1 /* $OpenBSD: tls13_handshake.c,v 1.65 2021/03/21 18:36:34 jsing Exp $ */ 2 /* 3 * Copyright (c) 2018-2019 Theo Buehler <tb@openbsd.org> 4 * Copyright (c) 2019 Joel Sing <jsing@openbsd.org> 5 * 6 * Permission to use, copy, modify, and distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #include <stddef.h> 20 21 #include "ssl_locl.h" 22 #include "tls13_handshake.h" 23 #include "tls13_internal.h" 24 25 /* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */ 26 27 struct tls13_handshake_action { 28 uint8_t handshake_type; 29 uint8_t sender; 30 uint8_t handshake_complete; 31 uint8_t send_preserve_transcript_hash; 32 uint8_t recv_preserve_transcript_hash; 33 34 int (*send)(struct tls13_ctx *ctx, CBB *cbb); 35 int (*sent)(struct tls13_ctx *ctx); 36 int (*recv)(struct tls13_ctx *ctx, CBS *cbs); 37 }; 38 39 static enum tls13_message_type 40 tls13_handshake_active_state(struct tls13_ctx *ctx); 41 42 static const struct tls13_handshake_action * 43 tls13_handshake_active_action(struct tls13_ctx *ctx); 44 static int tls13_handshake_advance_state_machine(struct tls13_ctx *ctx); 45 46 static int tls13_handshake_send_action(struct tls13_ctx *ctx, 47 const struct tls13_handshake_action *action); 48 static int tls13_handshake_recv_action(struct tls13_ctx *ctx, 49 const struct tls13_handshake_action *action); 50 51 static const struct tls13_handshake_action state_machine[] = { 52 [CLIENT_HELLO] = { 53 .handshake_type = TLS13_MT_CLIENT_HELLO, 54 .sender = TLS13_HS_CLIENT, 55 .send = tls13_client_hello_send, 56 .sent = tls13_client_hello_sent, 57 .recv = tls13_client_hello_recv, 58 }, 59 [CLIENT_HELLO_RETRY] = { 60 .handshake_type = TLS13_MT_CLIENT_HELLO, 61 .sender = TLS13_HS_CLIENT, 62 .send = tls13_client_hello_retry_send, 63 .recv = tls13_client_hello_retry_recv, 64 }, 65 [CLIENT_END_OF_EARLY_DATA] = { 66 .handshake_type = TLS13_MT_END_OF_EARLY_DATA, 67 .sender = TLS13_HS_CLIENT, 68 .send = tls13_client_end_of_early_data_send, 69 .recv = tls13_client_end_of_early_data_recv, 70 }, 71 [CLIENT_CERTIFICATE] = { 72 .handshake_type = TLS13_MT_CERTIFICATE, 73 .sender = TLS13_HS_CLIENT, 74 .send_preserve_transcript_hash = 1, 75 .send = tls13_client_certificate_send, 76 .recv = tls13_client_certificate_recv, 77 }, 78 [CLIENT_CERTIFICATE_VERIFY] = { 79 .handshake_type = TLS13_MT_CERTIFICATE_VERIFY, 80 .sender = TLS13_HS_CLIENT, 81 .recv_preserve_transcript_hash = 1, 82 .send = tls13_client_certificate_verify_send, 83 .recv = tls13_client_certificate_verify_recv, 84 }, 85 [CLIENT_FINISHED] = { 86 .handshake_type = TLS13_MT_FINISHED, 87 .sender = TLS13_HS_CLIENT, 88 .recv_preserve_transcript_hash = 1, 89 .send = tls13_client_finished_send, 90 .sent = tls13_client_finished_sent, 91 .recv = tls13_client_finished_recv, 92 }, 93 [SERVER_HELLO] = { 94 .handshake_type = TLS13_MT_SERVER_HELLO, 95 .sender = TLS13_HS_SERVER, 96 .send = tls13_server_hello_send, 97 .sent = tls13_server_hello_sent, 98 .recv = tls13_server_hello_recv, 99 }, 100 [SERVER_HELLO_RETRY_REQUEST] = { 101 .handshake_type = TLS13_MT_SERVER_HELLO, 102 .sender = TLS13_HS_SERVER, 103 .send = tls13_server_hello_retry_request_send, 104 .recv = tls13_server_hello_retry_request_recv, 105 .sent = tls13_server_hello_retry_request_sent, 106 }, 107 [SERVER_ENCRYPTED_EXTENSIONS] = { 108 .handshake_type = TLS13_MT_ENCRYPTED_EXTENSIONS, 109 .sender = TLS13_HS_SERVER, 110 .send = tls13_server_encrypted_extensions_send, 111 .recv = tls13_server_encrypted_extensions_recv, 112 }, 113 [SERVER_CERTIFICATE] = { 114 .handshake_type = TLS13_MT_CERTIFICATE, 115 .sender = TLS13_HS_SERVER, 116 .send_preserve_transcript_hash = 1, 117 .send = tls13_server_certificate_send, 118 .recv = tls13_server_certificate_recv, 119 }, 120 [SERVER_CERTIFICATE_REQUEST] = { 121 .handshake_type = TLS13_MT_CERTIFICATE_REQUEST, 122 .sender = TLS13_HS_SERVER, 123 .send = tls13_server_certificate_request_send, 124 .recv = tls13_server_certificate_request_recv, 125 }, 126 [SERVER_CERTIFICATE_VERIFY] = { 127 .handshake_type = TLS13_MT_CERTIFICATE_VERIFY, 128 .sender = TLS13_HS_SERVER, 129 .recv_preserve_transcript_hash = 1, 130 .send = tls13_server_certificate_verify_send, 131 .recv = tls13_server_certificate_verify_recv, 132 }, 133 [SERVER_FINISHED] = { 134 .handshake_type = TLS13_MT_FINISHED, 135 .sender = TLS13_HS_SERVER, 136 .recv_preserve_transcript_hash = 1, 137 .send_preserve_transcript_hash = 1, 138 .send = tls13_server_finished_send, 139 .sent = tls13_server_finished_sent, 140 .recv = tls13_server_finished_recv, 141 }, 142 [APPLICATION_DATA] = { 143 .handshake_complete = 1, 144 }, 145 }; 146 147 const enum tls13_message_type handshakes[][TLS13_NUM_MESSAGE_TYPES] = { 148 [INITIAL] = { 149 CLIENT_HELLO, 150 SERVER_HELLO_RETRY_REQUEST, 151 CLIENT_HELLO_RETRY, 152 SERVER_HELLO, 153 }, 154 [NEGOTIATED] = { 155 CLIENT_HELLO, 156 SERVER_HELLO_RETRY_REQUEST, 157 CLIENT_HELLO_RETRY, 158 SERVER_HELLO, 159 SERVER_ENCRYPTED_EXTENSIONS, 160 SERVER_CERTIFICATE_REQUEST, 161 SERVER_CERTIFICATE, 162 SERVER_CERTIFICATE_VERIFY, 163 SERVER_FINISHED, 164 CLIENT_CERTIFICATE, 165 CLIENT_FINISHED, 166 APPLICATION_DATA, 167 }, 168 [NEGOTIATED | WITHOUT_HRR] = { 169 CLIENT_HELLO, 170 SERVER_HELLO, 171 SERVER_ENCRYPTED_EXTENSIONS, 172 SERVER_CERTIFICATE_REQUEST, 173 SERVER_CERTIFICATE, 174 SERVER_CERTIFICATE_VERIFY, 175 SERVER_FINISHED, 176 CLIENT_CERTIFICATE, 177 CLIENT_FINISHED, 178 APPLICATION_DATA, 179 }, 180 [NEGOTIATED | WITHOUT_CR] = { 181 CLIENT_HELLO, 182 SERVER_HELLO_RETRY_REQUEST, 183 CLIENT_HELLO_RETRY, 184 SERVER_HELLO, 185 SERVER_ENCRYPTED_EXTENSIONS, 186 SERVER_CERTIFICATE, 187 SERVER_CERTIFICATE_VERIFY, 188 SERVER_FINISHED, 189 CLIENT_FINISHED, 190 APPLICATION_DATA, 191 }, 192 [NEGOTIATED | WITHOUT_HRR | WITHOUT_CR] = { 193 CLIENT_HELLO, 194 SERVER_HELLO, 195 SERVER_ENCRYPTED_EXTENSIONS, 