rustls 0.5.5

use msgs::enums::{ContentType, HandshakeType, ProtocolVersion};
use msgs::enums::{Compression, NamedGroup, ECPointFormat, CipherSuite};
use msgs::enums::{ExtensionType, AlertDescription};
use msgs::enums::{ClientCertificateType, SignatureScheme, PSKKeyExchangeMode};
use msgs::message::{Message, MessagePayload};
use msgs::base::{Payload, PayloadU8};
use msgs::handshake::{HandshakePayload, SupportedSignatureSchemes};
use msgs::handshake::{HandshakeMessagePayload, ServerHelloPayload, Random};
use msgs::handshake::{ClientHelloPayload, ServerExtension, SessionID};
use msgs::handshake::{ConvertProtocolNameList, ConvertServerNameList};
use msgs::handshake::{NamedGroups, SupportedGroups, ClientExtension};
use msgs::handshake::{ECPointFormatList, SupportedPointFormats};
use msgs::handshake::{ServerECDHParams, DigitallySignedStruct};
use msgs::handshake::{ServerKeyExchangePayload, ECDHEServerKeyExchange};
use msgs::handshake::{CertificateRequestPayload, NewSessionTicketPayload};
use msgs::handshake::{CertificateRequestPayloadTLS13, NewSessionTicketPayloadTLS13};
use msgs::handshake::{HelloRetryRequest, HelloRetryExtension, KeyShareEntry};
use msgs::handshake::{CertificatePayloadTLS13, CertificateEntry};
use msgs::handshake::SupportedMandatedSignatureSchemes;
use msgs::ccs::ChangeCipherSpecPayload;
use msgs::codec::Codec;
use msgs::persist;
use session::SessionSecrets;
use cipher;
use server::{ServerSessionImpl, ConnState};
use key_schedule::{KeySchedule, SecretKind};
use suites;
use hash_hs;
use sign;
use ring;
use verify;
use util;
use rand;
use error::TLSError;
use handshake::Expectation;

use std::sync::Arc;

macro_rules! extract_handshake(
  ( $m:expr, $t:path ) => (
    match $m.payload {
      MessagePayload::Handshake(ref hsp) => match hsp.payload {
        $t(ref hm) => Some(hm),
        _ => None
      },
      _ => None
    }
  )
);

pub type HandleFunction = fn(&mut ServerSessionImpl, m: Message) -> Result<ConnState, TLSError>;

// These are effectively operations on the ServerSessionImpl, variant on the
// connection state. They must not have state of their own -- so they're
// functions rather than a trait.
pub struct Handler {
    pub expect: Expectation,
    pub handle: HandleFunction,
}

fn process_extensions(sess: &mut ServerSessionImpl,
                      hello: &ClientHelloPayload)
                      -> Result<Vec<ServerExtension>, TLSError> {
    let mut ret = Vec::new();

    // ALPN
    let our_protocols = &sess.config.alpn_protocols;
    let maybe_their_protocols = hello.get_alpn_extension();
    if let Some(their_protocols) = maybe_their_protocols {
        let their_proto_strings = their_protocols.to_strings();

        if their_proto_strings.contains(&"".to_string()) {
            return Err(TLSError::PeerMisbehavedError("client offered empty ALPN protocol"
                .to_string()));
        }

        sess.alpn_protocol = util::first_in_both(&our_protocols, &their_proto_strings);
        match sess.alpn_protocol {
            Some(ref selected_protocol) => {
                info!("Chosen ALPN protocol {:?}", selected_protocol);
                ret.push(ServerExtension::make_alpn(selected_protocol.clone()))
            }
            _ => {}
        };
    }

    // SNI
    if hello.get_sni_extension().is_some() {
        ret.push(ServerExtension::ServerNameAcknowledgement);
    }

    if !sess.common.is_tls13 {
        // Renegotiation.
        // (We don't do reneg at all, but would support the secure version if we did.)
        let secure_reneg_offered =
            hello.find_extension(ExtensionType::RenegotiationInfo).is_some() ||
            hello.cipher_suites.contains(&CipherSuite::TLS_EMPTY_RENEGOTIATION_INFO_SCSV);

        if secure_reneg_offered {
            ret.push(ServerExtension::make_empty_renegotiation_info());
        }

        // Tickets:
        // If we get any SessionTicket extension and have tickets enabled,
        // we send an ack.
        if hello.find_extension(ExtensionType::SessionTicket).is_some() &&
           sess.config.ticketer.enabled() {
            sess.handshake_data.send_ticket = true;
            ret.push(ServerExtension::SessionTicketAcknowledgement);
        }
    }

    Ok(ret)
}

fn emit_server_hello(sess: &mut ServerSessionImpl,
                     hello: &ClientHelloPayload)
                     -> Result<(), TLSError> {
    let extensions = try!(process_extensions(sess, hello));

    if sess.handshake_data.session_id.is_empty() {
        let sessid = sess.config
            .session_storage
            .lock()
            .unwrap()
            .generate();
        sess.handshake_data.session_id = sessid;
    }

    let sh = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_2,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::ServerHello,
            payload: HandshakePayload::ServerHello(ServerHelloPayload {
                server_version: ProtocolVersion::TLSv1_2,
                random: Random::from_slice(&sess.handshake_data.randoms.server),
                session_id: sess.handshake_data.session_id.clone(),
                cipher_suite: sess.common.get_suite().suite,
                compression_method: Compression::Null,
                extensions: extensions,
            }),
        }),
    };

    debug!("sending server hello {:?}", sh);
    sess.handshake_data.transcript.add_message(&sh);
    sess.common.send_msg(sh, false);
    Ok(())
}

fn emit_certificate(sess: &mut ServerSessionImpl) {
    let cert_chain = sess.handshake_data.server_cert_chain.as_ref().unwrap().clone();

    let c = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_2,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::Certificate,
            payload: HandshakePayload::Certificate(cert_chain),
        }),
    };

