xref: /openbsd-src/lib/libssl/tls13_handshake.c (revision ef566ea2adb5f57fdaa4b4c2b691e6f66646632f) 
1 /*	$OpenBSD: tls13_handshake.c,v 1.8 2019/01/18 06:51:29 tb Exp $	*/
2 /*
3  * Copyright (c) 2018-2019 Theo Buehler <tb@openbsd.org>
4  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <stddef.h>
20 
21 #include "tls13_handshake.h"
22 #include "tls13_internal.h"
23 
24 /* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */
25 
26 /* Record types */
27 #define TLS13_HANDSHAKE		1
28 #define TLS13_APPLICATION_DATA	2
29 
30 /* Indexing into the state machine */
31 struct tls13_handshake {
32 	uint8_t			hs_type;
33 	int			message_number;
34 };
35 
36 struct tls13_ctx {
37 	uint8_t			mode;
38 	struct tls13_handshake	handshake;
39 };
40 
41 struct tls13_handshake_action {
42 	uint8_t			record_type;
43 	uint8_t			handshake_type;
44 
45 	uint8_t			sender;
46 #define TLS13_HS_CLIENT		1
47 #define TLS13_HS_SERVER		2
48 #define TLS13_HS_BOTH		(TLS13_HS_CLIENT | TLS13_HS_SERVER)
49 
50 	int (*send)(struct tls13_ctx *ctx);
51 	int (*recv)(struct tls13_ctx *ctx);
52 };
53 
54 enum tls13_message_type tls13_handshake_active_state(struct tls13_ctx *ctx);
55 
56 int tls13_connect(struct tls13_ctx *ctx);
57 int tls13_accept(struct tls13_ctx *ctx);
58 
59 int tls13_handshake_advance_state_machine(struct tls13_ctx *ctx);
60 
61 int tls13_handshake_send_action(struct tls13_ctx *ctx,
62     struct tls13_handshake_action *action);
63 int tls13_handshake_recv_action(struct tls13_ctx *ctx,
64     struct tls13_handshake_action *action);
65 
66 struct tls13_handshake_action state_machine[] = {
67 	[CLIENT_HELLO] = {
68 		.record_type = TLS13_HANDSHAKE,
69 		.handshake_type = TLS13_MT_CLIENT_HELLO,
70 		.sender = TLS13_HS_CLIENT,
71 		.send = tls13_client_hello_send,
72 		.recv = tls13_client_hello_recv,
73 	},
74 	[CLIENT_HELLO_RETRY] = {
75 		.record_type = TLS13_HANDSHAKE,
76 		.handshake_type = TLS13_MT_CLIENT_HELLO,
77 		.sender = TLS13_HS_CLIENT,
78 		.send = tls13_client_hello_retry_send,
79 		.recv = tls13_client_hello_retry_recv,
80 	},
81 	[CLIENT_END_OF_EARLY_DATA] = {
82 		.record_type = TLS13_HANDSHAKE,
83 		.handshake_type = TLS13_MT_END_OF_EARLY_DATA,
84 		.sender = TLS13_HS_CLIENT,
85 		.send = tls13_client_end_of_early_data_send,
86 		.recv = tls13_client_end_of_early_data_recv,
87 	},
88 	[CLIENT_CERTIFICATE] = {
89 		.record_type = TLS13_HANDSHAKE,
90 		.handshake_type = TLS13_MT_CERTIFICATE,
91 		.sender = TLS13_HS_CLIENT,
92 		.send = tls13_client_certificate_send,
93 		.recv = tls13_client_certificate_recv,
94 	},
95 	[CLIENT_CERTIFICATE_VERIFY] = {
96 		.record_type = TLS13_HANDSHAKE,
97 		.handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
98 		.sender = TLS13_HS_CLIENT,
99 		.send = tls13_client_certificate_verify_send,
100 		.recv = tls13_client_certificate_verify_recv,
101 	},
102 	[CLIENT_FINISHED] = {
103 		.record_type = TLS13_HANDSHAKE,
104 		.handshake_type = TLS13_MT_FINISHED,
105 		.sender = TLS13_HS_CLIENT,
106 		.send = tls13_client_finished_send,
107 		.recv = tls13_client_finished_recv,
