Merge branch 'peterdmv/ssl/hello-retry-request/OTP-15590'

* peterdmv/ssl/hello-retry-request/OTP-15590:
  ssl: Fix type spec for handshake_history()
  ssl: Add tests for hello_retry_request and groups
  ssl: Implement 'hello_retry_request'

Change-Id: I04ad2860d0ba81462a1e36c7d6fcee6bc5c98c32

5 files changed, 273 insertions, 96 deletions

diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 6b1e3b6e07..260f603e90 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -39,7 +39,7 @@
 -type oid()               :: tuple().
 -type public_key_params() :: #'Dss-Parms'{} |  {namedCurve, oid()} | #'ECParameters'{} | term().
 -type public_key_info()   :: {oid(), #'RSAPublicKey'{} | integer() | #'ECPoint'{}, public_key_params()}.
--type ssl_handshake_history() :: {[binary()], [binary()]}.
+-type ssl_handshake_history() :: {iodata(), iodata()}.
 
 -type ssl_handshake() :: #server_hello{} | #server_hello_done{} | #certificate{} | #certificate_request{} |
 			 #client_key_exchange{} | #finished{} | #certificate_verify{} |
@@ -76,7 +76,7 @@
 	 handle_client_hello_extensions/9, %% Returns server hello extensions
 	 handle_server_hello_extensions/9, select_curve/2, select_curve/3,
          select_hashsign/4, select_hashsign/5,
-	 select_hashsign_algs/3, empty_extensions/2, add_server_share/2
+	 select_hashsign_algs/3, empty_extensions/2, add_server_share/3
 	]).
 
 -export([get_cert_params/1]).
@@ -1150,12 +1150,18 @@ maybe_add_key_share(HelloExtensions, KeyShare) ->
     HelloExtensions#{key_share => #key_share_client_hello{
                                      client_shares = ClientShares}}.
 
-add_server_share(Extensions, KeyShare) ->
+add_server_share(server_hello, Extensions, KeyShare) ->
     #key_share_server_hello{server_share = ServerShare0} = KeyShare,
     %% Keep only public keys
     ServerShare = kse_remove_private_key(ServerShare0),
     Extensions#{key_share => #key_share_server_hello{
-                                server_share = ServerShare}}.
+                                server_share = ServerShare}};
+add_server_share(hello_retry_request, Extensions,
+                 #key_share_server_hello{
+                    server_share = #key_share_entry{group = Group}}) ->
+    Extensions#{key_share => #key_share_hello_retry_request{
+                                selected_group = Group}}.
+
 
 kse_remove_private_key(#key_share_entry{
                       group = Group,
diff --git a/lib/ssl/src/tls_connection_1_3.erl b/lib/ssl/src/tls_connection_1_3.erl
index de786d0875..71ac6a9310 100644
--- a/lib/ssl/src/tls_connection_1_3.erl
+++ b/lib/ssl/src/tls_connection_1_3.erl
@@ -113,27 +113,27 @@
          wait_finished/4
         ]).
 
-start(internal,
-      #client_hello{} = Hello,
-      #state{connection_states = _ConnectionStates0,
-	     ssl_options = #ssl_options{ciphers = _ServerCiphers,
-                                        signature_algs = _ServerSignAlgs,
-                                        signature_algs_cert = _SignatureSchemes, %% TODO: Check??
-                                        supported_groups = _ServerGroups0,
-                                        versions = _Versions} = SslOpts,
-             session = #session{own_certificate = Cert}} = State0,
-      _Module) ->
 
