xref: /openbsd-src/lib/libssl/tls13_handshake.c (revision 99fd087599a8791921855f21bd7e36130f39aadc)
1 /*	$OpenBSD: tls13_handshake.c,v 1.51 2020/02/05 16:42:29 jsing Exp $	*/
2 /*
3  * Copyright (c) 2018-2019 Theo Buehler <tb@openbsd.org>
4  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <stddef.h>
20 
21 #include "ssl_locl.h"
22 #include "tls13_handshake.h"
23 #include "tls13_internal.h"
24 
25 /* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */
26 
27 struct tls13_handshake_action {
28 	uint8_t	handshake_type;
29 	uint8_t	sender;
30 	uint8_t	handshake_complete;
31 	uint8_t	send_preserve_transcript_hash;
32 	uint8_t	recv_preserve_transcript_hash;
33 
34 	int (*send)(struct tls13_ctx *ctx, CBB *cbb);
35 	int (*sent)(struct tls13_ctx *ctx);
36 	int (*recv)(struct tls13_ctx *ctx, CBS *cbs);
37 };
38 
39 enum tls13_message_type tls13_handshake_active_state(struct tls13_ctx *ctx);
40 
41 struct tls13_handshake_action *
42     tls13_handshake_active_action(struct tls13_ctx *ctx);
43 int tls13_handshake_advance_state_machine(struct tls13_ctx *ctx);
44 
45 int tls13_handshake_send_action(struct tls13_ctx *ctx,
46     struct tls13_handshake_action *action);
47 int tls13_handshake_recv_action(struct tls13_ctx *ctx,
48     struct tls13_handshake_action *action);
49 
50 struct tls13_handshake_action state_machine[] = {
51 	[CLIENT_HELLO] = {
52 		.handshake_type = TLS13_MT_CLIENT_HELLO,
53 		.sender = TLS13_HS_CLIENT,
54 		.send = tls13_client_hello_send,
55 		.sent = tls13_client_hello_sent,
56 		.recv = tls13_client_hello_recv,
57 	},
58 	[CLIENT_HELLO_RETRY] = {
59 		.handshake_type = TLS13_MT_CLIENT_HELLO,
60 		.sender = TLS13_HS_CLIENT,
61 		.send = tls13_client_hello_retry_send,
62 		.recv = tls13_client_hello_retry_recv,
63 	},
64 	[CLIENT_END_OF_EARLY_DATA] = {
65 		.handshake_type = TLS13_MT_END_OF_EARLY_DATA,
66 		.sender = TLS13_HS_CLIENT,
67 		.send = tls13_client_end_of_early_data_send,
68 		.recv = tls13_client_end_of_early_data_recv,
69 	},
70 	[CLIENT_CERTIFICATE] = {
71 		.handshake_type = TLS13_MT_CERTIFICATE,
72 		.sender = TLS13_HS_CLIENT,
73 		.send_preserve_transcript_hash = 1,
74 		.send = tls13_client_certificate_send,
75 		.recv = tls13_client_certificate_recv,
76 	},
77 	[CLIENT_CERTIFICATE_VERIFY] = {
78 		.handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
79 		.sender = TLS13_HS_CLIENT,
80 		.recv_preserve_transcript_hash = 1,
81 		.send = tls13_client_certificate_verify_send,
82 		.recv = tls13_client_certificate_verify_recv,
83 	},
84 	[CLIENT_FINISHED] = {
85 		.handshake_type = TLS13_MT_FINISHED,
86 		.sender = TLS13_HS_CLIENT,
87 		.recv_preserve_transcript_hash = 1,
88 		.send = tls13_client_finished_send,
89 		.sent = tls13_client_finished_sent,
90 		.recv = tls13_client_finished_recv,
91 	},
92 	[CLIENT_KEY_UPDATE] = {
93 		.handshake_type = TLS13_MT_KEY_UPDATE,
94 		.sender = TLS13_HS_CLIENT,
95 		.send = tls13_client_key_update_send,
96 		.recv = tls13_client_key_update_recv,
97 	},
98 	[SERVER_HELLO] = {
99 		.handshake_type = TLS13_MT_SERVER_HELLO,
100 		.sender = TLS13_HS_SERVER,
101 		.send = tls13_server_hello_send,
102 		.sent = tls13_server_hello_sent,
103 		.recv = tls13_server_hello_recv,
104 	},
