1 /* $OpenBSD: tls13_client.c,v 1.12 2019/02/25 16:46:17 jsing Exp $ */ 2 /* 3 * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include "ssl_locl.h" 19 20 #include <openssl/curve25519.h> 21 #include <openssl/ssl3.h> 22 23 #include "bytestring.h" 24 #include "ssl_tlsext.h" 25 #include "tls13_handshake.h" 26 #include "tls13_internal.h" 27 28 int 29 tls13_connect(struct tls13_ctx *ctx) 30 { 31 if (ctx->mode != TLS13_HS_CLIENT) 32 return TLS13_IO_FAILURE; 33 34 return tls13_handshake_perform(ctx); 35 } 36 37 static int 38 tls13_client_init(struct tls13_ctx *ctx) 39 { 40 SSL *s = ctx->ssl; 41 42 if (!ssl_supported_version_range(s, &ctx->hs->min_version, 43 &ctx->hs->max_version)) { 44 SSLerror(s, SSL_R_NO_PROTOCOLS_AVAILABLE); 45 return 0; 46 } 47 s->client_version = s->version = ctx->hs->max_version; 48 49 if (!ssl_get_new_session(s, 0)) /* XXX */ 50 return 0; 51 52 if (!tls1_transcript_init(s)) 53 return 0; 54 55 arc4random_buf(s->s3->client_random, SSL3_RANDOM_SIZE); 56 57 return 1; 58 } 59 60 int 61 tls13_legacy_connect(SSL *ssl) 62 { 63 struct tls13_ctx *ctx = ssl->internal->tls13; 64 int ret; 65 66 if (ctx == NULL) { 67 if ((ctx = tls13_ctx_new(TLS13_HS_CLIENT)) == NULL) { 68 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 69 return -1; 70 } 71 ssl->internal->tls13 = ctx; 72 ctx->ssl = ssl; 73 ctx->hs = &S3I(ssl)->hs_tls13; 74 75 if (!tls13_client_init(ctx)) { 76 if (ERR_peek_error() == 0) 77 SSLerror(ssl, ERR_R_INTERNAL_ERROR); /* XXX */ 78 return -1; 79 } 80 } 81 82 ret = tls13_connect(ctx); 83 84 return tls13_legacy_return_code(ssl, ret); 85 } 86 87 static int 88 tls13_client_hello_build(SSL *s, CBB *cbb) 89 { 90 CBB cipher_suites, compression_methods, session_id; 91 uint8_t *sid; 92 93 if (!CBB_add_u16(cbb, TLS1_2_VERSION)) 94 goto err; 95 if (!CBB_add_bytes(cbb, s->s3->client_random, SSL3_RANDOM_SIZE)) 96 goto err; 97 98 /* Either 32-random bytes or zero length... */ 99 /* XXX - session resumption for TLSv1.2? */ 100 if (!CBB_add_u8_length_prefixed(cbb, &session_id)) 101 goto err; 102 if (!CBB_add_space(&session_id, &sid, 32)) 103 goto err; 104 arc4random_buf(sid, 32); 105 106 if (!CBB_add_u16_length_prefixed(cbb, &cipher_suites)) 107 goto err; 108 if (!ssl_cipher_list_to_bytes(s, SSL_get_ciphers(s), &cipher_suites)) { 109 SSLerror(s, SSL_R_NO_CIPHERS_AVAILABLE); 110 goto err; 111 } 112 113 if (!CBB_add_u8_length_prefixed(cbb, &compression_methods)) 114 goto err; 115 if (!CBB_add_u8(&compression_methods, 0)) 116 goto err; 117 118 if (!tlsext_client_build(s, cbb, SSL_TLSEXT_MSG_CH)) 119 goto err; 120 121 if (!CBB_flush(cbb)) 122 goto err; 123 124 return 1; 125 126 err: 127 return 0; 128 } 129 130 int 131 tls13_client_hello_send(struct tls13_ctx *ctx) 132 { 133 CBB body; 134 135 if (!tls13_handshake_msg_start(ctx->hs_msg, &body, TLS13_MT_CLIENT_HELLO)) 136 return 0; 137 if (!tls13_client_hello_build(ctx->ssl, &body)) 138 return 0; 139 if (!tls13_handshake_msg_finish(ctx->hs_msg)) 140 return 0; 141 142 return 1; 143 } 144 145 /* 146 * HelloRetryRequest hash - RFC 8446 section 4.1.3. 