1 /* $OpenBSD: tls13_handshake.c,v 1.51 2020/02/05 16:42:29 jsing Exp $ */ 2 /* 3 * Copyright (c) 2018-2019 Theo Buehler <tb@openbsd.org> 4 * Copyright (c) 2019 Joel Sing <jsing@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <stddef.h> 20 21 #include "ssl_locl.h" 22 #include "tls13_handshake.h" 23 #include "tls13_internal.h" 24 25 /* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */ 26 27 struct tls13_handshake_action { 28 uint8_t handshake_type; 29 uint8_t sender; 30 uint8_t handshake_complete; 31 uint8_t send_preserve_transcript_hash; 32 uint8_t recv_preserve_transcript_hash; 33 34 int (*send)(struct tls13_ctx *ctx, CBB *cbb); 35 int (*sent)(struct tls13_ctx *ctx); 36 int (*recv)(struct tls13_ctx *ctx, CBS *cbs); 37 }; 38 39 enum tls13_message_type tls13_handshake_active_state(struct tls13_ctx *ctx); 40 41 struct tls13_handshake_action * 42 tls13_handshake_active_action(struct tls13_ctx *ctx); 43 int tls13_handshake_advance_state_machine(struct tls13_ctx *ctx); 44 45 int tls13_handshake_send_action(struct tls13_ctx *ctx, 46 struct tls13_handshake_action *action); 47 int tls13_handshake_recv_action(struct tls13_ctx *ctx, 48 struct tls13_handshake_action *action); 49 50 struct tls13_handshake_action state_machine[] = { 51 [CLIENT_HELLO] = { 52 .handshake_type = TLS13_MT_CLIENT_HELLO, 53 .sender = TLS13_HS_CLIENT, 54 .send = tls13_client_hello_send, 55 .sent = tls13_client_hello_sent, 56 .recv = tls13_client_hello_recv, 57 }, 58 [CLIENT_HELLO_RETRY] = { 59 .handshake_type = TLS13_MT_CLIENT_HELLO, 60 .sender = TLS13_HS_CLIENT, 61 .send = tls13_client_hello_retry_send, 62 .recv = tls13_client_hello_retry_recv, 63 }, 64 [CLIENT_END_OF_EARLY_DATA] = { 65 .handshake_type = TLS13_MT_END_OF_EARLY_DATA, 66 .sender = TLS13_HS_CLIENT, 67 .send = tls13_client_end_of_early_data_send, 68 .recv = tls13_client_end_of_early_data_recv, 69 }, 70 [CLIENT_CERTIFICATE] = { 71 .handshake_type = TLS13_MT_CERTIFICATE, 72 .sender = TLS13_HS_CLIENT, 73 .send_preserve_transcript_hash = 1, 74 .send = tls13_client_certificate_send, 75 .recv = tls13_client_certificate_recv, 76 }, 77 [CLIENT_CERTIFICATE_VERIFY] = { 78 .handshake_type = TLS13_MT_CERTIFICATE_VERIFY, 79 .sender = TLS13_HS_CLIENT, 80 .recv_preserve_transcript_hash = 1, 81 .send = tls13_client_certificate_verify_send, 82 .recv = tls13_client_certificate_verify_recv, 83 }, 84 [CLIENT_FINISHED] = { 85 .handshake_type = TLS13_MT_FINISHED, 86 .sender = TLS13_HS_CLIENT, 87 .recv_preserve_transcript_hash = 1, 88 .send = tls13_client_finished_send, 89 .sent = tls13_client_finished_sent, 90 .recv = tls13_client_finished_recv, 91 }, 92 [CLIENT_KEY_UPDATE] = { 93 .handshake_type = TLS13_MT_KEY_UPDATE, 94 .sender = TLS13_HS_CLIENT, 95 .send = tls13_client_key_update_send, 96 .recv = tls13_client_key_update_recv, 97 }, 98 [SERVER_HELLO] = { 99 .handshake_type = TLS13_MT_SERVER_HELLO, 100 .sender = TLS13_HS_SERVER, 101 .send = tls13_server_hello_send, 102 .sent = tls13_server_hello_sent, 103 .recv = tls13_server_hello_recv, 104 }, 105 [SERVER_HELLO_RETRY] = { 106 .handshake_type = TLS13_MT_SERVER_HELLO, 107 .sender = TLS13_HS_SERVER, 108 .send = tls13_server_hello_retry_send, 109 .recv = tls13_server_hello_retry_recv, 110 }, 111 [SERVER_ENCRYPTED_EXTENSIONS] = { 112 .handshake_type = TLS13_MT_ENCRYPTED_EXTENSIONS, 113 .sender = TLS13_HS_SERVER, 114 .send = tls13_server_encrypted_extensions_send, 115 .recv = tls13_server_encrypted_extensions_recv, 116 }, 117 [SERVER_CERTIFICATE] = { 118 .handshake_type = TLS13_MT_CERTIFICATE, 119 .sender = TLS13_HS_SERVER, 120 .send_preserve_transcript_hash = 1, 121 .send = tls13_server_certificate_send, 122 .recv = tls13_server_certificate_recv, 123 }, 124 [SERVER_CERTIFICATE_REQUEST] = { 125 .handshake_type = TLS13_MT_CERTIFICATE_REQUEST, 126 .sender = TLS13_HS_SERVER, 127 .send = tls13_server_certificate_request_send, 128 .recv = tls13_server_certificate_request_recv, 129 }, 130 [SERVER_CERTIFICATE_VERIFY] = { 131 .handshake_type = TLS13_MT_CERTIFICATE_VERIFY, 132 .sender = TLS13_HS_SERVER, 133 .recv_preserve_transcript_hash = 1, 134 .send = tls13_server_certificate_verify_send, 135 .recv = tls13_server_certificate_verify_recv, 136 }, 137 [SERVER_FINISHED] = { 138 .handshake_type = TLS13_MT_FINISHED, 139 .sender = TLS13_HS_SERVER, 140 .recv_preserve_transcript_hash = 1, 141 .send_preserve_transcript_hash = 1, 142 .send = tls13_server_finished_send, 143 .sent = tls13_server_finished_sent, 144 .recv = tls13_server_finished_recv, 145 }, 146 [APPLICATION_DATA] = { 147 .handshake_complete = 1, 148 }, 149 }; 150 151 enum tls13_message_type handshakes[][TLS13_NUM_MESSAGE_TYPES] = { 152 [INITIAL] = { 153 CLIENT_HELLO, 154 SERVER_HELLO, 155 }, 156 [NEGOTIATED] = { 157 CLIENT_HELLO, 158 SERVER_HELLO, 159 SERVER_ENCRYPTED_EXTENSIONS, 160 SERVER_CERTIFICATE_REQUEST, 161 SERVER_CERTIFICATE, 162 SERVER_CERTIFICATE_VERIFY, 163 SERVER_FINISHED, 164 CLIENT_CERTIFICATE, 165 CLIENT_FINISHED, 166 APPLICATION_DATA, 167 }, 168 [NEGOTIATED | WITH_HRR] = { 169 CLIENT_HELLO, 170 SERVER_HELLO, 171 CLIENT_HELLO_RETRY, 172 SERVER_HELLO_RETRY, 173 SERVER_ENCRYPTED_EXTENSIONS, 174 SERVER_CERTIFICATE_REQUEST, 175 SERVER_CERTIFICATE, 176 SERVER_CERTIFICATE_VERIFY, 177 SERVER_FINISHED, 178 CLIENT_CERTIFICATE, 179 CLIENT_FINISHED, 180 APPLICATION_DATA, 181 }, 182 [NEGOTIATED | WITHOUT_CR] = { 183 CLIENT_HELLO, 184 SERVER_HELLO, 185 SERVER_ENCRYPTED_EXTENSIONS, 186 SERVER_CERTIFICATE, 187 SERVER_CERTIFICATE_VERIFY, 188 SERVER_FINISHED, 189 CLIENT_FINISHED, 190 APPLICATION_DATA, 191 }, 192 [NEGOTIATED | WITH_HRR | WITHOUT_CR] = { 193 CLIENT_HELLO, 194 SERVER_HELLO, 195 CLIENT_HELLO_RETRY, 196 SERVER_HELLO_RETRY, 197 SERVER_ENCRYPTED_EXTENSIONS, 198 SERVER_CERTIFICATE, 199 SERVER_CERTIFICATE_VERIFY, 200 SERVER_FINISHED, 201 CLIENT_FINISHED, 202 APPLICATION_DATA, 203 }, 204 [NEGOTIATED | WITH_PSK] = { 205 CLIENT_HELLO, 206 SERVER_HELLO, 207 SERVER_ENCRYPTED_EXTENSIONS, 208 SERVER_FINISHED, 209 CLIENT_FINISHED, 210 APPLICATION_DATA, 211 }, 212 [NEGOTIATED | WITH_HRR | WITH_PSK] = { 213 CLIENT_HELLO, 214 SERVER_HELLO, 