ssl: Fix handling of TLS record versions

- Introduce new macro ALL_TLS_RECORD_VERSIONS to decouple
  ALL_AVAILABLE_VERSIONS from the list of valid TLS record
  versions. It consists of versions allowed in
  TLSCiphertext.version (TLS 1.2 and prior) and
  TLSCiphertext.legacy_record_version (TLS 1.3).

- TLS 1.3 sets TLSCiphertext.legacy_record_version to 0x0303
  for all records generated other than an initial ClientHello,
  where it MAY also be 0x0301.

- TLSPlaintext.legacy_record_version is ignored.

Change-Id: Iabb1a954ab21f8be012e6460ae99ab533e31e123

2 files changed, 23 insertions, 5 deletions

diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 3428009573..2e1a928a62 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -72,11 +72,21 @@
 -define(FALSE, 1).
 
 %% sslv3 is considered insecure due to lack of padding check (Poodle attack)
-%% Keep as interop with legacy software but do not support as default 
+%% Keep as interop with legacy software but do not support as default
+%% tlsv1.3 is under development (experimental).
 -define(ALL_AVAILABLE_VERSIONS, ['tlsv1.3', 'tlsv1.2', 'tlsv1.1', tlsv1, sslv3]).
 -define(ALL_AVAILABLE_DATAGRAM_VERSIONS, ['dtlsv1.2', dtlsv1]).
--define(ALL_SUPPORTED_VERSIONS, ['tlsv1.3', 'tlsv1.2', 'tlsv1.1', tlsv1]).
+%% Defines the default versions when not specified by an ssl option.
+-define(ALL_SUPPORTED_VERSIONS, ['tlsv1.2', 'tlsv1.1', tlsv1]).
 -define(MIN_SUPPORTED_VERSIONS, ['tlsv1.1', tlsv1]).
+
+%% Versions allowed in TLSCiphertext.version (TLS 1.2 and prior) and
+%% TLSCiphertext.legacy_record_version (TLS 1.3).
+%% TLS 1.3 sets TLSCiphertext.legacy_record_version to 0x0303 for all records
+%% generated other than an than an initial ClientHello, where it MAY also be 0x0301.
+%% Thus, the allowed range is limited to 0x0300 - 0x0303.
+-define(ALL_TLS_RECORD_VERSIONS, ['tlsv1.2', 'tlsv1.1', tlsv1, sslv3]).
+
 -define(ALL_DATAGRAM_SUPPORTED_VERSIONS, ['dtlsv1.2', dtlsv1]).
 -define(MIN_DATAGRAM_SUPPORTED_VERSIONS, [dtlsv1]).
 
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 1a0a9b9275..8320d3f7f3 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -679,8 +679,8 @@ initial_state(Role, Host, Port, Socket, {SSLOptions, SocketOptions, Tracker}, Us
 next_tls_record(Data, StateName, #state{protocol_buffers = 
                                             #protocol_buffers{tls_record_buffer = Buf0,
                                                               tls_cipher_texts = CT0} = Buffers,
-                                       ssl_options = SslOpts} = State0) ->
-    case tls_record:get_tls_records(Data, 
+                                        ssl_options = SslOpts} = State0) ->
+    case tls_record:get_tls_records(Data,
                                     acceptable_record_versions(StateName, State0),
                                     Buf0, SslOpts) of
 	{Records, Buf1} ->
@@ -693,10 +693,18 @@ next_tls_record(Data, StateName, #state{protocol_buffers =
     end.
 
 
+%% TLS 1.3 Client/Server
+%% - Ignore TLSPlaintext.legacy_record_version
+%% - Verify that TLSCiphertext.legacy_record_version is set to  0x0303 for all records
+%%   other than an initial ClientHello, where it MAY also be 0x0301.
 acceptable_record_versions(hello, _) ->
-    [tls_record:protocol_version(Vsn) || Vsn <- ?ALL_AVAILABLE_VERSIONS];
+    [tls_record:protocol_version(Vsn) || Vsn <- ?ALL_TLS_RECORD_VERSIONS];
+acceptable_record_versions(_, #state{negotiated_version = {Major, Minor}})
+  when Major > 3; Major =:= 3, Minor >= 4 ->
+    [{3, 3}];
 acceptable_record_versions(_, #state{negotiated_version = Version}) ->
     [Version].
+
 handle_record_alert(Alert, _) ->
     Alert.