GmSSL/src/tls13.c

/*
 *  Copyright 2014-2026 The GmSSL Project. All Rights Reserved.
 *
 *  Licensed under the Apache License, Version 2.0 (the License); you may
 *  not use this file except in compliance with the License.
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 */



#include <time.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <gmssl/rand.h>
#include <gmssl/x509.h>
#include <gmssl/error.h>
#include <gmssl/sm2.h>
#include <gmssl/sm3.h>
#include <gmssl/sm4.h>
#include <gmssl/pem.h>
#include <gmssl/tls.h>
#include <gmssl/digest.h>
#include <gmssl/hmac.h>
#include <gmssl/hkdf.h>
#include <gmssl/mem.h>
#include <gmssl/endian.h>



static const int tls13_ciphers[] = { TLS_cipher_sm4_gcm_sm3 };
static size_t tls13_ciphers_count = sizeof(tls13_ciphers)/sizeof(int);

static int tls13_client_hello_exts[] = {
	TLS_extension_supported_versions,
	TLS_extension_padding,
};

int tls13_random_generate(uint8_t random[32])
{
	if (rand_bytes(random, 32) != 1) {
		error_print();
		return -1;
	}
	return 1;
}


int tls13_cipher_suite_get(int cipher_suite, const BLOCK_CIPHER **cipher, const DIGEST **digest)
{
	switch (cipher_suite) {
	case TLS_cipher_sm4_gcm_sm3:
		*digest = DIGEST_sm3();
		*cipher = BLOCK_CIPHER_sm4();
		break;
#if defined(ENABLE_AES) && defined(ENABLE_SHA2)
	case TLS_cipher_aes_128_gcm_sha256:
		*digest = DIGEST_sha256();
		*cipher = BLOCK_CIPHER_aes128();
		break;
#endif
	default:
		error_print();
		return -1;
	}
	return 1;
}


int tls13_padding_len_rand(size_t *padding_len)
{
	uint8_t val;
	rand_bytes(&val, 1);
	*padding_len = val % 128;
	return 1;
}




int gcm_encrypt(const BLOCK_CIPHER_KEY *key, const uint8_t *iv, size_t ivlen,
	const uint8_t *aad, size_t aadlen, const uint8_t *in, size_t inlen,
	uint8_t *out, size_t taglen, uint8_t *tag)
{
	if (key->cipher == BLOCK_CIPHER_sm4()) {
		if (sm4_gcm_encrypt(&(key->u.sm4_key), iv, ivlen, aad, aadlen,  in, inlen, out, taglen, tag) != 1) {
			error_print();
			return -1;
		}
// 避免在tls13.c中引入宏
#ifdef ENABLE_AES
	} else if (key->cipher == BLOCK_CIPHER_aes128()) {
		if (aes_gcm_encrypt(&(key->u.aes_key), iv, ivlen, aad, aadlen,  in, inlen, out, taglen, tag) != 1) {
			error_print();
			return -1;
		}
#endif
	} else {
		error_print();
		return -1;
	}
	return 1;
}

int gcm_decrypt(const BLOCK_CIPHER_KEY *key, const uint8_t *iv, size_t ivlen,
	const uint8_t *aad, size_t aadlen, const uint8_t *in, size_t inlen,
	const uint8_t *tag, size_t taglen, uint8_t *out)
{
	if (key->cipher == BLOCK_CIPHER_sm4()) {
		if (sm4_gcm_decrypt(&(key->u.sm4_key), iv, ivlen, aad, aadlen,  in, inlen, tag, taglen, out) != 1) {
			error_print();
			return -1;
		}
#ifdef ENABLE_AES
	} else if (key->cipher == BLOCK_CIPHER_aes128()) {
		if (aes_gcm_decrypt(&(key->u.aes_key), iv, ivlen, aad, aadlen,  in, inlen, tag, taglen, out) != 1) {
			error_print();
			return -1;
		}
#endif
	} else {
		error_print();
		return -1;
	}
	return 1;
}

/*
struct {
	opaque content[TLSPlaintext.length];
	ContentType type;
	uint8 zeros[length_of_padding];
} TLSInnerPlaintext;

struct {
	ContentType opaque_type = application_data; // 23
	ProtocolVersion legacy_record_version = 0x0303; // TLS v1.2
	uint16 length;
	opaque encrypted_record[TLSCiphertext.length];
} TLSCiphertext;
*/
int tls13_gcm_encrypt(const BLOCK_CIPHER_KEY *key, const uint8_t iv[12],
	const uint8_t seq_num[8], int record_type,
	const uint8_t *in, size_t inlen, size_t padding_len, // TLSInnerPlaintext.content
	uint8_t *out, size_t *outlen) // TLSCiphertext.encrypted_record
{
	uint8_t nonce[12];
	uint8_t aad[5];
	uint8_t *gmac;
	uint8_t *mbuf = NULL; // FIXME: update gcm_encrypt API
	size_t mlen, clen;

	if (!(mbuf = malloc(inlen + 256))) {
		error_print();
		return -1;
	}

	// nonce = (zeros|seq_num) xor (iv)
	nonce[0] = nonce[1] = nonce[2] = nonce[3] = 0;
	memcpy(nonce + 4, seq_num, 8);
	gmssl_memxor(nonce, nonce, iv, 12);

	// TLSInnerPlaintext
	memcpy(mbuf, in, inlen);
	mbuf[inlen] = record_type;
	memset(mbuf + inlen + 1, 0, padding_len);
	mlen = inlen + 1 + padding_len;
	clen = mlen + GHASH_SIZE;

	// aad = TLSCiphertext header
	aad[0] = TLS_record_application_data;
	aad[1] = 0x03; //TLS_protocol_tls12_major;
	aad[2] = 0x03; //TLS_protocol_tls12_minor;
	aad[3] = (uint8_t)(clen >> 8);
	aad[4] = (uint8_t)(clen);

	gmac = out + mlen;
	if (gcm_encrypt(key, nonce, sizeof(nonce), aad, sizeof(aad), mbuf, mlen, out, 16, gmac) != 1) {
		error_print();
		free(mbuf);
		return -1;
	}
	*outlen = clen;
	free(mbuf);

	return 1;
}

int tls13_gcm_decrypt(const BLOCK_CIPHER_KEY *key, const uint8_t iv[12],
	const uint8_t seq_num[8], const uint8_t *in, size_t inlen,
	int *record_type, uint8_t *out, size_t *outlen)
{
	uint8_t nonce[12];
	uint8_t aad[5];
	size_t mlen;
	const uint8_t *gmac;

	// nonce = (zeros|seq_num) xor (iv)
	nonce[0] = nonce[1] = nonce[2] = nonce[3] = 0;
	memcpy(nonce + 4, seq_num, 8);
	gmssl_memxor(nonce, nonce, iv, 12);

	// aad = TLSCiphertext header
	aad[0] = TLS_record_application_data;
	aad[1] = 0x03; //TLS_protocol_tls12_major;
	aad[2] = 0x03; //TLS_protocol_tls12_minor;
	aad[3] = (uint8_t)(inlen >> 8);
	aad[4] = (uint8_t)(inlen);

	if (inlen < GHASH_SIZE) {
		error_print();
		return -1;
	}
	mlen = inlen - GHASH_SIZE;
	gmac = in + mlen;

	if (gcm_decrypt(key, nonce, 12, aad, 5, in, mlen, gmac, GHASH_SIZE, out) != 1) {
		error_print();
		return -1;
	}
	// remove padding, get record_type
	*record_type = 0;
	while (mlen--) {
		if (out[mlen] != 0) {
			*record_type = out[mlen];
			break;
		}
	}
	*outlen = mlen;
	if (!tls_record_type_name(*record_type)) {
		error_print();
		return -1;
	}
	return 1;
}


int tls13_record_encrypt(const BLOCK_CIPHER_KEY *key, const uint8_t iv[12],
	const uint8_t seq_num[8], const uint8_t *record, size_t recordlen, size_t padding_len,
	uint8_t *enced_record, size_t *enced_recordlen)
{
	if (tls13_gcm_encrypt(key, iv,
		seq_num, record[0], record + 5, recordlen - 5, padding_len,
		enced_record + 5, enced_recordlen) != 1) {
		error_print();
		return -1;
	}

	// in tls1.3, type of encrypted records must be application_data
	enced_record[0] = TLS_record_application_data;
	enced_record[1] = 0x03; //TLS_protocol_tls12_major;
	enced_record[2] = 0x03; //TLS_protocol_tls12_minor;
	enced_record[3] = (uint8_t)((*enced_recordlen) >> 8);
	enced_record[4] = (uint8_t)(*enced_recordlen);

	(*enced_recordlen) += 5;
	return 1;
}

int tls13_record_decrypt(const BLOCK_CIPHER_KEY *key, const uint8_t iv[12],
	const uint8_t seq_num[8], const uint8_t *enced_record, size_t enced_recordlen,
	uint8_t *record, size_t *recordlen)
{
	int record_type;

	if (tls13_gcm_decrypt(key, iv,
		seq_num, enced_record + 5, enced_recordlen - 5,
		&record_type, record + 5, recordlen) != 1) {
		error_print();
		return -1;
	}
	record[0] = record_type;
	record[1] = 0x03; //TLS_protocol_tls12_major;
	record[2] = 0x03; //TLS_protocol_tls12_minor;
	record[3] = (uint8_t)((*recordlen) >> 8);
	record[4] = (uint8_t)(*recordlen);

	(*recordlen) += 5;
	return 1;
}

/*
KeyUpate的流程


	客户端发现需要KeyUpdate （可能是C->S 或者C <- S某个方向需要）
	如果是自己方向的需要更新，或者对方需要更新，那么就一定要发送KeyUpdate
	如果对方不需要更新，那么不要求对方更新

	客户端更新自己的密钥

	服务器端在收到通知后，更新客户端的密钥
	服务器端查看是否要求自己也更新密钥，如果要求
		因此向客户端发送KeyUpdate
	注意因为客户端的密钥刚更新过，作为响应方的服务器一定不能要求对方再更新了

	客户端接受到服务器的请求，如果自己才刚刚更新过，就不再发送反馈了


	这里一个主要的状态判断是，
	某一方在接收到对方的KeyUpdate请求后，是否响。




*/


int tls13_send(TLS_CONNECT *conn, const uint8_t *data, size_t datalen, size_t *sentlen)
{
	int key_update = 0;

	tls_trace("send {ApplicationData}\n");
	format_print(stderr, 0, 0, "data = %p, datalen = %zu\n", data, datalen);

	*sentlen = 0;


	if (!conn->recordlen) {
		const BLOCK_CIPHER_KEY *key;
		const uint8_t *iv;
		uint8_t *seq_num;
		size_t padding_len = 0;
		size_t record_datalen;

		if (!data || !datalen) {
			return 0;
		}

		if (datalen > TLS_MAX_PLAINTEXT_SIZE) {
			datalen = TLS_MAX_PLAINTEXT_SIZE;
		}

		if (conn->is_client) {
			key = &conn->client_write_key;
			iv = conn->client_write_iv;
			seq_num = conn->client_seq_num;
		} else {
			key = &conn->server_write_key;
			iv = conn->server_write_iv;
			seq_num = conn->server_seq_num;
		}

		tls13_padding_len_rand(&padding_len);
		if (tls13_gcm_encrypt(key, iv,
			seq_num, TLS_record_application_data, data, datalen, padding_len,
			conn->record + 5, &record_datalen) != 1) {
			error_print();
			return -1;
		}
		tls_seq_num_incr(seq_num);

		tls_record_set_type(conn->record, TLS_record_application_data);
		tls_record_set_protocol(conn->record, TLS_protocol_tls12);
		tls_record_set_data_length(conn->record, record_datalen);

		conn->recordlen = 5 + record_datalen;
		conn->record_offset = 0;
		conn->plain_recordlen = datalen + 5;

		/*
		KeyUpdate有两个原因
			* 我们自己检查，应该KeyUpdate了，那么发送KeyUpdate并且要求对方也Update
			* 对方要求KeyUpdate，那么我们只是通知对方，我方KeyUPdate，不要求对方再次Update

		*/

		// check if KeyUpdate
		if (GETU64(seq_num) >= conn->ctx->key_update_seq_num_limit) {
			key_update = 1;
		}
	}

	while (conn->recordlen) {
		tls_ret_t n;

		if ((n = tls_socket_send(conn->sock, conn->record + conn->record_offset, conn->recordlen, 0)) <= 0) {
			if (errno == EAGAIN || errno == EWOULDBLOCK) {
				return EAGAIN;
			} else {
				if (n == 0) {
					error_puts("TCP connection closed");
				}
				error_print();
				return -1;
			}
		}
		conn->recordlen -= n;
		conn->record_offset += n;
	}


	if (key_update) {
		int ret;

		if (conn->is_client) {
			if ((ret = tls13_send_client_key_update(conn, 1)) <= 0) {
				if (ret == TLS_ERROR_SEND_AGAIN) {
					return ret;
				}
			} else {
				error_print();
				return -1;
			}

		} else {
			if ((ret = tls13_send_server_key_update(conn, 1)) <= 0) {
				if (ret == TLS_ERROR_SEND_AGAIN) {
					return ret;
				}
			} else {
				error_print();
				return -1;
			}


		}

	}

	*sentlen = conn->plain_recordlen - 5;
	return 1;
}

int tls13_do_recv(TLS_CONNECT *conn)
{
	tls_ret_t n;
	const BLOCK_CIPHER_KEY *key;
	const uint8_t *iv;
	uint8_t *seq_num;

	tls_trace("recv {ApplicationData}\n");

	switch (conn->state) {
	case 0:
		conn->record_offset = 0;
		conn->recordlen = TLS_RECORD_HEADER_SIZE;
		conn->state = TLS_state_recv_record_header;

	case TLS_state_recv_record_header:
		while (conn->recordlen) {
			if ((n = tls_socket_recv(conn->sock, conn->record + conn->record_offset, conn->recordlen, 0)) <= 0) {
				if (errno == EAGAIN || errno == EWOULDBLOCK) {
					return TLS_ERROR_RECV_AGAIN;
				} else {
					error_print();
					return -1;
				}
			}
			conn->recordlen -= n;
		}
		if (tls_record_type(conn->record) != TLS_record_application_data) {
			error_print();
			return -1;
		}
		if (tls_record_protocol(conn->record) != TLS_protocol_tls12) {
			error_print();
			return -1;
		}
		conn->recordlen = tls_record_length(conn->record);
		conn->state = TLS_state_recv_record_data;

	case TLS_state_recv_record_data:
		while (conn->recordlen) {
			if ((n = tls_socket_recv(conn->sock, conn->record + conn->record_offset, conn->recordlen, 0)) <= 0) {
				if (errno == EAGAIN || errno == EWOULDBLOCK) {
					return TLS_ERROR_RECV_AGAIN;
				} else {
					error_print();
					return -1;
				}
			}
			conn->recordlen -= n;
		}
		conn->state = 0;
		break;

	default:
		error_print();
		return -1;
	}
	conn->recordlen = tls_record_length(conn->record) + TLS_RECORD_HEADER_SIZE;
	// tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

	if (conn->is_client) {
		key = &conn->server_write_key;
		iv = conn->server_write_iv;
		seq_num = conn->server_seq_num;
	} else {
		key = &conn->client_write_key;
		iv = conn->client_write_iv;
		seq_num = conn->client_seq_num;
	}
	if (tls13_record_decrypt(key, iv, seq_num, conn->record, conn->recordlen,
		conn->plain_record, &conn->plain_recordlen) != 1) {
		error_print();
		return -1;
	}
	tls_seq_num_incr(seq_num);

	switch (tls_record_type(conn->plain_record)) {
	case TLS_record_application_data:
		conn->data = conn->plain_record + 5;
		conn->datalen = conn->plain_recordlen - 5;
		break;

	case TLS_record_handshake:
		{
		int handshake_type;
		const uint8_t *handshake_data;
		size_t handshake_datalen;
		int update_requested;

		if (tls_record_get_handshake(conn->plain_record, &handshake_type, &handshake_data, &handshake_datalen) != 1) {
			error_print();
			return -1;
		}
		switch (handshake_type) {

		// NewSessionTicket 也不应该是被单独接收的，只能在解密并解析了handshake之后才可以
		case TLS_handshake_new_session_ticket:
			if (tls13_process_new_session_ticket(conn) != 1) {
				error_print();
				return -1;
			}
			break;


		case TLS_handshake_key_update:
			if (tls13_record_get_handshake_key_update(conn->plain_record, &update_requested) != 1) {
				error_print();
				return -1;
			}

			// 对方的密钥已经更新了，我方必须更新
			// 但是我方密钥是否更新（以及发送KeyUpdate通知呢？），要看当前密钥使用了多久
			if (conn->is_client) {
				uint64_t seq_num;
				int ret;

				tls13_update_server_application_keys(conn);

				seq_num = GETU64(conn->client_seq_num);

				if (seq_num > 1 && update_requested) {

					if ((ret = tls13_send_client_key_update(conn, 0)) <= 0) {
						if (ret == TLS_ERROR_SEND_AGAIN) {
							return ret;
						}
					}
				}


			} else {
				uint64_t seq_num;
				int ret;

				tls13_update_client_application_keys(conn);


				seq_num = GETU64(conn->server_seq_num);

				if (seq_num > 1 && update_requested) {
					if ((ret = tls13_send_server_key_update(conn, 0)) <= 0) {
						if (ret == TLS_ERROR_SEND_AGAIN) {
							return ret;
						} else {
							error_print();
							return -1;
						}
					}
				}
			}

			break;
		default:
			error_print();
			return -1;
		}
		}
		break;

	case TLS_record_alert:
		{
		int alert_level;
		int alert_description;

		if (tls_record_get_alert(conn->plain_record, &alert_level, &alert_description) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);
		}
		return -1;

	default:
		error_print();
		return -1;
	}

	return 1;
}

int tls13_recv(TLS_CONNECT *conn, uint8_t *out, size_t outlen, size_t *recvlen)
{
	if (!conn || !out || !outlen || !recvlen) {
		error_print();
		return -1;
	}
	if (conn->datalen == 0) {
		int ret;
		if ((ret = tls13_do_recv(conn)) != 1) {
			if (ret) error_print();
			return ret;
		}
	}
	*recvlen = outlen <= conn->datalen ? outlen : conn->datalen;
	memcpy(out, conn->data, *recvlen);
	conn->data += *recvlen;
	conn->datalen -= *recvlen;
	return 1;
}

// 这里需要考虑max_early_data_size的问题
int tls13_recv_early_data(TLS_CONNECT *conn)
{
	tls_trace("recv EarlyData\n");

	if (tls13_do_recv(conn) != 1) {
		error_print();
		return -1;
	}
	memcpy(conn->early_data_buf, conn->data, conn->datalen);
	conn->early_data_len = conn->datalen;

	format_string(stderr, 0, 4, "EarlyData", conn->early_data_buf, conn->early_data_len);

	return 1;
}


/*
HKDF-Expand-Label(Secret, Label, Context, Length) =
	HKDF-Expand(Secret, HkdfLabel, Length);

	HkdfLabel = struct {
		uint16 length = Length;
		opaque label<7..255> = "tls13 " + Label;
		opaque context<0..255> = Context; }

Derive-Secret(Secret, Label, Messages) =
	HKDF-Expand-Label(Secret, Label, Hash(Messages), Hash.length)