147 */ 148 static const uint8_t tls13_hello_retry_request_hash[] = { 149 0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11, 150 0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91, 151 0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e, 152 0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c, 153 }; 154 155 static int 156 tls13_server_hello_process(struct tls13_ctx *ctx, CBS *cbs) 157 { 158 CBS server_random, session_id; 159 uint16_t cipher_suite, legacy_version; 160 uint8_t compression_method; 161 const SSL_CIPHER *cipher; 162 SSL *s = ctx->ssl; 163 int alert; 164 165 if (!CBS_get_u16(cbs, &legacy_version)) 166 goto err; 167 if (!CBS_get_bytes(cbs, &server_random, SSL3_RANDOM_SIZE)) 168 goto err; 169 if (!CBS_get_u8_length_prefixed(cbs, &session_id)) 170 goto err; 171 if (!CBS_get_u16(cbs, &cipher_suite)) 172 goto err; 173 if (!CBS_get_u8(cbs, &compression_method)) 174 goto err; 175 176 if (!tlsext_client_parse(s, cbs, &alert, SSL_TLSEXT_MSG_SH)) 177 goto err; 178 179 if (CBS_len(cbs) != 0) 180 goto err; 181 182 /* 183 * See if a supported versions extension was returned. If it was then 184 * the legacy version must be set to 0x0303 (RFC 8446 section 4.1.3). 185 * Otherwise, fallback to the legacy version, ensuring that it is both 186 * within range and not TLS 1.3 or greater (which must use the 187 * supported version extension. 188 */ 189 if (ctx->hs->server_version != 0) { 190 if (legacy_version != TLS1_2_VERSION) { 191 /* XXX - alert. */ 192 goto err; 193 } 194 } else { 195 if (legacy_version < ctx->hs->min_version || 196 legacy_version > ctx->hs->max_version || 197 legacy_version > TLS1_2_VERSION) { 198 /* XXX - alert. */ 199 goto err; 200 } 201 ctx->hs->server_version = legacy_version; 202 } 203 204 /* XXX - session_id must match. */ 205 206 /* 207 * Ensure that the cipher suite is one that we offered in the client 208 * hello and that it matches the TLS version selected. 209 */ 210 cipher = ssl3_get_cipher_by_value(cipher_suite); 211 if (cipher == NULL || 212 sk_SSL_CIPHER_find(ssl_get_ciphers_by_id(s), cipher) < 0) { 213 /* XXX - alert. */ 214 goto err; 215 } 216 if (ctx->hs->server_version == TLS1_3_VERSION && 217 cipher->algorithm_ssl != SSL_TLSV1_3) { 218 /* XXX - alert. */ 219 goto err; 220 } 221 /* XXX - move this to hs_tls13? */ 222 S3I(s)->hs.new_cipher = cipher; 223 224 if (compression_method != 0) { 225 /* XXX - alert. */ 226 goto err; 227 } 228 229 if (CBS_mem_equal(&server_random, tls13_hello_retry_request_hash, 230 sizeof(tls13_hello_retry_request_hash))) 231 ctx->handshake_stage.hs_type |= WITH_HRR; 232 233 return 1; 234 235 err: 236 /* XXX - send alert. */ 237 238 return 0; 239 } 240 241 int 242 tls13_server_hello_recv(struct tls13_ctx *ctx) 243 { 244 struct tls13_secrets *secrets; 245 struct tls13_secret context; 246 unsigned char buf[EVP_MAX_MD_SIZE]; 247 uint8_t *shared_key = NULL; 248 size_t hash_len; 249 SSL *s = ctx->ssl; 250 int ret = 0; 251 CBS cbs; 252 253 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs)) 254 goto err; 255 256 if (!tls13_server_hello_process(ctx, &cbs)) 