1 /* Copyright (c) 2016, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15 #include <openssl/ssl.h>
16
17 #include <assert.h>
18 #include <string.h>
19
20 #include <tuple>
21
22 #include <openssl/aead.h>
23 #include <openssl/bytestring.h>
24 #include <openssl/digest.h>
25 #include <openssl/err.h>
26 #include <openssl/hpke.h>
27 #include <openssl/mem.h>
28 #include <openssl/rand.h>
29 #include <openssl/stack.h>
30
31 #include "../crypto/internal.h"
32 #include "internal.h"
33
34
35 BSSL_NAMESPACE_BEGIN
36
37 static const uint8_t kZeroes[EVP_MAX_MD_SIZE] = {0};
38
39 // Allow a minute of ticket age skew in either direction. This covers
40 // transmission delays in ClientHello and NewSessionTicket, as well as
41 // drift between client and server clock rate since the ticket was issued.
42 // See RFC 8446, section 8.3.
43 static const int32_t kMaxTicketAgeSkewSeconds = 60;
44
resolve_ecdhe_secret(SSL_HANDSHAKE * hs,const SSL_CLIENT_HELLO * client_hello)45 static bool resolve_ecdhe_secret(SSL_HANDSHAKE *hs,
46 const SSL_CLIENT_HELLO *client_hello) {
47 SSL *const ssl = hs->ssl;
48 const uint16_t group_id = hs->new_session->group_id;
49
50 bool found_key_share;
51 Span<const uint8_t> peer_key;
52 uint8_t alert = SSL_AD_DECODE_ERROR;
53 if (!ssl_ext_key_share_parse_clienthello(hs, &found_key_share, &peer_key,
54 &alert, client_hello)) {
55 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
56 return false;
57 }
58
59 if (!found_key_share) {
60 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
61 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE);
62 return false;
63 }
64
65 Array<uint8_t> secret;
66 SSL_HANDSHAKE_HINTS *const hints = hs->hints.get();
67 if (hints && !hs->hints_requested && hints->key_share_group_id == group_id &&
68 !hints->key_share_secret.empty()) {
69 // Copy the key_share secret from hints.
70 if (!hs->key_share_ciphertext.CopyFrom(hints->key_share_ciphertext) ||
71 !secret.CopyFrom(hints->key_share_secret)) {
72 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
73 return false;
74 }
75 } else {
76 ScopedCBB ciphertext;
77 UniquePtr<SSLKeyShare> key_share = SSLKeyShare::Create(group_id);
78 if (!key_share || //
79 !CBB_init(ciphertext.get(), 32) ||
80 !key_share->Encap(ciphertext.get(), &secret, &alert, peer_key) ||
81 !CBBFinishArray(ciphertext.get(), &hs->key_share_ciphertext)) {
82 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
83 return false;
84 }
85 if (hints && hs->hints_requested) {
86 hints->key_share_group_id = group_id;
87 if (!hints->key_share_ciphertext.CopyFrom(hs->key_share_ciphertext) ||
88 !hints->key_share_secret.CopyFrom(secret)) {
89 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
90 return false;
91 }
92 }
93 }
94
95 return tls13_advance_key_schedule(hs, secret);
96 }
97
ssl_ext_supported_versions_add_serverhello(SSL_HANDSHAKE * hs,CBB * out)98 static int ssl_ext_supported_versions_add_serverhello(SSL_HANDSHAKE *hs,
99 CBB *out) {
100 CBB contents;
101 if (!CBB_add_u16(out, TLSEXT_TYPE_supported_versions) ||
102 !CBB_add_u16_length_prefixed(out, &contents) ||
103 !CBB_add_u16(&contents, hs->ssl->version) ||
104 !CBB_flush(out)) {
105 return 0;
106 }
107
108 return 1;
109 }
110
choose_tls13_cipher(const SSL * ssl,const SSL_CLIENT_HELLO * client_hello,uint16_t group_id)111 static const SSL_CIPHER *choose_tls13_cipher(
112 const SSL *ssl, const SSL_CLIENT_HELLO *client_hello, uint16_t group_id) {
113 CBS cipher_suites;
114 CBS_init(&cipher_suites, client_hello->cipher_suites,
115 client_hello->cipher_suites_len);
116
117 const uint16_t version = ssl_protocol_version(ssl);
118
119 return ssl_choose_tls13_cipher(
120 cipher_suites,
121 ssl->config->aes_hw_override ? ssl->config->aes_hw_override_value
122 : EVP_has_aes_hardware(),
123 version, group_id, ssl->config->only_fips_cipher_suites_in_tls13);
124 }
125
add_new_session_tickets(SSL_HANDSHAKE * hs,bool * out_sent_tickets)126 static bool add_new_session_tickets(SSL_HANDSHAKE *hs, bool *out_sent_tickets) {
127 SSL *const ssl = hs->ssl;
128 if (// If the client doesn't accept resumption with PSK_DHE_KE, don't send a
129 // session ticket.
130 !hs->accept_psk_mode ||
131 // We only implement stateless resumption in TLS 1.3, so skip sending
132 // tickets if disabled.
133 (SSL_get_options(ssl) & SSL_OP_NO_TICKET)) {
134 *out_sent_tickets = false;
135 return true;
136 }
137
138 // Rebase the session timestamp so that it is measured from ticket
139 // issuance.
140 ssl_session_rebase_time(ssl, hs->new_session.get());
141
142 assert(ssl->session_ctx->num_tickets <= kMaxTickets);
143 for (size_t i = 0; i < ssl->session_ctx->num_tickets; i++) {
144 UniquePtr<SSL_SESSION> session(
145 SSL_SESSION_dup(hs->new_session.get(), SSL_SESSION_INCLUDE_NONAUTH));
146 if (!session) {
147 return false;
148 }
149
150 if (!RAND_bytes((uint8_t *)&session->ticket_age_add, 4)) {
151 return false;
152 }
153 session->ticket_age_add_valid = true;
154 bool enable_early_data =
155 ssl->enable_early_data &&
156 (!ssl->quic_method || !ssl->config->quic_early_data_context.empty());
157 if (enable_early_data) {
158 // QUIC does not use the max_early_data_size parameter and always sets it
159 // to a fixed value. See RFC 9001, section 4.6.1.
160 session->ticket_max_early_data =
161 ssl->quic_method != nullptr ? 0xffffffff : kMaxEarlyDataAccepted;
162 }
163
164 static_assert(kMaxTickets < 256, "Too many tickets");
165 assert(i < 256);
166 uint8_t nonce[] = {static_cast<uint8_t>(i)};
167
168 ScopedCBB cbb;
169 CBB body, nonce_cbb, ticket, extensions;
170 if (!ssl->method->init_message(ssl, cbb.get(), &body,
171 SSL3_MT_NEW_SESSION_TICKET) ||
172 !CBB_add_u32(&body, session->timeout) ||
173 !CBB_add_u32(&body, session->ticket_age_add) ||
174 !CBB_add_u8_length_prefixed(&body, &nonce_cbb) ||
175 !CBB_add_bytes(&nonce_cbb, nonce, sizeof(nonce)) ||
176 !CBB_add_u16_length_prefixed(&body, &ticket) ||
177 !tls13_derive_session_psk(session.get(), nonce) ||
178 !ssl_encrypt_ticket(hs, &ticket, session.get()) ||
179 !CBB_add_u16_length_prefixed(&body, &extensions)) {
180 return false;
181 }
182
183 if (enable_early_data) {
184 CBB early_data;
185 if (!CBB_add_u16(&extensions, TLSEXT_TYPE_early_data) ||
186 !CBB_add_u16_length_prefixed(&extensions, &early_data) ||
187 !CBB_add_u32(&early_data, session->ticket_max_early_data) ||
188 !CBB_flush(&extensions)) {
189 return false;
190 }
191 }
192
193 // Add a fake extension. See RFC 8701.