*/

int tls13_hkdf_extract(const DIGEST *digest, const uint8_t salt[32], const uint8_t in[32], uint8_t out[32])
{
	size_t dgstlen;

	if (hkdf_extract(digest, salt, 32, in, 32, out, &dgstlen) != 1
		|| dgstlen != 32) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_hkdf_expand_label(const DIGEST *digest, const uint8_t secret[32],
	const char *label, const uint8_t *context, size_t context_len,
	size_t outlen, uint8_t *out)
{
	uint8_t label_len;
	uint8_t hkdf_label[2 + 256 + 256];
	uint8_t *p = hkdf_label;
	size_t hkdf_label_len = 0;

	label_len = (uint8_t)(strlen("tls13 ") + strlen(label)); //FIXME: check length < 255
	tls_uint16_to_bytes((uint16_t)outlen, &p, &hkdf_label_len);
	tls_uint8_to_bytes(label_len, &p, &hkdf_label_len);
	tls_array_to_bytes((uint8_t *)"tls13 ", strlen("tls13 "), &p, &hkdf_label_len);
	tls_array_to_bytes((uint8_t *)label, strlen(label), &p, &hkdf_label_len);
	tls_uint8array_to_bytes(context, context_len, &p, &hkdf_label_len);

	hkdf_expand(digest, secret, 32, hkdf_label, hkdf_label_len, outlen, out);

	return 1;
}

// 输入参数都需要提供长度			
int tls13_derive_secret(const uint8_t secret[32], const char *label, const DIGEST_CTX *dgst_ctx, uint8_t out[32])
{
	DIGEST_CTX ctx = *dgst_ctx;
	uint8_t dgst[64];
	size_t dgstlen;

	if (digest_finish(&ctx, dgst, &dgstlen) != 1
		|| tls13_hkdf_expand_label(dgst_ctx->digest, secret, label, dgst, 32, dgstlen, out) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

static const uint8_t TLS13_client_context_str_and_zero[] = "TLS 1.3, client CertificateVerify";
static const uint8_t TLS13_server_context_str_and_zero[] = "TLS 1.3, server CertificateVerify";
static size_t TLS13_client_context_str_and_zero_size = sizeof(TLS13_client_context_str_and_zero);
static size_t TLS13_server_context_str_and_zero_size = sizeof(TLS13_server_context_str_and_zero);


int tls13_sign_certificate_verify(int tls_mode, int sig_alg,
	X509_KEY *sign_key, const DIGEST_CTX *tbs_dgst_ctx,
	uint8_t *sig, size_t *siglen)
{
	uint8_t prefix[64];
	const uint8_t *context_str_and_zero;
	size_t context_str_and_zero_len;
	DIGEST_CTX dgst_ctx;
	uint8_t dgst[64];
	size_t dgstlen;
	X509_SIGN_CTX sign_ctx;
	const char *signer_id = NULL;
	size_t signer_id_len = 0;

	if (!sign_key || !tbs_dgst_ctx || !sig || !siglen) {
		error_print();
		return -1;
	}

	memset(prefix, 0x20, 64);

	switch (tls_mode) {
	case TLS_client_mode:
		context_str_and_zero = TLS13_client_context_str_and_zero;
		context_str_and_zero_len = TLS13_client_context_str_and_zero_size;
		break;
	case TLS_server_mode:
		context_str_and_zero = TLS13_server_context_str_and_zero;
		context_str_and_zero_len = TLS13_server_context_str_and_zero_size;
		break;
	default:
		error_print();
		return -1;
	}

	switch (sig_alg) {
	case TLS_sig_sm2sig_sm3:
		if (sign_key->algor != OID_ec_public_key
			&& sign_key->algor_param != OID_sm2) {
			error_print();
			return -1;
		}
		if (tbs_dgst_ctx->digest->oid != OID_sm3) {
			error_print();
			return -1;
		}
		signer_id = TLS13_SM2_ID;
		signer_id_len = TLS13_SM2_ID_LENGTH;
		break;

	case TLS_sig_ecdsa_secp256r1_sha256:
		if (sign_key->algor != OID_ec_public_key
			&& sign_key->algor_param != OID_secp256r1) {
			error_print();
			return -1;
		}
		if (tbs_dgst_ctx->digest->oid != OID_sha256) {
			error_print();
			return -1;
		}
		break;

	default:
		error_print();
		return -1;
	}

	dgst_ctx = *tbs_dgst_ctx;
	if (digest_finish(&dgst_ctx, dgst, &dgstlen) != 1) {
		error_print();
		return -1;
	}

	if (x509_sign_init(&sign_ctx, sign_key, signer_id, signer_id_len) !=  1
		|| x509_sign_update(&sign_ctx, prefix, 64) != 1
		|| x509_sign_update(&sign_ctx, context_str_and_zero, context_str_and_zero_len) != 1
		|| x509_sign_update(&sign_ctx, dgst, dgstlen) != 1
		|| x509_sign_finish(&sign_ctx, sig, siglen) != 1) {
		gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
		error_print();
		return -1;
	}

	gmssl_secure_clear(&sign_ctx, sizeof(sign_ctx));
	return 1;
}

int tls13_verify_certificate_verify(int tls_mode, int sig_alg,
	const X509_KEY *public_key, const DIGEST_CTX *tbs_dgst_ctx,
	const uint8_t *sig, size_t siglen)
{
	int ret;
	uint8_t prefix[64];
	const uint8_t *context_str_and_zero;
	size_t context_str_and_zero_len;
	DIGEST_CTX dgst_ctx;
	uint8_t dgst[64];
	size_t dgstlen;
	X509_SIGN_CTX sign_ctx;
	const char *signer_id = NULL;
	size_t signer_id_len = 0;

	if (!public_key || !tbs_dgst_ctx || !sig || !siglen) {
		error_print();
		return -1;
	}

	memset(prefix, 0x20, 64);

	switch (tls_mode) {
	case TLS_client_mode:
		context_str_and_zero = TLS13_client_context_str_and_zero;
		context_str_and_zero_len = TLS13_client_context_str_and_zero_size;
		break;
	case TLS_server_mode:
		context_str_and_zero = TLS13_server_context_str_and_zero;
		context_str_and_zero_len = TLS13_server_context_str_and_zero_size;
		break;
	default:
		error_print();
		return -1;
	}

	switch (sig_alg) {
	case TLS_sig_sm2sig_sm3:
		if (public_key->algor != OID_ec_public_key
			&& public_key->algor_param != OID_sm2) {
			error_print();
			return -1;
		}
		if (tbs_dgst_ctx->digest->oid != OID_sm3) {
			error_print();
			return -1;
		}
		signer_id = TLS13_SM2_ID;
		signer_id_len = TLS13_SM2_ID_LENGTH;
		break;

	case TLS_sig_ecdsa_secp256r1_sha256:
		if (public_key->algor != OID_ec_public_key
			&& public_key->algor_param != OID_secp256r1) {
			error_print();
			return -1;
		}
		if (tbs_dgst_ctx->digest->oid != OID_sha256) {
			error_print();
			return -1;
		}
		break;

	default:
		error_print();
		return -1;
	}

	dgst_ctx = *tbs_dgst_ctx;
	if (digest_finish(&dgst_ctx, dgst, &dgstlen) != 1) {
		error_print();
		return -1;
	}

	if (x509_verify_init(&sign_ctx, public_key, signer_id, signer_id_len, sig, siglen) != 1
		|| x509_verify_update(&sign_ctx, prefix, 64) != 1
		|| x509_verify_update(&sign_ctx, context_str_and_zero, context_str_and_zero_len) != 1
		|| x509_verify_update(&sign_ctx, dgst, dgstlen) != 1) {
		error_print();
		return -1;
	}
	if ((ret = x509_verify_finish(&sign_ctx)) < 0) {
		error_print();
		return -1;
	}
	if (ret != 1) {
		error_print();
	}
	return ret;
}

/*
 verify_data in Finished

   finished_key =
       HKDF-Expand-Label(BaseKey, "finished", "", Hash.length)
   Structure of this message:
      struct {
          opaque verify_data[Hash.length];
      } Finished;
   The verify_data value is computed as follows:
      verify_data =
          HMAC(finished_key,
               Transcript-Hash(Handshake Context,
                               Certificate*, CertificateVerify*))
*/
int tls13_compute_verify_data(const uint8_t *handshake_traffic_secret,
	const DIGEST_CTX *dgst_ctx, uint8_t *verify_data, size_t *verify_data_len)
{
	DIGEST_CTX temp_dgst_ctx;
	uint8_t dgst[64];
	size_t dgstlen;
	uint8_t finished_key[64];
	size_t finished_key_len;

	temp_dgst_ctx = *dgst_ctx;
	digest_finish(&temp_dgst_ctx, dgst, &dgstlen);
	finished_key_len = dgstlen;

	tls13_hkdf_expand_label(dgst_ctx->digest, handshake_traffic_secret,
		"finished", NULL, 0, finished_key_len, finished_key);

	hmac(dgst_ctx->digest, finished_key, finished_key_len, dgst, dgstlen, verify_data, verify_data_len);
	return 1;
}



/*
CertificateEntry {
    select (certificate_type) {
        case X509: opaque cert_data<1..2^24-1>;    // DER编码的X.509证书
    };
    Extension extensions<0..2^16-1>;               // 这个证书的扩展列表
}
*/

int tls13_cert_list_get_count(const uint8_t *d, size_t dlen, size_t *cnt)
{
	int ret;
	ret = asn1_types_get_count(d, dlen, ASN1_TAG_SEQUENCE, cnt);
	if (ret < 0) error_print();
	return ret;
}

int tls13_cert_list_get_cert_by_index(const uint8_t *d, size_t dlen, int index, const uint8_t **cert, size_t *certlen)
{
	int i = 0;

	if (index < 0) {
		error_print();
		return -1;
	}
	while (dlen) {
		if (x509_cert_from_der(cert, certlen, &d, &dlen) != 1) {
			error_print();
			return -1;
		}
		if (i++ == index) {
			return 1;
		}
	}
	*cert = NULL;
	*certlen = 0;
	return 0;
}

int tls13_cert_list_get_last(const uint8_t *d, size_t dlen, const uint8_t **cert, size_t *certlen)
{
	if (dlen == 0) {
		return 0;
	}
	while (dlen) {
		if (x509_cert_from_der(cert, certlen, &d, &dlen) != 1) {
			error_print();
			return -1;
		}
	}
	return 1;
}

























// extensions


// 这个函数需要测试一下，看看是否支持ext_data == NULL， ext_datalen != 0时，可以只输出头部，并正确的修改输出长度
int tls_ext_to_bytes(int ext_type, const uint8_t *ext_data, size_t ext_datalen,
	uint8_t **out, size_t *outlen)
{
	tls_uint16_to_bytes(ext_type, out, outlen);
	tls_uint16array_to_bytes(ext_data, ext_datalen, out, outlen);
	return 1;
}



/*
struct {
	ProtocolVersion versions<2..254>;
} SupportedVersions; -- in ClientHello
*/
int tls13_client_supported_versions_ext_to_bytes(const int *versions, size_t versions_cnt,
	uint8_t **out, size_t *outlen)
{
	uint16_t ext_type = TLS_extension_supported_versions;
	size_t ext_datalen;
	size_t versions_len;
	size_t i;

	if (!versions || !versions_cnt || !outlen) {
		error_print();
		return -1;
	}
	if (versions_cnt > 254/2) {
		error_print();
		return -1;
	}
	for (i = 0; i < versions_cnt; i++) {
		if (!tls_protocol_name(versions[i])) {
			error_print();
			return -1;
		}
	}
 	versions_len = tls_uint16_size() * versions_cnt;
	ext_datalen = tls_uint8_size() + versions_len;
	tls_uint16_to_bytes(ext_type, out, outlen);
	tls_uint16_to_bytes((uint16_t)ext_datalen, out, outlen);
	tls_uint8_to_bytes((uint8_t)versions_len, out, outlen);
	for (i = 0; i < versions_cnt; i++) {
		tls_uint16_to_bytes((uint16_t)versions[i], out, outlen);
	}
	return 1;
}

int tls13_process_client_supported_versions(const uint8_t *ext_data, size_t ext_datalen,
	const int *server_versions, size_t server_versions_cnt,
	int *common_versions, size_t *common_versions_cnt, size_t max_cnt)
{
	const uint8_t *versions;
	size_t versions_len;
	const uint8_t *cp;
	size_t len;
	uint16_t version;
	size_t i, j = 0;

	if (tls_uint8array_from_bytes(&versions, &versions_len, &ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}
	if (versions_len < 2 || versions_len > 254) {
		error_print();
		return -1;
	}

	cp = versions;
	len = versions_len;
	while (len) {
		if (tls_uint16_from_bytes(&version, &cp, &len) != 1) {
			error_print();
			return -1;
		}
		if (!tls_protocol_name(version)) {
			error_print();
			return -1;
		}
		if (version == server_versions[0] && j < max_cnt) {
			common_versions[j++] = version;
		}
	}
	for (i = 1; i < server_versions_cnt && j < max_cnt; i++) {
		cp = versions;
		len = versions_len;
		while (len) {
			tls_uint16_from_bytes(&version, &cp, &len);
			if (version == server_versions[i]) {
				common_versions[j++] = version;
				break;
			}
		}
	}
	*common_versions_cnt = j;
	if (*common_versions_cnt == 0) {
		error_print();
		return 0;
	}
	return 1;
}

int tls13_client_supported_versions_print(FILE *fp, int fmt, int ind,
	const uint8_t *ext_data, size_t ext_datalen)
{
	const uint8_t *versions;
	size_t versions_len;

	format_print(fp, fmt, ind, "versions\n");
	ind += 4;

	if (tls_uint8array_from_bytes(&versions, &versions_len, &ext_data, &ext_datalen) != 1) {
		error_print();
		return -1;
	}
	if (versions_len < 2 || versions_len > 254) {
		error_print();
		return -1;
	}
	while (versions_len) {
		uint16_t version;
		if (tls_uint16_from_bytes(&version, &versions, &versions_len) != 1) {
			error_print();
			return -1;
		}
		format_print(fp, fmt, ind, "%s (%04x)\n", tls_protocol_name(version), version);
	}
	if (ext_datalen) {
		error_print();
		return -1;
	}
	return 1;
}


/*
struct {
	ProtocolVersion selected_version;
} SupportedVersions; // in ServerHello and HelloRetryRequest
*/
int tls13_server_supported_versions_ext_to_bytes(int selected_version, uint8_t **out, size_t *outlen)
{
	uint16_t ext_type = TLS_extension_supported_versions;
	size_t ext_datalen;
	size_t i;

	if (!outlen) {
		error_print();
		return -1;
	}
	if (!tls_protocol_name(selected_version)) {
		error_print();
		return -1;
	}
	ext_datalen = tls_uint16_size();
	tls_uint16_to_bytes(ext_type, out, outlen);
	tls_uint16_to_bytes((uint16_t)ext_datalen, out, outlen);
	tls_uint16_to_bytes(selected_version, out, outlen);
	return 1;
}

// 这个函数可能用不上
int tls13_server_supported_versions_from_bytes(int *selected_version, const uint8_t *ext_data, size_t ext_datalen)
{
	uint16_t version;
	if (tls_uint16_from_bytes(&version, &ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}
	if (!tls_protocol_name(version)) {
		error_print();
		return -1;
	}
	*selected_version = version;
	return 1;
}

int tls13_server_supported_versions_print(FILE *fp, int fmt, int ind,
	const uint8_t *ext_data, size_t ext_datalen)
{
	uint16_t version;

	if (tls_uint16_from_bytes(&version, &ext_data, &ext_datalen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "selected_version: %s (%04x)\n", tls_protocol_name(version), version);
	if (ext_datalen) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_process_server_supported_versions(const int *client_versions, size_t client_versions_cnt,
	const uint8_t *server_ext_data, size_t server_ext_datalen,
	int *selected_version)
{
	uint16_t version;
	size_t i;

	if (tls_uint16_from_bytes(&version, &server_ext_data, &server_ext_datalen) != 1
		|| tls_length_is_zero(server_ext_datalen) != 1) {
		error_print();
		return -1;
	}
	for (i = 0; i < client_versions_cnt; i++) {
		if (version == client_versions[i]) {
			*selected_version = version;
			return 1;
		}
	}
	error_print();
	return -1;
}



/*
struct {
	NamedGroup group;
	opaque key_exchange<1..2^16-1>;
} KeyShareEntry;
*/
int tls13_key_share_entry_to_bytes(const X509_KEY *key, uint8_t **out, size_t *outlen)
{
	uint16_t group;
	uint8_t key_exchange[65];

	if (!key || !outlen) {
		error_print();
		return -1;
	}
	if (key->algor != OID_ec_public_key) {
		error_print();
		return -1;
	}
	if (!(group = tls_named_curve_from_oid(key->algor_param))) {
		error_print();
		return -1;
	}
	if (out && *out) {
		uint8_t *p = key_exchange;
		size_t len = 0;
		if (x509_public_key_to_bytes(key, &p, &len) != 1) {
			error_print();
			return -1;
		}
		if (len != 65) {
			error_print();
			return -1;
		}
	}
	tls_uint16_to_bytes(group, out, outlen);
	tls_uint16array_to_bytes(key_exchange, 65, out, outlen);
	return 1;
}

int tls13_key_share_entry_from_bytes(int *group, const uint8_t **key_exchange, size_t *key_exchange_len,
	const uint8_t **in, size_t *inlen)
{
	uint16_t named_curve;

	if (tls_uint16_from_bytes(&named_curve, in, inlen) != 1
		|| tls_uint16array_from_bytes(key_exchange, key_exchange_len, in, inlen) != 1) {
		error_print();
		return -1;
	}
	*group = named_curve;
	if (!tls_named_curve_name(named_curve)) {
		error_print();
		return -1;
	}
	if (*key_exchange_len != 65) {
		error_print();
		return -1;
	}
	return 1;
}

/*
struct {
	KeyShareEntry client_shares<0..2^16-1>;
} KeyShareClientHello;
*/
int tls13_key_share_client_hello_ext_to_bytes(const X509_KEY *keys, size_t keys_cnt, uint8_t **out, size_t *outlen)
{
	uint16_t ext_type = TLS_extension_key_share;
	size_t ext_datalen = 0;
	size_t client_shares_len = 0;
	size_t i;

	for (i = 0; i < keys_cnt; i++) {
		if (tls13_key_share_entry_to_bytes(&keys[i], NULL, &client_shares_len) != 1) {
			error_print();
			return -1;
		}
	}
	ext_datalen = 2 + client_shares_len;

	tls_uint16_to_bytes(ext_type, out, outlen);
	tls_uint16_to_bytes((uint16_t)ext_datalen, out, outlen);
	tls_uint16_to_bytes((uint16_t)client_shares_len, out, outlen);
	for (i = 0; i < keys_cnt; i++) {
		tls13_key_share_entry_to_bytes(&keys[i], out, outlen);
	}
	return 1;
}

// allow supported_groups, supported_groups_cnt == NULL, 0
int tls13_process_key_share_client_hello(const uint8_t *ext_data, size_t ext_datalen,
	const int *supported_groups, size_t supported_groups_cnt,
	int *group, const uint8_t **key_exchange, size_t *key_exchange_len)
{
	int ret = 0;
	const uint8_t *client_shares;
	size_t client_shares_len;
	size_t i;

	if (tls_uint16array_from_bytes(&client_shares, &client_shares_len, &ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}

	for (i = 0; i < supported_groups_cnt; i++) {
		const uint8_t *cp = client_shares;
		size_t len = client_shares_len;
		int named_curve;
		const uint8_t *point;
		size_t pointlen;

		while (len) {
			if (tls13_key_share_entry_from_bytes(&named_curve, &point, &pointlen, &cp, &len) != 1) {
				error_print();
				return -1;
			}
			if (named_curve == supported_groups[i]) {
				*group = named_curve;
				*key_exchange = point;
				*key_exchange_len = pointlen;
				return 1;
			}
		}
	}
	return 0;
}

int tls13_process_key_share_client_hello_again(const uint8_t *ext_data, size_t ext_datalen,
	int key_exchange_group, const uint8_t **key_exchange, size_t *key_exchange_len)
{
	int ret = 0;
	const uint8_t *client_shares;
	size_t client_shares_len;
	int group;

	if (tls_uint16array_from_bytes(&client_shares, &client_shares_len, &ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}
	if (tls13_key_share_entry_from_bytes(&group, key_exchange, key_exchange_len, &client_shares, &client_shares_len) != 1
		|| tls_length_is_zero(client_shares_len) != 1) {
		error_print();
		return -1;
	}
	if (group != key_exchange_group) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_key_share_client_hello_print(FILE *fp, int fmt, int ind,
	const uint8_t *data, size_t datalen)
{
	const uint8_t *client_shares;
	size_t client_shares_len;

	format_print(fp, fmt, ind, "client_shares\n");
	ind += 4;
	if (tls_uint16array_from_bytes(&client_shares, &client_shares_len, &data, &datalen) != 1) {
		error_print();
		return -1;
	}
	if (!client_shares_len) {
		format_print(fp, fmt, ind, "(null)\n");
	}
	while (client_shares_len) {
		uint16_t group;
		const uint8_t *key_exchange;
		size_t key_exchange_len;

		format_print(fp, fmt, ind, "KeyShareEntry\n");
		if (tls_uint16_from_bytes(&group, &client_shares, &client_shares_len) != 1
			|| tls_uint16array_from_bytes(&key_exchange, &key_exchange_len, &client_shares, &client_shares_len) != 1) {
			error_print();
			return -1;
		}
		format_print(fp, fmt, ind + 4, "group: %s (%04x)\n", tls_named_curve_name(group), group);
		format_bytes(fp, fmt, ind + 4, "key_exchange", key_exchange, key_exchange_len);
	}
	if (datalen) {
		error_print();
		return -1;
	}
	return 1;
}





