aws-crt 0.1.4 → 0.1.5

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_server_hello_retry_test.c

@@ -28,6 +28,8 @@
 #include "tls/extensions/s2n_server_key_share.h"
 
 #include "error/s2n_errno.h"
+#include "utils/s2n_result.h"
+#include "tls/s2n_internal.h"
 
 #define HELLO_RETRY_MSG_NO 1
 
@@ -37,8 +39,45 @@ const uint8_t COMPRESSION_METHOD_SIZE = 1;
 struct client_hello_context {
     int invocations;
     s2n_client_hello_cb_mode mode;
+    bool mark_done;
+    bool enable_poll;
 };
 
+int s2n_negotiate_poll_hello_retry(struct s2n_connection *server_conn,
+                struct s2n_connection *client_conn,
+                struct client_hello_context *client_hello_ctx)
+{
+    s2n_blocked_status blocked = S2N_NOT_BLOCKED;
+    EXPECT_FAILURE_WITH_ERRNO(s2n_negotiate(client_conn, &blocked), S2N_ERR_IO_BLOCKED);
+
+    int expected_invocation = 0;
+
+    /* if polling is enabled then confirm that the callback is incremented each time */
+    if (client_hello_ctx->enable_poll) {
+        do {
+            /* invocation should increase each time s2n_negotiate is called */
+            EXPECT_FAILURE_WITH_ERRNO(s2n_negotiate(server_conn, &blocked), S2N_ERR_ASYNC_BLOCKED);
+            EXPECT_EQUAL(blocked, S2N_BLOCKED_ON_APPLICATION_INPUT);
+            expected_invocation++;
+            EXPECT_EQUAL(client_hello_ctx->invocations, expected_invocation);
+        } while (expected_invocation < 10);
+    }
+    EXPECT_EQUAL(client_hello_ctx->invocations, expected_invocation);
+
+    /* complete the callback on the next call */
+    client_hello_ctx->mark_done = true;
+    EXPECT_SUCCESS(s2n_negotiate_test_server_and_client(server_conn, client_conn));
+
+    /*
+     * hello retry will invoke the s2n_negotiate twice but the callback should
+     * be called once regardless of polling
+     */
+    expected_invocation++;
+    EXPECT_EQUAL(client_hello_ctx->invocations, expected_invocation);
+
+    return S2N_SUCCESS;
+}
+
 static int client_hello_detect_duplicate_calls(struct s2n_connection *conn, void *ctx)
 {
     if (ctx == NULL) {
@@ -56,6 +95,78 @@ static int client_hello_detect_duplicate_calls(struct s2n_connection *conn, void
     return 0;
 }
 