105 	[SERVER_HELLO_RETRY] = {
106 		.handshake_type = TLS13_MT_SERVER_HELLO,
107 		.sender = TLS13_HS_SERVER,
108 		.send = tls13_server_hello_retry_send,
109 		.recv = tls13_server_hello_retry_recv,
110 	},
111 	[SERVER_ENCRYPTED_EXTENSIONS] = {
112 		.handshake_type = TLS13_MT_ENCRYPTED_EXTENSIONS,
113 		.sender = TLS13_HS_SERVER,
114 		.send = tls13_server_encrypted_extensions_send,
115 		.recv = tls13_server_encrypted_extensions_recv,
116 	},
117 	[SERVER_CERTIFICATE] = {
118 		.handshake_type = TLS13_MT_CERTIFICATE,
119 		.sender = TLS13_HS_SERVER,
120 		.send_preserve_transcript_hash = 1,
121 		.send = tls13_server_certificate_send,
122 		.recv = tls13_server_certificate_recv,
123 	},
124 	[SERVER_CERTIFICATE_REQUEST] = {
125 		.handshake_type = TLS13_MT_CERTIFICATE_REQUEST,
126 		.sender = TLS13_HS_SERVER,
127 		.send = tls13_server_certificate_request_send,
128 		.recv = tls13_server_certificate_request_recv,
129 	},
130 	[SERVER_CERTIFICATE_VERIFY] = {
131 		.handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
132 		.sender = TLS13_HS_SERVER,
133 		.recv_preserve_transcript_hash = 1,
134 		.send = tls13_server_certificate_verify_send,
135 		.recv = tls13_server_certificate_verify_recv,
136 	},
137 	[SERVER_FINISHED] = {
138 		.handshake_type = TLS13_MT_FINISHED,
139 		.sender = TLS13_HS_SERVER,
140 		.recv_preserve_transcript_hash = 1,
141 		.send_preserve_transcript_hash = 1,
142 		.send = tls13_server_finished_send,
143 		.sent = tls13_server_finished_sent,
144 		.recv = tls13_server_finished_recv,
145 	},
146 	[APPLICATION_DATA] = {
147 		.handshake_complete = 1,
148 	},
149 };
150 
151 enum tls13_message_type handshakes[][TLS13_NUM_MESSAGE_TYPES] = {
152 	[INITIAL] = {
153 		CLIENT_HELLO,
154 		SERVER_HELLO,
155 	},
156 	[NEGOTIATED] = {
157 		CLIENT_HELLO,
158 		SERVER_HELLO,
159 		SERVER_ENCRYPTED_EXTENSIONS,
160 		SERVER_CERTIFICATE_REQUEST,
161 		SERVER_CERTIFICATE,
162 		SERVER_CERTIFICATE_VERIFY,
163 		SERVER_FINISHED,
164 		CLIENT_CERTIFICATE,
165 		CLIENT_FINISHED,
166 		APPLICATION_DATA,
167 	},
168 	[NEGOTIATED | WITH_HRR] = {
169 		CLIENT_HELLO,
170 		SERVER_HELLO,
171 		CLIENT_HELLO_RETRY,
172 		SERVER_HELLO_RETRY,
173 		SERVER_ENCRYPTED_EXTENSIONS,
174 		SERVER_CERTIFICATE_REQUEST,
175 		SERVER_CERTIFICATE,
176 		SERVER_CERTIFICATE_VERIFY,
177 		SERVER_FINISHED,
178 		CLIENT_CERTIFICATE,
179 		CLIENT_FINISHED,
180 		APPLICATION_DATA,
181 	},
182 	[NEGOTIATED | WITHOUT_CR] = {
183 		CLIENT_HELLO,
184 		SERVER_HELLO,
185 		SERVER_ENCRYPTED_EXTENSIONS,
186 		SERVER_CERTIFICATE,
187 		SERVER_CERTIFICATE_VERIFY,
188 		SERVER_FINISHED,
189 		CLIENT_FINISHED,
190 		APPLICATION_DATA,
191 	},
192 	[NEGOTIATED | WITH_HRR | WITHOUT_CR] = {
193 		CLIENT_HELLO,
194 		SERVER_HELLO,
195 		CLIENT_HELLO_RETRY,
196 		SERVER_HELLO_RETRY,
197 		SERVER_ENCRYPTED_EXTENSIONS,
198 		SERVER_CERTIFICATE,
199 		SERVER_CERTIFICATE_VERIFY,
200 		SERVER_FINISHED,
201 		CLIENT_FINISHED,
202 		APPLICATION_DATA,
203 	},
204 	[NEGOTIATED | WITH_PSK] = {
205 		CLIENT_HELLO,
206 		SERVER_HELLO,
207 		SERVER_ENCRYPTED_EXTENSIONS,
208 		SERVER_FINISHED,
209 		CLIENT_FINISHED,
210 		APPLICATION_DATA,
211 	},
212 	[NEGOTIATED | WITH_HRR | WITH_PSK] = {
213 		CLIENT_HELLO,