/*
struct {
	KeyShareEntry server_share;
} KeyShareServerHello;
*/
int tls13_key_share_server_hello_ext_to_bytes(const X509_KEY *key, uint8_t **out, size_t *outlen)
{
	uint16_t ext_type = TLS_extension_key_share;
	size_t ext_datalen = 0;

	if (tls13_key_share_entry_to_bytes(key, NULL, &ext_datalen) != 1) {
		error_print();
		return -1;
	}
	tls_uint16_to_bytes(ext_type, out, outlen);
	tls_uint16_to_bytes((uint16_t)ext_datalen, out, outlen);
	tls13_key_share_entry_to_bytes(key, out, outlen);
	return 1;
}

int tls13_key_share_server_hello_from_bytes(int *group, const uint8_t **key_exchange, size_t *key_exchange_len,
	const uint8_t *ext_data, size_t ext_datalen)
{
	if (tls13_key_share_entry_from_bytes(group, key_exchange, key_exchange_len,
			&ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_key_share_server_hello_print(FILE *fp, int fmt, int ind,
	const uint8_t *data, size_t datalen)
{
	uint16_t group;
	const uint8_t *key_exchange;
	size_t key_exchange_len;

	format_print(fp, fmt, ind, "server_share\n");
	ind += 4;
	if (tls_uint16_from_bytes(&group, &data, &datalen) != 1
		|| tls_uint16array_from_bytes(&key_exchange, &key_exchange_len, &data, &datalen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "group: %s (%04x)\n", tls_named_curve_name(group), group);
	format_bytes(fp, fmt, ind, "key_exchange", key_exchange, key_exchange_len);
	if (datalen) {
		error_print();
		return -1;
	}
	return 1;
}

/*
struct {
	NamedGroup selected_group;
} KeyShareHelloRetryRequest;
*/
int tls13_key_share_hello_retry_request_ext_to_bytes(int selected_group, uint8_t **out, size_t *outlen)
{
	uint16_t ext_type = TLS_extension_key_share;

	uint8_t ext_data[2];
	uint8_t *p = ext_data;
	size_t len = 0;

	tls_uint16_to_bytes((uint16_t)selected_group, &p, &len);
	tls_ext_to_bytes(ext_type, ext_data, sizeof(ext_data), out, outlen);

	return 1;
}

int tls13_key_share_hello_retry_request_from_bytes(int *selected_group, const uint8_t *ext_data, size_t ext_datalen)
{
	uint16_t group;

	if (tls_uint16_from_bytes(&group, &ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}
	if (!tls_named_curve_name(group)) {
		error_print();
		return -1;
	}
	*selected_group = group;
	return 1;
}

int tls13_key_share_hello_retry_request_print(FILE *fp, int fmt, int ind,
	const uint8_t *ext_data, size_t ext_datalen)
{
	uint16_t selected_group;

	if (tls_uint16_from_bytes(&selected_group, &ext_data, &ext_datalen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "selected_group: %s (%04x)\n",
		tls_named_curve_name(selected_group), selected_group);
	if (ext_datalen) {
		error_print();
		return -1;
	}
	return 1;
}



/*
certificate_authorities

  opaque DistinguishedName<1..2^16-1>;

  struct {
	DistinguishedName authorities<3..2^16-1>;
  } CertificateAuthoritiesExtension;
*/

int tls13_certificate_authorities_ext_to_bytes(const uint8_t *ca_names, size_t ca_names_len,
	uint8_t **out, size_t *outlen)
{
	int ext_type = TLS_extension_certificate_authorities;
	size_t ext_datalen;
	size_t authorities_len;
	const uint8_t *name;
	size_t namelen;
	const uint8_t *p;
	size_t len;

	p = ca_names;
	len = ca_names_len;
	authorities_len = 0;
	while (len) {
		if (x509_name_from_der(&name, &namelen, &p, &len) != 1) {
			error_print();
			return -1;
		}
		tls_uint16array_to_bytes(name, namelen, NULL, &authorities_len);
	}
	if (authorities_len < 3 || authorities_len > (1 << 16) - 1) {
		error_print();
		return -1;
	}
	ext_datalen = tls_uint16_size() + authorities_len;

	tls_uint16_to_bytes(ext_type, out, outlen);
	tls_uint16_to_bytes((uint16_t)ext_datalen, out, outlen);
	tls_uint16_to_bytes((uint16_t)authorities_len, out, outlen);
	while (ca_names_len) {
		x509_name_from_der(&name, &namelen, &ca_names, &ca_names_len);
		tls_uint16array_to_bytes(name, namelen, out, outlen);
	}
	return 1;
}

int tls13_certificate_authorities_from_bytes(const uint8_t **ca_names, size_t *ca_names_len,
	const uint8_t *ext_data, size_t ext_datalen)
{
	if (tls_uint16array_from_bytes(ca_names, ca_names_len, &ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}
	if (*ca_names == NULL) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_enable_certificate_authorities(TLS_CONNECT *conn)
{
	if (!conn) {
		error_print();
		return -1;
	}
	if (!conn->ctx->cacertslen) {
		error_print();
		return -1;
	}
	conn->certificate_authorities = 1;
	return 1;
}

int tls13_certificate_authorities_print(FILE *fp, int fmt, int ind,
	const uint8_t *ext_data, size_t ext_datalen)
{
	const uint8_t *authorities;
	size_t authorities_len;

	if (tls_uint16array_from_bytes(&authorities, &authorities_len, &ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}
	while (authorities_len) {
		const uint8_t *dn;
		size_t dn_len;

		if (tls_uint16array_from_bytes(&dn, &dn_len, &authorities, &authorities_len) != 1) {
			error_print();
			return -1;
		}

		x509_name_print(fp, fmt, ind, "DistinguishedName", dn, dn_len);
	}
	return 1;
}


/*
48. oid_filters

struct {
	OIDFilter filters<0..2^16-1>;
} OIDFilterExtension;

struct {
	opaque certificate_extension_oid<1..2^8-1>;
	opaque certificate_extension_values<0..2^16-1>;
} OIDFilter;
*/

int tls13_oid_filters_ext_to_bytes(const uint8_t *filters, size_t filters_len, uint8_t **out, size_t *outlen)
{
	uint16_t ext_type = TLS_extension_oid_filters;
	size_t ext_datalen;

	if (!outlen) {
		error_print();
		return -1;
	}

	ext_datalen = tls_uint16_size() + filters_len;
	tls_uint16_to_bytes(ext_type, out, outlen);
	tls_uint16_to_bytes(ext_datalen, out, outlen);
	tls_uint16array_to_bytes(filters, filters_len, out, outlen);

	return 1;
}

int tls13_oid_filters_from_bytes(const uint8_t **filters, size_t *filters_len,
	const uint8_t *ext_data, size_t ext_datalen)
{
	if (tls_uint16array_from_bytes(filters, filters_len, &ext_data, &ext_datalen) != 1
		|| tls_length_is_zero(ext_datalen) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_oid_filters_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	return 1;
}










/*
struct {
	opaque certificate_request_context<0..2^8-1>;
	Extension extensions<2..2^16-1>;
} CertificateRequest;

certificate_request_context 用于 Post-handshake Authentication，否则应该长度为0

*/

int tls13_client_hello_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	uint16_t protocol;
	const uint8_t *random;
	const uint8_t *session_id;
	const uint8_t *cipher_suites;
	const uint8_t *comp_meths;
	const uint8_t *exts;
	size_t session_id_len, cipher_suites_len, comp_meths_len, extslen;
	size_t i;

	format_print(fp, fmt, ind, "ClientHello\n");
	ind += 4;

	if (tls_uint16_from_bytes(&protocol, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "legacy_version: %s (%04x)\n",
		tls_protocol_name(protocol), protocol);

	if (tls_array_from_bytes(&random, 32, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "random", random ,32);

	if (tls_uint8array_from_bytes(&session_id, &session_id_len, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "legacy_session_id", session_id, session_id_len);

	format_print(fp, fmt, ind, "cipher_suites\n");
	if (tls_uint16array_from_bytes(&cipher_suites, &cipher_suites_len, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	while (cipher_suites_len) {
		uint16_t cipher;
		if (tls_uint16_from_bytes(&cipher, &cipher_suites, &cipher_suites_len) != 1) {
			error_print();
			return -1;
		}
		format_print(fp, fmt, ind+4, "%s (%04x)\n", tls_cipher_suite_name(cipher), cipher);
	}

	format_print(fp, fmt, ind, "legacy_compression_methods\n");
	if (tls_uint8array_from_bytes(&comp_meths, &comp_meths_len, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	for (i = 0; i < comp_meths_len; i++) {
		format_print(fp, fmt, ind + 4, "%s (%d)\n",
			tls_compression_method_name(comp_meths[i]), comp_meths[i]);
	}

	format_print(fp, fmt, ind, "extensions\n");
	ind += 4;
	if (tls_uint16array_from_bytes(&exts, &extslen, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	while (extslen) {
		uint16_t ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		// tls_ext_from_bytes can not parse unknown ext
		if (tls_uint16_from_bytes(&ext_type, &exts, &extslen) != 1
			|| tls_uint16array_from_bytes(&ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			return -1;
		}
		format_print(fp, fmt, ind, "%s (%d)\n", tls_extension_name(ext_type), ext_type);

		switch (ext_type) {
		case TLS_extension_supported_versions:
			tls13_client_supported_versions_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_signature_algorithms:
			tls_signature_algorithms_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_signature_algorithms_cert:
			tls_signature_algorithms_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_server_name:
			tls_server_name_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_status_request:
		//	tls_client_status_request_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_signed_certificate_timestamp:
			format_print(fp, fmt, ind + 4, "signed_certificate_timestamp\n");
			format_bytes(fp, fmt, ind + 4, "data", ext_data, ext_datalen); // should be empty
			break;
		case TLS_extension_supported_groups:
			tls_supported_groups_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_key_share:
			tls13_key_share_client_hello_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_psk_key_exchange_modes:
			tls13_psk_key_exchange_modes_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_pre_shared_key:
			tls13_client_pre_shared_key_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_early_data:
			tls13_early_data_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_cookie:
			tls13_cookie_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_post_handshake_auth:
			format_bytes(fp, fmt, ind + 4, "data", ext_data, ext_datalen); // should be empty
			break;
		case TLS_extension_max_fragment_length:
		case TLS_extension_use_srtp:
		case TLS_extension_heartbeat:
		case TLS_extension_application_layer_protocol_negotiation:
		case TLS_extension_server_certificate_type:
		case TLS_extension_client_certificate_type:
		case TLS_extension_padding:
		case TLS_extension_record_size_limit:
			format_bytes(fp, fmt, ind + 4, "data", ext_data, ext_datalen);
			break;
		default:
			format_bytes(fp, fmt, ind + 4, "data", ext_data, ext_datalen);
			//error_print();
			//return -1;
		}
	}
	if (dlen) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_server_hello_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	uint16_t protocol;
	const uint8_t *random;
	const uint8_t *session_id;
	uint16_t cipher_suite;
	uint8_t comp_meth;
	const uint8_t *exts;
	size_t session_id_len, extslen;

	format_print(fp, fmt, ind, "ServerHello\n");
	ind += 4;

	if (tls_uint16_from_bytes(&protocol, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "legacy_version: %s (%04x)\n",
		tls_protocol_name(protocol), protocol);

	if (tls_array_from_bytes(&random, 32, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "random", random, 32);

	if (tls_uint8array_from_bytes(&session_id, &session_id_len, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "legacy_session_id", session_id, session_id_len);

	if (tls_uint16_from_bytes(&cipher_suite, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "cipher_suite: %s (%04x)\n",
		tls_cipher_suite_name(cipher_suite), cipher_suite);

	if (tls_uint8_from_bytes(&comp_meth, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "legacy_compression_method: %s (%d)\n",
		tls_compression_method_name(comp_meth), comp_meth);

	format_print(fp, fmt, ind, "extensions\n");
	ind += 4;
	if (tls_uint16array_from_bytes(&exts, &extslen, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	while (extslen) {
		uint16_t ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_uint16_from_bytes(&ext_type, &exts, &extslen) != 1
			|| tls_uint16array_from_bytes(&ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			return -1;
		}
		format_print(fp, fmt, ind, "%s (%d)\n", tls_extension_name(ext_type), ext_type);
		switch (ext_type) {
		case TLS_extension_supported_versions:
			tls13_server_supported_versions_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_key_share:
			tls13_key_share_server_hello_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_pre_shared_key:
			tls13_server_pre_shared_key_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_cookie:
			tls13_cookie_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		default:
			format_bytes(fp, fmt, ind + 4, "raw_data", ext_data, ext_datalen);
			return -1;
		}
	}
	if (dlen) {
		error_print();
		return -1;
	}
	return 1;
}



int tls13_record_set_handshake_hello_retry_request(uint8_t *record, size_t *recordlen,
	int legacy_version, const uint8_t random[32],
	const uint8_t *legacy_session_id_echo, size_t legacy_session_id_echo_len,
	int cipher_suite, int legacy_compress_meth,
	const uint8_t *exts, size_t extslen)
{
	int type = TLS_handshake_hello_retry_request;
	uint8_t *p;
	size_t len;

	if (!tls_protocol_name(legacy_version)) {
		error_print();
		return -1;
	}
	if (legacy_session_id_echo_len > 32) {
		error_print();
		return -1;
	}
	if (!tls_cipher_suite_name(cipher_suite)) {
		error_print();
		return -1;
	}
	if (legacy_compress_meth > 255) {
		error_print();
		return -1;
	}

	p = tls_handshake_data(tls_record_data(record));
	len = 0;

	tls_uint16_to_bytes((uint16_t)legacy_version, &p, &len);
	tls_array_to_bytes(random, 32, &p, &len);
	tls_uint8array_to_bytes(legacy_session_id_echo, legacy_session_id_echo_len, &p, &len);
	tls_uint16_to_bytes((uint16_t)cipher_suite, &p, &len);
	tls_uint8_to_bytes((uint8_t)legacy_compress_meth, &p, &len);
	tls_uint16array_to_bytes(exts, extslen, &p, &len);

	if (tls_record_set_handshake(record, recordlen, type, NULL, len) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_record_get_handshake_hello_retry_request(uint8_t *record,
	int *legacy_version, const uint8_t **random,
	const uint8_t **legacy_session_id_echo, size_t *legacy_session_id_echo_len,
	int *cipher_suite, int *legacy_compress_meth,
	const uint8_t **exts, size_t *extslen)
{
	int type;
	const uint8_t *cp;
	size_t len;
	uint16_t version;
	uint16_t cipher;
	uint8_t comp_meth;

	if (tls_record_get_handshake(record, &type, &cp, &len) != 1) {
		error_print();
		return -1;
	}
	if (type != TLS_handshake_hello_retry_request) {
		error_print();
		return -1;
	}
	if (tls_uint16_from_bytes(&version, &cp, &len) != 1
		|| tls_array_from_bytes(random, 32, &cp, &len) != 1
		|| tls_uint8array_from_bytes(legacy_session_id_echo, legacy_session_id_echo_len, &cp, &len) != 1
		|| tls_uint16_from_bytes(&cipher, &cp, &len) != 1
		|| tls_uint8_from_bytes(&comp_meth, &cp, &len) != 1
		|| tls_uint16array_from_bytes(exts, extslen, &cp, &len) != 1
		|| tls_length_is_zero(len) != 1) {
		error_print();
		return -1;
	}

	// if legacy_version != tls12, send protocol_version alert
	if (!tls_protocol_name(version)) {
		error_print();
		return -1;
	}
	if (version != TLS_protocol_tls12) {
		error_print();
	}
	*legacy_version = version;

	if (*legacy_session_id_echo_len > 32) {
		error_print();
		return -1;
	}

	if (!tls_cipher_suite_name(cipher)) {
		error_print();
		return -1;
	}
	*cipher_suite = cipher;

	// if legacy_compress_meth != 0, send illegal_parameter alert
	if (comp_meth != 0) {
		error_print();
	}
	*legacy_compress_meth = comp_meth;

	if (*extslen < 6) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_hello_retry_request_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	uint16_t protocol;
	const uint8_t *random;
	const uint8_t *session_id;
	uint16_t cipher_suite;
	uint8_t comp_meth;
	const uint8_t *exts;
	size_t session_id_len, extslen;

	format_print(fp, fmt, ind, "HelloRetryRequest\n");
	ind += 4;

	if (tls_uint16_from_bytes(&protocol, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "legacy_version: %s (%04x)\n",
		tls_protocol_name(protocol), protocol);

	if (tls_array_from_bytes(&random, 32, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "random", random, 32);

	if (tls_uint8array_from_bytes(&session_id, &session_id_len, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "legacy_session_id", session_id, session_id_len);

	if (tls_uint16_from_bytes(&cipher_suite, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "cipher_suite: %s (%04x)\n",
		tls_cipher_suite_name(cipher_suite), cipher_suite);

	if (tls_uint8_from_bytes(&comp_meth, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "legacy_compression_method: %s (%d)\n",
		tls_compression_method_name(comp_meth), comp_meth);

	format_print(fp, fmt, ind, "extensions\n");
	ind += 4;
	if (tls_uint16array_from_bytes(&exts, &extslen, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	while (extslen) {
		uint16_t ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_uint16_from_bytes(&ext_type, &exts, &extslen) != 1
			|| tls_uint16array_from_bytes(&ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			return -1;
		}
		format_print(fp, fmt, ind, "%s (%d)\n", tls_extension_name(ext_type), ext_type);
		switch (ext_type) {
		case TLS_extension_supported_versions:
			tls13_server_supported_versions_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_key_share:
			tls13_key_share_hello_retry_request_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_pre_shared_key:
			//tls13_pre_shared_key_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_cookie:
			tls13_cookie_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		default:
			format_bytes(fp, fmt, ind + 4, "raw_data", ext_data, ext_datalen);
			return -1;
		}
	}
	if (dlen) {
		error_print();
		return -1;
	}

	return 1;
}





int tls13_encrypted_extensions_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	const uint8_t *exts;
	size_t extslen;

	format_print(fp, fmt, ind, "EncryptedExtensions\n");
	ind += 4;
	format_print(fp, fmt, ind, "extensions\n");
	ind += 4;

	if (tls_uint16array_from_bytes(&exts, &extslen, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	if (!extslen) {
		format_print(fp, fmt, ind, "(null)\n");
	}
	while (extslen) {
		uint16_t ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_uint16_from_bytes(&ext_type, &exts, &extslen) != 1
			|| tls_uint16array_from_bytes(&ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			return -1;
		}
		format_print(fp, fmt, ind, "%s (%d)\n", tls_extension_name(ext_type), ext_type);