+int s2n_client_hello_poll_cb(struct s2n_connection *conn, void *ctx)
+{
+    struct client_hello_context *client_hello_ctx;
+    if (ctx == NULL) {
+        return -1;
+    }
+    client_hello_ctx = ctx;
+    /* Increment counter to ensure that callback was invoked */
+    client_hello_ctx->invocations++;
+
+    if (client_hello_ctx->mark_done) {
+        EXPECT_SUCCESS(s2n_client_hello_cb_done(conn));
+        return S2N_SUCCESS;
+    }
+
+    return S2N_SUCCESS;
+}
+
+S2N_RESULT hello_retry_client_hello_cb_test(bool enable_poll) {
+    struct s2n_cert_chain_and_key *tls13_chain_and_key = NULL;
+    EXPECT_SUCCESS(s2n_test_cert_chain_and_key_new(&tls13_chain_and_key,
+        S2N_ECDSA_P384_PKCS1_CERT_CHAIN, S2N_ECDSA_P384_PKCS1_KEY));
+    EXPECT_NOT_NULL(tls13_chain_and_key);
+
+    DEFER_CLEANUP(struct s2n_config *config = s2n_config_new(), s2n_config_ptr_free);
+    EXPECT_NOT_NULL(config);
+
+    EXPECT_SUCCESS(s2n_config_set_unsafe_for_testing(config));
+    EXPECT_SUCCESS(s2n_config_add_cert_chain_and_key_to_store(config, tls13_chain_and_key));
+    EXPECT_SUCCESS(s2n_config_set_cipher_preferences(config, "default_tls13"));
+
+    DEFER_CLEANUP(struct s2n_connection *server_conn = s2n_connection_new(S2N_SERVER), s2n_connection_ptr_free);
+    DEFER_CLEANUP(struct s2n_connection *client_conn = s2n_connection_new(S2N_CLIENT), s2n_connection_ptr_free);
+    EXPECT_NOT_NULL(server_conn);
+    EXPECT_NOT_NULL(client_conn);
+
+    EXPECT_SUCCESS(s2n_connection_set_config(server_conn, config));
+    EXPECT_SUCCESS(s2n_connection_set_config(client_conn, config));
+
+    struct s2n_test_io_pair io_pair = { 0 };
+    EXPECT_SUCCESS(s2n_io_pair_init_non_blocking(&io_pair));
+    EXPECT_SUCCESS(s2n_connections_set_io_pair(client_conn, server_conn, &io_pair));
+
+    /* Force HRR path */
+    client_conn->security_policy_override = &security_policy_test_tls13_retry;
+
+    /* setup the client hello callback */
+    struct client_hello_context client_hello_ctx = {.invocations = 0,
+        .mode = S2N_CLIENT_HELLO_CB_NONBLOCKING, .mark_done = false,
+        .enable_poll = enable_poll };
+    EXPECT_SUCCESS(s2n_config_set_client_hello_cb(config,
+        s2n_client_hello_poll_cb, &client_hello_ctx));
+    EXPECT_SUCCESS(s2n_config_set_client_hello_cb_mode(config,
+        S2N_CLIENT_HELLO_CB_NONBLOCKING));
+
+    if (enable_poll) {
+        /* Enable callback polling mode */
+        EXPECT_SUCCESS(s2n_config_client_hello_cb_enable_poll(config));
+    }
+
+    /* negotiate and make assertions */
+    EXPECT_SUCCESS(s2n_negotiate_poll_hello_retry(server_conn, client_conn, &client_hello_ctx));
+
+    /* check hello retry state */
+    EXPECT_TRUE(IS_HELLO_RETRY_HANDSHAKE(client_conn));
+    EXPECT_TRUE(IS_HELLO_RETRY_HANDSHAKE(server_conn));
+
+    /* cleanup */
+    EXPECT_SUCCESS(s2n_cert_chain_and_key_free(tls13_chain_and_key));
+    EXPECT_SUCCESS(s2n_io_pair_close(&io_pair));
+    return S2N_RESULT_OK;
+}
 
 int main(int argc, char **argv)
 {
@@ -450,6 +561,9 @@ int main(int argc, char **argv)
         EXPECT_TRUE(server_conn->handshake.handshake_type & HELLO_RETRY_REQUEST);
         EXPECT_EQUAL(client_hello_ctx.invocations, 1);
 
+        EXPECT_TRUE(IS_HELLO_RETRY_HANDSHAKE(client_conn));
+        EXPECT_TRUE(IS_HELLO_RETRY_HANDSHAKE(server_conn));
+
         EXPECT_SUCCESS(s2n_connection_free(server_conn));
         EXPECT_SUCCESS(s2n_connection_free(client_conn));
         EXPECT_SUCCESS(s2n_config_free(client_config));
@@ -458,6 +572,14 @@ int main(int argc, char **argv)
         EXPECT_SUCCESS(s2n_io_pair_close(&io_pair));
     }
 
+    /* Hello Retry Request + (poll and no-poll) client hello callback */
+    {
+        /* enable polling */
+        EXPECT_OK(hello_retry_client_hello_cb_test(true));
+        /* disable polling */
+        EXPECT_OK(hello_retry_client_hello_cb_test(false));
+    }
+
     /* Test s2n_set_hello_retry_required correctly sets the handshake type to HELLO_RETRY_REQUEST,
      * when conn->actual_protocol_version is set to TLS1.3 version */
     {
@@ -471,7 +593,7 @@ int main(int argc, char **argv)
         EXPECT_SUCCESS(s2n_connection_free(conn));
     }
 
-    /* Test s2n_set_hello_retry_required raises a S2N_ERR_INVALID_HELLO_RETRY error 
+    /* Test s2n_set_hello_retry_required raises a S2N_ERR_INVALID_HELLO_RETRY error
      * when conn->actual_protocol_version is less than TLS1.3 */
     {
         struct s2n_connection *conn;

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_tls13_key_schedule_rfc8448_test.c

