Merge branch 'peterdmv/ssl/version_extension_updates/OTP-15059'

* peterdmv/ssl/version_extension_updates/OTP-15059:
  ssl: Fix handling of TLS record versions
  ssl: Update hello state (TLS 1.3)
  ssl: Implement 'supported_versions' extension
  ssl: Sort supported versions in handle_options
  ssl: Add experimental version 'tlsv1.3'

Change-Id: I071d24242103cc066c5ee8154effc5ee01b04703

10 files changed, 275 insertions, 57 deletions

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index c7f1f36d5d..09953908ce 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -887,9 +887,10 @@ handle_options(Opts0, #ssl_options{protocol = Protocol, cacerts = CaCerts0,
 	[] ->
 	    new_ssl_options(SslOpts1, NewVerifyOpts, RecordCB);
 	Value ->
-	    Versions = [RecordCB:protocol_version(Vsn) || Vsn <- Value],
+            Versions0 = [RecordCB:protocol_version(Vsn) || Vsn <- Value],
+            Versions1 = lists:sort(fun RecordCB:is_higher/2, Versions0),
 	    new_ssl_options(proplists:delete(versions, SslOpts1), 
-			    NewVerifyOpts#ssl_options{versions = Versions}, record_cb(Protocol))
+			    NewVerifyOpts#ssl_options{versions = Versions1}, record_cb(Protocol))
     end;
 
 %% Handle all options in listen and connect
@@ -912,7 +913,8 @@ handle_options(Opts0, Role, Host) ->
 		   [] ->
 		       RecordCb:supported_protocol_versions();
 		   Vsns  ->
-		       [RecordCb:protocol_version(Vsn) || Vsn <- Vsns]
+                       Versions0 = [RecordCb:protocol_version(Vsn) || Vsn <- Vsns],
+                       lists:sort(fun RecordCb:is_higher/2, Versions0)
 	       end,
 
     Protocol = handle_option(protocol, Opts, tls),
@@ -1311,7 +1313,8 @@ validate_binary_list(Opt, List) ->
         end, List).
 validate_versions([], Versions) ->
     Versions;
-validate_versions([Version | Rest], Versions) when Version == 'tlsv1.2';
+validate_versions([Version | Rest], Versions) when Version == 'tlsv1.3';
+                                                   Version == 'tlsv1.2';
                                                    Version == 'tlsv1.1';
                                                    Version == tlsv1;
                                                    Version == sslv3 ->
@@ -1324,10 +1327,11 @@ validate_versions([Ver| _], Versions) ->
 
 tls_validate_versions([], Versions) ->
     Versions;
-tls_validate_versions([Version | Rest], Versions) when Version == 'tlsv1.2';
-                                                   Version == 'tlsv1.1';
-                                                   Version == tlsv1;
-                                                   Version == sslv3 ->
+tls_validate_versions([Version | Rest], Versions) when Version == 'tlsv1.3';
+                                                       Version == 'tlsv1.2';
+                                                       Version == 'tlsv1.1';
+                                                       Version == tlsv1;
+                                                       Version == sslv3 ->
     tls_validate_versions(Rest, Versions);                  
 tls_validate_versions([Ver| _], Versions) ->
     throw({error, {options, {Ver, {versions, Versions}}}}).
diff --git a/lib/ssl/src/ssl_cipher.erl b/lib/ssl/src/ssl_cipher.erl
index 50dadd0903..81ef491c40 100644
--- a/lib/ssl/src/ssl_cipher.erl
+++ b/lib/ssl/src/ssl_cipher.erl
@@ -187,7 +187,7 @@ block_cipher(Fun, BlockSz, #cipher_state{key=Key, iv=IV} = CS0,
 
 block_cipher(Fun, BlockSz, #cipher_state{key=Key, iv=IV} = CS0,
 	     Mac, Fragment, {3, N})
-  when N == 2; N == 3 ->
+  when N == 2; N == 3; N == 4 ->
     NextIV = random_iv(IV),
     L0 = build_cipher_block(BlockSz, Mac, Fragment),
     L = [NextIV|L0],
@@ -320,6 +320,8 @@ suites({3, Minor}) ->
 suites({_, Minor}) ->
     dtls_v1:suites(Minor).
 
