xref: /openbsd-src/lib/libssl/tls13_handshake.c (revision 4b70baf6e17fc8b27fc1f7fa7929335753fa94c3) 
1 /*	$OpenBSD: tls13_handshake.c,v 1.35 2019/04/05 20:23:38 tb Exp $	*/
2 /*
3  * Copyright (c) 2018-2019 Theo Buehler <tb@openbsd.org>
4  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <stddef.h>
20 
21 #include "ssl_locl.h"
22 #include "tls13_handshake.h"
23 #include "tls13_internal.h"
24 
25 /* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */
26 
27 struct tls13_handshake_action {
28 	uint8_t			handshake_type;
29 	uint8_t			sender;
30 	uint8_t			handshake_complete;
31 	uint8_t			preserve_transcript_hash;
32 
33 	int (*send)(struct tls13_ctx *ctx);
34 	int (*sent)(struct tls13_ctx *ctx);
35 	int (*recv)(struct tls13_ctx *ctx);
36 };
37 
38 enum tls13_message_type tls13_handshake_active_state(struct tls13_ctx *ctx);
39 
40 int tls13_accept(struct tls13_ctx *ctx);
41 
42 struct tls13_handshake_action *
43     tls13_handshake_active_action(struct tls13_ctx *ctx);
44 int tls13_handshake_advance_state_machine(struct tls13_ctx *ctx);
45 
46 int tls13_handshake_send_action(struct tls13_ctx *ctx,
47     struct tls13_handshake_action *action);
48 int tls13_handshake_recv_action(struct tls13_ctx *ctx,
49     struct tls13_handshake_action *action);
50 
51 struct tls13_handshake_action state_machine[] = {
52 	[CLIENT_HELLO] = {
53 		.handshake_type = TLS13_MT_CLIENT_HELLO,
54 		.sender = TLS13_HS_CLIENT,
55 		.send = tls13_client_hello_send,
56 		.recv = tls13_client_hello_recv,
57 	},
58 	[CLIENT_HELLO_RETRY] = {
59 		.handshake_type = TLS13_MT_CLIENT_HELLO,
60 		.sender = TLS13_HS_CLIENT,
61 		.send = tls13_client_hello_retry_send,
62 		.recv = tls13_client_hello_retry_recv,
63 	},
64 	[CLIENT_END_OF_EARLY_DATA] = {
65 		.handshake_type = TLS13_MT_END_OF_EARLY_DATA,
66 		.sender = TLS13_HS_CLIENT,
67 		.send = tls13_client_end_of_early_data_send,
68 		.recv = tls13_client_end_of_early_data_recv,
69 	},
70 	[CLIENT_CERTIFICATE] = {
71 		.handshake_type = TLS13_MT_CERTIFICATE,
72 		.sender = TLS13_HS_CLIENT,
73 		.send = tls13_client_certificate_send,
74 		.recv = tls13_client_certificate_recv,
75 	},
76 	[CLIENT_CERTIFICATE_VERIFY] = {
77 		.handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
78 		.sender = TLS13_HS_CLIENT,
79 		.send = tls13_client_certificate_verify_send,
80 		.recv = tls13_client_certificate_verify_recv,
81 	},
82 	[CLIENT_FINISHED] = {
83 		.handshake_type = TLS13_MT_FINISHED,
84 		.sender = TLS13_HS_CLIENT,
85 		.send = tls13_client_finished_send,
86 		.sent = tls13_client_finished_sent,
87 		.recv = tls13_client_finished_recv,
88 	},
89 	[CLIENT_KEY_UPDATE] = {
90 		.handshake_type = TLS13_MT_KEY_UPDATE,
91 		.sender = TLS13_HS_CLIENT,
92 		.send = tls13_client_key_update_send,
93 		.recv = tls13_client_key_update_recv,
94 	},
95 	[SERVER_HELLO] = {
96 		.handshake_type = TLS13_MT_SERVER_HELLO,
97 		.sender = TLS13_HS_SERVER,
98 		.send = tls13_server_hello_send,
99 		.recv = tls13_server_hello_recv,
100 	},
101 	[SERVER_HELLO_RETRY] = {
102 		.handshake_type = TLS13_MT_SERVER_HELLO,
103 		.sender = TLS13_HS_SERVER,
104 		.send = tls13_server_hello_retry_send,
105 		.recv = tls13_server_hello_retry_recv,
106 	},
107 	[SERVER_ENCRYPTED_EXTENSIONS] = {
108 		.handshake_type = TLS13_MT_ENCRYPTED_EXTENSIONS,
109 		.sender = TLS13_HS_SERVER,
110 		.send = tls13_server_encrypted_extensions_send,
111 		.recv = tls13_server_encrypted_extensions_recv,
112 	},
113 	[SERVER_CERTIFICATE] = {
114 		.handshake_type = TLS13_MT_CERTIFICATE,
115 		.sender = TLS13_HS_SERVER,
116 		.send = tls13_server_certificate_send,