@@ -205,10 +205,15 @@ int main(int argc, char **argv)
                         server_hello_hash.data, server_hello_hash.size);
 
                 conn->handshake.handshake_type = one_rtt_handshake_type;
+
+                conn->handshake.message_number = one_rtt_message_nums[SERVER_HELLO];
+                EXPECT_EQUAL(s2n_conn_get_current_message_type(conn), SERVER_HELLO);
+                EXPECT_OK(s2n_tls13_secrets_update(conn));
+
                 conn->handshake.message_number = one_rtt_message_nums[SERVER_FINISHED];
                 EXPECT_EQUAL(s2n_conn_get_current_message_type(conn), SERVER_FINISHED);
-
                 EXPECT_OK(s2n_tls13_key_schedule_update(conn));
+
                 EXPECT_IVS_EQUAL(conn, iv, S2N_CLIENT);
                 EXPECT_KEYS_EQUAL(conn, key, S2N_CLIENT);
             }
@@ -289,10 +294,15 @@ int main(int argc, char **argv)
                         server_finished_hash.data, server_finished_hash.size);
 
                 conn->handshake.handshake_type = one_rtt_handshake_type;
+
+                conn->handshake.message_number = one_rtt_message_nums[SERVER_FINISHED];
+                EXPECT_EQUAL(s2n_conn_get_current_message_type(conn), SERVER_FINISHED);
+                EXPECT_OK(s2n_tls13_secrets_update(conn));
+
                 conn->handshake.message_number = one_rtt_message_nums[trigger_message];
                 EXPECT_EQUAL(s2n_conn_get_current_message_type(conn), trigger_message);
-
                 EXPECT_OK(s2n_tls13_key_schedule_update(conn));
+
                 EXPECT_IVS_EQUAL(conn, iv, S2N_SERVER);
                 EXPECT_KEYS_EQUAL(conn, key, S2N_SERVER);
             }
@@ -335,10 +345,15 @@ int main(int argc, char **argv)
                         server_finished_hash.data, server_finished_hash.size);
 
                 conn->handshake.handshake_type = one_rtt_handshake_type;
+
+                conn->handshake.message_number = one_rtt_message_nums[SERVER_FINISHED];
+                EXPECT_EQUAL(s2n_conn_get_current_message_type(conn), SERVER_FINISHED);
+                EXPECT_OK(s2n_tls13_secrets_update(conn));
+
                 conn->handshake.message_number = one_rtt_message_nums[CLIENT_FINISHED];
                 EXPECT_EQUAL(s2n_conn_get_current_message_type(conn), CLIENT_FINISHED);
-
                 EXPECT_OK(s2n_tls13_key_schedule_update(conn));
+
                 EXPECT_IVS_EQUAL(conn, iv, S2N_CLIENT);
                 EXPECT_KEYS_EQUAL(conn, key, S2N_CLIENT);
             }

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_tls13_key_schedule_test.c

@@ -52,18 +52,6 @@ static int s2n_test_secret_cb(void* context, struct s2n_connection *conn,
     POSIX_GUARD(s2n_blob_init(&secrets->blobs[secret_type],
             secrets->bytes[secret_type], secret_size));
     POSIX_CHECKED_MEMCPY(secrets->bytes[secret_type], secret_bytes, secret_size);
-
-    /* s2n-quic requires that all handshake secrets be emitted before
-     * any application secrets.
-     *
-     * This requirement is not supported for 0RTT yet.
-     */
-    bool is_handshake_secret = (secret_type == S2N_CLIENT_HANDSHAKE_TRAFFIC_SECRET
-            || secret_type == S2N_SERVER_HANDSHAKE_TRAFFIC_SECRET);
-    if (!WITH_EARLY_DATA(conn) && is_handshake_secret) {
-        POSIX_ENSURE_EQ(secrets->blobs[S2N_CLIENT_APPLICATION_TRAFFIC_SECRET].size, 0);
-        POSIX_ENSURE_EQ(secrets->blobs[S2N_SERVER_APPLICATION_TRAFFIC_SECRET].size, 0);
-    }
     return S2N_SUCCESS;
 }
 