196 SERVER_CERTIFICATE, 197 SERVER_CERTIFICATE_VERIFY, 198 SERVER_FINISHED, 199 CLIENT_FINISHED, 200 APPLICATION_DATA, 201 }, 202 [NEGOTIATED | WITH_PSK] = { 203 CLIENT_HELLO, 204 SERVER_HELLO_RETRY_REQUEST, 205 CLIENT_HELLO_RETRY, 206 SERVER_HELLO, 207 SERVER_ENCRYPTED_EXTENSIONS, 208 SERVER_FINISHED, 209 CLIENT_FINISHED, 210 APPLICATION_DATA, 211 }, 212 [NEGOTIATED | WITHOUT_HRR | WITH_PSK] = { 213 CLIENT_HELLO, 214 SERVER_HELLO, 215 SERVER_ENCRYPTED_EXTENSIONS, 216 SERVER_FINISHED, 217 CLIENT_FINISHED, 218 APPLICATION_DATA, 219 }, 220 [NEGOTIATED | WITH_CCV] = { 221 CLIENT_HELLO, 222 SERVER_HELLO_RETRY_REQUEST, 223 CLIENT_HELLO_RETRY, 224 SERVER_HELLO, 225 SERVER_ENCRYPTED_EXTENSIONS, 226 SERVER_CERTIFICATE_REQUEST, 227 SERVER_CERTIFICATE, 228 SERVER_CERTIFICATE_VERIFY, 229 SERVER_FINISHED, 230 CLIENT_CERTIFICATE, 231 CLIENT_CERTIFICATE_VERIFY, 232 CLIENT_FINISHED, 233 APPLICATION_DATA, 234 }, 235 [NEGOTIATED | WITHOUT_HRR | WITH_CCV] = { 236 CLIENT_HELLO, 237 SERVER_HELLO, 238 SERVER_ENCRYPTED_EXTENSIONS, 239 SERVER_CERTIFICATE_REQUEST, 240 SERVER_CERTIFICATE, 241 SERVER_CERTIFICATE_VERIFY, 242 SERVER_FINISHED, 243 CLIENT_CERTIFICATE, 244 CLIENT_CERTIFICATE_VERIFY, 245 CLIENT_FINISHED, 246 APPLICATION_DATA, 247 }, 248 }; 249 250 const size_t handshake_count = sizeof(handshakes) / sizeof(handshakes[0]); 251 252 #ifndef TLS13_DEBUG 253 #define DEBUGF(...) 254 #else 255 #define DEBUGF(...) fprintf(stderr, __VA_ARGS__) 256 257 static const char * 258 tls13_handshake_mode_name(uint8_t mode) 259 { 260 switch (mode) { 261 case TLS13_HS_CLIENT: 262 return "Client"; 263 case TLS13_HS_SERVER: 264 return "Server"; 265 } 266 return "Unknown"; 267 } 268 269 static const char * 270 tls13_handshake_message_name(uint8_t msg_type) 271 { 272 switch (msg_type) { 273 case TLS13_MT_CLIENT_HELLO: 274 return "ClientHello"; 275 case TLS13_MT_SERVER_HELLO: 276 return "ServerHello"; 277 case TLS13_MT_NEW_SESSION_TICKET: 278 return "NewSessionTicket"; 279 case TLS13_MT_END_OF_EARLY_DATA: 280 return "EndOfEarlyData"; 281 case TLS13_MT_ENCRYPTED_EXTENSIONS: 282 return "EncryptedExtensions"; 283 case TLS13_MT_CERTIFICATE: 284 return "Certificate"; 285 case TLS13_MT_CERTIFICATE_REQUEST: 286 return "CertificateRequest"; 287 case TLS13_MT_CERTIFICATE_VERIFY: 288 return "CertificateVerify"; 289 case TLS13_MT_FINISHED: 290 return "Finished"; 291 case TLS13_MT_KEY_UPDATE: 292 return "KeyUpdate"; 293 } 294 return "Unknown"; 295 } 296 #endif 297 298 static enum tls13_message_type 299 tls13_handshake_active_state(struct tls13_ctx *ctx) 300 { 301 struct tls13_handshake_stage hs = ctx->handshake_stage; 302 303 if (hs.hs_type >= handshake_count) 304 return INVALID; 305 if (hs.message_number >= TLS13_NUM_MESSAGE_TYPES) 306 return INVALID; 307 308 return handshakes[hs.hs_type][hs.message_number]; 309 } 310 311 static const struct tls13_handshake_action * 312 