-    Env = #{cert => Cert},
-    case tls_handshake_1_3:handle_client_hello(Hello, SslOpts, Env) of
+start(internal,
+      #change_cipher_spec{} =  ChangeCipherSpec, State0, _Module) ->
+    case tls_handshake_1_3:do_start(ChangeCipherSpec, State0) of
         #alert{} = Alert ->
             ssl_connection:handle_own_alert(Alert, {3,4}, start, State0);
-        M ->
-            %% update connection_states with cipher
-            State = update_state(State0, M),
-            {next_state, negotiated, State, [{next_event, internal, M}]}
-
-    end.
+        State1 ->
+            {Record, State} = tls_connection:next_record(State1),
+            tls_connection:next_event(?FUNCTION_NAME, Record, State)
+    end;
+start(internal, #client_hello{} = Hello, State0, _Module) ->
+    case tls_handshake_1_3:do_start(Hello, State0) of
+        #alert{} = Alert ->
+            ssl_connection:handle_own_alert(Alert, {3,4}, start, State0);
+        {State, _, start} ->
+            {next_state, start, State, []};
+        {State, Context, negotiated} ->
+            {next_state, negotiated, State, [{next_event, internal, Context}]}
+    end;
+start(Type, Msg, State, Connection) ->
+    ssl_connection:handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection).
 
 
 negotiated(internal, Map, State0, _Module) ->
@@ -166,24 +166,3 @@ wait_finished(internal,
     end;
 wait_finished(Type, Msg, State, Connection) ->
     ssl_connection:handle_common_event(Type, Msg, ?FUNCTION_NAME, State, Connection).
-
-
-update_state(#state{connection_states = ConnectionStates0,
-                    connection_env = CEnv,
-                    session = Session} = State,
-             #{cipher := Cipher,
-               key_share := KeyShare,
-               session_id := SessionId}) ->
-    #{security_parameters := SecParamsR0} = PendingRead =
-        maps:get(pending_read, ConnectionStates0),
-    #{security_parameters := SecParamsW0} = PendingWrite =
-        maps:get(pending_write, ConnectionStates0),
-    SecParamsR = ssl_cipher:security_parameters_1_3(SecParamsR0, Cipher),
-    SecParamsW = ssl_cipher:security_parameters_1_3(SecParamsW0, Cipher),
-    ConnectionStates =
-        ConnectionStates0#{pending_read => PendingRead#{security_parameters => SecParamsR},
-                           pending_write => PendingWrite#{security_parameters => SecParamsW}},
-    State#state{connection_states = ConnectionStates,
-                key_share = KeyShare,
-                session = Session#session{session_id = SessionId},
-                connection_env = CEnv#connection_env{negotiated_version = {3,4}}}.
diff --git a/lib/ssl/src/tls_handshake_1_3.erl b/lib/ssl/src/tls_handshake_1_3.erl
index 6a6de4b988..3bc1290361 100644
--- a/lib/ssl/src/tls_handshake_1_3.erl
+++ b/lib/ssl/src/tls_handshake_1_3.erl
@@ -36,38 +36,49 @@
 %% Encode
 -export([encode_handshake/1, decode_handshake/2]).
 
-%% Handshake
--export([handle_client_hello/3]).
-
 %% Create handshake messages
 -export([certificate/5,
          certificate_verify/4,
          encrypted_extensions/0,
          server_hello/4]).
 
--export([do_negotiated/2,
+-export([do_start/2,
+         do_negotiated/2,
          do_wait_finished/2]).
 
 %%====================================================================
 %% Create handshake messages
 %%====================================================================
 
-server_hello(SessionId, KeyShare, ConnectionStates, _Map) ->
+server_hello(MsgType, SessionId, KeyShare, ConnectionStates) ->
     #{security_parameters := SecParams} =
 	ssl_record:pending_connection_state(ConnectionStates, read),
-    Extensions = server_hello_extensions(KeyShare),
+    Extensions = server_hello_extensions(MsgType, KeyShare),
     #server_hello{server_version = {3,3}, %% legacy_version
 		  cipher_suite = SecParams#security_parameters.cipher_suite,
                   compression_method = 0, %% legacy attribute
-		  random = SecParams#security_parameters.server_random,
+		  random = server_hello_random(MsgType, SecParams),
 		  session_id = SessionId,
 		  extensions = Extensions
 		 }.
 
