1 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ 2 /* 3 * This file is PRIVATE to SSL. 4 * 5 * This Source Code Form is subject to the terms of the Mozilla Public 6 * License, v. 2.0. If a copy of the MPL was not distributed with this 7 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 8 9 #ifndef __tls13ech_h_ 10 #define __tls13ech_h_ 11 12 #include "pk11hpke.h" 13 14 /* draft-09, supporting shared-mode and split-mode as a backend server only. 15 * Notes on the implementation status: 16 * - Padding (https://tools.ietf.org/html/draft-ietf-tls-esni-08#section-6.2), 17 * is not implemented (see bug 1677181). 18 * - When multiple ECHConfigs are provided by the server, the first compatible 19 * config is selected by the client. Ciphersuite choices are limited and only 20 * the AEAD may vary (AES-128-GCM or ChaCha20Poly1305). 21 * - Some of the buffering (construction/compression/decompression) could likely 22 * be optimized, but the spec is still evolving so that work is deferred. 23 */ 24 #define TLS13_ECH_VERSION 0xfe0d 25 #define TLS13_ECH_SIGNAL_LEN 8 26 #define TLS13_ECH_AEAD_TAG_LEN 16 27 #define TLS13_ECH_GREASE_SNI_LEN 100 28 29 static const char kHpkeInfoEch[] = "tls ech"; 30 static const char hHkdfInfoEchConfigID[] = "tls ech config id"; 31 static const char kHkdfInfoEchConfirm[] = "ech accept confirmation"; 32 static const char kHkdfInfoEchHrrConfirm[] = "hrr ech accept confirmation"; 33 34 typedef enum { 35 ech_xtn_type_outer = 0, 36 ech_xtn_type_inner = 1, 37 } EchXtnType; 38 39 struct sslEchConfigContentsStr { 40 PRUint8 configId; 41 HpkeKemId kemId; 42 SECItem publicKey; /* NULL on server. Use the keypair in sslEchConfig instead. */ 43 HpkeKdfId kdfId; 44 HpkeAeadId aeadId; 45 SECItem suites; /* One or more HpkeCipherSuites. The selected s 46 * suite is placed in kdfId and aeadId. */ 47 PRUint8 maxNameLen; 48 char *publicName; 49 /* No supported extensions. */ 50 }; 51 52 /* ECH Information needed by a server to process a second CH after a 53 * HelloRetryRequest is sent. This data is stored in the cookie. 54 */ 55 struct sslEchCookieDataStr { 56 PRBool previouslyOffered; 57 PRUint8 configId; 58 HpkeKdfId kdfId; 59 HpkeAeadId aeadId; 60 HpkeContext *hpkeCtx; 61 sslBuffer signal; 62 }; 63 64 struct sslEchConfigStr { 65 PRCList link; 66 SECItem raw; 67 PRUint16 version; 68 sslEchConfigContents contents; 69 }; 70 71 struct sslEchXtnStateStr { 72 SECItem innerCh; /* Server: ClientECH.payload */ 73 SECItem senderPubKey; /* Server: ClientECH.enc */ 74 PRUint8 configId; /* Server: ClientECH.config_id */ 75 HpkeKdfId kdfId; /* Server: ClientECH.cipher_suite.kdf */ 76 HpkeAeadId aeadId; /* Server: ClientECH.cipher_suite.aead */ 77 SECItem retryConfigs; /* Client: ServerECH.retry_configs*/ 78 PRBool retryConfigsValid; /* Client: Extraction of retry_configss is allowed. 79 * This is set once the handshake completes (having 80 * verified to the ECHConfig public name). */ 81 PRUint8 *hrrConfirmation; /* Client/Server: HRR Confirmation Location */ 82 PRBool receivedInnerXtn; /* Server: Handled ECH Xtn with Inner Enum */ 83 PRUint8 *payloadStart; /* Server: Start of ECH Payload*/ 84 }; 85 86 SECStatus SSLExp_EncodeEchConfigId(PRUint8 configId, const char *publicName, unsigned int maxNameLen, 87 HpkeKemId kemId, const SECKEYPublicKey *pubKey, 88 const HpkeSymmetricSuite *hpkeSuites, unsigned int hpkeSuiteCount, 89 PRUint8 *out, unsigned int *outlen, unsigned int maxlen); 90 SECStatus SSLExp_GetEchRetryConfigs(PRFileDesc *fd, SECItem *retryConfigs); 91 SECStatus SSLExp_SetClientEchConfigs(PRFileDesc *fd, const PRUint8 *echConfigs, 92 unsigned int echConfigsLen); 93 SECStatus SSLExp_SetServerEchConfigs(PRFileDesc *fd, 94 const SECKEYPublicKey *pubKey, const SECKEYPrivateKey *privKey, 95 const PRUint8 *echConfigs, unsigned int numEchConfigs); 96 SECStatus SSLExp_RemoveEchConfigs(PRFileDesc *fd); 97 98 SECStatus tls13_ClientSetupEch(sslSocket *ss, sslClientHelloType type); 99 SECStatus tls13_ConstructClientHelloWithEch(sslSocket *ss, const sslSessionID *sid, 100 PRBool freshSid, sslBuffer *chOuterBuf, 101 sslBuffer *chInnerXtnsBuf); 102 SECStatus tls13_CopyEchConfigs(PRCList *oconfigs, PRCList *configs); 103 SECStatus tls13_DecodeEchConfigs(const SECItem *data, PRCList *configs); 104 void tls13_DestroyEchConfigs(PRCList *list); 105 void tls13_DestroyEchXtnState(sslEchXtnState *state); 106 SECStatus tls13_GetMatchingEchConfig(const sslSocket *ss, HpkeKdfId kdf, HpkeAeadId aead, 107 const SECItem *configId, sslEchConfig **cfg); 108 SECStatus tls13_MaybeHandleEch(sslSocket *ss, const PRUint8 *msg, PRUint32 msgLen, SECItem *sidBytes, 109 SECItem *comps, SECItem *cookieBytes, SECItem *suites, SECItem **echInner); 110 SECStatus tls13_MaybeHandleEchSignal(sslSocket *ss, const PRUint8 *savedMsg, PRUint32 savedLength, PRBool isHrr); 111 SECStatus tls13_MaybeAcceptEch(sslSocket *ss, const SECItem *sidBytes, const PRUint8 *chOuter, 112 unsigned int chOuterLen, SECItem **chInner); 113 SECStatus tls13_MaybeGreaseEch(sslSocket *ss, const sslBuffer *preamble, sslBuffer *buf); 114 SECStatus tls13_WriteServerEchSignal(sslSocket *ss, PRUint8 *sh, unsigned int shLen); 115 SECStatus tls13_WriteServerEchHrrSignal(sslSocket *ss, PRUint8 *sh, unsigned int shLen); 116 SECStatus tls13_DeriveEchSecret(const sslSocket *ss, PK11SymKey **output); 117 SECStatus tls13_ComputeEchSignal(sslSocket *ss, PRBool isHrr, const PRUint8 *sh, unsigned int shLen, PRUint8 *out); 118 119 PRBool tls13_IsIp(const PRUint8 *str, unsigned int len); 120 PRBool tls13_IsLDH(const PRUint8 *str, unsigned int len); 121 122 #endif 123