tls13_handshake_active_action(struct tls13_ctx *ctx) 313 { 314 enum tls13_message_type mt = tls13_handshake_active_state(ctx); 315 316 if (mt == INVALID) 317 return NULL; 318 319 return &state_machine[mt]; 320 } 321 322 static int 323 tls13_handshake_advance_state_machine(struct tls13_ctx *ctx) 324 { 325 if (++ctx->handshake_stage.message_number >= TLS13_NUM_MESSAGE_TYPES) 326 return 0; 327 328 return 1; 329 } 330 331 int 332 tls13_handshake_msg_record(struct tls13_ctx *ctx) 333 { 334 CBS cbs; 335 336 tls13_handshake_msg_data(ctx->hs_msg, &cbs); 337 return tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs)); 338 } 339 340 int 341 tls13_handshake_perform(struct tls13_ctx *ctx) 342 { 343 const struct tls13_handshake_action *action; 344 int ret; 345 346 if (!ctx->handshake_started) { 347 ctx->handshake_started = 1; 348 if (ctx->info_cb != NULL) 349 ctx->info_cb(ctx, TLS13_INFO_HANDSHAKE_STARTED, 1); 350 } 351 352 for (;;) { 353 if ((action = tls13_handshake_active_action(ctx)) == NULL) 354 return TLS13_IO_FAILURE; 355 356 if (action->handshake_complete) { 357 ctx->handshake_completed = 1; 358 tls13_record_layer_handshake_completed(ctx->rl); 359 if (ctx->info_cb != NULL) 360 ctx->info_cb(ctx, 361 TLS13_INFO_HANDSHAKE_COMPLETED, 1); 362 return TLS13_IO_SUCCESS; 363 } 364 365 DEBUGF("%s %s %s\n", tls13_handshake_mode_name(ctx->mode), 366 (action->sender == ctx->mode) ? "sending" : "receiving", 367 tls13_handshake_message_name(action->handshake_type)); 368 369 if (ctx->alert) 370 return tls13_send_alert(ctx->rl, ctx->alert); 371 372 if (action->sender == ctx->mode) 373 ret = tls13_handshake_send_action(ctx, action); 374 else 375 ret = tls13_handshake_recv_action(ctx, action); 376 377 if (ctx->alert) 378 return tls13_send_alert(ctx->rl, ctx->alert); 379 380 if (ret <= 0) { 381 DEBUGF("%s %s returned %d\n", 382 tls13_handshake_mode_name(ctx->mode), 383 (action->sender == ctx->mode) ? "send" : "recv", 384 ret); 385 return ret; 386 } 387 388 if (!tls13_handshake_advance_state_machine(ctx)) 389 return TLS13_IO_FAILURE; 390 } 391 } 392 393 static int 394 tls13_handshake_send_action(struct tls13_ctx *ctx, 395 const struct tls13_handshake_action *action) 396 { 397 ssize_t ret; 398 CBB cbb; 399 400 if (ctx->send_dummy_ccs) { 401 if ((ret = tls13_send_dummy_ccs(ctx->rl)) != TLS13_IO_SUCCESS) 402 return ret; 403 ctx->send_dummy_ccs = 0; 404 if (ctx->send_dummy_ccs_after) { 405 ctx->send_dummy_ccs_after = 0; 406 return TLS13_IO_SUCCESS; 407 } 408 } 409 410 /* If we have no handshake message, we need to build one. */ 411 if (ctx->hs_msg == NULL) { 412 if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL) 413 return TLS13_IO_FAILURE; 414 if (!tls13_handshake_msg_start(ctx->hs_msg, &cbb, 415 action->handshake_type)) 416 return TLS13_IO_FAILURE; 417 if (!action->send(ctx, &cbb)) 418 return TLS13_IO_FAILURE; 419 if (!tls13_handshake_msg_finish(ctx->hs_msg)) 420 