use crate::msgs::enums::{ContentType, HandshakeType, ProtocolVersion};
use crate::msgs::enums::{AlertDescription, SignatureScheme, NamedGroup};
use crate::msgs::enums::{Compression, PSKKeyExchangeMode};
use crate::msgs::enums::KeyUpdateRequest;
use crate::msgs::message::{Message, MessagePayload};
use crate::msgs::handshake::HandshakePayload;
use crate::msgs::handshake::HandshakeMessagePayload;
use crate::msgs::handshake::NewSessionTicketPayloadTLS13;
use crate::msgs::handshake::CertificateEntry;
use crate::msgs::handshake::CertificateExtension;
use crate::msgs::handshake::CertificateStatus;
use crate::msgs::handshake::CertificatePayloadTLS13;
use crate::msgs::handshake::CertificateRequestPayloadTLS13;
use crate::msgs::handshake::CertReqExtension;
use crate::msgs::handshake::ClientHelloPayload;
use crate::msgs::handshake::HelloRetryRequest;
use crate::msgs::handshake::HelloRetryExtension;
use crate::msgs::handshake::ServerHelloPayload;
use crate::msgs::handshake::KeyShareEntry;
use crate::msgs::handshake::SessionID;
use crate::msgs::handshake::ServerExtension;
use crate::msgs::handshake::Random;
use crate::msgs::handshake::DigitallySignedStruct;
use crate::msgs::ccs::ChangeCipherSpecPayload;
use crate::msgs::base::{Payload, PayloadU8};
use crate::msgs::codec::Codec;
use crate::msgs::persist;
use crate::server::ServerSessionImpl;
use crate::key_schedule::{
KeyScheduleNonSecret,
KeyScheduleEarly,
KeyScheduleHandshake,
KeyScheduleTrafficWithClientFinishedPending,
KeyScheduleTraffic
};
use crate::cipher;
use crate::verify;
use crate::rand;
use crate::sign;
use crate::suites;
#[cfg(feature = "logging")]
use crate::log::{warn, trace, debug};
use crate::error::TLSError;
use crate::check::check_message;
#[cfg(feature = "quic")]
use crate::{
quic,
msgs::handshake::NewSessionTicketExtension,
session::Protocol
};
use crate::server::common::{HandshakeDetails, ClientCertDetails};
use crate::server::hs;
use ring::constant_time;
pub struct CompleteClientHelloHandling {
pub handshake: HandshakeDetails,
pub done_retry: bool,
pub send_cert_status: bool,
pub send_sct: bool,
pub send_ticket: bool,
}
impl CompleteClientHelloHandling {
fn check_binder(&self,
sess: &mut ServerSessionImpl,
client_hello: &Message,
psk: &[u8],
binder: &[u8])
-> bool {
let binder_plaintext = match client_hello.payload {
MessagePayload::Handshake(ref hmp) => hmp.get_encoding_for_binder_signing(),
_ => unreachable!(),
};
let suite = sess.common.get_suite_assert();
let suite_hash = suite.get_hash();
let handshake_hash = self.handshake.transcript.get_hash_given(suite_hash, &binder_plaintext);
let key_schedule = KeyScheduleEarly::new(suite.hkdf_algorithm, &psk);
let real_binder = key_schedule.resumption_psk_binder_key_and_sign_verify_data(&handshake_hash);
constant_time::verify_slices_are_equal(&real_binder, binder).is_ok()
}
fn into_expect_retried_client_hello(self) -> hs::NextState {
Box::new(hs::ExpectClientHello {
handshake: self.handshake,
done_retry: true,
send_cert_status: self.send_cert_status,
send_sct: self.send_sct,
send_ticket: self.send_ticket,
})
}
fn into_expect_certificate(self, key_schedule: KeyScheduleTrafficWithClientFinishedPending) -> hs::NextState {
Box::new(ExpectCertificate {
handshake: self.handshake,
key_schedule,
send_ticket: self.send_ticket,
})
}
fn into_expect_finished(self, key_schedule: KeyScheduleTrafficWithClientFinishedPending) -> hs::NextState {
Box::new(ExpectFinished {
