284                           ssl->heap);
9285 #endif
9286
9287         ssl->buffers.outputBuffer.length += sendSz;
9288
9289         return SendBuffered(ssl);
9290     }
9291
9292
9293     static int DoHelloVerifyRequest(WOLFSSL* ssl, const byte* input,
9294                                     word32* inOutIdx, word32 size)
9295     {
9296         ProtocolVersion pv;
9297         byte            cookieSz;
9298         word32          begin = *inOutIdx;
9299
9300 #ifdef WOLFSSL_CALLBACKS
9301         if (ssl->hsInfoOn) AddPacketName("HelloVerifyRequest",
9302                                          &ssl->handShakeInfo);
9303         if (ssl->toInfoOn) AddLateName("HelloVerifyRequest", &ssl->timeoutInfo);
9304 #endif
9305
9306 #ifdef WOLFSSL_DTLS
9307         if (ssl->options.dtls) {
9308             DtlsPoolReset(ssl);
9309         }
9310 #endif
9311
9312         if ((*inOutIdx - begin) + OPAQUE16_LEN + OPAQUE8_LEN > size)
9313             return BUFFER_ERROR;
9314
9315         XMEMCPY(&pv, input + *inOutIdx, OPAQUE16_LEN);
9316         *inOutIdx += OPAQUE16_LEN;
9317
9318         cookieSz = input[(*inOutIdx)++];
9319
9320         if (cookieSz) {
9321             if ((*inOutIdx - begin) + cookieSz > size)
9322                 return BUFFER_ERROR;
9323
9324 #ifdef WOLFSSL_DTLS
9325             if (cookieSz <= MAX_COOKIE_LEN) {
9326                 XMEMCPY(ssl->arrays->cookie, input + *inOutIdx, cookieSz);
9327                 ssl->arrays->cookieSz = cookieSz;
9328             }
9329 #endif
9330             *inOutIdx += cookieSz;
9331         }
9332
9333         ssl->options.serverState = SERVER_HELLOVERIFYREQUEST_COMPLETE;
9334         return 0;
9335     }
9336
9337
9338     static INLINE int DSH_CheckSessionId(WOLFSSL* ssl)
9339     {
9340         int ret = 0;
9341
9342 #ifdef HAVE_SECRET_CALLBACK
9343         /* If a session secret callback exists, we are using that
9344          * key instead of the saved session key. */
9345         ret = ret || (ssl->sessionSecretCb != NULL);
9346 #endif
9347
9348 #ifdef HAVE_SESSION_TICKET
9349         /* server may send blank ticket which may not be expected to indicate
9350          * exisiting one ok but will also be sending a new one */
9351         ret = ret || (ssl->session.ticketLen > 0);
9352 #endif
9353
9354         ret = ret ||
9355               (ssl->options.haveSessionId && XMEMCMP(ssl->arrays->sessionID,
9356                                           ssl->session.sessionID, ID_LEN) == 0);
9357
9358         return ret;
9359     }
9360
9361     static int DoServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
9362                              word32 helloSz)
9363     {
9364         byte            cs0;   /* cipher suite bytes 0, 1 */
9365         byte            cs1;
9366         ProtocolVersion pv;
9367         byte            compression;
9368         word32          i = *inOutIdx;
9369         word32          begin = i;
9370
9371 #ifdef WOLFSSL_CALLBACKS
9372         if (ssl->hsInfoOn) AddPacketName("ServerHello", &ssl->handShakeInfo);
9373         if (ssl->toInfoOn) AddLateName("ServerHello", &ssl->timeoutInfo);
9374 #endif
9375
9376         /* protocol version, random and session id length check */
9377         if (OPAQUE16_LEN + RAN_LEN + OPAQUE8_LEN > helloSz)
9378             return BUFFER_ERROR;
9379
9380         /* protocol version */
9381         XMEMCPY(&pv, input + i, OPAQUE16_LEN);
9382         i += OPAQUE16_LEN;
9383
9384         if (pv.minor > ssl->version.minor) {
9385             WOLFSSL_MSG("Server using higher version, fatal error");
9386             return VERSION_ERROR;
9387         }
9388         else if (pv.minor < ssl->version.minor) {
9389             WOLFSSL_MSG("server using lower version");
9390
9391             if (!ssl->options.downgrade) {
9392                 WOLFSSL_MSG("    no downgrade allowed, fatal error");
9393                 return VERSION_ERROR;
9394             }
9395             if (pv.minor < ssl->options.minDowngrade) {
9396                 WOLFSSL_MSG("    version below minimum allowed, fatal error");
9397                 return VERSION_ERROR;
9398             }
9399
9400             #ifdef HAVE_SECURE_RENEGOTIATION
9401                 if (ssl->secure_renegotiation &&
9402                                          ssl->secure_renegotiation->enabled &&
9403                                          ssl->options.handShakeDone) {
9404                     WOLFSSL_MSG("Server changed version during scr");
9405                     return VERSION_ERROR;
9406                 }
9407             #endif
9408
9409             if (pv.minor == SSLv3_MINOR) {
9410                 /* turn off tls */
9411                 WOLFSSL_MSG("    downgrading to SSLv3");
9412                 ssl->options.tls    = 0;
9413                 ssl->options.tls1_1 = 0;
9414                 ssl->version.minor  = SSLv3_MINOR;
9415             }
9416             else if (pv.minor == TLSv1_MINOR) {
9417                 /* turn off tls 1.1+ */
9418                 WOLFSSL_MSG("    downgrading to TLSv1");
9419                 ssl->options.tls1_1 = 0;
9420                 ssl->version.minor  = TLSv1_MINOR;
9421             }
9422             else if (pv.minor == TLSv1_1_MINOR) {
9423                 WOLFSSL_MSG("    downgrading to TLSv1.1");
9424                 ssl->version.minor  = TLSv1_1_MINOR;
9425             }
9426         }
9427
9428         /* random */
9429         XMEMCPY(ssl->arrays->serverRandom, input + i, RAN_LEN);
9430         i += RAN_LEN;
9431
9432         /* session id */
9433         ssl->arrays->sessionIDSz = input[i++];
9434
9435         if (ssl->arrays->sessionIDSz > ID_LEN) {
9436             WOLFSSL_MSG("Invalid session ID size");
9437             ssl->arrays->sessionIDSz = 0;
9438             return BUFFER_ERROR;
9439         }
9440         else if (ssl->arrays->sessionIDSz) {
9441             if ((i - begin) + ssl->arrays->sessionIDSz > helloSz)
9442                 return BUFFER_ERROR;
9443
9444             XMEMCPY(ssl->arrays->sessionID, input + i,
9445                                                       ssl->arrays->sessionIDSz);
9446             i += ssl->arrays->sessionIDSz;
9447             ssl->options.haveSessionId = 1;
9448         }
9449
9450
9451         /* suite and compression */
9452         if ((i - begin) + OPAQUE16_LEN + OPAQUE8_LEN > helloSz)
9453             return BUFFER_ERROR;
9454
9455         cs0 = input[i++];
9456         cs1 = input[i++];
9457
9458 #ifdef HAVE_SECURE_RENEGOTIATION
9459         if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled &&
9460                                          ssl->options.handShakeDone) {
9461             if (ssl->options.cipherSuite0 != cs0 ||
9462                 ssl->options.cipherSuite  != cs1) {
9463                 WOLFSSL_MSG("Server changed cipher suite during scr");
9464                 return MATCH_SUITE_ERROR;
9465             }
9466         }
9467 #endif
9468
9469         ssl->options.cipherSuite0 = cs0;
9470         ssl->options.cipherSuite  = cs1;
9471         compression = input[i++];
9472
9473         if (compression != ZLIB_COMPRESSION && ssl->options.usingCompression) {
9474             WOLFSSL_MSG("Server refused compression, turning off");
9475             ssl->options.usingCompression = 0;  /* turn off if server refused */
9476         }
9477
9478         *inOutIdx = i;
9479
9480         /* tls extensions */
9481         if ( (i - begin) < helloSz) {
9482 #ifdef HAVE_TLS_EXTENSIONS
9483             if (TLSX_SupportExtensions(ssl)) {
9484                 int    ret = 0;
9485                 word16 totalExtSz;
9486
9487                 if ((i - begin) + OPAQUE16_LEN > helloSz)
9488                     return BUFFER_ERROR;
9489
9490                 ato16(&input[i], &totalExtSz);
9491                 i += OPAQUE16_LEN;
9492
9493                 if ((i - begin) + totalExtSz > helloSz)
9494                     return BUFFER_ERROR;
9495
9496                 if ((ret = TLSX_Parse(ssl, (byte *) input + i,
9497                                                           totalExtSz, 0, NULL)))
9498                     return ret;
9499
9500                 i += totalExtSz;
9501                 *inOutIdx = i;
9502             }
9503             else
9504 #endif
9505                 *inOutIdx = begin + helloSz; /* skip extensions */
9506         }
9507
9508         ssl->options.serverState = SERVER_HELLO_COMPLETE;
9509
9510         if (ssl->keys.encryptionOn) {
9511             *inOutIdx += ssl->keys.padSz;
9512         }
9513
9514 #ifdef HAVE_SECRET_CALLBACK
9515         if (ssl->sessionSecretCb != NULL) {
9516             int secretSz = SECRET_LEN, ret;
9517             ret = ssl->sessionSecretCb(ssl, ssl->session.masterSecret,
9518                                               &secretSz, ssl->sessionSecretCtx);
9519             if (ret != 0 || secretSz != SECRET_LEN)
9520                 return SESSION_SECRET_CB_E;
9521         }
9522 #endif /* HAVE_SECRET_CALLBACK */
9523
9524         if (ssl->options.resuming) {
9525             if (DSH_CheckSessionId(ssl)) {
9526                 if (SetCipherSpecs(ssl) == 0) {
9527                     int ret = -1;
9528
9529                     XMEMCPY(ssl->arrays->masterSecret,
9530                             ssl->session.masterSecret, SECRET_LEN);
9531                     #ifdef NO_OLD_TLS
9532                         ret = DeriveTlsKeys(ssl);
9533                     #else
9534                         #ifndef NO_TLS
9535                             if (ssl->options.tls)
9536                                 ret = DeriveTlsKeys(ssl);
9537                         #endif
9538                             if (!ssl->options.tls)
9539                                 ret = DeriveKeys(ssl);
9540                     #endif
9541                     ssl->options.serverState = SERVER_HELLODONE_COMPLETE;
9542
9543                     return ret;
9544                 }
9545                 else {
9546                     WOLFSSL_MSG("Unsupported cipher suite, DoServerHello");
9547                     return UNSUPPORTED_SUITE;
9548                 }
9549             }
9550             else {
9551                 WOLFSSL_MSG("Server denied resumption attempt");
9552                 ssl->options.resuming = 0; /* server denied resumption try */
9553             }
9554         }
9555         #ifdef WOLFSSL_DTLS
9556             if (ssl->options.dtls) {
9557                 DtlsPoolReset(ssl);
9558             }
9559         #endif
9560
9561         return SetCipherSpecs(ssl);
9562     }
9563
9564
9565     /* Make sure client setup is valid for this suite, true on success */
9566     int VerifyClientSuite(WOLFSSL* ssl)
9567     {
9568         int  havePSK = 0;
9569         byte first   = ssl->options.cipherSuite0;
9570         byte second  = ssl->options.cipherSuite;
9571
9572         WOLFSSL_ENTER("VerifyClientSuite");
9573
9574         #ifndef NO_PSK
9575             havePSK = ssl->options.havePSK;
9576         #endif
9577
9578         if (CipherRequires(first, second, REQUIRES_PSK)) {
9579             WOLFSSL_MSG("Requires PSK");
9580             if (havePSK == 0) {
9581                 WOLFSSL_MSG("Don't have PSK");
9582                 return 0;
9583             }
9584         }
9585
9586         return 1;  /* success */
9587     }
9588
9589
9590 #ifndef NO_CERTS
9591     /* just read in and ignore for now TODO: */
9592     static int DoCertificateRequest(WOLFSSL* ssl, const byte* input, word32*
9593                                     inOutIdx, word32 size)
9594     {
9595         word16 len;
9596         word32 begin = *inOutIdx;
9597
9598         #ifdef WOLFSSL_CALLBACKS
9599             if (ssl->hsInfoOn)
9600                 AddPacketName("CertificateRequest", &ssl->handShakeInfo);
9601             if (ssl->toInfoOn)
9602                 AddLateName("CertificateRequest", &ssl->timeoutInfo);
9603         #endif
9604
9605         if ((*inOutIdx - begin) + OPAQUE8_LEN > size)
9606             return BUFFER_ERROR;
9607
9608         len = input[(*inOutIdx)++];
9609
9610         if ((*inOutIdx - begin) + len > size)
9611             return BUFFER_ERROR;
9612
9613         /* types, read in here */
9614         *inOutIdx += len;
9615
9616         /* signature and hash signature algorithm */
9617         if (IsAtLeastTLSv1_2(ssl)) {
9618             if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9619                 return BUFFER_ERROR;
9620
9621             ato16(input + *inOutIdx, &len);
9622             *inOutIdx += OPAQUE16_LEN;
9623
9624             if ((*inOutIdx - begin) + len > size)
9625                 return BUFFER_ERROR;
9626
9627             PickHashSigAlgo(ssl, input + *inOutIdx, len);
9628             *inOutIdx += len;
9629         }
9630
9631         /* authorities */
9632         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9633             return BUFFER_ERROR;
9634
9635         ato16(input + *inOutIdx, &len);
9636         *inOutIdx += OPAQUE16_LEN;
9637
9638         if ((*inOutIdx - begin) + len > size)
9639             return BUFFER_ERROR;
9640
9641         while (len) {
9642             word16 dnSz;
9643
9644             if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9645                 return BUFFER_ERROR;
9646
9647             ato16(input + *inOutIdx, &dnSz);
9648             *inOutIdx += OPAQUE16_LEN;
9649
9650             if ((*inOutIdx - begin) + dnSz > size)
9651                 return BUFFER_ERROR;
9652
9653             *inOutIdx += dnSz;
9654             len -= OPAQUE16_LEN + dnSz;
9655         }
9656
9657         /* don't send client cert or cert verify if user hasn't provided
9658            cert and private key */
9659         if (ssl->buffers.certificate.buffer && ssl->buffers.key.buffer)
9660             ssl->options.sendVerify = SEND_CERT;
9661         else if (IsTLS(ssl))
9662             ssl->options.sendVerify = SEND_BLANK_CERT;
9663
9664         if (ssl->keys.encryptionOn)
9665             *inOutIdx += ssl->keys.padSz;
9666
9667         return 0;
9668     }
9669 #endif /* !NO_CERTS */
9670
9671
9672 #ifdef HAVE_ECC
9673
9674     static int CheckCurveId(int oid)
9675     {
9676         int ret = 0;
9677
9678         switch (oid) {
9679 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC160)
9680             case WOLFSSL_ECC_SECP160R1:
9681 #endif
9682 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC192)
9683             case WOLFSSL_ECC_SECP192R1:
9684 #endif
9685 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC224)
9686             case WOLFSSL_ECC_SECP224R1:
9687 #endif
9688 #if defined(HAVE_ALL_CURVES) || !defined(NO_ECC256)
9689             case WOLFSSL_ECC_SECP256R1:
9690 #endif
9691 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC384)
9692             case WOLFSSL_ECC_SECP384R1:
9693 #endif
9694 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC521)
9695             case WOLFSSL_ECC_SECP521R1:
9696 #endif
9697                 break;
9698
9699             default:
9700                 ret = -1;
9701         }
9702
9703         return ret;
9704     }
9705
9706 #endif /* HAVE_ECC */
9707
9708     static int DoServerKeyExchange(WOLFSSL* ssl, const byte* input,
9709                                    word32* inOutIdx, word32 size)
9710     {
9711         word16 length = 0;
9712         word32 begin  = *inOutIdx;
9713         int    ret    = 0;
9714         #define ERROR_OUT(err, eLabel) do { ret = err; goto eLabel; } while(0)
9715
9716         (void)length; /* shut up compiler warnings */
9717         (void)begin;
9718         (void)ssl;
9719         (void)input;
9720         (void)size;
9721         (void)ret;
9722
9723     #ifdef WOLFSSL_CALLBACKS
9724         if (ssl->hsInfoOn)
9725             AddPacketName("ServerKeyExchange", &ssl->handShakeInfo);
9726         if (ssl->toInfoOn)
9727             AddLateName("ServerKeyExchange", &ssl->timeoutInfo);
9728     #endif
9729
9730     #ifndef NO_PSK
9731         if (ssl->specs.kea == psk_kea) {
9732
9733             if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9734                 return BUFFER_ERROR;
9735
9736             ato16(input + *inOutIdx, &length);
9737             *inOutIdx += OPAQUE16_LEN;
9738
9739             if ((*inOutIdx - begin) + length > size)
9740                 return BUFFER_ERROR;
9741
9742             XMEMCPY(ssl->arrays->server_hint, input + *inOutIdx,
9743                    min(length, MAX_PSK_ID_LEN));
9744
9745             ssl->arrays->server_hint[min(length, MAX_PSK_ID_LEN - 1)] = 0;
9746             *inOutIdx += length;
9747
9748             return 0;
9749         }
9750     #endif
9751     #ifndef NO_DH
9752         if (ssl->specs.kea == diffie_hellman_kea)
9753         {
9754         /* p */
9755         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9756             return BUFFER_ERROR;
9757
9758         ato16(input + *inOutIdx, &length);
9759         *inOutIdx += OPAQUE16_LEN;
9760
9761         if ((*inOutIdx - begin) + length > size)
9762             return BUFFER_ERROR;
9763
9764         if (length < ssl->options.minDhKeySz) {
9765             WOLFSSL_MSG("Server using a DH key that is too small");
9766             SendAlert(ssl, alert_fatal, handshake_failure);
9767             return DH_KEY_SIZE_E;
9768         }
9769
9770         ssl->buffers.serverDH_P.buffer = (byte*) XMALLOC(length, ssl->heap,
9771                                                          DYNAMIC_TYPE_DH);
9772
9773         if (ssl->buffers.serverDH_P.buffer)
9774             ssl->buffers.serverDH_P.length = length;
9775         else
9776             return MEMORY_ERROR;
9777
9778         XMEMCPY(ssl->buffers.serverDH_P.buffer, input + *inOutIdx, length);
9779         *inOutIdx += length;
9780
9781         ssl->options.dhKeySz = length;
9782
9783         /* g */
9784         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9785             return BUFFER_ERROR;
9786
9787         ato16(input + *inOutIdx, &length);
9788         *inOutIdx += OPAQUE16_LEN;
9789
9790         if ((*inOutIdx - begin) + length > size)
9791             return BUFFER_ERROR;
9792
9793         ssl->buffers.serverDH_G.buffer = (byte*) XMALLOC(length, ssl->heap,
9794                                                          DYNAMIC_TYPE_DH);
9795
9796         if (ssl->buffers.serverDH_G.buffer)
9797             ssl->buffers.serverDH_G.length = length;
9798         else
9799             return MEMORY_ERROR;
9800
9801         XMEMCPY(ssl->buffers.serverDH_G.buffer, input + *inOutIdx, length);
9802         *inOutIdx += length;
9803
9804         /* pub */
9805         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9806             return BUFFER_ERROR;
9807
9808         ato16(input + *inOutIdx, &length);
9809         *inOutIdx += OPAQUE16_LEN;
9810
9811         if ((*inOutIdx - begin) + length > size)
9812             return BUFFER_ERROR;
9813
9814         ssl->buffers.serverDH_Pub.buffer = (byte*) XMALLOC(length, ssl->heap,
9815                                                            DYNAMIC_TYPE_DH);
9816
9817         if (ssl->buffers.serverDH_Pub.buffer)
9818             ssl->buffers.serverDH_Pub.length = length;
9819         else
9820             return MEMORY_ERROR;
9821
9822         XMEMCPY(ssl->buffers.serverDH_Pub.buffer, input + *inOutIdx, length);
9823         *inOutIdx += length;
9824         }  /* dh_kea */
9825     #endif /* NO_DH */
9826
9827     #ifdef HAVE_ECC
9828         if (ssl->specs.kea == ecc_diffie_hellman_kea)
9829         {
9830         byte b;
9831
9832         if ((*inOutIdx - begin) + ENUM_LEN + OPAQUE16_LEN + OPAQUE8_LEN > size)
9833             return BUFFER_ERROR;
9834
9835         b = input[(*inOutIdx)++];
9836
9837         if (b != named_curve)
9838             return ECC_CURVETYPE_ERROR;
9839
9840         *inOutIdx += 1;   /* curve type, eat leading 0 */
9841         b = input[(*inOutIdx)++];
9842
9843         if (CheckCurveId(b) != 0) {
9844             return ECC_CURVE_ERROR;
9845         }
9846
9847         length = input[(*inOutIdx)++];
9848
9849         if ((*inOutIdx - begin) + length > size)
9850             return BUFFER_ERROR;
9851
9852         if (ssl->peerEccKey == NULL) {
9853             /* alloc/init on demand */
9854             ssl->peerEccKey = (ecc_key*)XMALLOC(sizeof(ecc_key),
9855                                               ssl->ctx->heap, DYNAMIC_TYPE_ECC);
9856             if (ssl->peerEccKey == NULL) {
9857                 WOLFSSL_MSG("PeerEccKey Memory error");
9858                 return MEMORY_E;
9859             }
9860             wc_ecc_init(ssl->peerEccKey);
9861         } else if (ssl->peerEccKeyPresent) {  /* don't leak on reuse */
9862             wc_ecc_free(ssl->peerEccKey);
9863             ssl->peerEccKeyPresent = 0;
9864             wc_ecc_init(ssl->peerEccKey);
9865         }
9866
9867         if (wc_ecc_import_x963(input + *inOutIdx, length, ssl->peerEccKey) != 0)
9868             return ECC_PEERKEY_ERROR;
9869
9870         *inOutIdx += length;
9871         ssl->peerEccKeyPresent = 1;
9872         }
9873     #endif /* HAVE_ECC */
9874
9875     #if !defined(NO_DH) && !defined(NO_PSK)
9876     if (ssl->specs.kea == dhe_psk_kea) {
9877         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9878             return BUFFER_ERROR;
9879
9880         ato16(input + *inOutIdx, &length);
9881         *inOutIdx += OPAQUE16_LEN;
9882
9883         if ((*inOutIdx - begin) + length > size)
9884             return BUFFER_ERROR;
9885
9886         XMEMCPY(ssl->arrays->server_hint, input + *inOutIdx,
9887                min(length, MAX_PSK_ID_LEN));
9888
9889         ssl->arrays->server_hint[min(length, MAX_PSK_ID_LEN - 1)] = 0;
9890         *inOutIdx += length;
9891
9892         /* p */
9893         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9894             return BUFFER_ERROR;
9895
9896         ato16(input + *inOutIdx, &length);
9897         *inOutIdx += OPAQUE16_LEN;
9898
9899         if ((*inOutIdx - begin) + length > size)
9900             return BUFFER_ERROR;
9901
9902         if (length < ssl->options.minDhKeySz) {
9903             WOLFSSL_MSG("Server using a DH key that is too small");
9904             SendAlert(ssl, alert_fatal, handshake_failure);
9905             return DH_KEY_SIZE_E;
9906         }
9907
9908         ssl->buffers.serverDH_P.buffer = (byte*) XMALLOC(length, ssl->heap,
9909                                                          DYNAMIC_TYPE_DH);
9910
9911         if (ssl->buffers.serverDH_P.buffer)
9912             ssl->buffers.serverDH_P.length = length;
9913         else
9914             return MEMORY_ERROR;
9915
9916         XMEMCPY(ssl->buffers.serverDH_P.buffer, input + *inOutIdx, length);
9917         *inOutIdx += length;
9918
9919         ssl->options.dhKeySz = length;
9920
9921         /* g */
9922         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9923             return BUFFER_ERROR;
9924
9925         ato16(input + *inOutIdx, &length);
9926         *inOutIdx += OPAQUE16_LEN;
9927
9928         if ((*inOutIdx - begin) + length > size)
9929             return BUFFER_ERROR;
9930
9931         ssl->buffers.serverDH_G.buffer = (byte*) XMALLOC(length, ssl->heap,
9932                                                          DYNAMIC_TYPE_DH);
9933
9934         if (ssl->buffers.serverDH_G.buffer)
9935             ssl->buffers.serverDH_G.length = length;
9936         else
9937             return MEMORY_ERROR;
9938
9939         XMEMCPY(ssl->buffers.serverDH_G.buffer, input + *inOutIdx, length);
9940         *inOutIdx += length;
9941
9942         /* pub */
9943         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
9944             return BUFFER_ERROR;
9945
9946         ato16(input + *inOutIdx, &length);
9947         *inOutIdx += OPAQUE16_LEN;
9948
9949         if ((*inOutIdx - begin) + length > size)
9950             return BUFFER_ERROR;
9951
9952         ssl->buffers.serverDH_Pub.buffer = (byte*) XMALLOC(length, ssl->heap,
9953                                                            DYNAMIC_TYPE_DH);
9954
9955         if (ssl->buffers.serverDH_Pub.buffer)
9956             ssl->buffers.serverDH_Pub.length = length;
9957         else
9958             return MEMORY_ERROR;
9959
9960         XMEMCPY(ssl->buffers.serverDH_Pub.buffer, input + *inOutIdx, length);
9961         *inOutIdx += length;
9962     }
9963     #endif /* !NO_DH || !NO_PSK */
9964
9965     #if !defined(NO_DH) || defined(HAVE_ECC)
9966     if (!ssl->options.usingAnon_cipher &&
9967         (ssl->specs.kea == ecc_diffie_hellman_kea ||
9968          ssl->specs.kea == diffie_hellman_kea))
9969     {
9970 #ifndef NO_OLD_TLS
9971 #ifdef WOLFSSL_SMALL_STACK
9972         Md5*    md5 = NULL;
9973         Sha*    sha = NULL;
9974 #else
9975         Md5     md5[1];
9976         Sha     sha[1];
9977 #endif
9978 #endif
9979 #ifndef NO_SHA256
9980 #ifdef WOLFSSL_SMALL_STACK
9981         Sha256* sha256  = NULL;
9982         byte*   hash256 = NULL;
9983 #else
9984         Sha256  sha256[1];
9985         byte    hash256[SHA256_DIGEST_SIZE];
9986 #endif
9987 #endif
9988 #ifdef WOLFSSL_SHA384
9989 #ifdef WOLFSSL_SMALL_STACK
9990         Sha384* sha384  = NULL;
9991         byte*   hash384 = NULL;
9992 #else
