summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/lib/libssl/tls13_handshake.c132
-rw-r--r--src/lib/libssl/tls13_handshake.h52
-rw-r--r--src/lib/libssl/tls13_internal.h8
3 files changed, 93 insertions, 99 deletions
diff --git a/src/lib/libssl/tls13_handshake.c b/src/lib/libssl/tls13_handshake.c
index 930e6e4be2..77e59f1930 100644
--- a/src/lib/libssl/tls13_handshake.c
+++ b/src/lib/libssl/tls13_handshake.c
@@ -1,6 +1,7 @@
1/* $OpenBSD: tls13_handshake.c,v 1.7 2018/11/11 06:49:35 beck Exp $ */ 1/* $OpenBSD: tls13_handshake.c,v 1.8 2019/01/18 06:51:29 tb Exp $ */
2/* 2/*
3 * Copyright (c) 2018 Theo Buehler <tb@openbsd.org> 3 * Copyright (c) 2018-2019 Theo Buehler <tb@openbsd.org>
4 * Copyright (c) 2019 Joel Sing <jsing@openbsd.org>
4 * 5 *
5 * Permission to use, copy, modify, and distribute this software for any 6 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above 7 * purpose with or without fee is hereby granted, provided that the above
@@ -17,6 +18,7 @@
17 18
18#include <stddef.h> 19#include <stddef.h>
19 20
21#include "tls13_handshake.h"
20#include "tls13_internal.h" 22#include "tls13_internal.h"
21 23
22/* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */ 24/* Based on RFC 8446 and inspired by s2n's TLS 1.2 state machine. */
@@ -28,11 +30,6 @@
28/* Indexing into the state machine */ 30/* Indexing into the state machine */
29struct tls13_handshake { 31struct tls13_handshake {
30 uint8_t hs_type; 32 uint8_t hs_type;
31#define INITIAL 0x00
32#define NEGOTIATED 0x01
33#define WITH_CERT_REQ 0x02
34#define WITH_HELLO_RET_REQ 0x04
35#define WITH_PSK 0x08
36 int message_number; 33 int message_number;
37}; 34};
38 35
@@ -66,27 +63,6 @@ int tls13_handshake_send_action(struct tls13_ctx *ctx,
66int tls13_handshake_recv_action(struct tls13_ctx *ctx, 63int tls13_handshake_recv_action(struct tls13_ctx *ctx,
67 struct tls13_handshake_action *action); 64 struct tls13_handshake_action *action);
68 65
69enum tls13_message_type {
70 INVALID,
71 CLIENT_HELLO,
72 CLIENT_HELLO_RETRY,
73 CLIENT_END_OF_EARLY_DATA,
74 CLIENT_CERTIFICATE,
75 CLIENT_CERTIFICATE_VERIFY,
76 CLIENT_FINISHED,
77 CLIENT_KEY_UPDATE,
78 SERVER_HELLO,
79 SERVER_NEW_SESSION_TICKET,
80 SERVER_ENCRYPTED_EXTENSIONS,
81 SERVER_CERTIFICATE,
82 SERVER_CERTIFICATE_VERIFY,
83 SERVER_CERTIFICATE_REQUEST,
84 SERVER_FINISHED,
85 SERVER_KEY_UPDATE,
86 SERVER_MESSAGE_HASH,
87 APPLICATION_DATA,
88};
89
90struct tls13_handshake_action state_machine[] = { 66struct tls13_handshake_action state_machine[] = {
91 [CLIENT_HELLO] = { 67 [CLIENT_HELLO] = {
92 .record_type = TLS13_HANDSHAKE, 68 .record_type = TLS13_HANDSHAKE,
@@ -144,13 +120,6 @@ struct tls13_handshake_action state_machine[] = {
144 .send = tls13_server_hello_send, 120 .send = tls13_server_hello_send,
145 .recv = tls13_server_hello_recv, 121 .recv = tls13_server_hello_recv,
146 }, 122 },
147 [SERVER_NEW_SESSION_TICKET] = {
148 .record_type = TLS13_HANDSHAKE,
149 .handshake_type = TLS13_MT_NEW_SESSION_TICKET,
150 .sender = TLS13_HS_SERVER,
151 .send = tls13_server_new_session_ticket_send,
152 .recv = tls13_server_new_session_ticket_recv,
153 },
154 [SERVER_ENCRYPTED_EXTENSIONS] = { 123 [SERVER_ENCRYPTED_EXTENSIONS] = {