@@ -230,26 +218,17 @@ int main(int argc, char **argv)
                         case CLIENT_HELLO:
                             /* Expect not encrypted */
                             EXPECT_EQUAL(conn->client, &conn->initial);
-                            /* Expect all secrets not available yet */
-                            EXPECT_EQUAL(secrets.blobs[S2N_CLIENT_HANDSHAKE_TRAFFIC_SECRET].size, 0);
-                            EXPECT_EQUAL(secrets.blobs[S2N_CLIENT_APPLICATION_TRAFFIC_SECRET].size, 0);
                             break;
                         case HELLO_RETRY_MSG:
                         case SERVER_HELLO:
                             /* Expect not encrypted  */
                             EXPECT_EQUAL(conn->server, &conn->initial);
-                            /* Expect all secrets not available yet */
-                            EXPECT_EQUAL(secrets.blobs[S2N_SERVER_HANDSHAKE_TRAFFIC_SECRET].size, 0);
-                            EXPECT_EQUAL(secrets.blobs[S2N_SERVER_APPLICATION_TRAFFIC_SECRET].size, 0);
                             break;
                         case END_OF_EARLY_DATA:
                             /* Expect encrypted */
                             EXPECT_EQUAL(conn->client, &conn->secure);
                             /* Expect correct secret available */
                             EXPECT_TRUE(secrets.blobs[S2N_CLIENT_EARLY_TRAFFIC_SECRET].size > 0);
-                            /* Expect other secrets not available yet */
-                            EXPECT_EQUAL(secrets.blobs[S2N_CLIENT_HANDSHAKE_TRAFFIC_SECRET].size, 0);
-                            EXPECT_EQUAL(secrets.blobs[S2N_CLIENT_APPLICATION_TRAFFIC_SECRET].size, 0);
                             break;
                         case ENCRYPTED_EXTENSIONS:
                         case SERVER_CERT:
@@ -260,8 +239,6 @@ int main(int argc, char **argv)
                             EXPECT_EQUAL(conn->server, &conn->secure);
                             /* Expect correct secret available */
                             EXPECT_TRUE(secrets.blobs[S2N_SERVER_HANDSHAKE_TRAFFIC_SECRET].size > 0);
-                            /* Expect other secrets not available yet */
-                            EXPECT_EQUAL(secrets.blobs[S2N_SERVER_APPLICATION_TRAFFIC_SECRET].size, 0);
                             break;
                         case CLIENT_CERT:
                         case CLIENT_CERT_VERIFY:
@@ -270,8 +247,6 @@ int main(int argc, char **argv)
                             EXPECT_EQUAL(conn->client, &conn->secure);
                             /* Expect correct secret available */
                             EXPECT_TRUE(secrets.blobs[S2N_CLIENT_HANDSHAKE_TRAFFIC_SECRET].size > 0);
-                            /* Expect other secrets not available yet */
-                            EXPECT_EQUAL(secrets.blobs[S2N_CLIENT_APPLICATION_TRAFFIC_SECRET].size, 0);
                             break;
                         case APPLICATION_DATA:
                             /* Expect encrypted */
@@ -298,19 +273,6 @@ int main(int argc, char **argv)
                     }
 
                     EXPECT_OK(s2n_tls13_key_schedule_update(conn));
-
-                    /*
-                     * For complete QUIC support, secrets need to be available as soon as possible.
-                     * For the server, that means that the application traffic secrets
-                     * must be available immediately after the server Finished message, even though
-                     * they're not technically required until APPLICATION_DATA.
-                     */
-                    if (s2n_conn_get_current_message_type(conn) == SERVER_FINISHED
-                            && conn->mode == S2N_SERVER) {
-                        EXPECT_EQUAL(conn->server, &conn->secure);
-                        EXPECT_TRUE(secrets.blobs[S2N_SERVER_APPLICATION_TRAFFIC_SECRET].size > 0);
-                    }
-
                     conn->handshake.message_number++;
                 }
 

data/aws-crt-ffi/crt/s2n/tests/unit/s2n_tls13_secrets_test.c

@@ -52,6 +52,10 @@ int main(int argc, char **argv)
     const struct s2n_ecc_preferences *curves = &s2n_ecc_preferences_test_all;
     const s2n_mode modes[] = { S2N_CLIENT, S2N_SERVER };
 