9993         Sha384  sha384[1];
9994         byte    hash384[SHA384_DIGEST_SIZE];
9995 #endif
9996 #endif
9997 #ifdef WOLFSSL_SHA512
9998 #ifdef WOLFSSL_SMALL_STACK
9999         Sha512* sha512  = NULL;
10000         byte*   hash512 = NULL;
10001 #else
10002         Sha512  sha512[1];
10003         byte    hash512[SHA512_DIGEST_SIZE];
10004 #endif
10005 #endif
10006 #ifdef WOLFSSL_SMALL_STACK
10007         byte*   hash          = NULL;
10008         byte*   messageVerify = NULL;
10009 #else
10010         byte    hash[FINISHED_SZ];
10011         byte    messageVerify[MAX_DH_SZ];
10012 #endif
10013         byte    hashAlgo = sha_mac;
10014         byte    sigAlgo  = ssl->specs.sig_algo;
10015         word16  verifySz = (word16) (*inOutIdx - begin);
10016
10017 #ifndef NO_OLD_TLS
10018         byte doMd5 = 0;
10019         byte doSha = 0;
10020 #endif
10021 #ifndef NO_SHA256
10022         byte doSha256 = 0;
10023 #endif
10024 #ifdef WOLFSSL_SHA384
10025         byte doSha384 = 0;
10026 #endif
10027 #ifdef WOLFSSL_SHA512
10028         byte doSha512 = 0;
10029 #endif
10030
10031         (void)hash;
10032         (void)sigAlgo;
10033         (void)hashAlgo;
10034
10035         /* save message for hash verify */
10036         if (verifySz > MAX_DH_SZ)
10037             ERROR_OUT(BUFFER_ERROR, done);
10038
10039     #ifdef WOLFSSL_SMALL_STACK
10040         messageVerify = (byte*)XMALLOC(MAX_DH_SZ, NULL,
10041                                                        DYNAMIC_TYPE_TMP_BUFFER);
10042         if (messageVerify == NULL)
10043             ERROR_OUT(MEMORY_E, done);
10044     #endif
10045
10046         XMEMCPY(messageVerify, input + begin, verifySz);
10047
10048         if (IsAtLeastTLSv1_2(ssl)) {
10049             byte setHash = 0;
10050             if ((*inOutIdx - begin) + ENUM_LEN + ENUM_LEN > size)
10051                 ERROR_OUT(BUFFER_ERROR, done);
10052
10053             hashAlgo = input[(*inOutIdx)++];
10054             sigAlgo  = input[(*inOutIdx)++];
10055
10056             switch (hashAlgo) {
10057                 case sha512_mac:
10058                     #ifdef WOLFSSL_SHA512
10059                         doSha512 = 1;
10060                         setHash  = 1;
10061                     #endif
10062                     break;
10063
10064                 case sha384_mac:
10065                     #ifdef WOLFSSL_SHA384
10066                         doSha384 = 1;
10067                         setHash  = 1;
10068                     #endif
10069                     break;
10070
10071                 case sha256_mac:
10072                     #ifndef NO_SHA256
10073                         doSha256 = 1;
10074                         setHash  = 1;
10075                     #endif
10076                     break;
10077
10078                 case sha_mac:
10079                     #ifndef NO_OLD_TLS
10080                         doSha = 1;
10081                         setHash  = 1;
10082                     #endif
10083                     break;
10084
10085                 default:
10086                     ERROR_OUT(ALGO_ID_E, done);
10087             }
10088
10089             if (setHash == 0) {
10090                 ERROR_OUT(ALGO_ID_E, done);
10091             }
10092
10093         } else {
10094             /* only using sha and md5 for rsa */
10095             #ifndef NO_OLD_TLS
10096                 doSha = 1;
10097                 if (sigAlgo == rsa_sa_algo) {
10098                     doMd5 = 1;
10099                 }
10100             #else
10101                 ERROR_OUT(ALGO_ID_E, done);
10102             #endif
10103         }
10104
10105         /* signature */
10106         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
10107             ERROR_OUT(BUFFER_ERROR, done);
10108
10109         ato16(input + *inOutIdx, &length);
10110         *inOutIdx += OPAQUE16_LEN;
10111
10112         if ((*inOutIdx - begin) + length > size)
10113             ERROR_OUT(BUFFER_ERROR, done);
10114
10115         /* inOutIdx updated at the end of the function */
10116
10117         /* verify signature */
10118     #ifdef WOLFSSL_SMALL_STACK
10119         hash = (byte*)XMALLOC(FINISHED_SZ, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10120         if (hash == NULL)
10121             ERROR_OUT(MEMORY_E, done);
10122     #endif
10123
10124 #ifndef NO_OLD_TLS
10125         /* md5 */
10126     #ifdef WOLFSSL_SMALL_STACK
10127         if (doMd5) {
10128             md5 = (Md5*)XMALLOC(sizeof(Md5), NULL, DYNAMIC_TYPE_TMP_BUFFER);
10129             if (md5 == NULL)
10130                 ERROR_OUT(MEMORY_E, done);
10131         }
10132     #endif
10133         if (doMd5) {
10134             wc_InitMd5(md5);
10135             wc_Md5Update(md5, ssl->arrays->clientRandom, RAN_LEN);
10136             wc_Md5Update(md5, ssl->arrays->serverRandom, RAN_LEN);
10137             wc_Md5Update(md5, messageVerify, verifySz);
10138             wc_Md5Final(md5, hash);
10139         }
10140         /* sha */
10141     #ifdef WOLFSSL_SMALL_STACK
10142         if (doSha) {
10143             sha = (Sha*)XMALLOC(sizeof(Sha), NULL, DYNAMIC_TYPE_TMP_BUFFER);
10144             if (sha == NULL)
10145                 ERROR_OUT(MEMORY_E, done);
10146         }
10147     #endif
10148         if (doSha) {
10149             ret = wc_InitSha(sha);
10150             if (ret != 0) goto done;
10151             wc_ShaUpdate(sha, ssl->arrays->clientRandom, RAN_LEN);
10152             wc_ShaUpdate(sha, ssl->arrays->serverRandom, RAN_LEN);
10153             wc_ShaUpdate(sha, messageVerify, verifySz);
10154             wc_ShaFinal(sha, hash + MD5_DIGEST_SIZE);
10155         }
10156 #endif
10157
10158 #ifndef NO_SHA256
10159     #ifdef WOLFSSL_SMALL_STACK
10160         if (doSha256) {
10161             sha256 = (Sha256*)XMALLOC(sizeof(Sha256), NULL,
10162                                                        DYNAMIC_TYPE_TMP_BUFFER);
10163             hash256 = (byte*)XMALLOC(SHA256_DIGEST_SIZE, NULL,
10164                                                        DYNAMIC_TYPE_TMP_BUFFER);
10165             if (sha256 == NULL || hash256 == NULL)
10166                 ERROR_OUT(MEMORY_E, done);
10167         }
10168     #endif
10169         if (doSha256) {
10170             if (!(ret = wc_InitSha256(sha256))
10171             &&  !(ret = wc_Sha256Update(sha256, ssl->arrays->clientRandom,
10172                                         RAN_LEN))
10173             &&  !(ret = wc_Sha256Update(sha256, ssl->arrays->serverRandom,
10174                                         RAN_LEN))
10175             &&  !(ret = wc_Sha256Update(sha256, messageVerify, verifySz)))
10176                   ret = wc_Sha256Final(sha256, hash256);
10177             if (ret != 0) goto done;
10178         }
10179 #endif
10180
10181 #ifdef WOLFSSL_SHA384
10182     #ifdef WOLFSSL_SMALL_STACK
10183         if (doSha384) {
10184             sha384 = (Sha384*)XMALLOC(sizeof(Sha384), NULL,
10185                                                        DYNAMIC_TYPE_TMP_BUFFER);
10186             hash384 = (byte*)XMALLOC(SHA384_DIGEST_SIZE, NULL,
10187                                                        DYNAMIC_TYPE_TMP_BUFFER);
10188             if (sha384 == NULL || hash384 == NULL)
10189                 ERROR_OUT(MEMORY_E, done);
10190         }
10191     #endif
10192         if (doSha384) {
10193             if (!(ret = wc_InitSha384(sha384))
10194             &&  !(ret = wc_Sha384Update(sha384, ssl->arrays->clientRandom,
10195                                         RAN_LEN))
10196             &&  !(ret = wc_Sha384Update(sha384, ssl->arrays->serverRandom,
10197                                         RAN_LEN))
10198             &&  !(ret = wc_Sha384Update(sha384, messageVerify, verifySz)))
10199                   ret = wc_Sha384Final(sha384, hash384);
10200             if (ret != 0) goto done;
10201         }
10202 #endif
10203
10204 #ifdef WOLFSSL_SHA512
10205     #ifdef WOLFSSL_SMALL_STACK
10206         if (doSha512) {
10207             sha512 = (Sha512*)XMALLOC(sizeof(Sha512), NULL,
10208                                                        DYNAMIC_TYPE_TMP_BUFFER);
10209             hash512 = (byte*)XMALLOC(SHA512_DIGEST_SIZE, NULL,
10210                                                        DYNAMIC_TYPE_TMP_BUFFER);
10211             if (sha512 == NULL || hash512 == NULL)
10212                 ERROR_OUT(MEMORY_E, done);
10213         }
10214     #endif
10215         if (doSha512) {
10216             if (!(ret = wc_InitSha512(sha512))
10217             &&  !(ret = wc_Sha512Update(sha512, ssl->arrays->clientRandom,
10218                                         RAN_LEN))
10219             &&  !(ret = wc_Sha512Update(sha512, ssl->arrays->serverRandom,
10220                                         RAN_LEN))
10221             &&  !(ret = wc_Sha512Update(sha512, messageVerify, verifySz)))
10222                   ret = wc_Sha512Final(sha512, hash512);
10223             if (ret != 0) goto done;
10224         }
10225 #endif
10226
10227 #ifndef NO_RSA
10228         /* rsa */
10229         if (sigAlgo == rsa_sa_algo)
10230         {
10231             byte*  out        = NULL;
10232             byte   doUserRsa  = 0;
10233             word32 verifiedSz = 0;
10234
10235             #ifdef HAVE_PK_CALLBACKS
10236                 if (ssl->ctx->RsaVerifyCb)
10237                     doUserRsa = 1;
10238             #endif /*HAVE_PK_CALLBACKS */
10239
10240             if (ssl->peerRsaKey == NULL || !ssl->peerRsaKeyPresent)
10241                 ERROR_OUT(NO_PEER_KEY, done);
10242
10243             if (doUserRsa) {
10244             #ifdef HAVE_PK_CALLBACKS
10245                 verifiedSz = ssl->ctx->RsaVerifyCb(ssl,
10246                                                  (byte *)input + *inOutIdx,
10247                                                  length, &out,
10248                                                  ssl->buffers.peerRsaKey.buffer,
10249                                                  ssl->buffers.peerRsaKey.length,
10250                                                  ssl->RsaVerifyCtx);
10251             #endif /*HAVE_PK_CALLBACKS */
10252             }
10253             else
10254                 verifiedSz = wc_RsaSSL_VerifyInline((byte *)input + *inOutIdx,
10255                                                  length, &out, ssl->peerRsaKey);
10256
10257             if (IsAtLeastTLSv1_2(ssl)) {
10258                 word32 encSigSz;
10259 #ifndef NO_OLD_TLS
10260                 byte*  digest = &hash[MD5_DIGEST_SIZE];
10261                 int    typeH = SHAh;
10262                 int    digestSz = SHA_DIGEST_SIZE;
10263 #else
10264                 byte*  digest = hash256;
10265                 int    typeH =  SHA256h;
10266                 int    digestSz = SHA256_DIGEST_SIZE;
10267 #endif
10268 #ifdef WOLFSSL_SMALL_STACK
10269                 byte*  encodedSig = NULL;
10270 #else
10271                 byte   encodedSig[MAX_ENCODED_SIG_SZ];
10272 #endif
10273
10274                 if (hashAlgo == sha_mac) {
10275                     #ifndef NO_SHA
10276                         digest   = &hash[MD5_DIGEST_SIZE];
10277                         typeH    = SHAh;
10278                         digestSz = SHA_DIGEST_SIZE;
10279                     #endif
10280                 }
10281                 else if (hashAlgo == sha256_mac) {
10282                     #ifndef NO_SHA256
10283                         digest   = hash256;
10284                         typeH    = SHA256h;
10285                         digestSz = SHA256_DIGEST_SIZE;
10286                     #endif
10287                 }
10288                 else if (hashAlgo == sha384_mac) {
10289                     #ifdef WOLFSSL_SHA384
10290                         digest   = hash384;
10291                         typeH    = SHA384h;
10292                         digestSz = SHA384_DIGEST_SIZE;
10293                     #endif
10294                 }
10295                 else if (hashAlgo == sha512_mac) {
10296                     #ifdef WOLFSSL_SHA512
10297                         digest   = hash512;
10298                         typeH    = SHA512h;
10299                         digestSz = SHA512_DIGEST_SIZE;
10300                     #endif
10301                 }
10302
10303             #ifdef WOLFSSL_SMALL_STACK
10304                 encodedSig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ, NULL,
10305                                                        DYNAMIC_TYPE_TMP_BUFFER);
10306                 if (encodedSig == NULL)
10307                     ERROR_OUT(MEMORY_E, done);
10308             #endif
10309
10310                 if (digest == NULL)
10311                     ERROR_OUT(ALGO_ID_E, done);
10312                 encSigSz = wc_EncodeSignature(encodedSig, digest, digestSz,
10313                                               typeH);
10314                 if (encSigSz != verifiedSz || !out || XMEMCMP(out, encodedSig,
10315                                         min(encSigSz, MAX_ENCODED_SIG_SZ)) != 0)
10316                     ret = VERIFY_SIGN_ERROR;
10317
10318             #ifdef WOLFSSL_SMALL_STACK
10319                 XFREE(encodedSig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10320             #endif
10321                 if (ret != 0)
10322                     goto done;
10323             }
10324             else if (verifiedSz != FINISHED_SZ || !out || XMEMCMP(out,
10325                                                         hash, FINISHED_SZ) != 0)
10326                 ERROR_OUT(VERIFY_SIGN_ERROR, done);
10327         } else
10328 #endif
10329 #ifdef HAVE_ECC
10330         /* ecdsa */
10331         if (sigAlgo == ecc_dsa_sa_algo) {
10332             int verify = 0;
10333 #ifndef NO_OLD_TLS
10334             byte* digest = &hash[MD5_DIGEST_SIZE];
10335             word32 digestSz = SHA_DIGEST_SIZE;
10336 #else
10337             byte* digest = hash256;
10338             word32 digestSz = SHA256_DIGEST_SIZE;
10339 #endif
10340             byte doUserEcc = 0;
10341
10342             #ifdef HAVE_PK_CALLBACKS
10343                 if (ssl->ctx->EccVerifyCb)
10344                     doUserEcc = 1;
10345             #endif
10346
10347             if (!ssl->peerEccDsaKeyPresent)
10348                 ERROR_OUT(NO_PEER_KEY, done);
10349
10350             if (IsAtLeastTLSv1_2(ssl)) {
10351                 if (hashAlgo == sha_mac) {
10352                     #ifndef NO_SHA
10353                         digest   = &hash[MD5_DIGEST_SIZE];
10354                         digestSz = SHA_DIGEST_SIZE;
10355                     #endif
10356                 }
10357                 else if (hashAlgo == sha256_mac) {
10358                     #ifndef NO_SHA256
10359                         digest   = hash256;
10360                         digestSz = SHA256_DIGEST_SIZE;
10361                     #endif
10362                 }
10363                 else if (hashAlgo == sha384_mac) {
10364                     #ifdef WOLFSSL_SHA384
10365                         digest   = hash384;
10366                         digestSz = SHA384_DIGEST_SIZE;
10367                     #endif
10368                 }
10369                 else if (hashAlgo == sha512_mac) {
10370                     #ifdef WOLFSSL_SHA512
10371                         digest   = hash512;
10372                         digestSz = SHA512_DIGEST_SIZE;
10373                     #endif
10374                 }
10375             }
10376             if (doUserEcc) {
10377             #ifdef HAVE_PK_CALLBACKS
10378                 ret = ssl->ctx->EccVerifyCb(ssl, input + *inOutIdx, length,
10379                                             digest, digestSz,
10380                                             ssl->buffers.peerEccDsaKey.buffer,
10381                                             ssl->buffers.peerEccDsaKey.length,
10382                                             &verify, ssl->EccVerifyCtx);
10383             #endif
10384             }
10385             else {
10386                 ret = wc_ecc_verify_hash(input + *inOutIdx, length,
10387                                  digest, digestSz, &verify, ssl->peerEccDsaKey);
10388             }
10389             if (ret != 0 || verify == 0)
10390                 ERROR_OUT(VERIFY_SIGN_ERROR, done);
10391         }
10392         else
10393 #endif /* HAVE_ECC */
10394             ERROR_OUT(ALGO_ID_E, done);
10395
10396         /* signature length */
10397         *inOutIdx += length;
10398
10399         ssl->options.serverState = SERVER_KEYEXCHANGE_COMPLETE;
10400
10401     done:
10402 #ifdef WOLFSSL_SMALL_STACK
10403     #ifndef NO_OLD_TLS
10404         XFREE(md5,           NULL, DYNAMIC_TYPE_TMP_BUFFER);
10405         XFREE(sha,           NULL, DYNAMIC_TYPE_TMP_BUFFER);
10406     #endif
10407     #ifndef NO_SHA256
10408         XFREE(sha256,        NULL, DYNAMIC_TYPE_TMP_BUFFER);
10409         XFREE(hash256,       NULL, DYNAMIC_TYPE_TMP_BUFFER);
10410     #endif
10411     #ifdef WOLFSSL_SHA384
10412         XFREE(sha384,        NULL, DYNAMIC_TYPE_TMP_BUFFER);
10413         XFREE(hash384,       NULL, DYNAMIC_TYPE_TMP_BUFFER);
10414     #endif
10415     #ifdef WOLFSSL_SHA512
10416         XFREE(sha512,        NULL, DYNAMIC_TYPE_TMP_BUFFER);
10417         XFREE(hash512,       NULL, DYNAMIC_TYPE_TMP_BUFFER);
10418     #endif
10419         XFREE(hash,          NULL, DYNAMIC_TYPE_TMP_BUFFER);
10420         XFREE(messageVerify, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10421 #endif
10422         if (ret != 0)
10423             return ret;
10424     }
10425
10426     if (ssl->keys.encryptionOn) {
10427         *inOutIdx += ssl->keys.padSz;
10428     }
10429
10430     return 0;
10431 #else  /* !NO_DH or HAVE_ECC */
10432         return NOT_COMPILED_IN;  /* not supported by build */
10433 #endif /* !NO_DH or HAVE_ECC */
10434
10435         #undef ERROR_OUT
10436     }
10437
10438
10439     int SendClientKeyExchange(WOLFSSL* ssl)
10440     {
10441 #ifdef WOLFSSL_SMALL_STACK
10442         byte*  encSecret = NULL;
10443 #else
10444         byte   encSecret[MAX_ENCRYPT_SZ];
10445 #endif
10446         word32 encSz = 0;
10447         word32 idx = 0;
10448         int    ret = 0;
10449         byte   doUserRsa = 0;
10450
10451         (void)doUserRsa;
10452
10453 #ifdef HAVE_PK_CALLBACKS
10454     #ifndef NO_RSA
10455         if (ssl->ctx->RsaEncCb)
10456             doUserRsa = 1;
10457     #endif /* NO_RSA */
10458 #endif /*HAVE_PK_CALLBACKS */
10459
10460     #ifdef WOLFSSL_SMALL_STACK
10461         encSecret = (byte*)XMALLOC(MAX_ENCRYPT_SZ, NULL,
10462                                                        DYNAMIC_TYPE_TMP_BUFFER);
10463         if (encSecret == NULL)
10464             return MEMORY_E;
10465     #endif
10466
10467         switch (ssl->specs.kea) {
10468         #ifndef NO_RSA
10469             case rsa_kea:
10470                 ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->preMasterSecret,
10471                                                                     SECRET_LEN);
10472                 if (ret != 0) {
10473                 #ifdef WOLFSSL_SMALL_STACK
10474                     XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10475                 #endif
10476                     return ret;
10477                 }
10478
10479                 ssl->arrays->preMasterSecret[0] = ssl->chVersion.major;
10480                 ssl->arrays->preMasterSecret[1] = ssl->chVersion.minor;
10481                 ssl->arrays->preMasterSz = SECRET_LEN;
10482
10483                 if (ssl->peerRsaKey == NULL || ssl->peerRsaKeyPresent == 0) {
10484                 #ifdef WOLFSSL_SMALL_STACK
10485                     XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10486                 #endif
10487                     return NO_PEER_KEY;
10488                 }
10489
10490                 if (doUserRsa) {
10491                 #ifdef HAVE_PK_CALLBACKS
10492                     #ifndef NO_RSA
10493                         encSz = MAX_ENCRYPT_SZ;
10494                         ret = ssl->ctx->RsaEncCb(ssl,
10495                                             ssl->arrays->preMasterSecret,
10496                                             SECRET_LEN,
10497                                             encSecret, &encSz,
10498                                             ssl->buffers.peerRsaKey.buffer,
10499                                             ssl->buffers.peerRsaKey.length,
10500                                             ssl->RsaEncCtx);
10501                     #endif /* NO_RSA */
10502                 #endif /*HAVE_PK_CALLBACKS */
10503                 }
10504                 else {
10505                     ret = wc_RsaPublicEncrypt(ssl->arrays->preMasterSecret,
10506                                  SECRET_LEN, encSecret, MAX_ENCRYPT_SZ,
10507                                  ssl->peerRsaKey, ssl->rng);
10508                     if (ret > 0) {
10509                         encSz = ret;
10510                         ret = 0;   /* set success to 0 */
10511                     }
10512                 }
10513                 break;
10514         #endif
10515         #ifndef NO_DH
10516             case diffie_hellman_kea:
10517                 {
10518                     buffer  serverP   = ssl->buffers.serverDH_P;
10519                     buffer  serverG   = ssl->buffers.serverDH_G;
10520                     buffer  serverPub = ssl->buffers.serverDH_Pub;
10521                 #ifdef WOLFSSL_SMALL_STACK
10522                     byte*   priv = NULL;
10523                 #else
10524                     byte    priv[ENCRYPT_LEN];
10525                 #endif
10526                     word32  privSz = 0;
10527                     DhKey   key;
10528
10529                     if (serverP.buffer == 0 || serverG.buffer == 0 ||
10530                                                serverPub.buffer == 0) {
10531                     #ifdef WOLFSSL_SMALL_STACK
10532                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10533                     #endif
10534                         return NO_PEER_KEY;
10535                     }
10536
10537                 #ifdef WOLFSSL_SMALL_STACK
10538                     priv = (byte*)XMALLOC(ENCRYPT_LEN, NULL,
10539                                                        DYNAMIC_TYPE_TMP_BUFFER);
10540                     if (priv == NULL) {
10541                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10542                         return MEMORY_E;
10543                     }
10544                 #endif
10545
10546                     wc_InitDhKey(&key);
10547                     ret = wc_DhSetKey(&key, serverP.buffer, serverP.length,
10548                                    serverG.buffer, serverG.length);
10549                     if (ret == 0)
10550                         /* for DH, encSecret is Yc, agree is pre-master */
10551                         ret = wc_DhGenerateKeyPair(&key, ssl->rng, priv, &privSz,
10552                                                 encSecret, &encSz);
10553                     if (ret == 0)
10554                         ret = wc_DhAgree(&key, ssl->arrays->preMasterSecret,
10555                                       &ssl->arrays->preMasterSz, priv, privSz,
10556                                       serverPub.buffer, serverPub.length);
10557                 #ifdef WOLFSSL_SMALL_STACK
10558                     XFREE(priv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10559                 #endif
10560                     wc_FreeDhKey(&key);
10561                 }
10562                 break;
10563         #endif /* NO_DH */
10564         #ifndef NO_PSK
10565             case psk_kea:
10566                 {
10567                     byte* pms = ssl->arrays->preMasterSecret;
10568
10569                     ssl->arrays->psk_keySz = ssl->options.client_psk_cb(ssl,
10570                         ssl->arrays->server_hint, ssl->arrays->client_identity,
10571                         MAX_PSK_ID_LEN, ssl->arrays->psk_key, MAX_PSK_KEY_LEN);
10572                     if (ssl->arrays->psk_keySz == 0 ||
10573                         ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN) {
10574                     #ifdef WOLFSSL_SMALL_STACK
10575                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10576                     #endif
10577                         return PSK_KEY_ERROR;
10578                     }
10579                     encSz = (word32)XSTRLEN(ssl->arrays->client_identity);
10580                     if (encSz > MAX_PSK_ID_LEN) {
10581                     #ifdef WOLFSSL_SMALL_STACK
10582                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10583                     #endif
10584                         return CLIENT_ID_ERROR;
10585                     }
10586                     XMEMCPY(encSecret, ssl->arrays->client_identity, encSz);
10587
10588                     /* make psk pre master secret */
10589                     /* length of key + length 0s + length of key + key */
10590                     c16toa((word16)ssl->arrays->psk_keySz, pms);
10591                     pms += 2;
10592                     XMEMSET(pms, 0, ssl->arrays->psk_keySz);