		switch (ext_type) {
		case TLS_extension_supported_groups:
			tls_supported_groups_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_early_data:
			tls13_early_data_print(fp, fmt, ind + 4, ext_data, ext_datalen);
			break;
		case TLS_extension_client_certificate_type:
		case TLS_extension_server_certificate_type:
		case TLS_extension_server_name:
		case TLS_extension_max_fragment_length:
		case TLS_extension_use_srtp:
		case TLS_extension_heartbeat:
		case TLS_extension_application_layer_protocol_negotiation:
		case TLS_extension_record_size_limit:
		default:
			format_bytes(fp, fmt, ind, "raw_data", ext_data, ext_datalen);
		}
	}
	if (dlen) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_certificate_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	const uint8_t *req_context;
	size_t req_context_len;
	const uint8_t *cert_list;
	size_t cert_list_len;

	format_print(fp, fmt, ind, "Certificate\n");
	ind += 4;

	if (tls_uint8array_from_bytes(&req_context, &req_context_len, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "certificate_request_context", req_context, req_context_len);

	format_print(fp, fmt, ind, "certificate_list\n");
	ind += 4;
	if (tls_uint24array_from_bytes(&cert_list, &cert_list_len, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	while (cert_list_len) {
		const uint8_t *cert_data;
		size_t cert_data_len;
		const uint8_t *exts;
		size_t extslen;

		format_print(fp, fmt, ind, "CertificateEntry\n");
		if (tls_uint24array_from_bytes(&cert_data, &cert_data_len, &cert_list, &cert_list_len) != 1
			|| tls_uint16array_from_bytes(&exts, &extslen, &cert_list, &cert_list_len) != 1) {
			error_print();
			return -1;
		}
		if (!cert_data_len) {
			error_print();
			return -1;
		}
		x509_cert_print(fp, fmt, ind + 4, "Certificate", cert_data, cert_data_len);
		x509_cert_to_pem(cert_data, cert_data_len, fp);

		if (extslen)
			format_print(fp, fmt, ind + 4, "extensions\n");
		else	format_print(fp, fmt, ind + 4, "extensions: (null)\n");

		while (extslen) {
			uint16_t ext_type;
			const uint8_t *ext_data;
			size_t ext_datalen;

			if (tls_uint16_from_bytes(&ext_type, &exts, &extslen) != 1
				|| tls_uint16array_from_bytes(&ext_data, &ext_datalen, &exts, &extslen) != 1) {
				error_print();
				return -1;
			}
			format_print(fp, fmt, ind, "%s (%d)\n", tls_extension_name(ext_type), ext_type);
			ind += 4;

			switch (ext_type) {
			case TLS_extension_status_request:
			case TLS_extension_signed_certificate_timestamp:
			case TLS_extension_server_certificate_type:
			case TLS_extension_client_certificate_type:
				break;
			default:
				error_print();
				return -1;
			}
		}
	}
	if (dlen) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_certificate_request_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	const uint8_t *req_context;
	size_t req_context_len;
	const uint8_t *exts;
	size_t extslen;

	format_print(fp, fmt, ind, "CertificateRequest\n");
	ind += 4;

	if (tls_uint8array_from_bytes(&req_context, &req_context_len, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "certificate_request_context", req_context, req_context_len);

	format_print(fp, fmt, ind, "extensions\n");
	ind += 4;
	if (tls_uint16array_from_bytes(&exts, &extslen, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	while (extslen) {
		uint16_t ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_uint16_from_bytes(&ext_type, &exts, &extslen) != 1
			|| tls_uint16array_from_bytes(&ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			return -1;
		}
		switch (ext_type) {
		case TLS_extension_signature_algorithms:
			tls_signature_algorithms_print(fp, fmt, ind, ext_data, ext_datalen);
			break;
		case TLS_extension_certificate_authorities:
			tls13_certificate_authorities_print(fp, fmt, ind, ext_data, ext_datalen);
			break;
		case TLS_extension_status_request:
			//tls13_status_request_print(fp, fmt, ind, ext_data, ext_datalen);
			break;
		case TLS_extension_signature_algorithms_cert:
			tls_signature_algorithms_print(fp, fmt, ind, ext_data, ext_datalen);
			break;
		case TLS_extension_client_certificate_type:
			//tls13_client_certificate_type_print(fp, fmt, ind, ext_data, ext_datalen);
			break;
		default:
			error_print();
			return -1;
		}
	}
	if (dlen) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_certificate_verify_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	uint16_t sig_alg;
	const uint8_t *sig;
	size_t siglen;

	format_print(fp, fmt, ind, "CertificateVerify\n");
	ind += 4;

	if (tls_uint16_from_bytes(&sig_alg, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "algorithm: %s (%04x)\n", tls_signature_scheme_name(sig_alg), sig_alg);
	if (tls_uint16array_from_bytes(&sig, &siglen, &d, &dlen) != 1) {
		error_print();
		return -1;
	}
	format_bytes(fp, fmt, ind, "signature", sig, siglen);
	if (tls_length_is_zero(dlen) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_key_update_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	uint8_t update_requested;

	if (tls_uint8_from_bytes(&update_requested, &d, &dlen) != 1
		|| tls_length_is_zero(dlen) != 1) {
		error_print();
		return -1;
	}
	switch (update_requested) {
	case 0:
	case 1:
		break;
	default:
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "request_update: %d\n", update_requested);
	return 1;
}

int tls13_message_hash_print(FILE *fp, int fmt, int ind, const uint8_t *d, size_t dlen)
{
	return 1;
}

int tls13_finished_print(FILE *fp, int fmt, int ind, const uint8_t *data, size_t datalen)
{
	format_print(fp, fmt, ind, "Finished\n");
	ind += 4;
	format_bytes(fp, fmt, ind, "verify_data", data, datalen);
	return 1;
}


int tls13_handshake_print(FILE *fp, int fmt, int ind, const uint8_t *handshake, size_t handshake_len)
{
	const uint8_t *p = handshake;
	size_t len = handshake_len;
	uint8_t type;
	const uint8_t *data;
	size_t datalen;

	if (tls_uint8_from_bytes(&type, &handshake, &handshake_len) != 1
		|| tls_uint24array_from_bytes(&data, &datalen, &handshake, &handshake_len) != 1
		|| tls_length_is_zero(handshake_len) != 1) {
		error_print();
		return -1;
	}
	format_print(fp, fmt, ind, "Handshake\n");
	ind += 4;
	format_print(fp, fmt, ind, "Type: %s (%d)\n", tls_handshake_type_name(type), type);
	format_print(fp, fmt, ind, "Length: %zu\n", datalen);

	switch (type) {
	case TLS_handshake_client_hello:
		tls13_client_hello_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_server_hello:
		tls13_server_hello_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_hello_retry_request:
		tls13_hello_retry_request_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_new_session_ticket:
		tls13_new_session_ticket_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_end_of_early_data:
		tls13_end_of_early_data_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_encrypted_extensions:
		tls13_encrypted_extensions_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_certificate:
		tls13_certificate_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_certificate_request:
		tls13_certificate_request_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_certificate_verify:
		tls13_certificate_verify_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_finished:
		tls13_finished_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_key_update:
		tls13_key_update_print(fp, fmt, ind, data, datalen);
		break;
	case TLS_handshake_message_hash:
		tls13_message_hash_print(fp, fmt, ind, data, datalen);
		break;
	default:
		error_print();
		return -1;
	}
	return 1;
}

int tls13_record_print(FILE *fp, int format, int indent, const uint8_t *record, size_t recordlen)
{
	const uint8_t *data;
	size_t datalen;
	int protocol;

	format |= TLS_cipher_sm4_gcm_sm3 << 8;

	if (!fp || !record || recordlen < 5) {
		error_print();
		return -1;
	}
	protocol = tls_record_protocol(record);
	format_print(fp, format, indent, "Record\n"); indent += 4;
	format_print(fp, format, indent, "ContentType: %s (%d)\n", tls_record_type_name(record[0]), record[0]);
	format_print(fp, format, indent, "Version: %s (%04x)\n", tls_protocol_name(protocol), protocol);
	format_print(fp, format, indent, "Length: %d\n", tls_record_data_length(record));

	data = tls_record_data(record);
	datalen = tls_record_data_length(record);

	if (recordlen < tls_record_length(record)) {
		error_print();
		return -1;
	}

	// 最高字节设置后强制打印记录原始数据
	if (format >> 24) {
		format_bytes(fp, format, indent, "Data", data, datalen);
		fprintf(fp, "\n");
		return 1;
	}

	switch (record[0]) {
	case TLS_record_handshake:
		tls13_handshake_print(fp, format, indent, data, datalen);
		break;

	case TLS_record_alert:
		if (tls_alert_print(fp, data, datalen, format, indent) != 1) {
			error_print();
			return -1;
		}
		break;
	case TLS_record_change_cipher_spec:
		if (tls_change_cipher_spec_print(fp, data, datalen, format, indent) != 1) {
			error_print();
			return -1;
		}
		break;
	case TLS_record_application_data:
		if (tls_application_data_print(fp, data, datalen, format, indent) != 1) {
			error_print();
			return -1;
		}
		break;
	default:
		error_print();
		return -1;
	}

	recordlen -= tls_record_length(record);
	if (recordlen) {
		format_print(fp, 0, 0, "DataLeftInRecord: %zu\n", recordlen);
	}

	fprintf(fp, "\n");
	return 1;
}




int tls13_certificate_list_to_bytes(const uint8_t *certs, size_t certslen,
	uint8_t **out, size_t *outlen)
{
	uint8_t *p = NULL;
	size_t cert_list_len = 0;

	if (out && *out) {
		p = (*out) + tls_uint24_size();
	}
	while (certslen) {
		const uint8_t *cert;
		size_t certlen;
		const uint8_t *entry_exts = NULL;
		size_t entry_exts_len = 0;

		if (x509_cert_from_der(&cert, &certlen, &certs, &certslen) != 1) {
			error_print();
			return -1;
		}
		tls_uint24array_to_bytes(cert, certlen, &p, &cert_list_len);
		tls_uint16array_to_bytes(entry_exts, entry_exts_len, &p, &cert_list_len);

	}
	tls_uint24array_to_bytes(NULL, cert_list_len, out, outlen);
	return 1;
}

int tls13_process_certificate_list(const uint8_t *cert_list, size_t cert_list_len,
	uint8_t *certs, size_t *certs_len)
{
	*certs_len = 0;

	while (cert_list_len) {
		const uint8_t *cert_data;
		size_t cert_data_len;
		const uint8_t *exts;
		size_t exts_len;
		const uint8_t *cert;
		size_t cert_len;

		if (tls_uint24array_from_bytes(&cert_data, &cert_data_len, &cert_list, &cert_list_len) != 1
			|| tls_uint16array_from_bytes(&exts, &exts_len, &cert_list, &cert_list_len) != 1) {
			error_print();
			return -1;
		}
		if (x509_cert_from_der(&cert, &cert_len, &cert_data, &cert_data_len) != 1
			|| asn1_length_is_zero(cert_data_len) != 1
			|| x509_cert_to_der(cert, cert_len, &certs, certs_len) != 1) {
			error_print();
			return -1;
		}

		while (exts_len) {
			int ext_type;
			const uint8_t *ext_data;
			size_t ext_data_len;

			if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_data_len, &exts, &exts_len) != 1) {
				error_print();
				return -1;
			}
			switch (ext_type) {
			case TLS_extension_status_request:
			case TLS_extension_signed_certificate_timestamp:
				error_print();
				return -1;
			default:
				error_print();
				return -1;
			}
		}
	}
	return 1;
}


// 1. client_hello
// 2. server_hello

/*
int tls13_record_set_handshake_hello_retry_request(uint8_t *record, size_t *recordlen,
	int protocol, const uint8_t random[32],
	const uint8_t *session_id, size_t session_id_len, int cipher_suite,
	const uint8_t *exts, size_t exts_len)
{
	uint8_t type = TLS_handshake_hello_retry_request;
	uint8_t *p;
	size_t len;

	if (!record || !recordlen || !random) {
		error_print();
		return -1;
	}
	if (session_id) {
		if (session_id_len == 0
			|| session_id_len < TLS_MIN_SESSION_ID_SIZE
			|| session_id_len > TLS_MAX_SESSION_ID_SIZE) {
			error_print();
			return -1;
		}
	}
	if (!tls_protocol_name(protocol)) {
		error_print();
		return -1;
	}
	if (!tls_cipher_suite_name(cipher_suite)) {
		error_print();
		return -1;
	}

	p = tls_handshake_data(tls_record_data(record));
	len = 0;

	tls_uint16_to_bytes((uint16_t)protocol, &p, &len);
	tls_array_to_bytes(random, 32, &p, &len);
	tls_uint8array_to_bytes(session_id, session_id_len, &p, &len);
	tls_uint16_to_bytes((uint16_t)cipher_suite, &p, &len);
	tls_uint8_to_bytes((uint8_t)TLS_compression_null, &p, &len);
	if (exts) {
		if (protocol < TLS_protocol_tls12) {
			error_print();
			return -1;
		}
		tls_uint16array_to_bytes(exts, exts_len, &p, &len);
	}
	if (tls_record_set_handshake(record, recordlen, type, NULL, len) != 1) {
		error_print();
		return -1;
	}
	return 1;
}
*/

/*
NewSessionTicket

      struct {
          uint32 ticket_lifetime;
          uint32 ticket_age_add;
          opaque ticket_nonce<0..255>;
          opaque ticket<1..2^16-1>;
          Extension extensions<0..2^16-2>;
      } NewSessionTicket;
*/





// 8. encrypted_extensions
int tls13_record_set_handshake_encrypted_extensions(uint8_t *record, size_t *recordlen,
	const uint8_t *exts, size_t extslen)
{
	int type = TLS_handshake_encrypted_extensions;
	uint8_t *p = record + 5 + 4;
	size_t len = 0;

	tls_uint16array_to_bytes(exts, extslen, &p, &len);
	tls_record_set_handshake(record, recordlen, type, NULL, len);
	return 1;
}

int tls13_record_get_handshake_encrypted_extensions(const uint8_t *record,
	const uint8_t **exts, size_t *extslen)
{
	int type;
	const uint8_t *cp;
	size_t len;

	if (tls_record_get_handshake(record, &type, &cp, &len) != 1) {
		error_print();
		return -1;
	}
	if (type != TLS_handshake_encrypted_extensions) {
		error_print();
		return 0;
	}
	if (tls_uint16array_from_bytes(exts, extslen, &cp, &len) != 1
		|| tls_length_is_zero(len) != 1) {
		error_print();
		return -1;
	}
	return 1;
}


// 11. certificate

/*
Certificate {
    opaque certificate_request_context<0..2^8-1>;
    CertificateEntry certificate_list<0..2^24-1>;
}

CertificateEntry {
	opaque cert_data<1..2^24-1>;
	Extension extensions<0..2^16-1>;
}
*/

int tls13_certificate_entry_to_bytes(const uint8_t *cert, size_t certlen,
	const uint8_t *status_request_ocsp_response, size_t status_request_ocsp_response_len,
	const uint8_t *signed_certificate_timestamp, size_t signed_certificate_timestamp_len,
	uint8_t **out, size_t *outlen)
{
	size_t extslen = 0;

	if (status_request_ocsp_response && status_request_ocsp_response_len) {
		tls_server_status_request_ext_to_bytes(status_request_ocsp_response, status_request_ocsp_response_len, NULL, &extslen);
	}
	if (signed_certificate_timestamp && signed_certificate_timestamp_len) {
		tls_signed_certificate_timestamp_ext_to_bytes(signed_certificate_timestamp, signed_certificate_timestamp_len, NULL, &extslen);
	}

	tls_uint24array_to_bytes(cert, certlen, out, outlen);
	tls_uint16_to_bytes(extslen, out, outlen);
	if (status_request_ocsp_response && status_request_ocsp_response_len) {
		tls_server_status_request_ext_to_bytes(status_request_ocsp_response, status_request_ocsp_response_len, out, outlen);
	}
	if (signed_certificate_timestamp && signed_certificate_timestamp_len) {
		tls_signed_certificate_timestamp_ext_to_bytes(signed_certificate_timestamp, signed_certificate_timestamp_len, out, outlen);
	}
	return 1;
}

int tls13_certificate_entry_from_bytes(const uint8_t **cert, size_t *certlen,
	const uint8_t **status_request_ocsp_response, size_t *status_request_ocsp_response_len,
	const uint8_t **signed_certificate_timestamp, size_t *signed_certificate_timestamp_len,
	const uint8_t **in, size_t *inlen)
{
	const uint8_t *exts;
	size_t extslen;

	if (!cert || !certlen
		|| !status_request_ocsp_response || !status_request_ocsp_response_len
		|| !signed_certificate_timestamp || !signed_certificate_timestamp_len
		|| !in || !(*in) || !inlen) {
		error_print();
		return -1;
	}
	if (tls_uint24array_from_bytes(cert, certlen, in, inlen) != 1
		|| tls_uint16array_from_bytes(&exts, &extslen, in, inlen) != 1) {
		error_print();
		return -1;
	}
	while (extslen) {
		int ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			return -1;
		}

		switch (ext_type) {
		case TLS_extension_status_request:
			*status_request_ocsp_response = ext_data;
			*status_request_ocsp_response_len = ext_datalen;
			break;
		case TLS_extension_signed_certificate_timestamp:
			*signed_certificate_timestamp = ext_data;
			*signed_certificate_timestamp_len = ext_datalen;
			break;
		default:
			error_print();
			return -1;
		}
	}
	return 1;
}

/*
struct {
	opaque certificate_request_context<0..2^8-1>;
	CertificateEntry certificate_list<0..2^24-1>;
} Certificate;

if has no proper certificate chain
the client should send the Certificate with empty certificate_list content
*/
int tls13_record_set_handshake_certificate(uint8_t *record, size_t *recordlen,
	const uint8_t *request_context, size_t request_context_len,
	const uint8_t *certs, size_t certslen,
	const uint8_t *entity_status_request_ocsp_response, size_t entity_status_request_ocsp_response_len,
	const uint8_t *entity_signed_certificate_timestamp, size_t entity_signed_certificate_timestamp_len)
{
	int type = TLS_handshake_certificate;
	uint8_t *data;
	size_t datalen = 0;
	uint8_t *cert_list;
	size_t cert_list_len = 0;
	const uint8_t *cert;
	size_t certlen;
	size_t len;

	if (!record || !recordlen) {
		error_print();
		return -1;
	}

	data = tls_handshake_data(tls_record_data(record));

	// certificate_request_context<0..2^8-1>
	tls_uint8array_to_bytes(request_context, request_context_len, &data, &datalen);

	// certificate_list<0..2^24-1>
	cert_list = data;
	tls_uint24_to_bytes(0, &data, &len);

	// client might send null certificate_list
	if (certs && certslen) {
		// first (entity) cert entry
		if (x509_cert_from_der(&cert, &certlen, &certs, &certslen) != 1) {
			error_print();
			return -1;
		}
		if (tls13_certificate_entry_to_bytes(cert, certlen,
			entity_status_request_ocsp_response, entity_status_request_ocsp_response_len,
			entity_signed_certificate_timestamp, entity_signed_certificate_timestamp_len,
			&data, &cert_list_len) != 1) {
			error_print();
			return -1;
		}
		// ca certs entries
		while (certslen) {
			if (x509_cert_from_der(&cert, &certlen, &certs, &certslen) != 1) {
				error_print();
				return -1;
			}
			if (tls13_certificate_entry_to_bytes(cert, certlen, NULL, 0, NULL, 0, &data, &cert_list_len) != 1) {
				error_print();
				return -1;
			}
		}
	}
	tls_uint24array_to_bytes(NULL, cert_list_len, &cert_list, &datalen);
	if (tls_record_set_handshake(record, recordlen, type, NULL, datalen) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

/*
int _tls13_record_get_handshake_certificate(const uint8_t *record,
	const uint8_t **request_context, size_t *request_context_len,
	const uint8_t **cert_list, size_t *cert_list_len)
{
	int type;
	const uint8_t *p;
	size_t len;

	if (tls_record_get_handshake(record, &type, &p, &len) != 1) {
		error_print();
		return -1;
	}
	if (type != TLS_handshake_certificate) {
		error_print();
		return -1;
	}
	if (tls_uint8array_from_bytes(request_context, request_context_len, &p, &len) != 1
		|| tls_uint24array_from_bytes(cert_list, cert_list_len, &p, &len) != 1
		|| tls_length_is_zero(len) != 1) {
		error_print();
		return -1;
	}
	return 1;
}
*/