194 if (!CBB_add_u16(&extensions,
195 ssl_get_grease_value(hs, ssl_grease_ticket_extension)) ||
196 !CBB_add_u16(&extensions, 0 /* empty */)) {
197 return false;
198 }
199
200 if (!ssl_add_message_cbb(ssl, cbb.get())) {
201 return false;
202 }
203 }
204
205 *out_sent_tickets = true;
206 return true;
207 }
208
do_select_parameters(SSL_HANDSHAKE * hs)209 static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
210 // At this point, most ClientHello extensions have already been processed by
211 // the common handshake logic. Resolve the remaining non-PSK parameters.
212 SSL *const ssl = hs->ssl;
213 SSLMessage msg;
214 SSL_CLIENT_HELLO client_hello;
215 if (!hs->GetClientHello(&msg, &client_hello)) {
216 return ssl_hs_error;
217 }
218
219 if (ssl->quic_method != nullptr && client_hello.session_id_len > 0) {
220 OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_COMPATIBILITY_MODE);
221 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
222 return ssl_hs_error;
223 }
224 OPENSSL_memcpy(hs->session_id, client_hello.session_id,
225 client_hello.session_id_len);
226 hs->session_id_len = client_hello.session_id_len;
227
228 uint16_t group_id;
229 if (!tls1_get_shared_group(hs, &group_id)) {
230 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_GROUP);
231 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
232 return ssl_hs_error;
233 }
234
235 // Negotiate the cipher suite.
236 hs->new_cipher = choose_tls13_cipher(ssl, &client_hello, group_id);
237 if (hs->new_cipher == NULL) {
238 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_CIPHER);
239 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
240 return ssl_hs_error;
241 }
242
243 // HTTP/2 negotiation depends on the cipher suite, so ALPN negotiation was
244 // deferred. Complete it now.
245 uint8_t alert = SSL_AD_DECODE_ERROR;
246 if (!ssl_negotiate_alpn(hs, &alert, &client_hello)) {
247 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
248 return ssl_hs_error;
249 }
250
251 // The PRF hash is now known.
252 if (!hs->transcript.InitHash(ssl_protocol_version(ssl), hs->new_cipher)) {
253 return ssl_hs_error;
254 }
255
256 hs->tls13_state = state13_select_session;
257 return ssl_hs_ok;
258 }
259
select_session(SSL_HANDSHAKE * hs,uint8_t * out_alert,UniquePtr<SSL_SESSION> * out_session,int32_t * out_ticket_age_skew,bool * out_offered_ticket,const SSLMessage & msg,const SSL_CLIENT_HELLO * client_hello)260 static enum ssl_ticket_aead_result_t select_session(
261 SSL_HANDSHAKE *hs, uint8_t *out_alert, UniquePtr<SSL_SESSION> *out_session,
262 int32_t *out_ticket_age_skew, bool *out_offered_ticket,
263 const SSLMessage &msg, const SSL_CLIENT_HELLO *client_hello) {
264 SSL *const ssl = hs->ssl;
265 *out_session = nullptr;
266
267 CBS pre_shared_key;
268 *out_offered_ticket = ssl_client_hello_get_extension(
269 client_hello, &pre_shared_key, TLSEXT_TYPE_pre_shared_key);
270 if (!*out_offered_ticket) {
271 return ssl_ticket_aead_ignore_ticket;
272 }
273
274 // Per RFC 8446, section 4.2.9, servers MUST abort the handshake if the client
275 // sends pre_shared_key without psk_key_exchange_modes.
276 CBS unused;
277 if (!ssl_client_hello_get_extension(client_hello, &unused,
278 TLSEXT_TYPE_psk_key_exchange_modes)) {
279 *out_alert = SSL_AD_MISSING_EXTENSION;
280 OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
281 return ssl_ticket_aead_error;
282 }
283
284 CBS ticket, binders;
285 uint32_t client_ticket_age;
286 if (!ssl_ext_pre_shared_key_parse_clienthello(
287 hs, &ticket, &binders, &client_ticket_age, out_alert, client_hello,
288 &pre_shared_key)) {
289 return ssl_ticket_aead_error;
290 }
291
292 // If the peer did not offer psk_dhe, ignore the resumption.
293 if (!hs->accept_psk_mode) {
294 return ssl_ticket_aead_ignore_ticket;
295 }
296
297 // TLS 1.3 session tickets are renewed separately as part of the
298 // NewSessionTicket.
299 bool unused_renew;
300 UniquePtr<SSL_SESSION> session;
301 enum ssl_ticket_aead_result_t ret =
302 ssl_process_ticket(hs, &session, &unused_renew, ticket, {});
303 switch (ret) {
304 case ssl_ticket_aead_success:
305 break;
306 case ssl_ticket_aead_error:
307 *out_alert = SSL_AD_INTERNAL_ERROR;
308 return ret;
309 default:
310 return ret;
311 }
312
313 if (!ssl_session_is_resumable(hs, session.get()) ||
314 // Historically, some TLS 1.3 tickets were missing ticket_age_add.
315 !session->ticket_age_add_valid) {
316 return ssl_ticket_aead_ignore_ticket;
317 }
318
319 // Recover the client ticket age and convert to seconds.
320 client_ticket_age -= session->ticket_age_add;
321 client_ticket_age /= 1000;
322
323 struct OPENSSL_timeval now;
324 ssl_get_current_time(ssl, &now);
325
326 // Compute the server ticket age in seconds.
327 assert(now.tv_sec >= session->time);
328 uint64_t server_ticket_age = now.tv_sec - session->time;
329
330 // To avoid overflowing |hs->ticket_age_skew|, we will not resume
331 // 68-year-old sessions.
332 if (server_ticket_age > INT32_MAX) {
333 return ssl_ticket_aead_ignore_ticket;
334 }
335
336 *out_ticket_age_skew = static_cast<int32_t>(client_ticket_age) -
337 static_cast<int32_t>(server_ticket_age);
338
339 // Check the PSK binder.