155 .record_type = TLS13_HANDSHAKE, 124 .record_type = TLS13_HANDSHAKE,
156 .handshake_type = TLS13_MT_ENCRYPTED_EXTENSIONS, 125 .handshake_type = TLS13_MT_ENCRYPTED_EXTENSIONS,
@@ -186,20 +155,6 @@ struct tls13_handshake_action state_machine[] = {
186 .send = tls13_server_finished_send, 155 .send = tls13_server_finished_send,
187 .recv = tls13_server_finished_recv, 156 .recv = tls13_server_finished_recv,
188 }, 157 },
189 [SERVER_KEY_UPDATE] = {
190 .record_type = TLS13_HANDSHAKE,
191 .handshake_type = TLS13_MT_KEY_UPDATE,
192 .sender = TLS13_HS_SERVER,
193 .send = tls13_server_key_update_send,
194 .recv = tls13_server_key_update_recv,
195 },
196 [SERVER_MESSAGE_HASH] = {
197 .record_type = TLS13_HANDSHAKE,
198 .handshake_type = TLS13_MT_MESSAGE_HASH,
199 .sender = TLS13_HS_SERVER,
200 .send = tls13_server_message_hash_send,
201 .recv = tls13_server_message_hash_recv,
202 },
203 [APPLICATION_DATA] = { 158 [APPLICATION_DATA] = {
204 .record_type = TLS13_APPLICATION_DATA, 159 .record_type = TLS13_APPLICATION_DATA,
205 .handshake_type = 0, 160 .handshake_type = 0,
@@ -209,7 +164,7 @@ struct tls13_handshake_action state_machine[] = {
209 }, 164 },
210}; 165};
211 166
212static enum tls13_message_type handshakes[][16] = { 167static enum tls13_message_type handshakes[][TLS13_NUM_MESSAGE_TYPES] = {
213 [INITIAL] = { 168 [INITIAL] = {
214 CLIENT_HELLO, 169 CLIENT_HELLO,
215 SERVER_HELLO, 170 SERVER_HELLO,
@@ -218,16 +173,30 @@ static enum tls13_message_type handshakes[][16] = {
218 CLIENT_HELLO, 173 CLIENT_HELLO,
219 SERVER_HELLO, 174 SERVER_HELLO,
220 SERVER_ENCRYPTED_EXTENSIONS, 175 SERVER_ENCRYPTED_EXTENSIONS,
176 SERVER_CERTIFICATE_REQUEST,
221 SERVER_CERTIFICATE, 177 SERVER_CERTIFICATE,
222 SERVER_CERTIFICATE_VERIFY, 178 SERVER_CERTIFICATE_VERIFY,
223 SERVER_FINISHED, 179 SERVER_FINISHED,
180 CLIENT_CERTIFICATE,
224 CLIENT_FINISHED, 181 CLIENT_FINISHED,
225 APPLICATION_DATA, 182 APPLICATION_DATA,
226 }, 183 },
227 [NEGOTIATED | WITH_HELLO_RET_REQ] = { 184 [NEGOTIATED | WITH_CCV] = {
185 CLIENT_HELLO,
186 SERVER_HELLO,
187 SERVER_ENCRYPTED_EXTENSIONS,
188 SERVER_CERTIFICATE_REQUEST,
189 SERVER_CERTIFICATE,
190 SERVER_CERTIFICATE_VERIFY,
191 SERVER_FINISHED,
192 CLIENT_CERTIFICATE,
193 CLIENT_CERTIFICATE_VERIFY,
194 CLIENT_FINISHED,
195 APPLICATION_DATA,
196 },
197 [NEGOTIATED | WITHOUT_CR] = {
228 CLIENT_HELLO, 198 CLIENT_HELLO,
229 SERVER_HELLO, 199 SERVER_HELLO,
230 CLIENT_HELLO_RETRY,
231 SERVER_ENCRYPTED_EXTENSIONS, 200 SERVER_ENCRYPTED_EXTENSIONS,
232 SERVER_CERTIFICATE, 201 SERVER_CERTIFICATE,
233 SERVER_CERTIFICATE_VERIFY, 202 SERVER_CERTIFICATE_VERIFY,
@@ -235,18 +204,28 @@ static enum tls13_message_type handshakes[][16] = {
235 CLIENT_FINISHED, 204 CLIENT_FINISHED,
236 APPLICATION_DATA, 205 APPLICATION_DATA,
237 }, 206 },
238 [NEGOTIATED | WITH_CERT_REQ] = { 207 [NEGOTIATED | WITH_PSK] = {
239 CLIENT_HELLO, 208 CLIENT_HELLO,
240 SERVER_HELLO, 209 SERVER_HELLO,
241 SERVER_ENCRYPTED_EXTENSIONS, 210 SERVER_ENCRYPTED_EXTENSIONS,
211 SERVER_FINISHED,
212 CLIENT_FINISHED,
213 APPLICATION_DATA,
214 },
215 [NEGOTIATED | WITH_HRR] = {
216 CLIENT_HELLO,
217 SERVER_HELLO,
