1/* Copyright (c) 2016, Google Inc.
2 *
3 * Permission to use, copy, modify, and/or distribute this software for any
4 * purpose with or without fee is hereby granted, provided that the above
5 * copyright notice and this permission notice appear in all copies.
6 *
7 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14
15#include <openssl/ssl.h>
16
17#include <assert.h>
18#include <string.h>
19
20#include <tuple>
21
22#include <openssl/aead.h>
23#include <openssl/bytestring.h>
24#include <openssl/digest.h>
25#include <openssl/err.h>
26#include <openssl/mem.h>
27#include <openssl/rand.h>
28#include <openssl/stack.h>
29
30#include "../crypto/internal.h"
31#include "internal.h"
32
33
34BSSL_NAMESPACE_BEGIN
35
36enum server_hs_state_t {
37 state_select_parameters = 0,
38 state_select_session,
39 state_send_hello_retry_request,
40 state_read_second_client_hello,
41 state_send_server_hello,
42 state_send_server_certificate_verify,
43 state_send_server_finished,
44 state_read_second_client_flight,
45 state_process_end_of_early_data,
46 state_read_client_certificate,
47 state_read_client_certificate_verify,
48 state_read_channel_id,
49 state_read_client_finished,
50 state_send_new_session_ticket,
51 state_done,
52};
53
54static const uint8_t kZeroes[EVP_MAX_MD_SIZE] = {0};
55
56// Allow a minute of ticket age skew in either direction. This covers
57// transmission delays in ClientHello and NewSessionTicket, as well as
58// drift between client and server clock rate since the ticket was issued.
59// See RFC 8446, section 8.3.
60static const int32_t kMaxTicketAgeSkewSeconds = 60;
61
62static int resolve_ecdhe_secret(SSL_HANDSHAKE *hs, bool *out_need_retry,
63 SSL_CLIENT_HELLO *client_hello) {
64 SSL *const ssl = hs->ssl;
65 *out_need_retry = false;
66
67 // We only support connections that include an ECDHE key exchange.
68 CBS key_share;
69 if (!ssl_client_hello_get_extension(client_hello, &key_share,
70 TLSEXT_TYPE_key_share)) {
71 OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_KEY_SHARE);
72 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION);
73 return 0;
74 }
75
76 bool found_key_share;
77 Array<uint8_t> dhe_secret;
78 uint8_t alert = SSL_AD_DECODE_ERROR;
79 if (!ssl_ext_key_share_parse_clienthello(hs, &found_key_share, &dhe_secret,
80 &alert, &key_share)) {
81 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
82 return 0;
83 }
84
85 if (!found_key_share) {
86 *out_need_retry = true;
87 return 0;
88 }
89
90 return tls13_advance_key_schedule(hs, dhe_secret.data(), dhe_secret.size());
91}
92
93static int ssl_ext_supported_versions_add_serverhello(SSL_HANDSHAKE *hs,
94 CBB *out) {
95 CBB contents;
96 if (!CBB_add_u16(out, TLSEXT_TYPE_supported_versions) ||
97 !CBB_add_u16_length_prefixed(out, &contents) ||
98 !CBB_add_u16(&contents, hs->ssl->version) ||
99 !CBB_flush(out)) {
100 return 0;
101 }
102
103 return 1;
104}
105
106static const SSL_CIPHER *choose_tls13_cipher(
107 const SSL *ssl, const SSL_CLIENT_HELLO *client_hello, uint16_t group_id) {
108 CBS cipher_suites;
109 CBS_init(&cipher_suites, client_hello->cipher_suites,
110 client_hello->cipher_suites_len);
111
112 const uint16_t version = ssl_protocol_version(ssl);
113
114 return ssl_choose_tls13_cipher(cipher_suites, version, group_id);
115}
116
117static bool add_new_session_tickets(SSL_HANDSHAKE *hs, bool *out_sent_tickets) {
118 SSL *const ssl = hs->ssl;
119 if (// If the client doesn't accept resumption with PSK_DHE_KE, don't send a
120 // session ticket.
121 !hs->accept_psk_mode ||
122 // We only implement stateless resumption in TLS 1.3, so skip sending
123 // tickets if disabled.
124 (SSL_get_options(ssl) & SSL_OP_NO_TICKET)) {
125 *out_sent_tickets = false;
126 return true;
127 }
128
129 // TLS 1.3 recommends single-use tickets, so issue multiple tickets in case
130 // the client makes several connections before getting a renewal.
131 static const int kNumTickets = 2;
132
133 // Rebase the session timestamp so that it is measured from ticket
134 // issuance.