340 if (!tls13_verify_psk_binder(hs, session.get(), msg, &binders)) {
341 *out_alert = SSL_AD_DECRYPT_ERROR;
342 return ssl_ticket_aead_error;
343 }
344
345 *out_session = std::move(session);
346 return ssl_ticket_aead_success;
347 }
348
quic_ticket_compatible(const SSL_SESSION * session,const SSL_CONFIG * config)349 static bool quic_ticket_compatible(const SSL_SESSION *session,
350 const SSL_CONFIG *config) {
351 if (!session->is_quic) {
352 return true;
353 }
354
355 if (session->quic_early_data_context.empty() ||
356 config->quic_early_data_context.size() !=
357 session->quic_early_data_context.size() ||
358 CRYPTO_memcmp(config->quic_early_data_context.data(),
359 session->quic_early_data_context.data(),
360 session->quic_early_data_context.size()) != 0) {
361 return false;
362 }
363 return true;
364 }
365
do_select_session(SSL_HANDSHAKE * hs)366 static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
367 SSL *const ssl = hs->ssl;
368 SSLMessage msg;
369 SSL_CLIENT_HELLO client_hello;
370 if (!hs->GetClientHello(&msg, &client_hello)) {
371 return ssl_hs_error;
372 }
373
374 uint8_t alert = SSL_AD_DECODE_ERROR;
375 UniquePtr<SSL_SESSION> session;
376 bool offered_ticket = false;
377 switch (select_session(hs, &alert, &session, &ssl->s3->ticket_age_skew,
378 &offered_ticket, msg, &client_hello)) {
379 case ssl_ticket_aead_ignore_ticket:
380 assert(!session);
381 if (!ssl_get_new_session(hs)) {
382 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
383 return ssl_hs_error;
384 }
385 break;
386
387 case ssl_ticket_aead_success:
388 // Carry over authentication information from the previous handshake into
389 // a fresh session.
390 hs->new_session =
391 SSL_SESSION_dup(session.get(), SSL_SESSION_DUP_AUTH_ONLY);
392 if (hs->new_session == nullptr) {
393 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
394 return ssl_hs_error;
395 }
396
397 ssl->s3->session_reused = true;
398 hs->can_release_private_key = true;
399
400 // Resumption incorporates fresh key material, so refresh the timeout.
401 ssl_session_renew_timeout(ssl, hs->new_session.get(),
402 ssl->session_ctx->session_psk_dhe_timeout);
403 break;
404
405 case ssl_ticket_aead_error:
406 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
407 return ssl_hs_error;
408
409 case ssl_ticket_aead_retry:
410 hs->tls13_state = state13_select_session;
411 return ssl_hs_pending_ticket;
412 }
413
414 // Negotiate ALPS now, after ALPN is negotiated and |hs->new_session| is
415 // initialized.
416 if (!ssl_negotiate_alps(hs, &alert, &client_hello)) {
417 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
418 return ssl_hs_error;
419 }
420
421 // Record connection properties in the new session.
422 hs->new_session->cipher = hs->new_cipher;
423 if (!tls1_get_shared_group(hs, &hs->new_session->group_id)) {
424 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_GROUP);
425 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
426 return ssl_hs_error;
427 }
428
429 // Determine if we need HelloRetryRequest.
430 bool found_key_share;
431 if (!ssl_ext_key_share_parse_clienthello(hs, &found_key_share,
432 /*out_key_share=*/nullptr, &alert,
433 &client_hello)) {
434 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
435 return ssl_hs_error;
436 }
437
438 // Determine if we're negotiating 0-RTT.
439 if (!ssl->enable_early_data) {
440 ssl->s3->early_data_reason = ssl_early_data_disabled;
441 } else if (!offered_ticket) {
442 ssl->s3->early_data_reason = ssl_early_data_no_session_offered;
443 } else if (!session) {
444 ssl->s3->early_data_reason = ssl_early_data_session_not_resumed;
445 } else if (session->ticket_max_early_data == 0) {
446 ssl->s3->early_data_reason = ssl_early_data_unsupported_for_session;
447 } else if (!hs->early_data_offered) {
448 ssl->s3->early_data_reason = ssl_early_data_peer_declined;
449 } else if (hs->channel_id_negotiated) {
450 // Channel ID is incompatible with 0-RTT.
451 ssl->s3->early_data_reason = ssl_early_data_channel_id;
452 } else if (MakeConstSpan(ssl->s3->alpn_selected) != session->early_alpn) {
453 // The negotiated ALPN must match the one in the ticket.
454 ssl->s3->early_data_reason = ssl_early_data_alpn_mismatch;
455 } else if (hs->new_session->has_application_settings !=
456 session->has_application_settings ||
457 MakeConstSpan(hs->new_session->local_application_settings) !=
458 session->local_application_settings) {
459 ssl->s3->early_data_reason = ssl_early_data_alps_mismatch;
460 } else if (ssl->s3->ticket_age_skew < -kMaxTicketAgeSkewSeconds ||
461 kMaxTicketAgeSkewSeconds < ssl->s3->ticket_age_skew) {
462 ssl->s3->early_data_reason = ssl_early_data_ticket_age_skew;
463 } else if (!quic_ticket_compatible(session.get(), hs->config)) {
464 ssl->s3->early_data_reason = ssl_early_data_quic_parameter_mismatch;
465 } else if (!found_key_share) {
466 ssl->s3->early_data_reason = ssl_early_data_hello_retry_request;
467 } else {
468 // |ssl_session_is_resumable| forbids cross-cipher resumptions even if the
469 // PRF hashes match.
470 assert(hs->new_cipher == session->cipher);
471
472 ssl->s3->early_data_reason = ssl_early_data_accepted;
473 ssl->s3->early_data_accepted = true;
474 }
475
476 // Store the ALPN and ALPS values in the session for 0-RTT. Note the peer
477 // applications settings are not generally known until client
478 // EncryptedExtensions.
479 if (!hs->new_session->early_alpn.CopyFrom(ssl->s3->alpn_selected)) {
480 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
481 return ssl_hs_error;
482 }
483
484 // The peer applications settings are usually received later, in
485 // EncryptedExtensions. But, in 0-RTT handshakes, we carry over the
486 // values from |session|. Do this now, before |session| is discarded.
487 if (ssl->s3->early_data_accepted &&
488 hs->new_session->has_application_settings &&
489 !hs->new_session->peer_application_settings.CopyFrom(
490 session->peer_application_settings)) {
491 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
492 return ssl_hs_error;
493 }
494
495 // Copy the QUIC early data context to the session.
496 if (ssl->enable_early_data && ssl->quic_method) {
497 if (!hs->new_session->quic_early_data_context.CopyFrom(
498 hs->config->quic_early_data_context)) {
499 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
500 return ssl_hs_error;
501 }
502 }
503
504 if (ssl->ctx->dos_protection_cb != NULL &&
505 ssl->ctx->dos_protection_cb(&client_hello) == 0) {
506 // Connection rejected for DOS reasons.
507 OPENSSL_PUT_ERROR(SSL, SSL_R_CONNECTION_REJECTED);
508 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
509 return ssl_hs_error;
510 }
511
512 size_t hash_len = EVP_MD_size(
513 ssl_get_handshake_digest(ssl_protocol_version(ssl), hs->new_cipher));
514
515 // Set up the key schedule and incorporate the PSK into the running secret.