    sess.handshake_data.transcript.add_message(&c);
    sess.common.send_msg(c, false);
}

fn emit_server_kx(sess: &mut ServerSessionImpl,
                  sigscheme: SignatureScheme,
                  group: &NamedGroup,
                  signer: Arc<Box<sign::Signer>>)
                  -> Result<(), TLSError> {
    let kx = try! {
        sess.common.get_suite()
            .start_server_kx(*group)
            .ok_or_else(|| TLSError::PeerMisbehavedError("key exchange failed".to_string()))
    };
    let secdh = ServerECDHParams::new(group, &kx.pubkey);

    let mut msg = Vec::new();
    msg.extend(&sess.handshake_data.randoms.client);
    msg.extend(&sess.handshake_data.randoms.server);
    secdh.encode(&mut msg);

    let sig = try! {
        signer.sign(sigscheme, &msg)
            .map_err(|_| TLSError::General("signing failed".to_string()))
    };

    let skx = ServerKeyExchangePayload::ECDHE(ECDHEServerKeyExchange {
        params: secdh,
        dss: DigitallySignedStruct::new(sigscheme, sig),
    });

    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_2,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::ServerKeyExchange,
            payload: HandshakePayload::ServerKeyExchange(skx),
        }),
    };

    sess.handshake_data.kx_data = Some(kx);
    sess.handshake_data.transcript.add_message(&m);
    sess.common.send_msg(m, false);
    Ok(())
}

fn emit_certificate_req(sess: &mut ServerSessionImpl) {
    if !sess.config.client_auth_offer {
        return;
    }

    let names = sess.config.client_auth_roots.get_subjects();

    let cr = CertificateRequestPayload {
        certtypes: vec![ ClientCertificateType::RSASign,
                     ClientCertificateType::ECDSASign ],
        sigschemes: SupportedSignatureSchemes::supported_verify(),
        canames: names,
    };

    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_2,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::CertificateRequest,
            payload: HandshakePayload::CertificateRequest(cr),
        }),
    };

    debug!("Sending CertificateRequest {:?}", m);
    sess.handshake_data.transcript.add_message(&m);
    sess.common.send_msg(m, false);
    sess.handshake_data.doing_client_auth = true;
}

fn emit_server_hello_done(sess: &mut ServerSessionImpl) {
    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_2,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::ServerHelloDone,
            payload: HandshakePayload::ServerHelloDone,
        }),
    };

    sess.handshake_data.transcript.add_message(&m);
    sess.common.send_msg(m, false);
}

fn incompatible(sess: &mut ServerSessionImpl, why: &str) -> TLSError {
    sess.common.send_fatal_alert(AlertDescription::HandshakeFailure);
    TLSError::PeerIncompatibleError(why.to_string())
}

fn illegal_param(sess: &mut ServerSessionImpl, why: &str) -> TLSError {
    sess.common.send_fatal_alert(AlertDescription::IllegalParameter);
    TLSError::PeerMisbehavedError(why.to_string())
}

fn decode_error(sess: &mut ServerSessionImpl, why: &str) -> TLSError {
    sess.common.send_fatal_alert(AlertDescription::DecodeError);
    TLSError::PeerMisbehavedError(why.to_string())
}

fn can_resume(sess: &ServerSessionImpl,
              resumedata: &Option<persist::ServerSessionValue>) -> bool {
    // The RFCs underspecify what happens if we try to resume to
    // an unoffered/varying suite.  We merely don't resume in weird cases.
    resumedata.is_some() &&
        resumedata.as_ref().unwrap().cipher_suite == sess.common.get_suite().suite
}

fn start_resumption(sess: &mut ServerSessionImpl,
                    client_hello: &ClientHelloPayload,
                    id: &SessionID,
                    resumedata: persist::ServerSessionValue)
                    -> Result<ConnState, TLSError> {
    info!("Resuming session");

    sess.handshake_data.session_id = id.clone();
    try!(emit_server_hello(sess, client_hello));

    let hashalg = sess.common.get_suite().get_hash();
    sess.secrets = Some(SessionSecrets::new_resume(&sess.handshake_data.randoms,
                                                   hashalg,
                                                   &resumedata.master_secret.0));
    sess.start_encryption_tls12();
    sess.handshake_data.valid_client_cert_chain = resumedata.client_cert_chain;
    sess.handshake_data.doing_resume = true;

    emit_ticket(sess);
    emit_ccs(sess);
    emit_finished(sess);
    return Ok(ConnState::ExpectCCS);
}

// Changing the keys must not span any fragmented handshake
// messages.  Otherwise the defragmented messages will have
// been protected with two different record layer protections,
// which is illegal.  Not mentioned in RFC.
fn check_aligned_handshake(sess: &mut ServerSessionImpl) -> Result<(), TLSError> {
    if !sess.common.handshake_joiner.is_empty() {
        Err(illegal_param(sess, "keys changed with pending hs fragment"))
    } else {
        Ok(())
    }
}

fn emit_server_hello_tls13(sess: &mut ServerSessionImpl,
                           share: &KeyShareEntry,
                           chosen_psk_idx: Option<usize>,
                           resuming_psk: Option<Vec<u8>>)
                           -> Result<(), TLSError> {
    let mut extensions = Vec::new();

    // Do key exchange
    let kxr = try! {
        suites::KeyExchange::start_ecdhe(share.group)
            .and_then(|kx| kx.complete(&share.payload.0))
            .ok_or_else(|| TLSError::PeerMisbehavedError("key exchange failed".to_string()))
    };

    let kse = KeyShareEntry::new(share.group, &kxr.pubkey);
    extensions.push(ServerExtension::KeyShare(kse));

    if let Some(psk_idx) = chosen_psk_idx {
        extensions.push(ServerExtension::PresharedKey(psk_idx as u16));
    }

    let sh = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_0,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::ServerHello,
            payload: HandshakePayload::ServerHello(ServerHelloPayload {
                server_version: ProtocolVersion::Unknown(0x7f12),
                random: Random::from_slice(&sess.handshake_data.randoms.server),
                session_id: SessionID::empty(),
                cipher_suite: sess.common.get_suite().suite,
                compression_method: Compression::Null,
                extensions: extensions,
            }),
        }),
    };

    try!(check_aligned_handshake(sess));

    debug!("sending server hello {:?}", sh);
    sess.handshake_data.transcript.add_message(&sh);
    sess.common.send_msg(sh, false);

