Skip to content

Commit 3b0b50e

Browse files
julek-wolfssljulek-wolfssl
committed
DTLS1.3: Implement RFC 9147 legacy_session_id_echo requirements
1 parent c9c2376 commit 3b0b50e

4 files changed

Lines changed: 153 additions & 19 deletions

File tree

‎src/dtls.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -857,9 +857,9 @@ static int SendStatelessReplyDtls13(const WOLFSSL* ssl, WolfSSL_CH* ch)
857857
nonConstSSL->options.tls1_1 = 1;
858858
nonConstSSL->options.tls1_3 = 1;
859859

860-
XMEMCPY(nonConstSSL->session->sessionID, ch->sessionId.elements,
861-
ch->sessionId.size);
862-
nonConstSSL->session->sessionIDSz = (byte)ch->sessionId.size;
860+
/* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
861+
* legacy_session_id_echo. Don't copy the client's session ID. */
862+
nonConstSSL->session->sessionIDSz = 0;
863863
nonConstSSL->options.cipherSuite0 = cs.cipherSuite0;
864864
nonConstSSL->options.cipherSuite = cs.cipherSuite;
865865
nonConstSSL->extensions = parsedExts;

‎src/tls13.c‎

Lines changed: 60 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4647,6 +4647,13 @@ int SendTls13ClientHello(WOLFSSL* ssl)
46474647
ssl->session->sessionIDSz = 0;
46484648
ssl->options.tls13MiddleBoxCompat = 0;
46494649
}
4650+
#endif
4651+
#ifdef WOLFSSL_DTLS13
4652+
if (ssl->options.dtls) {
4653+
/* RFC 9147 Section 5: DTLS implementations do not use the
4654+
* TLS 1.3 "compatibility mode" */
4655+
ssl->options.tls13MiddleBoxCompat = 0;
4656+
}
46504657
#endif
46514658
GetTls13SessionId(ssl, NULL, &sessIdSz);
46524659
args->length += (word16)sessIdSz;
@@ -5590,16 +5597,25 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
55905597
}
55915598
else
55925599
#endif /* WOLFSSL_TLS13_MIDDLEBOX_COMPAT */
5600+
#if defined(WOLFSSL_QUIC) || defined(WOLFSSL_DTLS13)
5601+
if (0
55935602
#ifdef WOLFSSL_QUIC
5594-
if (WOLFSSL_IS_QUIC(ssl)) {
5603+
|| WOLFSSL_IS_QUIC(ssl)
5604+
#endif
5605+
#ifdef WOLFSSL_DTLS13
5606+
|| ssl->options.dtls
5607+
#endif
5608+
) {
5609+
/* RFC 9147 Section 5.3 / RFC 9001 Section 8.4: DTLS 1.3 and QUIC
5610+
* ServerHello must have empty legacy_session_id_echo. */
55955611
if (args->sessIdSz != 0) {
55965612
WOLFSSL_MSG("args->sessIdSz != 0");
55975613
WOLFSSL_ERROR_VERBOSE(INVALID_PARAMETER);
55985614
return INVALID_PARAMETER;
55995615
}
56005616
}
56015617
else
5602-
#endif /* WOLFSSL_QUIC */
5618+
#endif /* WOLFSSL_QUIC || WOLFSSL_DTLS13 */
56035619
if (args->sessIdSz != ssl->session->sessionIDSz || (args->sessIdSz > 0 &&
56045620
XMEMCMP(ssl->session->sessionID, args->sessId, args->sessIdSz) != 0))
56055621
{
@@ -6562,6 +6578,7 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie)
65626578
word16 length;
65636579
int keyShareExt = 0;
65646580
int ret;
6581+
byte sessIdSz;
65656582

65666583
ret = TlsCheckCookie(ssl, cookie->data, (byte)cookie->len);
65676584
if (ret < 0)
@@ -6586,7 +6603,13 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie)
65866603
return ret;
65876604

65886605
/* Reconstruct the HelloRetryMessage for handshake hash. */
6589-
length = HRR_BODY_SZ - ID_LEN + ssl->session->sessionIDSz +
6606+
sessIdSz = ssl->session->sessionIDSz;
6607+
#ifdef WOLFSSL_DTLS13
6608+
/* RFC 9147 Section 5.3: DTLS 1.3 must use empty legacy_session_id. */
6609+
if (ssl->options.dtls)
6610+
sessIdSz = 0;
6611+
#endif
6612+
length = HRR_BODY_SZ - ID_LEN + sessIdSz +
65906613
HRR_COOKIE_HDR_SZ + cookie->len;
65916614
length += HRR_VERSIONS_SZ;
65926615
/* HashSz (1 byte) + Hash (HashSz bytes) + CipherSuite (2 bytes) */
@@ -6613,10 +6636,10 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie)
66136636
XMEMCPY(hrr + hrrIdx, helloRetryRequestRandom, RAN_LEN);
66146637
hrrIdx += RAN_LEN;
66156638

