1 /*	$OpenBSD: tls13_handshake.c,v 1.64 2020/07/30 16:23:17 tb Exp $	*/
2 /*
3  * Copyright (c) 2018-2019 Theo Buehler <tb@openbsd.org>
4  * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <stddef.h>
20 
21 #include "ssl_locl.h"
22 #include "tls13_handshake.h"
23 #include "tls13_internal.h"
24 
25 /* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */
26 
27 struct tls13_handshake_action {
28 	uint8_t	handshake_type;
29 	uint8_t	sender;
30 	uint8_t	handshake_complete;
31 	uint8_t	send_preserve_transcript_hash;
32 	uint8_t	recv_preserve_transcript_hash;
33 
34 	int (*send)(struct tls13_ctx *ctx, CBB *cbb);
35 	int (*sent)(struct tls13_ctx *ctx);
36 	int (*recv)(struct tls13_ctx *ctx, CBS *cbs);
37 };
38 
39 static enum tls13_message_type
40     tls13_handshake_active_state(struct tls13_ctx *ctx);
41 
42 static const struct tls13_handshake_action *
43     tls13_handshake_active_action(struct tls13_ctx *ctx);
44 static int tls13_handshake_advance_state_machine(struct tls13_ctx *ctx);
45 
46 static int tls13_handshake_send_action(struct tls13_ctx *ctx,
47     const struct tls13_handshake_action *action);
48 static int tls13_handshake_recv_action(struct tls13_ctx *ctx,
49     const struct tls13_handshake_action *action);
50 
51 static const struct tls13_handshake_action state_machine[] = {
52 	[CLIENT_HELLO] = {
53 		.handshake_type = TLS13_MT_CLIENT_HELLO,
54 		.sender = TLS13_HS_CLIENT,
55 		.send = tls13_client_hello_send,
56 		.sent = tls13_client_hello_sent,
57 		.recv = tls13_client_hello_recv,
58 	},
59 	[CLIENT_HELLO_RETRY] = {
60 		.handshake_type = TLS13_MT_CLIENT_HELLO,
61 		.sender = TLS13_HS_CLIENT,
62 		.send = tls13_client_hello_retry_send,
63 		.recv = tls13_client_hello_retry_recv,
64 	},
65 	[CLIENT_END_OF_EARLY_DATA] = {
66 		.handshake_type = TLS13_MT_END_OF_EARLY_DATA,
67 		.sender = TLS13_HS_CLIENT,
68 		.send = tls13_client_end_of_early_data_send,
69 		.recv = tls13_client_end_of_early_data_recv,
70 	},
71 	[CLIENT_CERTIFICATE] = {
72 		.handshake_type = TLS13_MT_CERTIFICATE,
73 		.sender = TLS13_HS_CLIENT,
74 		.send_preserve_transcript_hash = 1,
75 		.send = tls13_client_certificate_send,
76 		.recv = tls13_client_certificate_recv,
77 	},
78 	[CLIENT_CERTIFICATE_VERIFY] = {
79 		.handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
80 		.sender = TLS13_HS_CLIENT,
81 		.recv_preserve_transcript_hash = 1,
82 		.send = tls13_client_certificate_verify_send,
83 		.recv = tls13_client_certificate_verify_recv,
84 	},
85 	[CLIENT_FINISHED] = {
86 		.handshake_type = TLS13_MT_FINISHED,
87 		.sender = TLS13_HS_CLIENT,
88 		.recv_preserve_transcript_hash = 1,
89 		.send = tls13_client_finished_send,
90 		.sent = tls13_client_finished_sent,
91 		.recv = tls13_client_finished_recv,
92 	},
93 	[SERVER_HELLO] = {
94 		.handshake_type = TLS13_MT_SERVER_HELLO,
95 		.sender = TLS13_HS_SERVER,
96 		.send = tls13_server_hello_send,
97 		.sent = tls13_server_hello_sent,
98 		.recv = tls13_server_hello_recv,
99 	},
100 	[SERVER_HELLO_RETRY_REQUEST] = {