+all_suites({3, 4}) ->
+    all_suites({3, 3});
 all_suites({3, _} = Version) ->
     suites(Version)
         ++ chacha_suites(Version)
@@ -478,11 +480,12 @@ rc4_suites({3, Minor}) ->
 rc4_suites(0) ->
     [?TLS_RSA_WITH_RC4_128_SHA,
      ?TLS_RSA_WITH_RC4_128_MD5];
-rc4_suites(N) when N =< 3 ->
+rc4_suites(N) when N =< 4 ->
     [?TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
      ?TLS_ECDHE_RSA_WITH_RC4_128_SHA,
      ?TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
      ?TLS_ECDH_RSA_WITH_RC4_128_SHA].
+
 %%--------------------------------------------------------------------
 -spec des_suites(Version::ssl_record:ssl_version()) -> [cipher_suite()].
 %%
@@ -517,13 +520,14 @@ rsa_suites(0) ->
      ?TLS_RSA_WITH_AES_128_CBC_SHA,
      ?TLS_RSA_WITH_3DES_EDE_CBC_SHA
     ];  
-rsa_suites(N) when N =< 3 ->
+rsa_suites(N) when N =< 4 ->
     [
      ?TLS_RSA_WITH_AES_256_GCM_SHA384,
      ?TLS_RSA_WITH_AES_256_CBC_SHA256,
      ?TLS_RSA_WITH_AES_128_GCM_SHA256,
      ?TLS_RSA_WITH_AES_128_CBC_SHA256
     ].
+
 %%--------------------------------------------------------------------
 -spec suite_definition(cipher_suite()) -> erl_cipher_suite().
 %%
@@ -2430,7 +2434,7 @@ mac_hash({_,_}, ?NULL, _MacSecret, _SeqNo, _Type,
 mac_hash({3, 0}, MacAlg, MacSecret, SeqNo, Type, Length, Fragment) ->
     ssl_v3:mac_hash(MacAlg, MacSecret, SeqNo, Type, Length, Fragment);
 mac_hash({3, N} = Version, MacAlg, MacSecret, SeqNo, Type, Length, Fragment)  
-  when N =:= 1; N =:= 2; N =:= 3 ->
+  when N =:= 1; N =:= 2; N =:= 3; N =:= 4 ->
     tls_v1:mac_hash(MacAlg, MacSecret, SeqNo, Type, Version,
 		      Length, Fragment).
 
@@ -2635,7 +2639,7 @@ generic_block_cipher_from_bin({3, N}, T, IV, HashSize)
 			  next_iv = IV};
 
 generic_block_cipher_from_bin({3, N}, T, IV, HashSize)
-  when N == 2; N == 3 ->
+  when N == 2; N == 3; N == 4 ->
     Sz1 = byte_size(T) - 1,
     <<_:Sz1/binary, ?BYTE(PadLength)>> = T,
     IVLength = byte_size(IV),
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl
index 4d0bdd6386..98e9d9da7e 100644
--- a/lib/ssl/src/ssl_handshake.erl
+++ b/lib/ssl/src/ssl_handshake.erl
@@ -53,7 +53,7 @@
 -export([certify/7, certificate_verify/6, verify_signature/5,
 	 master_secret/4, server_key_exchange_hash/2, verify_connection/6,
 	 init_handshake_history/0, update_handshake_history/2, verify_server_key/5,
-         select_version/3, extension_value/1
+         select_version/3, select_supported_version/2, extension_value/1
 	]).
 
 %% Encode
@@ -505,6 +505,21 @@ verify_server_key(#server_key_params{params_bin = EncParams,
 select_version(RecordCB, ClientVersion, Versions) ->
     do_select_version(RecordCB, ClientVersion, Versions).
 