handshake: self.handshake,
key_schedule,
send_ticket: self.send_ticket,
})
}
fn emit_server_hello(&mut self,
sess: &mut ServerSessionImpl,
session_id: &SessionID,
share: &KeyShareEntry,
chosen_psk_idx: Option<usize>,
resuming_psk: Option<&[u8]>)
-> Result<KeyScheduleHandshake, TLSError> {
let mut extensions = Vec::new();
let kxr = suites::KeyExchange::start_ecdhe(share.group)
.and_then(|kx| kx.complete(&share.payload.0))
.ok_or_else(|| TLSError::PeerMisbehavedError("key exchange failed".to_string()))?;
let kse = KeyShareEntry::new(share.group, kxr.pubkey.as_ref());
extensions.push(ServerExtension::KeyShare(kse));
extensions.push(ServerExtension::SupportedVersions(ProtocolVersion::TLSv1_3));
if let Some(psk_idx) = chosen_psk_idx {
extensions.push(ServerExtension::PresharedKey(psk_idx as u16));
}
let sh = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_2,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::ServerHello,
payload: HandshakePayload::ServerHello(ServerHelloPayload {
legacy_version: ProtocolVersion::TLSv1_2,
random: Random::from_slice(&self.handshake.randoms.server),
session_id: *session_id,
cipher_suite: sess.common.get_suite_assert().suite,
compression_method: Compression::Null,
extensions,
}),
}),
};
hs::check_aligned_handshake(sess)?;
#[cfg(feature = "quic")]
let client_hello_hash = self.handshake.transcript
.get_hash_given(sess.common.get_suite_assert().get_hash(), &[]);
trace!("sending server hello {:?}", sh);
self.handshake.transcript.add_message(&sh);
sess.common.send_msg(sh, false);
let suite = sess.common.get_suite_assert();
let mut key_schedule = if let Some(psk) = resuming_psk {
let early_key_schedule = KeyScheduleEarly::new(suite.hkdf_algorithm, psk);
#[cfg(feature = "quic")] {
if sess.common.protocol == Protocol::Quic {
let client_early_traffic_secret = early_key_schedule
.client_early_traffic_secret(&client_hello_hash,
&*sess.config.key_log,
&self.handshake.randoms.client);
sess.common.quic.early_secret = Some(client_early_traffic_secret);
}
}
early_key_schedule
.into_handshake(&kxr.shared_secret)
} else {
KeyScheduleNonSecret::new(suite.hkdf_algorithm)
.into_handshake(&kxr.shared_secret)
};
let handshake_hash = self.handshake.transcript.get_current_hash();
let write_key = key_schedule
.server_handshake_traffic_secret(&handshake_hash,
&*sess.config.key_log,
&self.handshake.randoms.client);
sess.common
.record_layer
.set_message_encrypter(cipher::new_tls13_write(suite, &write_key));
let read_key = key_schedule
.client_handshake_traffic_secret(&handshake_hash,
&*sess.config.key_log,
&self.handshake.randoms.client);
sess.common
.record_layer
.set_message_decrypter(cipher::new_tls13_read(suite, &read_key));
#[cfg(feature = "quic")] {
sess.common.quic.hs_secrets = Some(quic::Secrets {
client: read_key,
server: write_key,
});
}
Ok(key_schedule)
}
fn emit_fake_ccs(&mut self,
sess: &mut ServerSessionImpl) {
if sess.common.is_quic() { return; }
let m = Message {
typ: ContentType::ChangeCipherSpec,
version: ProtocolVersion::TLSv1_2,
payload: MessagePayload::ChangeCipherSpec(ChangeCipherSpecPayload {})
};
sess.common.send_msg(m, false);
}
fn emit_hello_retry_request(&mut self,
sess: &mut ServerSessionImpl,
group: NamedGroup) {
let mut req = HelloRetryRequest {
legacy_version: ProtocolVersion::TLSv1_2,
session_id: SessionID::empty(),
cipher_suite: sess.common.get_suite_assert().suite,
extensions: Vec::new(),
};