+    struct s2n_blob test_secret = { 0 };
+    uint8_t test_secret_bytes[S2N_TLS13_SECRET_MAX_LEN] = "hello world";
+    EXPECT_SUCCESS(s2n_blob_init(&test_secret, test_secret_bytes, sizeof(test_secret_bytes)));
+
     struct s2n_tls13_secrets_test_case test_cases[1000] = { 0 };
     size_t test_cases_count = 0;
     for (s2n_extract_secret_type_t next_type = S2N_EARLY_SECRET; next_type <= S2N_MASTER_SECRET; next_type++) {
@@ -224,14 +228,10 @@ int main(int argc, char **argv)
         }
     }
 
-    /* s2n_tls13_secrets_finish */
+    /* s2n_tls13_secrets_clean */
     {
         /* Safety */
-        EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_finish(NULL), S2N_ERR_NULL);
-
-        struct s2n_blob test_secret = { 0 };
-        uint8_t test_secret_bytes[S2N_TLS13_SECRET_MAX_LEN] = "hello world";
-        EXPECT_SUCCESS(s2n_blob_init(&test_secret, test_secret_bytes, sizeof(test_secret_bytes)));
+        EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_clean(NULL), S2N_ERR_NULL);
 
         /* Wipes all secrets */
         {
@@ -247,36 +247,155 @@ int main(int argc, char **argv)
             EXPECT_OK(s2n_connection_set_test_early_secret(conn, &test_secret));
             EXPECT_OK(s2n_connection_set_test_handshake_secret(conn, &test_secret));
             EXPECT_OK(s2n_connection_set_test_master_secret(conn, &test_secret));
+            EXPECT_MEMCPY_SUCCESS(conn->secrets.tls13.client_handshake_secret, test_secret.data, test_secret.size);
+            EXPECT_MEMCPY_SUCCESS(conn->secrets.tls13.server_handshake_secret, test_secret.data, test_secret.size);
+            EXPECT_MEMCPY_SUCCESS(conn->secrets.tls13.client_app_secret, test_secret.data, test_secret.size);
+            EXPECT_MEMCPY_SUCCESS(conn->secrets.tls13.server_app_secret, test_secret.data, test_secret.size);
+            EXPECT_MEMCPY_SUCCESS(conn->secrets.tls13.resumption_master_secret, test_secret.data, test_secret.size);
 
             EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.early_secret, empty_secret, sizeof(empty_secret));
             EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.handshake_secret, empty_secret, sizeof(empty_secret));
             EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.master_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.client_handshake_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.server_handshake_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.client_app_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.server_app_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.resumption_master_secret, empty_secret, sizeof(empty_secret));
 
-            EXPECT_OK(s2n_tls13_secrets_finish(conn));
+            EXPECT_OK(s2n_tls13_secrets_clean(conn));
 
             EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.early_secret, empty_secret, sizeof(empty_secret));
             EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.handshake_secret, empty_secret, sizeof(empty_secret));
             EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.master_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.client_handshake_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.server_handshake_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.client_app_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.server_app_secret, empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.resumption_master_secret, empty_secret, sizeof(empty_secret));
+        }
+    }
+
+    /* Test s2n_tls13_secrets_get */
+    {
+        /* Safety */
+        {
+            struct s2n_blob result = { 0 };
+            struct s2n_connection conn = { 0 };
+            EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_get(NULL, S2N_HANDSHAKE_SECRET, S2N_CLIENT, &result), S2N_ERR_NULL);
+            EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_get(&conn, S2N_HANDSHAKE_SECRET, S2N_CLIENT, NULL), S2N_ERR_NULL);
+            EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_get(&conn, S2N_NONE_SECRET, S2N_CLIENT, &result), S2N_ERR_SAFETY);
+            EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_get(&conn, -1, S2N_CLIENT, &result), S2N_ERR_SAFETY);
+            EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_get(&conn, 100, S2N_CLIENT, &result), S2N_ERR_SAFETY);
+
+            conn.secrets.tls13.secrets_state = S2N_NONE_SECRET;
+            EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_get(&conn, S2N_HANDSHAKE_SECRET, S2N_CLIENT, &result), S2N_ERR_SAFETY);
+        }
+
+        /* Retrieves an existing secret */
+        {
+            DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_SERVER),
+                    s2n_connection_ptr_free);
+            conn->secure.cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
+            conn->actual_protocol_version = S2N_TLS13;
+
+            EXPECT_MEMCPY_SUCCESS(conn->secrets.tls13.client_handshake_secret,
+                    test_secret.data, test_secret.size);
+            conn->secrets.tls13.secrets_state = S2N_HANDSHAKE_SECRET;
+
+            struct s2n_blob result = { 0 };
+            uint8_t result_bytes[S2N_TLS13_SECRET_MAX_LEN] = { 0 };
+            EXPECT_SUCCESS(s2n_blob_init(&result, result_bytes, sizeof(result_bytes)));
+            EXPECT_OK(s2n_tls13_secrets_get(conn, S2N_HANDSHAKE_SECRET, S2N_CLIENT, &result));
+
+            EXPECT_TRUE(result.size > 0);
+            EXPECT_TRUE(result.size <= S2N_TLS13_SECRET_MAX_LEN);
+            EXPECT_BYTEARRAY_EQUAL(result.data, test_secret.data, result.size);
+        }
+
+        /* Derives a new secret */
+        {
+            DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_SERVER),
+                    s2n_connection_ptr_free);
+            conn->secure.cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
+            conn->actual_protocol_version = S2N_TLS13;
+
+            struct s2n_blob result = { 0 };
+            uint8_t result_bytes[S2N_TLS13_SECRET_MAX_LEN] = { 0 };
+            EXPECT_SUCCESS(s2n_blob_init(&result, result_bytes, sizeof(result_bytes)));
+            EXPECT_OK(s2n_tls13_secrets_get(conn, S2N_EARLY_SECRET, S2N_CLIENT, &result));
+
+            EXPECT_TRUE(result.size > 0);
+            EXPECT_TRUE(result.size <= S2N_TLS13_SECRET_MAX_LEN);
+            EXPECT_BYTEARRAY_NOT_EQUAL(result.data, empty_secret, result.size);
+        }
+    }
+
+    /* s2n_tls13_secrets_update */
+    {
+        /* Safety */
+        EXPECT_ERROR_WITH_ERRNO(s2n_tls13_secrets_update(NULL), S2N_ERR_NULL);
+
+        /* Derives handshake secrets on SERVER_HELLO */
+        {
+            DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_SERVER),
+                    s2n_connection_ptr_free);
+            conn->secure.cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
+            conn->actual_protocol_version = S2N_TLS13;
+            EXPECT_OK(s2n_connection_set_test_handshake_secret(conn, &test_secret));
+            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.client_handshake_secret,
+                    empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.server_handshake_secret,
+                    empty_secret, sizeof(empty_secret));
+
+            while(s2n_conn_get_current_message_type(conn) != SERVER_HELLO) {
+                conn->handshake.message_number++;
+            }
+            EXPECT_OK(s2n_tls13_secrets_update(conn));
+
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.client_handshake_secret,
+                    empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.server_handshake_secret,
+                    empty_secret, sizeof(empty_secret));
         }
 
-        /* Stores TLS1.3 resumption secret */
+        /* Derives application secrets on SERVER_FINISHED */
         {
             DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_SERVER),
                     s2n_connection_ptr_free);
             conn->secure.cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
+            conn->actual_protocol_version = S2N_TLS13;
             EXPECT_OK(s2n_connection_set_test_master_secret(conn, &test_secret));
-            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.resumption_master_secret,
+            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.client_app_secret,
+                    empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.server_app_secret,
                     empty_secret, sizeof(empty_secret));
 
-            /* Does NOT calculate secret if TLS1.2 */
-            conn->actual_protocol_version = S2N_TLS12;
-            EXPECT_OK(s2n_tls13_secrets_finish(conn));
-            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.resumption_master_secret,
+            while(s2n_conn_get_current_message_type(conn) != SERVER_FINISHED) {
+                conn->handshake.message_number++;
+            }
+            EXPECT_OK(s2n_tls13_secrets_update(conn));
+
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.client_app_secret,
                     empty_secret, sizeof(empty_secret));
+            EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.server_app_secret,
+                    empty_secret, sizeof(empty_secret));
+        }
 