257 goto err; 258 259 if (ctx->hs->server_version < TLS1_3_VERSION) { 260 /* XXX - switch back to legacy client. */ 261 goto err; 262 } 263 264 if (ctx->handshake_stage.hs_type & WITH_HRR) 265 return 1; 266 267 /* XXX - handle other key share types. */ 268 if (ctx->hs->x25519_peer_public == NULL) { 269 /* XXX - alert. */ 270 goto err; 271 } 272 if ((shared_key = malloc(X25519_KEY_LENGTH)) == NULL) 273 goto err; 274 if (!X25519(shared_key, ctx->hs->x25519_private, 275 ctx->hs->x25519_peer_public)) 276 goto err; 277 278 s->session->cipher = S3I(s)->hs.new_cipher; 279 s->session->ssl_version = ctx->hs->server_version; 280 281 if ((ctx->aead = tls13_cipher_aead(S3I(s)->hs.new_cipher)) == NULL) 282 goto err; 283 if ((ctx->hash = tls13_cipher_hash(S3I(s)->hs.new_cipher)) == NULL) 284 goto err; 285 286 if ((secrets = tls13_secrets_create(ctx->hash, 0)) == NULL) 287 goto err; 288 S3I(ctx->ssl)->hs_tls13.secrets = secrets; 289 290 /* XXX - pass in hash. */ 291 if (!tls1_transcript_hash_init(s)) 292 goto err; 293 if (!tls1_transcript_hash_value(s, buf, sizeof(buf), &hash_len)) 294 goto err; 295 context.data = buf; 296 context.len = hash_len; 297 298 /* Early secrets. */ 299 if (!tls13_derive_early_secrets(secrets, secrets->zeros.data, 300 secrets->zeros.len, &context)) 301 goto err; 302 303 /* Handshake secrets. */ 304 if (!tls13_derive_handshake_secrets(ctx->hs->secrets, shared_key, 305 X25519_KEY_LENGTH, &context)) 306 goto err; 307 308 tls13_record_layer_set_aead(ctx->rl, ctx->aead); 309 tls13_record_layer_set_hash(ctx->rl, ctx->hash); 310 311 if (!tls13_record_layer_set_read_traffic_key(ctx->rl, 312 &secrets->server_handshake_traffic)) 313 goto err; 314 if (!tls13_record_layer_set_write_traffic_key(ctx->rl, 315 &secrets->client_handshake_traffic)) 316 goto err; 317 318 ctx->handshake_stage.hs_type |= NEGOTIATED; 319 ret = 1; 320 321 err: 322 freezero(shared_key, X25519_KEY_LENGTH); 323 return ret; 324 } 325 326 int 327 tls13_server_encrypted_extensions_recv(struct tls13_ctx *ctx) 328 { 329 int alert; 330 CBS cbs; 331 332 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs)) 333 goto err; 334 335 if (!tlsext_client_parse(ctx->ssl, &cbs, &alert, SSL_TLSEXT_MSG_EE)) 336 goto err; 337 338 if (CBS_len(&cbs) != 0) 339 goto err; 340 341 return 1; 342 343 err: 344 /* XXX - send alert. */ 345 346 return 0; 347 } 348 349 int 350 tls13_server_certificate_request_recv(struct tls13_ctx *ctx) 351 { 352 /* 353 * Thanks to poor state design in the RFC, this function can be called 354 * when we actually have a certificate message instead of a certificate 355 * request... in that case we call the certificate handler after 356 * switching state, to avoid advancing state. 