req.extensions.push(HelloRetryExtension::KeyShare(group));
req.extensions.push(HelloRetryExtension::SupportedVersions(ProtocolVersion::TLSv1_3));
let m = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_2,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::HelloRetryRequest,
payload: HandshakePayload::HelloRetryRequest(req),
}),
};
trace!("Requesting retry {:?}", m);
self.handshake.transcript.rollup_for_hrr();
self.handshake.transcript.add_message(&m);
sess.common.send_msg(m, false);
}
fn emit_encrypted_extensions(&mut self,
sess: &mut ServerSessionImpl,
server_key: &mut sign::CertifiedKey,
hello: &ClientHelloPayload,
resumedata: Option<&persist::ServerSessionValue>)
-> Result<(), TLSError> {
let mut ep = hs::ExtensionProcessing::new();
ep.process_common(sess, Some(server_key), hello, resumedata, &self.handshake)?;
self.send_cert_status = ep.send_cert_status;
self.send_sct = ep.send_sct;
let ee = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_3,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::EncryptedExtensions,
payload: HandshakePayload::EncryptedExtensions(ep.exts),
}),
};
trace!("sending encrypted extensions {:?}", ee);
self.handshake.transcript.add_message(&ee);
sess.common.send_msg(ee, true);
Ok(())
}
fn emit_certificate_req_tls13(&mut self, sess: &mut ServerSessionImpl) -> Result<bool, TLSError> {
if !sess.config.verifier.offer_client_auth() {
return Ok(false);
}
let mut cr = CertificateRequestPayloadTLS13 {
context: PayloadU8::empty(),
extensions: Vec::new(),
};
let schemes = sess.config.get_verifier()
.supported_verify_schemes();
cr.extensions.push(CertReqExtension::SignatureAlgorithms(schemes.to_vec()));
let names = sess.config.verifier.client_auth_root_subjects(sess.get_sni())
.ok_or_else(|| {
debug!("could not determine root subjects based on SNI");
sess.common.send_fatal_alert(AlertDescription::AccessDenied);
TLSError::General("client rejected by client_auth_root_subjects".into())
})?;
if !names.is_empty() {
cr.extensions.push(CertReqExtension::AuthorityNames(names));
}
let m = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_3,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::CertificateRequest,
payload: HandshakePayload::CertificateRequestTLS13(cr),
}),
};
trace!("Sending CertificateRequest {:?}", m);
self.handshake.transcript.add_message(&m);
sess.common.send_msg(m, true);
Ok(true)
}
fn emit_certificate_tls13(&mut self,
sess: &mut ServerSessionImpl,
server_key: &mut sign::CertifiedKey) {
let mut cert_entries = vec![];
for cert in server_key.take_cert() {
let entry = CertificateEntry {
cert,
exts: Vec::new(),
};
cert_entries.push(entry);
}
if let Some(end_entity_cert) = cert_entries.first_mut() {
if self.send_cert_status {
if let Some(ocsp) = server_key.take_ocsp() {
let cst = CertificateStatus::new(ocsp);
end_entity_cert.exts.push(CertificateExtension::CertificateStatus(cst));
}
}
if self.send_sct {
if let Some(sct_list) = server_key.take_sct_list() {
end_entity_cert.exts.push(CertificateExtension::make_sct(sct_list));
}
}
}
let cert_body = CertificatePayloadTLS13::new(cert_entries);
let c = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_3,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::Certificate,
payload: HandshakePayload::CertificateTLS13(cert_body),
}),
};
trace!("sending certificate {:?}", c);
self.handshake.transcript.add_message(&c);
sess.common.send_msg(c, true);
}
fn emit_certificate_verify_tls13(&mut self,