215 CLIENT_HELLO_RETRY, 216 SERVER_HELLO_RETRY, 217 SERVER_ENCRYPTED_EXTENSIONS, 218 SERVER_FINISHED, 219 CLIENT_FINISHED, 220 APPLICATION_DATA, 221 }, 222 [NEGOTIATED | WITH_CCV] = { 223 CLIENT_HELLO, 224 SERVER_HELLO, 225 SERVER_ENCRYPTED_EXTENSIONS, 226 SERVER_CERTIFICATE_REQUEST, 227 SERVER_CERTIFICATE, 228 SERVER_CERTIFICATE_VERIFY, 229 SERVER_FINISHED, 230 CLIENT_CERTIFICATE, 231 CLIENT_CERTIFICATE_VERIFY, 232 CLIENT_FINISHED, 233 APPLICATION_DATA, 234 }, 235 [NEGOTIATED | WITH_HRR | WITH_CCV] = { 236 CLIENT_HELLO, 237 SERVER_HELLO, 238 CLIENT_HELLO_RETRY, 239 SERVER_HELLO_RETRY, 240 SERVER_ENCRYPTED_EXTENSIONS, 241 SERVER_CERTIFICATE_REQUEST, 242 SERVER_CERTIFICATE, 243 SERVER_CERTIFICATE_VERIFY, 244 SERVER_FINISHED, 245 CLIENT_CERTIFICATE, 246 CLIENT_CERTIFICATE_VERIFY, 247 CLIENT_FINISHED, 248 APPLICATION_DATA, 249 }, 250 }; 251 252 const size_t handshake_count = sizeof(handshakes) / sizeof(handshakes[0]); 253 254 enum tls13_message_type 255 tls13_handshake_active_state(struct tls13_ctx *ctx) 256 { 257 struct tls13_handshake_stage hs = ctx->handshake_stage; 258 259 if (hs.hs_type >= handshake_count) 260 return INVALID; 261 if (hs.message_number >= TLS13_NUM_MESSAGE_TYPES) 262 return INVALID; 263 264 return handshakes[hs.hs_type][hs.message_number]; 265 } 266 267 struct tls13_handshake_action * 268 tls13_handshake_active_action(struct tls13_ctx *ctx) 269 { 270 enum tls13_message_type mt = tls13_handshake_active_state(ctx); 271 272 if (mt == INVALID) 273 return NULL; 274 275 return &state_machine[mt]; 276 } 277 278 int 279 tls13_handshake_advance_state_machine(struct tls13_ctx *ctx) 280 { 281 if (++ctx->handshake_stage.message_number >= TLS13_NUM_MESSAGE_TYPES) 282 return 0; 283 284 return 1; 285 } 286 287 int 288 tls13_handshake_msg_record(struct tls13_ctx *ctx) 289 { 290 CBS cbs; 291 292 tls13_handshake_msg_data(ctx->hs_msg, &cbs); 293 return tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs)); 294 } 295 296 int 297 tls13_handshake_perform(struct tls13_ctx *ctx) 298 { 299 struct tls13_handshake_action *action; 300 int ret; 301 302 for (;;) { 303 if ((action = tls13_handshake_active_action(ctx)) == NULL) 304 return TLS13_IO_FAILURE; 305 306 if (action->handshake_complete) { 307 ctx->handshake_completed = 1; 308 tls13_record_layer_handshake_completed(ctx->rl); 309 return TLS13_IO_SUCCESS; 310 } 311 312 if (ctx->alert) 313 return tls13_send_alert(ctx->rl, ctx->alert); 314 315 if (action->sender == ctx->mode) { 316 if ((ret = tls13_handshake_send_action(ctx, action)) <= 0) 317 return ret; 318 } else { 319 if ((ret = tls13_handshake_recv_action(ctx, action)) <= 0) 320 return ret; 321 } 322 323 if (!tls13_handshake_advance_state_machine(ctx)) 324 return TLS13_IO_FAILURE; 325 } 326 } 327 328 int 329 tls13_handshake_send_action(struct tls13_ctx *ctx, 330 struct tls13_handshake_action *action) 331 { 332 ssize_t ret; 333 CBB cbb; 334 335 /* If we have no handshake message, we need to build one. */ 336 if (ctx->hs_msg == NULL) { 337 if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL) 