10593                     pms += ssl->arrays->psk_keySz;
10594                     c16toa((word16)ssl->arrays->psk_keySz, pms);
10595                     pms += 2;
10596                     XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
10597                     ssl->arrays->preMasterSz = ssl->arrays->psk_keySz * 2 + 4;
10598                     ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
10599                     ssl->arrays->psk_keySz = 0; /* No further need */
10600                 }
10601                 break;
10602         #endif /* NO_PSK */
10603         #if !defined(NO_DH) && !defined(NO_PSK)
10604             case dhe_psk_kea:
10605                 {
10606                     byte* pms = ssl->arrays->preMasterSecret;
10607                     byte* es  = encSecret;
10608                     buffer  serverP   = ssl->buffers.serverDH_P;
10609                     buffer  serverG   = ssl->buffers.serverDH_G;
10610                     buffer  serverPub = ssl->buffers.serverDH_Pub;
10611                 #ifdef WOLFSSL_SMALL_STACK
10612                     byte*   priv = NULL;
10613                 #else
10614                     byte    priv[ENCRYPT_LEN];
10615                 #endif
10616                     word32  privSz = 0;
10617                     word32  pubSz = 0;
10618                     word32  esSz = 0;
10619                     DhKey   key;
10620
10621                     if (serverP.buffer == 0 || serverG.buffer == 0 ||
10622                                                serverPub.buffer == 0) {
10623                     #ifdef WOLFSSL_SMALL_STACK
10624                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10625                     #endif
10626                         return NO_PEER_KEY;
10627                     }
10628
10629                     ssl->arrays->psk_keySz = ssl->options.client_psk_cb(ssl,
10630                          ssl->arrays->server_hint, ssl->arrays->client_identity,
10631                          MAX_PSK_ID_LEN, ssl->arrays->psk_key, MAX_PSK_KEY_LEN);
10632                     if (ssl->arrays->psk_keySz == 0 ||
10633                                      ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN) {
10634                     #ifdef WOLFSSL_SMALL_STACK
10635                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10636                     #endif
10637                         return PSK_KEY_ERROR;
10638                     }
10639                     esSz = (word32)XSTRLEN(ssl->arrays->client_identity);
10640
10641                     if (esSz > MAX_PSK_ID_LEN) {
10642                     #ifdef WOLFSSL_SMALL_STACK
10643                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10644                     #endif
10645                         return CLIENT_ID_ERROR;
10646                     }
10647
10648                 #ifdef WOLFSSL_SMALL_STACK
10649                     priv = (byte*)XMALLOC(ENCRYPT_LEN, NULL,
10650                                                        DYNAMIC_TYPE_TMP_BUFFER);
10651                     if (priv == NULL) {
10652                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10653                         return MEMORY_E;
10654                     }
10655                 #endif
10656                     c16toa((word16)esSz, es);
10657                     es += OPAQUE16_LEN;
10658                     XMEMCPY(es, ssl->arrays->client_identity, esSz);
10659                     es += esSz;
10660                     encSz = esSz + OPAQUE16_LEN;
10661
10662                     wc_InitDhKey(&key);
10663                     ret = wc_DhSetKey(&key, serverP.buffer, serverP.length,
10664                                    serverG.buffer, serverG.length);
10665                     if (ret == 0)
10666                         /* for DH, encSecret is Yc, agree is pre-master */
10667                         ret = wc_DhGenerateKeyPair(&key, ssl->rng, priv, &privSz,
10668                                                 es + OPAQUE16_LEN, &pubSz);
10669                     if (ret == 0)
10670                         ret = wc_DhAgree(&key, pms + OPAQUE16_LEN,
10671                                       &ssl->arrays->preMasterSz, priv, privSz,
10672                                       serverPub.buffer, serverPub.length);
10673                     wc_FreeDhKey(&key);
10674                 #ifdef WOLFSSL_SMALL_STACK
10675                     XFREE(priv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10676                 #endif
10677                     if (ret != 0) {
10678                     #ifdef WOLFSSL_SMALL_STACK
10679                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10680                     #endif
10681                         return ret;
10682                     }
10683
10684                     c16toa((word16)pubSz, es);
10685                     encSz += pubSz + OPAQUE16_LEN;
10686                     c16toa((word16)ssl->arrays->preMasterSz, pms);
10687                     ssl->arrays->preMasterSz += OPAQUE16_LEN;
10688                     pms += ssl->arrays->preMasterSz;
10689
10690                     /* make psk pre master secret */
10691                     /* length of key + length 0s + length of key + key */
10692                     c16toa((word16)ssl->arrays->psk_keySz, pms);
10693                     pms += OPAQUE16_LEN;
10694                     XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
10695                     ssl->arrays->preMasterSz +=
10696                                           ssl->arrays->psk_keySz + OPAQUE16_LEN;
10697                     ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
10698                     ssl->arrays->psk_keySz = 0; /* No further need */
10699                 }
10700                 break;
10701         #endif /* !NO_DH && !NO_PSK */
10702         #ifdef HAVE_NTRU
10703             case ntru_kea:
10704                 {
10705                     word32 rc;
10706                     word16 cipherLen = MAX_ENCRYPT_SZ;
10707                     DRBG_HANDLE drbg;
10708                     static uint8_t const wolfsslStr[] = {
10709                         'C', 'y', 'a', 'S', 'S', 'L', ' ', 'N', 'T', 'R', 'U'
10710                     };
10711
10712                     ret = wc_RNG_GenerateBlock(ssl->rng,
10713                                       ssl->arrays->preMasterSecret, SECRET_LEN);
10714                     if (ret != 0) {
10715                     #ifdef WOLFSSL_SMALL_STACK
10716                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10717                     #endif
10718                         return ret;
10719                     }
10720
10721                     ssl->arrays->preMasterSz = SECRET_LEN;
10722
10723                     if (ssl->peerNtruKeyPresent == 0) {
10724                     #ifdef WOLFSSL_SMALL_STACK
10725                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10726                     #endif
10727                         return NO_PEER_KEY;
10728                     }
10729
10730                     rc = ntru_crypto_drbg_instantiate(MAX_NTRU_BITS, wolfsslStr,
10731                                                  sizeof(wolfsslStr), GetEntropy,
10732                                                  &drbg);
10733                     if (rc != DRBG_OK) {
10734                     #ifdef WOLFSSL_SMALL_STACK
10735                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10736                     #endif
10737                         return NTRU_DRBG_ERROR;
10738                     }
10739
10740                     rc = ntru_crypto_ntru_encrypt(drbg, ssl->peerNtruKeyLen,
10741                                                   ssl->peerNtruKey,
10742                                                   ssl->arrays->preMasterSz,
10743                                                   ssl->arrays->preMasterSecret,
10744                                                   &cipherLen, encSecret);
10745                     ntru_crypto_drbg_uninstantiate(drbg);
10746                     if (rc != NTRU_OK) {
10747                     #ifdef WOLFSSL_SMALL_STACK
10748                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10749                     #endif
10750                         return NTRU_ENCRYPT_ERROR;
10751                     }
10752
10753                     encSz = cipherLen;
10754                     ret = 0;
10755                 }
10756                 break;
10757         #endif /* HAVE_NTRU */
10758         #ifdef HAVE_ECC
10759             case ecc_diffie_hellman_kea:
10760                 {
10761                     ecc_key  myKey;
10762                     ecc_key* peerKey = NULL;
10763                     word32   size = MAX_ENCRYPT_SZ;
10764
10765                     if (ssl->specs.static_ecdh) {
10766                         /* TODO: EccDsa is really fixed Ecc change naming */
10767                         if (!ssl->peerEccDsaKey || !ssl->peerEccDsaKeyPresent ||
10768                                                    !ssl->peerEccDsaKey->dp) {
10769                         #ifdef WOLFSSL_SMALL_STACK
10770                             XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10771                         #endif
10772                             return NO_PEER_KEY;
10773                         }
10774                         peerKey = ssl->peerEccDsaKey;
10775                     }
10776                     else {
10777                         if (!ssl->peerEccKey || !ssl->peerEccKeyPresent ||
10778                                                 !ssl->peerEccKey->dp) {
10779                         #ifdef WOLFSSL_SMALL_STACK
10780                             XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10781                         #endif
10782                             return NO_PEER_KEY;
10783                         }
10784                         peerKey = ssl->peerEccKey;
10785                     }
10786
10787                     if (peerKey == NULL) {
10788                     #ifdef WOLFSSL_SMALL_STACK
10789                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10790                     #endif
10791                         return NO_PEER_KEY;
10792                     }
10793
10794                     wc_ecc_init(&myKey);
10795                     ret = wc_ecc_make_key(ssl->rng, peerKey->dp->size, &myKey);
10796                     if (ret != 0) {
10797                     #ifdef WOLFSSL_SMALL_STACK
10798                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10799                     #endif
10800                         return ECC_MAKEKEY_ERROR;
10801                     }
10802
10803                     /* precede export with 1 byte length */
10804                     ret = wc_ecc_export_x963(&myKey, encSecret + 1, &size);
10805                     encSecret[0] = (byte)size;
10806                     encSz = size + 1;
10807
10808                     if (ret != 0)
10809                         ret = ECC_EXPORT_ERROR;
10810                     else {
10811                         size = sizeof(ssl->arrays->preMasterSecret);
10812                         ret  = wc_ecc_shared_secret(&myKey, peerKey,
10813                                                  ssl->arrays->preMasterSecret, &size);
10814                         if (ret != 0)
10815                             ret = ECC_SHARED_ERROR;
10816                     }
10817
10818                     ssl->arrays->preMasterSz = size;
10819                     wc_ecc_free(&myKey);
10820                 }
10821                 break;
10822         #endif /* HAVE_ECC */
10823             default:
10824             #ifdef WOLFSSL_SMALL_STACK
10825                 XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10826             #endif
10827                 return ALGO_ID_E; /* unsupported kea */
10828         }
10829
10830         if (ret == 0) {
10831             byte              *output;
10832             int                sendSz;
10833             word32             tlsSz = 0;
10834
10835             if (ssl->options.tls || ssl->specs.kea == diffie_hellman_kea)
10836                 tlsSz = 2;
10837
10838             if (ssl->specs.kea == ecc_diffie_hellman_kea ||
10839                 ssl->specs.kea == dhe_psk_kea)  /* always off */
10840                 tlsSz = 0;
10841
10842             sendSz = encSz + tlsSz + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
10843             idx    = HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
10844
10845             #ifdef WOLFSSL_DTLS
10846                 if (ssl->options.dtls) {
10847                     sendSz += DTLS_HANDSHAKE_EXTRA + DTLS_RECORD_EXTRA;
10848                     idx    += DTLS_HANDSHAKE_EXTRA + DTLS_RECORD_EXTRA;
10849                 }
10850             #endif
10851
10852             if (ssl->keys.encryptionOn)
10853                 sendSz += MAX_MSG_EXTRA;
10854
10855             /* check for available size */
10856             if ((ret = CheckAvailableSize(ssl, sendSz)) != 0) {
10857             #ifdef WOLFSSL_SMALL_STACK
10858                 XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10859             #endif
10860                 return ret;
10861             }
10862
10863             /* get ouput buffer */
10864             output = ssl->buffers.outputBuffer.buffer +
10865                      ssl->buffers.outputBuffer.length;
10866
10867             AddHeaders(output, encSz + tlsSz, client_key_exchange, ssl);
10868
10869             if (tlsSz) {
10870                 c16toa((word16)encSz, &output[idx]);
10871                 idx += 2;
10872             }
10873             XMEMCPY(output + idx, encSecret, encSz);
10874             idx += encSz;
10875
10876             if (ssl->keys.encryptionOn) {
10877                 byte* input;
10878                 int   inputSz = idx-RECORD_HEADER_SZ; /* buildmsg adds rechdr */
10879
10880                 input = (byte*)XMALLOC(inputSz, ssl->heap,
10881                                        DYNAMIC_TYPE_TMP_BUFFER);
10882                 if (input == NULL) {
10883                 #ifdef WOLFSSL_SMALL_STACK
10884                     XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10885                 #endif
10886                     return MEMORY_E;
10887                 }
10888
10889                 XMEMCPY(input, output + RECORD_HEADER_SZ, inputSz);
10890                 sendSz = BuildMessage(ssl, output, sendSz, input, inputSz,
10891                                       handshake);
10892                 XFREE(input, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
10893                 if (sendSz < 0) {
10894                 #ifdef WOLFSSL_SMALL_STACK
10895                     XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10896                 #endif
10897                     return sendSz;
10898                 }
10899             } else {
10900                 ret = HashOutput(ssl, output, sendSz, 0);
10901                 if (ret != 0) {
10902                 #ifdef WOLFSSL_SMALL_STACK
10903                     XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10904                 #endif
10905                     return ret;
10906                 }
10907             }
10908
10909             #ifdef WOLFSSL_DTLS
10910                 if (ssl->options.dtls) {
10911                     if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0) {
10912                     #ifdef WOLFSSL_SMALL_STACK
10913                         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10914                     #endif
10915                         return ret;
10916                     }
10917                 }
10918             #endif
10919
10920             #ifdef WOLFSSL_CALLBACKS
10921                 if (ssl->hsInfoOn)
10922                     AddPacketName("ClientKeyExchange", &ssl->handShakeInfo);
10923                 if (ssl->toInfoOn)
10924                     AddPacketInfo("ClientKeyExchange", &ssl->timeoutInfo,
10925                                   output, sendSz, ssl->heap);
10926             #endif
10927
10928             ssl->buffers.outputBuffer.length += sendSz;
10929
10930             if (ssl->options.groupMessages)
10931                 ret = 0;
10932             else
10933                 ret = SendBuffered(ssl);
10934         }
10935
10936     #ifdef WOLFSSL_SMALL_STACK
10937         XFREE(encSecret, NULL, DYNAMIC_TYPE_TMP_BUFFER);
10938     #endif
10939
10940         if (ret == 0 || ret == WANT_WRITE) {
10941             int tmpRet = MakeMasterSecret(ssl);
10942             if (tmpRet != 0)
10943                 ret = tmpRet;   /* save WANT_WRITE unless more serious */
10944             ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
10945         }
10946         /* No further need for PMS */
10947         ForceZero(ssl->arrays->preMasterSecret, ssl->arrays->preMasterSz);
10948         ssl->arrays->preMasterSz = 0;
10949
10950         return ret;
10951     }
10952
10953 #ifndef NO_CERTS
10954     int SendCertificateVerify(WOLFSSL* ssl)
10955     {
10956         byte              *output;
10957         int                sendSz = MAX_CERT_VERIFY_SZ, length, ret;
10958         word32             idx = 0;
10959         word32             sigOutSz = 0;
10960 #ifndef NO_RSA
10961         RsaKey             key;
10962         int                initRsaKey = 0;
10963 #endif
10964         int                usingEcc = 0;
10965 #ifdef HAVE_ECC
10966         ecc_key            eccKey;
10967 #endif
10968
10969         (void)idx;
10970
10971         if (ssl->options.sendVerify == SEND_BLANK_CERT)
10972             return 0;  /* sent blank cert, can't verify */
10973
10974         if (ssl->keys.encryptionOn)
10975             sendSz += MAX_MSG_EXTRA;
10976
10977         /* check for available size */
10978         if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
10979             return ret;
10980
10981         /* get ouput buffer */
10982         output = ssl->buffers.outputBuffer.buffer +
10983                  ssl->buffers.outputBuffer.length;
10984
10985         ret = BuildCertHashes(ssl, &ssl->hsHashes->certHashes);
10986         if (ret != 0)
10987             return ret;
10988
10989 #ifdef HAVE_ECC
10990         wc_ecc_init(&eccKey);
10991 #endif
10992 #ifndef NO_RSA
10993         ret = wc_InitRsaKey(&key, ssl->heap);
10994         if (ret == 0) initRsaKey = 1;
10995         if (ret == 0)
10996             ret = wc_RsaPrivateKeyDecode(ssl->buffers.key.buffer, &idx, &key,
10997                                       ssl->buffers.key.length);
10998         if (ret == 0)
10999             sigOutSz = wc_RsaEncryptSize(&key);
11000         else
11001 #endif
11002         {
11003     #ifdef HAVE_ECC
11004             WOLFSSL_MSG("Trying ECC client cert, RSA didn't work");
11005
11006             idx = 0;
11007             ret = wc_EccPrivateKeyDecode(ssl->buffers.key.buffer, &idx, &eccKey,
11008                                       ssl->buffers.key.length);
11009             if (ret == 0) {
11010                 WOLFSSL_MSG("Using ECC client cert");
11011                 usingEcc = 1;
11012                 sigOutSz = MAX_ENCODED_SIG_SZ;
11013             }
11014             else {
11015                 WOLFSSL_MSG("Bad client cert type");
11016             }
11017     #endif
11018         }
11019         if (ret == 0) {
11020             byte*  verify = (byte*)&output[RECORD_HEADER_SZ +
11021                                            HANDSHAKE_HEADER_SZ];
11022 #ifndef NO_OLD_TLS
11023             byte*  signBuffer = ssl->hsHashes->certHashes.md5;
11024 #else
11025             byte*  signBuffer = NULL;
11026 #endif
11027             word32 signSz = FINISHED_SZ;
11028             word32 extraSz = 0;  /* tls 1.2 hash/sig */
11029 #ifdef WOLFSSL_SMALL_STACK
11030             byte*  encodedSig = NULL;
11031 #else
11032             byte   encodedSig[MAX_ENCODED_SIG_SZ];
11033 #endif
11034
11035 #ifdef WOLFSSL_SMALL_STACK
11036             encodedSig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ, NULL,
11037                                                        DYNAMIC_TYPE_TMP_BUFFER);
11038             if (encodedSig == NULL) {
11039             #ifndef NO_RSA
11040                 if (initRsaKey)
11041                     wc_FreeRsaKey(&key);
11042             #endif
11043             #ifdef HAVE_ECC
11044                 wc_ecc_free(&eccKey);
11045             #endif
11046                 return MEMORY_E;
11047             }
11048 #endif
11049
11050             (void)encodedSig;
11051             (void)signSz;
11052             (void)signBuffer;
11053
11054             #ifdef WOLFSSL_DTLS
11055                 if (ssl->options.dtls)
11056                     verify += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11057             #endif
11058             length = sigOutSz;
11059             if (IsAtLeastTLSv1_2(ssl)) {
11060                 verify[0] = ssl->suites->hashAlgo;
11061                 verify[1] = usingEcc ? ecc_dsa_sa_algo : rsa_sa_algo;
11062                 extraSz = HASH_SIG_SIZE;
11063             }
11064
11065             if (usingEcc) {
11066 #ifdef HAVE_ECC
11067                 word32 localSz = MAX_ENCODED_SIG_SZ;
11068                 word32 digestSz;
11069                 byte*  digest;
11070                 byte   doUserEcc = 0;
11071 #ifndef NO_OLD_TLS
11072                 /* old tls default */
11073                 digestSz = SHA_DIGEST_SIZE;
11074                 digest   = ssl->hsHashes->certHashes.sha;
11075 #else
11076                 /* new tls default */
11077                 digestSz = SHA256_DIGEST_SIZE;
11078                 digest   = ssl->hsHashes->certHashes.sha256;
11079 #endif
11080
11081                 #ifdef HAVE_PK_CALLBACKS
11082                     #ifdef HAVE_ECC
11083                         if (ssl->ctx->EccSignCb)
11084                             doUserEcc = 1;
11085                     #endif /* HAVE_ECC */
11086                 #endif /*HAVE_PK_CALLBACKS */
11087
11088                 if (IsAtLeastTLSv1_2(ssl)) {
11089                     if (ssl->suites->hashAlgo == sha_mac) {
11090                         #ifndef NO_SHA
11091                             digest = ssl->hsHashes->certHashes.sha;
11092                             digestSz = SHA_DIGEST_SIZE;
11093                         #endif
11094                     }
11095                     else if (ssl->suites->hashAlgo == sha256_mac) {
11096                         #ifndef NO_SHA256
11097                             digest = ssl->hsHashes->certHashes.sha256;
11098                             digestSz = SHA256_DIGEST_SIZE;
11099                         #endif
11100                     }
11101                     else if (ssl->suites->hashAlgo == sha384_mac) {
11102                         #ifdef WOLFSSL_SHA384
11103                             digest = ssl->hsHashes->certHashes.sha384;
11104                             digestSz = SHA384_DIGEST_SIZE;
11105                         #endif
11106                     }
11107                     else if (ssl->suites->hashAlgo == sha512_mac) {
11108                         #ifdef WOLFSSL_SHA512
11109                             digest = ssl->hsHashes->certHashes.sha512;
11110                             digestSz = SHA512_DIGEST_SIZE;
11111                         #endif
11112                     }
11113                 }
11114
11115                 if (doUserEcc) {
11116                 #ifdef HAVE_PK_CALLBACKS
11117                     #ifdef HAVE_ECC
11118                         ret = ssl->ctx->EccSignCb(ssl, digest, digestSz,
11119                                         encodedSig, &localSz,
11120                                         ssl->buffers.key.buffer,
11121                                         ssl->buffers.key.length,
11122                                         ssl->EccSignCtx);
11123                     #endif /* HAVE_ECC */
11124                 #endif /*HAVE_PK_CALLBACKS */
11125                 }
11126                 else {
11127                     ret = wc_ecc_sign_hash(digest, digestSz, encodedSig,
11128                                         &localSz, ssl->rng, &eccKey);
11129                 }
11130                 if (ret == 0) {
11131                     length = localSz;
11132                     c16toa((word16)length, verify + extraSz); /* prepend hdr */
11133                     XMEMCPY(verify + extraSz + VERIFY_HEADER,encodedSig,length);
11134                 }
11135 #endif
11136             }
11137 #ifndef NO_RSA
11138             else {
11139                 byte doUserRsa = 0;
11140
11141                 #ifdef HAVE_PK_CALLBACKS
11142                     if (ssl->ctx->RsaSignCb)
11143                         doUserRsa = 1;
11144                 #endif /*HAVE_PK_CALLBACKS */
11145
11146                 if (IsAtLeastTLSv1_2(ssl)) {
11147                     /*
11148                      * MSVC Compiler complains because it can not
11149                      * guarantee any of the conditionals will succeed in
11150                      * assigning a value before wc_EncodeSignature executes.