117 		.recv = tls13_server_certificate_recv,
118 	},
119 	[SERVER_CERTIFICATE_REQUEST] = {
120 		.handshake_type = TLS13_MT_CERTIFICATE,
121 		.sender = TLS13_HS_SERVER,
122 		.send = tls13_server_certificate_request_send,
123 		.recv = tls13_server_certificate_request_recv,
124 	},
125 	[SERVER_CERTIFICATE_VERIFY] = {
126 		.handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
127 		.sender = TLS13_HS_SERVER,
128 		.preserve_transcript_hash = 1,
129 		.send = tls13_server_certificate_verify_send,
130 		.recv = tls13_server_certificate_verify_recv,
131 	},
132 	[SERVER_FINISHED] = {
133 		.handshake_type = TLS13_MT_FINISHED,
134 		.sender = TLS13_HS_SERVER,
135 		.preserve_transcript_hash = 1,
136 		.send = tls13_server_finished_send,
137 		.recv = tls13_server_finished_recv,
138 	},
139 	[APPLICATION_DATA] = {
140 		.handshake_complete = 1,
141 	},
142 };
143 
144 enum tls13_message_type handshakes[][TLS13_NUM_MESSAGE_TYPES] = {
145 	[INITIAL] = {
146 		CLIENT_HELLO,
147 		SERVER_HELLO,
148 	},
149 	[NEGOTIATED] = {
150 		CLIENT_HELLO,
151 		SERVER_HELLO,
152 		SERVER_ENCRYPTED_EXTENSIONS,
153 		SERVER_CERTIFICATE_REQUEST,
154 		SERVER_CERTIFICATE,
155 		SERVER_CERTIFICATE_VERIFY,
156 		SERVER_FINISHED,
157 		CLIENT_CERTIFICATE,
158 		CLIENT_FINISHED,
159 		APPLICATION_DATA,
160 	},
161 	[NEGOTIATED | WITH_HRR] = {
162 		CLIENT_HELLO,
163 		SERVER_HELLO,
164 		CLIENT_HELLO_RETRY,
165 		SERVER_HELLO_RETRY,
166 		SERVER_ENCRYPTED_EXTENSIONS,
167 		SERVER_CERTIFICATE_REQUEST,
168 		SERVER_CERTIFICATE,
169 		SERVER_CERTIFICATE_VERIFY,
170 		SERVER_FINISHED,
171 		CLIENT_CERTIFICATE,
172 		CLIENT_FINISHED,
173 		APPLICATION_DATA,
174 	},
175 	[NEGOTIATED | WITHOUT_CR] = {
176 		CLIENT_HELLO,
177 		SERVER_HELLO,
178 		SERVER_ENCRYPTED_EXTENSIONS,
179 		SERVER_CERTIFICATE,
180 		SERVER_CERTIFICATE_VERIFY,
181 		SERVER_FINISHED,
182 		CLIENT_FINISHED,
183 		APPLICATION_DATA,
184 	},
185 	[NEGOTIATED | WITH_HRR | WITHOUT_CR] = {
186 		CLIENT_HELLO,
187 		SERVER_HELLO,
188 		CLIENT_HELLO_RETRY,
189 		SERVER_HELLO_RETRY,
190 		SERVER_ENCRYPTED_EXTENSIONS,
191 		SERVER_CERTIFICATE,
192 		SERVER_CERTIFICATE_VERIFY,
193 		SERVER_FINISHED,
194 		CLIENT_FINISHED,
195 		APPLICATION_DATA,
196 	},
197 	[NEGOTIATED | WITH_PSK] = {
198 		CLIENT_HELLO,
199 		SERVER_HELLO,
200 		SERVER_ENCRYPTED_EXTENSIONS,
201 		SERVER_FINISHED,
202 		CLIENT_FINISHED,
203 		APPLICATION_DATA,
204 	},
205 	[NEGOTIATED | WITH_HRR | WITH_PSK] = {
206 		CLIENT_HELLO,
207 		SERVER_HELLO,
208 		CLIENT_HELLO_RETRY,
209 		SERVER_HELLO_RETRY,
210 		SERVER_ENCRYPTED_EXTENSIONS,
211 		SERVER_FINISHED,
212 		CLIENT_FINISHED,
213 		APPLICATION_DATA,
214 	},
215 	[NEGOTIATED | WITH_CCV] = {
216 		CLIENT_HELLO,
217 		SERVER_HELLO,
218 		SERVER_ENCRYPTED_EXTENSIONS,
219 		SERVER_CERTIFICATE_REQUEST,
220 		SERVER_CERTIFICATE,
221 		SERVER_CERTIFICATE_VERIFY,
222 		SERVER_FINISHED,
223 		CLIENT_CERTIFICATE,
224 		CLIENT_CERTIFICATE_VERIFY,
225 		CLIENT_FINISHED,
226 		APPLICATION_DATA,
227 	},
228 	[NEGOTIATED | WITH_HRR | WITH_CCV] = {
229 		CLIENT_HELLO,
230 		SERVER_HELLO,
231 		CLIENT_HELLO_RETRY,
232 		SERVER_HELLO_RETRY,
233 		SERVER_ENCRYPTED_EXTENSIONS,
234 		SERVER_CERTIFICATE_REQUEST,
235 		SERVER_CERTIFICATE,
236 		SERVER_CERTIFICATE_VERIFY,
237 		SERVER_FINISHED,
238 		CLIENT_CERTIFICATE,
239 		CLIENT_CERTIFICATE_VERIFY,
240 		CLIENT_FINISHED,
241 		APPLICATION_DATA,
242 	},
243 };
244 
245 const size_t handshake_count = sizeof(handshakes) / sizeof(handshakes[0]);
246 
247 enum tls13_message_type
248 tls13_handshake_active_state(struct tls13_ctx *ctx)
249 {