516 if (!tls13_init_key_schedule(
517 hs, ssl->s3->session_reused
518 ? MakeConstSpan(hs->new_session->secret,
519 hs->new_session->secret_length)
520 : MakeConstSpan(kZeroes, hash_len)) ||
521 !ssl_hash_message(hs, msg)) {
522 return ssl_hs_error;
523 }
524
525 if (ssl->s3->early_data_accepted) {
526 if (!tls13_derive_early_secret(hs)) {
527 return ssl_hs_error;
528 }
529 } else if (hs->early_data_offered) {
530 ssl->s3->skip_early_data = true;
531 }
532
533 if (!found_key_share) {
534 ssl->method->next_message(ssl);
535 if (!hs->transcript.UpdateForHelloRetryRequest()) {
536 return ssl_hs_error;
537 }
538 hs->tls13_state = state13_send_hello_retry_request;
539 return ssl_hs_ok;
540 }
541
542 if (!resolve_ecdhe_secret(hs, &client_hello)) {
543 return ssl_hs_error;
544 }
545
546 ssl->method->next_message(ssl);
547 hs->ech_client_hello_buf.Reset();
548 hs->tls13_state = state13_send_server_hello;
549 return ssl_hs_ok;
550 }
551
do_send_hello_retry_request(SSL_HANDSHAKE * hs)552 static enum ssl_hs_wait_t do_send_hello_retry_request(SSL_HANDSHAKE *hs) {
553 SSL *const ssl = hs->ssl;
554 if (hs->hints_requested) {
555 return ssl_hs_hints_ready;
556 }
557
558 ScopedCBB cbb;
559 CBB body, session_id, extensions;
560 uint16_t group_id;
561 if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
562 !CBB_add_u16(&body, TLS1_2_VERSION) ||
563 !CBB_add_bytes(&body, kHelloRetryRequest, SSL3_RANDOM_SIZE) ||
564 !CBB_add_u8_length_prefixed(&body, &session_id) ||
565 !CBB_add_bytes(&session_id, hs->session_id, hs->session_id_len) ||
566 !CBB_add_u16(&body, SSL_CIPHER_get_protocol_id(hs->new_cipher)) ||
567 !CBB_add_u8(&body, 0 /* no compression */) ||
568 !tls1_get_shared_group(hs, &group_id) ||
569 !CBB_add_u16_length_prefixed(&body, &extensions) ||
570 !CBB_add_u16(&extensions, TLSEXT_TYPE_supported_versions) ||
571 !CBB_add_u16(&extensions, 2 /* length */) ||
572 !CBB_add_u16(&extensions, ssl->version) ||
573 !CBB_add_u16(&extensions, TLSEXT_TYPE_key_share) ||
574 !CBB_add_u16(&extensions, 2 /* length */) ||
575 !CBB_add_u16(&extensions, group_id)) {
576 return ssl_hs_error;
577 }
578 if (hs->ech_is_inner) {
579 // Fill a placeholder for the ECH confirmation value.
580 if (!CBB_add_u16(&extensions, TLSEXT_TYPE_encrypted_client_hello) ||
581 !CBB_add_u16(&extensions, ECH_CONFIRMATION_SIGNAL_LEN) ||
582 !CBB_add_zeros(&extensions, ECH_CONFIRMATION_SIGNAL_LEN)) {
583 return ssl_hs_error;
584 }
585 }
586 Array<uint8_t> hrr;
587 if (!ssl->method->finish_message(ssl, cbb.get(), &hrr)) {
588 return ssl_hs_error;
589 }
590 if (hs->ech_is_inner) {
591 // Now that the message is encoded, fill in the whole value.
592 size_t offset = hrr.size() - ECH_CONFIRMATION_SIGNAL_LEN;
593 if (!ssl_ech_accept_confirmation(
594 hs, MakeSpan(hrr).last(ECH_CONFIRMATION_SIGNAL_LEN),
595 ssl->s3->client_random, hs->transcript, /*is_hrr=*/true, hrr,
596 offset)) {
597 return ssl_hs_error;
598 }
599 }
600
601 if (!ssl->method->add_message(ssl, std::move(hrr)) ||
602 !ssl->method->add_change_cipher_spec(ssl)) {
603 return ssl_hs_error;
604 }
605
606 ssl->s3->used_hello_retry_request = true;
607 hs->tls13_state = state13_read_second_client_hello;
608 return ssl_hs_flush;
609 }
610
do_read_second_client_hello(SSL_HANDSHAKE * hs)611 static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
612 SSL *const ssl = hs->ssl;
613 SSLMessage msg;
614 if (!ssl->method->get_message(ssl, &msg)) {
615 return ssl_hs_read_message;
616 }
617 if (!ssl_check_message_type(ssl, msg, SSL3_MT_CLIENT_HELLO)) {
618 return ssl_hs_error;
619 }
620 SSL_CLIENT_HELLO client_hello;
621 if (!ssl_client_hello_init(ssl, &client_hello, msg.body)) {
622 OPENSSL_PUT_ERROR(SSL, SSL_R_CLIENTHELLO_PARSE_FAILED);
623 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
624 return ssl_hs_error;
625 }
626
627 if (ssl->s3->ech_status == ssl_ech_accepted) {
628 // If we previously accepted the ClientHelloInner, the second ClientHello
629 // must contain an outer encrypted_client_hello extension.
630 CBS ech_body;
631 if (!ssl_client_hello_get_extension(&client_hello, &ech_body,
632 TLSEXT_TYPE_encrypted_client_hello)) {
633 OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
634 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION);
635 return ssl_hs_error;
636 }
637 uint16_t kdf_id, aead_id;
638 uint8_t type, config_id;
639 CBS enc, payload;
640 if (!CBS_get_u8(&ech_body, &type) || //
641 type != ECH_CLIENT_OUTER || //
642 !CBS_get_u16(&ech_body, &kdf_id) || //
643 !CBS_get_u16(&ech_body, &aead_id) ||
644 !CBS_get_u8(&ech_body, &config_id) ||
645 !CBS_get_u16_length_prefixed(&ech_body, &enc) ||
646 !CBS_get_u16_length_prefixed(&ech_body, &payload) ||
647 CBS_len(&ech_body) != 0) {
648 OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
649 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
650 return ssl_hs_error;
651 }
652
653 if (kdf_id != EVP_HPKE_KDF_id(EVP_HPKE_CTX_kdf(hs->ech_hpke_ctx.get())) ||
654 aead_id !=
655 EVP_HPKE_AEAD_id(EVP_HPKE_CTX_aead(hs->ech_hpke_ctx.get())) ||
656 config_id != hs->ech_config_id || CBS_len(&enc) > 0) {
657 OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
658 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
659 return ssl_hs_error;
660 }
661
662 // Decrypt the payload with the HPKE context from the first ClientHello.
663 uint8_t alert = SSL_AD_DECODE_ERROR;
664 bool unused;
665 if (!ssl_client_hello_decrypt(hs, &alert, &unused,
666 &hs->ech_client_hello_buf, &client_hello,
667 payload)) {
668 // Decryption failure is fatal in the second ClientHello.
669 OPENSSL_PUT_ERROR(SSL, SSL_R_DECRYPTION_FAILED);
670 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
671 return ssl_hs_error;
672 }
673
674 // Reparse |client_hello| from the buffer owned by |hs|.