135 ssl_session_rebase_time(ssl, hs->new_session.get());
136
137 for (int i = 0; i < kNumTickets; i++) {
138 UniquePtr<SSL_SESSION> session(
139 SSL_SESSION_dup(hs->new_session.get(), SSL_SESSION_INCLUDE_NONAUTH));
140 if (!session) {
141 return false;
142 }
143
144 if (!RAND_bytes((uint8_t *)&session->ticket_age_add, 4)) {
145 return false;
146 }
147 session->ticket_age_add_valid = true;
148 if (ssl->enable_early_data) {
149 session->ticket_max_early_data = kMaxEarlyDataAccepted;
150 }
151
152 static_assert(kNumTickets < 256, "Too many tickets");
153 uint8_t nonce[] = {static_cast<uint8_t>(i)};
154
155 ScopedCBB cbb;
156 CBB body, nonce_cbb, ticket, extensions;
157 if (!ssl->method->init_message(ssl, cbb.get(), &body,
158 SSL3_MT_NEW_SESSION_TICKET) ||
159 !CBB_add_u32(&body, session->timeout) ||
160 !CBB_add_u32(&body, session->ticket_age_add) ||
161 !CBB_add_u8_length_prefixed(&body, &nonce_cbb) ||
162 !CBB_add_bytes(&nonce_cbb, nonce, sizeof(nonce)) ||
163 !CBB_add_u16_length_prefixed(&body, &ticket) ||
164 !tls13_derive_session_psk(session.get(), nonce) ||
165 !ssl_encrypt_ticket(hs, &ticket, session.get()) ||
166 !CBB_add_u16_length_prefixed(&body, &extensions)) {
167 return false;
168 }
169
170 if (ssl->enable_early_data) {
171 CBB early_data_info;
172 if (!CBB_add_u16(&extensions, TLSEXT_TYPE_early_data) ||
173 !CBB_add_u16_length_prefixed(&extensions, &early_data_info) ||
174 !CBB_add_u32(&early_data_info, session->ticket_max_early_data) ||
175 !CBB_flush(&extensions)) {
176 return false;
177 }
178 }
179
180 // Add a fake extension. See draft-davidben-tls-grease-01.
181 if (!CBB_add_u16(&extensions,
182 ssl_get_grease_value(hs, ssl_grease_ticket_extension)) ||
183 !CBB_add_u16(&extensions, 0 /* empty */)) {
184 return false;
185 }
186
187 if (!ssl_add_message_cbb(ssl, cbb.get())) {
188 return false;
189 }
190 }
191
192 *out_sent_tickets = true;
193 return true;
194}
195
196static enum ssl_hs_wait_t do_select_parameters(SSL_HANDSHAKE *hs) {
197 // At this point, most ClientHello extensions have already been processed by
198 // the common handshake logic. Resolve the remaining non-PSK parameters.
199 SSL *const ssl = hs->ssl;
200 SSLMessage msg;
201 if (!ssl->method->get_message(ssl, &msg)) {
202 return ssl_hs_read_message;
203 }
204 SSL_CLIENT_HELLO client_hello;
205 if (!ssl_client_hello_init(ssl, &client_hello, msg)) {
206 OPENSSL_PUT_ERROR(SSL, SSL_R_CLIENTHELLO_PARSE_FAILED);
207 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
208 return ssl_hs_error;
209 }
210
211 OPENSSL_memcpy(hs->session_id, client_hello.session_id,
212 client_hello.session_id_len);
213 hs->session_id_len = client_hello.session_id_len;
214
215 uint16_t group_id;
216 if (!tls1_get_shared_group(hs, &group_id)) {
217 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_GROUP);
218 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
219 return ssl_hs_error;
220 }
221
222 // Negotiate the cipher suite.
223 hs->new_cipher = choose_tls13_cipher(ssl, &client_hello, group_id);
224 if (hs->new_cipher == NULL) {
225 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_SHARED_CIPHER);
226 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_HANDSHAKE_FAILURE);
227 return ssl_hs_error;
228 }
229
230 // HTTP/2 negotiation depends on the cipher suite, so ALPN negotiation was
231 // deferred. Complete it now.
232 uint8_t alert = SSL_AD_DECODE_ERROR;
233 if (!ssl_negotiate_alpn(hs, &alert, &client_hello)) {
234 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
235 return ssl_hs_error;
236 }
237
238 // The PRF hash is now known. Set up the key schedule and hash the
239 // ClientHello.
240 if (!hs->transcript.InitHash(ssl_protocol_version(ssl), hs->new_cipher)) {
241 return ssl_hs_error;
242 }
243
244 if (!ssl_hash_message(hs, msg)) {
245 return ssl_hs_error;
246 }
247
248 hs->tls13_state = state_select_session;
249 return ssl_hs_ok;
250}
251
252static enum ssl_ticket_aead_result_t select_session(
253 SSL_HANDSHAKE *hs, uint8_t *out_alert, UniquePtr<SSL_SESSION> *out_session,
254 int32_t *out_ticket_age_skew, bool *out_offered_ticket,
255 const SSLMessage &msg, const SSL_CLIENT_HELLO *client_hello) {
256 SSL *const ssl = hs->ssl;
257 *out_session = nullptr;
258
259 CBS pre_shared_key;
260 *out_offered_ticket = ssl_client_hello_get_extension(
261 client_hello, &pre_shared_key, TLSEXT_TYPE_pre_shared_key);
262 if (!*out_offered_ticket) {
263 return ssl_ticket_aead_ignore_ticket;
264 }
265
266 // Verify that the pre_shared_key extension is the last extension in
267 // ClientHello.
268 if (CBS_data(&pre_shared_key) + CBS_len(&pre_shared_key) !=
269 client_hello->extensions + client_hello->extensions_len) {
270 OPENSSL_PUT_ERROR(SSL, SSL_R_PRE_SHARED_KEY_MUST_BE_LAST);
271 *out_alert = SSL_AD_ILLEGAL_PARAMETER;
272 return ssl_ticket_aead_error;
273 }
274
275 CBS ticket, binders;
276 uint32_t client_ticket_age;
277 if (!ssl_ext_pre_shared_key_parse_clienthello(hs, &ticket, &binders,
278 &client_ticket_age, out_alert,
279 &pre_shared_key)) {
280 return ssl_ticket_aead_error;
281 }
282
283 // If the peer did not offer psk_dhe, ignore the resumption.