sess: &mut ServerSessionImpl,
server_key: &mut sign::CertifiedKey,
schemes: &[SignatureScheme])
-> Result<(), TLSError> {
let message = verify::construct_tls13_server_verify_message(
&self.handshake.transcript.get_current_hash()
);
let signing_key = &server_key.key;
let signer = signing_key.choose_scheme(schemes)
.ok_or_else(|| hs::incompatible(sess, "no overlapping sigschemes"))?;
let scheme = signer.get_scheme();
let sig = signer.sign(&message)?;
let cv = DigitallySignedStruct::new(scheme, sig);
let m = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_3,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::CertificateVerify,
payload: HandshakePayload::CertificateVerify(cv),
}),
};
trace!("sending certificate-verify {:?}", m);
self.handshake.transcript.add_message(&m);
sess.common.send_msg(m, true);
Ok(())
}
fn emit_finished_tls13(&mut self, sess: &mut ServerSessionImpl,
key_schedule: KeyScheduleHandshake) -> KeyScheduleTrafficWithClientFinishedPending {
let handshake_hash = self.handshake.transcript.get_current_hash();
let verify_data = key_schedule.sign_server_finish(&handshake_hash);
let verify_data_payload = Payload::new(verify_data);
let m = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_3,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::Finished,
payload: HandshakePayload::Finished(verify_data_payload),
}),
};
trace!("sending finished {:?}", m);
self.handshake.transcript.add_message(&m);
self.handshake.hash_at_server_fin = self.handshake.transcript.get_current_hash();
sess.common.send_msg(m, true);
let mut key_schedule_traffic = key_schedule.into_traffic_with_client_finished_pending();
let suite = sess.common.get_suite_assert();
let write_key = key_schedule_traffic
.server_application_traffic_secret(&self.handshake.hash_at_server_fin,
&*sess.config.key_log,
&self.handshake.randoms.client);
sess.common
.record_layer
.set_message_encrypter(cipher::new_tls13_write(suite, &write_key));
key_schedule_traffic
.exporter_master_secret(&self.handshake.hash_at_server_fin,
&*sess.config.key_log,
&self.handshake.randoms.client);
let _read_key = key_schedule_traffic
.client_application_traffic_secret(&self.handshake.hash_at_server_fin,
&*sess.config.key_log,
&self.handshake.randoms.client);
#[cfg(feature = "quic")] {
sess.common.quic.traffic_secrets = Some(quic::Secrets {
client: _read_key,
server: write_key,
});
}
key_schedule_traffic
}
fn attempt_tls13_ticket_decryption(&mut self,
sess: &mut ServerSessionImpl,
ticket: &[u8]) -> Option<persist::ServerSessionValue> {
if sess.config.ticketer.enabled() {
sess.config
.ticketer
.decrypt(ticket)
.and_then(|plain| persist::ServerSessionValue::read_bytes(&plain))
} else {
sess.config
.session_storage
.take(ticket)
.and_then(|plain| persist::ServerSessionValue::read_bytes(&plain))
}
}
pub fn handle_client_hello(mut self,
sess: &mut ServerSessionImpl,
mut server_key: sign::CertifiedKey,
chm: &Message) -> hs::NextStateOrError {
let client_hello = require_handshake_msg!(chm, HandshakeType::ClientHello, HandshakePayload::ClientHello)?;
if client_hello.compression_methods.len() != 1 {
return Err(hs::illegal_param(sess, "client offered wrong compressions"));
}
let groups_ext = client_hello.get_namedgroups_extension()
.ok_or_else(|| hs::incompatible(sess, "client didn't describe groups"))?;
let mut sigschemes_ext = client_hello.get_sigalgs_extension()
.ok_or_else(|| hs::incompatible(sess, "client didn't describe sigschemes"))?