    // Start key schedule
    let suite = sess.common.get_suite();
    let mut key_schedule = KeySchedule::new(suite.get_hash());
    if let Some(psk) = resuming_psk {
        key_schedule.input_secret(&psk);
    } else {
        key_schedule.input_empty();
    }
    key_schedule.input_secret(&kxr.premaster_secret);

    let handshake_hash = sess.handshake_data.transcript.get_current_hash();
    let write_key = key_schedule.derive(SecretKind::ServerHandshakeTrafficSecret, &handshake_hash);
    let read_key = key_schedule.derive(SecretKind::ClientHandshakeTrafficSecret, &handshake_hash);
    sess.common.set_message_encrypter(cipher::new_tls13_write(suite, &write_key));
    sess.common.set_message_decrypter(cipher::new_tls13_read(suite, &read_key));
    key_schedule.current_client_traffic_secret = read_key;
    key_schedule.current_server_traffic_secret = write_key;
    sess.common.set_key_schedule(key_schedule);

    Ok(())
}

fn emit_hello_retry_request(sess: &mut ServerSessionImpl, group: NamedGroup) {
    let mut req = HelloRetryRequest {
        server_version: ProtocolVersion::Unknown(0x7f12),
        extensions: Vec::new(),
    };

    req.extensions.push(HelloRetryExtension::KeyShare(group));

    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_0,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::HelloRetryRequest,
            payload: HandshakePayload::HelloRetryRequest(req),
        }),
    };

    debug!("Requesting retry {:?}", m);
    sess.handshake_data.transcript.add_message(&m);
    sess.common.send_msg(m, false);
}

fn emit_encrypted_extensions(sess: &mut ServerSessionImpl,
                             hello: &ClientHelloPayload)
                             -> Result<(), TLSError> {
    let encrypted_exts = try!(process_extensions(sess, hello));
    let ee = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_3,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::EncryptedExtensions,
            payload: HandshakePayload::EncryptedExtensions(encrypted_exts),
        }),
    };

    debug!("sending encrypted extensions {:?}", ee);
    sess.handshake_data.transcript.add_message(&ee);
    sess.common.send_msg(ee, true);
    Ok(())
}

fn emit_certificate_req_tls13(sess: &mut ServerSessionImpl) {
    if !sess.config.client_auth_offer {
        return;
    }

    let names = sess.config.client_auth_roots.get_subjects();

    let cr = CertificateRequestPayloadTLS13 {
        context: PayloadU8::empty(),
        sigschemes: SupportedSignatureSchemes::supported_verify(),
        canames: names,
        extensions: Vec::new(),
    };

    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_3,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::CertificateRequest,
            payload: HandshakePayload::CertificateRequestTLS13(cr),
        }),
    };

    debug!("Sending CertificateRequest {:?}", m);
    sess.handshake_data.transcript.add_message(&m);
    sess.common.send_msg(m, true);
    sess.handshake_data.doing_client_auth = true;
}

fn emit_certificate_tls13(sess: &mut ServerSessionImpl) {
    let mut cert_body = CertificatePayloadTLS13::new();

    for cert in sess.handshake_data.server_cert_chain.as_ref().unwrap() {
        let entry = CertificateEntry {
            cert: cert.clone(),
            exts: Vec::new(),
        };

        cert_body.list.push(entry);
    }

    let c = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_3,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::Certificate,
            payload: HandshakePayload::CertificateTLS13(cert_body),
        }),
    };

    debug!("sending certificate {:?}", c);
    sess.handshake_data.transcript.add_message(&c);
    sess.common.send_msg(c, true);
}

fn emit_certificate_verify_tls13(sess: &mut ServerSessionImpl,
                                 schemes: &SupportedSignatureSchemes,
                                 signer: &Arc<Box<sign::Signer>>)
                                 -> Result<(), TLSError> {
    let mut message = Vec::new();
    message.resize(64, 0x20u8);
    message.extend_from_slice(b"TLS 1.3, server CertificateVerify\x00");
    message.extend_from_slice(&sess.handshake_data.transcript.get_current_hash());

    let scheme = try!(signer.choose_scheme(schemes)
    .ok_or_else(|| TLSError::PeerIncompatibleError("no overlapping sigschemes".to_string())));

    let sig = try!(signer.sign(scheme, &message)
    .map_err(|_| TLSError::General("cannot sign".to_string())));

    let cv = DigitallySignedStruct::new(scheme, sig);

    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_3,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::CertificateVerify,
            payload: HandshakePayload::CertificateVerify(cv),
        }),
    };

    debug!("sending certificate-verify {:?}", m);
    sess.handshake_data.transcript.add_message(&m);
    sess.common.send_msg(m, true);
    Ok(())
}

fn emit_finished_tls13(sess: &mut ServerSessionImpl) {
    let handshake_hash = sess.handshake_data.transcript.get_current_hash();
    let verify_data = sess.common
        .get_key_schedule()
        .sign_finish(SecretKind::ServerHandshakeTrafficSecret, &handshake_hash);
    let verify_data_payload = Payload::new(verify_data);

    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_3,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::Finished,
            payload: HandshakePayload::Finished(verify_data_payload),
        }),
    };

    debug!("sending finished {:?}", m);
    sess.handshake_data.transcript.add_message(&m);
    sess.handshake_data.hash_at_server_fin = sess.handshake_data.transcript.get_current_hash();
    sess.common.send_msg(m, true);