218 CLIENT_HELLO_RETRY,
219 SERVER_ENCRYPTED_EXTENSIONS,
242 SERVER_CERTIFICATE_REQUEST, 220 SERVER_CERTIFICATE_REQUEST,
243 SERVER_CERTIFICATE, 221 SERVER_CERTIFICATE,
244 SERVER_CERTIFICATE_VERIFY, 222 SERVER_CERTIFICATE_VERIFY,
245 SERVER_FINISHED, 223 SERVER_FINISHED,
224 CLIENT_CERTIFICATE,
246 CLIENT_FINISHED, 225 CLIENT_FINISHED,
247 APPLICATION_DATA, 226 APPLICATION_DATA,
248 }, 227 },
249 [NEGOTIATED | WITH_HELLO_RET_REQ | WITH_CERT_REQ] = { 228 [NEGOTIATED | WITH_HRR | WITH_CCV] = {
250 CLIENT_HELLO, 229 CLIENT_HELLO,
251 SERVER_HELLO, 230 SERVER_HELLO,
252 CLIENT_HELLO_RETRY, 231 CLIENT_HELLO_RETRY,
@@ -255,18 +234,23 @@ static enum tls13_message_type handshakes[][16] = {
255 SERVER_CERTIFICATE, 234 SERVER_CERTIFICATE,
256 SERVER_CERTIFICATE_VERIFY, 235 SERVER_CERTIFICATE_VERIFY,
257 SERVER_FINISHED, 236 SERVER_FINISHED,
237 CLIENT_CERTIFICATE,
238 CLIENT_CERTIFICATE_VERIFY,
258 CLIENT_FINISHED, 239 CLIENT_FINISHED,
259 APPLICATION_DATA, 240 APPLICATION_DATA,
260 }, 241 },
261 [NEGOTIATED | WITH_PSK] = { 242 [NEGOTIATED | WITH_HRR | WITHOUT_CR] = {
262 CLIENT_HELLO, 243 CLIENT_HELLO,
263 SERVER_HELLO, 244 SERVER_HELLO,
245 CLIENT_HELLO_RETRY,
264 SERVER_ENCRYPTED_EXTENSIONS, 246 SERVER_ENCRYPTED_EXTENSIONS,
247 SERVER_CERTIFICATE,
248 SERVER_CERTIFICATE_VERIFY,
265 SERVER_FINISHED, 249 SERVER_FINISHED,
266 CLIENT_FINISHED, 250 CLIENT_FINISHED,
267 APPLICATION_DATA, 251 APPLICATION_DATA,
268 }, 252 },
269 [NEGOTIATED | WITH_HELLO_RET_REQ | WITH_PSK] = { 253 [NEGOTIATED | WITH_HRR | WITH_PSK] = {
270 CLIENT_HELLO, 254 CLIENT_HELLO,
271 SERVER_HELLO, 255 SERVER_HELLO,
272 CLIENT_HELLO_RETRY, 256 CLIENT_HELLO_RETRY,
@@ -470,18 +454,6 @@ tls13_server_hello_send(struct tls13_ctx *ctx)
470} 454}
471 455
472int 456int
473tls13_server_new_session_ticket_recv(struct tls13_ctx *ctx)
474{
475 return 1;
476}
477
478int
479tls13_server_new_session_ticket_send(struct tls13_ctx *ctx)
480{
481 return 1;
482}
483
484int
485tls13_server_encrypted_extensions_recv(struct tls13_ctx *ctx) 457tls13_server_encrypted_extensions_recv(struct tls13_ctx *ctx)
486{ 458{
487 return 1; 459 return 1;
@@ -540,27 +512,3 @@ tls13_server_finished_send(struct tls13_ctx *ctx)
540{ 512{
541 return 1; 513 return 1;
542} 514}
543
544int
545tls13_server_key_update_recv(struct tls13_ctx *ctx)
546{
547 return 1;
548}
549
550int
551tls13_server_key_update_send(struct tls13_ctx *ctx)
552{
553 return 1;
554}
555
556int
557tls13_server_message_hash_recv(struct tls13_ctx *ctx)
558{
559 return 1;
560}
561
562int
563tls13_server_message_hash_send(struct tls13_ctx *ctx)
564{
565 return 1;
566}
diff --git a/src/lib/libssl/tls13_handshake.h b/src/lib/libssl/tls13_handshake.h
new file mode 100644
index 0000000000..8b21bca3dd
--- /dev/null
+++ b/src/lib/libssl/tls13_handshake.h
@@ -0,0 +1,52 @@
1/* $OpenBSD: tls13_handshake.h,v 1.1 2019/01/18 06:51:29 tb Exp $ */
2/*
3 * Copyright (c) 2019 Theo Buehler <tb@openbsd.org>
4 *
5 * Permission to use, copy, modify, and/or distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
12 * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
14 * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