.clone();
let tls13_schemes = sign::supported_sign_tls13();
sigschemes_ext.retain(|scheme| tls13_schemes.contains(scheme));
let shares_ext = client_hello.get_keyshare_extension()
.ok_or_else(|| hs::incompatible(sess, "client didn't send keyshares"))?;
if client_hello.has_keyshare_extension_with_duplicates() {
return Err(hs::illegal_param(sess, "client sent duplicate keyshares"));
}
let share_groups: Vec<NamedGroup> = shares_ext.iter()
.map(|share| share.group)
.collect();
let supported_groups = suites::KeyExchange::supported_groups();
let chosen_group = supported_groups
.iter()
.filter(|group| share_groups.contains(group))
.nth(0)
.cloned();
if chosen_group.is_none() {
let retry_group_maybe = supported_groups
.iter()
.filter(|group| groups_ext.contains(group))
.nth(0)
.cloned();
self.handshake.transcript.add_message(chm);
if let Some(group) = retry_group_maybe {
if self.done_retry {
return Err(hs::illegal_param(sess, "did not follow retry request"));
}
self.emit_hello_retry_request(sess, group);
self.emit_fake_ccs(sess);
return Ok(self.into_expect_retried_client_hello());
}
return Err(hs::incompatible(sess, "no kx group overlap with client"));
}
let chosen_group = chosen_group.unwrap();
let chosen_share = shares_ext.iter()
.find(|share| share.group == chosen_group)
.unwrap();
let mut chosen_psk_index = None;
let mut resumedata = None;
if let Some(psk_offer) = client_hello.get_psk() {
if !client_hello.check_psk_ext_is_last() {
return Err(hs::illegal_param(sess, "psk extension in wrong position"));
}
if psk_offer.binders.is_empty() {
return Err(hs::decode_error(sess, "psk extension missing binder"));
}
if psk_offer.binders.len() != psk_offer.identities.len() {
return Err(hs::illegal_param(sess, "psk extension mismatched ids/binders"));
}
for (i, psk_id) in psk_offer.identities.iter().enumerate() {
let maybe_resume = self.attempt_tls13_ticket_decryption(sess, &psk_id.identity.0);
if !hs::can_resume(sess, &self.handshake, &maybe_resume) {
continue;
}
let resume = maybe_resume.unwrap();
if !self.check_binder(sess, chm, &resume.master_secret.0, &psk_offer.binders[i].0) {
sess.common.send_fatal_alert(AlertDescription::DecryptError);
return Err(TLSError::PeerMisbehavedError("client sent wrong binder".to_string()));
}
chosen_psk_index = Some(i);
resumedata = Some(resume);
break;
}
}
if !client_hello.psk_mode_offered(PSKKeyExchangeMode::PSK_DHE_KE) {
warn!("Resumption ignored, DHE_KE not offered");
self.send_ticket = false;
chosen_psk_index = None;
resumedata = None;
} else {
self.send_ticket = true;
}
if let Some(ref resume) = resumedata {
sess.received_resumption_data = Some(resume.application_data.0.clone());
}
let full_handshake = resumedata.is_none();
self.handshake.transcript.add_message(chm);
let key_schedule = self.emit_server_hello(sess, &client_hello.session_id,
chosen_share, chosen_psk_index,
resumedata.as_ref().map(|x| &x.master_secret.0[..]))?;
if !self.done_retry {
self.emit_fake_ccs(sess);
}
self.emit_encrypted_extensions(sess, &mut server_key, client_hello, resumedata.as_ref())?;
let doing_client_auth = if full_handshake {
let client_auth = self.emit_certificate_req_tls13(sess)?;
self.emit_certificate_tls13(sess, &mut server_key);
self.emit_certificate_verify_tls13(sess, &mut server_key, &sigschemes_ext)?;
client_auth
} else {
false
};
hs::check_aligned_handshake(sess)?;
let key_schedule_traffic = self.emit_finished_tls13(sess, key_schedule);
if doing_client_auth {
Ok(self.into_expect_certificate(key_schedule_traffic))
} else {
Ok(self.into_expect_finished(key_schedule_traffic))