11151                      */
11152                     byte* digest    = NULL;
11153                     int   digestSz  = 0;
11154                     int   typeH     = 0;
11155                     int   didSet    = 0;
11156
11157                     if (ssl->suites->hashAlgo == sha_mac) {
11158                         #ifndef NO_SHA
11159                             digest   = ssl->hsHashes->certHashes.sha;
11160                             typeH    = SHAh;
11161                             digestSz = SHA_DIGEST_SIZE;
11162                             didSet   = 1;
11163                         #endif
11164                     }
11165                     else if (ssl->suites->hashAlgo == sha256_mac) {
11166                         #ifndef NO_SHA256
11167                             digest   = ssl->hsHashes->certHashes.sha256;
11168                             typeH    = SHA256h;
11169                             digestSz = SHA256_DIGEST_SIZE;
11170                             didSet   = 1;
11171                         #endif
11172                     }
11173                     else if (ssl->suites->hashAlgo == sha384_mac) {
11174                         #ifdef WOLFSSL_SHA384
11175                             digest   = ssl->hsHashes->certHashes.sha384;
11176                             typeH    = SHA384h;
11177                             digestSz = SHA384_DIGEST_SIZE;
11178                             didSet   = 1;
11179                         #endif
11180                     }
11181                     else if (ssl->suites->hashAlgo == sha512_mac) {
11182                         #ifdef WOLFSSL_SHA512
11183                             digest   = ssl->hsHashes->certHashes.sha512;
11184                             typeH    = SHA512h;
11185                             digestSz = SHA512_DIGEST_SIZE;
11186                             didSet   = 1;
11187                         #endif
11188                     }
11189
11190                     if (didSet == 0) {
11191                         /* defaults */
11192                         #ifndef NO_OLD_TLS
11193                             digest = ssl->hsHashes->certHashes.sha;
11194                             digestSz = SHA_DIGEST_SIZE;
11195                             typeH = SHAh;
11196                         #else
11197                             digest = ssl->hsHashes->certHashes.sha256;
11198                             digestSz = SHA256_DIGEST_SIZE;
11199                             typeH = SHA256h;
11200                         #endif
11201                     }
11202
11203                     signSz = wc_EncodeSignature(encodedSig, digest,digestSz,typeH);
11204                     signBuffer = encodedSig;
11205                 }
11206
11207                 c16toa((word16)length, verify + extraSz); /* prepend hdr */
11208                 if (doUserRsa) {
11209                 #ifdef HAVE_PK_CALLBACKS
11210                     #ifndef NO_RSA
11211                         word32 ioLen = ENCRYPT_LEN;
11212                         ret = ssl->ctx->RsaSignCb(ssl, signBuffer, signSz,
11213                                             verify + extraSz + VERIFY_HEADER,
11214                                             &ioLen,
11215                                             ssl->buffers.key.buffer,
11216                                             ssl->buffers.key.length,
11217                                             ssl->RsaSignCtx);
11218                     #endif /* NO_RSA */
11219                 #endif /*HAVE_PK_CALLBACKS */
11220                 }
11221                 else {
11222                     ret = wc_RsaSSL_Sign(signBuffer, signSz, verify + extraSz +
11223                                   VERIFY_HEADER, ENCRYPT_LEN, &key, ssl->rng);
11224                 }
11225
11226                 if (ret > 0)
11227                     ret = 0;  /* RSA reset */
11228             }
11229 #endif
11230 #ifdef WOLFSSL_SMALL_STACK
11231             XFREE(encodedSig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
11232 #endif
11233
11234             if (ret == 0) {
11235                 AddHeaders(output, length + extraSz + VERIFY_HEADER,
11236                            certificate_verify, ssl);
11237
11238                 sendSz = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ + length +
11239                          extraSz + VERIFY_HEADER;
11240
11241                 #ifdef WOLFSSL_DTLS
11242                     if (ssl->options.dtls) {
11243                         sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11244                     }
11245                 #endif
11246
11247                 if (ssl->keys.encryptionOn) {
11248                     byte* input;
11249                     int   inputSz = sendSz - RECORD_HEADER_SZ;
11250                                     /* build msg adds rec hdr */
11251                     input = (byte*)XMALLOC(inputSz, ssl->heap,
11252                                            DYNAMIC_TYPE_TMP_BUFFER);
11253                     if (input == NULL)
11254                         ret = MEMORY_E;
11255                     else {
11256                         XMEMCPY(input, output + RECORD_HEADER_SZ, inputSz);
11257                         sendSz = BuildMessage(ssl, output,
11258                                               MAX_CERT_VERIFY_SZ +MAX_MSG_EXTRA,
11259                                               input, inputSz, handshake);
11260                         XFREE(input, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
11261
11262                         if (sendSz < 0)
11263                             ret = sendSz;
11264                     }
11265                 } else {
11266                     ret = HashOutput(ssl, output, sendSz, 0);
11267                 }
11268
11269                 #ifdef WOLFSSL_DTLS
11270                     if (ssl->options.dtls) {
11271                         if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
11272                             return ret;
11273                     }
11274                 #endif
11275             }
11276         }
11277 #ifndef NO_RSA
11278         if (initRsaKey)
11279             wc_FreeRsaKey(&key);
11280 #endif
11281 #ifdef HAVE_ECC
11282         wc_ecc_free(&eccKey);
11283 #endif
11284
11285         if (ret == 0) {
11286             #ifdef WOLFSSL_CALLBACKS
11287                 if (ssl->hsInfoOn)
11288                     AddPacketName("CertificateVerify", &ssl->handShakeInfo);
11289                 if (ssl->toInfoOn)
11290                     AddPacketInfo("CertificateVerify", &ssl->timeoutInfo,
11291                                   output, sendSz, ssl->heap);
11292             #endif
11293             ssl->buffers.outputBuffer.length += sendSz;
11294             if (ssl->options.groupMessages)
11295                 return 0;
11296             else
11297                 return SendBuffered(ssl);
11298         }
11299         else
11300             return ret;
11301     }
11302 #endif /* NO_CERTS */
11303
11304 #ifdef HAVE_SESSION_TICKET
11305 int DoSessionTicket(WOLFSSL* ssl,
11306                                const byte* input, word32* inOutIdx, word32 size)
11307 {
11308     word32 begin = *inOutIdx;
11309     word32 lifetime;
11310     word16 length;
11311
11312     if (ssl->expect_session_ticket == 0) {
11313         WOLFSSL_MSG("Unexpected session ticket");
11314         return SESSION_TICKET_EXPECT_E;
11315     }
11316
11317     if ((*inOutIdx - begin) + OPAQUE32_LEN > size)
11318         return BUFFER_ERROR;
11319
11320     ato32(input + *inOutIdx, &lifetime);
11321     *inOutIdx += OPAQUE32_LEN;
11322
11323     if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
11324         return BUFFER_ERROR;
11325
11326     ato16(input + *inOutIdx, &length);
11327     *inOutIdx += OPAQUE16_LEN;
11328
11329     if (length > sizeof(ssl->session.ticket))
11330         return SESSION_TICKET_LEN_E;
11331
11332     if ((*inOutIdx - begin) + length > size)
11333         return BUFFER_ERROR;
11334
11335     /* If the received ticket including its length is greater than
11336      * a length value, the save it. Otherwise, don't save it. */
11337     if (length > 0) {
11338         XMEMCPY(ssl->session.ticket, input + *inOutIdx, length);
11339         *inOutIdx += length;
11340         ssl->session.ticketLen = length;
11341         ssl->timeout = lifetime;
11342         if (ssl->session_ticket_cb != NULL) {
11343             ssl->session_ticket_cb(ssl,
11344                                    ssl->session.ticket, ssl->session.ticketLen,
11345                                    ssl->session_ticket_ctx);
11346         }
11347         /* Create a fake sessionID based on the ticket, this will
11348          * supercede the existing session cache info. */
11349         ssl->options.haveSessionId = 1;
11350         XMEMCPY(ssl->arrays->sessionID,
11351                                  ssl->session.ticket + length - ID_LEN, ID_LEN);
11352 #ifndef NO_SESSION_CACHE
11353         AddSession(ssl);
11354 #endif
11355
11356     }
11357     else {
11358         ssl->session.ticketLen = 0;
11359     }
11360
11361     if (ssl->keys.encryptionOn) {
11362         *inOutIdx += ssl->keys.padSz;
11363     }
11364
11365     ssl->expect_session_ticket = 0;
11366
11367     return 0;
11368 }
11369 #endif /* HAVE_SESSION_TICKET */
11370
11371 #endif /* NO_WOLFSSL_CLIENT */
11372
11373
11374 #ifndef NO_WOLFSSL_SERVER
11375
11376     int SendServerHello(WOLFSSL* ssl)
11377     {
11378         byte              *output;
11379         word32             length, idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
11380         int                sendSz;
11381         int                ret;
11382         byte               sessIdSz = ID_LEN;
11383
11384         length = VERSION_SZ + RAN_LEN
11385                + ID_LEN + ENUM_LEN
11386                + SUITE_LEN
11387                + ENUM_LEN;
11388
11389 #ifdef HAVE_TLS_EXTENSIONS
11390         length += TLSX_GetResponseSize(ssl);
11391
11392     #ifdef HAVE_SESSION_TICKET
11393         if (ssl->options.useTicket && ssl->arrays->sessionIDSz == 0) {
11394             /* no session id */
11395             length  -= ID_LEN;
11396             sessIdSz = 0;
11397         }
11398     #endif /* HAVE_SESSION_TICKET */
11399 #endif
11400
11401         /* check for avalaible size */
11402         if ((ret = CheckAvailableSize(ssl, MAX_HELLO_SZ)) != 0)
11403             return ret;
11404
11405         /* get ouput buffer */
11406         output = ssl->buffers.outputBuffer.buffer +
11407                  ssl->buffers.outputBuffer.length;
11408
11409         sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
11410         AddHeaders(output, length, server_hello, ssl);
11411
11412         #ifdef WOLFSSL_DTLS
11413             if (ssl->options.dtls) {
11414                 idx    += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11415                 sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11416             }
11417         #endif
11418         /* now write to output */
11419             /* first version */
11420         output[idx++] = ssl->version.major;
11421         output[idx++] = ssl->version.minor;
11422
11423             /* then random */
11424         if (!ssl->options.resuming) {
11425             ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom,
11426                                                                        RAN_LEN);
11427             if (ret != 0)
11428                 return ret;
11429         }
11430
11431         XMEMCPY(output + idx, ssl->arrays->serverRandom, RAN_LEN);
11432         idx += RAN_LEN;
11433
11434 #ifdef SHOW_SECRETS
11435         {
11436             int j;
11437             printf("server random: ");
11438             for (j = 0; j < RAN_LEN; j++)
11439                 printf("%02x", ssl->arrays->serverRandom[j]);
11440             printf("\n");
11441         }
11442 #endif
11443             /* then session id */
11444         output[idx++] = sessIdSz;
11445         if (sessIdSz) {
11446
11447             if (!ssl->options.resuming) {
11448                 ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->sessionID,
11449                                            sessIdSz);
11450                 if (ret != 0) return ret;
11451             }
11452
11453             XMEMCPY(output + idx, ssl->arrays->sessionID, sessIdSz);
11454             idx += sessIdSz;
11455         }
11456
11457             /* then cipher suite */
11458         output[idx++] = ssl->options.cipherSuite0;
11459         output[idx++] = ssl->options.cipherSuite;
11460
11461             /* then compression */
11462         if (ssl->options.usingCompression)
11463             output[idx++] = ZLIB_COMPRESSION;
11464         else
11465             output[idx++] = NO_COMPRESSION;
11466
11467             /* last, extensions */
11468 #ifdef HAVE_TLS_EXTENSIONS
11469         TLSX_WriteResponse(ssl, output + idx);
11470 #endif
11471
11472         ssl->buffers.outputBuffer.length += sendSz;
11473         #ifdef WOLFSSL_DTLS
11474             if (ssl->options.dtls) {
11475                 if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
11476                     return ret;
11477             }
11478         #endif
11479
11480         ret = HashOutput(ssl, output, sendSz, 0);
11481         if (ret != 0)
11482             return ret;
11483
11484         #ifdef WOLFSSL_CALLBACKS
11485             if (ssl->hsInfoOn)
11486                 AddPacketName("ServerHello", &ssl->handShakeInfo);
11487             if (ssl->toInfoOn)
11488                 AddPacketInfo("ServerHello", &ssl->timeoutInfo, output, sendSz,
11489                               ssl->heap);
11490         #endif
11491
11492         ssl->options.serverState = SERVER_HELLO_COMPLETE;
11493
11494         if (ssl->options.groupMessages)
11495             return 0;
11496         else
11497             return SendBuffered(ssl);
11498     }
11499
11500
11501 #ifdef HAVE_ECC
11502
11503     static byte SetCurveId(int size)
11504     {
11505         switch(size) {
11506 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC160)
11507             case 20:
11508                 return WOLFSSL_ECC_SECP160R1;
11509 #endif
11510 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC192)
11511             case 24:
11512                 return WOLFSSL_ECC_SECP192R1;
11513 #endif
11514 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC224)
11515             case 28:
11516                 return WOLFSSL_ECC_SECP224R1;
11517 #endif
11518 #if defined(HAVE_ALL_CURVES) || !defined(NO_ECC256)
11519             case 32:
11520                 return WOLFSSL_ECC_SECP256R1;
11521 #endif
11522 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC384)
11523             case 48:
11524                 return WOLFSSL_ECC_SECP384R1;
11525 #endif
11526 #if defined(HAVE_ALL_CURVES) || defined(HAVE_ECC521)
11527             case 66:
11528                 return WOLFSSL_ECC_SECP521R1;
11529 #endif
11530             default:
11531                 return 0;
11532         }
11533     }
11534
11535 #endif /* HAVE_ECC */
11536
11537
11538     int SendServerKeyExchange(WOLFSSL* ssl)
11539     {
11540         int ret = 0;
11541         (void)ssl;
11542         #define ERROR_OUT(err, eLabel) do { ret = err; goto eLabel; } while(0)
11543
11544     #ifndef NO_PSK
11545         if (ssl->specs.kea == psk_kea)
11546         {
11547             byte    *output;
11548             word32   length, idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
11549             int      sendSz;
11550             if (ssl->arrays->server_hint[0] == 0) return 0; /* don't send */
11551
11552             /* include size part */
11553             length = (word32)XSTRLEN(ssl->arrays->server_hint);
11554             if (length > MAX_PSK_ID_LEN)
11555                 return SERVER_HINT_ERROR;
11556
11557             length += HINT_LEN_SZ;
11558             sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
11559
11560         #ifdef WOLFSSL_DTLS
11561             if (ssl->options.dtls) {
11562                 sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11563                 idx    += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11564             }
11565         #endif
11566             /* check for available size */
11567             if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
11568                return ret;
11569
11570             /* get ouput buffer */
11571             output = ssl->buffers.outputBuffer.buffer +
11572                      ssl->buffers.outputBuffer.length;
11573
11574             AddHeaders(output, length, server_key_exchange, ssl);
11575
11576             /* key data */
11577             c16toa((word16)(length - HINT_LEN_SZ), output + idx);
11578             idx += HINT_LEN_SZ;
11579             XMEMCPY(output + idx, ssl->arrays->server_hint,length -HINT_LEN_SZ);
11580
11581         #ifdef WOLFSSL_DTLS
11582             if (ssl->options.dtls)
11583                 if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
11584                     return ret;
11585         #endif
11586
11587             ret = HashOutput(ssl, output, sendSz, 0);
11588             if (ret != 0)
11589                 return ret;
11590
11591         #ifdef WOLFSSL_CALLBACKS
11592             if (ssl->hsInfoOn)
11593                 AddPacketName("ServerKeyExchange", &ssl->handShakeInfo);
11594             if (ssl->toInfoOn)
11595                 AddPacketInfo("ServerKeyExchange", &ssl->timeoutInfo, output,
11596                                                              sendSz, ssl->heap);
11597         #endif
11598
11599             ssl->buffers.outputBuffer.length += sendSz;
11600             if (ssl->options.groupMessages)
11601                 ret = 0;
11602             else
11603                 ret = SendBuffered(ssl);
11604             ssl->options.serverState = SERVER_KEYEXCHANGE_COMPLETE;
11605         }
11606     #endif /*NO_PSK */
11607
11608     #if !defined(NO_DH) && !defined(NO_PSK)
11609         if (ssl->specs.kea == dhe_psk_kea) {
11610             byte    *output;
11611             word32   length, idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
11612             word32   hintLen;
11613             int      sendSz;
11614             DhKey    dhKey;
11615
11616             if (ssl->buffers.serverDH_P.buffer == NULL ||
11617                 ssl->buffers.serverDH_G.buffer == NULL)
11618                 return NO_DH_PARAMS;
11619
11620             if (ssl->buffers.serverDH_Pub.buffer == NULL) {
11621                 ssl->buffers.serverDH_Pub.buffer = (byte*)XMALLOC(
11622                         ssl->buffers.serverDH_P.length + 2, ssl->ctx->heap,
11623                         DYNAMIC_TYPE_DH);
11624                 if (ssl->buffers.serverDH_Pub.buffer == NULL)
11625                     return MEMORY_E;
11626             }
11627
11628             if (ssl->buffers.serverDH_Priv.buffer == NULL) {
11629                 ssl->buffers.serverDH_Priv.buffer = (byte*)XMALLOC(
11630                         ssl->buffers.serverDH_P.length + 2, ssl->ctx->heap,
11631                         DYNAMIC_TYPE_DH);
11632                 if (ssl->buffers.serverDH_Priv.buffer == NULL)
11633                     return MEMORY_E;
11634             }
11635
11636             wc_InitDhKey(&dhKey);
11637             ret = wc_DhSetKey(&dhKey, ssl->buffers.serverDH_P.buffer,
11638                                    ssl->buffers.serverDH_P.length,
11639                                    ssl->buffers.serverDH_G.buffer,
11640                                    ssl->buffers.serverDH_G.length);
11641             if (ret == 0)
11642                 ret = wc_DhGenerateKeyPair(&dhKey, ssl->rng,
11643                                          ssl->buffers.serverDH_Priv.buffer,
11644                                         &ssl->buffers.serverDH_Priv.length,
11645                                          ssl->buffers.serverDH_Pub.buffer,
11646                                         &ssl->buffers.serverDH_Pub.length);
11647             wc_FreeDhKey(&dhKey);
11648             if (ret != 0)
11649                 return ret;
11650
11651             length = LENGTH_SZ * 3 + /* p, g, pub */
11652                      ssl->buffers.serverDH_P.length +
11653                      ssl->buffers.serverDH_G.length +
11654                      ssl->buffers.serverDH_Pub.length;
11655
11656             /* include size part */
11657             hintLen = (word32)XSTRLEN(ssl->arrays->server_hint);
11658             if (hintLen > MAX_PSK_ID_LEN)
11659                 return SERVER_HINT_ERROR;
11660             length += hintLen + HINT_LEN_SZ;
11661             sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
11662
11663         #ifdef WOLFSSL_DTLS
11664             if (ssl->options.dtls) {
11665                 sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11666                 idx    += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11667             }
11668         #endif
11669
11670             /* check for available size */
11671             if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
11672                return ret;
11673
11674             /* get ouput buffer */
11675             output = ssl->buffers.outputBuffer.buffer +
11676                      ssl->buffers.outputBuffer.length;
11677
11678             AddHeaders(output, length, server_key_exchange, ssl);
11679
11680             /* key data */
11681             c16toa((word16)hintLen, output + idx);
11682             idx += HINT_LEN_SZ;
11683             XMEMCPY(output + idx, ssl->arrays->server_hint, hintLen);
11684             idx += hintLen;
11685
11686             /* add p, g, pub */
11687             c16toa((word16)ssl->buffers.serverDH_P.length, output + idx);
11688             idx += LENGTH_SZ;
11689             XMEMCPY(output + idx, ssl->buffers.serverDH_P.buffer,
11690                                   ssl->buffers.serverDH_P.length);
11691             idx += ssl->buffers.serverDH_P.length;
11692
11693             /*  g */
11694             c16toa((word16)ssl->buffers.serverDH_G.length, output + idx);
11695             idx += LENGTH_SZ;
11696             XMEMCPY(output + idx, ssl->buffers.serverDH_G.buffer,
11697                                   ssl->buffers.serverDH_G.length);
11698             idx += ssl->buffers.serverDH_G.length;
11699
11700             /*  pub */
11701             c16toa((word16)ssl->buffers.serverDH_Pub.length, output + idx);
11702             idx += LENGTH_SZ;
11703             XMEMCPY(output + idx, ssl->buffers.serverDH_Pub.buffer,
11704                                   ssl->buffers.serverDH_Pub.length);
11705             idx += ssl->buffers.serverDH_Pub.length;
11706             (void)idx; /* suppress analyzer warning, and keep idx current */
11707
11708         #ifdef WOLFSSL_DTLS
11709             if (ssl->options.dtls)
11710                 if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
11711                     return ret;
11712         #endif
11713
11714             ret = HashOutput(ssl, output, sendSz, 0);
11715
11716             if (ret != 0)
11717                 return ret;
11718
11719         #ifdef WOLFSSL_CALLBACKS
11720             if (ssl->hsInfoOn)
11721                 AddPacketName("ServerKeyExchange", &ssl->handShakeInfo);
11722             if (ssl->toInfoOn)
11723                 AddPacketInfo("ServerKeyExchange", &ssl->timeoutInfo, output,
11724                                                              sendSz, ssl->heap);
11725         #endif
11726
11727             ssl->buffers.outputBuffer.length += sendSz;
11728             if (ssl->options.groupMessages)
11729                 ret = 0;
11730             else
11731                 ret = SendBuffered(ssl);
11732             ssl->options.serverState = SERVER_KEYEXCHANGE_COMPLETE;
11733         }
11734     #endif /* !NO_DH && !NO_PSK */
11735
11736     #ifdef HAVE_ECC
11737         if (ssl->specs.kea == ecc_diffie_hellman_kea)
11738         {
11739             byte    *output;
11740             word32   length, idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
11741             int      sendSz;
11742             word32   sigSz;
11743             word32   preSigSz, preSigIdx;
11744         #ifndef NO_RSA
11745             RsaKey   rsaKey;
11746         #endif
11747             ecc_key  dsaKey;
11748         #ifdef WOLFSSL_SMALL_STACK
11749             byte*    exportBuf = NULL;
11750         #else
11751             byte     exportBuf[MAX_EXPORT_ECC_SZ];
11752         #endif
11753             word32   expSz = MAX_EXPORT_ECC_SZ;
11754
11755         #ifndef NO_OLD_TLS
11756             byte doMd5 = 0;
11757             byte doSha = 0;
11758         #endif
11759         #ifndef NO_SHA256
11760             byte doSha256 = 0;
11761         #endif
11762         #ifdef WOLFSSL_SHA384
11763             byte doSha384 = 0;
11764         #endif
11765         #ifdef WOLFSSL_SHA512
11766             byte doSha512 = 0;
11767         #endif
11768
11769             if (ssl->specs.static_ecdh) {
11770                 WOLFSSL_MSG("Using Static ECDH, not sending ServerKeyExchagne");
11771                 return 0;
11772             }
11773
11774             /* curve type, named curve, length(1) */
11775             length = ENUM_LEN + CURVE_LEN + ENUM_LEN;
11776             /* pub key size */
11777             WOLFSSL_MSG("Using ephemeral ECDH");
11778
11779             /* need ephemeral key now, create it if missing */
11780             if (ssl->eccTempKey == NULL) {
11781                 /* alloc/init on demand */
11782                 ssl->eccTempKey = (ecc_key*)XMALLOC(sizeof(ecc_key),
11783                                               ssl->ctx->heap, DYNAMIC_TYPE_ECC);
11784                 if (ssl->eccTempKey == NULL) {
11785                     WOLFSSL_MSG("EccTempKey Memory error");
11786                     return MEMORY_E;
11787                 }
11788                 wc_ecc_init(ssl->eccTempKey);
11789             }
11790             if (ssl->eccTempKeyPresent == 0) {
11791                 if (wc_ecc_make_key(ssl->rng, ssl->eccTempKeySz,
11792                                  ssl->eccTempKey) != 0) {
11793                     return ECC_MAKEKEY_ERROR;
11794                 }
11795                 ssl->eccTempKeyPresent = 1;
11796             }
11797
11798         #ifdef WOLFSSL_SMALL_STACK
11799             exportBuf = (byte*)XMALLOC(MAX_EXPORT_ECC_SZ, NULL,
11800                                                        DYNAMIC_TYPE_TMP_BUFFER);
11801             if (exportBuf == NULL)
11802                 return MEMORY_E;
11803         #endif
11804
11805             if (wc_ecc_export_x963(ssl->eccTempKey, exportBuf, &expSz) != 0)
11806                 ERROR_OUT(ECC_EXPORT_ERROR, done_a);
11807             length += expSz;
11808
11809             preSigSz  = length;
11810             preSigIdx = idx;
11811
11812         #ifndef NO_RSA
11813             ret = wc_InitRsaKey(&rsaKey, ssl->heap);
11814             if (ret != 0)