6616-
hrr[hrrIdx++] = ssl->session->sessionIDSz;
6617-
if (ssl->session->sessionIDSz > 0) {
6618-
XMEMCPY(hrr + hrrIdx, ssl->session->sessionID, ssl->session->sessionIDSz);
6619-
hrrIdx += ssl->session->sessionIDSz;
6639+
hrr[hrrIdx++] = sessIdSz;
6640+
if (sessIdSz > 0) {
6641+
XMEMCPY(hrr + hrrIdx, ssl->session->sessionID, sessIdSz);
6642+
hrrIdx += sessIdSz;
66206643
}
66216644

66226645
/* Restore the cipher suite from the cookie. */
@@ -6629,7 +6652,7 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie)
66296652
hrr[hrrIdx++] = 0;
66306653

66316654
/* Extensions' length */
6632-
length -= HRR_BODY_SZ - ID_LEN + ssl->session->sessionIDSz;
6655+
length -= HRR_BODY_SZ - ID_LEN + sessIdSz;
66336656
c16toa(length, hrr + hrrIdx);
66346657
hrrIdx += 2;
66356658

@@ -7054,9 +7077,20 @@ int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
70547077
if (sessIdSz + args->idx > helloSz)
70557078
ERROR_OUT(BUFFER_ERROR, exit_dch);
70567079

7057-
ssl->session->sessionIDSz = sessIdSz;
7058-
if (sessIdSz > 0)
7059-
XMEMCPY(ssl->session->sessionID, input + args->idx, sessIdSz);
7080+
#ifdef WOLFSSL_DTLS13
7081+
/* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
7082+
* legacy_session_id_echo. Don't store the client's value so it
7083+
* won't be echoed in SendTls13ServerHello. */
7084+
if (ssl->options.dtls) {
7085+
ssl->session->sessionIDSz = 0;
7086+
}
7087+
else
7088+
#endif
7089+
{
7090+
ssl->session->sessionIDSz = sessIdSz;
7091+
if (sessIdSz > 0)
7092+
XMEMCPY(ssl->session->sessionID, input + args->idx, sessIdSz);
7093+
}
70607094
args->idx += sessIdSz;
70617095

70627096
#ifdef WOLFSSL_TLS13_MIDDLEBOX_COMPAT
@@ -7629,10 +7663,21 @@ int SendTls13ServerHello(WOLFSSL* ssl, byte extMsgType)
76297663
WOLFSSL_BUFFER(ssl->arrays->serverRandom, RAN_LEN);
76307664
#endif
76317665

7632-
output[idx++] = ssl->session->sessionIDSz;
7633-
if (ssl->session->sessionIDSz > 0) {
7634-
XMEMCPY(output + idx, ssl->session->sessionID, ssl->session->sessionIDSz);
7635-
idx += ssl->session->sessionIDSz;
7666+
#ifdef WOLFSSL_DTLS13
7667+
if (ssl->options.dtls) {
7668+
/* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
7669+
* legacy_session_id_echo. */
7670+
output[idx++] = 0;
7671+
}
7672+
else
7673+
#endif
7674+
{
7675+
output[idx++] = ssl->session->sessionIDSz;
7676+
if (ssl->session->sessionIDSz > 0) {
7677+
XMEMCPY(output + idx, ssl->session->sessionID,
7678+
ssl->session->sessionIDSz);
7679+
idx += ssl->session->sessionIDSz;
7680+
}
76367681
}
76377682