+
+%% Called by TLS 1.2/1.3 Server when "supported_versions" is present
+%% in ClientHello.
+%% Input lists are ordered (highest first)
+select_supported_version([], _ServerVersions) ->
+    undefined;
+select_supported_version([ClientVersion|T], ServerVersions) ->
+    case lists:member(ClientVersion, ServerVersions) of
+        true ->
+            ClientVersion;
+        false ->
+            select_supported_version(T, ServerVersions)
+    end.
+
+
 %%====================================================================
 %% Encode handshake 
 %%====================================================================
@@ -632,7 +647,20 @@ encode_hello_extensions([#sni{hostname = Hostname} | Rest], Acc) ->
 				    ?UINT16(ServerNameLength),
 				    ?BYTE(?SNI_NAMETYPE_HOST_NAME),
 				    ?UINT16(HostLen), HostnameBin/binary,
-				    Acc/binary>>).
+				    Acc/binary>>);
+encode_hello_extensions([#client_hello_versions{versions = Versions0} | Rest], Acc) ->
+    Versions = encode_versions(Versions0),
+    VerLen = byte_size(Versions),
+    Len = VerLen + 2,
+    encode_hello_extensions(Rest, <<?UINT16(?SUPPORTED_VERSIONS_EXT),
+                                    ?UINT16(Len), ?UINT16(VerLen), Versions/binary, Acc/binary>>);
+encode_hello_extensions([#server_hello_selected_version{selected_version = Version0} | Rest], Acc) ->
+    Version = encode_versions(Version0),
+    Len = byte_size(Version), %% 2
+    encode_hello_extensions(Rest, <<?UINT16(?SUPPORTED_VERSIONS_EXT),
+                                    ?UINT16(Len), Version/binary, Acc/binary>>).
+
+
 
 encode_client_protocol_negotiation(undefined, _) ->
     undefined;
@@ -930,7 +958,8 @@ premaster_secret(EncSecret, #'RSAPrivateKey'{} = RSAPrivateKey) ->
 %%====================================================================
 client_hello_extensions(Version, CipherSuites, 
 			#ssl_options{signature_algs = SupportedHashSigns,
-				     eccs = SupportedECCs} = SslOpts, ConnectionStates, Renegotiation) ->
+				     eccs = SupportedECCs,
+                                     versions = Versions} = SslOpts, ConnectionStates, Renegotiation) ->
     {EcPointFormats, EllipticCurves} =
 	case advertises_ec_ciphers(lists:map(fun ssl_cipher:suite_definition/1, CipherSuites)) of
 	    true ->
@@ -940,18 +969,29 @@ client_hello_extensions(Version, CipherSuites,
 	end,
     SRP = srp_user(SslOpts),
 
-    #hello_extensions{
-       renegotiation_info = renegotiation_info(tls_record, client,
-					       ConnectionStates, Renegotiation),
-       srp = SRP,
-       signature_algs = available_signature_algs(SupportedHashSigns, Version),
-       ec_point_formats = EcPointFormats,
-       elliptic_curves = EllipticCurves,
-       alpn = encode_alpn(SslOpts#ssl_options.alpn_advertised_protocols, Renegotiation),
-       next_protocol_negotiation =
-	   encode_client_protocol_negotiation(SslOpts#ssl_options.next_protocol_selector,
-					      Renegotiation),
-       sni = sni(SslOpts#ssl_options.server_name_indication)}.
+    HelloExtensions =
+        #hello_extensions{
+           renegotiation_info = renegotiation_info(tls_record, client,
+                                                   ConnectionStates, Renegotiation),
+           srp = SRP,
+           signature_algs = available_signature_algs(SupportedHashSigns, Version),
+           ec_point_formats = EcPointFormats,
+           elliptic_curves = EllipticCurves,
+           alpn = encode_alpn(SslOpts#ssl_options.alpn_advertised_protocols, Renegotiation),
+           next_protocol_negotiation =
+               encode_client_protocol_negotiation(SslOpts#ssl_options.next_protocol_selector,
+                                                  Renegotiation),
+           sni = sni(SslOpts#ssl_options.server_name_indication)},
+
+    %% Add "supported_versions" extension if TLS 1.3
+    case Version of
+        {3,4} ->
+            HelloExtensions#hello_extensions{
+              client_hello_versions = #client_hello_versions{
+                                         versions = Versions}};
+        _Else ->
+            HelloExtensions
+    end.
 
 handle_client_hello_extensions(RecordCB, Random, ClientCipherSuites,
 			       #hello_extensions{renegotiation_info = Info,
@@ -1722,6 +1762,16 @@ encode_alpn(undefined, _) ->
 encode_alpn(Protocols, _) ->
     #alpn{extension_data = lists:foldl(fun encode_protocol/2, <<>>, Protocols)}.
 