// even if status_request, signed_certificate_timestamp not requested
// server/client can still return certificate with these two extensions
int tls13_record_get_handshake_certificate(const uint8_t *record,
	const uint8_t **request_context, size_t *request_context_len,
	uint8_t *cert_chain, size_t *cert_chain_len, size_t cert_chain_maxlen,
	const uint8_t **entity_status_request_ocsp_response, size_t *entity_status_request_ocsp_response_len,
	const uint8_t **entity_signed_certificate_timestamp, size_t *entity_signed_certificate_timestamp_len)
{
	int type;
	const uint8_t *p;
	size_t len;
	const uint8_t *cert_list;
	size_t cert_list_len;
	const uint8_t *cert;
	size_t certlen;


	if (tls_record_get_handshake(record, &type, &p, &len) != 1) {
		error_print();
		return -1;
	}
	if (type != TLS_handshake_certificate) {
		error_print();
		return -1;
	}
	if (tls_uint8array_from_bytes(request_context, request_context_len, &p, &len) != 1
		|| tls_uint24array_from_bytes(&cert_list, &cert_list_len, &p, &len) != 1
		|| tls_length_is_zero(len) != 1) {
		error_print();
		return -1;
	}
	if (cert_list_len > cert_chain_maxlen) {
		error_print();
		return -1;
	}

	if (tls13_certificate_entry_from_bytes(&cert, &certlen,
		entity_status_request_ocsp_response, entity_status_request_ocsp_response_len,
		entity_signed_certificate_timestamp, entity_signed_certificate_timestamp_len,
		&cert_list, &cert_list_len) != 1) {
		error_print();
		return -1;
	}

	*cert_chain_len = 0;

	x509_cert_to_der(cert, certlen, &cert_chain, cert_chain_len);

	while (cert_list_len) {
		const uint8_t *status_request_ocsp_response;
		size_t status_request_ocsp_response_len;
		const uint8_t *signed_certificate_timestamp;
		size_t signed_certificate_timestamp_len;

		if (tls13_certificate_entry_from_bytes(&cert, &certlen,
			&status_request_ocsp_response, &status_request_ocsp_response_len,
			&signed_certificate_timestamp, &signed_certificate_timestamp_len,
			&cert_list, &cert_list_len) != 1) {
			error_print();
			return -1;
		}
			// 这里的解析可能是有问题的				


		x509_cert_to_der(cert, certlen, &cert_chain, cert_chain_len);
	}

	return 1;
}




// 13. certificate_request
/*
struct {
	opaque certificate_request_context<0..2^8-1>;
	Extension extensions<2..2^16-1>;
} CertificateRequest;

extensiosns:
	Extension signature_algorithms MUST be specified
*/
int tls13_record_set_handshake_certificate_request(uint8_t *record, size_t *recordlen,
	const uint8_t *request_context, size_t request_context_len,
	const uint8_t *exts, size_t extslen)
{
	int type = TLS_handshake_certificate_request;
	uint8_t *data;
	size_t datalen = 0;

	if (!record || !recordlen) {
		error_print();
		return -1;
	}
	data = tls_handshake_data(tls_record_data(record));
	tls_uint8array_to_bytes(request_context, request_context_len, &data, &datalen);
	tls_uint16array_to_bytes(exts, extslen, &data, &datalen);
	tls_record_set_handshake(record, recordlen, type, NULL, datalen);
	return 1;
}

int tls13_record_set_handshake_certificate_request_default(uint8_t *record, size_t *recordlen)
{
	int sig_algs[] = { TLS_sig_sm2sig_sm3 };
	uint8_t exts[256];
	uint8_t *p = exts;
	size_t extslen = 0;

	tls_signature_algorithms_ext_to_bytes(sig_algs, sizeof(sig_algs)/sizeof(int), &p, &extslen);
	tls13_record_set_handshake_certificate_request(record, recordlen, NULL, 0, exts, extslen);
	return 1;
}

int tls13_record_get_handshake_certificate_request(const uint8_t *record,
	const uint8_t **requst_context, size_t *request_context_len,
	const uint8_t **exts, size_t *exts_len)
{
	int type;
	const uint8_t *p;
	size_t len;

	if (tls_record_get_handshake(record, &type, &p, &len) != 1) {
		error_print();
		return -1;
	}
	if (type != TLS_handshake_certificate_request) {
		error_print();
		return -1;
	}
	if (tls_uint8array_from_bytes(requst_context, request_context_len, &p, &len) != 1
		|| tls_uint16array_from_bytes(exts, exts_len, &p, &len) != 1
		|| tls_length_is_zero(len) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

/*
handshake #15

struct {
	SignatureScheme algorithm;
	opaque signature<0..2^16-1>;
} CertificateVerify;
*/
int tls13_record_set_handshake_certificate_verify(uint8_t *record, size_t *recordlen,
	int sig_alg, const uint8_t *sig, size_t siglen)
{
	int type = TLS_handshake_certificate_verify;
	uint8_t *p = record + 5 + 4; // 这里都应该改为tls_record_handshake_data			
	size_t len = 0;

	if (!tls_signature_scheme_name(sig_alg)) {
		error_print();
		return -1;
	}
	tls_uint16_to_bytes((uint16_t)sig_alg, &p, &len);
	tls_uint16array_to_bytes(sig, siglen, &p, &len);
	if (tls_record_set_handshake_header(record, recordlen, type, len) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_record_get_handshake_certificate_verify(const uint8_t *record,
	int *sig_alg, const uint8_t **sig, size_t *siglen)
{
	int type;
	const uint8_t *cp;
	size_t len ;
	uint16_t alg;

	if (tls_record_get_handshake(record, &type, &cp, &len) != 1) {
		error_print();
		return -1;
	}
	if (type != TLS_handshake_certificate_verify) {
		return 0;
	}
	if (tls_uint16_from_bytes(&alg, &cp, &len) != 1
		|| tls_uint16array_from_bytes(sig, siglen, &cp, &len) != 1) {
		error_print();
		return -1;
	}
	if (!tls_signature_scheme_name(alg)) {
		error_print();
		return -1;
	}
	*sig_alg = alg;
	return 1;
}


// 20. finished


/*
finished_key = HKDF-Expand-Label(BaseKey, "finished", "", Hash.length)

struct {
          opaque verify_data[Hash.length];
} Finished;

verify_data = HMAC(finished_key, Hash(Handshake Context, Certificate*, CertificateVerify*))
Hash = SM3, SHA256 or SHA384
*/


int tls13_record_set_handshake_finished(uint8_t *record, size_t *recordlen,
	const uint8_t *verify_data, size_t verify_data_len)
{
	int type = TLS_handshake_finished;

	if (!verify_data || !verify_data_len) {
		error_print();
		return -1;
	}
	if (verify_data_len != 32) {
		error_print();
		return -1;
	}
	if (tls_record_set_handshake(record, recordlen, type, verify_data, verify_data_len) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_record_get_handshake_finished(const uint8_t *record,
	const uint8_t **verify_data, size_t *verify_data_len)
{
	int type;

	if (tls_record_get_handshake(record, &type, verify_data, verify_data_len) != 1) {
		error_print();
		return -1;
	}
	if (type != TLS_handshake_finished) {
		return 0;
	}
	if (*verify_data_len == 0) {
		error_print();
		return -1;
	}
	return 1;
}

// 24. key_update
int tls13_record_set_handshake_key_update(uint8_t *record, size_t *recordlen,
	int request_update)
{
	int type = TLS_handshake_key_update;
	uint8_t data[1]; // 这个值不太好

	data[0] = request_update ? 1 : 0;
	if (tls_record_set_handshake(record, recordlen, type, data, sizeof(data)) != 1) {
		error_print();
		return -1;
	}
	return 1;
}

int tls13_record_get_handshake_key_update(uint8_t *record, int *request_update)
{
	int type;
	const uint8_t *cp;
	size_t len;

	if (tls_record_get_handshake(record, &type, &cp, &len) != 1) {
		error_print();
		return -1;
	}
	if (type != TLS_handshake_key_update) {
		return 0;
	}

	if (len != 1) {
		error_print();
		return -1;
	}
	switch (cp[0]) {
	case 0:
		*request_update = 0;
		break;
	case 1:
		*request_update = 1;
		break;
	default:
		error_print();
		return -1;
	}
	return 1;
}



// 254. message_hash
int tls13_record_set_message_hash(uint8_t *record, size_t *recordlen)
{
	return -1;
}

int tls13_record_get_message_hash(uint8_t *record, size_t *recordlen)
{
	return -1;
}






int tls_handshake_digest_print(FILE *fp, int fmt, int ind, const char *label, const DIGEST_CTX *dgst_ctx)
{
	DIGEST_CTX tmp_ctx;
	uint8_t dgst[64];
	size_t dgstlen;

	tmp_ctx = *dgst_ctx;

	digest_finish(&tmp_ctx, dgst, &dgstlen);

	format_bytes(fp, fmt, ind, label, dgst, dgstlen);

	return 1;
}





/*
       Client                                           Server

Key  ^ ClientHello
Exch | + key_share*
     | + signature_algorithms*
     | + psk_key_exchange_modes*
     v + pre_shared_key*       -------->
                                                  ServerHello  ^ Key
                                                 + key_share*  | Exch
                                            + pre_shared_key*  v


	| ecdhe => handshake_secret			|
	| handshake_secret => master_secret		|
	| handshake_secret, client_hello, server_hello	|
	|	=> client_handshake_traffic_secret	|
	| => server_handshake_traffic_secret		|


                                        {EncryptedExtensions}  ^  Server
                                        {CertificateRequest*}  v  Params
                                                {Certificate}  ^
                                          {CertificateVerify}  | Auth
                                                   {Finished}  v

	+ master_secret, ClientHello .. server Finished
		=> server_application_traffic_secret_0

                               <--------  [Application Data*]

     ^ {Certificate*}
Auth | {CertificateVerify*}
     v {Finished}              -------->


	+ master_secret, ClientHello .. server Finished
		=> client_application_traffic_secret_0

       [Application Data]      <------->  [Application Data]




*/



int tls_key_exchange_modes_print(FILE *fp, int fmt, int ind, const char *label, int modes)
{
	format_print(fp, fmt, ind, "%s:", label);

	if (modes & TLS_KE_CERT_DHE) {
		fprintf(fp, " CERT_DHE");
	}
	if (modes & TLS_KE_PSK_DHE) {
		fprintf(fp, " PSK_DHE");
	}
	if (modes & TLS_KE_PSK) {
		fprintf(fp, " PSK");
	}
	fprintf(fp, "\n");
	return 1;
}


/*

             0
             |
             v
[1]  PSK ->  HKDF-Extract = Early Secret
             |
[2]          +-----> Derive-Secret(., "ext binder" | "res binder", "")
             |                     = binder_key
             |
[3]          +-----> Derive-Secret(., "c e traffic", ClientHello)
             |                     = client_early_traffic_secret
             |
[4]          +-----> Derive-Secret(., "e exp master", ClientHello)
             |                     = early_exporter_master_secret
             v
[5]    Derive-Secret(., "derived", "")
             |
             v
[6]  (EC)DHE -> HKDF-Extract = Handshake Secret
             |
[7]          +-----> Derive-Secret(., "c hs traffic",
             |                     ClientHello...ServerHello)
             |                     = client_handshake_traffic_secret
             |
[8]          +-----> Derive-Secret(., "s hs traffic",
             |                     ClientHello...ServerHello)
             |                     = server_handshake_traffic_secret
             v
[9]    Derive-Secret(., "derived", "")
             |
             v
[10]   0 -> HKDF-Extract = Master Secret
             |
[11]         +-----> Derive-Secret(., "c ap traffic",
             |                     ClientHello...server Finished)
             |                     = client_application_traffic_secret_0
             |
[12]         +-----> Derive-Secret(., "s ap traffic",
             |                     ClientHello...server Finished)
             |                     = server_application_traffic_secret_0
             |
[13]         +-----> Derive-Secret(., "exp master",
             |                     ClientHello...server Finished)
             |                     = exporter_master_secret
             |
[14]         +-----> Derive-Secret(., "res master",
                                   ClientHello...client Finished)
                                   = resumption_master_secret

*/


// 这个函数实际上是生成握手过程的密钥
int tls13_generate_handshake_keys(TLS_CONNECT *conn)
{
	uint8_t zeros[32] = {0};
	uint8_t early_secret[32];
	uint8_t handshake_secret[32];
	uint8_t pre_master_secret[32] = {0};
	size_t pre_master_secret_len;
	uint8_t client_write_key[16] = {0};
	uint8_t server_write_key[16] = {0};
	DIGEST_CTX null_dgst_ctx;

	printf("generate handshake secrets\n");


	/*
	generate handshake keys
		uint8_t client_write_key[32]
		uint8_t server_write_key[32]
		uint8_t client_write_iv[12]
		uint8_t server_write_iv[12]
	*/



	// 计算ECDHE
	if (conn->key_exchange_modes != TLS_KE_PSK) {
		if (conn->key_exchange_idx >= conn->key_exchanges_cnt) {
			error_print();
			return -1;
		}
		if (x509_key_exchange(&conn->key_exchanges[conn->key_exchange_idx],
			conn->peer_key_exchange, conn->peer_key_exchange_len,
			pre_master_secret, &pre_master_secret_len) != 1) {
			error_print();
			return -1;
		}
	}

	digest_init(&null_dgst_ctx, conn->digest);


	/* [1]  */ tls13_hkdf_extract(conn->digest, zeros, conn->psk, early_secret);
	/* [5]  */ tls13_derive_secret(early_secret, "derived", &null_dgst_ctx, handshake_secret);
	/* [6]  */ tls13_hkdf_extract(conn->digest, handshake_secret, pre_master_secret, handshake_secret);
	/* [7]  */ tls13_derive_secret(handshake_secret, "c hs traffic", &conn->dgst_ctx, conn->client_handshake_traffic_secret);
	/* [8]  */ tls13_derive_secret(handshake_secret, "s hs traffic", &conn->dgst_ctx, conn->server_handshake_traffic_secret);

	/* [9]  */ tls13_derive_secret(handshake_secret, "derived", &null_dgst_ctx, conn->master_secret);
	/* [10] */ tls13_hkdf_extract(conn->digest, conn->master_secret, zeros, conn->master_secret);

	//[sender]_write_key = HKDF-Expand-Label(Secret, "key", "", key_length)
	//[sender]_write_iv  = HKDF-Expand-Label(Secret, "iv", "", iv_length)
	//[sender] in {server, client}
	tls13_hkdf_expand_label(conn->digest, conn->server_handshake_traffic_secret, "key", NULL, 0, 16, server_write_key);
	block_cipher_set_encrypt_key(&conn->server_write_key, conn->cipher, server_write_key);
	tls13_hkdf_expand_label(conn->digest, conn->server_handshake_traffic_secret, "iv", NULL, 0, 12, conn->server_write_iv);
	tls_seq_num_reset(conn->server_seq_num);

	format_bytes(stderr, 0, 0, "server_handshake_traffic_secret", conn->server_handshake_traffic_secret, 48);
	format_bytes(stderr, 0, 0, "client_handshake_traffic_secret", conn->client_handshake_traffic_secret, 48);

	if (!conn->early_data) {
		format_print(stderr, 0, 0, "update client_write_key, client_write_iv\n");

		tls13_hkdf_expand_label(conn->digest, conn->client_handshake_traffic_secret, "key", NULL, 0, 16, client_write_key);
		block_cipher_set_encrypt_key(&conn->client_write_key, conn->cipher, client_write_key);
		tls13_hkdf_expand_label(conn->digest, conn->client_handshake_traffic_secret, "iv", NULL, 0, 12, conn->client_write_iv);
		tls_seq_num_reset(conn->client_seq_num);
	}

	format_bytes(stderr, 0, 4, "server_write_key", server_write_key, 16);
	format_bytes(stderr, 0, 4, "server_write_iv", conn->server_write_iv, 12);

	format_bytes(stderr, 0, 4, "client_write_key", client_write_key, 16);
	format_bytes(stderr, 0, 4, "client_write_iv", conn->client_write_iv, 12);

	return 1;
}

int tls13_init(TLS_CONNECT *conn, TLS_CTX *ctx)
{
	size_t i;


	if (!ctx->supported_versions_cnt) {
		error_print();
		return -1;
	}

	if (!ctx->cipher_suites_cnt) {
		error_print();
		return -1;
	}


	memset(conn, 0, sizeof(*conn));

	conn->ctx = ctx;

	conn->is_client = ctx->is_client;

	conn->protocol = ctx->protocol;



	conn->new_session_ticket = ctx->new_session_ticket;


	/*
	extensions depends on key_exchange_modes


	switch (key_exchange_mode)
	case CERT_DHE:
		* supported_groups		ctx->supported_groups_cnt != 0
		* signature_algorithms		ctx->signature_algorithms_cnt != 0
		* key_share			generated in ClientHello, so always ok
		* [signature_algorithms_cert]
		* [certificate_authorities]

	case PSK_DHE:
		* supported_groups
		* psk_key_exchange_modes	ctx->psk_key_exchange_modes has psk_dhe_ke
		* pre_shared_key		call tls13_add_pre_shared_key, tls13_add_pre_shared_key_from_session_file after tls13_init
		* key_share
		* [early_data]
		* [signature_algorithms]
		* [signature_algorithms_cert]

	case PSK:
		* psk_key_exchange_modes	ctx->psk_key_exchange_modes has psk_ke
		* pre_shared_key
		* [early_data]
		* [supported_groups]
		* [signature_algorithms]
		* [signature_algorithms_cert]
	*/


	fprintf(stderr, "tls13_init\n");

	// key_exchange_modes
	conn->key_exchange_modes = ctx->psk_key_exchange_modes;
	if (ctx->supported_groups_cnt && ctx->signature_algorithms_cnt) {
		conn->key_exchange_modes = TLS_KE_CERT_DHE;
	}
	if (!ctx->supported_groups_cnt) {
		conn->key_exchange_modes &= ~(TLS_KE_CERT_DHE|TLS_KE_PSK_DHE);
	}
	if (!conn->key_exchange_modes) {
		error_print();
		return -1;
	}

	// TLS_KE_PSK_DHE|TLS_KE_PSK depends on pre_shared_key
	// but pre_shared_key is set by tls13_add_pre_shared_key, tls13_add_pre_shared_key_from_session_file
	// after tls13_init

	// key_share
	if (conn->key_exchange_modes & (TLS_KE_CERT_DHE|TLS_KE_PSK_DHE)) {
		conn->key_share = 1;
	}

	conn->signed_certificate_timestamp = ctx->signed_certificate_timestamp;

	// early_data
	conn->early_data = ctx->early_data;
	conn->max_early_data_size = ctx->max_early_data_size;

	return 1;
}



int tls13_send_client_hello(TLS_CONNECT *conn)
{
	int ret;

	if (!conn->recordlen) {
		const uint8_t *legacy_session_id = NULL;
		size_t legacy_session_id_len = 0;
		uint8_t exts[TLS_MAX_EXTENSIONS_SIZE];
		uint8_t *pexts = exts;
		size_t extslen = 0;

		tls_trace("send ClientHello\n");

		// record_version
		tls_record_set_protocol(conn->record, TLS_protocol_tls1);

		// client_random
		if (tls13_random_generate(conn->client_random) != 1) {
			error_print();
			return -1;
		}

		// legacy_session_id
		conn->session_id_len = 0;


		// exts in CH (RFC 8446 page 37), only oid_filter not in CH
		//  * supported_versions
		//  * signature_algorithms
		//  * signature_algorithms_cert
		//  * certificate_authorities
		//  * server_name
		//  * status_request
		//  * signed_certificate_timestamp
		//  * supported_groups
		//  * key_share
		//  * psk_key_exchange_modes
		//  * pre_shared_key
		//  * early_data (only in ClientHello1)
		//  * cookie (only in ClientHello2)
		//  * post_handshake_auth: client support post handshake auth
		//  * max_fragment_length
		//  * use_srtp
		//  * heartbeat
		//  * application_layer_protocol_negotiation
		//  * server_certificate_type: if client accept raw/x509
		//  * client_certificate_type: if client sned raw/x509
		//  * padding