}
}
}
pub struct ExpectCertificate {
pub handshake: HandshakeDetails,
pub key_schedule: KeyScheduleTrafficWithClientFinishedPending,
pub send_ticket: bool,
}
impl ExpectCertificate {
fn into_expect_finished(self) -> hs::NextState {
Box::new(ExpectFinished {
key_schedule: self.key_schedule,
handshake: self.handshake,
send_ticket: self.send_ticket,
})
}
fn into_expect_certificate_verify(self,
cert: ClientCertDetails) -> hs::NextState {
Box::new(ExpectCertificateVerify {
handshake: self.handshake,
key_schedule: self.key_schedule,
client_cert: cert,
send_ticket: self.send_ticket,
})
}
}
impl hs::State for ExpectCertificate {
fn handle(mut self: Box<Self>, sess: &mut ServerSessionImpl, m: Message) -> hs::NextStateOrError {
let certp = require_handshake_msg!(m, HandshakeType::Certificate, HandshakePayload::CertificateTLS13)?;
self.handshake.transcript.add_message(&m);
if certp.any_entry_has_extension() {
return Err(TLSError::PeerMisbehavedError("client sent unsolicited cert extension"
.to_string()));
}
let cert_chain = certp.convert();
let mandatory = sess.config.verifier.client_auth_mandatory(sess.get_sni())
.ok_or_else(|| {
debug!("could not determine if client auth is mandatory based on SNI");
sess.common.send_fatal_alert(AlertDescription::AccessDenied);
TLSError::General("client rejected by client_auth_mandatory".into())
})?;
if cert_chain.is_empty() {
if !mandatory {
debug!("client auth requested but no certificate supplied");
self.handshake.transcript.abandon_client_auth();
return Ok(self.into_expect_finished());
}
sess.common.send_fatal_alert(AlertDescription::CertificateRequired);
return Err(TLSError::NoCertificatesPresented);
}
sess.config.get_verifier().verify_client_cert(&cert_chain, sess.get_sni())
.or_else(|err| {
hs::incompatible(sess, "certificate invalid");
Err(err)
})?;
let cert = ClientCertDetails::new(cert_chain);
Ok(self.into_expect_certificate_verify(cert))
}
}
pub struct ExpectCertificateVerify {
handshake: HandshakeDetails,
key_schedule: KeyScheduleTrafficWithClientFinishedPending,
client_cert: ClientCertDetails,
send_ticket: bool,
}
impl ExpectCertificateVerify {
fn into_expect_finished(self) -> hs::NextState {
Box::new(ExpectFinished {
key_schedule: self.key_schedule,
handshake: self.handshake,
send_ticket: self.send_ticket,
})
}
}
impl hs::State for ExpectCertificateVerify {
fn handle(mut self: Box<Self>, sess: &mut ServerSessionImpl, m: Message) -> hs::NextStateOrError {
let rc = {
let sig = require_handshake_msg!(m, HandshakeType::CertificateVerify, HandshakePayload::CertificateVerify)?;
let handshake_hash = self.handshake.transcript.get_current_hash();
self.handshake.transcript.abandon_client_auth();
let certs = &self.client_cert.cert_chain;
let msg = verify::construct_tls13_client_verify_message(&handshake_hash);
sess.config
.get_verifier()
.verify_tls13_signature(&msg,
&certs[0],
sig)
};
if let Err(e) = rc {
sess.common.send_fatal_alert(AlertDescription::AccessDenied);
return Err(e);
}
trace!("client CertificateVerify OK");
sess.client_cert_chain = Some(self.client_cert.take_chain());
self.handshake.transcript.add_message(&m);
Ok(self.into_expect_finished())
}
}
fn get_server_session_value(handshake: &mut HandshakeDetails,
key_schedule: &KeyScheduleTraffic,
sess: &ServerSessionImpl,
nonce: &[u8]) -> persist::ServerSessionValue {
let scs = sess.common.get_suite_assert();
let version = ProtocolVersion::TLSv1_3;
let handshake_hash = handshake
.transcript
.get_current_hash();
let secret = key_schedule