11815                 goto done_a;
11816         #endif
11817
11818             wc_ecc_init(&dsaKey);
11819
11820             /* sig length */
11821             length += LENGTH_SZ;
11822
11823             if (!ssl->buffers.key.buffer) {
11824             #ifndef NO_RSA
11825                 wc_FreeRsaKey(&rsaKey);
11826             #endif
11827                 wc_ecc_free(&dsaKey);
11828                 ERROR_OUT(NO_PRIVATE_KEY, done_a);
11829             }
11830
11831         #ifndef NO_RSA
11832             if (ssl->specs.sig_algo == rsa_sa_algo) {
11833                 /* rsa sig size */
11834                 word32 i = 0;
11835                 ret = wc_RsaPrivateKeyDecode(ssl->buffers.key.buffer, &i,
11836                                           &rsaKey, ssl->buffers.key.length);
11837                 if (ret != 0)
11838                     goto done_a;
11839                 sigSz = wc_RsaEncryptSize(&rsaKey);
11840             } else
11841         #endif
11842
11843             if (ssl->specs.sig_algo == ecc_dsa_sa_algo) {
11844                 /* ecdsa sig size */
11845                 word32 i = 0;
11846                 ret = wc_EccPrivateKeyDecode(ssl->buffers.key.buffer, &i,
11847                                           &dsaKey, ssl->buffers.key.length);
11848                 if (ret != 0)
11849                     goto done_a;
11850                 sigSz = wc_ecc_sig_size(&dsaKey);  /* worst case estimate */
11851             }
11852             else {
11853             #ifndef NO_RSA
11854                 wc_FreeRsaKey(&rsaKey);
11855             #endif
11856                 wc_ecc_free(&dsaKey);
11857                 ERROR_OUT(ALGO_ID_E, done_a);  /* unsupported type */
11858             }
11859             length += sigSz;
11860
11861             if (IsAtLeastTLSv1_2(ssl))
11862                 length += HASH_SIG_SIZE;
11863
11864             sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
11865
11866         #ifdef WOLFSSL_DTLS
11867             if (ssl->options.dtls) {
11868                 sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11869                 idx    += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
11870                 preSigIdx = idx;
11871             }
11872         #endif
11873             /* check for available size */
11874             if ((ret = CheckAvailableSize(ssl, sendSz)) != 0) {
11875             #ifndef NO_RSA
11876                 wc_FreeRsaKey(&rsaKey);
11877             #endif
11878                 wc_ecc_free(&dsaKey);
11879                 goto done_a;
11880             }
11881
11882             /* get ouput buffer */
11883             output = ssl->buffers.outputBuffer.buffer +
11884                      ssl->buffers.outputBuffer.length;
11885
11886             /* record and message headers will be added below, when we're sure
11887                of the sig length */
11888
11889             /* key exchange data */
11890             output[idx++] = named_curve;
11891             output[idx++] = 0x00;          /* leading zero */
11892             output[idx++] = SetCurveId(wc_ecc_size(ssl->eccTempKey));
11893             output[idx++] = (byte)expSz;
11894             XMEMCPY(output + idx, exportBuf, expSz);
11895             idx += expSz;
11896             if (IsAtLeastTLSv1_2(ssl)) {
11897                 byte setHash = 0;
11898
11899                 output[idx++] = ssl->suites->hashAlgo;
11900                 output[idx++] = ssl->suites->sigAlgo;
11901
11902                 switch (ssl->suites->hashAlgo) {
11903                     case sha512_mac:
11904                         #ifdef WOLFSSL_SHA512
11905                             doSha512 = 1;
11906                             setHash  = 1;
11907                         #endif
11908                         break;
11909
11910                     case sha384_mac:
11911                         #ifdef WOLFSSL_SHA384
11912                             doSha384 = 1;
11913                             setHash  = 1;
11914                         #endif
11915                         break;
11916
11917                     case sha256_mac:
11918                         #ifndef NO_SHA256
11919                             doSha256 = 1;
11920                             setHash  = 1;
11921                         #endif
11922                         break;
11923
11924                     case sha_mac:
11925                         #ifndef NO_OLD_TLS
11926                             doSha = 1;
11927                             setHash  = 1;
11928                         #endif
11929                         break;
11930
11931                     default:
11932                         WOLFSSL_MSG("Bad hash sig algo");
11933                         break;
11934                 }
11935
11936                 if (setHash == 0) {
11937                     #ifndef NO_RSA
11938                         wc_FreeRsaKey(&rsaKey);
11939                     #endif
11940                     wc_ecc_free(&dsaKey);
11941                     ERROR_OUT(ALGO_ID_E, done_a);
11942                 }
11943             } else {
11944                 /* only using sha and md5 for rsa */
11945                 #ifndef NO_OLD_TLS
11946                     doSha = 1;
11947                     if (ssl->suites->sigAlgo == rsa_sa_algo) {
11948                         doMd5 = 1;
11949                     }
11950                 #else
11951                     #ifndef NO_RSA
11952                         wc_FreeRsaKey(&rsaKey);
11953                     #endif
11954                     wc_ecc_free(&dsaKey);
11955                     ERROR_OUT(ALGO_ID_E, done_a);
11956                 #endif
11957             }
11958
11959             /* Signtaure length will be written later, when we're sure what it
11960                is */
11961
11962         #ifdef HAVE_FUZZER
11963             if (ssl->fuzzerCb)
11964                 ssl->fuzzerCb(ssl, output + preSigIdx, preSigSz, FUZZ_SIGNATURE,
11965                               ssl->fuzzerCtx);
11966         #endif
11967
11968             /* do signature */
11969             {
11970         #ifndef NO_OLD_TLS
11971             #ifdef WOLFSSL_SMALL_STACK
11972                 Md5*   md5  = NULL;
11973                 Sha*   sha  = NULL;
11974             #else
11975                 Md5    md5[1];
11976                 Sha    sha[1];
11977             #endif
11978         #endif
11979             #ifdef WOLFSSL_SMALL_STACK
11980                 byte*  hash = NULL;
11981             #else
11982                 byte   hash[FINISHED_SZ];
11983             #endif
11984         #ifndef NO_SHA256
11985             #ifdef WOLFSSL_SMALL_STACK
11986                 Sha256* sha256  = NULL;
11987                 byte*   hash256 = NULL;
11988             #else
11989                 Sha256  sha256[1];
11990                 byte    hash256[SHA256_DIGEST_SIZE];
11991             #endif
11992         #endif
11993         #ifdef WOLFSSL_SHA384
11994             #ifdef WOLFSSL_SMALL_STACK
11995                 Sha384* sha384  = NULL;
11996                 byte*   hash384 = NULL;
11997             #else
11998                 Sha384  sha384[1];
11999                 byte    hash384[SHA384_DIGEST_SIZE];
12000             #endif
12001         #endif
12002         #ifdef WOLFSSL_SHA512
12003             #ifdef WOLFSSL_SMALL_STACK
12004                 Sha512* sha512  = NULL;
12005                 byte*   hash512 = NULL;
12006             #else
12007                 Sha512  sha512[1];
12008                 byte    hash512[SHA512_DIGEST_SIZE];
12009             #endif
12010         #endif
12011
12012             #ifdef WOLFSSL_SMALL_STACK
12013                 hash = (byte*)XMALLOC(FINISHED_SZ, NULL,
12014                                                        DYNAMIC_TYPE_TMP_BUFFER);
12015                 if (hash == NULL)
12016                     ERROR_OUT(MEMORY_E, done_a);
12017             #endif
12018
12019         #ifndef NO_OLD_TLS
12020                 /* md5 */
12021             #ifdef WOLFSSL_SMALL_STACK
12022                 if (doMd5) {
12023                     md5 = (Md5*)XMALLOC(sizeof(Md5), NULL,
12024                                         DYNAMIC_TYPE_TMP_BUFFER);
12025                     if (md5 == NULL)
12026                         ERROR_OUT(MEMORY_E, done_a2);
12027                 }
12028             #endif
12029                 if (doMd5) {
12030                     wc_InitMd5(md5);
12031                     wc_Md5Update(md5, ssl->arrays->clientRandom, RAN_LEN);
12032                     wc_Md5Update(md5, ssl->arrays->serverRandom, RAN_LEN);
12033                     wc_Md5Update(md5, output + preSigIdx, preSigSz);
12034                     wc_Md5Final(md5, hash);
12035                 }
12036                 /* sha */
12037             #ifdef WOLFSSL_SMALL_STACK
12038                 if (doSha) {
12039                     sha = (Sha*)XMALLOC(sizeof(Sha), NULL,
12040                                         DYNAMIC_TYPE_TMP_BUFFER);
12041                     if (sha == NULL)
12042                         ERROR_OUT(MEMORY_E, done_a2);
12043                 }
12044             #endif
12045                 if (doSha) {
12046                     ret = wc_InitSha(sha);
12047                     if (ret != 0) goto done_a2;
12048                     wc_ShaUpdate(sha, ssl->arrays->clientRandom, RAN_LEN);
12049                     wc_ShaUpdate(sha, ssl->arrays->serverRandom, RAN_LEN);
12050                     wc_ShaUpdate(sha, output + preSigIdx, preSigSz);
12051                     wc_ShaFinal(sha, &hash[MD5_DIGEST_SIZE]);
12052                 }
12053         #endif
12054
12055         #ifndef NO_SHA256
12056             #ifdef WOLFSSL_SMALL_STACK
12057                 if (doSha256) {
12058                     sha256 = (Sha256*)XMALLOC(sizeof(Sha256), NULL,
12059                                               DYNAMIC_TYPE_TMP_BUFFER);
12060                     hash256 = (byte*)XMALLOC(SHA256_DIGEST_SIZE, NULL,
12061                                              DYNAMIC_TYPE_TMP_BUFFER);
12062                     if (sha256 == NULL || hash256 == NULL)
12063                         ERROR_OUT(MEMORY_E, done_a2);
12064                 }
12065             #endif
12066
12067                 if (doSha256) {
12068                     if (!(ret = wc_InitSha256(sha256))
12069                     &&  !(ret = wc_Sha256Update(sha256,
12070                                             ssl->arrays->clientRandom, RAN_LEN))
12071                     &&  !(ret = wc_Sha256Update(sha256,
12072                                             ssl->arrays->serverRandom, RAN_LEN))
12073                     &&  !(ret = wc_Sha256Update(sha256,
12074                                             output + preSigIdx, preSigSz)))
12075                         ret = wc_Sha256Final(sha256, hash256);
12076
12077                     if (ret != 0) goto done_a2;
12078                 }
12079         #endif
12080
12081         #ifdef WOLFSSL_SHA384
12082             #ifdef WOLFSSL_SMALL_STACK
12083                 if (doSha384) {
12084                     sha384 = (Sha384*)XMALLOC(sizeof(Sha384), NULL,
12085                                               DYNAMIC_TYPE_TMP_BUFFER);
12086                     hash384 = (byte*)XMALLOC(SHA384_DIGEST_SIZE, NULL,
12087                                              DYNAMIC_TYPE_TMP_BUFFER);
12088                     if (sha384 == NULL || hash384 == NULL)
12089                         ERROR_OUT(MEMORY_E, done_a2);
12090                 }
12091             #endif
12092
12093                 if (doSha384) {
12094                     if (!(ret = wc_InitSha384(sha384))
12095                     &&  !(ret = wc_Sha384Update(sha384,
12096                                             ssl->arrays->clientRandom, RAN_LEN))
12097                     &&  !(ret = wc_Sha384Update(sha384,
12098                                             ssl->arrays->serverRandom, RAN_LEN))
12099                     &&  !(ret = wc_Sha384Update(sha384,
12100                                             output + preSigIdx, preSigSz)))
12101                         ret = wc_Sha384Final(sha384, hash384);
12102
12103                     if (ret != 0) goto done_a2;
12104                 }
12105         #endif
12106
12107         #ifdef WOLFSSL_SHA512
12108             #ifdef WOLFSSL_SMALL_STACK
12109                 if (doSha512) {
12110                     sha512 = (Sha512*)XMALLOC(sizeof(Sha512), NULL,
12111                                               DYNAMIC_TYPE_TMP_BUFFER);
12112                     hash512 = (byte*)XMALLOC(SHA512_DIGEST_SIZE, NULL,
12113                                              DYNAMIC_TYPE_TMP_BUFFER);
12114                     if (sha512 == NULL || hash512 == NULL)
12115                         ERROR_OUT(MEMORY_E, done_a2);
12116                 }
12117             #endif
12118
12119                 if (doSha512) {
12120                     if (!(ret = wc_InitSha512(sha512))
12121                     &&  !(ret = wc_Sha512Update(sha512,
12122                                             ssl->arrays->clientRandom, RAN_LEN))
12123                     &&  !(ret = wc_Sha512Update(sha512,
12124                                             ssl->arrays->serverRandom, RAN_LEN))
12125                     &&  !(ret = wc_Sha512Update(sha512,
12126                                             output + preSigIdx, preSigSz)))
12127                         ret = wc_Sha512Final(sha512, hash512);
12128
12129                     if (ret != 0) goto done_a2;
12130                 }
12131         #endif
12132
12133             #ifndef NO_RSA
12134                 if (ssl->suites->sigAlgo == rsa_sa_algo) {
12135                     byte*  signBuffer = hash;
12136                     word32 signSz     = FINISHED_SZ;
12137                     byte   doUserRsa = 0;
12138                 #ifdef WOLFSSL_SMALL_STACK
12139                     byte*  encodedSig = NULL;
12140                 #else
12141                     byte   encodedSig[MAX_ENCODED_SIG_SZ];
12142                 #endif
12143
12144                 #ifdef HAVE_PK_CALLBACKS
12145                     if (ssl->ctx->RsaSignCb)
12146                         doUserRsa = 1;
12147                 #endif
12148
12149                 #ifdef WOLFSSL_SMALL_STACK
12150                     encodedSig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ, NULL,
12151                                                        DYNAMIC_TYPE_TMP_BUFFER);
12152                     if (encodedSig == NULL)
12153                         ERROR_OUT(MEMORY_E, done_a2);
12154                 #endif
12155
12156                     if (IsAtLeastTLSv1_2(ssl)) {
12157                         byte* digest   = &hash[MD5_DIGEST_SIZE];
12158                         int   typeH    = SHAh;
12159                         int   digestSz = SHA_DIGEST_SIZE;
12160
12161                         if (ssl->suites->hashAlgo == sha256_mac) {
12162                         #ifndef NO_SHA256
12163                             digest   = hash256;
12164                             typeH    = SHA256h;
12165                             digestSz = SHA256_DIGEST_SIZE;
12166                         #endif
12167                         }
12168                         else if (ssl->suites->hashAlgo == sha384_mac) {
12169                         #ifdef WOLFSSL_SHA384
12170                             digest   = hash384;
12171                             typeH    = SHA384h;
12172                             digestSz = SHA384_DIGEST_SIZE;
12173                         #endif
12174                         }
12175                         else if (ssl->suites->hashAlgo == sha512_mac) {
12176                         #ifdef WOLFSSL_SHA512
12177                             digest   = hash512;
12178                             typeH    = SHA512h;
12179                             digestSz = SHA512_DIGEST_SIZE;
12180                         #endif
12181                         }
12182
12183                         if (digest == NULL) {
12184                             #ifndef NO_RSA
12185                                 wc_FreeRsaKey(&rsaKey);
12186                             #endif
12187                             wc_ecc_free(&dsaKey);
12188                             ERROR_OUT(ALGO_ID_E, done_a2);
12189                         }
12190                         signSz = wc_EncodeSignature(encodedSig, digest,
12191                                                     digestSz, typeH);
12192                         signBuffer = encodedSig;
12193                     }
12194                     /* write sig size here */
12195                     c16toa((word16)sigSz, output + idx);
12196                     idx += LENGTH_SZ;
12197
12198                     if (doUserRsa) {
12199                     #ifdef HAVE_PK_CALLBACKS
12200                         word32 ioLen = sigSz;
12201                         ret = ssl->ctx->RsaSignCb(ssl, signBuffer, signSz,
12202                                             output + idx, &ioLen,
12203                                             ssl->buffers.key.buffer,
12204                                             ssl->buffers.key.length,
12205                                             ssl->RsaSignCtx);
12206                     #endif /*HAVE_PK_CALLBACKS */
12207                     }
12208                     else
12209                         ret = wc_RsaSSL_Sign(signBuffer, signSz, output + idx,
12210                                           sigSz, &rsaKey, ssl->rng);
12211
12212                     wc_FreeRsaKey(&rsaKey);
12213                     wc_ecc_free(&dsaKey);
12214
12215                 #ifdef WOLFSSL_SMALL_STACK
12216                     XFREE(encodedSig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12217                 #endif
12218
12219                     if (ret < 0)
12220                         goto done_a2;
12221                 } else
12222             #endif
12223
12224                 if (ssl->suites->sigAlgo == ecc_dsa_sa_algo) {
12225                 #ifndef NO_OLD_TLS
12226                     byte* digest = &hash[MD5_DIGEST_SIZE];
12227                     word32 digestSz = SHA_DIGEST_SIZE;
12228                 #else
12229                     byte* digest = hash256;
12230                     word32 digestSz = SHA256_DIGEST_SIZE;
12231                 #endif
12232                     word32 sz = sigSz;
12233                     byte   doUserEcc = 0;
12234
12235                 #if defined(HAVE_PK_CALLBACKS) && defined(HAVE_ECC)
12236                     if (ssl->ctx->EccSignCb)
12237                         doUserEcc = 1;
12238                 #endif
12239
12240                     if (IsAtLeastTLSv1_2(ssl)) {
12241                         if (ssl->suites->hashAlgo == sha_mac) {
12242                         #ifndef NO_SHA
12243                             digest   = &hash[MD5_DIGEST_SIZE];
12244                             digestSz = SHA_DIGEST_SIZE;
12245                         #endif
12246                         }
12247                         else if (ssl->suites->hashAlgo == sha256_mac) {
12248                         #ifndef NO_SHA256
12249                             digest   = hash256;
12250                             digestSz = SHA256_DIGEST_SIZE;
12251                         #endif
12252                         }
12253                         else if (ssl->suites->hashAlgo == sha384_mac) {
12254                         #ifdef WOLFSSL_SHA384
12255                             digest   = hash384;
12256                             digestSz = SHA384_DIGEST_SIZE;
12257                         #endif
12258                         }
12259                         else if (ssl->suites->hashAlgo == sha512_mac) {
12260                         #ifdef WOLFSSL_SHA512
12261                             digest   = hash512;
12262                             digestSz = SHA512_DIGEST_SIZE;
12263                         #endif
12264                         }
12265                     }
12266
12267                     if (doUserEcc) {
12268                     #if defined(HAVE_PK_CALLBACKS) && defined(HAVE_ECC)
12269                         ret = ssl->ctx->EccSignCb(ssl, digest, digestSz,
12270                                                   output + LENGTH_SZ + idx, &sz,
12271                                                   ssl->buffers.key.buffer,
12272                                                   ssl->buffers.key.length,
12273                                                   ssl->EccSignCtx);
12274                     #endif
12275                     }
12276                     else {
12277                         ret = wc_ecc_sign_hash(digest, digestSz,
12278                               output + LENGTH_SZ + idx, &sz, ssl->rng, &dsaKey);
12279                     }
12280                 #ifndef NO_RSA
12281                     wc_FreeRsaKey(&rsaKey);
12282                 #endif
12283                     wc_ecc_free(&dsaKey);
12284
12285                     if (ret < 0)
12286                         goto done_a2;
12287
12288                     /* Now that we know the real sig size, write it. */
12289                     c16toa((word16)sz, output + idx);
12290
12291                     /* And adjust length and sendSz from estimates */
12292                     length += sz - sigSz;
12293                     sendSz += sz - sigSz;
12294                 }
12295
12296             done_a2:
12297         #ifdef WOLFSSL_SMALL_STACK
12298             #ifndef NO_OLD_TLS
12299                 XFREE(md5,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
12300                 XFREE(sha,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
12301             #endif
12302                 XFREE(hash,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
12303             #ifndef NO_SHA256
12304                 XFREE(sha256,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
12305                 XFREE(hash256, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12306             #endif
12307             #ifdef WOLFSSL_SHA384
12308                 XFREE(sha384,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
12309                 XFREE(hash384, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12310             #endif
12311             #ifdef WOLFSSL_SHA512
12312                 XFREE(sha512,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
12313                 XFREE(hash512, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12314             #endif
12315         #endif
12316
12317                 if (ret < 0)
12318                     goto done_a;
12319             }
12320
12321             AddHeaders(output, length, server_key_exchange, ssl);
12322
12323         #ifdef WOLFSSL_DTLS
12324             if (ssl->options.dtls)
12325                 if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
12326                     goto done_a;
12327         #endif
12328
12329             if ((ret = HashOutput(ssl, output, sendSz, 0)) != 0)
12330                 goto done_a;
12331
12332         #ifdef WOLFSSL_CALLBACKS
12333             if (ssl->hsInfoOn)
12334                 AddPacketName("ServerKeyExchange", &ssl->handShakeInfo);
12335             if (ssl->toInfoOn)
12336                 AddPacketInfo("ServerKeyExchange", &ssl->timeoutInfo,
12337                               output, sendSz, ssl->heap);
12338         #endif
12339
12340             ssl->buffers.outputBuffer.length += sendSz;
12341             if (ssl->options.groupMessages)
12342                 ret = 0;
12343             else
12344                 ret = SendBuffered(ssl);
12345             ssl->options.serverState = SERVER_KEYEXCHANGE_COMPLETE;
12346
12347         done_a:
12348         #ifdef WOLFSSL_SMALL_STACK
12349             XFREE(exportBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12350         #endif
12351
12352             return ret;
12353         }
12354     #endif /* HAVE_ECC */
12355
12356     #if !defined(NO_DH) && !defined(NO_RSA)
12357         if (ssl->specs.kea == diffie_hellman_kea) {
12358             byte    *output;
12359             word32   length = 0, idx = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
12360             int      sendSz;
12361             word32   sigSz = 0, i = 0;
12362             word32   preSigSz = 0, preSigIdx = 0;
12363             RsaKey   rsaKey;
12364             DhKey    dhKey;
12365
12366             if (ssl->buffers.serverDH_P.buffer == NULL ||
12367                 ssl->buffers.serverDH_G.buffer == NULL)
12368                 return NO_DH_PARAMS;
12369
12370             if (ssl->buffers.serverDH_Pub.buffer == NULL) {
12371                 ssl->buffers.serverDH_Pub.buffer = (byte*)XMALLOC(
12372                         ssl->buffers.serverDH_P.length + 2, ssl->ctx->heap,
12373                         DYNAMIC_TYPE_DH);
12374                 if (ssl->buffers.serverDH_Pub.buffer == NULL)
12375                     return MEMORY_E;
12376             }
12377
12378             if (ssl->buffers.serverDH_Priv.buffer == NULL) {
12379                 ssl->buffers.serverDH_Priv.buffer = (byte*)XMALLOC(
12380                         ssl->buffers.serverDH_P.length + 2, ssl->ctx->heap,
12381                         DYNAMIC_TYPE_DH);
12382                 if (ssl->buffers.serverDH_Priv.buffer == NULL)
12383                     return MEMORY_E;
12384             }
12385
12386             wc_InitDhKey(&dhKey);
12387             ret = wc_DhSetKey(&dhKey, ssl->buffers.serverDH_P.buffer,
12388                                    ssl->buffers.serverDH_P.length,
12389                                    ssl->buffers.serverDH_G.buffer,
12390                                    ssl->buffers.serverDH_G.length);
12391             if (ret == 0)
12392                 ret = wc_DhGenerateKeyPair(&dhKey, ssl->rng,
12393                                          ssl->buffers.serverDH_Priv.buffer,
12394                                         &ssl->buffers.serverDH_Priv.length,
12395                                          ssl->buffers.serverDH_Pub.buffer,
12396                                         &ssl->buffers.serverDH_Pub.length);
12397             wc_FreeDhKey(&dhKey);
12398
12399             if (ret != 0) return ret;
12400
12401             length = LENGTH_SZ * 3;  /* p, g, pub */
12402             length += ssl->buffers.serverDH_P.length +
12403                       ssl->buffers.serverDH_G.length +
12404                       ssl->buffers.serverDH_Pub.length;
12405
12406             preSigIdx = idx;
12407             preSigSz  = length;
12408
12409             if (!ssl->options.usingAnon_cipher) {
12410                 ret = wc_InitRsaKey(&rsaKey, ssl->heap);
12411                 if (ret != 0) return ret;
12412
12413                 /* sig length */
12414                 length += LENGTH_SZ;
12415
12416                 if (!ssl->buffers.key.buffer)
12417                     return NO_PRIVATE_KEY;
12418
12419                 ret = wc_RsaPrivateKeyDecode(ssl->buffers.key.buffer, &i, &rsaKey,