-server_hello_extensions(KeyShare) ->
+server_hello_extensions(MsgType, KeyShare) ->
     SupportedVersions = #server_hello_selected_version{selected_version = {3,4}},
     Extensions = #{server_hello_selected_version => SupportedVersions},
-    ssl_handshake:add_server_share(Extensions, KeyShare).
+    ssl_handshake:add_server_share(MsgType, Extensions, KeyShare).
+
+server_hello_random(server_hello, #security_parameters{server_random = Random}) ->
+    Random;
+%% For reasons of backward compatibility with middleboxes (see
+%% Appendix D.4), the HelloRetryRequest message uses the same structure
+%% as the ServerHello, but with Random set to the special value of the
+%% SHA-256 of "HelloRetryRequest":
+%%
+%%   CF 21 AD 74 E5 9A 61 11 BE 1D 8C 02 1E 65 B8 91
+%%   C2 A2 11 16 7A BB 8C 5E 07 9E 09 E2 C8 A8 33 9C
+server_hello_random(hello_retry_request, _) ->
+    crypto:hash(sha256, "HelloRetryRequest").
+
 
 %% TODO: implement support for encrypted_extensions
 encrypted_extensions() ->
@@ -75,6 +86,7 @@ encrypted_extensions() ->
        extensions = #{}
       }.
 
+
 %% TODO: use maybe monad for error handling!
 %% enum {
 %%     X509(0),
@@ -361,20 +373,44 @@ build_content(Context, THash) ->
     Prefix = binary:copy(<<32>>, 64),
     <<Prefix/binary,Context/binary,?BYTE(0),THash/binary>>.
 
+
 %%====================================================================
 %% Handle handshake messages
 %%====================================================================
 
-handle_client_hello(#client_hello{cipher_suites = ClientCiphers,
-                                  session_id = SessionId,
-                                  extensions = Extensions} = _Hello,
-                    #ssl_options{ciphers = ServerCiphers,
-                                 signature_algs = ServerSignAlgs,
-                                 signature_algs_cert = _SignatureSchemes, %% TODO: Check??
-                                 supported_groups = ServerGroups0} = _SslOpts,
-                    Env) ->
 
-    Cert = maps:get(cert, Env, undefined),
+do_start(#change_cipher_spec{},
+              #state{connection_states = _ConnectionStates0,
+                     session = #session{session_id = _SessionId,
+                                        own_certificate = _OwnCert},
+                     ssl_options = #ssl_options{} = _SslOpts,
+                     key_share = _KeyShare,
+                     handshake_env = #handshake_env{tls_handshake_history = _HHistory0},
+                     static_env = #static_env{
+                                     cert_db = _CertDbHandle,
+                                     cert_db_ref = _CertDbRef,
+                                     socket = _Socket,
+                                     transport_cb = _Transport}
+                    } = State0) ->
+    %% {Ref,Maybe} = maybe(),
+
+    try
+
+        State0
+
+    catch
+        {_Ref, {state_not_implemented, State}} ->
+            ?ALERT_REC(?FATAL, ?INTERNAL_ERROR, {state_not_implemented, State})
+    end;
+do_start(#client_hello{cipher_suites = ClientCiphers,
+                       session_id = SessionId,
+                       extensions = Extensions} = _Hello,
+         #state{connection_states = _ConnectionStates0,
+                ssl_options = #ssl_options{ciphers = ServerCiphers,
+                                           signature_algs = ServerSignAlgs,
+                                           signature_algs_cert = _SignatureSchemes, %% TODO: check!
+                                           supported_groups = ServerGroups0},
+                session = #session{own_certificate = Cert}} = State0) ->
 