		// supported_versions
		if (tls13_client_supported_versions_ext_to_bytes(conn->ctx->supported_versions,
			conn->ctx->supported_versions_cnt, &pexts, &extslen) != 1) {
			error_print();
			return -1;
		}

		// supported_groups
		if (conn->ctx->supported_groups_cnt) {
			if (tls_supported_groups_ext_to_bytes(conn->ctx->supported_groups,
				conn->ctx->supported_groups_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// signature_algorithms
		if (conn->ctx->signature_algorithms_cnt) {
			if (tls_signature_algorithms_ext_to_bytes(conn->ctx->signature_algorithms,
				conn->ctx->signature_algorithms_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// signature_algorithms_cert
		if (conn->signature_algorithms_cert) {
			if (tls13_signature_algorithms_cert_ext_to_bytes(conn->ctx->signature_algorithms,
				conn->ctx->signature_algorithms_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// certificate_authorities
		if (conn->certificate_authorities) {
			if (tls13_certificate_authorities_ext_to_bytes(
				conn->ctx->ca_names, conn->ctx->ca_names_len, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// key_share
		if (conn->key_share) {
			size_t i;

			// empty ClientHello.key_share is allowed
			for (i = 0; i < conn->ctx->key_exchanges_cnt && i < conn->ctx->supported_groups_cnt; i++) {
				int curve_oid = tls_named_curve_oid(conn->ctx->supported_groups[i]);
				if (x509_key_generate(&conn->key_exchanges[i],
					OID_ec_public_key, &curve_oid, sizeof(curve_oid)) != 1) {
					error_print();
					tls13_send_alert(conn, TLS_alert_internal_error);
					return -1;
				}
			}
			conn->key_exchanges_cnt = i;
			if (tls13_key_share_client_hello_ext_to_bytes(conn->key_exchanges,
				conn->key_exchanges_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// server_name
		if (conn->server_name) {
			if (tls_server_name_ext_to_bytes(
				conn->host_name, conn->host_name_len, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// psk_key_exchange_modes
		if (conn->key_exchange_modes & (TLS_KE_PSK_DHE|TLS_KE_PSK)) {
			if (tls13_psk_key_exchange_modes_ext_to_bytes(
				conn->key_exchange_modes, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// status_request (hint only)
		if (conn->status_request) {
			if (tls_client_status_request_ext_to_bytes(TLS_certificate_status_type_ocsp,
				conn->status_request_responder_id_list, conn->status_request_responder_id_list_len,
				conn->status_request_exts, conn->status_request_exts_len,
				&pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
			conn->status_request = 0; // to track CertificateRequest.status_request
		}

		// signed_certificate_timestamp (hint only)
		if (conn->signed_certificate_timestamp) {
			if (tls_ext_to_bytes(TLS_extension_signed_certificate_timestamp, NULL, 0,
				&pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
			conn->signed_certificate_timestamp = 0; // to track CertificateRequest.signed_certificate_timestamp
		}

		// early_data
		if (conn->early_data) {
			if (tls_ext_to_bytes(TLS_extension_early_data, NULL, 0,
				&pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// post_handshake_auth
		if (conn->post_handshake_auth) {
			if (tls_ext_to_bytes(TLS_extension_post_handshake_auth, NULL, 0,
				&pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// pre_shared_key (must be the last extension)
		if (conn->pre_shared_key) {
			uint8_t *ptruncated_exts = pexts;
			size_t truncated_extslen = extslen;
			uint8_t binders[256];
			uint8_t *pbinders = binders;
			size_t binderslen = 0;

			if (!conn->psk_identities_len
				|| !conn->psk_keys_len
				|| !conn->psk_cipher_suites_cnt ) {
				error_print();
				return -1;
			}

			// output pre_shared_key ext with empty binders
			if (tls13_psk_binders_generate_empty(
				conn->psk_cipher_suites, conn->psk_cipher_suites_cnt,
				binders, &binderslen) != 1) {
				error_print();
				return -1;
			}
			if (tls13_client_pre_shared_key_ext_to_bytes(
				conn->psk_identities, conn->psk_identities_len,
				binders, binderslen, &ptruncated_exts, &truncated_extslen) != 1) {
				error_print();
				return -1;
			}

			// truncate(ClientHello)
			if (tls_record_set_handshake_client_hello(conn->record, &conn->recordlen,
				TLS_protocol_tls12, conn->client_random,
				legacy_session_id, legacy_session_id_len,
				conn->ctx->cipher_suites, conn->ctx->cipher_suites_cnt,
				exts, truncated_extslen) != 1) {
				error_print();
				return -1;
			}
			//tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

			// generate binders and output final pre_shared_key ext
			if (tls13_psk_binders_generate(
				conn->psk_cipher_suites, conn->psk_cipher_suites_cnt,
				conn->psk_keys, conn->psk_keys_len,
				conn->record + 5, conn->recordlen - 5,
				binders, &binderslen) != 1) {
				error_print();
				return -1;
			}
			if (tls13_client_pre_shared_key_ext_to_bytes(
				conn->psk_identities, conn->psk_identities_len,
				binders, binderslen, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		if (tls_record_set_handshake_client_hello(conn->record, &conn->recordlen,
			TLS_protocol_tls12, conn->client_random,
			legacy_session_id, legacy_session_id_len,
			conn->ctx->cipher_suites, conn->ctx->cipher_suites_cnt,
			exts, extslen) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

		// early_data encryption keys depends on the full client_hello
		if (conn->early_data) {
			if (tls13_generate_early_data_keys(conn) != 1) {
				error_print();
				return -1;
			}
		}

		// backup client_hello
		memcpy(conn->plain_record, conn->record, conn->recordlen);
		conn->plain_recordlen = conn->recordlen;
	}

	if (conn->client_certificate_verify) {
		sm2_sign_update(&conn->sign_ctx, conn->record + 5, conn->recordlen - 5);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	tls_clean_record(conn);
	return 1;
}

/*
recv HelloRetryRequest:
	* set conn->protocol
	* set conn->cipher_suite, conn->cipher, conn->digest
	* set conn->key_exchange_group
	* set conn->dgst_ctx <= ClientHello, HelloRetryRequest, ClientHello2

recv ServerHello after HelloRetryRequest:
	* check ServerHello.protocol == conn->protocol
	* check ServerHello.cipher_suite == conn->cipher_suite
	* check ServerHello.key_share.group == conn->key_exchange_group
	* conn->dgst_ctx <= ServerHello

recv ServerHello without HelloRetryRequest:
	* set conn->protocol
	* set conn->cipher_suite, conn->cipher, conn->digest
	* set conn->key_exchange_group
	* set conn->dgst_ctx <= ClientHello
*/

int tls13_recv_hello_retry_request(TLS_CONNECT *conn)
{
	int ret;

	// handshake
	int handshake_type;
	const uint8_t *handshake_data;
	size_t handshake_datalen;

	// HelloRetryRequest
	int legacy_version;
	const uint8_t *random;
	const uint8_t *legacy_session_id_echo;
	size_t legacy_session_id_echo_len;
	int cipher_suite;
	int legacy_compress_meth;
	const uint8_t *exts;
	size_t extslen;

	// extensions
	const uint8_t *supported_versions = NULL;
	size_t supported_versions_len = 0;
	const uint8_t *key_share = NULL;
	size_t key_share_len = 0;
	const uint8_t *cookie = NULL;
	size_t cookie_len = 0;

	int selected_version;
	int key_exchange_group;

	tls_trace("recv HelloRetryRequest*\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (tls_record_protocol(conn->record) != TLS_protocol_tls12) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}

	// the record might be Alert?
	if ((ret = tls_record_get_handshake(conn->record,
		&handshake_type, &handshake_data, &handshake_datalen)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		return -1;
	}
	if (handshake_type != TLS_handshake_hello_retry_request) {
		tls_trace("    no HelloRetryRequest\n");
		return 0;
	}

	tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

	if ((ret = tls13_record_get_handshake_hello_retry_request(conn->record,
		&legacy_version, &random,
		&legacy_session_id_echo, &legacy_session_id_echo_len,
		&cipher_suite, &legacy_compress_meth, &exts, &extslen)) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	}
	conn->hello_retry_request = 1;


	// HelloRetryRequest disable early_data
	conn->early_data = 0;


	// legacy_version
	if (legacy_version != TLS_protocol_tls12) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}

	// random
	memcpy(conn->server_random, random, 32);

	// legacy_session_id_echo
	if (legacy_session_id_echo_len != conn->session_id_len
		|| memcmp(legacy_session_id_echo, conn->session_id, conn->session_id_len) != 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	// cipher_suite
	if (tls_type_is_in_list(cipher_suite, conn->ctx->cipher_suites, conn->ctx->cipher_suites_cnt) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}
	if (tls13_cipher_suite_get(cipher_suite, &conn->cipher, &conn->digest) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_internal_error);
		return -1;
	}
	conn->cipher_suite = cipher_suite;

	// legacy_compression_method
	if (legacy_compress_meth != 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	while (extslen) {
		int ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}

		// exts in HRR
		//  * supported_versions
		//  * key_share
		//  * cookie

		switch (ext_type) {
		case TLS_extension_supported_versions:
		case TLS_extension_key_share:
		case TLS_extension_cookie:
			if (!ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			break;
		}

		switch (ext_type) {
		case TLS_extension_supported_versions:
			if (supported_versions) {
				error_print();
				return -1;
			}
			supported_versions = ext_data;
			supported_versions_len = ext_datalen;
			break;

		case TLS_extension_key_share:
			if (!conn->key_share) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			if (key_share) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			key_share = ext_data;
			key_share_len = ext_datalen;
			break;

		case TLS_extension_cookie:
			if (cookie) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			cookie = ext_data;
			cookie_len = ext_datalen;
			conn->cookie = 1;
			break;

		default:
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	}

	// supported_versions
	if (!supported_versions) {
		error_print();
		tls13_send_alert(conn, TLS_alert_missing_extension);
		return -1;
	}
	if (tls13_server_supported_versions_from_bytes(&selected_version,
		supported_versions, supported_versions_len) != 1) {
		tls13_send_alert(conn, TLS_alert_decode_error);
		error_print();
		return -1;
	}
	if (tls_type_is_in_list(selected_version,
		conn->ctx->supported_versions, conn->ctx->supported_versions_cnt) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}
	if (selected_version != TLS_protocol_tls13) {
		error_print();
		tls13_send_alert(conn, TLS_alert_internal_error);
		return -1;
	}
	conn->protocol = selected_version;

	// key_share
	if (!key_share) {
		error_print();
		tls13_send_alert(conn, TLS_alert_missing_extension);
		return -1;
	}
	if (tls13_key_share_hello_retry_request_from_bytes(&key_exchange_group,
		key_share, key_share_len) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	}
	if (tls_type_is_in_list(key_exchange_group,
		conn->ctx->supported_groups, conn->ctx->supported_groups_cnt) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}
	// HelloRetryRequest must choose a group not in ClientHello.key_share
	while (conn->key_exchanges_cnt--) {
		if (key_exchange_group == tls_named_curve_from_oid(
			conn->key_exchanges[conn->key_exchanges_cnt].algor_param)) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
		}
	}
	conn->key_exchange_group = key_exchange_group;

	// cookie
	if (cookie) {
		const uint8_t *cookie_data;
		size_t cookie_datalen;

		if (tls13_cookie_from_bytes(&cookie_data, &cookie_datalen,
			cookie, cookie_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}
		memcpy(conn->cookie_buf, cookie_data, cookie_datalen);
		conn->cookie_len = cookie_datalen;
	}

	// ClientHello1
	uint8_t message_hash[4 + 32];
	size_t dgstlen;
	message_hash[0] = TLS_handshake_message_hash;
	message_hash[1] = 0;
	message_hash[2] = 0;
	message_hash[3] = 32;

	// 我猜如果用了HRR，那么客户端实际上并没有保存ClientHello的数据，而是用ClientHello的哈希值来计算后续的

	if (digest_init(&conn->dgst_ctx, conn->digest) != 1
		|| digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1
		|| digest_finish(&conn->dgst_ctx, message_hash + 4, &dgstlen) != 1) {
		error_print();
		return -1;
	}

	// ClientHello, HelloRetryRequest
	if (digest_init(&conn->dgst_ctx, conn->digest) != 1
		|| digest_update(&conn->dgst_ctx, message_hash, sizeof(message_hash)) != 1
		|| digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
		error_print();
		return -1;
	}

	if (conn->client_certs_len) {
		sm2_sign_update(&conn->sign_ctx, conn->record + 5, conn->recordlen - 5);
	}

	return 1;
}

int tls13_client_hello_again_psk_update(TLS_CONNECT *conn)
{
	const uint8_t *psk_identities;
	const uint8_t *psk_keys;
	uint8_t tmp_identities_buf[sizeof(conn->psk_identities)];
	uint8_t *tmp_identities = tmp_identities_buf;
	size_t tmp_identities_len = 0;
	uint8_t tmp_keys_buf[sizeof(conn->psk_keys)];
	uint8_t *tmp_keys = tmp_keys_buf;
	size_t tmp_keys_len = 0;
	size_t tmp_cipher_suites_cnt = 0;
	size_t i;

	if (!conn) {
		error_print();
		return -1;
	}
	psk_identities = conn->psk_identities;
	psk_keys = conn->psk_keys;

	for (i = 0; i < conn->psk_cipher_suites_cnt; i++) {
		const uint8_t *identity;
		size_t identity_len;
		uint32_t obfuscated_ticket_age;
		const uint8_t *key;
		size_t key_len;

		if (tls13_psk_identity_from_bytes(&identity, &identity_len, &obfuscated_ticket_age, &psk_identities, &conn->psk_identities_len) != 1
			|| tls_uint8array_from_bytes(&key, &key_len, &psk_keys, &conn->psk_keys_len) != 1) {
			gmssl_secure_clear(tmp_keys_buf, sizeof(tmp_keys_buf));
			error_print();
			return -1;
		}
		if (conn->psk_cipher_suites[i] == conn->cipher_suite) {
			tls13_psk_identity_to_bytes(identity, identity_len, obfuscated_ticket_age, &tmp_identities, &tmp_identities_len);
			tls_uint16array_to_bytes(key, key_len, &tmp_keys, &tmp_keys_len);
			tmp_cipher_suites_cnt++;
		}
	}
	if (conn->psk_identities_len || conn->psk_keys_len) {
		gmssl_secure_clear(tmp_keys_buf, sizeof(tmp_keys_buf));
		error_print();
		return -1;
	}

	memcpy(conn->psk_identities, tmp_identities_buf, tmp_identities_len);
	conn->psk_identities_len = tmp_identities_len;
	memcpy(conn->psk_keys, tmp_keys_buf, tmp_keys_len);
	conn->psk_keys_len = tmp_keys_len;
	for (i = 0; i < tmp_cipher_suites_cnt; i++) {
		conn->psk_cipher_suites[i] = conn->cipher_suite;
	}
	conn->psk_cipher_suites_cnt = tmp_cipher_suites_cnt;

	gmssl_secure_clear(tmp_keys_buf, sizeof(tmp_keys_buf));
	return 1;
}

int tls13_send_client_hello_again(TLS_CONNECT *conn)
{
	int ret;
	tls_trace("send ClientHello again\n");

	if (!conn->recordlen) {
		const uint8_t *legacy_session_id = NULL;
		size_t legacy_session_id_len = 0;
		uint8_t exts[TLS_MAX_EXTENSIONS_SIZE];
		uint8_t *pexts = exts;
		size_t extslen = 0;
		int supported_versions = TLS_protocol_tls13;
		int curve_oid;

		// record_version
		tls_record_set_protocol(conn->record, TLS_protocol_tls1);

		// client_random
		if (tls13_random_generate(conn->client_random) != 1) {
			error_print();
			return -1;
		}

		// Extensions

		// keep ClientHello extensions except
		//	* key_share - generate a new key_exchange based on conn->key_exchange_group
		//	* pre_shared_key - remove PSKs not compatible with conn->cipher_suite
		//	* early_data - disable early_data
		//	* cookie - echo cookie if exist

		// supported_versions
		if (tls13_client_supported_versions_ext_to_bytes(conn->ctx->supported_versions,
			conn->ctx->supported_versions_cnt, &pexts, &extslen) != 1) {
			error_print();
			return -1;
		}

		// supported_groups
		if (conn->ctx->supported_groups_cnt) {
			if (tls_supported_groups_ext_to_bytes(conn->ctx->supported_groups,
				conn->ctx->supported_groups_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// signature_algorithms
		if (conn->ctx->signature_algorithms_cnt) {
			if (tls_signature_algorithms_ext_to_bytes(conn->ctx->signature_algorithms,
				conn->ctx->signature_algorithms_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// signature_algorithms_cert
		if (conn->signature_algorithms_cert) {
			if (tls13_signature_algorithms_cert_ext_to_bytes(conn->ctx->signature_algorithms,
				conn->ctx->signature_algorithms_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// server_name
		if (conn->server_name) {
			if (tls_server_name_ext_to_bytes(conn->host_name, conn->host_name_len, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// key_share (re-generated)
		if ((curve_oid = tls_named_curve_oid(conn->key_exchange_group)) == OID_undef) {
			error_print();
			return -1;
		}
		if (x509_key_generate(&conn->key_exchanges[0],
			OID_ec_public_key, &curve_oid, sizeof(curve_oid)) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		conn->key_exchange_idx = 0;
		conn->key_exchanges_cnt = 1;
		if (tls13_key_share_client_hello_ext_to_bytes(conn->key_exchanges,
			conn->key_exchanges_cnt, &pexts, &extslen) != 1) {
			error_print();
			return -1;
		}

		// psk_key_exchange_modes
		if (conn->key_exchange_modes & (TLS_KE_PSK_DHE|TLS_KE_PSK)) {
			if (tls13_psk_key_exchange_modes_ext_to_bytes(conn->key_exchange_modes, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}
		// update key_exchange_modes (disable PSK-only)
		conn->key_exchange_modes &= ~TLS_KE_PSK;

		// status_request
		if (conn->status_request) {
			if (tls_client_status_request_ext_to_bytes(TLS_certificate_status_type_ocsp,
				conn->status_request_responder_id_list, conn->status_request_responder_id_list_len,
				conn->status_request_exts, conn->status_request_exts_len,
				&pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// signed_certificate_timestamp
		if (conn->ctx->signed_certificate_timestamp) {
			if (tls_ext_to_bytes(TLS_extension_signed_certificate_timestamp, NULL, 0, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// post_handshake_auth
		if (conn->post_handshake_auth) {
			if (tls_ext_to_bytes(TLS_extension_post_handshake_auth, NULL, 0,
				&pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// early_data must not in ClientHello2

		// cookie
		if (conn->cookie) {
			if (tls13_cookie_ext_to_bytes(conn->cookie_buf, conn->cookie_len, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// pre_shared_key
		if (conn->pre_shared_key) {
			if (!conn->psk_identities_len
				|| !conn->psk_keys_len
				|| !conn->psk_cipher_suites_cnt ) {
				error_print();
				return -1;
			}
			if (tls13_client_hello_again_psk_update(conn) != 1) {
				error_print();
				return -1;
			}
			if (!conn->psk_cipher_suites_cnt) {
				conn->pre_shared_key = 0;
			}
		}
		if (conn->pre_shared_key) {
			uint8_t *ptruncated_exts = pexts;
			size_t truncated_extslen = extslen;
			uint8_t binders[256];
			uint8_t *pbinders = binders;
			size_t binderslen = 0;

			// output pre_shared_key ext with empty binders
			if (tls13_psk_binders_generate_empty(
				conn->psk_cipher_suites, conn->psk_cipher_suites_cnt,
				binders, &binderslen) != 1) {
				error_print();
				return -1;
			}
			if (tls13_client_pre_shared_key_ext_to_bytes(
				conn->psk_identities, conn->psk_identities_len,
				binders, binderslen, &ptruncated_exts, &truncated_extslen) != 1) {
				error_print();
				return -1;
			}