250 	struct tls13_handshake_stage hs = ctx->handshake_stage;
251 
252 	if (hs.hs_type >= handshake_count)
253 		return INVALID;
254 	if (hs.message_number >= TLS13_NUM_MESSAGE_TYPES)
255 		return INVALID;
256 
257 	return handshakes[hs.hs_type][hs.message_number];
258 }
259 
260 struct tls13_handshake_action *
261 tls13_handshake_active_action(struct tls13_ctx *ctx)
262 {
263 	enum tls13_message_type mt = tls13_handshake_active_state(ctx);
264 
265 	if (mt == INVALID)
266 		return NULL;
267 
268 	return &state_machine[mt];
269 }
270 
271 int
272 tls13_handshake_advance_state_machine(struct tls13_ctx *ctx)
273 {
274 	if (++ctx->handshake_stage.message_number >= TLS13_NUM_MESSAGE_TYPES)
275 		return 0;
276 
277 	return 1;
278 }
279 
280 int
281 tls13_handshake_perform(struct tls13_ctx *ctx)
282 {
283 	struct tls13_handshake_action *action;
284 	int ret;
285 
286 	for (;;) {
287 		if ((action = tls13_handshake_active_action(ctx)) == NULL)
288 			return TLS13_IO_FAILURE;
289 
290 		if (action->handshake_complete) {
291 			ctx->handshake_completed = 1;
292 			tls13_record_layer_handshake_completed(ctx->rl);
293 			return TLS13_IO_SUCCESS;
294 		}
295 
296 		if (action->sender == ctx->mode) {
297 			if ((ret = tls13_handshake_send_action(ctx, action)) <= 0)
298 				return ret;
299 		} else {
300 			if ((ret = tls13_handshake_recv_action(ctx, action)) <= 0)
301 				return ret;
302 		}
303 
304 		if (!tls13_handshake_advance_state_machine(ctx))
305 			return TLS13_IO_FAILURE;
306 	}
307 }
308 
309 int
310 tls13_accept(struct tls13_ctx *ctx)
311 {
312 	ctx->mode = TLS13_HS_SERVER;
313 
314 	return tls13_handshake_perform(ctx);
315 }
316 
317 int
318 tls13_handshake_send_action(struct tls13_ctx *ctx,
319     struct tls13_handshake_action *action)
320 {
321 	ssize_t ret;
322 	CBS cbs;
323 
324 	/* If we have no handshake message, we need to build one. */
325 	if (ctx->hs_msg == NULL) {
326 		if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL)
327 			return TLS13_IO_FAILURE;
328 
329 		/* XXX - provide CBB. */
330 		if (!action->send(ctx))
331 			return TLS13_IO_FAILURE;
332 	}
333 
334 	if ((ret = tls13_handshake_msg_send(ctx->hs_msg, ctx->rl)) <= 0)
335 		return ret;
336 
337 	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
338 	if (!tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs)))
339 		return TLS13_IO_FAILURE;
340 
341 	tls13_handshake_msg_free(ctx->hs_msg);
342 	ctx->hs_msg = NULL;
343 
344 	if (action->sent != NULL && !action->sent(ctx))
345 		return TLS13_IO_FAILURE;
346 
347 	return TLS13_IO_SUCCESS;
348 }
349 
350 int
351 tls13_handshake_recv_action(struct tls13_ctx *ctx,
352     struct tls13_handshake_action *action)
353 {
354 	uint8_t msg_type;
355 	ssize_t ret;
356 	CBS cbs;
357 
358 	if (ctx->hs_msg == NULL) {
359 		if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL)
360 			return TLS13_IO_FAILURE;
361 	}
362 
363 	if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl)) <= 0)
364 		return ret;
365 
366 	if (action->preserve_transcript_hash) {
367 		if (!tls1_transcript_hash_value(ctx->ssl,
368 		    ctx->hs->transcript_hash, sizeof(ctx->hs->transcript_hash),
369 		    &ctx->hs->transcript_hash_len))
370 			return TLS13_IO_FAILURE;
371 	}
372 
373 	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
374 	if (!tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs)))
375 		return TLS13_IO_FAILURE;
376 
377 	/*
378 	 * In TLSv1.3 there is no way to know if you're going to receive a
379 	 * certificate request message or not, hence we have to special case it
380 	 * here. The receive handler also knows how to deal with this situation.