284 if (!hs->accept_psk_mode) {
285 return ssl_ticket_aead_ignore_ticket;
286 }
287
288 // TLS 1.3 session tickets are renewed separately as part of the
289 // NewSessionTicket.
290 bool unused_renew;
291 UniquePtr<SSL_SESSION> session;
292 enum ssl_ticket_aead_result_t ret =
293 ssl_process_ticket(hs, &session, &unused_renew, ticket, {});
294 switch (ret) {
295 case ssl_ticket_aead_success:
296 break;
297 case ssl_ticket_aead_error:
298 *out_alert = SSL_AD_INTERNAL_ERROR;
299 return ret;
300 default:
301 return ret;
302 }
303
304 if (!ssl_session_is_resumable(hs, session.get()) ||
305 // Historically, some TLS 1.3 tickets were missing ticket_age_add.
306 !session->ticket_age_add_valid) {
307 return ssl_ticket_aead_ignore_ticket;
308 }
309
310 // Recover the client ticket age and convert to seconds.
311 client_ticket_age -= session->ticket_age_add;
312 client_ticket_age /= 1000;
313
314 struct OPENSSL_timeval now;
315 ssl_get_current_time(ssl, &now);
316
317 // Compute the server ticket age in seconds.
318 assert(now.tv_sec >= session->time);
319 uint64_t server_ticket_age = now.tv_sec - session->time;
320
321 // To avoid overflowing |hs->ticket_age_skew|, we will not resume
322 // 68-year-old sessions.
323 if (server_ticket_age > INT32_MAX) {
324 return ssl_ticket_aead_ignore_ticket;
325 }
326
327 // TODO(davidben,svaldez): Measure this value to decide on tolerance. For
328 // now, accept all values. https://crbug.com/boringssl/113.
329 *out_ticket_age_skew =
330 (int32_t)client_ticket_age - (int32_t)server_ticket_age;
331
332 // Check the PSK binder.
333 if (!tls13_verify_psk_binder(hs, session.get(), msg, &binders)) {
334 *out_alert = SSL_AD_DECRYPT_ERROR;
335 return ssl_ticket_aead_error;
336 }
337
338 *out_session = std::move(session);
339 return ssl_ticket_aead_success;
340}
341
342static enum ssl_hs_wait_t do_select_session(SSL_HANDSHAKE *hs) {
343 SSL *const ssl = hs->ssl;
344 SSLMessage msg;
345 if (!ssl->method->get_message(ssl, &msg)) {
346 return ssl_hs_read_message;
347 }
348 SSL_CLIENT_HELLO client_hello;
349 if (!ssl_client_hello_init(ssl, &client_hello, msg)) {
350 OPENSSL_PUT_ERROR(SSL, SSL_R_CLIENTHELLO_PARSE_FAILED);
351 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
352 return ssl_hs_error;
353 }
354
355 uint8_t alert = SSL_AD_DECODE_ERROR;
356 UniquePtr<SSL_SESSION> session;
357 bool offered_ticket = false;
358 switch (select_session(hs, &alert, &session, &ssl->s3->ticket_age_skew,
359 &offered_ticket, msg, &client_hello)) {
360 case ssl_ticket_aead_ignore_ticket:
361 assert(!session);
362 if (!ssl->enable_early_data) {
363 ssl->s3->early_data_reason = ssl_early_data_disabled;
364 } else if (!offered_ticket) {
365 ssl->s3->early_data_reason = ssl_early_data_no_session_offered;
366 } else {
367 ssl->s3->early_data_reason = ssl_early_data_session_not_resumed;
368 }
369 if (!ssl_get_new_session(hs, 1 /* server */)) {
370 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
371 return ssl_hs_error;
372 }
373 break;
374
375 case ssl_ticket_aead_success:
376 // Carry over authentication information from the previous handshake into
377 // a fresh session.
378 hs->new_session =
379 SSL_SESSION_dup(session.get(), SSL_SESSION_DUP_AUTH_ONLY);
380 if (hs->new_session == nullptr) {
381 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
382 return ssl_hs_error;
383 }
384
385 if (!ssl->enable_early_data) {
386 ssl->s3->early_data_reason = ssl_early_data_disabled;
387 } else if (session->ticket_max_early_data == 0) {
388 ssl->s3->early_data_reason = ssl_early_data_unsupported_for_session;
389 } else if (!hs->early_data_offered) {
390 ssl->s3->early_data_reason = ssl_early_data_peer_declined;
391 } else if (ssl->s3->channel_id_valid) {
392 // Channel ID is incompatible with 0-RTT.
393 ssl->s3->early_data_reason = ssl_early_data_channel_id;
394 } else if (ssl->s3->token_binding_negotiated) {
395 // Token Binding is incompatible with 0-RTT.
396 ssl->s3->early_data_reason = ssl_early_data_token_binding;
397 } else if (MakeConstSpan(ssl->s3->alpn_selected) != session->early_alpn) {
398 // The negotiated ALPN must match the one in the ticket.