675 if (!hs->GetClientHello(&msg, &client_hello)) {
676 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
677 return ssl_hs_error;
678 }
679 }
680
681 // We perform all our negotiation based on the first ClientHello (for
682 // consistency with what |select_certificate_cb| observed), which is in the
683 // transcript, so we can ignore most of this second one.
684 //
685 // We do, however, check the second PSK binder. This covers the client key
686 // share, in case we ever send half-RTT data (we currently do not). It is also
687 // a tricky computation, so we enforce the peer handled it correctly.
688 if (ssl->s3->session_reused) {
689 CBS pre_shared_key;
690 if (!ssl_client_hello_get_extension(&client_hello, &pre_shared_key,
691 TLSEXT_TYPE_pre_shared_key)) {
692 OPENSSL_PUT_ERROR(SSL, SSL_R_INCONSISTENT_CLIENT_HELLO);
693 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
694 return ssl_hs_error;
695 }
696
697 CBS ticket, binders;
698 uint32_t client_ticket_age;
699 uint8_t alert = SSL_AD_DECODE_ERROR;
700 if (!ssl_ext_pre_shared_key_parse_clienthello(
701 hs, &ticket, &binders, &client_ticket_age, &alert, &client_hello,
702 &pre_shared_key)) {
703 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
704 return ssl_hs_error;
705 }
706
707 // Note it is important that we do not obtain a new |SSL_SESSION| from
708 // |ticket|. We have already selected parameters based on the first
709 // ClientHello (in the transcript) and must not switch partway through.
710 if (!tls13_verify_psk_binder(hs, hs->new_session.get(), msg, &binders)) {
711 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
712 return ssl_hs_error;
713 }
714 }
715
716 if (!resolve_ecdhe_secret(hs, &client_hello)) {
717 return ssl_hs_error;
718 }
719
720 if (!ssl_hash_message(hs, msg)) {
721 return ssl_hs_error;
722 }
723
724 // ClientHello should be the end of the flight.
725 if (ssl->method->has_unprocessed_handshake_data(ssl)) {
726 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
727 OPENSSL_PUT_ERROR(SSL, SSL_R_EXCESS_HANDSHAKE_DATA);
728 return ssl_hs_error;
729 }
730
731 ssl->method->next_message(ssl);
732 hs->ech_client_hello_buf.Reset();
733 hs->tls13_state = state13_send_server_hello;
734 return ssl_hs_ok;
735 }
736
do_send_server_hello(SSL_HANDSHAKE * hs)737 static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
738 SSL *const ssl = hs->ssl;
739
740 Span<uint8_t> random(ssl->s3->server_random);
741
742 SSL_HANDSHAKE_HINTS *const hints = hs->hints.get();
743 if (hints && !hs->hints_requested &&
744 hints->server_random_tls13.size() == random.size()) {
745 OPENSSL_memcpy(random.data(), hints->server_random_tls13.data(),
746 random.size());
747 } else {
748 RAND_bytes(random.data(), random.size());
749 if (hints && hs->hints_requested &&
750 !hints->server_random_tls13.CopyFrom(random)) {
751 return ssl_hs_error;
752 }
753 }
754
755 Array<uint8_t> server_hello;
756 ScopedCBB cbb;
757 CBB body, extensions, session_id;
758 if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
759 !CBB_add_u16(&body, TLS1_2_VERSION) ||
760 !CBB_add_bytes(&body, ssl->s3->server_random,
761 sizeof(ssl->s3->server_random)) ||
762 !CBB_add_u8_length_prefixed(&body, &session_id) ||
763 !CBB_add_bytes(&session_id, hs->session_id, hs->session_id_len) ||
764 !CBB_add_u16(&body, SSL_CIPHER_get_protocol_id(hs->new_cipher)) ||
765 !CBB_add_u8(&body, 0) ||
766 !CBB_add_u16_length_prefixed(&body, &extensions) ||
767 !ssl_ext_pre_shared_key_add_serverhello(hs, &extensions) ||
768 !ssl_ext_key_share_add_serverhello(hs, &extensions) ||
769 !ssl_ext_supported_versions_add_serverhello(hs, &extensions) ||
770 !ssl->method->finish_message(ssl, cbb.get(), &server_hello)) {
771 return ssl_hs_error;
772 }
773
774 assert(ssl->s3->ech_status != ssl_ech_accepted || hs->ech_is_inner);
775 if (hs->ech_is_inner) {
776 // Fill in the ECH confirmation signal.
777 const size_t offset = ssl_ech_confirmation_signal_hello_offset(ssl);
778 Span<uint8_t> random_suffix = random.last(ECH_CONFIRMATION_SIGNAL_LEN);
779 if (!ssl_ech_accept_confirmation(hs, random_suffix, ssl->s3->client_random,
780 hs->transcript,
781 /*is_hrr=*/false, server_hello, offset)) {
782 return ssl_hs_error;
783 }
784
785 // Update |server_hello|.
786 Span<uint8_t> server_hello_out =
787 MakeSpan(server_hello).subspan(offset, ECH_CONFIRMATION_SIGNAL_LEN);
788 OPENSSL_memcpy(server_hello_out.data(), random_suffix.data(),
789 ECH_CONFIRMATION_SIGNAL_LEN);
790 }
791
792 if (!ssl->method->add_message(ssl, std::move(server_hello))) {
793 return ssl_hs_error;
794 }
795
796 hs->key_share_ciphertext.Reset(); // No longer needed.
797 if (!ssl->s3->used_hello_retry_request &&
798 !ssl->method->add_change_cipher_spec(ssl)) {
799 return ssl_hs_error;
800 }
801
802 // Derive and enable the handshake traffic secrets.
803 if (!tls13_derive_handshake_secrets(hs) ||
804 !tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_seal,
805 hs->new_session.get(),
806 hs->server_handshake_secret())) {
807 return ssl_hs_error;
808 }
809
810 // Send EncryptedExtensions.
811 if (!ssl->method->init_message(ssl, cbb.get(), &body,
812 SSL3_MT_ENCRYPTED_EXTENSIONS) ||
813 !ssl_add_serverhello_tlsext(hs, &body) ||
814 !ssl_add_message_cbb(ssl, cbb.get())) {
815 return ssl_hs_error;
816 }
817
818 if (!ssl->s3->session_reused) {
819 // Determine whether to request a client certificate.
820 hs->cert_request = !!(hs->config->verify_mode & SSL_VERIFY_PEER);
821 // Only request a certificate if Channel ID isn't negotiated.
822 if ((hs->config->verify_mode & SSL_VERIFY_PEER_IF_NO_OBC) &&
823 hs->channel_id_negotiated) {
824 hs->cert_request = false;
825 }
826 }
827
828 // Send a CertificateRequest, if necessary.
