Branch data     Line data    Source code

       1                 :            : /*
       2                 :            :  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
       3                 :            :  *
       4                 :            :  * Licensed under the Apache License, Version 2.0 (the "License").
       5                 :            :  * You may not use this file except in compliance with the License.
       6                 :            :  * A copy of the License is located at
       7                 :            :  *
       8                 :            :  *  http://aws.amazon.com/apache2.0
       9                 :            :  *
      10                 :            :  * or in the "license" file accompanying this file. This file is distributed
      11                 :            :  * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
      12                 :            :  * express or implied. See the License for the specific language governing
      13                 :            :  * permissions and limitations under the License.
      14                 :            :  */
      15                 :            : 
      16                 :            : #include "api/s2n.h"
      17                 :            : #include "tls/extensions/s2n_early_data_indication.h"
      18                 :            : #include "tls/s2n_connection.h"
      19                 :            : #include "tls/s2n_early_data.h"
      20                 :            : #include "tls/s2n_handshake.h"
      21                 :            : #include "utils/s2n_safety.h"
      22                 :            : 
      23                 :            : static bool s2n_server_early_data_indication_should_send(struct s2n_connection *conn)
      24                 :         86 : {
      25 [ +  + ][ +  + ]:         86 :     return conn && conn->early_data_state == S2N_EARLY_DATA_ACCEPTED;
      26                 :         86 : }
      27                 :            : 
      28                 :            : /**
      29                 :            :  *= https://www.rfc-editor.org/rfc/rfc8446#section-4.2.10
      30                 :            :  *# A server which receives an "early_data" extension MUST behave in one
      31                 :            :  *# of three ways:
      32                 :            :  *#
      33                 :            :  *# -  Ignore the extension and return a regular 1-RTT response.
      34                 :            :  **/
      35                 :            : static int s2n_server_early_data_indication_is_missing(struct s2n_connection *conn)
      36                 :         36 : {
      37 [ #  # ][ -  + ]:         36 :     POSIX_ENSURE_REF(conn);
      38         [ +  + ]:         36 :     if (conn->early_data_state == S2N_EARLY_DATA_REQUESTED) {
      39         [ -  + ]:         27 :         POSIX_GUARD_RESULT(s2n_connection_set_early_data_state(conn, S2N_EARLY_DATA_REJECTED));
      40                 :         27 :     }
      41                 :         36 :     return S2N_SUCCESS;
      42                 :         36 : }
      43                 :            : 
      44                 :            : /**
      45                 :            :  * The server version of this extension is empty, so we don't read/write any data.
      46                 :            :  *
      47                 :            :  *= https://www.rfc-editor.org/rfc/rfc8446#section-4.2.10
      48                 :            :  *# The "extension_data" field of this extension contains an
      49                 :            :  *# "EarlyDataIndication" value.
      50                 :            :  *#
      51                 :            :  *#     struct {} Empty;
      52                 :            :  *#
      53                 :            :  *#     struct {
      54                 :            :  *#         select (Handshake.msg_type) {
      55                 :            :  **
      56                 :            :  *= https://www.rfc-editor.org/rfc/rfc8446#section-4.2.10
      57                 :            :  *#             case encrypted_extensions: Empty;
      58                 :            :  *#         };
      59                 :            :  *#     } EarlyDataIndication;
      60                 :            :  **/
      61                 :            : 
      62                 :            : /**
      63                 :            :  *= https://www.rfc-editor.org/rfc/rfc8446#section-4.2.10
      64                 :            :  *# A server which receives an "early_data" extension MUST behave in one
      65                 :            :  *# of three ways:
      66                 :            :  *
      67                 :            :  *= https://www.rfc-editor.org/rfc/rfc8446#section-4.2.10
      68                 :            :  *# -  Return its own "early_data" extension in EncryptedExtensions,
      69                 :            :  *#    indicating that it intends to process the early data.
      70                 :            :  **/
      71                 :            : 
      72                 :            : static int s2n_server_early_data_indication_send(struct s2n_connection *conn, struct s2n_stuffer *out)
      73                 :         46 : {
      74                 :         46 :     return S2N_SUCCESS;
      75                 :         46 : }
      76                 :            : 
      77                 :            : static int s2n_server_early_data_indication_recv(struct s2n_connection *conn, struct s2n_stuffer *in)
      78                 :         45 : {
      79                 :            :     /**
      80                 :            :      *= https://www.rfc-editor.org/rfc/rfc8446#section-4.2.10
      81                 :            :      *# If any of these checks fail, the server MUST NOT respond with the
      82                 :            :      *# extension
      83                 :            :      **/
      84 [ +  - ][ +  + ]:         45 :     POSIX_ENSURE(s2n_early_data_is_valid_for_connection(conn), S2N_ERR_EARLY_DATA_NOT_ALLOWED);
      85                 :            : 
      86         [ +  + ]:         44 :     POSIX_GUARD_RESULT(s2n_connection_set_early_data_state(conn, S2N_EARLY_DATA_ACCEPTED));
      87                 :            : 
      88                 :            :     /* The client does not know for sure whether the server accepted early data until it receives
      89                 :            :      * this extension as part of the EncryptedExtensions message, after the handshake type has
      90                 :            :      * already been calculated. We'll need to manually update the handshake type.
      91                 :            :      */
      92                 :         43 :     conn->handshake.handshake_type |= WITH_EARLY_DATA;
      93                 :            : 
      94                 :         43 :     return S2N_SUCCESS;
      95                 :         44 : }
      96                 :            : 
      97                 :            : const s2n_extension_type s2n_server_early_data_indication_extension = {
      98                 :            :     .iana_value = TLS_EXTENSION_EARLY_DATA,
      99                 :            :     .is_response = true,
     100                 :            :     .send = s2n_server_early_data_indication_send,
     101                 :            :     .recv = s2n_server_early_data_indication_recv,
     102                 :            :     .should_send = s2n_server_early_data_indication_should_send,
     103                 :            :     .if_missing = s2n_server_early_data_indication_is_missing,
     104                 :            : };