     ClientGroups0 = maps:get(elliptic_curves, Extensions, undefined),
     ClientGroups = get_supported_groups(ClientGroups0),
@@ -398,11 +434,9 @@ handle_client_hello(#client_hello{cipher_suites = ClientCiphers,
         %% and a signature algorithm/certificate pair to authenticate itself to
         %% the client.
         Cipher = Maybe(select_cipher_suite(ClientCiphers, ServerCiphers)),
-        Group = Maybe(select_server_group(ServerGroups, ClientGroups)),
+        Groups = Maybe(select_common_groups(ServerGroups, ClientGroups)),
         Maybe(validate_key_share(ClientGroups, ClientShares)),
 
-        ClientPubKey = Maybe(get_client_public_key(Group, ClientShares)),
-
         {PublicKeyAlgo, SignAlgo, SignHash} = get_certificate_params(Cert),
 
         %% Check if client supports signature algorithm of server certificate
@@ -411,14 +445,31 @@ handle_client_hello(#client_hello{cipher_suites = ClientCiphers,
         %% Select signature algorithm (used in CertificateVerify message).
         SelectedSignAlg = Maybe(select_sign_algo(PublicKeyAlgo, ClientSignAlgs, ServerSignAlgs)),
 
+        %% Select client public key. If no public key found in ClientShares or
+        %% ClientShares is empty, trigger HelloRetryRequest as we were able
+        %% to find an acceptable set of parameters but the ClientHello does not
+        %% contain sufficient information.
+        {Group, ClientPubKey} = get_client_public_key(Groups, ClientShares),
+
         %% Generate server_share
         KeyShare = ssl_cipher:generate_server_share(Group),
-        _Ret = #{cipher => Cipher,
-                group => Group,
-                sign_alg => SelectedSignAlg,
-                client_share => ClientPubKey,
-                key_share => KeyShare,
-                session_id => SessionId}
+
+        State1 = update_start_state(State0, Cipher, KeyShare, SessionId),
+
+        %% 4.1.4.  Hello Retry Request
+        %%
+        %% The server will send this message in response to a ClientHello
+        %% message if it is able to find an acceptable set of parameters but the
+        %% ClientHello does not contain sufficient information to proceed with
+        %% the handshake.
+        {State2, NextState} =
+            Maybe(send_hello_retry_request(State1, ClientPubKey, KeyShare, SessionId)),
+
+        %% TODO: Add Context to state?
+        Context = #{group => Group,
+                    sign_alg => SelectedSignAlg,
+                    client_share => ClientPubKey},
+        {State2, Context, NextState}
 
         %% TODO:
         %%   - session handling
@@ -430,9 +481,6 @@ handle_client_hello(#client_hello{cipher_suites = ClientCiphers,
             ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY, no_suitable_groups);
         {Ref, illegal_parameter} ->
             ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER);
-        {Ref, {hello_retry_request, _Group0}} ->
-            %% TODO
-            ?ALERT_REC(?FATAL, ?INTERNAL_ERROR, "hello_retry_request not implemented");
         {Ref, no_suitable_cipher} ->
             ?ALERT_REC(?FATAL, ?INSUFFICIENT_SECURITY, no_suitable_cipher);
         {Ref, {insufficient_security, no_suitable_signature_algorithm}} ->
@@ -445,7 +493,7 @@ handle_client_hello(#client_hello{cipher_suites = ClientCiphers,
 do_negotiated(#{client_share := ClientKey,
                 group := SelectedGroup,
                 sign_alg := SignatureScheme
-               } = Map,
+               },
            #state{connection_states = ConnectionStates0,
                   session = #session{session_id = SessionId,
                                      own_certificate = OwnCert},
@@ -464,7 +512,7 @@ do_negotiated(#{client_share := ClientKey,
     try
         %% Create server_hello
         %% Extensions: supported_versions, key_share, (pre_shared_key)
-        ServerHello = server_hello(SessionId, KeyShare, ConnectionStates0, Map),
+        ServerHello = server_hello(server_hello, SessionId, KeyShare, ConnectionStates0),
 
         {State1, _} = tls_connection:send_handshake(ServerHello, State0),
 
@@ -597,6 +645,56 @@ compare_verify_data(_, _) ->
     {error, decrypt_error}.
 