+
+encode_versions(Versions) ->
+    encode_versions(lists:reverse(Versions), <<>>).
+%%
+encode_versions([], Acc) ->
+    Acc;
+encode_versions([{M,N}|T], Acc) ->
+    encode_versions(T, <<?BYTE(M),?BYTE(N),Acc/binary>>).
+
+
 hello_extensions_list(#hello_extensions{renegotiation_info = RenegotiationInfo,
 					srp = SRP,
 					signature_algs = HashSigns,
@@ -1729,9 +1779,13 @@ hello_extensions_list(#hello_extensions{renegotiation_info = RenegotiationInfo,
 					elliptic_curves = EllipticCurves,
                                         alpn = ALPN,
 					next_protocol_negotiation = NextProtocolNegotiation,
-					sni = Sni}) ->
+					sni = Sni,
+                                        client_hello_versions = Versions,
+                                        server_hello_selected_version = Version}) ->
     [Ext || Ext <- [RenegotiationInfo, SRP, HashSigns,
-		    EcPointFormats, EllipticCurves, ALPN, NextProtocolNegotiation, Sni], Ext =/= undefined].
+		    EcPointFormats, EllipticCurves, ALPN,
+                    NextProtocolNegotiation, Sni,
+                    Versions, Version], Ext =/= undefined].
 
 %%-------------Decode handshakes---------------------------------
 dec_server_key(<<?UINT16(PLen), P:PLen/binary,
@@ -1937,9 +1991,22 @@ dec_hello_extensions(<<?UINT16(?SNI_EXT), ?UINT16(Len),
                 ExtData:Len/binary, Rest/binary>>, Acc) ->
     <<?UINT16(_), NameList/binary>> = ExtData,
     dec_hello_extensions(Rest, Acc#hello_extensions{sni = dec_sni(NameList)});
+
+dec_hello_extensions(<<?UINT16(?SUPPORTED_VERSIONS_EXT), ?UINT16(Len),
+                       ExtData:Len/binary, Rest/binary>>, Acc) when Len > 2 ->
+    <<?UINT16(_),Versions/binary>> = ExtData,
+    dec_hello_extensions(Rest, Acc#hello_extensions{
+                                 client_hello_versions =
+                                     #client_hello_versions{versions = decode_versions(Versions)}});
+
+dec_hello_extensions(<<?UINT16(?SUPPORTED_VERSIONS_EXT), ?UINT16(Len),
+                       ?UINT16(Version), Rest/binary>>, Acc) when Len =:= 2, Version =:= 16#0304 ->
+    dec_hello_extensions(Rest, Acc#hello_extensions{
+                                 server_hello_selected_version =
+                                     #server_hello_selected_version{selected_version = [{3,4}]}});
+
 %% Ignore data following the ClientHello (i.e.,
 %% extensions) if not understood.
-
 dec_hello_extensions(<<?UINT16(_), ?UINT16(Len), _Unknown:Len/binary, Rest/binary>>, Acc) ->
     dec_hello_extensions(Rest, Acc);
 %% This theoretically should not happen if the protocol is followed, but if it does it is ignored.
@@ -1961,6 +2028,15 @@ decode_alpn(undefined) ->
 decode_alpn(#alpn{extension_data=Data}) ->
     decode_protocols(Data, []).
 
+decode_versions(Versions) ->
+    decode_versions(Versions, []).
+%%
+decode_versions(<<>>, Acc) ->
+    lists:reverse(Acc);
+decode_versions(<<?BYTE(M),?BYTE(N),Rest/binary>>, Acc) ->
+    decode_versions(Rest, [{M,N}|Acc]).
+
+
 decode_next_protocols({next_protocol_negotiation, Protocols}) ->
     decode_protocols(Protocols, []).
 
diff --git a/lib/ssl/src/ssl_handshake.hrl b/lib/ssl/src/ssl_handshake.hrl
index a191fcf766..9cc6f570fc 100644
--- a/lib/ssl/src/ssl_handshake.hrl
+++ b/lib/ssl/src/ssl_handshake.hrl
@@ -105,7 +105,9 @@
 	  srp,
 	  ec_point_formats,
 	  elliptic_curves,
-	  sni
+	  sni,
+          client_hello_versions,
+          server_hello_selected_version
 	 }).
 
 -record(server_hello, {
@@ -377,4 +379,13 @@
           hostname = undefined
         }).
 
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+%% Supported Versions TLS 1.3  section 4.2.1
+%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
+
+-define(SUPPORTED_VERSIONS_EXT, 43).
+
+-record(client_hello_versions, {versions}).
+-record(server_hello_selected_version, {selected_version}).
+
 -endif. % -ifdef(ssl_handshake).
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index a98cbf8542..2e1a928a62 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -72,11 +72,21 @@
 -define(FALSE, 1).
 