214 		SERVER_HELLO,
215 		CLIENT_HELLO_RETRY,
216 		SERVER_HELLO_RETRY,
217 		SERVER_ENCRYPTED_EXTENSIONS,
218 		SERVER_FINISHED,
219 		CLIENT_FINISHED,
220 		APPLICATION_DATA,
221 	},
222 	[NEGOTIATED | WITH_CCV] = {
223 		CLIENT_HELLO,
224 		SERVER_HELLO,
225 		SERVER_ENCRYPTED_EXTENSIONS,
226 		SERVER_CERTIFICATE_REQUEST,
227 		SERVER_CERTIFICATE,
228 		SERVER_CERTIFICATE_VERIFY,
229 		SERVER_FINISHED,
230 		CLIENT_CERTIFICATE,
231 		CLIENT_CERTIFICATE_VERIFY,
232 		CLIENT_FINISHED,
233 		APPLICATION_DATA,
234 	},
235 	[NEGOTIATED | WITH_HRR | WITH_CCV] = {
236 		CLIENT_HELLO,
237 		SERVER_HELLO,
238 		CLIENT_HELLO_RETRY,
239 		SERVER_HELLO_RETRY,
240 		SERVER_ENCRYPTED_EXTENSIONS,
241 		SERVER_CERTIFICATE_REQUEST,
242 		SERVER_CERTIFICATE,
243 		SERVER_CERTIFICATE_VERIFY,
244 		SERVER_FINISHED,
245 		CLIENT_CERTIFICATE,
246 		CLIENT_CERTIFICATE_VERIFY,
247 		CLIENT_FINISHED,
248 		APPLICATION_DATA,
249 	},
250 };
251 
252 const size_t handshake_count = sizeof(handshakes) / sizeof(handshakes[0]);
253 
254 enum tls13_message_type
255 tls13_handshake_active_state(struct tls13_ctx *ctx)
256 {
257 	struct tls13_handshake_stage hs = ctx->handshake_stage;
258 
259 	if (hs.hs_type >= handshake_count)
260 		return INVALID;
261 	if (hs.message_number >= TLS13_NUM_MESSAGE_TYPES)
262 		return INVALID;
263 
264 	return handshakes[hs.hs_type][hs.message_number];
265 }
266 
267 struct tls13_handshake_action *
268 tls13_handshake_active_action(struct tls13_ctx *ctx)
269 {
270 	enum tls13_message_type mt = tls13_handshake_active_state(ctx);
271 
272 	if (mt == INVALID)
273 		return NULL;
274 
275 	return &state_machine[mt];
276 }
277 
278 int
279 tls13_handshake_advance_state_machine(struct tls13_ctx *ctx)
280 {
281 	if (++ctx->handshake_stage.message_number >= TLS13_NUM_MESSAGE_TYPES)
282 		return 0;
283 
284 	return 1;
285 }
286 
287 int
288 tls13_handshake_msg_record(struct tls13_ctx *ctx)
289 {
290 	CBS cbs;
291 
292 	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
293 	return tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs));
294 }
295 
296 int
297 tls13_handshake_perform(struct tls13_ctx *ctx)
298 {
299 	struct tls13_handshake_action *action;
300 	int ret;
301 
302 	for (;;) {
303 		if ((action = tls13_handshake_active_action(ctx)) == NULL)
304 			return TLS13_IO_FAILURE;
305 
306 		if (action->handshake_complete) {
307 			ctx->handshake_completed = 1;
308 			tls13_record_layer_handshake_completed(ctx->rl);
309 			return TLS13_IO_SUCCESS;
310 		}
311 
312 		if (ctx->alert)
313 			return tls13_send_alert(ctx->rl, ctx->alert);
314 
315 		if (action->sender == ctx->mode) {
316 			if ((ret = tls13_handshake_send_action(ctx, action)) <= 0)
317 				return ret;
318 		} else {
319 			if ((ret = tls13_handshake_recv_action(ctx, action)) <= 0)
320 				return ret;
321 		}
322 
323 		if (!tls13_handshake_advance_state_machine(ctx))
324 			return TLS13_IO_FAILURE;
325 	}
326 }
327 
328 int
329 tls13_handshake_send_action(struct tls13_ctx *ctx,
330     struct tls13_handshake_action *action)
331 {
332 	ssize_t ret;
333 	CBB cbb;
334 
335 	/* If we have no handshake message, we need to build one. */
336 	if (ctx->hs_msg == NULL) {
337 		if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL)
