Merge branch 'peterdmv/ssl/psk' into maint

* peterdmv/ssl/psk:
  ssl: Reorder testcases in ssl_api_SUITE
  ssl: Fix handshake pause in TLS 1.3
  ssl: Implement option honor_cipher_order in TLS 1.3
  ssl: Add test for option supported_groups
  ssl: Document option supported_groups
  ssl: Fix ssl_api_SUITE:connection_information
  ssl: Fix property tests for SSLv3
  ssl: Update property tests with pre_shared_key
  ssl: Implement pre_shared_key extension
  ssl: Update property tests with psk_key_exchange_modes
  ssl: Implement psk_key_exchange_modes extension

2 files changed, 184 insertions, 32 deletions

diff --git a/lib/ssl/test/property_test/ssl_eqc_handshake.erl b/lib/ssl/test/property_test/ssl_eqc_handshake.erl
index 21aad26425..2ceb540e15 100644
--- a/lib/ssl/test/property_test/ssl_eqc_handshake.erl
+++ b/lib/ssl/test/property_test/ssl_eqc_handshake.erl
@@ -119,11 +119,11 @@ tls_msg(Version) ->
 %%
 client_hello(?'TLS_v1.3' = Version) ->
     #client_hello{session_id = session_id(),
-		  client_version = ?'TLS_v1.2',
-		  cipher_suites = cipher_suites(Version),
-		  compression_methods = compressions(Version),
-		  random = client_random(Version),
-		  extensions = client_hello_extensions(Version)    
+                  client_version = ?'TLS_v1.2',
+                  cipher_suites = cipher_suites(Version),
+                  compression_methods = compressions(Version),
+                  random = client_random(Version),
+                  extensions = client_hello_extensions(Version)
                  };
 client_hello(Version) ->
     #client_hello{session_id = session_id(),
@@ -139,7 +139,7 @@ client_hello(?'SSL_v3' = Version) ->
                   cipher_suites = cipher_suites(Version),
 		  compression_methods = compressions(Version),
 		  random = client_random(Version),
-		  extensions = undefined
+		  extensions = ssl_handshake:empty_extensions(Version, client_hello)
                  }.
 