 %% sslv3 is considered insecure due to lack of padding check (Poodle attack)
-%% Keep as interop with legacy software but do not support as default 
--define(ALL_AVAILABLE_VERSIONS, ['tlsv1.2', 'tlsv1.1', tlsv1, sslv3]).
+%% Keep as interop with legacy software but do not support as default
+%% tlsv1.3 is under development (experimental).
+-define(ALL_AVAILABLE_VERSIONS, ['tlsv1.3', 'tlsv1.2', 'tlsv1.1', tlsv1, sslv3]).
 -define(ALL_AVAILABLE_DATAGRAM_VERSIONS, ['dtlsv1.2', dtlsv1]).
+%% Defines the default versions when not specified by an ssl option.
 -define(ALL_SUPPORTED_VERSIONS, ['tlsv1.2', 'tlsv1.1', tlsv1]).
 -define(MIN_SUPPORTED_VERSIONS, ['tlsv1.1', tlsv1]).
+
+%% Versions allowed in TLSCiphertext.version (TLS 1.2 and prior) and
+%% TLSCiphertext.legacy_record_version (TLS 1.3).
+%% TLS 1.3 sets TLSCiphertext.legacy_record_version to 0x0303 for all records
+%% generated other than an than an initial ClientHello, where it MAY also be 0x0301.
+%% Thus, the allowed range is limited to 0x0300 - 0x0303.
+-define(ALL_TLS_RECORD_VERSIONS, ['tlsv1.2', 'tlsv1.1', tlsv1, sslv3]).
+
 -define(ALL_DATAGRAM_SUPPORTED_VERSIONS, ['dtlsv1.2', dtlsv1]).
 -define(MIN_DATAGRAM_SUPPORTED_VERSIONS, [dtlsv1]).
 
diff --git a/lib/ssl/src/ssl_logger.erl b/lib/ssl/src/ssl_logger.erl
index 23e9e096cc..35c8dcfd48 100644
--- a/lib/ssl/src/ssl_logger.erl
+++ b/lib/ssl/src/ssl_logger.erl
@@ -156,7 +156,9 @@ version({3,2}) ->
 version({3,1}) ->
     "TLS 1.0";
 version({3,0}) ->
-    "SSL 3.0".
+    "SSL 3.0";
+version({M,N}) ->
+    io_lib:format("TLS [0x0~B0~B]", [M,N]).
 
 
 header_prefix(inbound) ->
@@ -183,7 +185,6 @@ header_prefix_tls_record(outbound) ->
     "writing".
 
 
-
 tls_record_version([<<?BYTE(B),?BYTE(3),?BYTE(3),_/binary>>|_]) ->
     io_lib:format("TLS 1.2 Record Protocol, ~s", [msg_type(B)]);
 tls_record_version([<<?BYTE(B),?BYTE(3),?BYTE(2),_/binary>>|_]) ->
@@ -191,7 +192,9 @@ tls_record_version([<<?BYTE(B),?BYTE(3),?BYTE(2),_/binary>>|_]) ->
 tls_record_version([<<?BYTE(B),?BYTE(3),?BYTE(1),_/binary>>|_]) ->
     io_lib:format("TLS 1.0 Record Protocol, ~s", [msg_type(B)]);
 tls_record_version([<<?BYTE(B),?BYTE(3),?BYTE(0),_/binary>>|_]) ->
-    io_lib:format("SSL 3.0 Record Protocol, ~s", [msg_type(B)]).
+    io_lib:format("SSL 3.0 Record Protocol, ~s", [msg_type(B)]);
+tls_record_version([<<?BYTE(B),?BYTE(M),?BYTE(N),_/binary>>|_]) ->
+    io_lib:format("TLS [0x0~B0~B] Record Protocol, ~s", [M, N, msg_type(B)]).
 
 
 msg_type(20) -> "change_cipher_spec";
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 1a0a9b9275..8320d3f7f3 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -679,8 +679,8 @@ initial_state(Role, Host, Port, Socket, {SSLOptions, SocketOptions, Tracker}, Us
 next_tls_record(Data, StateName, #state{protocol_buffers = 
                                             #protocol_buffers{tls_record_buffer = Buf0,
                                                               tls_cipher_texts = CT0} = Buffers,
-                                       ssl_options = SslOpts} = State0) ->
-    case tls_record:get_tls_records(Data, 
+                                        ssl_options = SslOpts} = State0) ->
+    case tls_record:get_tls_records(Data,
                                     acceptable_record_versions(StateName, State0),
                                     Buf0, SslOpts) of
 	{Records, Buf1} ->
@@ -693,10 +693,18 @@ next_tls_record(Data, StateName, #state{protocol_buffers =
     end.
 