101 		.handshake_type = TLS13_MT_SERVER_HELLO,
102 		.sender = TLS13_HS_SERVER,
103 		.send = tls13_server_hello_retry_request_send,
104 		.recv = tls13_server_hello_retry_request_recv,
105 		.sent = tls13_server_hello_retry_request_sent,
106 	},
107 	[SERVER_ENCRYPTED_EXTENSIONS] = {
108 		.handshake_type = TLS13_MT_ENCRYPTED_EXTENSIONS,
109 		.sender = TLS13_HS_SERVER,
110 		.send = tls13_server_encrypted_extensions_send,
111 		.recv = tls13_server_encrypted_extensions_recv,
112 	},
113 	[SERVER_CERTIFICATE] = {
114 		.handshake_type = TLS13_MT_CERTIFICATE,
115 		.sender = TLS13_HS_SERVER,
116 		.send_preserve_transcript_hash = 1,
117 		.send = tls13_server_certificate_send,
118 		.recv = tls13_server_certificate_recv,
119 	},
120 	[SERVER_CERTIFICATE_REQUEST] = {
121 		.handshake_type = TLS13_MT_CERTIFICATE_REQUEST,
122 		.sender = TLS13_HS_SERVER,
123 		.send = tls13_server_certificate_request_send,
124 		.recv = tls13_server_certificate_request_recv,
125 	},
126 	[SERVER_CERTIFICATE_VERIFY] = {
127 		.handshake_type = TLS13_MT_CERTIFICATE_VERIFY,
128 		.sender = TLS13_HS_SERVER,
129 		.recv_preserve_transcript_hash = 1,
130 		.send = tls13_server_certificate_verify_send,
131 		.recv = tls13_server_certificate_verify_recv,
132 	},
133 	[SERVER_FINISHED] = {
134 		.handshake_type = TLS13_MT_FINISHED,
135 		.sender = TLS13_HS_SERVER,
136 		.recv_preserve_transcript_hash = 1,
137 		.send_preserve_transcript_hash = 1,
138 		.send = tls13_server_finished_send,
139 		.sent = tls13_server_finished_sent,
140 		.recv = tls13_server_finished_recv,
141 	},
142 	[APPLICATION_DATA] = {
143 		.handshake_complete = 1,
144 	},
145 };
146 
147 const enum tls13_message_type handshakes[][TLS13_NUM_MESSAGE_TYPES] = {
148 	[INITIAL] = {
149 		CLIENT_HELLO,
150 		SERVER_HELLO_RETRY_REQUEST,
151 		CLIENT_HELLO_RETRY,
152 		SERVER_HELLO,
153 	},
154 	[NEGOTIATED] = {
155 		CLIENT_HELLO,
156 		SERVER_HELLO_RETRY_REQUEST,
157 		CLIENT_HELLO_RETRY,
158 		SERVER_HELLO,
159 		SERVER_ENCRYPTED_EXTENSIONS,
160 		SERVER_CERTIFICATE_REQUEST,
161 		SERVER_CERTIFICATE,
162 		SERVER_CERTIFICATE_VERIFY,
163 		SERVER_FINISHED,
164 		CLIENT_CERTIFICATE,
165 		CLIENT_FINISHED,
166 		APPLICATION_DATA,
167 	},
168 	[NEGOTIATED | WITHOUT_HRR] = {
169 		CLIENT_HELLO,
170 		SERVER_HELLO,
171 		SERVER_ENCRYPTED_EXTENSIONS,
172 		SERVER_CERTIFICATE_REQUEST,
173 		SERVER_CERTIFICATE,
174 		SERVER_CERTIFICATE_VERIFY,
175 		SERVER_FINISHED,
176 		CLIENT_CERTIFICATE,
177 		CLIENT_FINISHED,
178 		APPLICATION_DATA,
179 	},
180 	[NEGOTIATED | WITHOUT_CR] = {
181 		CLIENT_HELLO,
182 		SERVER_HELLO_RETRY_REQUEST,
183 		CLIENT_HELLO_RETRY,
184 		SERVER_HELLO,
185 		SERVER_ENCRYPTED_EXTENSIONS,
186 		SERVER_CERTIFICATE,
187 		SERVER_CERTIFICATE_VERIFY,
188 		SERVER_FINISHED,
189 		CLIENT_FINISHED,
190 		APPLICATION_DATA,
191 	},
192 	[NEGOTIATED | WITHOUT_HRR | WITHOUT_CR] = {
193 		CLIENT_HELLO,
194 		SERVER_HELLO,
195 		SERVER_ENCRYPTED_EXTENSIONS,
196 		SERVER_CERTIFICATE,
197 		SERVER_CERTIFICATE_VERIFY,
198 		SERVER_FINISHED,