.resumption_master_secret_and_derive_ticket_psk(&handshake_hash, nonce);
persist::ServerSessionValue::new(
sess.get_sni(), version,
scs.suite, secret,
&sess.client_cert_chain,
sess.alpn_protocol.clone(),
sess.resumption_data.clone(),
)
}
pub struct ExpectFinished {
pub handshake: HandshakeDetails,
pub key_schedule: KeyScheduleTrafficWithClientFinishedPending,
pub send_ticket: bool,
}
impl ExpectFinished {
fn into_expect_traffic(fin: verify::FinishedMessageVerified, ks: KeyScheduleTraffic) -> hs::NextState {
Box::new(ExpectTraffic {
key_schedule: ks,
want_write_key_update: false,
_fin_verified: fin,
})
}
fn emit_stateless_ticket(handshake: &mut HandshakeDetails,
sess: &mut ServerSessionImpl,
key_schedule: &KeyScheduleTraffic) {
let nonce = rand::random_vec(32);
let plain = get_server_session_value(handshake,
key_schedule,
sess, &nonce)
.get_encoding();
let maybe_ticket = sess.config
.ticketer
.encrypt(&plain);
let ticket_lifetime = sess.config.ticketer.get_lifetime();
if maybe_ticket.is_none() {
return;
}
let ticket = maybe_ticket.unwrap();
let age_add = rand::random_u32();
#[allow(unused_mut)]
let mut payload = NewSessionTicketPayloadTLS13::new(ticket_lifetime, age_add, nonce, ticket);
#[cfg(feature = "quic")] {
if sess.config.max_early_data_size > 0 && sess.common.protocol == Protocol::Quic {
payload.exts.push(NewSessionTicketExtension::EarlyData(sess.config.max_early_data_size));
}
}
let m = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_3,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::NewSessionTicket,
payload: HandshakePayload::NewSessionTicketTLS13(payload),
}),
};
trace!("sending new ticket {:?}", m);
handshake.transcript.add_message(&m);
sess.common.send_msg(m, true);
}
fn emit_stateful_ticket(handshake: &mut HandshakeDetails,
sess: &mut ServerSessionImpl,
key_schedule: &KeyScheduleTraffic) {
let nonce = rand::random_vec(32);
let id = rand::random_vec(32);
let plain = get_server_session_value(handshake,
key_schedule,
sess, &nonce)
.get_encoding();
if sess.config.session_storage.put(id.clone(), plain) {
let stateful_lifetime = 24 * 60 * 60;
let age_add = rand::random_u32();
#[allow(unused_mut)]
let mut payload = NewSessionTicketPayloadTLS13::new(stateful_lifetime, age_add, nonce, id);
#[cfg(feature = "quic")] {
if sess.config.max_early_data_size > 0 && sess.common.protocol == Protocol::Quic {
payload.exts.push(NewSessionTicketExtension::EarlyData(sess.config.max_early_data_size));
}
}
let m = Message {
typ: ContentType::Handshake,
version: ProtocolVersion::TLSv1_3,
payload: MessagePayload::Handshake(HandshakeMessagePayload {
typ: HandshakeType::NewSessionTicket,
payload: HandshakePayload::NewSessionTicketTLS13(payload),
}),
};
trace!("sending new stateful ticket {:?}", m);
handshake.transcript.add_message(&m);
sess.common.send_msg(m, true);
} else {
trace!("resumption not available; not issuing ticket");
}
}
}
impl hs::State for ExpectFinished {
fn handle(mut self: Box<Self>, sess: &mut ServerSessionImpl, m: Message) -> hs::NextStateOrError {
let finished = require_handshake_msg!(m, HandshakeType::Finished, HandshakePayload::Finished)?;
let handshake_hash = self.handshake.transcript.get_current_hash();
let expect_verify_data = self.key_schedule.sign_client_finish(&handshake_hash);
let fin = constant_time::verify_slices_are_equal(&expect_verify_data, &finished.0)
.map_err(|_| {
sess.common.send_fatal_alert(AlertDescription::DecryptError);
warn!("Finished wrong");
TLSError::DecryptError
})
.map(|_| verify::FinishedMessageVerified::assertion())?;
self.handshake.transcript.add_message(&m);