 
+%% TLS 1.3 Client/Server
+%% - Ignore TLSPlaintext.legacy_record_version
+%% - Verify that TLSCiphertext.legacy_record_version is set to  0x0303 for all records
+%%   other than an initial ClientHello, where it MAY also be 0x0301.
 acceptable_record_versions(hello, _) ->
-    [tls_record:protocol_version(Vsn) || Vsn <- ?ALL_AVAILABLE_VERSIONS];
+    [tls_record:protocol_version(Vsn) || Vsn <- ?ALL_TLS_RECORD_VERSIONS];
+acceptable_record_versions(_, #state{negotiated_version = {Major, Minor}})
+  when Major > 3; Major =:= 3, Minor >= 4 ->
+    [{3, 3}];
 acceptable_record_versions(_, #state{negotiated_version = Version}) ->
     [Version].
+
 handle_record_alert(Alert, _) ->
     Alert.
 
diff --git a/lib/ssl/src/tls_handshake.erl b/lib/ssl/src/tls_handshake.erl
index 4e6bbb5061..39f0c1680b 100644
--- a/lib/ssl/src/tls_handshake.erl
+++ b/lib/ssl/src/tls_handshake.erl
@@ -61,6 +61,18 @@ client_hello(Host, Port, ConnectionStates,
 			 } = SslOpts,
 	     Cache, CacheCb, Renegotiation, OwnCert) ->
     Version = tls_record:highest_protocol_version(Versions),
+
+    %% In TLS 1.3, the client indicates its version preferences in the
+    %% "supported_versions" extension (Section 4.2.1) and the
+    %% legacy_version field MUST be set to 0x0303, which is the version
+    %% number for TLS 1.2.
+    LegacyVersion =
+        case tls_record:is_higher(Version, {3,2}) of
+            true ->
+                {3,3};
+            false ->
+                Version
+        end,
     #{security_parameters := SecParams} = 
         ssl_record:pending_connection_state(ConnectionStates, read),
     AvailableCipherSuites = ssl_handshake:available_suites(UserSuites, Version),     
@@ -71,7 +83,7 @@ client_hello(Host, Port, ConnectionStates,
     CipherSuites = ssl_handshake:cipher_suites(AvailableCipherSuites, Renegotiation, Fallback),
     Id = ssl_session:client_id({Host, Port, SslOpts}, Cache, CacheCb, OwnCert),    
     #client_hello{session_id = Id,
-		  client_version = Version,
+		  client_version = LegacyVersion,
 		  cipher_suites = CipherSuites,
 		  compression_methods = ssl_record:compressions(),
 		  random = SecParams#security_parameters.client_random,
@@ -93,6 +105,37 @@ client_hello(Host, Port, ConnectionStates,
 %%
 %% Description: Handles a received hello message
 %%--------------------------------------------------------------------
+
+%% TLS 1.3 - 4.2.1.  Supported Versions
+%% If the "supported_versions" extension in the ServerHello contains a
+%% version not offered by the client or contains a version prior to TLS
+%% 1.3, the client MUST abort the handshake with an "illegal_parameter"
+%% alert.
+%%--------------------------------------------------------------------
+%% TLS 1.2 Client
+%%
+%% - If "supported_version" is present (ServerHello):
+%%   - Abort handshake with an "illegal_parameter" alert
+hello(#server_hello{server_version = Version,
+                    extensions = #hello_extensions{
+                                    server_hello_selected_version =
+                                        #server_hello_selected_version{selected_version = Version}
+                                   }},
+      #ssl_options{versions = SupportedVersions},
+      _ConnectionStates0, _Renegotiation) ->
+    case tls_record:is_higher({3,4}, Version) of
+        true ->
+            ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER);
+        false ->
+            case tls_record:is_acceptable_version(Version, SupportedVersions) of
+                true ->
+                    %% Implement TLS 1.3 statem ???
+                    ?ALERT_REC(?FATAL, ?PROTOCOL_VERSION);
+                false ->
+                    ?ALERT_REC(?FATAL, ?ILLEGAL_PARAMETER)
+            end
+    end;
+
 hello(#server_hello{server_version = Version, random = Random,
 		    cipher_suite = CipherSuite,
 		    compression_method = Compression,
@@ -107,6 +150,37 @@ hello(#server_hello{server_version = Version, random = Random,
 	false ->
 	    ?ALERT_REC(?FATAL, ?PROTOCOL_VERSION)
     end;
+
+
+%% TLS 1.2 Server
+%% - If "supported_versions" is present (ClientHello):
+%%   - Select version from "supported_versions" (ignore ClientHello.legacy_version)
+%%   - If server only supports versions greater than "supported_versions":
+%%     - Abort handshake with a "protocol_version" alert (*)
+%% - If "supported_versions" is absent (ClientHello):
+%%   - Negotiate the minimum of ClientHello.legacy_version and TLS 1.2 (**)
+%%   - If server only supports versions greater than ClientHello.legacy_version:
+%%     - Abort handshake with a "protocol_version" alert
+%%
+%% (*)  Sends alert even if there is a gap in supported versions
+%%      e.g. Server 1.0,1.2 Client 1.1,1.3
+%% (**) Current implementation can negotiate a version not supported by the client
+%%      e.g. Server 1.0,1.2 Client 1.1 -> ServerHello 1.0
+hello(#client_hello{client_version = _ClientVersion,
+		    cipher_suites = CipherSuites,
+                    extensions = #hello_extensions{
+                                    client_hello_versions =
+                                        #client_hello_versions{versions = ClientVersions}
+                                   }} = Hello,
+      #ssl_options{versions = Versions} = SslOpts,
+      Info, Renegotiation) ->
+    try
+        Version = ssl_handshake:select_supported_version(ClientVersions, Versions),
+        do_hello(Version, Versions, CipherSuites, Hello, SslOpts, Info, Renegotiation)
+    catch
+	_:_ ->
+	    ?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE, malformed_handshake_data)
+    end;
 			       