399 ssl->s3->early_data_reason = ssl_early_data_alpn_mismatch;
400 } else if (ssl->s3->ticket_age_skew < -kMaxTicketAgeSkewSeconds ||
401 kMaxTicketAgeSkewSeconds < ssl->s3->ticket_age_skew) {
402 ssl->s3->early_data_reason = ssl_early_data_ticket_age_skew;
403 } else {
404 ssl->s3->early_data_reason = ssl_early_data_accepted;
405 ssl->s3->early_data_accepted = true;
406 }
407
408 ssl->s3->session_reused = true;
409
410 // Resumption incorporates fresh key material, so refresh the timeout.
411 ssl_session_renew_timeout(ssl, hs->new_session.get(),
412 ssl->session_ctx->session_psk_dhe_timeout);
413 break;
414
415 case ssl_ticket_aead_error:
416 ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
417 return ssl_hs_error;
418
419 case ssl_ticket_aead_retry:
420 hs->tls13_state = state_select_session;
421 return ssl_hs_pending_ticket;
422 }
423
424 // Record connection properties in the new session.
425 hs->new_session->cipher = hs->new_cipher;
426
427 // Store the initial negotiated ALPN in the session.
428 if (!hs->new_session->early_alpn.CopyFrom(ssl->s3->alpn_selected)) {
429 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
430 return ssl_hs_error;
431 }
432
433 if (ssl->ctx->dos_protection_cb != NULL &&
434 ssl->ctx->dos_protection_cb(&client_hello) == 0) {
435 // Connection rejected for DOS reasons.
436 OPENSSL_PUT_ERROR(SSL, SSL_R_CONNECTION_REJECTED);
437 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
438 return ssl_hs_error;
439 }
440
441 size_t hash_len = EVP_MD_size(
442 ssl_get_handshake_digest(ssl_protocol_version(ssl), hs->new_cipher));
443
444 // Set up the key schedule and incorporate the PSK into the running secret.
445 if (ssl->s3->session_reused) {
446 if (!tls13_init_key_schedule(hs, hs->new_session->master_key,
447 hs->new_session->master_key_length)) {
448 return ssl_hs_error;
449 }
450 } else if (!tls13_init_key_schedule(hs, kZeroes, hash_len)) {
451 return ssl_hs_error;
452 }
453
454 if (ssl->s3->early_data_accepted) {
455 if (!tls13_derive_early_secrets(hs)) {
456 return ssl_hs_error;
457 }
458 } else if (hs->early_data_offered) {
459 ssl->s3->skip_early_data = true;
460 }
461
462 // Resolve ECDHE and incorporate it into the secret.
463 bool need_retry;
464 if (!resolve_ecdhe_secret(hs, &need_retry, &client_hello)) {
465 if (need_retry) {
466 if (ssl->s3->early_data_accepted) {
467 ssl->s3->early_data_reason = ssl_early_data_hello_retry_request;
468 ssl->s3->early_data_accepted = false;
469 }
470 ssl->s3->skip_early_data = true;
471 ssl->method->next_message(ssl);
472 if (!hs->transcript.UpdateForHelloRetryRequest()) {
473 return ssl_hs_error;
474 }
475 hs->tls13_state = state_send_hello_retry_request;
476 return ssl_hs_ok;
477 }
478 return ssl_hs_error;
479 }
480
481 ssl->method->next_message(ssl);
482 hs->tls13_state = state_send_server_hello;
483 return ssl_hs_ok;
484}
485
486static enum ssl_hs_wait_t do_send_hello_retry_request(SSL_HANDSHAKE *hs) {
487 SSL *const ssl = hs->ssl;
488
489
490 ScopedCBB cbb;
491 CBB body, session_id, extensions;
492 uint16_t group_id;
493 if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
494 !CBB_add_u16(&body, TLS1_2_VERSION) ||
495 !CBB_add_bytes(&body, kHelloRetryRequest, SSL3_RANDOM_SIZE) ||
496 !CBB_add_u8_length_prefixed(&body, &session_id) ||
497 !CBB_add_bytes(&session_id, hs->session_id, hs->session_id_len) ||
498 !CBB_add_u16(&body, ssl_cipher_get_value(hs->new_cipher)) ||
499 !CBB_add_u8(&body, 0 /* no compression */) ||
500 !tls1_get_shared_group(hs, &group_id) ||
501 !CBB_add_u16_length_prefixed(&body, &extensions) ||
502 !CBB_add_u16(&extensions, TLSEXT_TYPE_supported_versions) ||
503 !CBB_add_u16(&extensions, 2 /* length */) ||
504 !CBB_add_u16(&extensions, ssl->version) ||
505 !CBB_add_u16(&extensions, TLSEXT_TYPE_key_share) ||
506 !CBB_add_u16(&extensions, 2 /* length */) ||
507 !CBB_add_u16(&extensions, group_id) ||
508 !ssl_add_message_cbb(ssl, cbb.get())) {
509 return ssl_hs_error;
510 }
511
512 if (!ssl->method->add_change_cipher_spec(ssl)) {
513 return ssl_hs_error;
514 }
515
516 hs->sent_hello_retry_request = true;
517 hs->tls13_state = state_read_second_client_hello;
518 return ssl_hs_flush;
519}
520
521static enum ssl_hs_wait_t do_read_second_client_hello(SSL_HANDSHAKE *hs) {
522 SSL *const ssl = hs->ssl;
523 SSLMessage msg;
524 if (!ssl->method->get_message(ssl, &msg)) {
525 return ssl_hs_read_message;
526 }
527 if (!ssl_check_message_type(ssl, msg, SSL3_MT_CLIENT_HELLO)) {
528 return ssl_hs_error;
529 }
530 SSL_CLIENT_HELLO client_hello;
531 if (!ssl_client_hello_init(ssl, &client_hello, msg)) {
532 OPENSSL_PUT_ERROR(SSL, SSL_R_CLIENTHELLO_PARSE_FAILED);
533 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
534 return ssl_hs_error;
535 }
536
537 bool need_retry;
538 if (!resolve_ecdhe_secret(hs, &need_retry, &client_hello)) {
539 if (need_retry) {
540 // Only send one HelloRetryRequest.