829 if (hs->cert_request) {
830 CBB cert_request_extensions, sigalg_contents, sigalgs_cbb;
831 if (!ssl->method->init_message(ssl, cbb.get(), &body,
832 SSL3_MT_CERTIFICATE_REQUEST) ||
833 !CBB_add_u8(&body, 0 /* no certificate_request_context. */) ||
834 !CBB_add_u16_length_prefixed(&body, &cert_request_extensions) ||
835 !CBB_add_u16(&cert_request_extensions,
836 TLSEXT_TYPE_signature_algorithms) ||
837 !CBB_add_u16_length_prefixed(&cert_request_extensions,
838 &sigalg_contents) ||
839 !CBB_add_u16_length_prefixed(&sigalg_contents, &sigalgs_cbb) ||
840 !tls12_add_verify_sigalgs(hs, &sigalgs_cbb)) {
841 return ssl_hs_error;
842 }
843
844 if (ssl_has_client_CAs(hs->config)) {
845 CBB ca_contents;
846 if (!CBB_add_u16(&cert_request_extensions,
847 TLSEXT_TYPE_certificate_authorities) ||
848 !CBB_add_u16_length_prefixed(&cert_request_extensions,
849 &ca_contents) ||
850 !ssl_add_client_CA_list(hs, &ca_contents) ||
851 !CBB_flush(&cert_request_extensions)) {
852 return ssl_hs_error;
853 }
854 }
855
856 if (!ssl_add_message_cbb(ssl, cbb.get())) {
857 return ssl_hs_error;
858 }
859 }
860
861 // Send the server Certificate message, if necessary.
862 if (!ssl->s3->session_reused) {
863 if (!ssl_has_certificate(hs)) {
864 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CERTIFICATE_SET);
865 return ssl_hs_error;
866 }
867
868 if (!tls13_add_certificate(hs)) {
869 return ssl_hs_error;
870 }
871
872 hs->tls13_state = state13_send_server_certificate_verify;
873 return ssl_hs_ok;
874 }
875
876 hs->tls13_state = state13_send_server_finished;
877 return ssl_hs_ok;
878 }
879
do_send_server_certificate_verify(SSL_HANDSHAKE * hs)880 static enum ssl_hs_wait_t do_send_server_certificate_verify(SSL_HANDSHAKE *hs) {
881 switch (tls13_add_certificate_verify(hs)) {
882 case ssl_private_key_success:
883 hs->tls13_state = state13_send_server_finished;
884 return ssl_hs_ok;
885
886 case ssl_private_key_retry:
887 hs->tls13_state = state13_send_server_certificate_verify;
888 return ssl_hs_private_key_operation;
889
890 case ssl_private_key_failure:
891 return ssl_hs_error;
892 }
893
894 assert(0);
895 return ssl_hs_error;
896 }
897
do_send_server_finished(SSL_HANDSHAKE * hs)898 static enum ssl_hs_wait_t do_send_server_finished(SSL_HANDSHAKE *hs) {
899 SSL *const ssl = hs->ssl;
900 if (hs->hints_requested) {
901 return ssl_hs_hints_ready;
902 }
903
904 hs->can_release_private_key = true;
905 if (!tls13_add_finished(hs) ||
906 // Update the secret to the master secret and derive traffic keys.
907 !tls13_advance_key_schedule(
908 hs, MakeConstSpan(kZeroes, hs->transcript.DigestLen())) ||
909 !tls13_derive_application_secrets(hs) ||
910 !tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_seal,
911 hs->new_session.get(),
912 hs->server_traffic_secret_0())) {
913 return ssl_hs_error;
914 }
915
916 hs->tls13_state = state13_send_half_rtt_ticket;
917 return hs->handback ? ssl_hs_handback : ssl_hs_ok;
918 }
919
do_send_half_rtt_ticket(SSL_HANDSHAKE * hs)920 static enum ssl_hs_wait_t do_send_half_rtt_ticket(SSL_HANDSHAKE *hs) {
921 SSL *const ssl = hs->ssl;
922
923 if (ssl->s3->early_data_accepted) {
924 // If accepting 0-RTT, we send tickets half-RTT. This gets the tickets on
925 // the wire sooner and also avoids triggering a write on |SSL_read| when
926 // processing the client Finished. This requires computing the client
927 // Finished early. See RFC 8446, section 4.6.1.
928 static const uint8_t kEndOfEarlyData[4] = {SSL3_MT_END_OF_EARLY_DATA, 0,
929 0, 0};
930 if (ssl->quic_method == nullptr &&
931 !hs->transcript.Update(kEndOfEarlyData)) {
932 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
933 return ssl_hs_error;
934 }
935
936 size_t finished_len;
937 if (!tls13_finished_mac(hs, hs->expected_client_finished().data(),
938 &finished_len, false /* client */)) {
939 return ssl_hs_error;
940 }
941
942 if (finished_len != hs->expected_client_finished().size()) {
943 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
944 return ssl_hs_error;
945 }
946
947 // Feed the predicted Finished into the transcript. This allows us to derive
948 // the resumption secret early and send half-RTT tickets.
949 //
950 // TODO(davidben): This will need to be updated for DTLS 1.3.
951 assert(!SSL_is_dtls(hs->ssl));
952 assert(hs->expected_client_finished().size() <= 0xff);
953 uint8_t header[4] = {
954 SSL3_MT_FINISHED, 0, 0,
955 static_cast<uint8_t>(hs->expected_client_finished().size())};
956 bool unused_sent_tickets;
957 if (!hs->transcript.Update(header) ||
958 !hs->transcript.Update(hs->expected_client_finished()) ||
959 !tls13_derive_resumption_secret(hs) ||
960 !add_new_session_tickets(hs, &unused_sent_tickets)) {
961 return ssl_hs_error;
962 }
963 }
964
965 hs->tls13_state = state13_read_second_client_flight;
966 return ssl_hs_flush;
967 }
968
do_read_second_client_flight(SSL_HANDSHAKE * hs)969 static enum ssl_hs_wait_t do_read_second_client_flight(SSL_HANDSHAKE *hs) {
970 SSL *const ssl = hs->ssl;
971 if (ssl->s3->early_data_accepted) {
972 if (!tls13_set_traffic_key(ssl, ssl_encryption_early_data, evp_aead_open,
973 hs->new_session.get(),
974 hs->early_traffic_secret())) {
975 return ssl_hs_error;
976 }
977 hs->can_early_write = true;
978 hs->can_early_read = true;
979 hs->in_early_data = true;
980 }
981
982 // QUIC doesn't use an EndOfEarlyData message (RFC 9001, section 8.3), so we
983 // switch to client_handshake_secret before the early return.
984 if (ssl->quic_method != nullptr) {
985 if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open,
986 hs->new_session.get(),
987 hs->client_handshake_secret())) {
988 return ssl_hs_error;
989 }
990 hs->tls13_state = state13_process_end_of_early_data;
991 return ssl->s3->early_data_accepted ? ssl_hs_early_return : ssl_hs_ok;
992 }
993
994 hs->tls13_state = state13_process_end_of_early_data;
995 return ssl->s3->early_data_accepted ? ssl_hs_read_end_of_early_data
996 : ssl_hs_ok;
997 }
998
do_process_end_of_early_data(SSL_HANDSHAKE * hs)999 static enum ssl_hs_wait_t do_process_end_of_early_data(SSL_HANDSHAKE *hs) {
1000 SSL *const ssl = hs->ssl;
1001 // In protocols that use EndOfEarlyData, we must consume the extra message and
1002 // switch to client_handshake_secret after the early return.