15 * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18#ifndef HEADER_TLS13_HANDSHAKE_H
19
20__BEGIN_HIDDEN_DECLS
21
22#define INITIAL 0x00
23#define NEGOTIATED 0x01
24#define WITH_HRR 0x02
25#define WITHOUT_CR 0x04
26#define WITH_PSK 0x08
27#define WITH_CCV 0x10
28#define WITH_0RTT 0x20
29
30enum tls13_message_type {
31 INVALID,
32 CLIENT_HELLO,
33 SERVER_HELLO,
34 CLIENT_HELLO_RETRY,
35 SERVER_ENCRYPTED_EXTENSIONS,
36 SERVER_CERTIFICATE_REQUEST,
37 SERVER_CERTIFICATE,
38 SERVER_CERTIFICATE_VERIFY,
39 SERVER_FINISHED,
40 CLIENT_END_OF_EARLY_DATA,
41 CLIENT_CERTIFICATE,
42 CLIENT_CERTIFICATE_VERIFY,
43 CLIENT_FINISHED,
44 CLIENT_KEY_UPDATE,
45 SERVER_NEW_SESSION_TICKET,
46 APPLICATION_DATA,
47 TLS13_NUM_MESSAGE_TYPES,
48};
49
50__END_HIDDEN_DECLS
51
52#endif
diff --git a/src/lib/libssl/tls13_internal.h b/src/lib/libssl/tls13_internal.h
index 872aced77c..e672df37e3 100644
--- a/src/lib/libssl/tls13_internal.h
+++ b/src/lib/libssl/tls13_internal.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: tls13_internal.h,v 1.6 2019/01/17 06:32:12 jsing Exp $ */ 1/* $OpenBSD: tls13_internal.h,v 1.7 2019/01/18 06:51:29 tb Exp $ */
2/* 2/*
3 * Copyright (c) 2018 Bob Beck <beck@openbsd.org> 3 * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
4 * Copyright (c) 2018 Theo Buehler <tb@openbsd.org> 4 * Copyright (c) 2018 Theo Buehler <tb@openbsd.org>
@@ -135,8 +135,6 @@ int tls13_client_key_update_send(struct tls13_ctx *ctx);
135int tls13_client_key_update_recv(struct tls13_ctx *ctx); 135int tls13_client_key_update_recv(struct tls13_ctx *ctx);
136int tls13_server_hello_recv(struct tls13_ctx *ctx); 136int tls13_server_hello_recv(struct tls13_ctx *ctx);
137int tls13_server_hello_send(struct tls13_ctx *ctx); 137int tls13_server_hello_send(struct tls13_ctx *ctx);
138int tls13_server_new_session_ticket_recv(struct tls13_ctx *ctx);
139int tls13_server_new_session_ticket_send(struct tls13_ctx *ctx);
140int tls13_server_encrypted_extensions_recv(struct tls13_ctx *ctx); 138int tls13_server_encrypted_extensions_recv(struct tls13_ctx *ctx);
141int tls13_server_encrypted_extensions_send(struct tls13_ctx *ctx); 139int tls13_server_encrypted_extensions_send(struct tls13_ctx *ctx);
142int tls13_server_certificate_recv(struct tls13_ctx *ctx); 140int tls13_server_certificate_recv(struct tls13_ctx *ctx);
@@ -147,10 +145,6 @@ int tls13_server_certificate_verify_send(struct tls13_ctx *ctx);
147int tls13_server_certificate_verify_recv(struct tls13_ctx *ctx); 145int tls13_server_certificate_verify_recv(struct tls13_ctx *ctx);
148int tls13_server_finished_recv(struct tls13_ctx *ctx); 146int tls13_server_finished_recv(struct tls13_ctx *ctx);
149int tls13_server_finished_send(struct tls13_ctx *ctx); 147int tls13_server_finished_send(struct tls13_ctx *ctx);
150int tls13_server_key_update_recv(struct tls13_ctx *ctx);
151int tls13_server_key_update_send(struct tls13_ctx *ctx);
152int tls13_server_message_hash_recv(struct tls13_ctx *ctx);
153int tls13_server_message_hash_send(struct tls13_ctx *ctx);
154 148
155__END_HIDDEN_DECLS 149__END_HIDDEN_DECLS
156 150
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-21 19:47:23 +0000