 
+send_hello_retry_request(#state{connection_states = ConnectionStates0} = State0,
+                         no_suitable_key, KeyShare, SessionId) ->
+    ServerHello = server_hello(hello_retry_request, SessionId, KeyShare, ConnectionStates0),
+    {State1, _} = tls_connection:send_handshake(ServerHello, State0),
+
+    %% TODO: Fix handshake history!
+    State2 = replace_ch1_with_message_hash(State1),
+
+    {ok, {State2, start}};
+send_hello_retry_request(State0, _, _, _) ->
+    %% Suitable key found.
+    {ok, {State0, negotiated}}.
+
+
+%% 4.4.1.  The Transcript Hash
+%%
+%% As an exception to this general rule, when the server responds to a
+%% ClientHello with a HelloRetryRequest, the value of ClientHello1 is
+%% replaced with a special synthetic handshake message of handshake type
+%% "message_hash" containing Hash(ClientHello1).  I.e.,
+%%
+%% Transcript-Hash(ClientHello1, HelloRetryRequest, ... Mn) =
+%%    Hash(message_hash ||        /* Handshake type */
+%%         00 00 Hash.length  ||  /* Handshake message length (bytes) */
+%%         Hash(ClientHello1) ||  /* Hash of ClientHello1 */
+%%         HelloRetryRequest  || ... || Mn)
+%%
+%% NOTE: Hash.length is used in practice (openssl) and not message length!
+%%       It is most probably a fault in the RFC.
+replace_ch1_with_message_hash(#state{connection_states = ConnectionStates,
+                                     handshake_env =
+                                         #handshake_env{
+                                            tls_handshake_history =
+                                                {[HRR,CH1|HHistory], LM}} = HSEnv}  = State0) ->
+    #{security_parameters := SecParamsR} =
+        ssl_record:pending_connection_state(ConnectionStates, read),
+    #security_parameters{prf_algorithm = HKDFAlgo} = SecParamsR,
+    MessageHash = message_hash(CH1, HKDFAlgo),
+    State0#state{handshake_env =
+                     HSEnv#handshake_env{
+                        tls_handshake_history =
+                            {[HRR,MessageHash|HHistory], LM}}}.
+
+
+message_hash(ClientHello1, HKDFAlgo) ->
+    [?MESSAGE_HASH,
+     0,0,ssl_cipher:hash_size(HKDFAlgo),
+     crypto:hash(HKDFAlgo, ClientHello1)].
+
+
 calculate_handshake_secrets(ClientKey, SelectedGroup, KeyShare,
                               #state{connection_states = ConnectionStates,
                                      handshake_env =
@@ -721,6 +819,24 @@ update_connection_state(ConnectionState = #{security_parameters := SecurityParam
                      cipher_state => cipher_init(Key, IV, FinishedKey)}.
 
 
+update_start_state(#state{connection_states = ConnectionStates0,
+                          connection_env = CEnv,
+                          session = Session} = State,
+                   Cipher, KeyShare, SessionId) ->
+    #{security_parameters := SecParamsR0} = PendingRead =
+        maps:get(pending_read, ConnectionStates0),
+    #{security_parameters := SecParamsW0} = PendingWrite =
+        maps:get(pending_write, ConnectionStates0),
+    SecParamsR = ssl_cipher:security_parameters_1_3(SecParamsR0, Cipher),
+    SecParamsW = ssl_cipher:security_parameters_1_3(SecParamsW0, Cipher),
+    ConnectionStates =
+        ConnectionStates0#{pending_read => PendingRead#{security_parameters => SecParamsR},
+                           pending_write => PendingWrite#{security_parameters => SecParamsW}},
+    State#state{connection_states = ConnectionStates,
+                key_share = KeyShare,
+                session = Session#session{session_id = SessionId},
+                connection_env = CEnv#connection_env{negotiated_version = {3,4}}}.
+
 