 server_hello(?'TLS_v1.3' = Version) ->
@@ -156,7 +156,7 @@ server_hello(?'SSL_v3' = Version) ->
                   random = server_random(Version),
                   cipher_suite = cipher_suite(Version),
 		  compression_method = compression(Version),
-		  extensions = undefined
+		  extensions = ssl_handshake:empty_extensions(Version, server_hello)
                  };
 server_hello(Version) ->
     #server_hello{server_version = Version,
@@ -307,7 +307,7 @@ pre_shared_keyextension() ->
 %% |                                                  |             |
 %% | signature_algorithms_cert (RFC 8446)             |      CH, CR |
 %% +--------------------------------------------------+-------------+
-extensions(?'TLS_v1.3' = Version, client_hello) ->
+extensions(?'TLS_v1.3' = Version, MsgType = client_hello) ->
      ?LET({
            ServerName,
            %% MaxFragmentLength,
@@ -322,8 +322,8 @@ extensions(?'TLS_v1.3' = Version, client_hello) ->
            %% ServerCertificateType,
            %% Padding,
            KeyShare,
-           %% PreSharedKey,
-           %% PSKKeyExchangeModes,
+           PreSharedKey,
+           PSKKeyExchangeModes,
            %% EarlyData,
            %% Cookie,
            SupportedVersions,
@@ -344,9 +344,9 @@ extensions(?'TLS_v1.3' = Version, client_hello) ->
            %% oneof([client_cert_type(), undefined]),
            %% oneof([server_cert_type(), undefined]),
            %% oneof([padding(), undefined]),
-           oneof([key_share(client_hello), undefined]),
-           %% oneof([pre_shared_key(), undefined]),
-           %% oneof([psk_key_exchange_modes(), undefined]),
+           oneof([key_share(MsgType), undefined]),
+           oneof([pre_shared_key(MsgType), undefined]),
+           oneof([psk_key_exchange_modes(), undefined]),
            %% oneof([early_data(), undefined]),
            %% oneof([cookie(), undefined]),
            oneof([client_hello_versions(Version)]),
@@ -373,8 +373,8 @@ extensions(?'TLS_v1.3' = Version, client_hello) ->
                         %% server_cert_type => ServerCertificateType,
                         %% padding => Padding,
                         key_share => KeyShare,
-                        %% pre_shared_key => PreSharedKey,
-                        %% psk_key_exhange_modes => PSKKeyExchangeModes,
+                        pre_shared_key => PreSharedKey,
+                        psk_key_exchange_modes => PSKKeyExchangeModes,
                         %% early_data => EarlyData,
                         %% cookie => Cookie,
                         client_hello_versions => SupportedVersions,
@@ -417,15 +417,15 @@ extensions(Version, client_hello) ->
                        srp => SRP
                        %% renegotiation_info => RenegotiationInfo
                       }));
-extensions(?'TLS_v1.3' = Version, server_hello) ->
+extensions(?'TLS_v1.3' = Version, MsgType = server_hello) ->
     ?LET({
           KeyShare,
-          %% PreSharedKeys,
+          PreSharedKey,
           SupportedVersions
          },
          {
-          oneof([key_share(server_hello), undefined]),
-          %% oneof([pre_shared_keys(),  undefined]),
+          oneof([key_share(MsgType), undefined]),
+          oneof([pre_shared_key(MsgType),  undefined]),
           oneof([server_hello_selected_version()])
          },
          maps:filter(fun(_, undefined) ->
@@ -435,7 +435,7 @@ extensions(?'TLS_v1.3' = Version, server_hello) ->
                      end,
                      #{
                        key_share => KeyShare,
-                       %% pre_shared_keys => PreSharedKeys,
+                       pre_shared_key => PreSharedKey,
                        server_hello_selected_version => SupportedVersions
                       }));
 extensions(Version, server_hello) ->
@@ -826,3 +826,58 @@ group_list(N, Pool, Acc) ->
     R = rand:uniform(length(Pool)),
     G = lists:nth(R, Pool),
     group_list(N - 1, Pool -- [G], [G|Acc]).
+
+
+ke_modes() ->
+    oneof([[psk_ke],[psk_dhe_ke],[psk_ke,psk_dhe_ke]]).
+
+psk_key_exchange_modes() ->
+    ?LET(KEModes, ke_modes(),
+         #psk_key_exchange_modes{
+            ke_modes = KEModes}).
+
+pre_shared_key(client_hello) ->
+    ?LET(OfferedPsks, offered_psks(),
+         #pre_shared_key_client_hello{
+            offered_psks = OfferedPsks});
+pre_shared_key(server_hello) ->
+    ?LET(SelectedIdentity, selected_identity(),
+         #pre_shared_key_server_hello{
+           selected_identity = SelectedIdentity}).
+
+selected_identity() ->
+    rand:uniform(32).
+
+offered_psks() ->
+    ?LET(Size, choose(1,5),
+         #offered_psks{
+            identities = psk_identities(Size),
+            binders = psk_binders(Size)}).
+
+psk_identities(Size) ->
+    psk_identities(Size, []).
+%%
+psk_identities(0, Acc) ->
+    Acc;
+psk_identities(N, Acc) ->
+    psk_identities(N - 1, [psk_identity()|Acc]).
+
+psk_identity() ->
+    Len = rand:uniform(32),
+    Identity = crypto:strong_rand_bytes(Len),
+    Age = crypto:strong_rand_bytes(4),
+    #psk_identity{
+      identity = Identity,
+      obfuscated_ticket_age = Age}.
+
+psk_binders(Size) ->
+    psk_binders(Size, []).
+%%
+psk_binders(0, Acc) ->
+    Acc;
+psk_binders(N, Acc) ->
+    psk_binders(N - 1, [psk_binder()|Acc]).
+
+psk_binder() ->
+    Len = rand:uniform(224) + 31,
+    crypto:strong_rand_bytes(Len).
diff --git a/lib/ssl/test/ssl_api_SUITE.erl b/lib/ssl/test/ssl_api_SUITE.erl
index 74e18122a6..fefecc0b65 100644
--- a/lib/ssl/test/ssl_api_SUITE.erl
+++ b/lib/ssl/test/ssl_api_SUITE.erl
@@ -44,8 +44,7 @@ all() ->
 