381 	 */
382 	msg_type = tls13_handshake_msg_type(ctx->hs_msg);
383 	if (msg_type != action->handshake_type &&
384 	    (msg_type != TLS13_MT_CERTIFICATE ||
385 	     action->handshake_type != TLS13_MT_CERTIFICATE_REQUEST)) {
386 		/* XXX send unexpected message alert */
387 		return TLS13_IO_FAILURE;
388 	}
389 
390 	/* XXX provide CBS and check all consumed. */
391 	ret = TLS13_IO_FAILURE;
392 	if (action->recv(ctx))
393 		ret = TLS13_IO_SUCCESS;
394 
395 	tls13_handshake_msg_free(ctx->hs_msg);
396 	ctx->hs_msg = NULL;
397 
398 	if (ctx->ssl->method->internal->version < TLS1_3_VERSION)
399 		return TLS13_IO_USE_LEGACY;
400 
401 	return ret;
402 }
403 
404 int
405 tls13_client_hello_recv(struct tls13_ctx *ctx)
406 {
407 	return 0;
408 }
409 
410 int
411 tls13_client_hello_retry_send(struct tls13_ctx *ctx)
412 {
413 	return 0;
414 }
415 
416 int
417 tls13_server_hello_retry_recv(struct tls13_ctx *ctx)
418 {
419         return 0;
420 }
421 
422 int
423 tls13_client_hello_retry_recv(struct tls13_ctx *ctx)
424 {
425 	return 0;
426 }
427 
428 
429 int
430 tls13_client_end_of_early_data_send(struct tls13_ctx *ctx)
431 {
432 	return 0;
433 }
434 
435 int
436 tls13_client_end_of_early_data_recv(struct tls13_ctx *ctx)
437 {
438 	return 0;
439 }
440 
441 int
442 tls13_client_certificate_send(struct tls13_ctx *ctx)
443 {
444 	return 0;
445 }
446 
447 int
448 tls13_client_certificate_recv(struct tls13_ctx *ctx)
449 {
450 	return 0;
451 }
452 
453 int
454 tls13_client_certificate_verify_send(struct tls13_ctx *ctx)
455 {
456 	return 0;
457 }
458 
459 int
460 tls13_client_certificate_verify_recv(struct tls13_ctx *ctx)
461 {
462 	return 0;
463 }
464 
465 int
466 tls13_client_finished_recv(struct tls13_ctx *ctx)
467 {
468 	return 0;
469 }
470 
471 int
472 tls13_client_key_update_send(struct tls13_ctx *ctx)
473 {
474 	return 0;
475 }
476 
477 int
478 tls13_client_key_update_recv(struct tls13_ctx *ctx)
479 {
480 	return 0;
481 }
482 
483 int
484 tls13_server_hello_send(struct tls13_ctx *ctx)
485 {
486 	ctx->handshake_stage.hs_type |= NEGOTIATED;
487 
488 	return 0;
489 }
490 
491 int
492 tls13_server_hello_retry_send(struct tls13_ctx *ctx)
493 {
494 	return 0;
495 }
496 
497 int
498 tls13_server_encrypted_extensions_send(struct tls13_ctx *ctx)
499 {
500 	return 0;
501 }
502 
503 int
504 tls13_server_certificate_send(struct tls13_ctx *ctx)
505 {
506 	return 0;
507 }
508 
509 int
510 tls13_server_certificate_request_send(struct tls13_ctx *ctx)
511 {
512 	return 0;
513 }
514 
515 int
516 tls13_server_certificate_verify_send(struct tls13_ctx *ctx)
517 {
518 	return 0;
519 }
520 
521 int
522 tls13_server_finished_send(struct tls13_ctx *ctx)
523 {
524 	return 0;
525 }
526