357 */ 358 if (tls13_handshake_msg_type(ctx->hs_msg) == TLS13_MT_CERTIFICATE) { 359 ctx->handshake_stage.hs_type |= WITHOUT_CR; 360 return tls13_server_certificate_recv(ctx); 361 } 362 363 /* XXX - unimplemented. */ 364 365 return 0; 366 } 367 368 int 369 tls13_server_certificate_recv(struct tls13_ctx *ctx) 370 { 371 CBS cbs, cert_request_context, cert_list, cert_data, cert_exts; 372 struct stack_st_X509 *certs = NULL; 373 SSL *s = ctx->ssl; 374 X509 *cert = NULL; 375 EVP_PKEY *pkey; 376 const uint8_t *p; 377 int cert_idx; 378 int ret = 0; 379 380 if ((certs = sk_X509_new_null()) == NULL) 381 goto err; 382 383 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs)) 384 goto err; 385 386 if (!CBS_get_u8_length_prefixed(&cbs, &cert_request_context)) 387 goto err; 388 if (CBS_len(&cert_request_context) != 0) 389 goto err; 390 if (!CBS_get_u24_length_prefixed(&cbs, &cert_list)) 391 goto err; 392 if (CBS_len(&cbs) != 0) 393 goto err; 394 395 while (CBS_len(&cert_list) > 0) { 396 if (!CBS_get_u24_length_prefixed(&cert_list, &cert_data)) 397 goto err; 398 if (!CBS_get_u16_length_prefixed(&cert_list, &cert_exts)) 399 goto err; 400 401 p = CBS_data(&cert_data); 402 if ((cert = d2i_X509(NULL, &p, CBS_len(&cert_data))) == NULL) 403 goto err; 404 if (p != CBS_data(&cert_data) + CBS_len(&cert_data)) 405 goto err; 406 407 if (!sk_X509_push(certs, cert)) 408 goto err; 409 410 cert = NULL; 411 } 412 413 /* 414 * At this stage we still have no proof of possession. As such, it would 415 * be preferable to keep the chain and verify once we have successfully 416 * processed the CertificateVerify message. 417 */ 418 if (ssl_verify_cert_chain(s, certs) <= 0 && 419 s->verify_mode != SSL_VERIFY_NONE) { 420 /* XXX send alert */ 421 goto err; 422 } 423 ERR_clear_error(); 424 425 cert = sk_X509_value(certs, 0); 426 X509_up_ref(cert); 427 428 if ((pkey = X509_get0_pubkey(cert)) == NULL) 429 goto err; 430 if (EVP_PKEY_missing_parameters(pkey)) 431 goto err; 432 if ((cert_idx = ssl_cert_type(cert, pkey)) < 0) 433 goto err; 434 435 ssl_sess_cert_free(SSI(s)->sess_cert); 436 if ((SSI(s)->sess_cert = ssl_sess_cert_new()) == NULL) 437 goto err; 438 439 SSI(s)->sess_cert->cert_chain = certs; 440 certs = NULL; 441 442 X509_up_ref(cert); 443 SSI(s)->sess_cert->peer_pkeys[cert_idx].x509 = cert; 444 SSI(s)->sess_cert->peer_key = &(SSI(s)->sess_cert->peer_pkeys[cert_idx]); 445 446 X509_free(s->session->peer); 447 448 X509_up_ref(cert); 449 s->session->peer = cert; 450 s->session->verify_result = s->verify_result; 451 452 ret = 1; 453 454 err: 455 sk_X509_pop_free(certs, X509_free); 456 X509_free(cert); 457 458 return ret; 459 } 460 461 /* 462 * Certificate Verify padding - RFC 8446 section 4.4.3. 463 */ 464 static uint8_t cert_verify_pad[64] = { 465 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 466 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 467 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 468 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 469 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 470 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 471 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 472 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 473 }; 474 475 static uint8_t server_cert_verify_context[] = "TLS 1.3, server CertificateVerify"; 476 477 int 478 tls13_server_certificate_verify_recv(struct tls13_ctx *ctx) 479 { 480 const struct ssl_sigalg *sigalg; 