76387683
/* Chosen cipher suite */

‎tests/api/test_dtls.c‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2727,3 +2727,90 @@ int test_dtls13_min_rtx_interval(void)
27272727
#endif
27282728
return EXPECT_RESULT();
27292729
}
2730+
2731+
/* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
2732+
* legacy_session_id_echo, even if the ClientHello had a non-empty
2733+
* legacy_session_id. */
2734+
int test_dtls13_no_session_id_echo(void)
2735+
{
2736+
EXPECT_DECLS;
2737+
#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS13) && \
2738+
defined(HAVE_SESSION_TICKET)
2739+
struct test_memio_ctx test_ctx;
2740+
WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL;
2741+
WOLFSSL *ssl_c = NULL, *ssl_s = NULL;
2742+
WOLFSSL_SESSION *sess = NULL;
2743+
char readBuf[1];
2744+
/* Use traditional groups to avoid HRR from PQ key share mismatch */
2745+
int groups[] = {
2746+
WOLFSSL_ECC_SECP256R1,
2747+
WOLFSSL_ECC_SECP384R1,
2748+
};
2749+
2750+
/* First connection: complete a DTLS 1.3 handshake to get a session */
2751+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2752+
ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
2753+
wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method), 0);
2754+
ExpectIntEQ(wolfSSL_set_groups(ssl_c, groups, 2), WOLFSSL_SUCCESS);
2755+
ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
2756+
2757+
/* Read to process any NewSessionTicket */
2758+
ExpectIntEQ(wolfSSL_read(ssl_c, readBuf, sizeof(readBuf)), -1);
2759+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), WOLFSSL_ERROR_WANT_READ);
2760+
2761+
ExpectNotNull(sess = wolfSSL_get1_session(ssl_c));
2762+
2763+
/* Ensure the session has a non-empty session ID so the ClientHello
2764+
* will have a populated legacy_session_id field (which is legal per
2765+
* RFC 9147). */
2766+
if (sess->sessionIDSz == 0) {
2767+
sess->sessionIDSz = ID_LEN;
2768+
XMEMSET(sess->sessionID, 0x42, ID_LEN);
2769+
}
2770+
2771+
wolfSSL_free(ssl_c); ssl_c = NULL;
2772+
wolfSSL_free(ssl_s); ssl_s = NULL;
2773+
wolfSSL_CTX_free(ctx_c); ctx_c = NULL;
2774+
wolfSSL_CTX_free(ctx_s); ctx_s = NULL;
2775+
2776+
/* Second connection: set the session on the client so the ClientHello
2777+
* contains a non-empty legacy_session_id. Verify the server does NOT
2778+
* echo it in the ServerHello. */
2779+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2780+
ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
2781+
wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method), 0);
2782+
ExpectIntEQ(wolfSSL_set_session(ssl_c, sess), WOLFSSL_SUCCESS);
2783+
/* Use traditional groups to avoid HRR from key share mismatch */
2784+
ExpectIntEQ(wolfSSL_set_groups(ssl_c, groups, 2), WOLFSSL_SUCCESS);
2785+
/* Disable HRR cookie so the server directly sends a ServerHello */
2786+
ExpectIntEQ(wolfSSL_disable_hrr_cookie(ssl_s), WOLFSSL_SUCCESS);
2787+
2788+
/* Client sends ClientHello (with non-empty legacy_session_id) */
2789+
ExpectIntEQ(wolfSSL_negotiate(ssl_c), -1);
2790+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), WOLFSSL_ERROR_WANT_READ);
2791+
2792+
/* Server processes ClientHello and sends ServerHello + flight */
2793+
ExpectIntEQ(wolfSSL_negotiate(ssl_s), -1);
2794+
ExpectIntEQ(wolfSSL_get_error(ssl_s, -1), WOLFSSL_ERROR_WANT_READ);
2795+
2796+
/* Verify the ServerHello on the wire.
2797+
* Layout: DTLS Record Header (13) + DTLS Handshake Header (12) +
2798+
* ProtocolVersion (2) + Random (32) = offset 59 for
2799+
* legacy_session_id_echo length byte. */
2800+
ExpectIntGE(test_ctx.c_len, 60);
2801+
ExpectIntEQ(test_ctx.c_buff[0], handshake);
2802+
ExpectIntEQ(test_ctx.c_buff[DTLS_RECORD_HEADER_SZ], server_hello);
2803+
ExpectIntEQ(test_ctx.c_buff[DTLS_RECORD_HEADER_SZ +
2804+
DTLS_HANDSHAKE_HEADER_SZ + OPAQUE16_LEN + RAN_LEN], 0);
2805+
2806+
/* Complete the handshake */
2807+
ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
2808+
2809+
wolfSSL_SESSION_free(sess);
2810+
wolfSSL_free(ssl_c);
2811+
wolfSSL_free(ssl_s);
2812+
wolfSSL_CTX_free(ctx_c);
2813+
wolfSSL_CTX_free(ctx_s);
2814+
#endif
2815+
return EXPECT_RESULT();
2816+
}

‎tests/api/test_dtls.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ int test_dtls_memio_wolfio_stateless(void);
5252
int test_dtls_mtu_fragment_headroom(void);
5353
int test_dtls_mtu_split_messages(void);
5454
int test_dtls13_min_rtx_interval(void);
55+
int test_dtls13_no_session_id_echo(void);
5556

5657
#define TEST_DTLS_DECLS \
5758
TEST_DECL_GROUP("dtls", test_dtls12_basic_connection_id), \
@@ -83,5 +84,6 @@ int test_dtls13_min_rtx_interval(void);
8384
TEST_DECL_GROUP("dtls", test_dtls_mtu_fragment_headroom), \
8485
TEST_DECL_GROUP("dtls", test_dtls_mtu_split_messages), \
8586
TEST_DECL_GROUP("dtls", test_dtls_memio_wolfio_stateless), \
86-
TEST_DECL_GROUP("dtls", test_dtls13_min_rtx_interval)
87+
TEST_DECL_GROUP("dtls", test_dtls13_min_rtx_interval), \
88+
TEST_DECL_GROUP("dtls", test_dtls13_no_session_id_echo)
8789
#endif /* TESTS_API_DTLS_H */

0 commit comments

Comments
 (0)