541 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
542 OPENSSL_PUT_ERROR(SSL, SSL_R_WRONG_CURVE);
543 }
544 return ssl_hs_error;
545 }
546
547 if (!ssl_hash_message(hs, msg)) {
548 return ssl_hs_error;
549 }
550
551 ssl->method->next_message(ssl);
552 hs->tls13_state = state_send_server_hello;
553 return ssl_hs_ok;
554}
555
556static enum ssl_hs_wait_t do_send_server_hello(SSL_HANDSHAKE *hs) {
557 SSL *const ssl = hs->ssl;
558
559 // Send a ServerHello.
560 ScopedCBB cbb;
561 CBB body, extensions, session_id;
562 if (!ssl->method->init_message(ssl, cbb.get(), &body, SSL3_MT_SERVER_HELLO) ||
563 !CBB_add_u16(&body, TLS1_2_VERSION) ||
564 !RAND_bytes(ssl->s3->server_random, sizeof(ssl->s3->server_random)) ||
565 !CBB_add_bytes(&body, ssl->s3->server_random, SSL3_RANDOM_SIZE) ||
566 !CBB_add_u8_length_prefixed(&body, &session_id) ||
567 !CBB_add_bytes(&session_id, hs->session_id, hs->session_id_len) ||
568 !CBB_add_u16(&body, ssl_cipher_get_value(hs->new_cipher)) ||
569 !CBB_add_u8(&body, 0) ||
570 !CBB_add_u16_length_prefixed(&body, &extensions) ||
571 !ssl_ext_pre_shared_key_add_serverhello(hs, &extensions) ||
572 !ssl_ext_key_share_add_serverhello(hs, &extensions) ||
573 !ssl_ext_supported_versions_add_serverhello(hs, &extensions) ||
574 !ssl_add_message_cbb(ssl, cbb.get())) {
575 return ssl_hs_error;
576 }
577
578 if (!hs->sent_hello_retry_request &&
579 !ssl->method->add_change_cipher_spec(ssl)) {
580 return ssl_hs_error;
581 }
582
583 // Derive and enable the handshake traffic secrets.
584 if (!tls13_derive_handshake_secrets(hs) ||
585 !tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_seal,
586 hs->server_handshake_secret, hs->hash_len)) {
587 return ssl_hs_error;
588 }
589
590 // Send EncryptedExtensions.
591 if (!ssl->method->init_message(ssl, cbb.get(), &body,
592 SSL3_MT_ENCRYPTED_EXTENSIONS) ||
593 !ssl_add_serverhello_tlsext(hs, &body) ||
594 !ssl_add_message_cbb(ssl, cbb.get())) {
595 return ssl_hs_error;
596 }
597
598 if (!ssl->s3->session_reused) {
599 // Determine whether to request a client certificate.
600 hs->cert_request = !!(hs->config->verify_mode & SSL_VERIFY_PEER);
601 // Only request a certificate if Channel ID isn't negotiated.
602 if ((hs->config->verify_mode & SSL_VERIFY_PEER_IF_NO_OBC) &&
603 ssl->s3->channel_id_valid) {
604 hs->cert_request = false;
605 }
606 }
607
608 // Send a CertificateRequest, if necessary.
609 if (hs->cert_request) {
610 CBB cert_request_extensions, sigalg_contents, sigalgs_cbb;
611 if (!ssl->method->init_message(ssl, cbb.get(), &body,
612 SSL3_MT_CERTIFICATE_REQUEST) ||
613 !CBB_add_u8(&body, 0 /* no certificate_request_context. */) ||
614 !CBB_add_u16_length_prefixed(&body, &cert_request_extensions) ||
615 !CBB_add_u16(&cert_request_extensions,
616 TLSEXT_TYPE_signature_algorithms) ||
617 !CBB_add_u16_length_prefixed(&cert_request_extensions,
618 &sigalg_contents) ||
619 !CBB_add_u16_length_prefixed(&sigalg_contents, &sigalgs_cbb) ||
620 !tls12_add_verify_sigalgs(ssl, &sigalgs_cbb,
621 false /* online signature */)) {
622 return ssl_hs_error;
623 }
624
625 if (tls12_has_different_verify_sigalgs_for_certs(ssl)) {
626 if (!CBB_add_u16(&cert_request_extensions,
627 TLSEXT_TYPE_signature_algorithms_cert) ||
628 !CBB_add_u16_length_prefixed(&cert_request_extensions,
629 &sigalg_contents) ||
630 !CBB_add_u16_length_prefixed(&sigalg_contents, &sigalgs_cbb) ||
631 !tls12_add_verify_sigalgs(ssl, &sigalgs_cbb, true /* certs */)) {
632 return ssl_hs_error;
633 }
634 }
635
636 if (ssl_has_client_CAs(hs->config)) {
637 CBB ca_contents;
638 if (!CBB_add_u16(&cert_request_extensions,
639 TLSEXT_TYPE_certificate_authorities) ||
640 !CBB_add_u16_length_prefixed(&cert_request_extensions,
641 &ca_contents) ||
642 !ssl_add_client_CA_list(hs, &ca_contents) ||
643 !CBB_flush(&cert_request_extensions)) {
644 return ssl_hs_error;
645 }
646 }
647
648 if (!ssl_add_message_cbb(ssl, cbb.get())) {
649 return ssl_hs_error;
650 }
651 }
652
653 // Send the server Certificate message, if necessary.
