int tls13_process_finished(SSL *ssl) {
uint8_t verify_data[EVP_MAX_MD_SIZE];
size_t verify_data_len;
if (!tls13_finished_mac(ssl, verify_data, &verify_data_len, !ssl->server)) {
return 0;
}
if (ssl->init_num != verify_data_len ||
CRYPTO_memcmp(verify_data, ssl->init_msg, verify_data_len) != 0) {
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED);
return 0;
}
return 1;
}
static enum ssl_hs_wait_t do_send_server_finished(SSL_HANDSHAKE *hs) {
SSL *const ssl = hs->ssl;
if (!tls13_add_finished(hs) ||
/* Update the secret to the master secret and derive traffic keys. */
!tls13_advance_key_schedule(hs, kZeroes, hs->hash_len) ||
!tls13_derive_application_secrets(hs) ||
!tls13_set_traffic_key(ssl, evp_aead_seal, hs->server_traffic_secret_0,
hs->hash_len)) {
return ssl_hs_error;
}
if (ssl->early_data_accepted) {
/* If accepting 0-RTT, we send tickets half-RTT. This gets the tickets on
* the wire sooner and also avoids triggering a write on |SSL_read| when
* processing the client Finished. This requires computing the client
* Finished early. See draft-ietf-tls-tls13-18, section 4.5.1. */
size_t finished_len;
if (!tls13_finished_mac(hs, hs->expected_client_finished, &finished_len,
0 /* client */)) {
return ssl_hs_error;
}
if (finished_len != hs->hash_len) {
OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
return ssl_hs_error;
}
/* Feed the predicted Finished into the transcript. This allows us to derive
* the resumption secret early and send half-RTT tickets.
*
* TODO(davidben): This will need to be updated for DTLS 1.3. */
assert(!SSL_is_dtls(hs->ssl));
uint8_t header[4] = {SSL3_MT_FINISHED, 0, 0, hs->hash_len};
if (!SSL_TRANSCRIPT_update(&hs->transcript, header, sizeof(header)) ||
!SSL_TRANSCRIPT_update(&hs->transcript, hs->expected_client_finished,
hs->hash_len) ||
!tls13_derive_resumption_secret(hs) ||
!add_new_session_tickets(hs)) {
return ssl_hs_error;
}
}
hs->tls13_state = state_read_second_client_flight;
return ssl_hs_flush;
}
int tls13_prepare_finished(SSL *ssl) {
size_t verify_data_len;
uint8_t verify_data[EVP_MAX_MD_SIZE];
if (!tls13_finished_mac(ssl, verify_data, &verify_data_len, ssl->server)) {
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_INTERNAL_ERROR);
OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED);
return 0;
}
CBB cbb, body;
if (!ssl->method->init_message(ssl, &cbb, &body, SSL3_MT_FINISHED) ||
!CBB_add_bytes(&body, verify_data, verify_data_len) ||
!ssl->method->finish_message(ssl, &cbb)) {
CBB_cleanup(&cbb);
return 0;
}
return 1;
}
int tls13_process_finished(SSL *ssl) {
uint8_t verify_data[EVP_MAX_MD_SIZE];
size_t verify_data_len;
if (!tls13_finished_mac(ssl, verify_data, &verify_data_len, !ssl->server)) {
return 0;
}
int finished_ok =
ssl->init_num == verify_data_len &&
CRYPTO_memcmp(verify_data, ssl->init_msg, verify_data_len) == 0;
#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
finished_ok = 1;
#endif
if (!finished_ok) {
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_DECRYPT_ERROR);
OPENSSL_PUT_ERROR(SSL, SSL_R_DIGEST_CHECK_FAILED);
return 0;
}
return 1;
}