199 		CLIENT_FINISHED,
200 		APPLICATION_DATA,
201 	},
202 	[NEGOTIATED | WITH_PSK] = {
203 		CLIENT_HELLO,
204 		SERVER_HELLO_RETRY_REQUEST,
205 		CLIENT_HELLO_RETRY,
206 		SERVER_HELLO,
207 		SERVER_ENCRYPTED_EXTENSIONS,
208 		SERVER_FINISHED,
209 		CLIENT_FINISHED,
210 		APPLICATION_DATA,
211 	},
212 	[NEGOTIATED | WITHOUT_HRR | WITH_PSK] = {
213 		CLIENT_HELLO,
214 		SERVER_HELLO,
215 		SERVER_ENCRYPTED_EXTENSIONS,
216 		SERVER_FINISHED,
217 		CLIENT_FINISHED,
218 		APPLICATION_DATA,
219 	},
220 	[NEGOTIATED | WITH_CCV] = {
221 		CLIENT_HELLO,
222 		SERVER_HELLO_RETRY_REQUEST,
223 		CLIENT_HELLO_RETRY,
224 		SERVER_HELLO,
225 		SERVER_ENCRYPTED_EXTENSIONS,
226 		SERVER_CERTIFICATE_REQUEST,
227 		SERVER_CERTIFICATE,
228 		SERVER_CERTIFICATE_VERIFY,
229 		SERVER_FINISHED,
230 		CLIENT_CERTIFICATE,
231 		CLIENT_CERTIFICATE_VERIFY,
232 		CLIENT_FINISHED,
233 		APPLICATION_DATA,
234 	},
235 	[NEGOTIATED | WITHOUT_HRR | WITH_CCV] = {
236 		CLIENT_HELLO,
237 		SERVER_HELLO,
238 		SERVER_ENCRYPTED_EXTENSIONS,
239 		SERVER_CERTIFICATE_REQUEST,
240 		SERVER_CERTIFICATE,
241 		SERVER_CERTIFICATE_VERIFY,
242 		SERVER_FINISHED,
243 		CLIENT_CERTIFICATE,
244 		CLIENT_CERTIFICATE_VERIFY,
245 		CLIENT_FINISHED,
246 		APPLICATION_DATA,
247 	},
248 };
249 
250 const size_t handshake_count = sizeof(handshakes) / sizeof(handshakes[0]);
251 
252 #ifndef TLS13_DEBUG
253 #define DEBUGF(...)
254 #else
255 #define DEBUGF(...) fprintf(stderr, __VA_ARGS__)
256 
257 static const char *
258 tls13_handshake_mode_name(uint8_t mode)
259 {
260 	switch (mode) {
261 	case TLS13_HS_CLIENT:
262 		return "Client";
263 	case TLS13_HS_SERVER:
264 		return "Server";
265 	}
266 	return "Unknown";
267 }
268 
269 static const char *
270 tls13_handshake_message_name(uint8_t msg_type)
271 {
272 	switch (msg_type) {
273 	case TLS13_MT_CLIENT_HELLO:
274 		return "ClientHello";
275 	case TLS13_MT_SERVER_HELLO:
276 		return "ServerHello";
277 	case TLS13_MT_NEW_SESSION_TICKET:
278 		return "NewSessionTicket";
279 	case TLS13_MT_END_OF_EARLY_DATA:
280 		return "EndOfEarlyData";
281 	case TLS13_MT_ENCRYPTED_EXTENSIONS:
282 		return "EncryptedExtensions";
283 	case TLS13_MT_CERTIFICATE:
284 		return "Certificate";
285 	case TLS13_MT_CERTIFICATE_REQUEST:
286 		return "CertificateRequest";
287 	case TLS13_MT_CERTIFICATE_VERIFY:
288 		return "CertificateVerify";
289 	case TLS13_MT_FINISHED:
290 		return "Finished";
291 	case TLS13_MT_KEY_UPDATE:
292 		return "KeyUpdate";
293 	}
294 	return "Unknown";
295 }
296 #endif
297 
298 static enum tls13_message_type
299 tls13_handshake_active_state(struct tls13_ctx *ctx)
300 {
301 	struct tls13_handshake_stage hs = ctx->handshake_stage;
302 
303 	if (hs.hs_type >= handshake_count)
304 		return INVALID;
305 	if (hs.message_number >= TLS13_NUM_MESSAGE_TYPES)
306 		return INVALID;
307 
308 	return handshakes[hs.hs_type][hs.message_number];
309 }
310 
311 static const struct tls13_handshake_action *
312 tls13_handshake_active_action(struct tls13_ctx *ctx)
313 {