654 if (!ssl->s3->session_reused) {
655 if (!ssl_has_certificate(hs)) {
656 OPENSSL_PUT_ERROR(SSL, SSL_R_NO_CERTIFICATE_SET);
657 return ssl_hs_error;
658 }
659
660 if (!tls13_add_certificate(hs)) {
661 return ssl_hs_error;
662 }
663
664 hs->tls13_state = state_send_server_certificate_verify;
665 return ssl_hs_ok;
666 }
667
668 hs->tls13_state = state_send_server_finished;
669 return ssl_hs_ok;
670}
671
672static enum ssl_hs_wait_t do_send_server_certificate_verify(SSL_HANDSHAKE *hs) {
673 switch (tls13_add_certificate_verify(hs)) {
674 case ssl_private_key_success:
675 hs->tls13_state = state_send_server_finished;
676 return ssl_hs_ok;
677
678 case ssl_private_key_retry:
679 hs->tls13_state = state_send_server_certificate_verify;
680 return ssl_hs_private_key_operation;
681
682 case ssl_private_key_failure:
683 return ssl_hs_error;
684 }
685
686 assert(0);
687 return ssl_hs_error;
688}
689
690static enum ssl_hs_wait_t do_send_server_finished(SSL_HANDSHAKE *hs) {
691 SSL *const ssl = hs->ssl;
692 if (!tls13_add_finished(hs) ||
693 // Update the secret to the master secret and derive traffic keys.
694 !tls13_advance_key_schedule(hs, kZeroes, hs->hash_len) ||
695 !tls13_derive_application_secrets(hs) ||
696 !tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_seal,
697 hs->server_traffic_secret_0, hs->hash_len)) {
698 return ssl_hs_error;
699 }
700
701 if (ssl->s3->early_data_accepted) {
702 // If accepting 0-RTT, we send tickets half-RTT. This gets the tickets on
703 // the wire sooner and also avoids triggering a write on |SSL_read| when
704 // processing the client Finished. This requires computing the client
705 // Finished early. See RFC 8446, section 4.6.1.
706 static const uint8_t kEndOfEarlyData[4] = {SSL3_MT_END_OF_EARLY_DATA, 0,
707 0, 0};
708 if (!hs->transcript.Update(kEndOfEarlyData)) {
709 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
710 return ssl_hs_error;
711 }
712
713 size_t finished_len;
714 if (!tls13_finished_mac(hs, hs->expected_client_finished, &finished_len,
715 false /* client */)) {
716 return ssl_hs_error;
717 }
718
719 if (finished_len != hs->hash_len) {
720 OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
721 return ssl_hs_error;
722 }
723
724 // Feed the predicted Finished into the transcript. This allows us to derive
725 // the resumption secret early and send half-RTT tickets.
726 //
727 // TODO(davidben): This will need to be updated for DTLS 1.3.
728 assert(!SSL_is_dtls(hs->ssl));
729 assert(hs->hash_len <= 0xff);
730 uint8_t header[4] = {SSL3_MT_FINISHED, 0, 0,
731 static_cast<uint8_t>(hs->hash_len)};
732 bool unused_sent_tickets;
733 if (!hs->transcript.Update(header) ||
734 !hs->transcript.Update(
735 MakeConstSpan(hs->expected_client_finished, hs->hash_len)) ||
736 !tls13_derive_resumption_secret(hs) ||
737 !add_new_session_tickets(hs, &unused_sent_tickets)) {
738 return ssl_hs_error;
739 }
740 }
741
742 hs->tls13_state = state_read_second_client_flight;
743 return ssl_hs_flush;
744}
745
746static enum ssl_hs_wait_t do_read_second_client_flight(SSL_HANDSHAKE *hs) {
747 SSL *const ssl = hs->ssl;
748 if (ssl->s3->early_data_accepted) {
749 if (!tls13_set_traffic_key(ssl, ssl_encryption_early_data, evp_aead_open,
750 hs->early_traffic_secret, hs->hash_len)) {
751 return ssl_hs_error;
752 }
753 hs->can_early_write = true;
754 hs->can_early_read = true;
755 hs->in_early_data = true;
756 }
757 hs->tls13_state = state_process_end_of_early_data;
758 return ssl->s3->early_data_accepted ? ssl_hs_read_end_of_early_data
759 : ssl_hs_ok;
760}
761
762static enum ssl_hs_wait_t do_process_end_of_early_data(SSL_HANDSHAKE *hs) {
763 SSL *const ssl = hs->ssl;
764 if (hs->early_data_offered) {
765 // If early data was not accepted, the EndOfEarlyData and ChangeCipherSpec
766 // message will be in the discarded early data.