 groups() ->
     [
-     %%{'tlsv1.3', [], gen_api_tests() ++ handshake_paus_tests()},
-     {'tlsv1.3', [], (gen_api_tests() -- [secret_connection_info, dh_params, honor_server_cipher_order, honor_client_cipher_order,
+     {'tlsv1.3', [], ((gen_api_tests() ++ tls13_group() ++ handshake_paus_tests()) -- [dh_params, honor_server_cipher_order, honor_client_cipher_order,
                                         new_options_in_handshake])
       ++ (since_1_2() -- [conf_signature_algs])},
      {'tlsv1.2', [],  gen_api_tests() ++ since_1_2() ++ handshake_paus_tests() ++ pre_1_3()},
@@ -124,6 +123,14 @@ beast_mitigation_test() ->
      rizzo_one_n_minus_one 
     ].
 
+tls13_group() ->
+    [
+     supported_groups,
+     honor_server_cipher_order_tls13,
+     honor_client_cipher_order_tls13
+    ].
+
+
 init_per_suite(Config0) ->
     catch crypto:stop(),
     try crypto:start() of
@@ -418,7 +425,6 @@ no_common_signature_algs(Config) when is_list(Config) ->
     ssl_test_lib:check_server_alert(Server, Client, insufficient_security).
 
 %%--------------------------------------------------------------------
-
 handshake_continue() ->
     [{doc, "Test API function ssl:handshake_continue/3"}].
 handshake_continue(Config) when is_list(Config) -> 
@@ -1166,10 +1172,11 @@ honor_server_cipher_order(Config) when is_list(Config) ->
                        cipher => aes_128_cbc, 
                        mac => sha,
                        prf => default_prf}],
-    honor_cipher_order(Config, true, ServerCiphers, ClientCiphers, #{key_exchange => dhe_rsa, 
-                                                                     cipher => aes_256_cbc, 
+    honor_cipher_order(Config, true, ServerCiphers, ClientCiphers, #{key_exchange => dhe_rsa,
+                                                                     cipher => aes_256_cbc,
                                                                      mac => sha,
                                                                      prf => default_prf}).
+
 %%--------------------------------------------------------------------
 honor_client_cipher_order() ->
     [{doc,"Test API honor server cipher order."}].
@@ -1190,10 +1197,11 @@ honor_client_cipher_order(Config) when is_list(Config) ->
                        cipher => aes_128_cbc, 
                        mac => sha,
                        prf => default_prf}],
-honor_cipher_order(Config, false, ServerCiphers, ClientCiphers, #{key_exchange => dhe_rsa, 
-                                                                  cipher => aes_128_cbc, 
-                                                                  mac => sha,
-                                                                  prf => default_prf}).
+    honor_cipher_order(Config, false, ServerCiphers, ClientCiphers, #{key_exchange => dhe_rsa,
+                                                                      cipher => aes_128_cbc,
+                                                                      mac => sha,
+                                                                      prf => default_prf}).
+
 %%--------------------------------------------------------------------
 ipv6() ->
     [{require, ipv6_hosts},
@@ -1560,6 +1568,82 @@ rizzo_one_n_minus_one (Config) ->
     
     ssl_test_lib:basic_test(ClientOpts, ServerOpts, Config).
 