    // Now move to application data keys.
    sess.common.get_mut_key_schedule().input_empty();
    let write_key = sess.common
        .get_key_schedule()
        .derive(SecretKind::ServerApplicationTrafficSecret,
                &sess.handshake_data.hash_at_server_fin);
    let suite = sess.common.get_suite();
    sess.common.set_message_encrypter(cipher::new_tls13_write(suite, &write_key));
    sess.common
        .get_mut_key_schedule()
        .current_server_traffic_secret = write_key;
}

fn check_binder(sess: &mut ServerSessionImpl,
                client_hello: &Message,
                psk: &[u8],
                binder: &[u8])
                -> bool {
    let binder_plaintext = match client_hello.payload {
        MessagePayload::Handshake(ref hmp) => hmp.get_encoding_for_binder_signing(),
        _ => unreachable!(),
    };

    let suite_hash = sess.common.get_suite().get_hash();
    let handshake_hash =
        sess.handshake_data.transcript.get_hash_given(suite_hash, &binder_plaintext);

    let mut empty_hash_ctx = hash_hs::HandshakeHash::new();
    empty_hash_ctx.start_hash(suite_hash);
    let empty_hash = empty_hash_ctx.get_current_hash();

    let mut key_schedule = KeySchedule::new(suite_hash);
    key_schedule.input_secret(psk);
    let base_key = key_schedule.derive(SecretKind::ResumptionPSKBinderKey, &empty_hash);
    let real_binder = key_schedule.sign_verify_data(&base_key, &handshake_hash);

    ring::constant_time::verify_slices_are_equal(&real_binder, &binder).is_ok()
}

fn handle_client_hello_tls13(sess: &mut ServerSessionImpl,
                             chm: &Message,
                             signer: &Arc<Box<sign::Signer>>)
                             -> Result<ConnState, TLSError> {
    let client_hello = extract_handshake!(chm, HandshakePayload::ClientHello).unwrap();

    if client_hello.compression_methods.len() != 1 {
        return Err(illegal_param(sess, "client offered wrong compressions"));
    }

    let groups_ext = try!(client_hello.get_namedgroups_extension()
    .ok_or_else(|| incompatible(sess, "client didn't describe groups")));

    let mut sigschemes_ext = try!(client_hello.get_sigalgs_extension()
    .ok_or_else(|| incompatible(sess, "client didn't describe sigschemes")))
        .clone();

    let tls13_schemes = SupportedSignatureSchemes::supported_sign_tls13();
    sigschemes_ext.retain(|scheme| tls13_schemes.contains(scheme));

    let shares_ext = try!(client_hello.get_keyshare_extension()
    .ok_or_else(|| incompatible(sess, "client didn't send keyshares")));

    if client_hello.has_keyshare_extension_with_duplicates() {
        return Err(illegal_param(sess, "client sent duplicate keyshares"));
    }

    let share_groups: Vec<NamedGroup> = shares_ext.iter()
        .map(|share| share.group)
        .collect();

    let chosen_group = util::first_in_both(&NamedGroups::supported(), &share_groups);
    if chosen_group.is_none() {
        // We don't have a suitable key share.  Choose a suitable group and
        // send a HelloRetryRequest.
        let retry_group_maybe = util::first_in_both(&NamedGroups::supported(), groups_ext);
        sess.handshake_data.transcript.add_message(chm);

        if let Some(group) = retry_group_maybe {
            if sess.handshake_data.done_retry {
                return Err(illegal_param(sess, "did not follow retry request"));
            } else {
                emit_hello_retry_request(sess, group);
                sess.handshake_data.done_retry = true;
                return Ok(ConnState::ExpectClientHello);
            }
        } else {
            return Err(incompatible(sess, "no kx group overlap with client"));
        }
    }

    let chosen_group = chosen_group.unwrap();
    let chosen_share = shares_ext.iter()
        .find(|share| share.group == chosen_group)
        .unwrap();

    let mut chosen_psk_index = None;
    let mut resuming_psk = None;
    if let Some(psk_offer) = client_hello.get_psk() {
        if !client_hello.check_psk_ext_is_last() {
            return Err(illegal_param(sess, "psk extension in wrong position"));
        }

        if psk_offer.binders.len() == 0 {
            return Err(decode_error(sess, "psk extension missing binder"));
        }

        if psk_offer.binders.len() != psk_offer.identities.len() {
            return Err(illegal_param(sess, "psk extension mismatched ids/binders"));
        }

        for (i, psk_id) in psk_offer.identities.iter().enumerate() {
            let maybe_resume = sess.config
                .ticketer
                .decrypt(&psk_id.identity.0)
                .and_then(|plain| persist::ServerSessionValue::read_bytes(&plain));

            if !can_resume(sess, &maybe_resume) {
                continue;
            }

            let resume = maybe_resume.unwrap();

            if !check_binder(sess, chm, &resume.master_secret.0, &psk_offer.binders[i].0) {
                sess.common.send_fatal_alert(AlertDescription::DecryptError);
                return Err(TLSError::PeerMisbehavedError("client sent wrong binder".to_string()));
            }

            chosen_psk_index = Some(i);
            resuming_psk = Some(resume.master_secret.0);
            break;
        }
    }

    if !client_hello.psk_mode_offered(PSKKeyExchangeMode::PSK_DHE_KE) {
        warn!("Resumption ignored, DHE_KE not offered");
        sess.handshake_data.send_ticket = false;
        chosen_psk_index = None;
        resuming_psk = None;
    } else {
        sess.handshake_data.send_ticket = true;
    }

    let full_handshake = resuming_psk.is_none();
    sess.handshake_data.transcript.add_message(chm);
    try!(emit_server_hello_tls13(sess, chosen_share, chosen_psk_index, resuming_psk));
    try!(emit_encrypted_extensions(sess, client_hello));

    if full_handshake {
        emit_certificate_req_tls13(sess);
        emit_certificate_tls13(sess);
        try!(emit_certificate_verify_tls13(sess, &sigschemes_ext, signer));
    }
    try!(check_aligned_handshake(sess));
    emit_finished_tls13(sess);