-            /* Calculates secret if TLS1.3 */
+        /* Derives resumption secret on CLIENT_FINISHED */
+        {
+            DEFER_CLEANUP(struct s2n_connection *conn = s2n_connection_new(S2N_SERVER),
+                    s2n_connection_ptr_free);
+            conn->secure.cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
             conn->actual_protocol_version = S2N_TLS13;
-            EXPECT_OK(s2n_tls13_secrets_finish(conn));
+            EXPECT_OK(s2n_connection_set_test_master_secret(conn, &test_secret));
+            EXPECT_BYTEARRAY_EQUAL(conn->secrets.tls13.resumption_master_secret,
+                    empty_secret, sizeof(empty_secret));
+
+            while(s2n_conn_get_current_message_type(conn) != CLIENT_FINISHED) {
+                conn->handshake.message_number++;
+            }
+            EXPECT_OK(s2n_tls13_secrets_update(conn));
+
             EXPECT_BYTEARRAY_NOT_EQUAL(conn->secrets.tls13.resumption_master_secret,
                     empty_secret, sizeof(empty_secret));
         }

data/aws-crt-ffi/crt/s2n/tls/s2n_cipher_suites.c

@@ -1088,7 +1088,7 @@ int s2n_cipher_suites_cleanup(void)
     return 0;
 }
 
-S2N_RESULT s2n_cipher_suite_from_iana(const uint8_t iana[], struct s2n_cipher_suite **cipher_suite)
+S2N_RESULT s2n_cipher_suite_from_iana(const uint8_t iana[static S2N_TLS_CIPHER_SUITE_LEN], struct s2n_cipher_suite **cipher_suite)
 {
     RESULT_ENSURE_REF(cipher_suite);
     *cipher_suite = NULL;

data/aws-crt-ffi/crt/s2n/tls/s2n_client_hello.c

@@ -33,6 +33,7 @@
 #include "tls/s2n_connection.h"
 #include "tls/s2n_client_hello.h"
 #include "tls/s2n_alerts.h"
+#include "tls/s2n_handshake_type.h"
 #include "tls/s2n_signature_algorithms.h"
 #include "tls/s2n_tls.h"
 #include "tls/s2n_security_policies.h"
@@ -116,6 +117,7 @@ int s2n_client_hello_cb_done(struct s2n_connection *conn)
     POSIX_ENSURE(conn->config->client_hello_cb_mode ==
         S2N_CLIENT_HELLO_CB_NONBLOCKING, S2N_ERR_INVALID_STATE);
     POSIX_ENSURE(conn->client_hello.callback_invoked == 1, S2N_ERR_ASYNC_NOT_PERFORMED);
+    POSIX_ENSURE(conn->client_hello.parsed == 1, S2N_ERR_INVALID_STATE);
 
     conn->client_hello.callback_async_blocked = 0;
     conn->client_hello.callback_async_done = 1;
@@ -170,6 +172,7 @@ int s2n_client_hello_free(struct s2n_client_hello *client_hello)
      * incase we are preparing for CH retry */
     client_hello->callback_async_blocked = 0;
     client_hello->callback_async_done = 0;
+    client_hello->parsed = 0;
 
     return 0;
 }
@@ -225,7 +228,7 @@ int s2n_parse_client_hello(struct s2n_connection *conn)
     POSIX_GUARD(s2n_stuffer_read_uint16(in, &cipher_suites_length));
     POSIX_ENSURE(cipher_suites_length > 0, S2N_ERR_BAD_MESSAGE);
     POSIX_ENSURE(cipher_suites_length % S2N_TLS_CIPHER_SUITE_LEN == 0, S2N_ERR_BAD_MESSAGE);
-   
+
     client_hello->cipher_suites.size = cipher_suites_length;
     client_hello->cipher_suites.data = s2n_stuffer_raw_read(in, cipher_suites_length);
     POSIX_ENSURE_REF(client_hello->cipher_suites.data);
@@ -346,19 +349,28 @@ fail:
     RESULT_BAIL(S2N_ERR_CANCELLED);
 }
 
+bool s2n_client_hello_invoke_callback(struct s2n_connection *conn) {
+    /* Invoke only if the callback has not been called or if polling mode is enabled */
+    bool invoke = !conn->client_hello.callback_invoked || conn->config->client_hello_cb_enable_poll;
+    /*
+     * The callback should not be called if this client_hello is in response to a hello retry.
+     */
+    return invoke && !IS_HELLO_RETRY_HANDSHAKE(conn);
+}
+
 int s2n_client_hello_recv(struct s2n_connection *conn)
 {
-    POSIX_ENSURE(conn->client_hello.callback_async_blocked == 0, S2N_ERR_ASYNC_BLOCKED);
+    if (conn->config->client_hello_cb_enable_poll == 0) {
+        POSIX_ENSURE(conn->client_hello.callback_async_blocked == 0, S2N_ERR_ASYNC_BLOCKED);
+    }
 
