Add support for TLS 1.3 post handshake messages and key updating.

tested against openssl 1.1's server.

ok jsing@ tb@

1 files changed, 147 insertions, 3 deletions

diff --git a/lib/libssl/tls13_lib.c b/lib/libssl/tls13_lib.c
index 61ca3d46821..6876528f50d 100644
--- a/lib/libssl/tls13_lib.c
+++ b/lib/libssl/tls13_lib.c
@@ -1,6 +1,7 @@
-/*	$OpenBSD: tls13_lib.c,v 1.12 2019/11/17 00:10:47 beck Exp $ */
+/*	$OpenBSD: tls13_lib.c,v 1.13 2019/11/26 23:46:18 beck Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
+ * Copyright (c) 2019 Bob Beck <beck@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -90,6 +91,149 @@ tls13_alert_received_cb(uint8_t alert_desc, void *arg)
 	SSL_CTX_remove_session(s->ctx, s->session);
 }
 
+static int
+tls13_phh_update_local_traffic_secret(struct tls13_ctx *ctx)
+{
+	struct tls13_secrets *secrets = ctx->hs->secrets;
+
+	if (ctx->mode == TLS13_HS_CLIENT)
+		return (tls13_update_client_traffic_secret(secrets) &&
+		    tls13_record_layer_set_write_traffic_key(ctx->rl,
+			&secrets->client_application_traffic));
+	return (tls13_update_server_traffic_secret(secrets) &&
+	    tls13_record_layer_set_read_traffic_key(ctx->rl,
+	    &secrets->server_application_traffic));
+}
+
+static int
+tls13_phh_update_peer_traffic_secret(struct tls13_ctx *ctx)
+{
+	struct tls13_secrets *secrets = ctx->hs->secrets;
+
+	if (ctx->mode == TLS13_HS_CLIENT)
+		return (tls13_update_server_traffic_secret(secrets) &&
+		    tls13_record_layer_set_read_traffic_key(ctx->rl,
+		    &secrets->server_application_traffic));
+	return (tls13_update_client_traffic_secret(secrets) &&
+	    tls13_record_layer_set_write_traffic_key(ctx->rl,
+	    &secrets->client_application_traffic));
+}
+
+/*
+ * XXX arbitrarily chosen limit of 100 post handshake handshake
+ * messages in an hour - to avoid a hostile peer from constantly
+ * requesting certificates or key renegotiaitons, etc.
+ */
+static int
+tls13_phh_limit_check(struct tls13_ctx *ctx)
+{
+	time_t now = time(NULL);
+
+	if (ctx->phh_last_seen > now - TLS13_PHH_LIMIT_TIME) {
+		if (ctx->phh_count > TLS13_PHH_LIMIT)
+			return 0;
+	} else
+		ctx->phh_count = 0;
+	ctx->phh_count++;
+	ctx->phh_last_seen = now;
+	return 1;
+}
+
+static ssize_t
+tls13_key_update_recv(struct tls13_ctx *ctx, CBS *cbs)
+{
+	ssize_t ret = TLS13_IO_FAILURE;
+
+	if (!CBS_get_u8(cbs, &ctx->key_update_request))
+		goto err;
+	if (CBS_len(cbs) != 0)
+		goto err;
+
+	if (!tls13_phh_update_peer_traffic_secret(ctx))
+		goto err;
+
+	if (ctx->key_update_request) {
+		CBB cbb;
+		CBS cbs; /* XXX */
+
+		free(ctx->hs_msg);
+		ctx->hs_msg = tls13_handshake_msg_new();
+		if (!tls13_handshake_msg_start(ctx->hs_msg, &cbb, TLS13_MT_KEY_UPDATE))
+			goto err;
+		if (!CBB_add_u8(&cbb, 0))
+			goto err;
+		if (!tls13_handshake_msg_finish(ctx->hs_msg))
+			goto err;
+		tls13_handshake_msg_data(ctx->hs_msg, &cbs);
+		ret = tls13_record_layer_phh(ctx->rl, &cbs);
+
+		tls13_handshake_msg_free(ctx->hs_msg);
+		ctx->hs_msg = NULL;
+	} else
+		ret = TLS13_IO_SUCCESS;
+
+	return ret;
+ err:
+	ctx->key_update_request = 0;
+	/* XXX alert */
+	return TLS13_IO_FAILURE;
+}
+
+static void
+tls13_phh_done_cb(void *cb_arg)
+{
+	struct tls13_ctx *ctx = cb_arg;
+
+	if (ctx->key_update_request) {
+		tls13_phh_update_local_traffic_secret(ctx);
+		ctx->key_update_request = 0;
+	}
+}
+
+static ssize_t
+tls13_phh_received_cb(void *cb_arg, CBS *cbs)
+{
+	ssize_t ret = TLS13_IO_FAILURE;
+	struct tls13_ctx *ctx = cb_arg;
+	CBS phh_cbs;
+
+	if (!tls13_phh_limit_check(ctx))
+		return tls13_send_alert(ctx->rl, SSL3_AD_UNEXPECTED_MESSAGE);
+
+	if ((ctx->hs_msg == NULL) &&
+	    ((ctx->hs_msg = tls13_handshake_msg_new()) == NULL))
+		return TLS13_IO_FAILURE;
+
+	if (!tls13_handshake_msg_set_buffer(ctx->hs_msg, cbs))
+		return TLS13_IO_FAILURE;
+
+	if ((ret = tls13_handshake_msg_recv(ctx->hs_msg, ctx->rl))
+	    != TLS13_IO_SUCCESS)
+		return ret;
+
+	if (!tls13_handshake_msg_content(ctx->hs_msg, &phh_cbs))
+		return TLS13_IO_FAILURE;
+
+	switch(tls13_handshake_msg_type(ctx->hs_msg)) {
+	case TLS13_MT_KEY_UPDATE:
+		ret = tls13_key_update_recv(ctx, &phh_cbs);
+		break;
+	case TLS13_MT_NEW_SESSION_TICKET:
+		/* XXX do nothing for now and ignore this */
+		break;
+	case TLS13_MT_CERTIFICATE_REQUEST:
+		/* XXX add support if we choose to advertise this */
+		/* FALLTHROUGH */
+	default:
+		ret = TLS13_IO_FAILURE; /* XXX send alert */
+		break;
+	}
+
+	tls13_handshake_msg_free(ctx->hs_msg);
+	ctx->hs_msg = NULL;
+	return ret;
+}
+
 struct tls13_ctx *
 tls13_ctx_new(int mode)
 {
@@ -101,8 +245,8 @@ tls13_ctx_new(int mode)
 	ctx->mode = mode;
 
 	if ((ctx->rl = tls13_record_layer_new(tls13_legacy_wire_read_cb,
-	    tls13_legacy_wire_write_cb, tls13_alert_received_cb, NULL, NULL,
-	    ctx)) == NULL)
+	    tls13_legacy_wire_write_cb, tls13_alert_received_cb,
+	    tls13_phh_received_cb, tls13_phh_done_cb, ctx)) == NULL)
 		goto err;
 
 	return ctx;