338 return TLS13_IO_FAILURE; 339 if (!tls13_handshake_msg_start(ctx->hs_msg, &cbb, 340 action->handshake_type)) 341 return TLS13_IO_FAILURE; 342 if (!action->send(ctx, &cbb)) 343 return TLS13_IO_FAILURE; 344 if (!tls13_handshake_msg_finish(ctx->hs_msg)) 345 return TLS13_IO_FAILURE; 346 347 if (ctx->alert) 348 return tls13_send_alert(ctx->rl, ctx->alert); 349 } 350 351 if ((ret = tls13_handshake_msg_send(ctx->hs_msg, ctx->rl)) <= 0) 352 return ret; 353 354 if (!tls13_handshake_msg_record(ctx)) 355 return TLS13_IO_FAILURE; 356 357 if (action->send_preserve_transcript_hash) { 358 if (!tls1_transcript_hash_value(ctx->ssl, 359 ctx->hs->transcript_hash, sizeof(ctx->hs->transcript_hash), 360 &ctx->hs->transcript_hash_len)) 361 return TLS13_IO_FAILURE; 362 } 363 364 if (ctx->handshake_message_sent_cb != NULL) 365 ctx->handshake_message_sent_cb(ctx); 366 367 tls13_handshake_msg_free(ctx->hs_msg); 368 ctx->hs_msg = NULL; 369 370 if (action->sent != NULL && !action->sent(ctx)) 371 return TLS13_IO_FAILURE; 372 373 return TLS13_IO_SUCCESS; 374 } 375 376 int 377 tls13_handshake_recv_action(struct tls13_ctx *ctx, 378 struct tls13_handshake_action *action) 379 { 380 uint8_t msg_type; 381 ssize_t ret; 382 CBS cbs; 383 384 if (ctx->hs_msg == NULL) { 385 if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL) 386 return TLS13_IO_FAILURE; 387 } 388 389 if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl)) <= 0) 390 return ret; 391 392 if (action->recv_preserve_transcript_hash) { 393 if (!tls1_transcript_hash_value(ctx->ssl, 394 ctx->hs->transcript_hash, sizeof(ctx->hs->transcript_hash), 395 &ctx->hs->transcript_hash_len)) 396 return TLS13_IO_FAILURE; 397 } 398 399 if (!tls13_handshake_msg_record(ctx)) 400 return TLS13_IO_FAILURE; 401 402 if (ctx->handshake_message_recv_cb != NULL) 403 ctx->handshake_message_recv_cb(ctx); 404 405 /* 406 * In TLSv1.3 there is no way to know if you're going to receive a 407 * certificate request message or not, hence we have to special case it 408 * here. The receive handler also knows how to deal with this situation. 409 */ 410 msg_type = tls13_handshake_msg_type(ctx->hs_msg); 411 if (msg_type != action->handshake_type && 412 (msg_type != TLS13_MT_CERTIFICATE || 413 action->handshake_type != TLS13_MT_CERTIFICATE_REQUEST)) 414 return tls13_send_alert(ctx->rl, SSL_AD_UNEXPECTED_MESSAGE); 415 416 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs)) 417 return TLS13_IO_FAILURE; 418 419 ret = TLS13_IO_FAILURE; 420 if (action->recv(ctx, &cbs)) { 421 if (CBS_len(&cbs) != 0) { 422 tls13_set_errorx(ctx, TLS13_ERR_TRAILING_DATA, 0, 423 "trailing data in handshake message", NULL); 424 ctx->alert = SSL_AD_DECODE_ERROR; 425 } else { 426 ret = TLS13_IO_SUCCESS; 427 } 428 } 429 430 if (ctx->alert) 431 ret = tls13_send_alert(ctx->rl, ctx->alert); 432 433 tls13_handshake_msg_free(ctx->hs_msg); 434 ctx->hs_msg = NULL; 435 436 if (ctx->ssl->method->internal->version < TLS1_3_VERSION) 437 return TLS13_IO_USE_LEGACY; 438 439 return ret; 440 } 441