+supported_groups() ->
+    [{doc,"Test the supported_groups option in TLS 1.3."}].
+
+supported_groups(Config) when is_list(Config) ->
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
+                                        {mfa, {ssl_test_lib, send_recv_result_active, []}},
+                                        {options, [{supported_groups, [x448, x25519]} | ServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+					{host, Hostname},
+                                        {from, self()},
+                                        {mfa, {ssl_test_lib, send_recv_result_active, []}},
+                                        {options, [{supported_groups,[x448]} | ClientOpts]}]),
+
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client).
+
+%%--------------------------------------------------------------------
+honor_client_cipher_order_tls13() ->
+    [{doc,"Test API honor server cipher order in TLS 1.3."}].
+honor_client_cipher_order_tls13(Config) when is_list(Config) ->
+    ClientCiphers = [#{key_exchange => any,
+                       cipher => aes_256_gcm,
+                       mac => aead,
+                       prf => sha384},
+                     #{key_exchange => any,
+                       cipher => aes_128_gcm,
+                       mac => aead,
+                       prf => sha256}],
+    ServerCiphers = [#{key_exchange => any,
+                       cipher => aes_128_gcm,
+                       mac => aead,
+                       prf => sha256},
+                     #{key_exchange => any,
+                       cipher => aes_256_gcm,
+                       mac => aead,
+                       prf => sha384}],
+    honor_cipher_order(Config, false, ServerCiphers, ClientCiphers, #{key_exchange => any,
+                                                                      cipher => aes_256_gcm,
+                                                                      mac => aead,
+                                                                      prf => sha384}).
+
+%%--------------------------------------------------------------------
+honor_server_cipher_order_tls13() ->
+    [{doc,"Test API honor server cipher order in TLS 1.3."}].
+honor_server_cipher_order_tls13(Config) when is_list(Config) ->
+    ClientCiphers = [#{key_exchange => any,
+                       cipher => aes_256_gcm,
+                       mac => aead,
+                       prf => sha384},
+                     #{key_exchange => any,
+                       cipher => aes_128_gcm,
+                       mac => aead,
+                       prf => sha256}],
+    ServerCiphers = [#{key_exchange => any,
+                       cipher => aes_128_gcm,
+                       mac => aead,
+                       prf => sha256},
+                     #{key_exchange => any,
+                       cipher => aes_256_gcm,
+                       mac => aead,
+                       prf => sha384}],
+    honor_cipher_order(Config, true, ServerCiphers, ClientCiphers, #{key_exchange => any,
+                                                                     cipher => aes_128_gcm,
+                                                                     mac => aead,
+                                                                     prf => sha256}).
+
+
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------
@@ -1578,10 +1662,23 @@ connection_information_result(Socket) ->
 	    ct:fail(no_ssl_options_returned)
     end.
 secret_connection_info_result(Socket) ->
-    {ok, [{client_random, ClientRand}, {server_random, ServerRand}, {master_secret, MasterSecret}]} 
-        = ssl:connection_information(Socket, [client_random, server_random, master_secret]),
-    is_binary(ClientRand) andalso is_binary(ServerRand) andalso is_binary(MasterSecret). 
+    {ok, [{protocol, Protocol}]} = ssl:connection_information(Socket, [protocol]),
+    {ok, ConnInfo} = ssl:connection_information(Socket, [client_random, server_random, master_secret]),
+    check_connection_info(Protocol, ConnInfo).
   
+
+%% In TLS 1.3 the master_secret field is used to store multiple secrets from the key schedule and it is a tuple.
+%% client_random and server_random are not used in the TLS 1.3 key schedule.
+check_connection_info('tlsv1.3', [{client_random, ClientRand}, {master_secret, {master_secret, MasterSecret}}]) ->
+    is_binary(ClientRand) andalso is_binary(MasterSecret);
+check_connection_info('tlsv1.3', [{server_random, ServerRand}, {master_secret, {master_secret, MasterSecret}}]) ->
+    is_binary(ServerRand) andalso is_binary(MasterSecret);
+check_connection_info(_, [{client_random, ClientRand}, {server_random, ServerRand}, {master_secret, MasterSecret}]) ->
+    is_binary(ClientRand) andalso is_binary(ServerRand) andalso is_binary(MasterSecret);
+check_connection_info(_, _) ->
+    false.
+
+
 prf_create_plan(TlsVersions, PRFs, Results) ->
     lists:foldl(fun(Ver, Acc) ->
                         A = prf_ciphers_and_expected(Ver, PRFs, Results),