hs::check_aligned_handshake(sess)?;
let suite = sess.common.get_suite_assert();
let read_key = self.key_schedule
.client_application_traffic_secret(&self.handshake.hash_at_server_fin,
&*sess.config.key_log,
&self.handshake.randoms.client);
sess.common
.record_layer
.set_message_decrypter(cipher::new_tls13_read(suite, &read_key));
let key_schedule_traffic = self.key_schedule.into_traffic();
if self.send_ticket {
if sess.config.ticketer.enabled() {
Self::emit_stateless_ticket(&mut self.handshake, sess, &key_schedule_traffic);
} else {
Self::emit_stateful_ticket(&mut self.handshake, sess, &key_schedule_traffic);
}
}
sess.common.start_traffic();
#[cfg(feature = "quic")] {
if sess.common.protocol == Protocol::Quic {
return Ok(Box::new(ExpectQUICTraffic { _fin_verified: fin }));
}
}
Ok(Self::into_expect_traffic(fin, key_schedule_traffic))
}
}
pub struct ExpectTraffic {
key_schedule: KeyScheduleTraffic,
want_write_key_update: bool,
_fin_verified: verify::FinishedMessageVerified,
}
impl ExpectTraffic {
fn handle_traffic(&self, sess: &mut ServerSessionImpl, mut m: Message) -> Result<(), TLSError> {
sess.common.take_received_plaintext(m.take_opaque_payload().unwrap());
Ok(())
}
fn handle_key_update(&mut self, sess: &mut ServerSessionImpl, kur: &KeyUpdateRequest) -> Result<(), TLSError> {
#[cfg(feature = "quic")]
{
if let Protocol::Quic = sess.common.protocol {
sess.common.send_fatal_alert(AlertDescription::UnexpectedMessage);
let msg = "KeyUpdate received in QUIC connection".to_string();
warn!("{}", msg);
return Err(TLSError::PeerMisbehavedError(msg));
}
}
hs::check_aligned_handshake(sess)?;
match kur {
KeyUpdateRequest::UpdateNotRequested => {}
KeyUpdateRequest::UpdateRequested => {
self.want_write_key_update = true;
}
_ => {
sess.common.send_fatal_alert(AlertDescription::IllegalParameter);
return Err(TLSError::CorruptMessagePayload(ContentType::Handshake));
}
}
let new_read_key = self.key_schedule.next_client_application_traffic_secret();
let suite = sess.common.get_suite_assert();
sess.common.record_layer.set_message_decrypter(cipher::new_tls13_read(suite, &new_read_key));
Ok(())
}
}
impl hs::State for ExpectTraffic {
fn handle(mut self: Box<Self>, sess: &mut ServerSessionImpl, m: Message) -> hs::NextStateOrError {
if m.is_content_type(ContentType::ApplicationData) {
self.handle_traffic(sess, m)?;
} else if let Ok(key_update) = require_handshake_msg!(m, HandshakeType::KeyUpdate, HandshakePayload::KeyUpdate) {
self.handle_key_update(sess, key_update)?;
} else {
check_message(&m,
&[ContentType::ApplicationData, ContentType::Handshake],
&[HandshakeType::KeyUpdate])?;
}
Ok(self)
}
fn export_keying_material(&self,
output: &mut [u8],
label: &[u8],
context: Option<&[u8]>) -> Result<(), TLSError> {
self.key_schedule.export_keying_material(output, label, context)
}
fn perhaps_write_key_update(&mut self, sess: &mut ServerSessionImpl) {
if self.want_write_key_update {
self.want_write_key_update = false;
sess.common.send_msg_encrypt(Message::build_key_update_notify());
let write_key = self.key_schedule.next_server_application_traffic_secret();
let scs = sess.common.get_suite_assert();
sess.common.record_layer.set_message_encrypter(cipher::new_tls13_write(scs, &write_key));
}
}
}
#[cfg(feature = "quic")]
pub struct ExpectQUICTraffic {
_fin_verified: verify::FinishedMessageVerified,
}
#[cfg(feature = "quic")]
impl hs::State for ExpectQUICTraffic {
fn handle(self: Box<Self>, _: &mut ServerSessionImpl, m: Message) -> hs::NextStateOrError {
check_message(&m, &[], &[])?;
unreachable!();
}
}