767 if (hs->ssl->s3->early_data_accepted) {
768 SSLMessage msg;
769 if (!ssl->method->get_message(ssl, &msg)) {
770 return ssl_hs_read_message;
771 }
772
773 if (!ssl_check_message_type(ssl, msg, SSL3_MT_END_OF_EARLY_DATA)) {
774 return ssl_hs_error;
775 }
776 if (CBS_len(&msg.body) != 0) {
777 ssl_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECODE_ERROR);
778 OPENSSL_PUT_ERROR(SSL, SSL_R_DECODE_ERROR);
779 return ssl_hs_error;
780 }
781 ssl->method->next_message(ssl);
782 }
783 }
784 if (!tls13_set_traffic_key(ssl, ssl_encryption_handshake, evp_aead_open,
785 hs->client_handshake_secret, hs->hash_len)) {
786 return ssl_hs_error;
787 }
788 hs->tls13_state = ssl->s3->early_data_accepted
789 ? state_read_client_finished
790 : state_read_client_certificate;
791 return ssl_hs_ok;
792}
793
794static enum ssl_hs_wait_t do_read_client_certificate(SSL_HANDSHAKE *hs) {
795 SSL *const ssl = hs->ssl;
796 if (!hs->cert_request) {
797 // OpenSSL returns X509_V_OK when no certificates are requested. This is
798 // classed by them as a bug, but it's assumed by at least NGINX.
799 hs->new_session->verify_result = X509_V_OK;
800
801 // Skip this state.
802 hs->tls13_state = state_read_channel_id;
803 return ssl_hs_ok;
804 }
805
806 const bool allow_anonymous =
807 (hs->config->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) == 0;
808 SSLMessage msg;
809 if (!ssl->method->get_message(ssl, &msg)) {
810 return ssl_hs_read_message;
811 }
812 if (!ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE) ||
813 !tls13_process_certificate(hs, msg, allow_anonymous) ||
814 !ssl_hash_message(hs, msg)) {
815 return ssl_hs_error;
816 }
817
818 ssl->method->next_message(ssl);
819 hs->tls13_state = state_read_client_certificate_verify;
820 return ssl_hs_ok;
821}
822
823static enum ssl_hs_wait_t do_read_client_certificate_verify(
824 SSL_HANDSHAKE *hs) {
825 SSL *const ssl = hs->ssl;
826 if (sk_CRYPTO_BUFFER_num(hs->new_session->certs.get()) == 0) {
827 // Skip this state.
828 hs->tls13_state = state_read_channel_id;
829 return ssl_hs_ok;
830 }
831
832 SSLMessage msg;
833 if (!ssl->method->get_message(ssl, &msg)) {
834 return ssl_hs_read_message;
835 }
836
837 switch (ssl_verify_peer_cert(hs)) {
838 case ssl_verify_ok:
839 break;
840 case ssl_verify_invalid:
841 return ssl_hs_error;
842 case ssl_verify_retry:
843 hs->tls13_state = state_read_client_certificate_verify;
844 return ssl_hs_certificate_verify;
845 }
846
847 if (!ssl_check_message_type(ssl, msg, SSL3_MT_CERTIFICATE_VERIFY) ||
848 !tls13_process_certificate_verify(hs, msg) ||
849 !ssl_hash_message(hs, msg)) {
850 return ssl_hs_error;
851 }
852
853 ssl->method->next_message(ssl);
854 hs->tls13_state = state_read_channel_id;
855 return ssl_hs_ok;
856}
857
858static enum ssl_hs_wait_t do_read_channel_id(SSL_HANDSHAKE *hs) {
859 SSL *const ssl = hs->ssl;
860 if (!ssl->s3->channel_id_valid) {
861 hs->tls13_state = state_read_client_finished;
862 return ssl_hs_ok;
863 }
864
865 SSLMessage msg;
866 if (!ssl->method->get_message(ssl, &msg)) {
867 return ssl_hs_read_message;
868 }
869 if (!ssl_check_message_type(ssl, msg, SSL3_MT_CHANNEL_ID) ||
870 !tls1_verify_channel_id(hs, msg) ||
871 !ssl_hash_message(hs, msg)) {
872 return ssl_hs_error;
873 }
874
875 ssl->method->next_message(ssl);
876 hs->tls13_state = state_read_client_finished;
877 return ssl_hs_ok;
878}
879
880static enum ssl_hs_wait_t do_read_client_finished(SSL_HANDSHAKE *hs) {
881 SSL *const ssl = hs->ssl;
882 SSLMessage msg;
883 if (!ssl->method->get_message(ssl, &msg)) {
884 return ssl_hs_read_message;
885 }
886 if (!ssl_check_message_type(ssl, msg, SSL3_MT_FINISHED) ||
887 // If early data was accepted, we've already computed the client Finished
888 // and derived the resumption secret.
889 !tls13_process_finished(hs, msg, ssl->s3->early_data_accepted) ||
890 // evp_aead_seal keys have already been switched.