return TLS13_IO_FAILURE; 421 } 422 423 if ((ret = tls13_handshake_msg_send(ctx->hs_msg, ctx->rl)) <= 0) 424 return ret; 425 426 if (!tls13_handshake_msg_record(ctx)) 427 return TLS13_IO_FAILURE; 428 429 if (action->send_preserve_transcript_hash) { 430 if (!tls1_transcript_hash_value(ctx->ssl, 431 ctx->hs->tls13.transcript_hash, 432 sizeof(ctx->hs->tls13.transcript_hash), 433 &ctx->hs->tls13.transcript_hash_len)) 434 return TLS13_IO_FAILURE; 435 } 436 437 if (ctx->handshake_message_sent_cb != NULL) 438 ctx->handshake_message_sent_cb(ctx); 439 440 tls13_handshake_msg_free(ctx->hs_msg); 441 ctx->hs_msg = NULL; 442 443 if (action->sent != NULL && !action->sent(ctx)) 444 return TLS13_IO_FAILURE; 445 446 if (ctx->send_dummy_ccs_after) { 447 ctx->send_dummy_ccs = 1; 448 if ((ret = tls13_send_dummy_ccs(ctx->rl)) != TLS13_IO_SUCCESS) 449 return ret; 450 ctx->send_dummy_ccs = 0; 451 ctx->send_dummy_ccs_after = 0; 452 } 453 454 return TLS13_IO_SUCCESS; 455 } 456 457 static int 458 tls13_handshake_recv_action(struct tls13_ctx *ctx, 459 const struct tls13_handshake_action *action) 460 { 461 uint8_t msg_type; 462 ssize_t ret; 463 CBS cbs; 464 465 if (ctx->hs_msg == NULL) { 466 if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL) 467 return TLS13_IO_FAILURE; 468 } 469 470 if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl)) <= 0) 471 return ret; 472 473 if (action->recv_preserve_transcript_hash) { 474 if (!tls1_transcript_hash_value(ctx->ssl, 475 ctx->hs->tls13.transcript_hash, 476 sizeof(ctx->hs->tls13.transcript_hash), 477 &ctx->hs->tls13.transcript_hash_len)) 478 return TLS13_IO_FAILURE; 479 } 480 481 if (!tls13_handshake_msg_record(ctx)) 482 return TLS13_IO_FAILURE; 483 484 if (ctx->handshake_message_recv_cb != NULL) 485 ctx->handshake_message_recv_cb(ctx); 486 487 /* 488 * In TLSv1.3 there is no way to know if you're going to receive a 489 * certificate request message or not, hence we have to special case it 490 * here. The receive handler also knows how to deal with this situation. 491 */ 492 msg_type = tls13_handshake_msg_type(ctx->hs_msg); 493 if (msg_type != action->handshake_type && 494 (msg_type != TLS13_MT_CERTIFICATE || 495 action->handshake_type != TLS13_MT_CERTIFICATE_REQUEST)) 496 return tls13_send_alert(ctx->rl, TLS13_ALERT_UNEXPECTED_MESSAGE); 497 498 if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs)) 499 return TLS13_IO_FAILURE; 500 501 ret = TLS13_IO_FAILURE; 502 if (action->recv(ctx, &cbs)) { 503 if (CBS_len(&cbs) != 0) { 504 tls13_set_errorx(ctx, TLS13_ERR_TRAILING_DATA, 0, 505 "trailing data in handshake message", NULL); 506 ctx->alert = TLS13_ALERT_DECODE_ERROR; 507 } else { 508 ret = TLS13_IO_SUCCESS; 509 } 510 } 511 512 tls13_handshake_msg_free(ctx->hs_msg); 513 ctx->hs_msg = NULL; 514 515 if (ctx->ssl->method->internal->version < TLS1_3_VERSION) 516 return TLS13_IO_USE_LEGACY; 517 518 return ret; 519 } 520