12420                                           ssl->buffers.key.length);
12421                 if (ret == 0) {
12422                     sigSz = wc_RsaEncryptSize(&rsaKey);
12423                     length += sigSz;
12424                 }
12425                 else {
12426                     wc_FreeRsaKey(&rsaKey);
12427                     return ret;
12428                 }
12429
12430                 if (IsAtLeastTLSv1_2(ssl))
12431                     length += HASH_SIG_SIZE;
12432             }
12433
12434             sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
12435
12436         #ifdef WOLFSSL_DTLS
12437             if (ssl->options.dtls) {
12438                 sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
12439                 idx    += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
12440                 preSigIdx = idx;
12441             }
12442         #endif
12443
12444             /* check for available size */
12445             if ((ret = CheckAvailableSize(ssl, sendSz)) != 0) {
12446                 if (!ssl->options.usingAnon_cipher)
12447                     wc_FreeRsaKey(&rsaKey);
12448                 return ret;
12449             }
12450
12451             /* get ouput buffer */
12452             output = ssl->buffers.outputBuffer.buffer +
12453                      ssl->buffers.outputBuffer.length;
12454
12455             AddHeaders(output, length, server_key_exchange, ssl);
12456
12457             /* add p, g, pub */
12458             c16toa((word16)ssl->buffers.serverDH_P.length, output + idx);
12459             idx += LENGTH_SZ;
12460             XMEMCPY(output + idx, ssl->buffers.serverDH_P.buffer,
12461                                   ssl->buffers.serverDH_P.length);
12462             idx += ssl->buffers.serverDH_P.length;
12463
12464             /*  g */
12465             c16toa((word16)ssl->buffers.serverDH_G.length, output + idx);
12466             idx += LENGTH_SZ;
12467             XMEMCPY(output + idx, ssl->buffers.serverDH_G.buffer,
12468                                   ssl->buffers.serverDH_G.length);
12469             idx += ssl->buffers.serverDH_G.length;
12470
12471             /*  pub */
12472             c16toa((word16)ssl->buffers.serverDH_Pub.length, output + idx);
12473             idx += LENGTH_SZ;
12474             XMEMCPY(output + idx, ssl->buffers.serverDH_Pub.buffer,
12475                                   ssl->buffers.serverDH_Pub.length);
12476             idx += ssl->buffers.serverDH_Pub.length;
12477
12478         #ifdef HAVE_FUZZER
12479             if (ssl->fuzzerCb)
12480                 ssl->fuzzerCb(ssl, output + preSigIdx, preSigSz, FUZZ_SIGNATURE,
12481                         ssl->fuzzerCtx);
12482         #endif
12483
12484             /* Add signature */
12485             if (!ssl->options.usingAnon_cipher) {
12486         #ifndef NO_OLD_TLS
12487             #ifdef WOLFSSL_SMALL_STACK
12488                 Md5*   md5  = NULL;
12489                 Sha*   sha  = NULL;
12490             #else
12491                 Md5    md5[1];
12492                 Sha    sha[1];
12493             #endif
12494         #endif
12495             #ifdef WOLFSSL_SMALL_STACK
12496                 byte*  hash = NULL;
12497             #else
12498                 byte   hash[FINISHED_SZ];
12499             #endif
12500         #ifndef NO_SHA256
12501             #ifdef WOLFSSL_SMALL_STACK
12502                 Sha256* sha256  = NULL;
12503                 byte*   hash256 = NULL;
12504             #else
12505                 Sha256  sha256[1];
12506                 byte    hash256[SHA256_DIGEST_SIZE];
12507             #endif
12508         #endif
12509         #ifdef WOLFSSL_SHA384
12510             #ifdef WOLFSSL_SMALL_STACK
12511                 Sha384* sha384  = NULL;
12512                 byte*   hash384 = NULL;
12513             #else
12514                 Sha384  sha384[1];
12515                 byte    hash384[SHA384_DIGEST_SIZE];
12516             #endif
12517         #endif
12518         #ifdef WOLFSSL_SHA512
12519             #ifdef WOLFSSL_SMALL_STACK
12520                 Sha512* sha512  = NULL;
12521                 byte*   hash512 = NULL;
12522             #else
12523                 Sha512  sha512[1];
12524                 byte    hash512[SHA512_DIGEST_SIZE];
12525             #endif
12526         #endif
12527
12528         #ifndef NO_OLD_TLS
12529             byte doMd5 = 0;
12530             byte doSha = 0;
12531         #endif
12532         #ifndef NO_SHA256
12533             byte doSha256 = 0;
12534         #endif
12535         #ifdef WOLFSSL_SHA384
12536             byte doSha384 = 0;
12537         #endif
12538         #ifdef WOLFSSL_SHA512
12539             byte doSha512 = 0;
12540         #endif
12541
12542             /* Add hash/signature algo ID */
12543             if (IsAtLeastTLSv1_2(ssl)) {
12544                 byte setHash = 0;
12545
12546                 output[idx++] = ssl->suites->hashAlgo;
12547                 output[idx++] = ssl->suites->sigAlgo;
12548
12549                 switch (ssl->suites->hashAlgo) {
12550                     case sha512_mac:
12551                         #ifdef WOLFSSL_SHA512
12552                             doSha512 = 1;
12553                             setHash  = 1;
12554                         #endif
12555                         break;
12556
12557                     case sha384_mac:
12558                         #ifdef WOLFSSL_SHA384
12559                             doSha384 = 1;
12560                             setHash  = 1;
12561                         #endif
12562                         break;
12563
12564                     case sha256_mac:
12565                         #ifndef NO_SHA256
12566                             doSha256 = 1;
12567                             setHash  = 1;
12568                         #endif
12569                         break;
12570
12571                     case sha_mac:
12572                         #ifndef NO_OLD_TLS
12573                             doSha = 1;
12574                             setHash  = 1;
12575                         #endif
12576                         break;
12577
12578                     default:
12579                         WOLFSSL_MSG("Bad hash sig algo");
12580                         break;
12581                 }
12582
12583                 if (setHash == 0) {
12584                     wc_FreeRsaKey(&rsaKey);
12585                     return ALGO_ID_E;
12586                 }
12587             } else {
12588                 /* only using sha and md5 for rsa */
12589                 #ifndef NO_OLD_TLS
12590                     doSha = 1;
12591                     if (ssl->suites->sigAlgo == rsa_sa_algo) {
12592                         doMd5 = 1;
12593                     }
12594                 #else
12595                     wc_FreeRsaKey(&rsaKey);
12596                     return ALGO_ID_E;
12597                 #endif
12598             }
12599
12600             /* signature size */
12601             c16toa((word16)sigSz, output + idx);
12602             idx += LENGTH_SZ;
12603
12604             /* do signature */
12605             #ifdef WOLFSSL_SMALL_STACK
12606                 hash = (byte*)XMALLOC(FINISHED_SZ, NULL,
12607                                                        DYNAMIC_TYPE_TMP_BUFFER);
12608                 if (hash == NULL)
12609                     return MEMORY_E; /* No heap commitment before this point,
12610                                         from now on, the resources are freed
12611                                         at done_b. */
12612             #endif
12613
12614         #ifndef NO_OLD_TLS
12615                 /* md5 */
12616             #ifdef WOLFSSL_SMALL_STACK
12617                 if (doMd5) {
12618                     md5 = (Md5*)XMALLOC(sizeof(Md5), NULL,
12619                                         DYNAMIC_TYPE_TMP_BUFFER);
12620                     if (md5 == NULL)
12621                         ERROR_OUT(MEMORY_E, done_b);
12622                 }
12623             #endif
12624                 if (doMd5) {
12625                     wc_InitMd5(md5);
12626                     wc_Md5Update(md5, ssl->arrays->clientRandom, RAN_LEN);
12627                     wc_Md5Update(md5, ssl->arrays->serverRandom, RAN_LEN);
12628                     wc_Md5Update(md5, output + preSigIdx, preSigSz);
12629                     wc_Md5Final(md5, hash);
12630                 }
12631
12632                 /* sha */
12633             #ifdef WOLFSSL_SMALL_STACK
12634                 if (doSha) {
12635                     sha = (Sha*)XMALLOC(sizeof(Sha), NULL,
12636                                         DYNAMIC_TYPE_TMP_BUFFER);
12637                     if (sha == NULL)
12638                         ERROR_OUT(MEMORY_E, done_b);
12639                 }
12640             #endif
12641
12642                 if (doSha) {
12643                     if ((ret = wc_InitSha(sha)) != 0)
12644                         goto done_b;
12645                     wc_ShaUpdate(sha, ssl->arrays->clientRandom, RAN_LEN);
12646                     wc_ShaUpdate(sha, ssl->arrays->serverRandom, RAN_LEN);
12647                     wc_ShaUpdate(sha, output + preSigIdx, preSigSz);
12648                     wc_ShaFinal(sha, &hash[MD5_DIGEST_SIZE]);
12649                 }
12650         #endif
12651
12652         #ifndef NO_SHA256
12653             #ifdef WOLFSSL_SMALL_STACK
12654                 if (doSha256) {
12655                     sha256 = (Sha256*)XMALLOC(sizeof(Sha256), NULL,
12656                                               DYNAMIC_TYPE_TMP_BUFFER);
12657                     hash256 = (byte*)XMALLOC(SHA256_DIGEST_SIZE, NULL,
12658                                              DYNAMIC_TYPE_TMP_BUFFER);
12659                     if (sha256 == NULL || hash256 == NULL)
12660                         ERROR_OUT(MEMORY_E, done_b);
12661                 }
12662             #endif
12663
12664                 if (doSha256) {
12665                     if (!(ret = wc_InitSha256(sha256))
12666                     &&  !(ret = wc_Sha256Update(sha256,
12667                                             ssl->arrays->clientRandom, RAN_LEN))
12668                     &&  !(ret = wc_Sha256Update(sha256,
12669                                             ssl->arrays->serverRandom, RAN_LEN))
12670                     &&  !(ret = wc_Sha256Update(sha256,
12671                                             output + preSigIdx, preSigSz)))
12672                         ret = wc_Sha256Final(sha256, hash256);
12673
12674                     if (ret != 0) goto done_b;
12675                 }
12676             #endif
12677
12678         #ifdef WOLFSSL_SHA384
12679             #ifdef WOLFSSL_SMALL_STACK
12680                 if (doSha384) {
12681                     sha384 = (Sha384*)XMALLOC(sizeof(Sha384), NULL,
12682                                               DYNAMIC_TYPE_TMP_BUFFER);
12683                     hash384 = (byte*)XMALLOC(SHA384_DIGEST_SIZE, NULL,
12684                                              DYNAMIC_TYPE_TMP_BUFFER);
12685                     if (sha384 == NULL || hash384 == NULL)
12686                         ERROR_OUT(MEMORY_E, done_b);
12687                 }
12688             #endif
12689
12690                 if (doSha384) {
12691                     if (!(ret = wc_InitSha384(sha384))
12692                     &&  !(ret = wc_Sha384Update(sha384,
12693                                             ssl->arrays->clientRandom, RAN_LEN))
12694                     &&  !(ret = wc_Sha384Update(sha384,
12695                                             ssl->arrays->serverRandom, RAN_LEN))
12696                     &&  !(ret = wc_Sha384Update(sha384,
12697                                             output + preSigIdx, preSigSz)))
12698                         ret = wc_Sha384Final(sha384, hash384);
12699
12700                     if (ret != 0) goto done_b;
12701                 }
12702         #endif
12703
12704         #ifdef WOLFSSL_SHA512
12705             #ifdef WOLFSSL_SMALL_STACK
12706                 if (doSha512) {
12707                     sha512 = (Sha512*)XMALLOC(sizeof(Sha512), NULL,
12708                                               DYNAMIC_TYPE_TMP_BUFFER);
12709                     hash512 = (byte*)XMALLOC(SHA512_DIGEST_SIZE, NULL,
12710                                              DYNAMIC_TYPE_TMP_BUFFER);
12711                     if (sha512 == NULL || hash512 == NULL)
12712                         ERROR_OUT(MEMORY_E, done_b);
12713                 }
12714             #endif
12715
12716                 if (doSha512) {
12717                     if (!(ret = wc_InitSha512(sha512))
12718                     &&  !(ret = wc_Sha512Update(sha512,
12719                                             ssl->arrays->clientRandom, RAN_LEN))
12720                     &&  !(ret = wc_Sha512Update(sha512,
12721                                             ssl->arrays->serverRandom, RAN_LEN))
12722                     &&  !(ret = wc_Sha512Update(sha512,
12723                                             output + preSigIdx, preSigSz)))
12724                         ret = wc_Sha512Final(sha512, hash512);
12725
12726                     if (ret != 0) goto done_b;
12727                 }
12728         #endif
12729
12730             #ifndef NO_RSA
12731                 if (ssl->suites->sigAlgo == rsa_sa_algo) {
12732                     byte*  signBuffer = hash;
12733                     word32 signSz     = FINISHED_SZ;
12734                 #ifdef WOLFSSL_SMALL_STACK
12735                     byte*  encodedSig = NULL;
12736                 #else
12737                     byte   encodedSig[MAX_ENCODED_SIG_SZ];
12738                 #endif
12739                     byte   doUserRsa = 0;
12740
12741                 #ifdef HAVE_PK_CALLBACKS
12742                     if (ssl->ctx->RsaSignCb)
12743                         doUserRsa = 1;
12744                 #endif
12745
12746                 #ifdef WOLFSSL_SMALL_STACK
12747                     encodedSig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ, NULL,
12748                                                        DYNAMIC_TYPE_TMP_BUFFER);
12749                     if (encodedSig == NULL)
12750                         ERROR_OUT(MEMORY_E, done_b);
12751                 #endif
12752
12753                     if (IsAtLeastTLSv1_2(ssl)) {
12754                         byte* digest   = &hash[MD5_DIGEST_SIZE];
12755                         int   typeH    = SHAh;
12756                         int   digestSz = SHA_DIGEST_SIZE;
12757
12758                         if (ssl->suites->hashAlgo == sha256_mac) {
12759                         #ifndef NO_SHA256
12760                             digest   = hash256;
12761                             typeH    = SHA256h;
12762                             digestSz = SHA256_DIGEST_SIZE;
12763                         #endif
12764                         }
12765                         else if (ssl->suites->hashAlgo == sha384_mac) {
12766                         #ifdef WOLFSSL_SHA384
12767                             digest   = hash384;
12768                             typeH    = SHA384h;
12769                             digestSz = SHA384_DIGEST_SIZE;
12770                         #endif
12771                         }
12772                         else if (ssl->suites->hashAlgo == sha512_mac) {
12773                         #ifdef WOLFSSL_SHA512
12774                             digest   = hash512;
12775                             typeH    = SHA512h;
12776                             digestSz = SHA512_DIGEST_SIZE;
12777                         #endif
12778                         }
12779
12780                         if (digest == NULL) {
12781                             ret = ALGO_ID_E;
12782                         } else {
12783                             signSz = wc_EncodeSignature(encodedSig, digest,
12784                                                         digestSz, typeH);
12785                             signBuffer = encodedSig;
12786                         }
12787                     }
12788                     if (doUserRsa && ret == 0) {
12789                     #ifdef HAVE_PK_CALLBACKS
12790                         word32 ioLen = sigSz;
12791                         ret = ssl->ctx->RsaSignCb(ssl, signBuffer, signSz,
12792                                                   output + idx, &ioLen,
12793                                                   ssl->buffers.key.buffer,
12794                                                   ssl->buffers.key.length,
12795                                                   ssl->RsaSignCtx);
12796                     #endif
12797                     } else if (ret == 0) {
12798                         ret = wc_RsaSSL_Sign(signBuffer, signSz, output + idx,
12799                                           sigSz, &rsaKey, ssl->rng);
12800                     }
12801
12802                     wc_FreeRsaKey(&rsaKey);
12803
12804                 #ifdef WOLFSSL_SMALL_STACK
12805                     XFREE(encodedSig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12806                 #endif
12807                 }
12808             #endif
12809
12810             done_b:
12811         #ifdef WOLFSSL_SMALL_STACK
12812             #ifndef NO_OLD_TLS
12813                 XFREE(md5,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
12814                 XFREE(sha,     NULL, DYNAMIC_TYPE_TMP_BUFFER);
12815             #endif
12816                 XFREE(hash,    NULL, DYNAMIC_TYPE_TMP_BUFFER);
12817             #ifndef NO_SHA256
12818                 XFREE(sha256,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
12819                 XFREE(hash256, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12820             #endif
12821             #ifdef WOLFSSL_SHA384
12822                 XFREE(sha384,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
12823                 XFREE(hash384, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12824             #endif
12825             #ifdef WOLFSSL_SHA512
12826                 XFREE(sha512,  NULL, DYNAMIC_TYPE_TMP_BUFFER);
12827                 XFREE(hash512, NULL, DYNAMIC_TYPE_TMP_BUFFER);
12828             #endif
12829         #endif
12830
12831                 if (ret < 0) return ret;
12832             }
12833
12834         #ifdef WOLFSSL_DTLS
12835             if (ssl->options.dtls)
12836                 if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
12837                     return ret;
12838         #endif
12839
12840             if ((ret = HashOutput(ssl, output, sendSz, 0)) != 0)
12841                 return ret;
12842
12843         #ifdef WOLFSSL_CALLBACKS
12844             if (ssl->hsInfoOn)
12845                 AddPacketName("ServerKeyExchange", &ssl->handShakeInfo);
12846             if (ssl->toInfoOn)
12847                 AddPacketInfo("ServerKeyExchange", &ssl->timeoutInfo,
12848                               output, sendSz, ssl->heap);
12849         #endif
12850
12851             ssl->buffers.outputBuffer.length += sendSz;
12852             if (ssl->options.groupMessages)
12853                 ret = 0;
12854             else
12855                 ret = SendBuffered(ssl);
12856             ssl->options.serverState = SERVER_KEYEXCHANGE_COMPLETE;
12857         }
12858     #endif /* NO_DH */
12859
12860         return ret;
12861         #undef ERROR_OUT
12862     }
12863
12864
12865     /* Make sure server cert/key are valid for this suite, true on success */
12866     static int VerifyServerSuite(WOLFSSL* ssl, word16 idx)
12867     {
12868         int  haveRSA = !ssl->options.haveStaticECC;
12869         int  havePSK = 0;
12870         byte first;
12871         byte second;
12872
12873         WOLFSSL_ENTER("VerifyServerSuite");
12874
12875         if (ssl->suites == NULL) {
12876             WOLFSSL_MSG("Suites pointer error");
12877             return 0;
12878         }
12879
12880         first   = ssl->suites->suites[idx];
12881         second  = ssl->suites->suites[idx+1];
12882
12883         #ifndef NO_PSK
12884             havePSK = ssl->options.havePSK;
12885         #endif
12886
12887         if (ssl->options.haveNTRU)
12888             haveRSA = 0;
12889
12890         if (CipherRequires(first, second, REQUIRES_RSA)) {
12891             WOLFSSL_MSG("Requires RSA");
12892             if (haveRSA == 0) {
12893                 WOLFSSL_MSG("Don't have RSA");
12894                 return 0;
12895             }
12896         }
12897
12898         if (CipherRequires(first, second, REQUIRES_DHE)) {
12899             WOLFSSL_MSG("Requires DHE");
12900             if (ssl->options.haveDH == 0) {
12901                 WOLFSSL_MSG("Don't have DHE");
12902                 return 0;
12903             }
12904         }
12905
12906         if (CipherRequires(first, second, REQUIRES_ECC_DSA)) {
12907             WOLFSSL_MSG("Requires ECCDSA");
12908             if (ssl->options.haveECDSAsig == 0) {
12909                 WOLFSSL_MSG("Don't have ECCDSA");
12910                 return 0;
12911             }
12912         }
12913
12914         if (CipherRequires(first, second, REQUIRES_ECC_STATIC)) {
12915             WOLFSSL_MSG("Requires static ECC");
12916             if (ssl->options.haveStaticECC == 0) {
12917                 WOLFSSL_MSG("Don't have static ECC");
12918                 return 0;
12919             }
12920         }
12921
12922         if (CipherRequires(first, second, REQUIRES_PSK)) {
12923             WOLFSSL_MSG("Requires PSK");
12924             if (havePSK == 0) {
12925                 WOLFSSL_MSG("Don't have PSK");
12926                 return 0;
12927             }
12928         }
12929
12930         if (CipherRequires(first, second, REQUIRES_NTRU)) {
12931             WOLFSSL_MSG("Requires NTRU");
12932             if (ssl->options.haveNTRU == 0) {
12933                 WOLFSSL_MSG("Don't have NTRU");
12934                 return 0;
12935             }
12936         }
12937
12938         if (CipherRequires(first, second, REQUIRES_RSA_SIG)) {
12939             WOLFSSL_MSG("Requires RSA Signature");
12940             if (ssl->options.side == WOLFSSL_SERVER_END &&
12941                                            ssl->options.haveECDSAsig == 1) {
12942                 WOLFSSL_MSG("Don't have RSA Signature");
12943                 return 0;
12944             }
12945         }
12946
12947 #ifdef HAVE_SUPPORTED_CURVES
12948         if (!TLSX_ValidateEllipticCurves(ssl, first, second)) {
12949             WOLFSSL_MSG("Don't have matching curves");
12950                 return 0;
12951         }
12952 #endif
12953
12954         /* ECCDHE is always supported if ECC on */
12955
12956         return 1;
12957     }
12958
12959
12960     static int MatchSuite(WOLFSSL* ssl, Suites* peerSuites)
12961     {
12962         word16 i, j;
12963
12964         WOLFSSL_ENTER("MatchSuite");
12965
12966         /* & 0x1 equivalent % 2 */
12967         if (peerSuites->suiteSz == 0 || peerSuites->suiteSz & 0x1)
12968             return MATCH_SUITE_ERROR;
12969
12970         if (ssl->suites == NULL)
12971             return SUITES_ERROR;
12972         /* start with best, if a match we are good */
12973         for (i = 0; i < ssl->suites->suiteSz; i += 2)
12974             for (j = 0; j < peerSuites->suiteSz; j += 2)
12975                 if (ssl->suites->suites[i]   == peerSuites->suites[j] &&
12976                     ssl->suites->suites[i+1] == peerSuites->suites[j+1] ) {
12977
12978                     if (VerifyServerSuite(ssl, i)) {
12979                         int result;
12980                         WOLFSSL_MSG("Verified suite validity");
12981                         ssl->options.cipherSuite0 = ssl->suites->suites[i];
12982                         ssl->options.cipherSuite  = ssl->suites->suites[i+1];
12983                         result = SetCipherSpecs(ssl);
12984                         if (result == 0)
12985                             PickHashSigAlgo(ssl, peerSuites->hashSigAlgo,
12986                                                  peerSuites->hashSigAlgoSz);
12987                         return result;
12988                     }
12989                     else {
12990                         WOLFSSL_MSG("Could not verify suite validity, continue");
12991                     }
12992                 }
12993
12994         return MATCH_SUITE_ERROR;
12995     }
12996
12997
12998 #ifdef OLD_HELLO_ALLOWED
12999
13000     /* process old style client hello, deprecate? */
13001     int ProcessOldClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
13002                               word32 inSz, word16 sz)
13003     {
13004         word32          idx = *inOutIdx;
13005         word16          sessionSz;
13006         word16          randomSz;
13007         word16          i, j;
13008         ProtocolVersion pv;
13009         Suites          clSuites;
13010
13011         (void)inSz;
13012         WOLFSSL_MSG("Got old format client hello");
13013 #ifdef WOLFSSL_CALLBACKS
13014         if (ssl->hsInfoOn)
13015             AddPacketName("ClientHello", &ssl->handShakeInfo);
13016         if (ssl->toInfoOn)
13017             AddLateName("ClientHello", &ssl->timeoutInfo);
13018 #endif
13019
13020         /* manually hash input since different format */
13021 #ifndef NO_OLD_TLS
13022 #ifndef NO_MD5
13023         wc_Md5Update(&ssl->hsHashes->hashMd5, input + idx, sz);
13024 #endif
13025 #ifndef NO_SHA
13026         wc_ShaUpdate(&ssl->hsHashes->hashSha, input + idx, sz);
13027 #endif
13028 #endif
13029 #ifndef NO_SHA256
13030         if (IsAtLeastTLSv1_2(ssl)) {
13031             int shaRet = wc_Sha256Update(&ssl->hsHashes->hashSha256,
13032                                          input + idx, sz);
13033             if (shaRet != 0)
13034                 return shaRet;
13035         }
13036 #endif
13037
13038         /* does this value mean client_hello? */
13039         idx++;
13040
13041         /* version */
13042         pv.major = input[idx++];
13043         pv.minor = input[idx++];
13044         ssl->chVersion = pv;  /* store */
13045
13046         if (ssl->version.minor > pv.minor) {
13047             byte haveRSA = 0;
13048             byte havePSK = 0;
13049             if (!ssl->options.downgrade) {
13050                 WOLFSSL_MSG("Client trying to connect with lesser version");
13051                 return VERSION_ERROR;
13052             }
13053             if (pv.minor < ssl->options.minDowngrade) {
13054                 WOLFSSL_MSG("    version below minimum allowed, fatal error");
13055                 return VERSION_ERROR;
13056             }
13057             if (pv.minor == SSLv3_MINOR) {
13058                 /* turn off tls */
13059                 WOLFSSL_MSG("    downgrading to SSLv3");
13060                 ssl->options.tls    = 0;
13061                 ssl->options.tls1_1 = 0;
13062                 ssl->version.minor  = SSLv3_MINOR;
13063             }
13064             else if (pv.minor == TLSv1_MINOR) {
13065                 WOLFSSL_MSG("    downgrading to TLSv1");