 hello(#client_hello{client_version = ClientVersion,
 		    cipher_suites = CipherSuites} = Hello,
@@ -114,18 +188,7 @@ hello(#client_hello{client_version = ClientVersion,
       Info, Renegotiation) ->
     try
 	Version = ssl_handshake:select_version(tls_record, ClientVersion, Versions),
-	case ssl_cipher:is_fallback(CipherSuites) of
-	true -> 
-		Highest = tls_record:highest_protocol_version(Versions),
-		case tls_record:is_higher(Highest, Version) of
-		    true ->
-			?ALERT_REC(?FATAL, ?INAPPROPRIATE_FALLBACK);
-		    false ->				     
-			handle_client_hello(Version, Hello, SslOpts, Info, Renegotiation)
-		end;
-	    false ->
-		handle_client_hello(Version, Hello, SslOpts, Info, Renegotiation)
-	end
+        do_hello(Version, Versions, CipherSuites, Hello, SslOpts, Info, Renegotiation)
     catch
 	_:_ ->
 	    ?ALERT_REC(?FATAL, ?HANDSHAKE_FAILURE, malformed_handshake_data)
@@ -242,6 +305,31 @@ handle_server_hello_extensions(Version, SessionId, Random, CipherSuite,
 	{ConnectionStates, ProtoExt, Protocol} ->
 	    {Version, SessionId, ConnectionStates, ProtoExt, Protocol}
     end.
+
+
+do_hello(undefined, _Versions, _CipherSuites, _Hello, _SslOpts, _Info, _Renegotiation) ->
+    ?ALERT_REC(?FATAL, ?PROTOCOL_VERSION);
+do_hello(Version, Versions, CipherSuites, Hello, SslOpts, Info, Renegotiation) ->
+    case tls_record:is_higher({3,4}, Version) of
+        true -> %% TLS 1.2 and older
+            case ssl_cipher:is_fallback(CipherSuites) of
+                true ->
+                    Highest = tls_record:highest_protocol_version(Versions),
+                    case tls_record:is_higher(Highest, Version) of
+                        true ->
+                            ?ALERT_REC(?FATAL, ?INAPPROPRIATE_FALLBACK);
+                        false ->
+                            handle_client_hello(Version, Hello, SslOpts, Info, Renegotiation)
+                    end;
+                false ->
+                    handle_client_hello(Version, Hello, SslOpts, Info, Renegotiation)
+            end;
+        false ->
+            %% Implement TLS 1.3 statem ???
+            ?ALERT_REC(?FATAL, ?PROTOCOL_VERSION)
+    end.
+
+
 %%--------------------------------------------------------------------
 enc_handshake(#hello_request{}, _Version) ->
     {?HELLO_REQUEST, <<>>};
diff --git a/lib/ssl/src/tls_record.erl b/lib/ssl/src/tls_record.erl
index 278d471fdb..444759aafa 100644
--- a/lib/ssl/src/tls_record.erl
+++ b/lib/ssl/src/tls_record.erl
@@ -230,6 +230,8 @@ decode_cipher_text(#ssl_tls{type = Type, version = Version,
 %% Description: Creates a protocol version record from a version atom
 %% or vice versa.
 %%--------------------------------------------------------------------
+protocol_version('tlsv1.3') ->
+    {3, 4};
 protocol_version('tlsv1.2') ->
     {3, 3};
 protocol_version('tlsv1.1') ->
@@ -240,6 +242,8 @@ protocol_version(sslv3) ->
     {3, 0};
 protocol_version(sslv2) -> %% Backwards compatibility
     {2, 0};
+protocol_version({3, 4}) ->
+    'tlsv1.3';
 protocol_version({3, 3}) ->
     'tlsv1.2';
 protocol_version({3, 2}) ->
diff --git a/lib/ssl/src/tls_v1.erl b/lib/ssl/src/tls_v1.erl
index d6b500748e..6ef6040761 100644
--- a/lib/ssl/src/tls_v1.erl
+++ b/lib/ssl/src/tls_v1.erl
@@ -74,7 +74,7 @@ finished(Role, Version, PrfAlgo, MasterSecret, Handshake)
     prf(?MD5SHA, MasterSecret, finished_label(Role), [MD5, SHA], 12);
 