108 	},
109 	[CLIENT_KEY_UPDATE] = {
110 		.record_type = TLS13_HANDSHAKE,
111 		.handshake_type = TLS13_MT_KEY_UPDATE,
112 		.sender = TLS13_HS_CLIENT,
113 		.send = tls13_client_key_update_send,
114 		.recv = tls13_client_key_update_recv,
115 	},
116 	[SERVER_HELLO] = {
117 		.record_type = TLS13_HANDSHAKE,
118 		.handshake_type = TLS13_MT_SERVER_HELLO,
119 		.sender = TLS13_HS_SERVER,
120 		.send = tls13_server_hello_send,
121 		.recv = tls13_server_hello_recv,
122 	},
123 	[SERVER_ENCRYPTED_EXTENSIONS] = {
124 		.record_type = TLS13_HANDSHAKE,
125 		.handshake_type = TLS13_MT_ENCRYPTED_EXTENSIONS,
126 		.sender = TLS13_HS_SERVER,
127 		.send = tls13_server_encrypted_extensions_send,
128 		.recv = tls13_server_encrypted_extensions_recv,
129 	},
130 	[SERVER_CERTIFICATE] = {
131 		.record_type = TLS13_HANDSHAKE,
132 		.handshake_type = TLS13_MT_CERTIFICATE,
133 		.sender = TLS13_HS_SERVER,
134 		.send = tls13_server_certificate_send,
135 		.recv = tls13_server_certificate_recv,
136 	},
137 	[SERVER_CERTIFICATE_REQUEST] = {
138 		.record_type = TLS13_HANDSHAKE,
139 		.handshake_type = TLS13_MT_CERTIFICATE,
140 		.sender = TLS13_HS_SERVER,
141 		.send = tls13_server_certificate_request_send,
142 		.recv = tls13_server_certificate_request_recv,
143 	},
144 	[SERVER_CERTIFICATE_VERIFY] = {
145 		.record_type = TLS13_HANDSHAKE,
146 		.handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
147 		.sender = TLS13_HS_SERVER,
148 		.send = tls13_server_certificate_verify_send,
149 		.recv = tls13_server_certificate_verify_recv,
150 	},
151 	[SERVER_FINISHED] = {
152 		.record_type = TLS13_HANDSHAKE,
153 		.handshake_type = TLS13_MT_FINISHED,
154 		.sender = TLS13_HS_SERVER,
155 		.send = tls13_server_finished_send,
156 		.recv = tls13_server_finished_recv,
157 	},
158 	[APPLICATION_DATA] = {
159 		.record_type = TLS13_APPLICATION_DATA,
160 		.handshake_type = 0,
161 		.sender = TLS13_HS_BOTH,
162 		.send = NULL,
163 		.recv = NULL,
164 	},
165 };
166 
167 static enum tls13_message_type handshakes[][TLS13_NUM_MESSAGE_TYPES] = {
168 	[INITIAL] = {
169 		CLIENT_HELLO,
170 		SERVER_HELLO,
171 	},
172 	[NEGOTIATED] = {
173 		CLIENT_HELLO,
174 		SERVER_HELLO,
175 		SERVER_ENCRYPTED_EXTENSIONS,
176 		SERVER_CERTIFICATE_REQUEST,
177 		SERVER_CERTIFICATE,
178 		SERVER_CERTIFICATE_VERIFY,
179 		SERVER_FINISHED,
180 		CLIENT_CERTIFICATE,
181 		CLIENT_FINISHED,
182 		APPLICATION_DATA,
183 	},
184 	[NEGOTIATED | WITH_CCV] = {
185 		CLIENT_HELLO,
186 		SERVER_HELLO,
187 		SERVER_ENCRYPTED_EXTENSIONS,
188 		SERVER_CERTIFICATE_REQUEST,
189 		SERVER_CERTIFICATE,
190 		SERVER_CERTIFICATE_VERIFY,
191 		SERVER_FINISHED,
192 		CLIENT_CERTIFICATE,
193 		CLIENT_CERTIFICATE_VERIFY,
194 		CLIENT_FINISHED,
195 		APPLICATION_DATA,
196 	},
197 	[NEGOTIATED | WITHOUT_CR] = {
198 		CLIENT_HELLO,
199 		SERVER_HELLO,
200 		SERVER_ENCRYPTED_EXTENSIONS,
201 		SERVER_CERTIFICATE,
202 		SERVER_CERTIFICATE_VERIFY,
203 		SERVER_FINISHED,
204 		CLIENT_FINISHED,
205 		APPLICATION_DATA,
206 	},
207 	[NEGOTIATED | WITH_PSK] = {
208 		CLIENT_HELLO,
209 		SERVER_HELLO,