    if sess.handshake_data.doing_client_auth && full_handshake {
        Ok(ConnState::ExpectCertificateTLS13)
    } else {
        Ok(ConnState::ExpectFinishedTLS13)
    }
}

fn handle_client_hello(sess: &mut ServerSessionImpl, m: Message) -> Result<ConnState, TLSError> {
    let client_hello = extract_handshake!(m, HandshakePayload::ClientHello).unwrap();
    let tls13_enabled = sess.config.versions.contains(&ProtocolVersion::TLSv1_3);
    let tls12_enabled = sess.config.versions.contains(&ProtocolVersion::TLSv1_2);
    debug!("we got a clienthello {:?}", client_hello);

    if client_hello.client_version.get_u16() < ProtocolVersion::TLSv1_2.get_u16() {
        sess.common.send_fatal_alert(AlertDescription::ProtocolVersion);
        return Err(TLSError::PeerIncompatibleError("client does not support TLSv1_2".to_string()));
    }

    if !client_hello.compression_methods.contains(&Compression::Null) {
        sess.common.send_fatal_alert(AlertDescription::IllegalParameter);
        return Err(TLSError::PeerIncompatibleError("client did not offer Null compression"
            .to_string()));
    }

    if client_hello.has_duplicate_extension() {
        return Err(decode_error(sess, "client sent duplicate extensions"));
    }

    // Are we doing TLS1.3?
    let maybe_versions_ext = client_hello.get_versions_extension();
    if let Some(versions) = maybe_versions_ext {
        if versions.contains(&ProtocolVersion::Unknown(0x7f12)) && tls13_enabled {
            sess.common.is_tls13 = true;
        } else if !versions.contains(&ProtocolVersion::TLSv1_2) || !tls12_enabled {
            sess.common.send_fatal_alert(AlertDescription::ProtocolVersion);
            return Err(incompatible(sess, "TLS1.2 not offered/enabled"));
        }
    } else {
        if !tls12_enabled && tls13_enabled {
            sess.common.send_fatal_alert(AlertDescription::ProtocolVersion);
            return Err(incompatible(sess, "Server requires TLS1.3, but client omitted versions ext"));
        }
    }

    // Common to TLS1.2 and TLS1.3: ciphersuite and certificate selection.
    let default_sigschemes_ext = SupportedSignatureSchemes::default();

    let sni_ext = client_hello.get_sni_extension()
        .and_then(|sni| sni.get_hostname());
    let sigschemes_ext = client_hello.get_sigalgs_extension()
        .unwrap_or(&default_sigschemes_ext);

    debug!("sni {:?}", sni_ext);
    debug!("sig schemes {:?}", sigschemes_ext);

    // Choose a certificate.
    let maybe_cert_key = sess.config.cert_resolver.resolve(sni_ext, sigschemes_ext);
    if maybe_cert_key.is_none() {
        sess.common.send_fatal_alert(AlertDescription::AccessDenied);
        return Err(TLSError::General("no server certificate chain resolved".to_string()));
    }
    let (cert_chain, private_key) = maybe_cert_key.unwrap();
    sess.handshake_data.server_cert_chain = Some(cert_chain);

    // Reduce our supported ciphersuites by the certificate.
    // (no-op for TLS1.3)
    let suitable_suites = suites::reduce_given_sigalg(&sess.config.ciphersuites,
                                                      &private_key.algorithm());

    // And version
    let protocol_version = if sess.common.is_tls13 {
        ProtocolVersion::TLSv1_3
    } else {
        ProtocolVersion::TLSv1_2
    };

    let suitable_suites = suites::reduce_given_version(&suitable_suites, protocol_version);

    let maybe_ciphersuite = if sess.config.ignore_client_order {
        suites::choose_ciphersuite_preferring_server(&client_hello.cipher_suites, &suitable_suites)
    } else {
        suites::choose_ciphersuite_preferring_client(&client_hello.cipher_suites, &suitable_suites)
    };

    if maybe_ciphersuite.is_none() {
        return Err(incompatible(sess, "no ciphersuites in common"));
    }

    info!("decided upon suite {:?}", maybe_ciphersuite.as_ref().unwrap());
    sess.common.set_suite(maybe_ciphersuite.unwrap());

    // Start handshake hash.
    if !sess.handshake_data.transcript.start_hash(sess.common.get_suite().get_hash()) {
        sess.common.send_fatal_alert(AlertDescription::IllegalParameter);
        return Err(TLSError::PeerIncompatibleError("hash differed on retry"
            .to_string()));
    }

    if sess.common.is_tls13 {
        return handle_client_hello_tls13(sess, &m, &private_key);
    }

    // -- TLS1.2 only from hereon in --
    sess.handshake_data.transcript.add_message(&m);
    // Save their Random.
    client_hello.random.write_slice(&mut sess.handshake_data.randoms.client);

    let groups_ext = try!(client_hello.get_namedgroups_extension()
                          .ok_or_else(|| incompatible(sess, "client didn't describe groups")));
    let ecpoints_ext = try!(client_hello.get_ecpoints_extension()
                          .ok_or_else(|| incompatible(sess, "client didn't describe ec points")));

    debug!("namedgroups {:?}", groups_ext);
    debug!("ecpoints {:?}", ecpoints_ext);

    if !ecpoints_ext.contains(&ECPointFormat::Uncompressed) {
        sess.common.send_fatal_alert(AlertDescription::IllegalParameter);
        return Err(TLSError::PeerIncompatibleError("client didn't support uncompressed ec points"
            .to_string()));
    }