1003 if (ssl->quic_method == nullptr) {
1004 // If early data was not accepted, the EndOfEarlyData will be in the
1005 // discarded early data.
1006 if (hs->ssl->s3->early_data_accepted) {
1007 SSLMessage msg;
1008 if (!ssl->method->get_message(ssl, &msg)) {
1009 return ssl_hs_read_message;
1010 }
1011 if (!ssl_check_message_type(ssl, msg, SSL3_MT_END_OF_EARLY_DATA)) {
1012 return ssl_hs_error;
1013 }
1014 if (CBS_len(&msg.body) != 0) {
1015 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1016 OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1017 return ssl_hs_error;
1018 }
1019 ssl->method->next_message(ssl);
1020 }
1021 if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open,
1022 hs->new_session.get(),
1023 hs->client_handshake_secret())) {
1024 return ssl_hs_error;
1025 }
1026 }
1027 hs->tls13_state = state13_read_client_encrypted_extensions;
1028 return ssl_hs_ok;
1029 }
1030
do_read_client_encrypted_extensions(SSL_HANDSHAKE * hs)1031 static enum ssl_hs_wait_t do_read_client_encrypted_extensions(
1032 SSL_HANDSHAKE *hs) {
1033 SSL *const ssl = hs->ssl;
1034 // For now, only one extension uses client EncryptedExtensions. This function
1035 // may be generalized if others use it in the future.
1036 if (hs->new_session->has_application_settings &&
1037 !ssl->s3->early_data_accepted) {
1038 SSLMessage msg;
1039 if (!ssl->method->get_message(ssl, &msg)) {
1040 return ssl_hs_read_message;
1041 }
1042 if (!ssl_check_message_type(ssl, msg, SSL3_MT_ENCRYPTED_EXTENSIONS)) {
1043 return ssl_hs_error;
1044 }
1045
1046 CBS body = msg.body, extensions;
1047 if (!CBS_get_u16_length_prefixed(&body, &extensions) ||
1048 CBS_len(&body) != 0) {
1049 OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
1050 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
1051 return ssl_hs_error;
1052 }
1053
1054 SSLExtension application_settings(TLSEXT_TYPE_application_settings);
1055 uint8_t alert = SSL_AD_DECODE_ERROR;
1056 if (!ssl_parse_extensions(&extensions, &alert, {&application_settings},
1057 /*ignore_unknown=*/false)) {
1058 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
1059 return ssl_hs_error;
1060 }
1061
1062 if (!application_settings.present) {
1063 OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_EXTENSION);
1064 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION);
1065 return ssl_hs_error;
1066 }
1067
1068 // Note that, if 0-RTT was accepted, these values will already have been
1069 // initialized earlier.
1070 if (!hs->new_session->peer_application_settings.CopyFrom(
1071 application_settings.data) ||
1072 !ssl_hash_message(hs, msg)) {
1073 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
1074 return ssl_hs_error;
1075 }
1076
1077 ssl->method->next_message(ssl);
1078 }
1079
1080 hs->tls13_state = state13_read_client_certificate;
1081 return ssl_hs_ok;
1082 }
1083
do_read_client_certificate(SSL_HANDSHAKE * hs)1084 static enum ssl_hs_wait_t do_read_client_certificate(SSL_HANDSHAKE *hs) {
1085 SSL *const ssl = hs->ssl;
1086 if (!hs->cert_request) {
1087 if (!ssl->s3->session_reused) {
1088 // OpenSSL returns X509_V_OK when no certificates are requested. This is
1089 // classed by them as a bug, but it's assumed by at least NGINX. (Only do
1090 // this in full handshakes as resumptions should carry over the previous
1091 // |verify_result|, though this is a no-op because servers do not
1092 // implement the client's odd soft-fail mode.)
1093 hs->new_session->verify_result = X509_V_OK;
1094 }
1095
1096 // Skip this state.
1097 hs->tls13_state = state13_read_channel_id;
1098 return ssl_hs_ok;
1099 }
1100
1101 const bool allow_anonymous =
1102 (hs->config->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) == 0;
1103 SSLMessage msg;
1104 if (!ssl->method->get_message(ssl, &msg)) {
1105 return ssl_hs_read_message;
1106 }
1107 if (!ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE) ||
1108 !tls13_process_certificate(hs, msg, allow_anonymous) ||
1109 !ssl_hash_message(hs, msg)) {
1110 return ssl_hs_error;
1111 }
1112
1113 ssl->method->next_message(ssl);
1114 hs->tls13_state = state13_read_client_certificate_verify;
1115 return ssl_hs_ok;
1116 }
1117
do_read_client_certificate_verify(SSL_HANDSHAKE * hs)1118 static enum ssl_hs_wait_t do_read_client_certificate_verify(SSL_HANDSHAKE *hs) {
1119 SSL *const ssl = hs->ssl;
1120 if (sk_CRYPTO_BUFFER_num(hs->new_session->certs.get()) == 0) {
1121 // Skip this state.
1122 hs->tls13_state = state13_read_channel_id;
1123 return ssl_hs_ok;
1124 }
1125
1126 SSLMessage msg;
1127 if (!ssl->method->get_message(ssl, &msg)) {
1128 return ssl_hs_read_message;
1129 }
1130
1131 switch (ssl_verify_peer_cert(hs)) {
1132 case ssl_verify_ok:
1133 break;
1134 case ssl_verify_invalid:
1135 return ssl_hs_error;
1136 case ssl_verify_retry:
1137 hs->tls13_state = state13_read_client_certificate_verify;
1138 return ssl_hs_certificate_verify;
1139 }
1140
1141 if (!ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE_VERIFY) ||
1142 !tls13_process_certificate_verify(hs, msg) ||
1143 !ssl_hash_message(hs, msg)) {
1144 return ssl_hs_error;
1145 }
1146
1147 ssl->method->next_message(ssl);
1148 hs->tls13_state = state13_read_channel_id;
1149 return ssl_hs_ok;
1150 }
1151
do_read_channel_id(SSL_HANDSHAKE * hs)1152 static enum ssl_hs_wait_t do_read_channel_id(SSL_HANDSHAKE *hs) {
1153 SSL *const ssl = hs->ssl;
1154 if (!hs->channel_id_negotiated) {
1155 hs->tls13_state = state13_read_client_finished;
1156 return ssl_hs_ok;
1157 }
1158
1159 SSLMessage msg;
1160 if (!ssl->method->get_message(ssl, &msg)) {
1161 return ssl_hs_read_message;
1162 }
1163 if (!ssl_check_message_type(ssl, msg, SSL3_MT_CHANNEL_ID) ||
1164 !tls1_verify_channel_id(hs, msg) ||
1165 !ssl_hash_message(hs, msg)) {
1166 return ssl_hs_error;
1167 }
1168
1169 ssl->method->next_message(ssl);
1170 hs->tls13_state = state13_read_client_finished;
1171 return ssl_hs_ok;
1172 }
1173
do_read_client_finished(SSL_HANDSHAKE * hs)1174 static enum ssl_hs_wait_t do_read_client_finished(SSL_HANDSHAKE *hs) {
1175 SSL *const ssl = hs->ssl;
1176 SSLMessage msg;
1177 if (!ssl->method->get_message(ssl, &msg)) {
1178 return ssl_hs_read_message;
1179 }
1180 if (!ssl_check_message_type(ssl, msg, SSL3_MT_FINISHED) ||
1181 // If early data was accepted, we've already computed the client Finished
1182 // and derived the resumption secret.