210 		SERVER_ENCRYPTED_EXTENSIONS,
211 		SERVER_FINISHED,
212 		CLIENT_FINISHED,
213 		APPLICATION_DATA,
214 	},
215 	[NEGOTIATED | WITH_HRR] = {
216 		CLIENT_HELLO,
217 		SERVER_HELLO,
218 		CLIENT_HELLO_RETRY,
219 		SERVER_ENCRYPTED_EXTENSIONS,
220 		SERVER_CERTIFICATE_REQUEST,
221 		SERVER_CERTIFICATE,
222 		SERVER_CERTIFICATE_VERIFY,
223 		SERVER_FINISHED,
224 		CLIENT_CERTIFICATE,
225 		CLIENT_FINISHED,
226 		APPLICATION_DATA,
227 	},
228 	[NEGOTIATED | WITH_HRR | WITH_CCV] = {
229 		CLIENT_HELLO,
230 		SERVER_HELLO,
231 		CLIENT_HELLO_RETRY,
232 		SERVER_ENCRYPTED_EXTENSIONS,
233 		SERVER_CERTIFICATE_REQUEST,
234 		SERVER_CERTIFICATE,
235 		SERVER_CERTIFICATE_VERIFY,
236 		SERVER_FINISHED,
237 		CLIENT_CERTIFICATE,
238 		CLIENT_CERTIFICATE_VERIFY,
239 		CLIENT_FINISHED,
240 		APPLICATION_DATA,
241 	},
242 	[NEGOTIATED | WITH_HRR | WITHOUT_CR] = {
243 		CLIENT_HELLO,
244 		SERVER_HELLO,
245 		CLIENT_HELLO_RETRY,
246 		SERVER_ENCRYPTED_EXTENSIONS,
247 		SERVER_CERTIFICATE,
248 		SERVER_CERTIFICATE_VERIFY,
249 		SERVER_FINISHED,
250 		CLIENT_FINISHED,
251 		APPLICATION_DATA,
252 	},
253 	[NEGOTIATED | WITH_HRR | WITH_PSK] = {
254 		CLIENT_HELLO,
255 		SERVER_HELLO,
256 		CLIENT_HELLO_RETRY,
257 		SERVER_ENCRYPTED_EXTENSIONS,
258 		SERVER_FINISHED,
259 		CLIENT_FINISHED,
260 		APPLICATION_DATA,
261 	},
262 };
263 
264 enum tls13_message_type
265 tls13_handshake_active_state(struct tls13_ctx *ctx)
266 {
267 	struct tls13_handshake hs = ctx->handshake;
268 	return handshakes[hs.hs_type][hs.message_number];
269 }
270 
271 struct tls13_handshake_action *
272 tls13_handshake_active_action(struct tls13_ctx *ctx)
273 {
274 	enum tls13_message_type mt = tls13_handshake_active_state(ctx);
275 	return &state_machine[mt];
276 }
277 
278 int
279 tls13_connect(struct tls13_ctx *ctx)
280 {
281 	struct tls13_handshake_action *action;
282 
283 	ctx->mode = TLS13_HS_CLIENT;
284 
285 	for (;;) {
286 		if ((action = tls13_handshake_active_action(ctx)) == NULL)
287 			return -1;
288 
289 		if (action->sender == TLS13_HS_BOTH)
290 			return 1;
291 
292 		if (action->sender == TLS13_HS_CLIENT) {
293 			if (!tls13_handshake_send_action(ctx, action))
294 				return 0;
295 		} else {
296 			if (!tls13_handshake_recv_action(ctx, action))
297 				return 0;
298 		}
299 
300 		if (!tls13_handshake_advance_state_machine(ctx))
301 			return 0;
302 	}
303 }
304 
305 int
306 tls13_accept(struct tls13_ctx *ctx)
307 {
308 	struct tls13_handshake_action *action;
309 
310 	ctx->mode = TLS13_HS_SERVER;
311 
312 	for (;;) {
313 		if ((action = tls13_handshake_active_action(ctx)) == NULL)
314 			return -1;
315 
316 		if (action->sender == TLS13_HS_BOTH)
317 			return 1;
318 
319 		if (action->sender == TLS13_HS_SERVER) {
320 			if (!tls13_handshake_send_action(ctx, action))
321 				return 0;
322 		} else {
323 			if (!tls13_handshake_recv_action(ctx, action))
324 				return 0;
325 		}
326 
327 		if (!tls13_handshake_advance_state_machine(ctx))
328 			return 0;
329 	}
330 
331 	return 1;
332 }
333 
334 int
335 tls13_handshake_advance_state_machine(struct tls13_ctx *ctx)