481 uint16_t signature_scheme; 482 uint8_t *sig_content = NULL; 483 size_t sig_content_len; 484 EVP_MD_CTX *mdctx = NULL; 485 EVP_PKEY_CTX *pctx; 486 EVP_PKEY *pkey; 487 X509 *cert; 488 CBS cbs, signature; 489 CBB cbb; 490 int ret = 0; 491 492 memset(&cbb, 0, sizeof(cbb)); 493 494 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs)) 495 goto err; 496 497 if (!CBS_get_u16(&cbs, &signature_scheme)) 498 goto err; 499 if (!CBS_get_u16_length_prefixed(&cbs, &signature)) 500 goto err; 501 if (CBS_len(&cbs) != 0) 502 goto err; 503 504 if ((sigalg = ssl_sigalg(signature_scheme, tls13_sigalgs, 505 tls13_sigalgs_len)) == NULL) 506 goto err; 507 508 if (!CBB_init(&cbb, 0)) 509 goto err; 510 if (!CBB_add_bytes(&cbb, cert_verify_pad, sizeof(cert_verify_pad))) 511 goto err; 512 if (!CBB_add_bytes(&cbb, server_cert_verify_context, 513 strlen(server_cert_verify_context))) 514 goto err; 515 if (!CBB_add_u8(&cbb, 0)) 516 goto err; 517 if (!CBB_add_bytes(&cbb, ctx->hs->transcript_hash, 518 ctx->hs->transcript_hash_len)) 519 goto err; 520 if (!CBB_finish(&cbb, &sig_content, &sig_content_len)) 521 goto err; 522 523 if ((cert = ctx->ssl->session->peer) == NULL) 524 goto err; 525 if ((pkey = X509_get0_pubkey(cert)) == NULL) 526 goto err; 527 if (!ssl_sigalg_pkey_ok(sigalg, pkey)) 528 goto err; 529 530 if (CBS_len(&signature) > EVP_PKEY_size(pkey)) 531 goto err; 532 533 if ((mdctx = EVP_MD_CTX_new()) == NULL) 534 goto err; 535 if (!EVP_DigestVerifyInit(mdctx, &pctx, sigalg->md(), NULL, pkey)) 536 goto err; 537 if (sigalg->flags & SIGALG_FLAG_RSA_PSS) { 538 if (!EVP_PKEY_CTX_set_rsa_padding(pctx, RSA_PKCS1_PSS_PADDING)) 539 goto err; 540 if (!EVP_PKEY_CTX_set_rsa_pss_saltlen(pctx, -1)) 541 goto err; 542 } 543 if (!EVP_DigestVerifyUpdate(mdctx, sig_content, sig_content_len)) 544 goto err; 545 if (EVP_DigestVerifyFinal(mdctx, CBS_data(&signature), 546 CBS_len(&signature)) <= 0) { 547 /* XXX - send alert. */ 548 goto err; 549 } 550 551 ret = 1; 552 553 err: 554 CBB_cleanup(&cbb); 555 EVP_MD_CTX_free(mdctx); 556 free(sig_content); 557 558 return ret; 559 } 560 561 int 562 tls13_server_finished_recv(struct tls13_ctx *ctx) 563 { 564 struct tls13_secrets *secrets = ctx->hs->secrets; 565 struct tls13_secret context = { .data = "", .len = 0 }; 566 struct tls13_secret finished_key; 567 uint8_t transcript_hash[EVP_MAX_MD_SIZE]; 568 size_t transcript_hash_len; 569 uint8_t *verify_data = NULL; 570 size_t verify_data_len; 571 uint8_t key[EVP_MAX_MD_SIZE]; 572 HMAC_CTX *hmac_ctx = NULL; 573 unsigned int hlen; 574 int ret = 0; 575 CBS cbs; 576 577 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs)) 578 goto err; 579 580 /* 581 * Verify server finished. 