13066                 /* turn off tls 1.1+ */
13067                 ssl->options.tls1_1 = 0;
13068                 ssl->version.minor  = TLSv1_MINOR;
13069             }
13070             else if (pv.minor == TLSv1_1_MINOR) {
13071                 WOLFSSL_MSG("    downgrading to TLSv1.1");
13072                 ssl->version.minor  = TLSv1_1_MINOR;
13073             }
13074 #ifndef NO_RSA
13075             haveRSA = 1;
13076 #endif
13077 #ifndef NO_PSK
13078             havePSK = ssl->options.havePSK;
13079 #endif
13080
13081             InitSuites(ssl->suites, ssl->version, haveRSA, havePSK,
13082                        ssl->options.haveDH, ssl->options.haveNTRU,
13083                        ssl->options.haveECDSAsig, ssl->options.haveStaticECC,
13084                        ssl->options.side);
13085         }
13086
13087         /* suite size */
13088         ato16(&input[idx], &clSuites.suiteSz);
13089         idx += 2;
13090
13091         if (clSuites.suiteSz > MAX_SUITE_SZ)
13092             return BUFFER_ERROR;
13093         clSuites.hashSigAlgoSz = 0;
13094
13095         /* session size */
13096         ato16(&input[idx], &sessionSz);
13097         idx += 2;
13098
13099         if (sessionSz > ID_LEN)
13100             return BUFFER_ERROR;
13101
13102         /* random size */
13103         ato16(&input[idx], &randomSz);
13104         idx += 2;
13105
13106         if (randomSz > RAN_LEN)
13107             return BUFFER_ERROR;
13108
13109         /* suites */
13110         for (i = 0, j = 0; i < clSuites.suiteSz; i += 3) {
13111             byte first = input[idx++];
13112             if (!first) { /* implicit: skip sslv2 type */
13113                 XMEMCPY(&clSuites.suites[j], &input[idx], 2);
13114                 j += 2;
13115             }
13116             idx += 2;
13117         }
13118         clSuites.suiteSz = j;
13119
13120         /* session id */
13121         if (sessionSz) {
13122             XMEMCPY(ssl->arrays->sessionID, input + idx, sessionSz);
13123             ssl->arrays->sessionIDSz = (byte)sessionSz;
13124             idx += sessionSz;
13125             ssl->options.resuming = 1;
13126         }
13127
13128         /* random */
13129         if (randomSz < RAN_LEN)
13130             XMEMSET(ssl->arrays->clientRandom, 0, RAN_LEN - randomSz);
13131         XMEMCPY(&ssl->arrays->clientRandom[RAN_LEN - randomSz], input + idx,
13132                randomSz);
13133         idx += randomSz;
13134
13135         if (ssl->options.usingCompression)
13136             ssl->options.usingCompression = 0;  /* turn off */
13137
13138         ssl->options.clientState = CLIENT_HELLO_COMPLETE;
13139         *inOutIdx = idx;
13140
13141         ssl->options.haveSessionId = 1;
13142         /* DoClientHello uses same resume code */
13143         if (ssl->options.resuming) {  /* let's try */
13144             int ret = -1;
13145             WOLFSSL_SESSION* session = GetSession(ssl,
13146                                                   ssl->arrays->masterSecret);
13147             #ifdef HAVE_SESSION_TICKET
13148                 if (ssl->options.useTicket == 1) {
13149                     session = &ssl->session;
13150                 }
13151             #endif
13152
13153             if (!session) {
13154                 WOLFSSL_MSG("Session lookup for resume failed");
13155                 ssl->options.resuming = 0;
13156             } else {
13157                 if (MatchSuite(ssl, &clSuites) < 0) {
13158                     WOLFSSL_MSG("Unsupported cipher suite, OldClientHello");
13159                     return UNSUPPORTED_SUITE;
13160                 }
13161                 #ifdef SESSION_CERTS
13162                     ssl->session = *session; /* restore session certs. */
13163                 #endif
13164
13165                 ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom,
13166                                                                        RAN_LEN);
13167                 if (ret != 0)
13168                     return ret;
13169
13170                 #ifdef NO_OLD_TLS
13171                     ret = DeriveTlsKeys(ssl);
13172                 #else
13173                     #ifndef NO_TLS
13174                         if (ssl->options.tls)
13175                             ret = DeriveTlsKeys(ssl);
13176                     #endif
13177                         if (!ssl->options.tls)
13178                             ret = DeriveKeys(ssl);
13179                 #endif
13180                 ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
13181
13182                 return ret;
13183             }
13184         }
13185
13186         return MatchSuite(ssl, &clSuites);
13187     }
13188
13189 #endif /* OLD_HELLO_ALLOWED */
13190
13191
13192     static int DoClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
13193                              word32 helloSz)
13194     {
13195         byte            b;
13196         ProtocolVersion pv;
13197         Suites          clSuites;
13198         word32          i = *inOutIdx;
13199         word32          begin = i;
13200
13201 #ifdef WOLFSSL_CALLBACKS
13202         if (ssl->hsInfoOn) AddPacketName("ClientHello", &ssl->handShakeInfo);
13203         if (ssl->toInfoOn) AddLateName("ClientHello", &ssl->timeoutInfo);
13204 #endif
13205
13206         /* protocol version, random and session id length check */
13207         if ((i - begin) + OPAQUE16_LEN + RAN_LEN + OPAQUE8_LEN > helloSz)
13208             return BUFFER_ERROR;
13209
13210         /* protocol version */
13211         XMEMCPY(&pv, input + i, OPAQUE16_LEN);
13212         ssl->chVersion = pv;   /* store */
13213         i += OPAQUE16_LEN;
13214
13215         if (ssl->version.minor > pv.minor) {
13216             byte haveRSA = 0;
13217             byte havePSK = 0;
13218
13219             if (!ssl->options.downgrade) {
13220                 WOLFSSL_MSG("Client trying to connect with lesser version");
13221                 return VERSION_ERROR;
13222             }
13223             if (pv.minor < ssl->options.minDowngrade) {
13224                 WOLFSSL_MSG("    version below minimum allowed, fatal error");
13225                 return VERSION_ERROR;
13226             }
13227
13228             if (pv.minor == SSLv3_MINOR) {
13229                 /* turn off tls */
13230                 WOLFSSL_MSG("    downgrading to SSLv3");
13231                 ssl->options.tls    = 0;
13232                 ssl->options.tls1_1 = 0;
13233                 ssl->version.minor  = SSLv3_MINOR;
13234             }
13235             else if (pv.minor == TLSv1_MINOR) {
13236                 /* turn off tls 1.1+ */
13237                 WOLFSSL_MSG("    downgrading to TLSv1");
13238                 ssl->options.tls1_1 = 0;
13239                 ssl->version.minor  = TLSv1_MINOR;
13240             }
13241             else if (pv.minor == TLSv1_1_MINOR) {
13242                 WOLFSSL_MSG("    downgrading to TLSv1.1");
13243                 ssl->version.minor  = TLSv1_1_MINOR;
13244             }
13245 #ifndef NO_RSA
13246             haveRSA = 1;
13247 #endif
13248 #ifndef NO_PSK
13249             havePSK = ssl->options.havePSK;
13250 #endif
13251             InitSuites(ssl->suites, ssl->version, haveRSA, havePSK,
13252                        ssl->options.haveDH, ssl->options.haveNTRU,
13253                        ssl->options.haveECDSAsig, ssl->options.haveStaticECC,
13254                        ssl->options.side);
13255         }
13256
13257         /* random */
13258         XMEMCPY(ssl->arrays->clientRandom, input + i, RAN_LEN);
13259         i += RAN_LEN;
13260
13261 #ifdef SHOW_SECRETS
13262         {
13263             int j;
13264             printf("client random: ");
13265             for (j = 0; j < RAN_LEN; j++)
13266                 printf("%02x", ssl->arrays->clientRandom[j]);
13267             printf("\n");
13268         }
13269 #endif
13270
13271         /* session id */
13272         b = input[i++];
13273
13274         if (b == ID_LEN) {
13275             if ((i - begin) + ID_LEN > helloSz)
13276                 return BUFFER_ERROR;
13277
13278             XMEMCPY(ssl->arrays->sessionID, input + i, ID_LEN);
13279             ssl->arrays->sessionIDSz = ID_LEN;
13280             i += ID_LEN;
13281             ssl->options.resuming = 1; /* client wants to resume */
13282             WOLFSSL_MSG("Client wants to resume session");
13283         }
13284         else if (b) {
13285             WOLFSSL_MSG("Invalid session ID size");
13286             return BUFFER_ERROR; /* session ID nor 0 neither 32 bytes long */
13287         }
13288
13289         #ifdef WOLFSSL_DTLS
13290             /* cookie */
13291             if (ssl->options.dtls) {
13292
13293                 if ((i - begin) + OPAQUE8_LEN > helloSz)
13294                     return BUFFER_ERROR;
13295
13296                 b = input[i++];
13297
13298                 if (b) {
13299                     byte cookie[MAX_COOKIE_LEN];
13300
13301                     if (b > MAX_COOKIE_LEN)
13302                         return BUFFER_ERROR;
13303
13304                     if ((i - begin) + b > helloSz)
13305                         return BUFFER_ERROR;
13306
13307                     if (ssl->ctx->CBIOCookie == NULL) {
13308                         WOLFSSL_MSG("Your Cookie callback is null, please set");
13309                         return COOKIE_ERROR;
13310                     }
13311
13312                     if ((ssl->ctx->CBIOCookie(ssl, cookie, COOKIE_SZ,
13313                                               ssl->IOCB_CookieCtx) != COOKIE_SZ)
13314                             || (b != COOKIE_SZ)
13315                             || (XMEMCMP(cookie, input + i, b) != 0)) {
13316                         return COOKIE_ERROR;
13317                     }
13318
13319                     i += b;
13320                 }
13321             }
13322         #endif
13323
13324         /* suites */
13325         if ((i - begin) + OPAQUE16_LEN > helloSz)
13326             return BUFFER_ERROR;
13327
13328         ato16(&input[i], &clSuites.suiteSz);
13329         i += OPAQUE16_LEN;
13330
13331         /* suites and compression length check */
13332         if ((i - begin) + clSuites.suiteSz + OPAQUE8_LEN > helloSz)
13333             return BUFFER_ERROR;
13334
13335         if (clSuites.suiteSz > MAX_SUITE_SZ)
13336             return BUFFER_ERROR;
13337
13338         XMEMCPY(clSuites.suites, input + i, clSuites.suiteSz);
13339         i += clSuites.suiteSz;
13340         clSuites.hashSigAlgoSz = 0;
13341
13342         /* compression length */
13343         b = input[i++];
13344
13345         if ((i - begin) + b > helloSz)
13346             return BUFFER_ERROR;
13347
13348         if (ssl->options.usingCompression) {
13349             int match = 0;
13350
13351             while (b--) {
13352                 byte comp = input[i++];
13353
13354                 if (comp == ZLIB_COMPRESSION)
13355                     match = 1;
13356             }
13357
13358             if (!match) {
13359                 WOLFSSL_MSG("Not matching compression, turning off");
13360                 ssl->options.usingCompression = 0;  /* turn off */
13361             }
13362         }
13363         else
13364             i += b; /* ignore, since we're not on */
13365
13366         *inOutIdx = i;
13367
13368         /* tls extensions */
13369         if ((i - begin) < helloSz) {
13370 #ifdef HAVE_TLS_EXTENSIONS
13371             if (TLSX_SupportExtensions(ssl)) {
13372                 int ret = 0;
13373 #else
13374             if (IsAtLeastTLSv1_2(ssl)) {
13375 #endif
13376                 /* Process the hello extension. Skip unsupported. */
13377                 word16 totalExtSz;
13378
13379                 if ((i - begin) + OPAQUE16_LEN > helloSz)
13380                     return BUFFER_ERROR;
13381
13382                 ato16(&input[i], &totalExtSz);
13383                 i += OPAQUE16_LEN;
13384
13385                 if ((i - begin) + totalExtSz > helloSz)
13386                     return BUFFER_ERROR;
13387
13388 #ifdef HAVE_TLS_EXTENSIONS
13389                 if ((ret = TLSX_Parse(ssl, (byte *) input + i,
13390                                                      totalExtSz, 1, &clSuites)))
13391                     return ret;
13392
13393                 i += totalExtSz;
13394 #else
13395                 while (totalExtSz) {
13396                     word16 extId, extSz;
13397
13398                     if (OPAQUE16_LEN + OPAQUE16_LEN > totalExtSz)
13399                         return BUFFER_ERROR;
13400
13401                     ato16(&input[i], &extId);
13402                     i += OPAQUE16_LEN;
13403                     ato16(&input[i], &extSz);
13404                     i += OPAQUE16_LEN;
13405
13406                     if (OPAQUE16_LEN + OPAQUE16_LEN + extSz > totalExtSz)
13407                         return BUFFER_ERROR;
13408
13409                     if (extId == HELLO_EXT_SIG_ALGO) {
13410                         ato16(&input[i], &clSuites.hashSigAlgoSz);
13411                         i += OPAQUE16_LEN;
13412
13413                         if (OPAQUE16_LEN + clSuites.hashSigAlgoSz > extSz)
13414                             return BUFFER_ERROR;
13415
13416                         XMEMCPY(clSuites.hashSigAlgo, &input[i],
13417                             min(clSuites.hashSigAlgoSz, HELLO_EXT_SIGALGO_MAX));
13418                         i += clSuites.hashSigAlgoSz;
13419
13420                         if (clSuites.hashSigAlgoSz > HELLO_EXT_SIGALGO_MAX)
13421                             clSuites.hashSigAlgoSz = HELLO_EXT_SIGALGO_MAX;
13422                     }
13423                     else
13424                         i += extSz;
13425
13426                     totalExtSz -= OPAQUE16_LEN + OPAQUE16_LEN + extSz;
13427                 }
13428 #endif
13429                 *inOutIdx = i;
13430             }
13431             else
13432                 *inOutIdx = begin + helloSz; /* skip extensions */
13433         }
13434
13435         ssl->options.clientState   = CLIENT_HELLO_COMPLETE;
13436         ssl->options.haveSessionId = 1;
13437
13438         /* ProcessOld uses same resume code */
13439         if (ssl->options.resuming && (!ssl->options.dtls ||
13440                ssl->options.acceptState == HELLO_VERIFY_SENT)) { /* let's try */
13441             int ret = -1;
13442             WOLFSSL_SESSION* session = GetSession(ssl,
13443                                                   ssl->arrays->masterSecret);
13444             #ifdef HAVE_SESSION_TICKET
13445                 if (ssl->options.useTicket == 1) {
13446                     session = &ssl->session;
13447                 }
13448             #endif
13449
13450             if (!session) {
13451                 WOLFSSL_MSG("Session lookup for resume failed");
13452                 ssl->options.resuming = 0;
13453             }
13454             else {
13455                 if (MatchSuite(ssl, &clSuites) < 0) {
13456                     WOLFSSL_MSG("Unsupported cipher suite, ClientHello");
13457                     return UNSUPPORTED_SUITE;
13458                 }
13459                 #ifdef SESSION_CERTS
13460                     ssl->session = *session; /* restore session certs. */
13461                 #endif
13462
13463                 ret = wc_RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom,
13464                                                                        RAN_LEN);
13465                 if (ret != 0)
13466                     return ret;
13467
13468                 #ifdef NO_OLD_TLS
13469                     ret = DeriveTlsKeys(ssl);
13470                 #else
13471                     #ifndef NO_TLS
13472                         if (ssl->options.tls)
13473                             ret = DeriveTlsKeys(ssl);
13474                     #endif
13475                         if (!ssl->options.tls)
13476                             ret = DeriveKeys(ssl);
13477                 #endif
13478                 ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
13479
13480                 return ret;
13481             }
13482         }
13483         return MatchSuite(ssl, &clSuites);
13484     }
13485
13486 #if !defined(NO_RSA) || defined(HAVE_ECC)
13487     static int DoCertificateVerify(WOLFSSL* ssl, byte* input, word32* inOutIdx,
13488                                    word32 size)
13489     {
13490         word16      sz = 0;
13491         int         ret = VERIFY_CERT_ERROR;   /* start in error state */
13492         byte        hashAlgo = sha_mac;
13493         byte        sigAlgo = anonymous_sa_algo;
13494         word32      begin = *inOutIdx;
13495
13496         #ifdef WOLFSSL_CALLBACKS
13497             if (ssl->hsInfoOn)
13498                 AddPacketName("CertificateVerify", &ssl->handShakeInfo);
13499             if (ssl->toInfoOn)
13500                 AddLateName("CertificateVerify", &ssl->timeoutInfo);
13501         #endif
13502
13503
13504         if (IsAtLeastTLSv1_2(ssl)) {
13505             if ((*inOutIdx - begin) + ENUM_LEN + ENUM_LEN > size)
13506                 return BUFFER_ERROR;
13507
13508             hashAlgo = input[(*inOutIdx)++];
13509             sigAlgo  = input[(*inOutIdx)++];
13510         }
13511
13512         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
13513             return BUFFER_ERROR;
13514
13515         ato16(input + *inOutIdx, &sz);
13516         *inOutIdx += OPAQUE16_LEN;
13517
13518         if ((*inOutIdx - begin) + sz > size || sz > ENCRYPT_LEN)
13519             return BUFFER_ERROR;
13520
13521         /* RSA */
13522 #ifndef NO_RSA
13523         if (ssl->peerRsaKey != NULL && ssl->peerRsaKeyPresent != 0) {
13524             byte* out       = NULL;
13525             int   outLen    = 0;
13526             byte  doUserRsa = 0;
13527
13528             #ifdef HAVE_PK_CALLBACKS
13529                 if (ssl->ctx->RsaVerifyCb)
13530                     doUserRsa = 1;
13531             #endif /*HAVE_PK_CALLBACKS */
13532
13533             WOLFSSL_MSG("Doing RSA peer cert verify");
13534
13535             if (doUserRsa) {
13536             #ifdef HAVE_PK_CALLBACKS
13537                 outLen = ssl->ctx->RsaVerifyCb(ssl, input + *inOutIdx, sz,
13538                                             &out,
13539                                             ssl->buffers.peerRsaKey.buffer,
13540                                             ssl->buffers.peerRsaKey.length,
13541                                             ssl->RsaVerifyCtx);
13542             #endif /*HAVE_PK_CALLBACKS */
13543             }
13544             else {
13545                 outLen = wc_RsaSSL_VerifyInline(input + *inOutIdx, sz, &out,
13546                                                                ssl->peerRsaKey);
13547             }
13548
13549             if (IsAtLeastTLSv1_2(ssl)) {
13550 #ifdef WOLFSSL_SMALL_STACK
13551                 byte*  encodedSig = NULL;
13552 #else
13553                 byte   encodedSig[MAX_ENCODED_SIG_SZ];
13554 #endif
13555                 word32 sigSz;
13556                 byte*  digest = ssl->hsHashes->certHashes.sha;
13557                 int    typeH = SHAh;
13558                 int    digestSz = SHA_DIGEST_SIZE;
13559
13560 #ifdef WOLFSSL_SMALL_STACK
13561                 encodedSig = (byte*)XMALLOC(MAX_ENCODED_SIG_SZ, NULL,
13562                                                        DYNAMIC_TYPE_TMP_BUFFER);
13563                 if (encodedSig == NULL)
13564                     return MEMORY_E;
13565 #endif
13566
13567                 if (sigAlgo != rsa_sa_algo) {
13568                     WOLFSSL_MSG("Oops, peer sent RSA key but not in verify");
13569                 }
13570
13571                 if (hashAlgo == sha256_mac) {
13572                     #ifndef NO_SHA256
13573                         digest = ssl->hsHashes->certHashes.sha256;
13574                         typeH    = SHA256h;
13575                         digestSz = SHA256_DIGEST_SIZE;
13576                     #endif
13577                 }
13578                 else if (hashAlgo == sha384_mac) {
13579                     #ifdef WOLFSSL_SHA384
13580                         digest = ssl->hsHashes->certHashes.sha384;
13581                         typeH    = SHA384h;
13582                         digestSz = SHA384_DIGEST_SIZE;
13583                     #endif
13584                 }
13585                 else if (hashAlgo == sha512_mac) {
13586                     #ifdef WOLFSSL_SHA512
13587                         digest = ssl->hsHashes->certHashes.sha512;
13588                         typeH    = SHA512h;
13589                         digestSz = SHA512_DIGEST_SIZE;
13590                     #endif
13591                 }
13592
13593                 sigSz = wc_EncodeSignature(encodedSig, digest, digestSz, typeH);
13594
13595                 if (outLen == (int)sigSz && out && XMEMCMP(out, encodedSig,
13596                                            min(sigSz, MAX_ENCODED_SIG_SZ)) == 0)
13597                     ret = 0; /* verified */
13598
13599 #ifdef WOLFSSL_SMALL_STACK
13600                 XFREE(encodedSig, NULL, DYNAMIC_TYPE_TMP_BUFFER);
13601 #endif
13602             }
13603             else {
13604                 if (outLen == FINISHED_SZ && out && XMEMCMP(out,
13605                                             &ssl->hsHashes->certHashes,
13606                                             FINISHED_SZ) == 0) {
13607                     ret = 0; /* verified */
13608                 }
13609             }
13610         }
13611 #endif
13612 #ifdef HAVE_ECC
13613         if (ssl->peerEccDsaKeyPresent) {
13614             int verify =  0;
13615             int err    = -1;
13616             byte* digest = ssl->hsHashes->certHashes.sha;
13617             word32 digestSz = SHA_DIGEST_SIZE;
13618             byte doUserEcc = 0;
13619
13620             #ifdef HAVE_PK_CALLBACKS
13621                 if (ssl->ctx->EccVerifyCb)
13622                     doUserEcc = 1;
13623             #endif
13624
13625             WOLFSSL_MSG("Doing ECC peer cert verify");
13626
13627             if (IsAtLeastTLSv1_2(ssl)) {
13628                 if (sigAlgo != ecc_dsa_sa_algo) {
13629                     WOLFSSL_MSG("Oops, peer sent ECC key but not in verify");
13630                 }
13631
13632                 if (hashAlgo == sha256_mac) {
13633                     #ifndef NO_SHA256
13634                         digest = ssl->hsHashes->certHashes.sha256;
13635                         digestSz = SHA256_DIGEST_SIZE;
13636                     #endif
13637                 }
13638                 else if (hashAlgo == sha384_mac) {
13639                     #ifdef WOLFSSL_SHA384
13640                         digest = ssl->hsHashes->certHashes.sha384;
13641                         digestSz = SHA384_DIGEST_SIZE;
13642                     #endif
13643                 }
13644                 else if (hashAlgo == sha512_mac) {
13645                     #ifdef WOLFSSL_SHA512
13646                         digest = ssl->hsHashes->certHashes.sha512;
13647                         digestSz = SHA512_DIGEST_SIZE;
13648                     #endif
13649                 }
13650             }
13651
13652             if (doUserEcc) {
13653             #ifdef HAVE_PK_CALLBACKS
13654                 ret = ssl->ctx->EccVerifyCb(ssl, input + *inOutIdx, sz, digest,
13655                                             digestSz,
13656                                             ssl->buffers.peerEccDsaKey.buffer,
13657                                             ssl->buffers.peerEccDsaKey.length,
13658                                             &verify, ssl->EccVerifyCtx);
13659             #endif
13660             }
13661             else {
13662                 err = wc_ecc_verify_hash(input + *inOutIdx, sz, digest,
13663                                          digestSz, &verify, ssl->peerEccDsaKey);
13664             }
13665
13666             if (err == 0 && verify == 1)
13667                ret = 0; /* verified */
13668         }
13669 #endif
13670         *inOutIdx += sz;
13671
13672         if (ret == 0)
13673             ssl->options.havePeerVerify = 1;
13674
13675         return ret;
13676     }
13677 #endif /* !NO_RSA || HAVE_ECC */
13678
13679     int SendServerHelloDone(WOLFSSL* ssl)
13680     {
13681         byte              *output;
13682         int                sendSz = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
13683         int                ret;
13684
13685         #ifdef WOLFSSL_DTLS
13686             if (ssl->options.dtls)
13687                 sendSz += DTLS_RECORD_EXTRA + DTLS_HANDSHAKE_EXTRA;
13688         #endif
13689         /* check for available size */
13690         if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
13691             return ret;
13692
13693         /* get ouput buffer */
13694         output = ssl->buffers.outputBuffer.buffer +
13695                  ssl->buffers.outputBuffer.length;
13696
13697         AddHeaders(output, 0, server_hello_done, ssl);
13698
13699         #ifdef WOLFSSL_DTLS
13700             if (ssl->options.dtls) {
13701                 if ((ret = DtlsPoolSave(ssl, output, sendSz)) != 0)
13702                     return 0;
13703             }
13704         #endif
13705
13706         ret = HashOutput(ssl, output, sendSz, 0);
13707             if (ret != 0)
13708                 return ret;
13709
13710 #ifdef WOLFSSL_CALLBACKS
13711         if (ssl->hsInfoOn)
13712             AddPacketName("ServerHelloDone", &ssl->handShakeInfo);
13713         if (ssl->toInfoOn)
13714             AddPacketInfo("ServerHelloDone", &ssl->timeoutInfo, output, sendSz,
13715                           ssl->heap);
13716 #endif
13717         ssl->options.serverState = SERVER_HELLODONE_COMPLETE;
13718
13719         ssl->buffers.outputBuffer.length += sendSz;
13720
13721         return SendBuffered(ssl);
13722     }
13723
13724
13725 #ifdef HAVE_SESSION_TICKET
13726
13727 #define WOLFSSL_TICKET_FIXED_SZ (WOLFSSL_TICKET_NAME_SZ + \
13728                 WOLFSSL_TICKET_IV_SZ + WOLFSSL_TICKET_MAC_SZ + LENGTH_SZ)
13729 #define WOLFSSL_TICKET_ENC_SZ (SESSION_TICKET_LEN - WOLFSSL_TICKET_FIXED_SZ)
13730
13731     /* our ticket format */
13732     typedef struct InternalTicket {
13733         ProtocolVersion pv;                    /* version when ticket created */
13734         byte            suite[SUITE_LEN];      /* cipher suite when created */
13735         byte            msecret[SECRET_LEN];   /* master secret */
13736         word32          timestamp;             /* born on */
13737     } InternalTicket;
13738
13739     /* fit within SESSION_TICKET_LEN */
13740     typedef struct ExternalTicket {
13741         byte key_name[WOLFSSL_TICKET_NAME_SZ];  /* key context name */
13742         byte iv[WOLFSSL_TICKET_IV_SZ];          /* this ticket's iv */
13743         byte enc_len[LENGTH_SZ];                /* encrypted length */
13744         byte enc_ticket[WOLFSSL_TICKET_ENC_SZ]; /* encrypted internal ticket */
13745         byte mac[WOLFSSL_TICKET_MAC_SZ];        /* total mac */