 finished(Role, Version, PrfAlgo, MasterSecret, Handshake)
-  when Version == 3 ->
+  when Version == 3; Version == 4 ->
     %% RFC 5246 - 7.4.9. Finished
     %% struct {
     %%          opaque verify_data[12];
@@ -85,6 +85,7 @@ finished(Role, Version, PrfAlgo, MasterSecret, Handshake)
     Hash = crypto:hash(mac_algo(PrfAlgo), Handshake),
     prf(PrfAlgo, MasterSecret, finished_label(Role), Hash, 12).
 
+
 -spec certificate_verify(md5sha | sha, integer(), [binary()]) -> binary().
 
 certificate_verify(md5sha, _Version, Handshake) ->
@@ -154,7 +155,7 @@ setup_keys(Version, _PrfAlgo, MasterSecret, ServerRandom, ClientRandom, HashSize
 %% TLS v1.2
 setup_keys(Version, PrfAlgo, MasterSecret, ServerRandom, ClientRandom, HashSize,
 	   KeyMatLen, IVSize)
-  when Version == 3 ->
+  when Version == 3; Version == 4 ->
     %% RFC 5246 - 6.3. Key calculation
     %% key_block = PRF(SecurityParameters.master_secret,
     %%                      "key expansion",
@@ -192,7 +193,7 @@ mac_hash(Method, Mac_write_secret, Seq_num, Type, {Major, Minor},
 		     Fragment]),
     Mac.
 
--spec suites(1|2|3) -> [ssl_cipher:cipher_suite()].
+-spec suites(1|2|3|4) -> [ssl_cipher:cipher_suite()].
 
 suites(Minor) when Minor == 1; Minor == 2 ->
     [
@@ -244,8 +245,15 @@ suites(3) ->
      %% ?TLS_DH_DSS_WITH_AES_256_GCM_SHA384,
      %% ?TLS_DH_RSA_WITH_AES_128_GCM_SHA256,
      %% ?TLS_DH_DSS_WITH_AES_128_GCM_SHA256
-    ] ++ suites(2).
+    ] ++ suites(2);
+
+
+suites(4) ->
+    suites(3).
+
 
+signature_algs({3, 4}, HashSigns) ->
+    signature_algs({3, 3}, HashSigns);
 signature_algs({3, 3}, HashSigns) ->
     CryptoSupports =  crypto:supports(),
     Hashes = proplists:get_value(hashs, CryptoSupports),
@@ -273,6 +281,8 @@ signature_algs({3, 3}, HashSigns) ->
 			    end, [], HashSigns),
     lists:reverse(Supported).
 
+default_signature_algs({3, 4}) ->
+    default_signature_algs({3, 3});
 default_signature_algs({3, 3} = Version) ->
     Default = [%% SHA2
 	       {sha512, ecdsa},