336 {
337 	ctx->handshake.message_number++;
338 	return 1;
339 }
340 
341 int
342 tls13_handshake_send_action(struct tls13_ctx *ctx,
343     struct tls13_handshake_action *action)
344 {
345 	return action->send(ctx);
346 }
347 
348 int
349 tls13_handshake_recv_action(struct tls13_ctx *ctx,
350     struct tls13_handshake_action *action)
351 {
352 	return action->recv(ctx);
353 }
354 
355 int
356 tls13_client_hello_send(struct tls13_ctx *ctx)
357 {
358 	return 1;
359 }
360 
361 int
362 tls13_client_hello_recv(struct tls13_ctx *ctx)
363 {
364 	return 1;
365 }
366 
367 int
368 tls13_client_hello_retry_send(struct tls13_ctx *ctx)
369 {
370 	return 1;
371 }
372 
373 int
374 tls13_client_hello_retry_recv(struct tls13_ctx *ctx)
375 {
376 	return 1;
377 }
378 
379 
380 int
381 tls13_client_end_of_early_data_send(struct tls13_ctx *ctx)
382 {
383 	return 1;
384 }
385 
386 int
387 tls13_client_end_of_early_data_recv(struct tls13_ctx *ctx)
388 {
389 	return 1;
390 }
391 
392 int
393 tls13_client_certificate_send(struct tls13_ctx *ctx)
394 {
395 	return 1;
396 }
397 
398 int
399 tls13_client_certificate_recv(struct tls13_ctx *ctx)
400 {
401 	return 1;
402 }
403 
404 int
405 tls13_client_certificate_verify_send(struct tls13_ctx *ctx)
406 {
407 	return 1;
408 }
409 
410 int
411 tls13_client_certificate_verify_recv(struct tls13_ctx *ctx)
412 {
413 	return 1;
414 }
415 
416 int
417 tls13_client_finished_recv(struct tls13_ctx *ctx)
418 {
419 	return 1;
420 }
421 
422 int
423 tls13_client_finished_send(struct tls13_ctx *ctx)
424 {
425 	return 1;
426 }
427 
428 int
429 tls13_client_key_update_send(struct tls13_ctx *ctx)
430 {
431 	return 1;
432 }
433 
434 int
435 tls13_client_key_update_recv(struct tls13_ctx *ctx)
436 {
437 	return 1;
438 }
439 
440 int
441 tls13_server_hello_recv(struct tls13_ctx *ctx)
442 {
443 	ctx->handshake.hs_type |= NEGOTIATED;
444 
445 	return 1;
446 }
447 
448 int
449 tls13_server_hello_send(struct tls13_ctx *ctx)
450 {
451 	ctx->handshake.hs_type |= NEGOTIATED;
452 
453 	return 1;
454 }
455 
456 int
457 tls13_server_encrypted_extensions_recv(struct tls13_ctx *ctx)
458 {
459 	return 1;
460 }
461 
462 int
463 tls13_server_encrypted_extensions_send(struct tls13_ctx *ctx)
464 {
465 	return 1;
466 }
467 
468 int
469 tls13_server_certificate_recv(struct tls13_ctx *ctx)
470 {
471 	return 1;
472 }
473 
474 int
475 tls13_server_certificate_send(struct tls13_ctx *ctx)
476 {
477 	return 1;
478 }
479 
480 int
481 tls13_server_certificate_request_recv(struct tls13_ctx *ctx)
482 {
483 	return 1;
484 }
485 
486 int
487 tls13_server_certificate_request_send(struct tls13_ctx *ctx)
488 {
489 	return 1;
490 }
491 
492 int
493 tls13_server_certificate_verify_send(struct tls13_ctx *ctx)
494 {
495 	return 1;
496 }
497 
498 int
499 tls13_server_certificate_verify_recv(struct tls13_ctx *ctx)
500 {
501 	return 1;
502 }
503 
504 int
505 tls13_server_finished_recv(struct tls13_ctx *ctx)
506 {
507 	return 1;
508 }
509 
510 int
511 tls13_server_finished_send(struct tls13_ctx *ctx)
512 {
513 	return 1;
514 }
515