1183 !tls13_process_finished(hs, msg, ssl->s3->early_data_accepted) ||
1184 // evp_aead_seal keys have already been switched.
1185 !tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_open,
1186 hs->new_session.get(),
1187 hs->client_traffic_secret_0())) {
1188 return ssl_hs_error;
1189 }
1190
1191 if (!ssl->s3->early_data_accepted) {
1192 if (!ssl_hash_message(hs, msg) ||
1193 !tls13_derive_resumption_secret(hs)) {
1194 return ssl_hs_error;
1195 }
1196
1197 // We send post-handshake tickets as part of the handshake in 1-RTT.
1198 hs->tls13_state = state13_send_new_session_ticket;
1199 } else {
1200 // We already sent half-RTT tickets.
1201 hs->tls13_state = state13_done;
1202 }
1203
1204 ssl->method->next_message(ssl);
1205 return ssl_hs_ok;
1206 }
1207
do_send_new_session_ticket(SSL_HANDSHAKE * hs)1208 static enum ssl_hs_wait_t do_send_new_session_ticket(SSL_HANDSHAKE *hs) {
1209 bool sent_tickets;
1210 if (!add_new_session_tickets(hs, &sent_tickets)) {
1211 return ssl_hs_error;
1212 }
1213
1214 hs->tls13_state = state13_done;
1215 // In TLS 1.3, the NewSessionTicket isn't flushed until the server performs a
1216 // write, to prevent a non-reading client from causing the server to hang in
1217 // the case of a small server write buffer. Consumers which don't write data
1218 // to the client will need to do a zero-byte write if they wish to flush the
1219 // tickets.
1220 if (hs->ssl->quic_method != nullptr && sent_tickets) {
1221 return ssl_hs_flush;
1222 }
1223 return ssl_hs_ok;
1224 }
1225
tls13_server_handshake(SSL_HANDSHAKE * hs)1226 enum ssl_hs_wait_t tls13_server_handshake(SSL_HANDSHAKE *hs) {
1227 while (hs->tls13_state != state13_done) {
1228 enum ssl_hs_wait_t ret = ssl_hs_error;
1229 enum tls13_server_hs_state_t state =
1230 static_cast<enum tls13_server_hs_state_t>(hs->tls13_state);
1231 switch (state) {
1232 case state13_select_parameters:
1233 ret = do_select_parameters(hs);
1234 break;
1235 case state13_select_session:
1236 ret = do_select_session(hs);
1237 break;
1238 case state13_send_hello_retry_request:
1239 ret = do_send_hello_retry_request(hs);
1240 break;
1241 case state13_read_second_client_hello:
1242 ret = do_read_second_client_hello(hs);
1243 break;
1244 case state13_send_server_hello:
1245 ret = do_send_server_hello(hs);
1246 break;
1247 case state13_send_server_certificate_verify:
1248 ret = do_send_server_certificate_verify(hs);
1249 break;
1250 case state13_send_server_finished:
1251 ret = do_send_server_finished(hs);
1252 break;
1253 case state13_send_half_rtt_ticket:
1254 ret = do_send_half_rtt_ticket(hs);
1255 break;
1256 case state13_read_second_client_flight:
1257 ret = do_read_second_client_flight(hs);
1258 break;
1259 case state13_process_end_of_early_data:
1260 ret = do_process_end_of_early_data(hs);
1261 break;
1262 case state13_read_client_encrypted_extensions:
1263 ret = do_read_client_encrypted_extensions(hs);
1264 break;
1265 case state13_read_client_certificate:
1266 ret = do_read_client_certificate(hs);
1267 break;
1268 case state13_read_client_certificate_verify:
1269 ret = do_read_client_certificate_verify(hs);
1270 break;
1271 case state13_read_channel_id:
1272 ret = do_read_channel_id(hs);
1273 break;
1274 case state13_read_client_finished:
1275 ret = do_read_client_finished(hs);
1276 break;
1277 case state13_send_new_session_ticket:
1278 ret = do_send_new_session_ticket(hs);
1279 break;
1280 case state13_done:
1281 ret = ssl_hs_ok;
1282 break;
1283 }
1284
1285 if (hs->tls13_state != state) {
1286 ssl_do_info_callback(hs->ssl, SSL_CB_ACCEPT_LOOP, 1);
1287 }
1288
1289 if (ret != ssl_hs_ok) {
1290 return ret;
1291 }
1292 }
1293
1294 return ssl_hs_ok;
1295 }
1296
tls13_server_handshake_state(SSL_HANDSHAKE * hs)1297 const char *tls13_server_handshake_state(SSL_HANDSHAKE *hs) {
1298 enum tls13_server_hs_state_t state =
1299 static_cast<enum tls13_server_hs_state_t>(hs->tls13_state);
1300 switch (state) {
1301 case state13_select_parameters:
1302 return "TLS 1.3 server select_parameters";
1303 case state13_select_session:
1304 return "TLS 1.3 server select_session";
1305 case state13_send_hello_retry_request:
1306 return "TLS 1.3 server send_hello_retry_request";
1307 case state13_read_second_client_hello:
1308 return "TLS 1.3 server read_second_client_hello";
1309 case state13_send_server_hello:
1310 return "TLS 1.3 server send_server_hello";
1311 case state13_send_server_certificate_verify:
1312 return "TLS 1.3 server send_server_certificate_verify";
1313 case state13_send_half_rtt_ticket:
1314 return "TLS 1.3 server send_half_rtt_ticket";
1315 case state13_send_server_finished:
1316 return "TLS 1.3 server send_server_finished";
1317 case state13_read_second_client_flight:
1318 return "TLS 1.3 server read_second_client_flight";
1319 case state13_process_end_of_early_data:
1320 return "TLS 1.3 server process_end_of_early_data";
1321 case state13_read_client_encrypted_extensions:
1322 return "TLS 1.3 server read_client_encrypted_extensions";
1323 case state13_read_client_certificate:
1324 return "TLS 1.3 server read_client_certificate";
1325 case state13_read_client_certificate_verify:
1326 return "TLS 1.3 server read_client_certificate_verify";
1327 case state13_read_channel_id:
1328 return "TLS 1.3 server read_channel_id";
1329 case state13_read_client_finished:
1330 return "TLS 1.3 server read_client_finished";
1331 case state13_send_new_session_ticket:
1332 return "TLS 1.3 server send_new_session_ticket";
1333 case state13_done:
1334 return "TLS 1.3 server done";
1335 }
1336
1337 return "TLS 1.3 server unknown";
1338 }
1339
1340 BSSL_NAMESPACE_END
1341