    // -- Check for resumption --
    // We can do this either by (in order of preference):
    // 1. receiving a ticket that decrypts
    // 2. receiving a sessionid that is in our cache
    //
    // If we receive a ticket, the sessionid won't be in our
    // cache, so don't check.
    //
    // If either works, we end up with a ServerSessionValue
    // which is passed to start_resumption and concludes
    // our handling of the ClientHello.
    //
    let mut ticket_received = false;

    if let Some(ticket_ext) = client_hello.get_ticket_extension() {
        match ticket_ext {
            &ClientExtension::SessionTicketOffer(ref ticket) => {
                ticket_received = true;
                info!("Ticket received");

                let maybe_resume = sess.config
                    .ticketer
                    .decrypt(&ticket.0)
                    .and_then(|plain| persist::ServerSessionValue::read_bytes(&plain));

                if can_resume(sess, &maybe_resume) {
                    return start_resumption(sess,
                                            client_hello,
                                            &client_hello.session_id,
                                            maybe_resume.unwrap());
                } else {
                    info!("Ticket didn't decrypt");
                }
            }

            // eg ClientExtension::SessionTicketRequest
            _ => (),
        }
    }

    // Perhaps resume?  If we received a ticket, the sessionid
    // does not correspond to a real session.
    if !client_hello.session_id.is_empty() && !ticket_received {
        let maybe_resume = {
                let persist = sess.config.session_storage.lock().unwrap();
                persist.get(&client_hello.session_id)
            }
            .and_then(|x| persist::ServerSessionValue::read_bytes(&x));

        if can_resume(sess, &maybe_resume) {
            return start_resumption(sess,
                                    client_hello,
                                    &client_hello.session_id,
                                    maybe_resume.unwrap());
        }
    }

    // Now we have chosen a ciphersuite, we can make kx decisions.
    let sigscheme = try! {
        sess.common.get_suite()
            .resolve_sig_scheme(sigschemes_ext)
            .ok_or_else(|| incompatible(sess, "no supported sig scheme"))
    };

    let group = try! {
        util::first_in_both(NamedGroups::supported().as_slice(),
                            groups_ext.as_slice())
            .ok_or_else(|| incompatible(sess, "no supported group"))
    };

    let ecpoint = try! {
        util::first_in_both(ECPointFormatList::supported().as_slice(),
                            ecpoints_ext.as_slice())
            .ok_or_else(|| incompatible(sess, "no supported point format"))
    };

    debug_assert_eq!(ecpoint, ECPointFormat::Uncompressed);

    try!(emit_server_hello(sess, client_hello));
    emit_certificate(sess);
    try!(emit_server_kx(sess, sigscheme, &group, private_key));
    emit_certificate_req(sess);
    emit_server_hello_done(sess);

    if sess.handshake_data.doing_client_auth {
        Ok(ConnState::ExpectCertificate)
    } else {
        Ok(ConnState::ExpectClientKX)
    }
}

pub static EXPECT_CLIENT_HELLO: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::Handshake],
        handshake_types: &[HandshakeType::ClientHello],
    },
    handle: handle_client_hello,
};

// --- Process client's Certificate for client auth ---
fn handle_certificate(sess: &mut ServerSessionImpl, m: Message) -> Result<ConnState, TLSError> {
    sess.handshake_data.transcript.add_message(&m);
    let cert_chain = extract_handshake!(m, HandshakePayload::Certificate).unwrap();

    if cert_chain.is_empty() && !sess.config.client_auth_mandatory {
        info!("client auth requested but no certificate supplied");
        sess.handshake_data.doing_client_auth = false;
        sess.handshake_data.transcript.abandon_client_auth();
        return Ok(ConnState::ExpectClientKX);
    }

    debug!("certs {:?}", cert_chain);

    try! {
        verify::verify_client_cert(&sess.config.client_auth_roots,
                                   &cert_chain)
            .or_else(|err| {
                     incompatible(sess, "certificate invalid");
                     Err(err)
                     })
    };

    sess.handshake_data.valid_client_cert_chain = Some(cert_chain.clone());
    Ok(ConnState::ExpectClientKX)
}

pub static EXPECT_CERTIFICATE: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::Handshake],
        handshake_types: &[HandshakeType::Certificate],
    },
    handle: handle_certificate,
};

fn handle_certificate_tls13(sess: &mut ServerSessionImpl,
                            m: Message)
                            -> Result<ConnState, TLSError> {
    sess.handshake_data.transcript.add_message(&m);
    let certp = extract_handshake!(m, HandshakePayload::CertificateTLS13).unwrap();
    let cert_chain = certp.convert();

    if cert_chain.is_empty() {
        if !sess.config.client_auth_mandatory {
            info!("client auth requested but no certificate supplied");
            sess.handshake_data.doing_client_auth = false;
            sess.handshake_data.transcript.abandon_client_auth();
            return Ok(ConnState::ExpectFinishedTLS13);
        }

        sess.common.send_fatal_alert(AlertDescription::CertificateRequired);
        return Err(TLSError::NoCertificatesPresented);
    }

    try! {
        verify::verify_client_cert(&sess.config.client_auth_roots,
                                   &cert_chain)
    };

    sess.handshake_data.valid_client_cert_chain = Some(cert_chain);
    Ok(ConnState::ExpectCertificateVerifyTLS13)
}

pub static EXPECT_CERTIFICATE_TLS13: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::Handshake],
        handshake_types: &[HandshakeType::Certificate],
    },
    handle: handle_certificate_tls13,
};

// --- Process client's KeyExchange ---
fn handle_client_kx(sess: &mut ServerSessionImpl, m: Message) -> Result<ConnState, TLSError> {
    let client_kx = extract_handshake!(m, HandshakePayload::ClientKeyExchange).unwrap();
    sess.handshake_data.transcript.add_message(&m);