13746         /* !! if add to structure, add to TICKET_FIXED_SZ !! */
13747     } ExternalTicket;
13748
13749     /* create a new session ticket, 0 on success */
13750     static int CreateTicket(WOLFSSL* ssl)
13751     {
13752         InternalTicket  it;
13753         ExternalTicket* et = (ExternalTicket*)ssl->session.ticket;
13754         int encLen;
13755         int ret;
13756         byte zeros[WOLFSSL_TICKET_MAC_SZ];   /* biggest cmp size */
13757
13758         /* build internal */
13759         it.pv.major = ssl->version.major;
13760         it.pv.minor = ssl->version.minor;
13761
13762         it.suite[0] = ssl->options.cipherSuite0;
13763         it.suite[1] = ssl->options.cipherSuite;
13764
13765         XMEMCPY(it.msecret, ssl->arrays->masterSecret, SECRET_LEN);
13766         c32toa(LowResTimer(), (byte*)&it.timestamp);
13767
13768         /* build external */
13769         XMEMCPY(et->enc_ticket, &it, sizeof(InternalTicket));
13770
13771         /* encrypt */
13772         encLen = WOLFSSL_TICKET_ENC_SZ;  /* max size user can use */
13773         ret = ssl->ctx->ticketEncCb(ssl, et->key_name, et->iv, et->mac, 1,
13774                                     et->enc_ticket, sizeof(InternalTicket),
13775                                     &encLen, ssl->ctx->ticketEncCtx);
13776         if (ret == WOLFSSL_TICKET_RET_OK) {
13777             if (encLen < (int)sizeof(InternalTicket) ||
13778                 encLen > WOLFSSL_TICKET_ENC_SZ) {
13779                 WOLFSSL_MSG("Bad user ticket encrypt size");
13780                 return BAD_TICKET_KEY_CB_SZ;
13781             }
13782
13783             /* sanity checks on encrypt callback */
13784
13785             /* internal ticket can't be the same if encrypted */
13786             if (XMEMCMP(et->enc_ticket, &it, sizeof(InternalTicket)) == 0) {
13787                 WOLFSSL_MSG("User ticket encrypt didn't encrypt");
13788                 return BAD_TICKET_ENCRYPT;
13789             }
13790
13791             XMEMSET(zeros, 0, sizeof(zeros));
13792
13793             /* name */
13794             if (XMEMCMP(et->key_name, zeros, WOLFSSL_TICKET_NAME_SZ) == 0) {
13795                 WOLFSSL_MSG("User ticket encrypt didn't set name");
13796                 return BAD_TICKET_ENCRYPT;
13797             }
13798
13799             /* iv */
13800             if (XMEMCMP(et->iv, zeros, WOLFSSL_TICKET_IV_SZ) == 0) {
13801                 WOLFSSL_MSG("User ticket encrypt didn't set iv");
13802                 return BAD_TICKET_ENCRYPT;
13803             }
13804
13805             /* mac */
13806             if (XMEMCMP(et->mac, zeros, WOLFSSL_TICKET_MAC_SZ) == 0) {
13807                 WOLFSSL_MSG("User ticket encrypt didn't set mac");
13808                 return BAD_TICKET_ENCRYPT;
13809             }
13810
13811             /* set size */
13812             c16toa((word16)encLen, et->enc_len);
13813             ssl->session.ticketLen = (word16)(encLen + WOLFSSL_TICKET_FIXED_SZ);
13814             if (encLen < WOLFSSL_TICKET_ENC_SZ) {
13815                 /* move mac up since whole enc buffer not used */
13816                 XMEMMOVE(et->enc_ticket +encLen, et->mac,WOLFSSL_TICKET_MAC_SZ);
13817             }
13818         }
13819
13820         return ret;
13821     }
13822
13823
13824     /* Parse ticket sent by client, returns callback return value */
13825     int DoClientTicket(WOLFSSL* ssl, const byte* input, word32 len)
13826     {
13827         ExternalTicket* et;
13828         InternalTicket* it;
13829         int             ret;
13830         int             outLen;
13831         word16          inLen;
13832
13833         if (len > SESSION_TICKET_LEN ||
13834              len < (word32)(sizeof(InternalTicket) + WOLFSSL_TICKET_FIXED_SZ)) {
13835             return BAD_TICKET_MSG_SZ;
13836         }
13837
13838         et = (ExternalTicket*)input;
13839         it = (InternalTicket*)et->enc_ticket;
13840
13841         /* decrypt */
13842         ato16(et->enc_len, &inLen);
13843         if (inLen > (word16)(len - WOLFSSL_TICKET_FIXED_SZ)) {
13844             return BAD_TICKET_MSG_SZ;
13845         }
13846         outLen = inLen;   /* may be reduced by user padding */
13847         ret = ssl->ctx->ticketEncCb(ssl, et->key_name, et->iv,
13848                                     et->enc_ticket + inLen, 0,
13849                                     et->enc_ticket, inLen, &outLen,
13850                                     ssl->ctx->ticketEncCtx);
13851         if (ret == WOLFSSL_TICKET_RET_FATAL || ret < 0) return ret;
13852         if (outLen > inLen || outLen < (int)sizeof(InternalTicket)) {
13853             WOLFSSL_MSG("Bad user ticket decrypt len");
13854             return BAD_TICKET_KEY_CB_SZ;
13855         }
13856
13857         /* get master secret */
13858         if (ret == WOLFSSL_TICKET_RET_OK || ret == WOLFSSL_TICKET_RET_CREATE)
13859             XMEMCPY(ssl->arrays->masterSecret, it->msecret, SECRET_LEN);
13860
13861         return ret;
13862     }
13863
13864
13865     /* send Session Ticket */
13866     int SendTicket(WOLFSSL* ssl)
13867     {
13868         byte*              output;
13869         int                ret;
13870         int                sendSz;
13871         word32             length = SESSION_HINT_SZ + LENGTH_SZ;
13872         word32             idx    = RECORD_HEADER_SZ + HANDSHAKE_HEADER_SZ;
13873
13874     #ifdef WOLFSSL_DTLS
13875         if (ssl->options.dtls) {
13876             length += DTLS_RECORD_EXTRA;
13877             idx    += DTLS_RECORD_EXTRA;
13878         }
13879     #endif
13880
13881         if (ssl->options.createTicket) {
13882             ret = CreateTicket(ssl);
13883             if (ret != 0) return ret;
13884         }
13885
13886         length += ssl->session.ticketLen;
13887         sendSz = length + HANDSHAKE_HEADER_SZ + RECORD_HEADER_SZ;
13888
13889         /* check for available size */
13890         if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
13891             return ret;
13892
13893         /* get ouput buffer */
13894         output = ssl->buffers.outputBuffer.buffer +
13895                  ssl->buffers.outputBuffer.length;
13896
13897         AddHeaders(output, length, session_ticket, ssl);
13898
13899         /* hint */
13900         c32toa(ssl->ctx->ticketHint, output + idx);
13901         idx += SESSION_HINT_SZ;
13902
13903         /* length */
13904         c16toa(ssl->session.ticketLen, output + idx);
13905         idx += LENGTH_SZ;
13906
13907         /* ticket */
13908         XMEMCPY(output + idx, ssl->session.ticket, ssl->session.ticketLen);
13909         /* idx += ssl->session.ticketLen; */
13910
13911         ret = HashOutput(ssl, output, sendSz, 0);
13912         if (ret != 0) return ret;
13913         ssl->buffers.outputBuffer.length += sendSz;
13914
13915         return SendBuffered(ssl);
13916     }
13917
13918 #endif /* HAVE_SESSION_TICKET */
13919
13920
13921 #ifdef WOLFSSL_DTLS
13922     int SendHelloVerifyRequest(WOLFSSL* ssl)
13923     {
13924         byte* output;
13925         byte  cookieSz = COOKIE_SZ;
13926         int   length = VERSION_SZ + ENUM_LEN + cookieSz;
13927         int   idx    = DTLS_RECORD_HEADER_SZ + DTLS_HANDSHAKE_HEADER_SZ;
13928         int   sendSz = length + idx;
13929         int   ret;
13930
13931         /* check for available size */
13932         if ((ret = CheckAvailableSize(ssl, sendSz)) != 0)
13933             return ret;
13934
13935         /* get ouput buffer */
13936         output = ssl->buffers.outputBuffer.buffer +
13937                  ssl->buffers.outputBuffer.length;
13938
13939         AddHeaders(output, length, hello_verify_request, ssl);
13940
13941         output[idx++] =  ssl->chVersion.major;
13942         output[idx++] =  ssl->chVersion.minor;
13943
13944         output[idx++] = cookieSz;
13945         if (ssl->ctx->CBIOCookie == NULL) {
13946             WOLFSSL_MSG("Your Cookie callback is null, please set");
13947             return COOKIE_ERROR;
13948         }
13949         if ((ret = ssl->ctx->CBIOCookie(ssl, output + idx, cookieSz,
13950                                         ssl->IOCB_CookieCtx)) < 0)
13951             return ret;
13952
13953         ret = HashOutput(ssl, output, sendSz, 0);
13954         if (ret != 0)
13955             return ret;
13956
13957 #ifdef WOLFSSL_CALLBACKS
13958         if (ssl->hsInfoOn)
13959             AddPacketName("HelloVerifyRequest", &ssl->handShakeInfo);
13960         if (ssl->toInfoOn)
13961             AddPacketInfo("HelloVerifyRequest", &ssl->timeoutInfo, output,
13962                           sendSz, ssl->heap);
13963 #endif
13964         ssl->options.serverState = SERVER_HELLOVERIFYREQUEST_COMPLETE;
13965
13966         ssl->buffers.outputBuffer.length += sendSz;
13967
13968         return SendBuffered(ssl);
13969     }
13970 #endif
13971
13972     static int DoClientKeyExchange(WOLFSSL* ssl, byte* input, word32* inOutIdx,
13973                                                                     word32 size)
13974     {
13975         int    ret = 0;
13976         word32 length = 0;
13977         byte*  out = NULL;
13978         word32 begin = *inOutIdx;
13979
13980         (void)length; /* shut up compiler warnings */
13981         (void)out;
13982         (void)input;
13983         (void)size;
13984         (void)begin;
13985
13986         if (ssl->options.side != WOLFSSL_SERVER_END) {
13987             WOLFSSL_MSG("Client received client keyexchange, attack?");
13988             WOLFSSL_ERROR(ssl->error = SIDE_ERROR);
13989             return SSL_FATAL_ERROR;
13990         }
13991
13992         if (ssl->options.clientState < CLIENT_HELLO_COMPLETE) {
13993             WOLFSSL_MSG("Client sending keyexchange at wrong time");
13994             SendAlert(ssl, alert_fatal, unexpected_message);
13995             return OUT_OF_ORDER_E;
13996         }
13997
13998         #ifndef NO_CERTS
13999             if (ssl->options.verifyPeer && ssl->options.failNoCert)
14000                 if (!ssl->options.havePeerCert) {
14001                     WOLFSSL_MSG("client didn't present peer cert");
14002                     return NO_PEER_CERT;
14003                 }
14004         #endif
14005
14006         #ifdef WOLFSSL_CALLBACKS
14007             if (ssl->hsInfoOn)
14008                 AddPacketName("ClientKeyExchange", &ssl->handShakeInfo);
14009             if (ssl->toInfoOn)
14010                 AddLateName("ClientKeyExchange", &ssl->timeoutInfo);
14011         #endif
14012
14013         switch (ssl->specs.kea) {
14014         #ifndef NO_RSA
14015             case rsa_kea:
14016             {
14017                 word32 idx = 0;
14018                 RsaKey key;
14019                 byte   doUserRsa = 0;
14020
14021                 #ifdef HAVE_PK_CALLBACKS
14022                     if (ssl->ctx->RsaDecCb)
14023                         doUserRsa = 1;
14024                 #endif
14025
14026                 ret = wc_InitRsaKey(&key, ssl->heap);
14027                 if (ret != 0) return ret;
14028
14029                 if (ssl->buffers.key.buffer)
14030                     ret = wc_RsaPrivateKeyDecode(ssl->buffers.key.buffer, &idx,
14031                                              &key, ssl->buffers.key.length);
14032                 else
14033                     return NO_PRIVATE_KEY;
14034
14035                 if (ret == 0) {
14036                     length = wc_RsaEncryptSize(&key);
14037                     ssl->arrays->preMasterSz = SECRET_LEN;
14038
14039                     if (ssl->options.tls) {
14040                         word16 check;
14041
14042                         if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
14043                             return BUFFER_ERROR;
14044
14045                         ato16(input + *inOutIdx, &check);
14046                         *inOutIdx += OPAQUE16_LEN;
14047
14048                         if ((word32) check != length) {
14049                             WOLFSSL_MSG("RSA explicit size doesn't match");
14050                             wc_FreeRsaKey(&key);
14051                             return RSA_PRIVATE_ERROR;
14052                         }
14053                     }
14054
14055                     if ((*inOutIdx - begin) + length > size) {
14056                         WOLFSSL_MSG("RSA message too big");
14057                         wc_FreeRsaKey(&key);
14058                         return BUFFER_ERROR;
14059                     }
14060
14061                     if (doUserRsa) {
14062                         #ifdef HAVE_PK_CALLBACKS
14063                             ret = ssl->ctx->RsaDecCb(ssl,
14064                                         input + *inOutIdx, length, &out,
14065                                         ssl->buffers.key.buffer,
14066                                         ssl->buffers.key.length,
14067                                         ssl->RsaDecCtx);
14068                         #endif
14069                     }
14070                     else {
14071                         ret = wc_RsaPrivateDecryptInline(input + *inOutIdx, length,
14072                                                                     &out, &key);
14073                     }
14074
14075                     *inOutIdx += length;
14076
14077                     if (ret == SECRET_LEN) {
14078                         XMEMCPY(ssl->arrays->preMasterSecret, out, SECRET_LEN);
14079                         if (ssl->arrays->preMasterSecret[0] !=
14080                                                            ssl->chVersion.major
14081                             || ssl->arrays->preMasterSecret[1] !=
14082                                                            ssl->chVersion.minor)
14083                             ret = PMS_VERSION_ERROR;
14084                         else
14085                             ret = MakeMasterSecret(ssl);
14086                     }
14087                     else {
14088                         ret = RSA_PRIVATE_ERROR;
14089                     }
14090                 }
14091
14092                 wc_FreeRsaKey(&key);
14093             }
14094             break;
14095         #endif
14096         #ifndef NO_PSK
14097             case psk_kea:
14098             {
14099                 byte* pms = ssl->arrays->preMasterSecret;
14100                 word16 ci_sz;
14101
14102                 if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
14103                     return BUFFER_ERROR;
14104
14105                 ato16(input + *inOutIdx, &ci_sz);
14106                 *inOutIdx += OPAQUE16_LEN;
14107
14108                 if (ci_sz > MAX_PSK_ID_LEN)
14109                     return CLIENT_ID_ERROR;
14110
14111                 if ((*inOutIdx - begin) + ci_sz > size)
14112                     return BUFFER_ERROR;
14113
14114                 XMEMCPY(ssl->arrays->client_identity, input + *inOutIdx, ci_sz);
14115                 *inOutIdx += ci_sz;
14116
14117                 ssl->arrays->client_identity[min(ci_sz, MAX_PSK_ID_LEN-1)] = 0;
14118                 ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
14119                     ssl->arrays->client_identity, ssl->arrays->psk_key,
14120                     MAX_PSK_KEY_LEN);
14121
14122                 if (ssl->arrays->psk_keySz == 0 ||
14123                                        ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN)
14124                     return PSK_KEY_ERROR;
14125
14126                 /* make psk pre master secret */
14127                 /* length of key + length 0s + length of key + key */
14128                 c16toa((word16) ssl->arrays->psk_keySz, pms);
14129                 pms += OPAQUE16_LEN;
14130
14131                 XMEMSET(pms, 0, ssl->arrays->psk_keySz);
14132                 pms += ssl->arrays->psk_keySz;
14133
14134                 c16toa((word16) ssl->arrays->psk_keySz, pms);
14135                 pms += OPAQUE16_LEN;
14136
14137                 XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
14138                 ssl->arrays->preMasterSz = ssl->arrays->psk_keySz * 2 + 4;
14139
14140                 ret = MakeMasterSecret(ssl);
14141
14142                 /* No further need for PSK */
14143                 ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
14144                 ssl->arrays->psk_keySz = 0;
14145             }
14146             break;
14147         #endif /* NO_PSK */
14148         #ifdef HAVE_NTRU
14149             case ntru_kea:
14150             {
14151                 word16 cipherLen;
14152                 word16 plainLen = sizeof(ssl->arrays->preMasterSecret);
14153
14154                 if (!ssl->buffers.key.buffer)
14155                     return NO_PRIVATE_KEY;
14156
14157                 if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
14158                     return BUFFER_ERROR;
14159
14160                 ato16(input + *inOutIdx, &cipherLen);
14161                 *inOutIdx += OPAQUE16_LEN;
14162
14163                 if (cipherLen > MAX_NTRU_ENCRYPT_SZ)
14164                     return NTRU_KEY_ERROR;
14165
14166                 if ((*inOutIdx - begin) + cipherLen > size)
14167                     return BUFFER_ERROR;
14168
14169                 if (NTRU_OK != ntru_crypto_ntru_decrypt(
14170                             (word16) ssl->buffers.key.length,
14171                             ssl->buffers.key.buffer, cipherLen,
14172                             input + *inOutIdx, &plainLen,
14173                             ssl->arrays->preMasterSecret))
14174                     return NTRU_DECRYPT_ERROR;
14175
14176                 if (plainLen != SECRET_LEN)
14177                     return NTRU_DECRYPT_ERROR;
14178
14179                 *inOutIdx += cipherLen;
14180
14181                 ssl->arrays->preMasterSz = plainLen;
14182                 ret = MakeMasterSecret(ssl);
14183             }
14184             break;
14185         #endif /* HAVE_NTRU */
14186         #ifdef HAVE_ECC
14187             case ecc_diffie_hellman_kea:
14188             {
14189                 if ((*inOutIdx - begin) + OPAQUE8_LEN > size)
14190                     return BUFFER_ERROR;
14191
14192                 length = input[(*inOutIdx)++];
14193
14194                 if ((*inOutIdx - begin) + length > size)
14195                     return BUFFER_ERROR;
14196
14197                 if (ssl->peerEccKey == NULL) {
14198                     /* alloc/init on demand */
14199                     ssl->peerEccKey = (ecc_key*)XMALLOC(sizeof(ecc_key),
14200                                               ssl->ctx->heap, DYNAMIC_TYPE_ECC);
14201                     if (ssl->peerEccKey == NULL) {
14202                         WOLFSSL_MSG("PeerEccKey Memory error");
14203                         return MEMORY_E;
14204                     }
14205                     wc_ecc_init(ssl->peerEccKey);
14206                 } else if (ssl->peerEccKeyPresent) {  /* don't leak on reuse */
14207                     wc_ecc_free(ssl->peerEccKey);
14208                     ssl->peerEccKeyPresent = 0;
14209                     wc_ecc_init(ssl->peerEccKey);
14210                 }
14211
14212                 if (wc_ecc_import_x963(input + *inOutIdx, length, ssl->peerEccKey))
14213                     return ECC_PEERKEY_ERROR;
14214
14215                 *inOutIdx += length;
14216                 ssl->peerEccKeyPresent = 1;
14217
14218                 length = sizeof(ssl->arrays->preMasterSecret);
14219
14220                 if (ssl->specs.static_ecdh) {
14221                     ecc_key staticKey;
14222                     word32 i = 0;
14223
14224                     wc_ecc_init(&staticKey);
14225                     ret = wc_EccPrivateKeyDecode(ssl->buffers.key.buffer, &i,
14226                                            &staticKey, ssl->buffers.key.length);
14227
14228                     if (ret == 0)
14229                         ret = wc_ecc_shared_secret(&staticKey, ssl->peerEccKey,
14230                                          ssl->arrays->preMasterSecret, &length);
14231
14232                     wc_ecc_free(&staticKey);
14233                 }
14234                 else {
14235                     if (ssl->eccTempKeyPresent == 0) {
14236                         WOLFSSL_MSG("Ecc ephemeral key not made correctly");
14237                         ret = ECC_MAKEKEY_ERROR;
14238                     } else {
14239                         ret = wc_ecc_shared_secret(ssl->eccTempKey,ssl->peerEccKey,
14240                                          ssl->arrays->preMasterSecret, &length);
14241                     }
14242                 }
14243
14244                 if (ret != 0)
14245                     return ECC_SHARED_ERROR;
14246
14247                 ssl->arrays->preMasterSz = length;
14248                 ret = MakeMasterSecret(ssl);
14249             }
14250             break;
14251         #endif /* HAVE_ECC */
14252         #ifndef NO_DH
14253             case diffie_hellman_kea:
14254             {
14255                 word16 clientPubSz;
14256                 DhKey  dhKey;
14257
14258                 if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
14259                     return BUFFER_ERROR;
14260
14261                 ato16(input + *inOutIdx, &clientPubSz);
14262                 *inOutIdx += OPAQUE16_LEN;
14263
14264                 if ((*inOutIdx - begin) + clientPubSz > size)
14265                     return BUFFER_ERROR;
14266
14267                 wc_InitDhKey(&dhKey);
14268                 ret = wc_DhSetKey(&dhKey, ssl->buffers.serverDH_P.buffer,
14269                                        ssl->buffers.serverDH_P.length,
14270                                        ssl->buffers.serverDH_G.buffer,
14271                                        ssl->buffers.serverDH_G.length);
14272                 if (ret == 0)
14273                     ret = wc_DhAgree(&dhKey, ssl->arrays->preMasterSecret,
14274                                          &ssl->arrays->preMasterSz,
14275                                           ssl->buffers.serverDH_Priv.buffer,
14276                                           ssl->buffers.serverDH_Priv.length,
14277                                           input + *inOutIdx, clientPubSz);
14278                 wc_FreeDhKey(&dhKey);
14279
14280                 *inOutIdx += clientPubSz;
14281
14282                 if (ret == 0)
14283                     ret = MakeMasterSecret(ssl);
14284             }
14285             break;
14286         #endif /* NO_DH */
14287         #if !defined(NO_DH) && !defined(NO_PSK)
14288             case dhe_psk_kea:
14289             {
14290                 byte* pms = ssl->arrays->preMasterSecret;
14291                 word16 clientSz;
14292                 DhKey  dhKey;
14293
14294                 /* Read in the PSK hint */
14295                 if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
14296                     return BUFFER_ERROR;
14297
14298                 ato16(input + *inOutIdx, &clientSz);
14299                 *inOutIdx += OPAQUE16_LEN;
14300                 if (clientSz > MAX_PSK_ID_LEN)
14301                     return CLIENT_ID_ERROR;
14302
14303                 if ((*inOutIdx - begin) + clientSz > size)
14304                     return BUFFER_ERROR;
14305
14306                 XMEMCPY(ssl->arrays->client_identity,
14307                                                    input + *inOutIdx, clientSz);
14308                 *inOutIdx += clientSz;
14309                 ssl->arrays->client_identity[min(clientSz, MAX_PSK_ID_LEN-1)] =
14310                                                                               0;
14311
14312                 /* Read in the DHE business */
14313                 if ((*inOutIdx - begin) + OPAQUE16_LEN > size)
14314                     return BUFFER_ERROR;
14315
14316                 ato16(input + *inOutIdx, &clientSz);
14317                 *inOutIdx += OPAQUE16_LEN;
14318
14319                 if ((*inOutIdx - begin) + clientSz > size)
14320                     return BUFFER_ERROR;
14321
14322                 wc_InitDhKey(&dhKey);
14323                 ret = wc_DhSetKey(&dhKey, ssl->buffers.serverDH_P.buffer,
14324                                        ssl->buffers.serverDH_P.length,
14325                                        ssl->buffers.serverDH_G.buffer,
14326                                        ssl->buffers.serverDH_G.length);
14327                 if (ret == 0)
14328                     ret = wc_DhAgree(&dhKey, pms + OPAQUE16_LEN,
14329                                           &ssl->arrays->preMasterSz,
14330                                           ssl->buffers.serverDH_Priv.buffer,
14331                                           ssl->buffers.serverDH_Priv.length,
14332                                           input + *inOutIdx, clientSz);
14333                 wc_FreeDhKey(&dhKey);
14334
14335                 *inOutIdx += clientSz;
14336                 c16toa((word16)ssl->arrays->preMasterSz, pms);
14337                 ssl->arrays->preMasterSz += OPAQUE16_LEN;
14338                 pms += ssl->arrays->preMasterSz;
14339
14340                 /* Use the PSK hint to look up the PSK and add it to the
14341                  * preMasterSecret here. */
14342                 ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
14343                     ssl->arrays->client_identity, ssl->arrays->psk_key,
14344                     MAX_PSK_KEY_LEN);
14345
14346                 if (ssl->arrays->psk_keySz == 0 ||
14347                                        ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN)
14348                     return PSK_KEY_ERROR;
14349
14350                 c16toa((word16) ssl->arrays->psk_keySz, pms);
14351                 pms += OPAQUE16_LEN;
14352
14353                 XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
14354                 ssl->arrays->preMasterSz +=
14355                                           ssl->arrays->psk_keySz + OPAQUE16_LEN;
14356                 if (ret == 0)
14357                     ret = MakeMasterSecret(ssl);
14358
14359                 /* No further need for PSK */
14360                 ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
14361                 ssl->arrays->psk_keySz = 0;
14362             }
14363             break;
14364         #endif /* !NO_DH && !NO_PSK */
14365             default:
14366             {
14367                 WOLFSSL_MSG("Bad kea type");
14368                 ret = BAD_KEA_TYPE_E;
14369             }
14370             break;
14371         }
14372
14373         /* No further need for PMS */
14374         ForceZero(ssl->arrays->preMasterSecret, ssl->arrays->preMasterSz);
14375         ssl->arrays->preMasterSz = 0;
14376
14377         if (ret == 0) {
14378             ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
14379             #ifndef NO_CERTS
14380                 if (ssl->options.verifyPeer)
14381                     ret = BuildCertHashes(ssl, &ssl->hsHashes->certHashes);
14382             #endif
14383         }
14384
14385         return ret;
14386     }
14387
14388 #endif /* NO_WOLFSSL_SERVER */