			// truncate(ClientHello)
			if (tls_record_set_handshake_client_hello(conn->record, &conn->recordlen,
				TLS_protocol_tls12, conn->client_random,
				legacy_session_id, legacy_session_id_len,
				conn->ctx->cipher_suites, conn->ctx->cipher_suites_cnt,
				exts, truncated_extslen) != 1) {
				error_print();
				return -1;
			}
			//tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

			// generate binders and output final pre_shared_key ext
			if (tls13_psk_binders_generate(
				conn->psk_cipher_suites, conn->psk_cipher_suites_cnt,
				conn->psk_keys, conn->psk_keys_len,
				conn->record + 5, conn->recordlen - 5,
				binders, &binderslen) != 1) {
				error_print();
				return -1;
			}
			if (tls13_client_pre_shared_key_ext_to_bytes(
				conn->psk_identities, conn->psk_identities_len,
				binders, binderslen, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		if (tls_record_set_handshake_client_hello(conn->record, &conn->recordlen,
			TLS_protocol_tls12, conn->client_random,
			legacy_session_id, legacy_session_id_len,
			conn->ctx->cipher_suites, conn->ctx->cipher_suites_cnt,
			exts, extslen) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

		// ClientHello2
		if (digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
			error_print();
			return -1;
		}
	}

	if (conn->client_certificate_verify) {
		sm2_sign_update(&conn->sign_ctx, conn->record + 5, conn->recordlen - 5);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	tls_clean_record(conn);
	return 1;
}


/*
recv HelloRetryRequest:
	* set conn->protocol
	* set conn->cipher_suite, conn->cipher, conn->digest
	* set conn->key_exchange_group
	* set conn->dgst_ctx <= ClientHello, HelloRetryRequest, ClientHello2

recv ServerHello after HelloRetryRequest:
	* check ServerHello.protocol == conn->protocol
	* check ServerHello.cipher_suite == conn->cipher_suite
	* check ServerHello.key_share.group == conn->key_exchange_group
	* conn->dgst_ctx <= ServerHello

recv ServerHello without HelloRetryRequest:
	* set conn->protocol
	* set conn->cipher_suite, conn->cipher, conn->digest
	* set conn->key_exchange_group
	* set conn->dgst_ctx <= ClientHello
*/
int tls13_recv_server_hello(TLS_CONNECT *conn)
{
	int ret;

	// server_hello
	int legacy_version;
	const uint8_t *random;
	const uint8_t *legacy_session_id_echo;
	size_t legacy_session_id_echo_len;
	int cipher_suite;
	const uint8_t *exts;
	size_t extslen;

	const uint8_t *supported_versions = NULL;
	size_t supported_versions_len;
	const uint8_t *key_share = NULL;
	size_t key_share_len;
	const uint8_t *pre_shared_key = NULL;
	size_t pre_shared_key_len;

	int selected_version;
	int server_key_exchange_mode = 0;

	tls_trace("recv ServerHello\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}
	tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

	if (tls_record_protocol(conn->record) != TLS_protocol_tls12) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}
	if ((ret = tls_record_get_handshake_server_hello(conn->record,
		&legacy_version, &random,
		&legacy_session_id_echo, &legacy_session_id_echo_len,
		&cipher_suite, &exts, &extslen)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}

	// legacy_version
	if (legacy_version != TLS_protocol_tls12) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}

	// random
	if (conn->hello_retry_request) {
		if (memcmp(random, conn->server_random, 32) == 0) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	}
	memcpy(conn->server_random, random, 32);

	// legacy_session_id_echo
	if (legacy_session_id_echo_len != conn->session_id_len
		|| memcmp(legacy_session_id_echo, conn->session_id, conn->session_id_len) != 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	// cipher_suite
	if (conn->hello_retry_request) {
		if (cipher_suite != conn->cipher_suite) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	} else {
		if (tls_type_is_in_list(cipher_suite,
			conn->ctx->cipher_suites, conn->ctx->cipher_suites_cnt) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
		conn->cipher_suite = cipher_suite;
		if (tls13_cipher_suite_get(cipher_suite, &conn->cipher, &conn->digest) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
	}

	while (extslen) {
		int ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}

		// exts in SH
		//  * supported_versions
		//  * key_share
		//  * pre_shared_key (not in HRR)
		//
		//
		//	ServerHello.key_share if only ClientHello.key_share
		//	ServerHello.pre_shared_key if only ClientHello.pre_shared_key
		//	if HelloRetryRequest, key_share must exist

		switch (ext_type) {
		case TLS_extension_supported_versions:
		case TLS_extension_key_share:
		case TLS_extension_pre_shared_key:
			if (!ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			break;
		}

		switch (ext_type) {
		case TLS_extension_supported_versions:
			if (supported_versions) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			supported_versions = ext_data;
			supported_versions_len = ext_datalen;
			break;

		case TLS_extension_key_share:
			// ServerHello.key_share if only ClientHello.key_share
			if (!conn->key_share) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			if (key_share) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			key_share = ext_data;
			key_share_len = ext_datalen;
			break;

		case TLS_extension_pre_shared_key:
			// ServerHello.pre_shared_key if only ClientHello.pre_shared_key
			if (!conn->pre_shared_key) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			if (pre_shared_key) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			pre_shared_key = ext_data;
			pre_shared_key_len = ext_datalen;
			break;

		default:
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	}

	if (!supported_versions) {
		error_print();
		tls13_send_alert(conn, TLS_alert_missing_extension);
		return -1;
	}

	// if HelloRetryRequest, key_share must exist
	if (conn->hello_retry_request) {
		if (!key_share) {
			error_print();
			tls13_send_alert(conn, TLS_alert_missing_extension);
			return -1;
		}
	}

	// key_exchange_mode
	//  implicitly sent through ServerHello exts
	//
	//  * key_share + pre_shared_key	PSK_DHE
	//  * key_share				CERT_DHE
	//  * pre_shared_key			PSK
	//  * (none)				error
	//
	if (pre_shared_key) {
		if (key_share)
			server_key_exchange_mode = TLS_KE_PSK_DHE;
		else	server_key_exchange_mode = TLS_KE_PSK;
	} else {
		if (key_share) {
			server_key_exchange_mode = TLS_KE_CERT_DHE;
		} else {
			error_print();
			tls13_send_alert(conn, TLS_alert_missing_extension);
			return -1;
		}
	}


	// set key_exchange_mode
	conn->key_exchange_modes &= server_key_exchange_mode;

	if (!conn->key_exchange_modes) {
		error_print();
		tls13_send_alert(conn, TLS_alert_handshake_failure);
		return -1;
	}


	// supported_versions
	if (tls13_server_supported_versions_from_bytes(
		&selected_version, supported_versions, supported_versions_len) != 1) {
		tls13_send_alert(conn, TLS_alert_decode_error);
		error_print();
		return -1;
	}
	if (conn->hello_retry_request) {
		if (selected_version != conn->protocol) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	} else {
		if (tls_type_is_in_list(selected_version,
			conn->ctx->supported_versions, conn->ctx->supported_versions_cnt) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
		if (selected_version != TLS_protocol_tls13) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		conn->protocol = selected_version;
	}


	// key_share
	if (key_share) {
		int key_exchange_group;
		const uint8_t *key_exchange;
		size_t key_exchange_len;

		if (!conn->key_exchanges_cnt) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
		if (tls13_key_share_server_hello_from_bytes(&key_exchange_group,
			&key_exchange, &key_exchange_len, key_share, key_share_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}
		// compatible with/without HRR
		while (conn->key_exchange_idx < conn->key_exchanges_cnt) {
			if (conn->key_exchanges[conn->key_exchange_idx].algor_param ==
				tls_named_curve_oid(key_exchange_group)) {
				break;
			}
			conn->key_exchange_idx++;
		}
		if (conn->key_exchange_idx >= conn->key_exchanges_cnt) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
		if (key_exchange_len != 65) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
		conn->key_exchange_group = key_exchange_group;
		memcpy(conn->peer_key_exchange, key_exchange, key_exchange_len);
		conn->peer_key_exchange_len = 65;
	}

	// pre_shared_key
	if (pre_shared_key) {
		const uint8_t *psk_keys = conn->psk_keys;
		size_t psk_keys_len = conn->psk_keys_len;
		int selected_identity;
		const uint8_t *key = NULL;
		size_t keylen = 0;
		size_t i;

		if (tls13_server_pre_shared_key_from_bytes(&selected_identity,
			pre_shared_key, pre_shared_key_len) != 1) {
			error_print();
			return -1;
		}
		for (i = 0; i <= selected_identity; i++) {
			if (tls_uint8array_from_bytes(&key, &keylen, &psk_keys, &psk_keys_len) != 1) {
				error_print();
				return -1;
			}
		}
		if (!key) {
			error_print();
			return -1;
		}

		// TODO: change psk from buf to reference
		memcpy(conn->psk, key, keylen);
		conn->psk_len = keylen;
	}


	if (conn->hello_retry_request) {
		// dgst_ctx <= ServerHello
		if (digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		tls_handshake_digest_print(stderr, 0, 0, "ServerHello", &conn->dgst_ctx);
	} else {
		if (digest_init(&conn->dgst_ctx, conn->digest) != 1
			// dgst_ctx <= ClientHello
			|| digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1
			// dgst_ctx <= ServerHello
			|| digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
			error_print();
			return -1;
		}
		tls_handshake_digest_print(stderr, 0, 0, "ServerHello", &conn->dgst_ctx);
	}

	if (conn->client_certs_len) {
		sm2_sign_update(&conn->sign_ctx, conn->record + 5, conn->recordlen - 5);
	}

	if (tls13_generate_handshake_keys(conn) != 1) {
		error_print();
		return -1;
	}

	return 1;
}

int tls13_recv_encrypted_extensions(TLS_CONNECT *conn)
{
	int ret;
	const uint8_t *exts;
	size_t extslen;

	const uint8_t *supported_groups = NULL;
	size_t supported_groups_len;

	int server_name = 0;
	int early_data = 0;

	printf("recv {EncryptedExtensions}\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (tls13_record_decrypt(&conn->server_write_key, conn->server_write_iv,
		conn->server_seq_num, conn->record, conn->recordlen,
		conn->plain_record, &conn->plain_recordlen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_record_mac);
		return -1;
	}
	tls_seq_num_incr(conn->server_seq_num);


	if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
		error_print();
		return -1;
	}
	tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

	tls_handshake_digest_print(stderr, 0, 0, "EncryptedExtension", &conn->dgst_ctx);


	if ((ret = tls13_record_get_handshake_encrypted_extensions(conn->plain_record,
		&exts, &extslen)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}

	while (extslen) {
		int ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}

		// Exts in EE (see RFC 8446 page 37)
		//  * supported_groups
		//  * server_name
		//  * early_data
		//  * application_layer_protocol_negotiation
		//  * use_srtp
		//  * client_certificate_type
		//  * server_certificate_type
		//  * max_fragment_length
		//  * heartbeat
		//  * record_size_limit (RFC 8449)


		switch (ext_type) {
		case TLS_extension_supported_groups:
			if (!ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			break;
		case TLS_extension_server_name:
		case TLS_extension_early_data:
			if (ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			break;
		}

		switch (ext_type) {
		case TLS_extension_supported_groups:
			if (!conn->ctx->supported_groups_cnt) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			if (supported_groups) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			break;

		case TLS_extension_server_name:
			if (!conn->server_name) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			if (server_name) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			server_name = 1;
			break;

		case TLS_extension_early_data:
			if (!conn->early_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			if (early_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			early_data = 1;
			break;

		case TLS_extension_application_layer_protocol_negotiation:
		case TLS_extension_use_srtp:
		case TLS_extension_client_certificate_type:
		case TLS_extension_server_certificate_type:
		case TLS_extension_max_fragment_length:
		case TLS_extension_heartbeat:
		case TLS_extension_record_size_limit:
			break;

		default:
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	}

	// server_name
	// if or not server support SNI, do nothing

	// early_data
	conn->early_data = early_data; // server allow EarlyData messages


	return 1;
}

int tls_cert_match_signature_algorithms(const uint8_t *cert, size_t certlen,
	const int *signature_algorithms, size_t signature_algorithms_cnt,
	int *first_matched_sig_alg)
{
	X509_KEY subject_public_key;
	int group_oid;
	size_t i;

	if (!cert || !certlen || !signature_algorithms || !signature_algorithms_cnt) {
		error_print();
		return -1;
	}

	if (x509_cert_get_subject_public_key(cert, certlen, &subject_public_key) != 1) {
		error_print();
		return -1;
	}
	if (subject_public_key.algor != OID_ec_public_key) {
		error_print();
		return -1;
	}
	group_oid = subject_public_key.algor_param;

	for (i = 0; i < signature_algorithms_cnt; i++) {
		if (group_oid == tls_signature_scheme_group_oid(signature_algorithms[i])) {
			*first_matched_sig_alg = signature_algorithms[i];
			return 1;
		}
	}

	*first_matched_sig_alg = 0;
	return 0;
}

int tls_cert_chain_match_signature_algorithms_cert(
	const uint8_t *cert_chain, size_t cert_chain_len,
	const int *signature_algorithms_cert, size_t signature_algorithms_cert_cnt)
{
	const uint8_t *cert;
	size_t certlen;
	const uint8_t *next_cert;
	size_t next_certlen;
	X509_KEY subject_public_key;
	int alg_oid;
	int group_oid;
	int sig_alg;

	if (!cert_chain || !cert_chain_len
		|| !signature_algorithms_cert && signature_algorithms_cert_cnt) {
		error_print();
		return -1;
	}

	if (x509_cert_from_der(&cert, &certlen, &cert_chain, &cert_chain_len) != 1) {
		error_print();
		return -1;
	}

	while (cert_chain_len) {
		if (x509_cert_get_signature_algor(cert, certlen, &alg_oid) != 1) {
			error_print();
			return -1;
		}
		if (x509_cert_from_der(&next_cert, &next_certlen, &cert_chain, &cert_chain_len) != 1
			|| x509_cert_get_subject_public_key(next_cert, next_certlen, &subject_public_key) != 1) {
			error_print();
			return -1;
		}
		if (subject_public_key.algor != OID_ec_public_key) {
			error_print();
			return -1;
		}
		group_oid = subject_public_key.algor_param;
		if (!(sig_alg = tls_signature_scheme_from_algorithm_and_group_oid(alg_oid, group_oid))) {
			error_print();
			return -1;
		}
		if (!tls_type_is_in_list(sig_alg, signature_algorithms_cert, signature_algorithms_cert_cnt)) {
			return 0;
		}

		cert = next_cert;
		certlen = next_certlen;
	}

	// can not do full check on the last cert, the public key is in root CA cert
	if (x509_cert_get_signature_algor(cert, certlen, &alg_oid) != 1) {
		error_print();
		return -1;
	}
	// 这里需要CA证书才能验证最后一个证书的签名算法是否满足要求

	return 1;
}

int tls_cert_match_server_name(const uint8_t *cert, size_t certlen, const uint8_t *host_name, size_t host_name_len)
{
	int ret;
	const uint8_t *subject_dns_name;
	size_t subject_dns_name_len;

	if (!cert || !certlen || !host_name || !host_name_len) {
		error_print();
		return -1;
	}
	if ((ret = x509_cert_get_subject_alt_name_dns_name(cert, certlen,
		&subject_dns_name, &subject_dns_name_len)) < 0) {
		error_print();
		return -1;
	} else if (ret == 0) {
		return TLS_CERT_VERIFY_NO_SUBJECT_ALT_NAME;
	}
	if (subject_dns_name_len != host_name_len
		|| memcmp(subject_dns_name, host_name, host_name_len) != 0) {
		return 0;
	}
	return 1;
}

int tls_cert_chain_match_extensions(
	const uint8_t *cert_chain, size_t cert_chain_len,
	const int *signature_algorithms, size_t signature_algorithms_cnt,
	const int *signature_algorithms_cert, size_t signature_algorithms_cert_cnt, // optional
	const uint8_t *ca_names, size_t ca_names_len, // optional
	const uint8_t *oid_filters, size_t oid_filters_len, // optional
	const uint8_t *host_name, size_t host_name_len, // optional
	int *prefered_sig_alg)
{
	int ret;
	const uint8_t *cert;
	size_t certlen;
	int sig_alg;

	if (!cert_chain || !cert_chain_len
		|| !signature_algorithms || !signature_algorithms_cnt) {
		error_print();
		return -1;
	}

	if (prefered_sig_alg) {
		*prefered_sig_alg = 0;
	}

	if (x509_certs_get_cert_by_index(cert_chain, cert_chain_len, 0,
		&cert, &certlen) != 1) {
		error_print();
		return -1;
	}

	// signature_algorithms
	if ((ret = tls_cert_match_signature_algorithms(cert, certlen,
		signature_algorithms, signature_algorithms_cnt, &sig_alg)) < 0) {
		error_print();
		return -1;
	} else if (ret == 0) {
		return 0;
	}

	// server_name
	if (host_name && host_name_len) {
		if ((ret = tls_cert_match_server_name(cert, certlen,
			host_name, host_name_len)) < 0) {
			error_print();
			return -1;
		} else if (ret == 0) {
			return 0;
		}
	}

	// signature_algorithms_cert
	if (signature_algorithms_cert && signature_algorithms_cert_cnt) {
		if ((ret = tls_cert_chain_match_signature_algorithms_cert(cert_chain, cert_chain_len,
			signature_algorithms_cert, signature_algorithms_cert_cnt)) < 0) {
			error_print();
			return -1;
		} else if (ret == 0) {
			return 0;
		}
	}

	// certificate_authorities
	if (ca_names && ca_names_len) {
		if ((ret = tls_authorities_issued_certificate(
			ca_names, ca_names_len, cert, certlen)) < 0) {
			error_print();
			return -1;
		} else if (ret == 0) {
			return 0;
		}
	}

	// oid_filters
	if (oid_filters && oid_filters_len) {
	}

	if (prefered_sig_alg) {
		*prefered_sig_alg = sig_alg;
	}
	return 1;
}

int tls13_cert_chains_select(const uint8_t *cert_chains, size_t cert_chains_len,
	const int *signature_algorithms, size_t signature_algorithms_cnt,
	const int *signature_algorithms_cert, size_t signature_algorithms_cert_cnt, // optional
	const uint8_t *ca_names, size_t ca_names_len, // certificate_authorities optional
	const uint8_t *oid_filters, size_t oid_filters_len, // optional, only in CertificateRequest
	const uint8_t *host_name, size_t host_name_len, // optional, only in ClientHello
	const uint8_t **certs, size_t *certs_len, size_t *certs_idx, int *prefered_sig_alg) // optional
{
	size_t i;

	if (!cert_chains || !cert_chains_len
		|| !signature_algorithms || !signature_algorithms_cnt) {
		error_print();
		return -1;
	}

	for (i = 1; cert_chains_len; i++) {
		const uint8_t *cert_chain;
		size_t cert_chain_len;
		int sig_alg;
		int ret;

		if (tls_uint24array_from_bytes(&cert_chain, &cert_chain_len,
			&cert_chains, &cert_chains_len) != 1) {
			error_print();
			return -1;
		}

		if ((ret = tls_cert_chain_match_extensions(cert_chain, cert_chain_len,
			signature_algorithms, signature_algorithms_cnt,
			signature_algorithms_cert, signature_algorithms_cert_cnt,
			ca_names, ca_names_len,
			oid_filters, oid_filters_len,
			host_name, host_name_len,
			&sig_alg)) < 0) {
			error_print();
			return -1;
		} else if (ret == 0) {
			continue;
		}

		if (certs) *certs = cert_chain;
		if (certs_len) *certs_len = cert_chain_len;
		if (certs_idx) *certs_idx = i;
		if (prefered_sig_alg) *prefered_sig_alg = sig_alg;
		return 1;
	}

	if (certs) *certs = NULL;
	if (certs_len) *certs_len = 0;
	if (certs_idx) *certs_idx = 0;
	if (prefered_sig_alg) *prefered_sig_alg = 0;
	warning_print();
	return 0;
}


int tls13_recv_certificate_request(TLS_CONNECT *conn)
{
	int ret;
	int handshake_type;
	const uint8_t *handshake_data;
	size_t handshake_datalen;
	int client_cert;