    // Complete key agreement, and set up encryption with the
    // resulting premaster secret.
    let kx = sess.handshake_data.kx_data.take().unwrap();
    if !kx.check_client_params(&client_kx.0) {
        sess.common.send_fatal_alert(AlertDescription::DecodeError);
        return Err(TLSError::CorruptMessagePayload(ContentType::Handshake));
    }

    let kxd = try! {
        kx.server_complete(&client_kx.0)
            .ok_or_else(|| TLSError::PeerMisbehavedError("key exchange completion failed"
                                                         .to_string()))
    };

    let hashalg = sess.common.get_suite().get_hash();
    sess.secrets =
        Some(SessionSecrets::new(&sess.handshake_data.randoms, hashalg, &kxd.premaster_secret));
    sess.start_encryption_tls12();

    if sess.handshake_data.doing_client_auth {
        Ok(ConnState::ExpectCertificateVerify)
    } else {
        Ok(ConnState::ExpectCCS)
    }
}

pub static EXPECT_CLIENT_KX: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::Handshake],
        handshake_types: &[HandshakeType::ClientKeyExchange],
    },
    handle: handle_client_kx,
};

// --- Process client's certificate proof ---
fn handle_certificate_verify(sess: &mut ServerSessionImpl,
                             m: Message)
                             -> Result<ConnState, TLSError> {
    let rc = {
        let sig = extract_handshake!(m, HandshakePayload::CertificateVerify).unwrap();
        let certs = sess.handshake_data.valid_client_cert_chain.as_ref().unwrap();
        let handshake_msgs = sess.handshake_data.transcript.take_handshake_buf();

        verify::verify_signed_struct(&handshake_msgs, &certs[0], &sig)
    };

    if rc.is_err() {
        sess.common.send_fatal_alert(AlertDescription::AccessDenied);
        return Err(rc.unwrap_err());
    } else {
        debug!("client CertificateVerify OK");
    }

    sess.handshake_data.transcript.add_message(&m);
    Ok(ConnState::ExpectCCS)
}

pub static EXPECT_CERTIFICATE_VERIFY: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::Handshake],
        handshake_types: &[HandshakeType::CertificateVerify],
    },
    handle: handle_certificate_verify,
};

fn handle_certificate_verify_tls13(sess: &mut ServerSessionImpl,
                                   m: Message)
                                   -> Result<ConnState, TLSError> {
    let rc = {
        let sig = extract_handshake!(m, HandshakePayload::CertificateVerify).unwrap();
        let certs = sess.handshake_data.valid_client_cert_chain.as_ref().unwrap();
        let handshake_hash = sess.handshake_data.transcript.get_current_hash();
        sess.handshake_data.transcript.abandon_client_auth();

        verify::verify_tls13(&certs[0],
                             &sig,
                             &handshake_hash,
                             b"TLS 1.3, client CertificateVerify\x00")
    };

    if rc.is_err() {
        sess.common.send_fatal_alert(AlertDescription::AccessDenied);
        return Err(rc.unwrap_err());
    } else {
        debug!("client CertificateVerify OK");
    }

    sess.handshake_data.transcript.add_message(&m);
    Ok(ConnState::ExpectFinishedTLS13)
}

pub static EXPECT_CERTIFICATE_VERIFY_TLS13: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::Handshake],
        handshake_types: &[HandshakeType::CertificateVerify],
    },
    handle: handle_certificate_verify_tls13,
};

// --- Process client's ChangeCipherSpec ---
fn handle_ccs(sess: &mut ServerSessionImpl, _m: Message) -> Result<ConnState, TLSError> {
    // CCS should not be received interleaved with fragmented handshake-level
    // message.
    if !sess.common.handshake_joiner.is_empty() {
        warn!("CCS received interleaved with fragmented handshake");
        return Err(TLSError::InappropriateMessage {
            expect_types: vec![ ContentType::Handshake ],
            got_type: ContentType::ChangeCipherSpec,
        });
    }

    sess.common.peer_now_encrypting();
    Ok(ConnState::ExpectFinished)
}

pub static EXPECT_CCS: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::ChangeCipherSpec],
        handshake_types: &[],
    },
    handle: handle_ccs,
};

// --- Process client's Finished ---
fn emit_ticket(sess: &mut ServerSessionImpl) {
    if !sess.handshake_data.send_ticket {
        return;
    }

    // If we can't produce a ticket for some reason, we can't
    // report an error. Send an empty one.
    let plain = get_server_session_value(sess).get_encoding();
    let ticket = sess.config
        .ticketer
        .encrypt(&plain)
        .unwrap_or_else(Vec::new);
    let ticket_lifetime = sess.config.ticketer.get_lifetime();

    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_2,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::NewSessionTicket,
            payload:
                HandshakePayload::NewSessionTicket(NewSessionTicketPayload::new(ticket_lifetime,
                                                                                ticket)),
        }),
    };

    sess.handshake_data.transcript.add_message(&m);
    sess.common.send_msg(m, false);
}

fn emit_ccs(sess: &mut ServerSessionImpl) {
    let m = Message {
        typ: ContentType::ChangeCipherSpec,
        version: ProtocolVersion::TLSv1_2,
        payload: MessagePayload::ChangeCipherSpec(ChangeCipherSpecPayload {}),
    };

    sess.common.send_msg(m, false);
    sess.common.we_now_encrypting();
}

fn emit_finished(sess: &mut ServerSessionImpl) {
    let vh = sess.handshake_data.transcript.get_current_hash();
    let verify_data = sess.secrets.as_ref().unwrap().server_verify_data(&vh);
    let verify_data_payload = Payload::new(verify_data);

    let f = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_2,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::Finished,
            payload: HandshakePayload::Finished(verify_data_payload),
        }),
    };

    sess.handshake_data.transcript.add_message(&f);
    sess.common.send_msg(f, true);
}

fn get_server_session_value(sess: &ServerSessionImpl) -> persist::ServerSessionValue {
    let scs = sess.common.get_suite();
    let client_certs = &sess.handshake_data.valid_client_cert_chain;