338 			return TLS13_IO_FAILURE;
339 		if (!tls13_handshake_msg_start(ctx->hs_msg, &cbb,
340 		    action->handshake_type))
341 			return TLS13_IO_FAILURE;
342 		if (!action->send(ctx, &cbb))
343 			return TLS13_IO_FAILURE;
344 		if (!tls13_handshake_msg_finish(ctx->hs_msg))
345 			return TLS13_IO_FAILURE;
346 
347 		if (ctx->alert)
348 			return tls13_send_alert(ctx->rl, ctx->alert);
349 	}
350 
351 	if ((ret = tls13_handshake_msg_send(ctx->hs_msg, ctx->rl)) <= 0)
352 		return ret;
353 
354 	if (!tls13_handshake_msg_record(ctx))
355 		return TLS13_IO_FAILURE;
356 
357 	if (action->send_preserve_transcript_hash) {
358 		if (!tls1_transcript_hash_value(ctx->ssl,
359 		    ctx->hs->transcript_hash, sizeof(ctx->hs->transcript_hash),
360 		    &ctx->hs->transcript_hash_len))
361 			return TLS13_IO_FAILURE;
362 	}
363 
364 	if (ctx->handshake_message_sent_cb != NULL)
365 		ctx->handshake_message_sent_cb(ctx);
366 
367 	tls13_handshake_msg_free(ctx->hs_msg);
368 	ctx->hs_msg = NULL;
369 
370 	if (action->sent != NULL && !action->sent(ctx))
371 		return TLS13_IO_FAILURE;
372 
373 	return TLS13_IO_SUCCESS;
374 }
375 
376 int
377 tls13_handshake_recv_action(struct tls13_ctx *ctx,
378     struct tls13_handshake_action *action)
379 {
380 	uint8_t msg_type;
381 	ssize_t ret;
382 	CBS cbs;
383 
384 	if (ctx->hs_msg == NULL) {
385 		if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL)
386 			return TLS13_IO_FAILURE;
387 	}
388 
389 	if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl)) <= 0)
390 		return ret;
391 
392 	if (action->recv_preserve_transcript_hash) {
393 		if (!tls1_transcript_hash_value(ctx->ssl,
394 		    ctx->hs->transcript_hash, sizeof(ctx->hs->transcript_hash),
395 		    &ctx->hs->transcript_hash_len))
396 			return TLS13_IO_FAILURE;
397 	}
398 
399 	if (!tls13_handshake_msg_record(ctx))
400 		return TLS13_IO_FAILURE;
401 
402 	if (ctx->handshake_message_recv_cb != NULL)
403 		ctx->handshake_message_recv_cb(ctx);
404 
405 	/*
406 	 * In TLSv1.3 there is no way to know if you're going to receive a
407 	 * certificate request message or not, hence we have to special case it
408 	 * here. The receive handler also knows how to deal with this situation.
409 	 */
410 	msg_type = tls13_handshake_msg_type(ctx->hs_msg);
411 	if (msg_type != action->handshake_type &&
412 	    (msg_type != TLS13_MT_CERTIFICATE ||
413 	     action->handshake_type != TLS13_MT_CERTIFICATE_REQUEST))
414 		return tls13_send_alert(ctx->rl, SSL_AD_UNEXPECTED_MESSAGE);
415 
416 	if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs))
417 		return TLS13_IO_FAILURE;
418 
419 	ret = TLS13_IO_FAILURE;
420 	if (action->recv(ctx, &cbs)) {
421 		if (CBS_len(&cbs) != 0) {
422 			tls13_set_errorx(ctx, TLS13_ERR_TRAILING_DATA, 0,
423 			    "trailing data in handshake message", NULL);
424 			ctx->alert = SSL_AD_DECODE_ERROR;
425 		} else {
426 			ret = TLS13_IO_SUCCESS;
427 		}
428 	}
429 
430 	if (ctx->alert)
431 		ret = tls13_send_alert(ctx->rl, ctx->alert);
432 
433 	tls13_handshake_msg_free(ctx->hs_msg);
434 	ctx->hs_msg = NULL;
435 
436 	if (ctx->ssl->method->internal->version < TLS1_3_VERSION)
437 		return TLS13_IO_USE_LEGACY;
438 
439 	return ret;
440 }
441