314 	enum tls13_message_type mt = tls13_handshake_active_state(ctx);
315 
316 	if (mt == INVALID)
317 		return NULL;
318 
319 	return &state_machine[mt];
320 }
321 
322 static int
323 tls13_handshake_advance_state_machine(struct tls13_ctx *ctx)
324 {
325 	if (++ctx->handshake_stage.message_number >= TLS13_NUM_MESSAGE_TYPES)
326 		return 0;
327 
328 	return 1;
329 }
330 
331 int
332 tls13_handshake_msg_record(struct tls13_ctx *ctx)
333 {
334 	CBS cbs;
335 
336 	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
337 	return tls1_transcript_record(ctx->ssl, CBS_data(&cbs), CBS_len(&cbs));
338 }
339 
340 int
341 tls13_handshake_perform(struct tls13_ctx *ctx)
342 {
343 	const struct tls13_handshake_action *action;
344 	int ret;
345 
346 	if (!ctx->handshake_started) {
347 		ctx->handshake_started = 1;
348 		if (ctx->info_cb != NULL)
349 			ctx->info_cb(ctx, TLS13_INFO_HANDSHAKE_STARTED, 1);
350 	}
351 
352 	for (;;) {
353 		if ((action = tls13_handshake_active_action(ctx)) == NULL)
354 			return TLS13_IO_FAILURE;
355 
356 		if (action->handshake_complete) {
357 			ctx->handshake_completed = 1;
358 			tls13_record_layer_handshake_completed(ctx->rl);
359 			if (ctx->info_cb != NULL)
360 				ctx->info_cb(ctx,
361 				    TLS13_INFO_HANDSHAKE_COMPLETED, 1);
362 			return TLS13_IO_SUCCESS;
363 		}
364 
365 		DEBUGF("%s %s %s\n", tls13_handshake_mode_name(ctx->mode),
366 		    (action->sender == ctx->mode) ? "sending" : "receiving",
367 		    tls13_handshake_message_name(action->handshake_type));
368 
369 		if (ctx->alert)
370 			return tls13_send_alert(ctx->rl, ctx->alert);
371 
372 		if (action->sender == ctx->mode)
373 			ret = tls13_handshake_send_action(ctx, action);
374 		else
375 			ret = tls13_handshake_recv_action(ctx, action);
376 
377 		if (ctx->alert)
378 			return tls13_send_alert(ctx->rl, ctx->alert);
379 
380 		if (ret <= 0) {
381 			DEBUGF("%s %s returned %d\n",
382 			    tls13_handshake_mode_name(ctx->mode),
383 			    (action->sender == ctx->mode) ? "send" : "recv",
384 			    ret);
385 			return ret;
386 		}
387 
388 		if (!tls13_handshake_advance_state_machine(ctx))
389 			return TLS13_IO_FAILURE;
390 	}
391 }
392 
393 static int
394 tls13_handshake_send_action(struct tls13_ctx *ctx,
395     const struct tls13_handshake_action *action)
396 {
397 	ssize_t ret;
398 	CBB cbb;
399 
400 	if (ctx->send_dummy_ccs) {
401 		if ((ret = tls13_send_dummy_ccs(ctx->rl)) != TLS13_IO_SUCCESS)
402 			return ret;
403 		ctx->send_dummy_ccs = 0;
404 		if (ctx->send_dummy_ccs_after) {
405 			ctx->send_dummy_ccs_after = 0;
406 			return TLS13_IO_SUCCESS;
407 		}
408 	}
409 
410 	/* If we have no handshake message, we need to build one. */
411 	if (ctx->hs_msg == NULL) {
412 		if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL)
413 			return TLS13_IO_FAILURE;
414 		if (!tls13_handshake_msg_start(ctx->hs_msg, &cbb,
415 		    action->handshake_type))
416 			return TLS13_IO_FAILURE;
417 		if (!action->send(ctx, &cbb))
418 			return TLS13_IO_FAILURE;
419 		if (!tls13_handshake_msg_finish(ctx->hs_msg))