 cipher_init(Key, IV, FinishedKey) ->
     #cipher_state{key = Key,
@@ -733,17 +849,19 @@ cipher_init(Key, IV, FinishedKey) ->
 %% "supported_groups" and the groups supported by the server, then the
 %% server MUST abort the handshake with a "handshake_failure" or an
 %% "insufficient_security" alert.
-select_server_group(_, []) ->
+select_common_groups(_, []) ->
     {error, {insufficient_security, no_suitable_groups}};
-select_server_group(ServerGroups, [C|ClientGroups]) ->
-    case lists:member(C, ServerGroups) of
-        true ->
-            {ok, C};
-        false ->
-            select_server_group(ServerGroups, ClientGroups)
+select_common_groups(ServerGroups, ClientGroups) ->
+    Fun = fun(E) -> lists:member(E, ClientGroups) end,
+    case lists:filter(Fun, ServerGroups) of
+        [] ->
+            {error, {insufficient_security, no_suitable_groups}};
+        L ->
+            {ok, L}
     end.
 
 
+
 %% RFC 8446 - 4.2.8.  Key Share
 %% This vector MAY be empty if the client is requesting a
 %% HelloRetryRequest.  Each KeyShareEntry value MUST correspond to a
@@ -771,20 +889,36 @@ validate_key_share([_|ClientGroups], [_|_] = ClientShares) ->
     validate_key_share(ClientGroups, ClientShares).
 
 
-get_client_public_key(Group, ClientShares) ->
+get_client_public_key([Group|_] = Groups, ClientShares) ->
+    get_client_public_key(Groups, ClientShares, Group).
+%%
+get_client_public_key(_, [], PreferredGroup) ->
+    {PreferredGroup, no_suitable_key};
+get_client_public_key([], _, PreferredGroup) ->
+    {PreferredGroup, no_suitable_key};
+get_client_public_key([Group|Groups], ClientShares, PreferredGroup) ->
      case lists:keysearch(Group, 2, ClientShares) of
          {value, {_, _, ClientPublicKey}} ->
-             {ok, ClientPublicKey};
+             {Group, ClientPublicKey};
          false ->
-             %% 4.1.4.  Hello Retry Request
-             %%
-             %% The server will send this message in response to a ClientHello
-             %% message if it is able to find an acceptable set of parameters but the
-             %% ClientHello does not contain sufficient information to proceed with
-             %% the handshake.
-             {error, {hello_retry_request, Group}}
+             get_client_public_key(Groups, ClientShares, PreferredGroup)
      end.
 
+
+%% get_client_public_key(Group, ClientShares) ->
+%%      case lists:keysearch(Group, 2, ClientShares) of
+%%          {value, {_, _, ClientPublicKey}} ->
+%%              ClientPublicKey;
+%%          false ->
+%%              %% 4.1.4.  Hello Retry Request
+%%              %%
+%%              %% The server will send this message in response to a ClientHello
+%%              %% message if it is able to find an acceptable set of parameters but the
+%%              %% ClientHello does not contain sufficient information to proceed with
+%%              %% the handshake.
+%%              no_suitable_key
+%%      end.
+
 select_cipher_suite([], _) ->
     {error, no_suitable_cipher};
 select_cipher_suite([Cipher|ClientCiphers], ServerCiphers) ->
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index 0873a4fbcd..292916692d 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -279,7 +279,9 @@ tls13_test_group() ->
      tls_record_1_3_encode_decode,
      tls13_finished_verify_data,
      tls13_1_RTT_handshake,
-     tls13_basic_ssl_s_client].
+     tls13_basic_ssl_server_openssl_client,
+     tls13_custom_groups_ssl_server_openssl_client,
+     tls13_hello_retry_request_ssl_server_openssl_client].
 
 %%--------------------------------------------------------------------
 init_per_suite(Config0) ->
@@ -5515,10 +5517,10 @@ tls13_finished_verify_data(_Config) ->
     FinishedKey = tls_v1:finished_key(BaseKey, sha256),
     VerifyData = tls_v1:finished_verify_data(FinishedKey, sha256, Messages).
 