    // nb cannot use get_protocol_version here; FIXME
    let (version, secret) = if sess.common.is_tls13 {
        let handshake_hash = sess.handshake_data
            .transcript
            .get_current_hash();
        let resume_secret = sess.common
            .get_key_schedule()
            .derive(SecretKind::ResumptionMasterSecret, &handshake_hash);
        (ProtocolVersion::TLSv1_3, resume_secret)
    } else {
        (ProtocolVersion::TLSv1_2, sess.secrets.as_ref().unwrap().get_master_secret())
    };

    persist::ServerSessionValue::new(version, scs.suite, secret, client_certs)
}

fn handle_finished(sess: &mut ServerSessionImpl, m: Message) -> Result<ConnState, TLSError> {
    let finished = extract_handshake!(m, HandshakePayload::Finished).unwrap();

    let vh = sess.handshake_data.transcript.get_current_hash();
    let expect_verify_data = sess.secrets.as_ref().unwrap().client_verify_data(&vh);

    use ring;
    try! {
        ring::constant_time::verify_slices_are_equal(&expect_verify_data, &finished.0)
            .map_err(|_| {
                     sess.common.send_fatal_alert(AlertDescription::DecryptError);
                     warn!("Finished wrong");
                     TLSError::DecryptError
                     })
    };

    // Save session, perhaps
    if !sess.handshake_data.doing_resume && !sess.handshake_data.session_id.is_empty() {
        let value = get_server_session_value(sess);

        let mut persist = sess.config.session_storage.lock().unwrap();
        if persist.put(&sess.handshake_data.session_id, value.get_encoding()) {
            info!("Session saved");
        } else {
            info!("Session not saved");
        }
    }

    // Send our CCS and Finished.
    sess.handshake_data.transcript.add_message(&m);
    if !sess.handshake_data.doing_resume {
        emit_ticket(sess);
        emit_ccs(sess);
        emit_finished(sess);
    }
    Ok(ConnState::TrafficTLS12)
}

pub static EXPECT_FINISHED: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::Handshake],
        handshake_types: &[HandshakeType::Finished],
    },
    handle: handle_finished,
};

fn emit_ticket_tls13(sess: &mut ServerSessionImpl) {
    if !sess.handshake_data.send_ticket {
        return;
    }

    let plain = get_server_session_value(sess).get_encoding();
    let maybe_ticket = sess.config
        .ticketer
        .encrypt(&plain);
    let ticket_lifetime = sess.config.ticketer.get_lifetime();

    if maybe_ticket.is_none() {
        return;
    }

    let ticket = maybe_ticket.unwrap();
    let age_add = rand::random_u32(); // nb, we don't do 0-RTT data, so whatever
    let payload = NewSessionTicketPayloadTLS13::new(ticket_lifetime, age_add, ticket);
    let m = Message {
        typ: ContentType::Handshake,
        version: ProtocolVersion::TLSv1_3,
        payload: MessagePayload::Handshake(HandshakeMessagePayload {
            typ: HandshakeType::NewSessionTicket,
            payload: HandshakePayload::NewSessionTicketTLS13(payload),
        }),
    };

    debug!("sending new ticket {:?}", m);
    sess.handshake_data.transcript.add_message(&m);
    sess.common.send_msg(m, true);
}

fn handle_finished_tls13(sess: &mut ServerSessionImpl, m: Message) -> Result<ConnState, TLSError> {
    let finished = extract_handshake!(m, HandshakePayload::Finished).unwrap();

    let handshake_hash = sess.handshake_data.transcript.get_current_hash();
    let expect_verify_data = sess.common
        .get_key_schedule()
        .sign_finish(SecretKind::ClientHandshakeTrafficSecret, &handshake_hash);

    use ring;
    try! {
        ring::constant_time::verify_slices_are_equal(&expect_verify_data, &finished.0)
            .map_err(|_| {
                     sess.common.send_fatal_alert(AlertDescription::DecryptError);
                     warn!("Finished wrong");
                     TLSError::DecryptError
                     })
    };

    // nb. future derivations include Client Finished, but not the
    // main application data keying.
    sess.handshake_data.transcript.add_message(&m);

    // Now move to using application data keys for client traffic.
    // Server traffic is already done.
    let read_key = sess.common
        .get_key_schedule()
        .derive(SecretKind::ClientApplicationTrafficSecret,
                &sess.handshake_data.hash_at_server_fin);

    let suite = sess.common.get_suite();
    try!(check_aligned_handshake(sess));
    sess.common.set_message_decrypter(cipher::new_tls13_read(suite, &read_key));
    sess.common
        .get_mut_key_schedule()
        .current_client_traffic_secret = read_key;

    if sess.config.ticketer.enabled() {
        emit_ticket_tls13(sess);
    }

    Ok(ConnState::TrafficTLS13)
}

pub static EXPECT_FINISHED_TLS13: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::Handshake],
        handshake_types: &[HandshakeType::Finished],
    },
    handle: handle_finished_tls13,
};

// --- Process traffic ---
fn handle_traffic(sess: &mut ServerSessionImpl, mut m: Message) -> Result<ConnState, TLSError> {
    sess.common.take_received_plaintext(m.take_opaque_payload().unwrap());
    Ok(ConnState::TrafficTLS12)
}

pub static TRAFFIC_TLS12: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::ApplicationData],
        handshake_types: &[],
    },
    handle: handle_traffic,
};

fn handle_key_update(sess: &mut ServerSessionImpl, m: Message) -> Result<(), TLSError> {
    let kur = extract_handshake!(m, HandshakePayload::KeyUpdate).unwrap();
    sess.common.process_key_update(kur, SecretKind::ClientApplicationTrafficSecret)
}

fn handle_traffic_tls13(sess: &mut ServerSessionImpl, m: Message) -> Result<ConnState, TLSError> {
    if m.is_content_type(ContentType::ApplicationData) {
        try!(handle_traffic(sess, m));
    } else if m.is_handshake_type(HandshakeType::KeyUpdate) {
        try!(handle_key_update(sess, m));
    }

    Ok(ConnState::TrafficTLS13)
}

pub static TRAFFIC_TLS13: Handler = Handler {
    expect: Expectation {
        content_types: &[ContentType::ApplicationData, ContentType::Handshake],
        handshake_types: &[HandshakeType::KeyUpdate],
    },
    handle: handle_traffic_tls13,
};