420 			return TLS13_IO_FAILURE;
421 	}
422 
423 	if ((ret = tls13_handshake_msg_send(ctx->hs_msg, ctx->rl)) <= 0)
424 		return ret;
425 
426 	if (!tls13_handshake_msg_record(ctx))
427 		return TLS13_IO_FAILURE;
428 
429 	if (action->send_preserve_transcript_hash) {
430 		if (!tls1_transcript_hash_value(ctx->ssl,
431 		    ctx->hs->transcript_hash, sizeof(ctx->hs->transcript_hash),
432 		    &ctx->hs->transcript_hash_len))
433 			return TLS13_IO_FAILURE;
434 	}
435 
436 	if (ctx->handshake_message_sent_cb != NULL)
437 		ctx->handshake_message_sent_cb(ctx);
438 
439 	tls13_handshake_msg_free(ctx->hs_msg);
440 	ctx->hs_msg = NULL;
441 
442 	if (action->sent != NULL && !action->sent(ctx))
443 		return TLS13_IO_FAILURE;
444 
445 	if (ctx->send_dummy_ccs_after) {
446 		ctx->send_dummy_ccs = 1;
447 		if ((ret = tls13_send_dummy_ccs(ctx->rl)) != TLS13_IO_SUCCESS)
448 			return ret;
449 		ctx->send_dummy_ccs = 0;
450 		ctx->send_dummy_ccs_after = 0;
451 	}
452 
453 	return TLS13_IO_SUCCESS;
454 }
455 
456 static int
457 tls13_handshake_recv_action(struct tls13_ctx *ctx,
458     const struct tls13_handshake_action *action)
459 {
460 	uint8_t msg_type;
461 	ssize_t ret;
462 	CBS cbs;
463 
464 	if (ctx->hs_msg == NULL) {
465 		if ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL)
466 			return TLS13_IO_FAILURE;
467 	}
468 
469 	if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl)) <= 0)
470 		return ret;
471 
472 	if (action->recv_preserve_transcript_hash) {
473 		if (!tls1_transcript_hash_value(ctx->ssl,
474 		    ctx->hs->transcript_hash, sizeof(ctx->hs->transcript_hash),
475 		    &ctx->hs->transcript_hash_len))
476 			return TLS13_IO_FAILURE;
477 	}
478 
479 	if (!tls13_handshake_msg_record(ctx))
480 		return TLS13_IO_FAILURE;
481 
482 	if (ctx->handshake_message_recv_cb != NULL)
483 		ctx->handshake_message_recv_cb(ctx);
484 
485 	/*
486 	 * In TLSv1.3 there is no way to know if you're going to receive a
487 	 * certificate request message or not, hence we have to special case it
488 	 * here. The receive handler also knows how to deal with this situation.
489 	 */
490 	msg_type = tls13_handshake_msg_type(ctx->hs_msg);
491 	if (msg_type != action->handshake_type &&
492 	    (msg_type != TLS13_MT_CERTIFICATE ||
493 	     action->handshake_type != TLS13_MT_CERTIFICATE_REQUEST))
494 		return tls13_send_alert(ctx->rl, TLS13_ALERT_UNEXPECTED_MESSAGE);
495 
496 	if (!tls13_handshake_msg_content(ctx->hs_msg, &cbs))
497 		return TLS13_IO_FAILURE;
498 
499 	ret = TLS13_IO_FAILURE;
500 	if (action->recv(ctx, &cbs)) {
501 		if (CBS_len(&cbs) != 0) {
502 			tls13_set_errorx(ctx, TLS13_ERR_TRAILING_DATA, 0,
503 			    "trailing data in handshake message", NULL);
504 			ctx->alert = TLS13_ALERT_DECODE_ERROR;
505 		} else {
506 			ret = TLS13_IO_SUCCESS;
507 		}
508 	}
509 
510 	tls13_handshake_msg_free(ctx->hs_msg);
511 	ctx->hs_msg = NULL;
512 
513 	if (ctx->ssl->method->internal->version < TLS1_3_VERSION)
514 		return TLS13_IO_USE_LEGACY;
515 
516 	return ret;
517 }
518