-    if (conn->config->client_hello_cb_mode == S2N_CLIENT_HELLO_CB_BLOCKING ||
-            !conn->client_hello.callback_async_done)
-    {
+    if (conn->client_hello.parsed == 0) {
         /* Parse client hello */
         POSIX_GUARD(s2n_parse_client_hello(conn));
+        conn->client_hello.parsed = 1;
     }
-    /* If the CLIENT_HELLO has already been parsed, then we should not call
-     * the client_hello_cb a second time. */
-    if (conn->client_hello.callback_invoked == 0) {
+    /* Call the client_hello_cb once unless polling is enabled. */
+    if (s2n_client_hello_invoke_callback(conn)) {
         /* Mark the collected client hello as available when parsing is done and before the client hello callback */
         conn->client_hello.callback_invoked = 1;
 
@@ -376,7 +388,6 @@ int s2n_client_hello_recv(struct s2n_connection *conn)
     return 0;
 }
 
-
 S2N_RESULT s2n_cipher_suite_validate_available(struct s2n_connection *conn, struct s2n_cipher_suite *cipher)
 {
     RESULT_ENSURE_REF(conn);

data/aws-crt-ffi/crt/s2n/tls/s2n_client_hello.h

@@ -36,6 +36,14 @@ struct s2n_client_hello {
     unsigned int callback_invoked:1;
     unsigned int callback_async_blocked:1;
     unsigned int callback_async_done:1;
+    /*
+     * Marks if the client hello has been parsed.
+     *
+     * While a client_hello is only parsed once, it is possible to parse
+     * two different client_hello during a single handshake if the server
+     * issues a hello retry.
+     */
+    unsigned int parsed:1;
 };
 
 int s2n_client_hello_free(struct s2n_client_hello *client_hello);

data/aws-crt-ffi/crt/s2n/tls/s2n_config.c

@@ -924,3 +924,16 @@ int s2n_config_get_ctx(struct s2n_config *config, void **ctx) {
 
     return S2N_SUCCESS;
 }
+
+/*
+ * Set the client_hello callback behavior to polling.
+ *
+ * Polling means that the callback function can be called multiple times.
+ */
+int s2n_config_client_hello_cb_enable_poll(struct s2n_config *config) {
+    POSIX_ENSURE_REF(config);
+
+    config->client_hello_cb_enable_poll = 1;
+
+    return S2N_SUCCESS;
+}

data/aws-crt-ffi/crt/s2n/tls/s2n_config.h

@@ -55,6 +55,12 @@ struct s2n_config {
      * but async signing must be enabled. Use this flag to enforce that restriction.
      */
     unsigned no_signing_key:1;
+    /*
+     * This option exists to allow for polling the client_hello callback.
+     *
+     * Note: This defaults to false to ensure backwards compatibility.
+     */
+    unsigned client_hello_cb_enable_poll:1;
 
     struct s2n_dh_params *dhparams;
     /* Needed until we can deprecate s2n_config_add_cert_chain_and_key. This is

data/aws-crt-ffi/crt/s2n/tls/s2n_handshake_io.c

@@ -1424,7 +1424,8 @@ int s2n_negotiate_impl(struct s2n_connection *conn, s2n_blocked_status *blocked)
         }
 
         if (ACTIVE_STATE(conn).writer == 'B') {
-            POSIX_GUARD_RESULT(s2n_tls13_secrets_finish(conn));
+            /* Clean up handshake secrets */
+            POSIX_GUARD_RESULT(s2n_tls13_secrets_clean(conn));
 
             /* Send any pending post-handshake messages */
             POSIX_GUARD(s2n_post_handshake_send(conn, blocked));

data/aws-crt-ffi/crt/s2n/tls/s2n_internal.h

@@ -47,3 +47,12 @@ struct s2n_connection;
  */
 S2N_PRIVATE_API
 extern int s2n_connection_get_config(struct s2n_connection *conn, struct s2n_config **config);
+
+/*
+ * Enable polling the async client_hello callback to make progress.
+ *
+ * `s2n_negotiate` must be called multiple times to poll the callback function
+ * and make progress.
+ */
+S2N_PRIVATE_API
+extern int s2n_config_client_hello_cb_enable_poll(struct s2n_config *config);