582 */ 583 finished_key.data = key; 584 finished_key.len = EVP_MD_size(ctx->hash); 585 586 if (!tls13_hkdf_expand_label(&finished_key, ctx->hash, 587 &secrets->server_handshake_traffic, "finished", 588 &context)) 589 goto err; 590 591 if ((hmac_ctx = HMAC_CTX_new()) == NULL) 592 goto err; 593 if (!HMAC_Init_ex(hmac_ctx, finished_key.data, finished_key.len, 594 ctx->hash, NULL)) 595 goto err; 596 if (!HMAC_Update(hmac_ctx, ctx->hs->transcript_hash, 597 ctx->hs->transcript_hash_len)) 598 goto err; 599 verify_data_len = HMAC_size(hmac_ctx); 600 if ((verify_data = calloc(1, verify_data_len)) == NULL) 601 goto err; 602 if (!HMAC_Final(hmac_ctx, verify_data, &hlen)) 603 goto err; 604 if (hlen != verify_data_len) 605 goto err; 606 607 if (!CBS_mem_equal(&cbs, verify_data, verify_data_len)) { 608 /* XXX - send alert. */ 609 goto err; 610 } 611 612 /* 613 * Derive application traffic keys. 614 */ 615 if (!tls1_transcript_hash_value(ctx->ssl, transcript_hash, 616 sizeof(transcript_hash), &transcript_hash_len)) 617 goto err; 618 619 context.data = transcript_hash; 620 context.len = transcript_hash_len; 621 622 if (!tls13_derive_application_secrets(secrets, &context)) 623 goto err; 624 625 /* 626 * Any records following the server finished message must be encrypted 627 * using the server application traffic keys. 628 */ 629 if (!tls13_record_layer_set_read_traffic_key(ctx->rl, 630 &secrets->server_application_traffic)) 631 goto err; 632 633 ret = 1; 634 635 err: 636 HMAC_CTX_free(hmac_ctx); 637 free(verify_data); 638 639 return ret; 640 } 641 642 int 643 tls13_client_finished_send(struct tls13_ctx *ctx) 644 { 645 struct tls13_secrets *secrets = ctx->hs->secrets; 646 struct tls13_secret context = { .data = "", .len = 0 }; 647 struct tls13_secret finished_key; 648 uint8_t transcript_hash[EVP_MAX_MD_SIZE]; 649 size_t transcript_hash_len; 650 uint8_t key[EVP_MAX_MD_SIZE]; 651 uint8_t *verify_data; 652 size_t hmac_len; 653 unsigned int hlen; 654 HMAC_CTX *hmac_ctx = NULL; 655 int ret = 0; 656 CBB body; 657 658 finished_key.data = key; 659 finished_key.len = EVP_MD_size(ctx->hash); 660 661 if (!tls13_hkdf_expand_label(&finished_key, ctx->hash, 662 &secrets->client_handshake_traffic, "finished", 663 &context)) 664 goto err; 665 666 if (!tls1_transcript_hash_value(ctx->ssl, transcript_hash, 667 sizeof(transcript_hash), &transcript_hash_len)) 668 goto err; 669 670 if ((hmac_ctx = HMAC_CTX_new()) == NULL) 671 goto err; 672 if (!HMAC_Init_ex(hmac_ctx, finished_key.data, finished_key.len, 673 ctx->hash, NULL)) 674 goto err; 675 if (!HMAC_Update(hmac_ctx, transcript_hash, transcript_hash_len)) 676 goto err; 677 678 if (!tls13_handshake_msg_start(ctx->hs_msg, &body, TLS13_MT_FINISHED)) 679 goto err; 680 hmac_len = HMAC_size(hmac_ctx); 681 if (!CBB_add_space(&body, &verify_data, hmac_len)) 682 goto err; 683 if (!HMAC_Final(hmac_ctx, verify_data, &hlen)) 684 goto err; 685 if (hlen != hmac_len) 686 goto err; 687 if (!tls13_handshake_msg_finish(ctx->hs_msg)) 688 goto err; 689 690 ret = 1; 691 692 err: 693 HMAC_CTX_free(hmac_ctx); 694 695 return ret; 696 } 697 698 int 699 tls13_client_finished_sent(struct tls13_ctx *ctx) 700 { 701 struct tls13_secrets *secrets = ctx->hs->secrets; 702 703 /* 704 * Any records following the client finished message must be encrypted 705 * using the client application traffic keys. 706 */ 707 return tls13_record_layer_set_write_traffic_key(ctx->rl, 708 &secrets->client_application_traffic); 709 } 710