-tls13_basic_ssl_s_client() ->
+tls13_basic_ssl_server_openssl_client() ->
      [{doc,"Test TLS 1.3 basic connection between ssl server and openssl s_client"}].
 
-tls13_basic_ssl_s_client(Config) ->
+tls13_basic_ssl_server_openssl_client(Config) ->
     ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
     ServerOpts0 = ssl_test_lib:ssl_options(server_rsa_opts, Config),
     %% Set versions
@@ -5537,6 +5539,55 @@ tls13_basic_ssl_s_client(Config) ->
     ssl_test_lib:close(Server),
     ssl_test_lib:close_port(Client).
 
+tls13_custom_groups_ssl_server_openssl_client() ->
+    [{doc,"Test that ssl server can select a common group for key-exchange"}].
+
+tls13_custom_groups_ssl_server_openssl_client(Config) ->
+    ClientOpts0 = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts0 = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    %% Set versions
+    ServerOpts = [{versions, ['tlsv1.2','tlsv1.3']},
+                  {supported_groups, [x448, secp256r1, secp384r1]}|ServerOpts0],
+    {_ClientNode, ServerNode, _Hostname} = ssl_test_lib:run_where(Config),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
+					{mfa, {ssl_test_lib, send_recv_result_active, []}},
+					{options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+
+    ClientOpts = [{groups,"P-384:P-256:X25519"}|ClientOpts0],
+    Client = ssl_test_lib:start_basic_client(openssl, 'tlsv1.3', Port, ClientOpts),
+
+    ssl_test_lib:check_result(Server, ok),
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close_port(Client).
+
+tls13_hello_retry_request_ssl_server_openssl_client() ->
+    [{doc,"Test that ssl server can request a new group when the client's first key share"
+      "is not supported"}].
+
+tls13_hello_retry_request_ssl_server_openssl_client(Config) ->
+    ClientOpts0 = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts0 = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+    %% Set versions
+    ServerOpts = [{versions, ['tlsv1.2','tlsv1.3']},
+                  {supported_groups, [x448, x25519]}|ServerOpts0],
+    {_ClientNode, ServerNode, _Hostname} = ssl_test_lib:run_where(Config),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
+					{mfa, {ssl_test_lib, send_recv_result_active, []}},
+					{options, ServerOpts}]),
+    Port = ssl_test_lib:inet_port(Server),
+
+    ClientOpts = [{groups,"P-256:X25519"}|ClientOpts0],
+    Client = ssl_test_lib:start_basic_client(openssl, 'tlsv1.3', Port, ClientOpts),
+
+    ssl_test_lib:check_result(Server, ok),
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close_port(Client).
+
 
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index c921dcae4c..f628b4e6d4 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -1110,12 +1110,19 @@ start_basic_client(openssl, Version, Port, ClientOpts) ->
     Cert = proplists:get_value(certfile, ClientOpts),
     Key = proplists:get_value(keyfile, ClientOpts),
     CA = proplists:get_value(cacertfile, ClientOpts),
+    Groups0 = proplists:get_value(groups, ClientOpts),
     Exe = "openssl",
-    Args = ["s_client", "-verify", "2", "-port", integer_to_list(Port),
+    Args0 = ["s_client", "-verify", "2", "-port", integer_to_list(Port),
 	    ssl_test_lib:version_flag(Version),
 	    "-cert", Cert, "-CAfile", CA,
 	    "-key", Key, "-host","localhost", "-msg", "-debug"],
-
+    Args =
+       case Groups0 of
+           undefined ->
+               Args0;
+           G ->
+               Args0 ++ ["-groups", G]
+       end,
     OpenSslPort = ssl_test_lib:portable_open_port(Exe, Args),
     true = port_command(OpenSslPort, "Hello world"),
     OpenSslPort.