891 !tls13_set_traffic_key(ssl, ssl_encryption_application, evp_aead_open,
892 hs->client_traffic_secret_0, hs->hash_len)) {
893 return ssl_hs_error;
894 }
895
896 if (!ssl->s3->early_data_accepted) {
897 if (!ssl_hash_message(hs, msg) ||
898 !tls13_derive_resumption_secret(hs)) {
899 return ssl_hs_error;
900 }
901
902 // We send post-handshake tickets as part of the handshake in 1-RTT.
903 hs->tls13_state = state_send_new_session_ticket;
904 } else {
905 // We already sent half-RTT tickets.
906 hs->tls13_state = state_done;
907 }
908
909 ssl->method->next_message(ssl);
910 return ssl_hs_ok;
911}
912
913static enum ssl_hs_wait_t do_send_new_session_ticket(SSL_HANDSHAKE *hs) {
914 bool sent_tickets;
915 if (!add_new_session_tickets(hs, &sent_tickets)) {
916 return ssl_hs_error;
917 }
918
919 hs->tls13_state = state_done;
920 // In TLS 1.3, the NewSessionTicket isn't flushed until the server performs a
921 // write, to prevent a non-reading client from causing the server to hang in
922 // the case of a small server write buffer. Consumers which don't write data
923 // to the client will need to do a zero-byte write if they wish to flush the
924 // tickets.
925 if (hs->ssl->ctx->quic_method != nullptr && sent_tickets) {
926 return ssl_hs_flush;
927 }
928 return ssl_hs_ok;
929}
930
931enum ssl_hs_wait_t tls13_server_handshake(SSL_HANDSHAKE *hs) {
932 while (hs->tls13_state != state_done) {
933 enum ssl_hs_wait_t ret = ssl_hs_error;
934 enum server_hs_state_t state =
935 static_cast<enum server_hs_state_t>(hs->tls13_state);
936 switch (state) {
937 case state_select_parameters:
938 ret = do_select_parameters(hs);
939 break;
940 case state_select_session:
941 ret = do_select_session(hs);
942 break;
943 case state_send_hello_retry_request:
944 ret = do_send_hello_retry_request(hs);
945 break;
946 case state_read_second_client_hello:
947 ret = do_read_second_client_hello(hs);
948 break;
949 case state_send_server_hello:
950 ret = do_send_server_hello(hs);
951 break;
952 case state_send_server_certificate_verify:
953 ret = do_send_server_certificate_verify(hs);
954 break;
955 case state_send_server_finished:
956 ret = do_send_server_finished(hs);
957 break;
958 case state_read_second_client_flight:
959 ret = do_read_second_client_flight(hs);
960 break;
961 case state_process_end_of_early_data:
962 ret = do_process_end_of_early_data(hs);
963 break;
964 case state_read_client_certificate:
965 ret = do_read_client_certificate(hs);
966 break;
967 case state_read_client_certificate_verify:
968 ret = do_read_client_certificate_verify(hs);
969 break;
970 case state_read_channel_id:
971 ret = do_read_channel_id(hs);
972 break;
973 case state_read_client_finished:
974 ret = do_read_client_finished(hs);
975 break;
976 case state_send_new_session_ticket:
977 ret = do_send_new_session_ticket(hs);
978 break;
979 case state_done:
980 ret = ssl_hs_ok;
981 break;
982 }
983
984 if (hs->tls13_state != state) {
985 ssl_do_info_callback(hs->ssl, SSL_CB_ACCEPT_LOOP, 1);
986 }
987
988 if (ret != ssl_hs_ok) {
989 return ret;
990 }
991 }
992
993 return ssl_hs_ok;
994}
995
996const char *tls13_server_handshake_state(SSL_HANDSHAKE *hs) {
997 enum server_hs_state_t state =
998 static_cast<enum server_hs_state_t>(hs->tls13_state);
999 switch (state) {
1000 case state_select_parameters:
1001 return "TLS 1.3 server select_parameters";
1002 case state_select_session:
1003 return "TLS 1.3 server select_session";
1004 case state_send_hello_retry_request:
1005 return "TLS 1.3 server send_hello_retry_request";
1006 case state_read_second_client_hello:
1007 return "TLS 1.3 server read_second_client_hello";
1008 case state_send_server_hello:
1009 return "TLS 1.3 server send_server_hello";
1010 case state_send_server_certificate_verify:
1011 return "TLS 1.3 server send_server_certificate_verify";
1012 case state_send_server_finished:
1013 return "TLS 1.3 server send_server_finished";
1014 case state_read_second_client_flight:
1015 return "TLS 1.3 server read_second_client_flight";
1016 case state_process_end_of_early_data:
1017 return "TLS 1.3 server process_end_of_early_data";
1018 case state_read_client_certificate:
1019 return "TLS 1.3 server read_client_certificate";
1020 case state_read_client_certificate_verify:
1021 return "TLS 1.3 server read_client_certificate_verify";
1022 case state_read_channel_id:
1023 return "TLS 1.3 server read_channel_id";
1024 case state_read_client_finished:
1025 return "TLS 1.3 server read_client_finished";
1026 case state_send_new_session_ticket:
1027 return "TLS 1.3 server send_new_session_ticket";
1028 case state_done:
1029 return "TLS 1.3 server done";
1030 }
1031
1032 return "TLS 1.3 server unknown";
1033}
1034
1035BSSL_NAMESPACE_END
1036