	// certificate_request
	const uint8_t *request_context;
	size_t request_context_len;
	const uint8_t *exts;
	size_t extslen;

	// extensions
	const uint8_t *signature_algorithms = NULL;
	size_t signature_algorithms_len;
	const uint8_t *signature_algorithms_cert = NULL;
	size_t signature_algorithms_cert_len;
	const uint8_t *certificate_authorities = NULL;
	size_t certificate_authorities_len;
	const uint8_t *oid_filters = NULL;
	size_t oid_filters_len;
	int status_request = 0;
	int signed_certificate_timestamp = 0;

	int common_sig_algs[4];
	size_t common_sig_algs_cnt;
	int common_sig_algs_cert[4];
	size_t common_sig_algs_cert_cnt;
	const uint8_t *ca_names = NULL;
	size_t ca_names_len = 0;
	const uint8_t *filters = NULL;
	size_t filters_len = 0;

	tls_trace("recv {CertificateRequest*}\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (tls13_record_decrypt(&conn->server_write_key, conn->server_write_iv,
		conn->server_seq_num, conn->record, conn->recordlen,
		conn->plain_record, &conn->plain_recordlen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_record_mac);
		return -1;
	}
	tls_seq_num_incr(conn->server_seq_num);

	if (tls_record_get_handshake(conn->plain_record,
		&handshake_type, &handshake_data, &handshake_datalen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	}
	if (handshake_type != TLS_handshake_certificate_request) {
		tls_trace("    no {CertificateRequest}\n");
		return 0;
	}

	if ((ret = tls13_record_get_handshake_certificate_request(conn->plain_record,
		&request_context, &request_context_len, &exts, &extslen)) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	}

	if (request_context) {
		// request_context must be null in full/initial handshake
		// and must not be null in post authentication handshakes
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	while (extslen) {
		int ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}

		// exts in CR (from RFC 8446 page 37)
		//  * signature_algorithms - the only ext must exist
		//  * signature_algorithms_cert
		//  * certificate_authorities
		//  * oid_filters (only in CR)
		//  * status_request
		//  * signed_certificate_timestamp

		switch (ext_type) {
		case TLS_extension_signature_algorithms:
		case TLS_extension_signature_algorithms_cert:
		case TLS_extension_certificate_authorities:
		case TLS_extension_oid_filters:
			if (!ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			break;
		case TLS_extension_status_request:
		case TLS_extension_signed_certificate_timestamp:
			if (ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			break;
		}

		switch (ext_type) {
		case TLS_extension_signature_algorithms:
			if (signature_algorithms) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			signature_algorithms = ext_data;
			signature_algorithms_len = ext_datalen;
			break;

		case TLS_extension_signature_algorithms_cert:
			if (signature_algorithms_cert) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			signature_algorithms_cert = ext_data;
			signature_algorithms_cert_len = ext_datalen;
			break;

		case TLS_extension_certificate_authorities:
			if (certificate_authorities) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			certificate_authorities = ext_data;
			certificate_authorities_len = ext_datalen;
			break;

		case TLS_extension_oid_filters:
			if (oid_filters) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			oid_filters = ext_data;
			oid_filters_len = ext_datalen;
			break;

		case TLS_extension_status_request:
			if (status_request) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			status_request = 1;
			break;

		case TLS_extension_signed_certificate_timestamp:
			if (signed_certificate_timestamp) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			signed_certificate_timestamp = 1;
			break;

		default:
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	}

	if (!signature_algorithms) {
		error_print();
		tls13_send_alert(conn, TLS_alert_missing_extension);
		return -1;
	}

	// even if no client cert, check extensions
	if (conn->ctx->cert_chains_len) {
		client_cert = 1;
	}

	// signature_algorithms
	if ((ret = tls_process_signature_algorithms(
		signature_algorithms, signature_algorithms_len,
		conn->ctx->signature_algorithms, conn->ctx->signature_algorithms_cnt,
		common_sig_algs, &common_sig_algs_cnt,
		sizeof(common_sig_algs)/sizeof(common_sig_algs[0]))) < 0) {
		error_print();
		return -1;
	} else if (ret == 0) {
		client_cert = 0;
	}

	// signature_algorithms_cert
	if (signature_algorithms_cert) {
		if ((ret = tls_process_signature_algorithms(
			signature_algorithms_cert, signature_algorithms_cert_len,
			conn->ctx->signature_algorithms, conn->ctx->signature_algorithms_cnt,
			common_sig_algs_cert, &common_sig_algs_cert_cnt,
			sizeof(common_sig_algs_cert)/sizeof(common_sig_algs_cert[0]))) < 0) {
			error_print();
			return -1;
		} else if (ret == 0) {
			client_cert = 0;
		}
	}

	// certificate_authorities
	if (certificate_authorities) {
		if (tls13_certificate_authorities_from_bytes(
			&ca_names, &ca_names_len,
			certificate_authorities, certificate_authorities_len) != 1) {
			error_print();
			return -1;
		}
	}

	// oid_filters
	if (oid_filters) {
		if (tls13_oid_filters_from_bytes(
			&filters, &filters_len, oid_filters, oid_filters_len) != 1) {
			error_print();
			return -1;
		}
	}

	// status_request
	if (status_request) {
		conn->status_request = 1;
	}

	// signed_certificate_timestamp
	if (signed_certificate_timestamp) {
		conn->signed_certificate_timestamp = 1;
	}

	// select cert_chain
	//	* signature_algorithms
	//	* [signature_algorithms_cert]
	//	* [certificate_authorities]
	//	* [oid_filter]
	//
	if (client_cert) {
		if ((ret = tls13_cert_chains_select(conn->ctx->cert_chains, conn->ctx->cert_chains_len,
			common_sig_algs, common_sig_algs_cnt,
			common_sig_algs_cert, common_sig_algs_cert_cnt,
			ca_names, ca_names_len,
			filters, filters_len,
			NULL, 0,
			&conn->cert_chain, &conn->cert_chain_len, &conn->cert_chain_idx, &conn->sig_alg)) < 0) {
			error_print();
			return -1;
		}
		// when ret == 0, conn->cert_chain == NULL
	}

	if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
		error_print();
		return -1;
	}

	conn->certificate_request = 1;

	return ret;
}

int tls13_recv_server_certificate(TLS_CONNECT *conn)
{
	int ret;
	const uint8_t *request_context;
	size_t request_context_len;
	const uint8_t *leaf_status_request_ocsp_response;
	size_t leaf_status_request_ocsp_response_len;
	const uint8_t *leaf_signed_certificate_timestamp;
	size_t leaf_signed_certificate_timestamp_len;

	const int *signature_algorithms_cert = NULL;
	size_t signature_algorithms_cert_cnt = 0;
	const uint8_t *ca_names = NULL;
	size_t ca_names_len = 0;
	const uint8_t *host_name = NULL;
	size_t host_name_len = 0;

	int verify_result;

	tls_trace("recv server {Certificate}\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}

	// decrypt unless previous handshake is CertificateRequest
	if (!conn->plain_recordlen) {
		if (tls13_record_decrypt(&conn->server_write_key, conn->server_write_iv,
			conn->server_seq_num, conn->record, conn->recordlen,
			conn->plain_record, &conn->plain_recordlen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_bad_record_mac);
			return -1;
		}
		tls_seq_num_incr(conn->server_seq_num);

	}

	if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
		error_print();
		return -1;
	}
	tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);
	tls_handshake_digest_print(stderr, 0, 0, "ServerCertificate", &conn->dgst_ctx);

	if ((ret = tls13_record_get_handshake_certificate(conn->plain_record,
		&request_context, &request_context_len,
		conn->peer_cert_chain, &conn->peer_cert_chain_len, sizeof(conn->peer_cert_chain),
		&leaf_status_request_ocsp_response, &leaf_status_request_ocsp_response_len,
		&leaf_signed_certificate_timestamp, &leaf_signed_certificate_timestamp_len)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return 0;
	}

	if (request_context) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}
	if (!conn->peer_cert_chain_len) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	// check server cert_chain match ClientHello.extensions
	if (conn->signature_algorithms_cert) {
		signature_algorithms_cert = conn->ctx->signature_algorithms;
		signature_algorithms_cert_cnt = conn->ctx->signature_algorithms_cnt;
	}
	if (conn->certificate_authorities) {
		ca_names = conn->ctx->ca_names;
		ca_names_len = conn->ctx->ca_names_len;
	}
	if (conn->server_name) {
		host_name = conn->host_name;
		host_name_len = conn->host_name_len;
	}
	if (tls_cert_chain_match_extensions(conn->peer_cert_chain, conn->peer_cert_chain_len,
		conn->ctx->signature_algorithms, conn->ctx->signature_algorithms_cnt,
		signature_algorithms_cert, signature_algorithms_cert_cnt,
		ca_names, ca_names_len, // certificate_authorities
		NULL, 0, // oid_filters
		host_name, host_name_len,
		NULL) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_certificate);
		return -1;
	}

	// verify server cert_chain
	if (x509_certs_verify(
		conn->peer_cert_chain, conn->peer_cert_chain_len, X509_cert_chain_server,
		conn->ctx->cacerts, conn->ctx->cacertslen,
		conn->ctx->verify_depth, &verify_result) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_certificate);
		return -1;
	}
	// status_request
	if (leaf_status_request_ocsp_response) {
		if (ocsp_response_verify(
			leaf_status_request_ocsp_response,
			leaf_status_request_ocsp_response_len,
			conn->ctx->cacerts, conn->ctx->cacertslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_certificate_revoked);
			return -1;
		}
	}
	// signed_certificate_timestamp
	if (leaf_signed_certificate_timestamp) {
		if (tls13_signed_certificate_timestamp_verify(
			leaf_signed_certificate_timestamp,
			leaf_signed_certificate_timestamp_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_bad_certificate);
			return -1;
		}
	}

	return 1;
}

int tls13_recv_server_certificate_verify(TLS_CONNECT *conn)
{
	int ret;
	int sig_alg;
	const uint8_t *sig;
	size_t siglen;
	const uint8_t *cert;
	size_t certlen;
	X509_KEY public_key;

	tls_trace("recv server {CertificateVerify}\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (tls13_record_decrypt(&conn->server_write_key, conn->server_write_iv,
		conn->server_seq_num, conn->record, conn->recordlen,
		conn->plain_record, &conn->plain_recordlen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_record_mac);
		return -1;
	}
	tls_seq_num_incr(conn->server_seq_num);
	tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

	if ((ret = tls13_record_get_handshake_certificate_verify(conn->plain_record,
		&sig_alg, &sig, &siglen)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}
	if (tls_type_is_in_list(sig_alg, conn->ctx->signature_algorithms,
		conn->ctx->signature_algorithms_cnt) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}
	if (!sig) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	if (x509_certs_get_cert_by_index(conn->peer_cert_chain, conn->peer_cert_chain_len, 0, &cert, &certlen) != 1
		|| x509_cert_get_subject_public_key(cert, certlen, &public_key) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}

	// verify signature
	if (tls13_verify_certificate_verify(TLS_server_mode, sig_alg, &public_key,
		&conn->dgst_ctx, sig, siglen) != 1) {
		error_print();
		return -1;
	}

	if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
		error_print();
		return -1;
	}

	return 1;
}

int tls13_recv_client_certificate_verify(TLS_CONNECT *conn)
{
	int ret;
	int sig_alg;
	const uint8_t *sig;
	size_t siglen;
	const uint8_t *cert;
	size_t certlen;
	X509_KEY public_key;

	tls_trace("recv client {CertificateVerify}\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (tls13_record_decrypt(&conn->client_write_key, conn->client_write_iv,
		conn->client_seq_num, conn->record, conn->recordlen,
		conn->plain_record, &conn->plain_recordlen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_record_mac);
		return -1;
	}
	tls_seq_num_incr(conn->client_seq_num);
	tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

	if ((ret = tls13_record_get_handshake_certificate_verify(conn->plain_record,
		&sig_alg, &sig, &siglen)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}
	if (tls_type_is_in_list(sig_alg, conn->ctx->signature_algorithms,
		conn->ctx->signature_algorithms_cnt) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}
	if (!sig) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	if (x509_certs_get_cert_by_index(conn->peer_cert_chain, conn->peer_cert_chain_len, 0, &cert, &certlen) != 1
		|| x509_cert_get_subject_public_key(cert, certlen, &public_key) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}

	// verify signature
	if (tls13_verify_certificate_verify(TLS_server_mode, sig_alg, &public_key,
		&conn->dgst_ctx, sig, siglen) != 1) {
		error_print();
		return -1;
	}

	if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
		error_print();
		return -1;
	}

	return 1;
}















int tls13_recv_server_finished(TLS_CONNECT *conn)
{
	int ret;
	const uint8_t *server_verify_data;
	size_t server_verify_data_len;
	uint8_t verify_data[64];
	size_t verify_data_len;

	uint8_t server_write_key[16];

	// compute verify_data before digest_update
	if (tls13_compute_verify_data(conn->server_handshake_traffic_secret,
		&conn->dgst_ctx, verify_data, &verify_data_len) != 1) {
		error_print();
		return -1;
	}

	tls_trace("recv server {Finished}\n");
	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (tls13_record_decrypt(&conn->server_write_key, conn->server_write_iv,
		conn->server_seq_num, conn->record, conn->recordlen,
		conn->plain_record, &conn->plain_recordlen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_record_mac);
		return -1;
	}
	tls_seq_num_incr(conn->server_seq_num);
	tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);
	if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
		error_print();
		return -1;
	}
	tls_handshake_digest_print(stderr, 0, 0, "ServerFinished", &conn->dgst_ctx);


	if ((ret = tls13_record_get_handshake_finished(conn->plain_record,
		&server_verify_data, &server_verify_data_len)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}

	if (server_verify_data_len != verify_data_len
		|| memcmp(server_verify_data, verify_data, verify_data_len) != 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_record_mac);
		return -1;
	}

	// generate client_application_traffic_secret
	/* [11] */ tls13_derive_secret(conn->master_secret, "c ap traffic", &conn->dgst_ctx, conn->client_application_traffic_secret);
	// generate server_application_traffic_secret
	/* [12] */ tls13_derive_secret(conn->master_secret, "s ap traffic", &conn->dgst_ctx, conn->server_application_traffic_secret);

	// update server_write_key, server_write_iv, reset server_seq_num
	tls13_hkdf_expand_label(conn->digest, conn->server_application_traffic_secret, "key", NULL, 0, 16, server_write_key);
	block_cipher_set_encrypt_key(&conn->server_write_key, conn->cipher, server_write_key);
	tls13_hkdf_expand_label(conn->digest, conn->server_application_traffic_secret, "iv", NULL, 0, 12, conn->server_write_iv);
	tls_seq_num_reset(conn->server_seq_num);

	format_print(stderr, 0, 0, "update server secrets\n");
	format_bytes(stderr, 0, 4, "server_application_traffic_secret", conn->server_application_traffic_secret, 48);
	format_bytes(stderr, 0, 4, "server_write_key", server_write_key, 16);
	format_bytes(stderr, 0, 4, "server_write_iv", conn->server_write_iv, 12);
	format_print(stderr, 0, 0, "\n");

	tls_seq_num_reset(conn->server_seq_num);

	return 1;
}

int tls13_send_client_certificate(TLS_CONNECT *conn)
{
	int ret;

	tls_trace("send {Certificate}\n");

	if (conn->recordlen == 0) {
		const uint8_t *request_context = NULL;
		size_t request_context_len = 0;
		const uint8_t *entity_status_request_ocsp_response = NULL;
		size_t entity_status_request_ocsp_response_len = 0;
		const uint8_t *entity_signed_certificate_timestamp = NULL;
		size_t entity_signed_certificate_timestamp_len = 0;
		size_t padding_len;

		// status_request
		if (conn->status_request) {
			entity_status_request_ocsp_response = conn->status_request_ocsp_response;
			entity_status_request_ocsp_response_len = conn->status_request_ocsp_response_len;
		}

		// signed_certificate_timestamp
		if (conn->signed_certificate_timestamp) {
			entity_signed_certificate_timestamp = conn->signed_certificate_timestamp_list;
			entity_signed_certificate_timestamp_len = conn->signed_certificate_timestamp_list_len;
		}

		if (tls13_record_set_handshake_certificate(conn->plain_record, &conn->plain_recordlen,
			request_context, request_context_len,
			conn->cert_chain, conn->cert_chain_len,
			entity_status_request_ocsp_response, entity_status_request_ocsp_response_len,
			entity_signed_certificate_timestamp, entity_signed_certificate_timestamp_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

		if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
			error_print();
			return -1;
		}

		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->client_write_key, conn->client_write_iv,
			conn->client_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			return -1;
		}
		tls_seq_num_incr(conn->client_seq_num);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	return 1;
}

int tls13_send_client_certificate_verify(TLS_CONNECT *conn)
{
	int ret;

	tls_trace("send {CertificateVerify*}\n");

	if (!conn->recordlen) {
		X509_KEY *sign_key = &conn->ctx->x509_keys[conn->cert_chain_idx - 1];
		uint8_t sig[256];
		size_t siglen;
		size_t padding_len;

		if (tls13_sign_certificate_verify(TLS_client_mode, conn->sig_alg,
			sign_key, &conn->dgst_ctx, sig, &siglen) != 1) {
			error_print();
			return -1;
		}

		if (tls13_record_set_handshake_certificate_verify(
			conn->plain_record, &conn->plain_recordlen,
			conn->sig_alg, sig, siglen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

		if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
			error_print();
			return -1;
		}

		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->client_write_key, conn->client_write_iv,
			conn->client_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		tls_seq_num_incr(conn->client_seq_num);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	return 1;
}

int tls13_send_client_finished(TLS_CONNECT *conn)
{
	int ret;
	uint8_t client_write_key[16];

	tls_trace("send client {Finished}\n");

	if (!conn->recordlen) {
		uint8_t verify_data[64];
		size_t verify_data_len;
		size_t padding_len;


		tls_handshake_digest_print(stderr, 0, 0, "before ClientFinished", &conn->dgst_ctx);

		tls13_compute_verify_data(conn->client_handshake_traffic_secret, &conn->dgst_ctx,
			verify_data, &verify_data_len);

		memset(&conn->dgst_ctx, 0, sizeof(conn->dgst_ctx));


		if (tls_record_set_handshake_finished(conn->plain_record, &conn->plain_recordlen,
			verify_data, verify_data_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);


		format_bytes(stderr, 0, 0, "client_seq_num", conn->client_seq_num, 8);

		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->client_write_key, conn->client_write_iv,
			conn->client_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}

		tls_seq_num_incr(conn->client_seq_num);

	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	//update client_write_key, client_write_iv, reset client_seq_num
	tls13_hkdf_expand_label(conn->digest, conn->client_application_traffic_secret, "key", NULL, 0, 16, client_write_key);
	tls13_hkdf_expand_label(conn->digest, conn->client_application_traffic_secret, "iv", NULL, 0, 12, conn->client_write_iv);
	block_cipher_set_encrypt_key(&conn->client_write_key, conn->cipher, client_write_key);
	tls_seq_num_reset(conn->client_seq_num);

	format_print(stderr, 0, 0, "update client secrets\n");
	format_bytes(stderr, 0, 4, "client_application_traffic_secret", conn->client_application_traffic_secret, 48);
	format_bytes(stderr, 0, 4, "client_write_key", client_write_key, 16);
	format_bytes(stderr, 0, 4, "client_write_iv", conn->client_write_iv, 12);
	format_print(stderr, 0, 0, "\n");


	return 1;
}


int tls13_recv_client_hello(TLS_CONNECT *conn)
{
	int ret;
	uint8_t *record = conn->record;
	size_t recordlen;

	int client_verify = 0;

	int protocol;

	// client_hello
	int legacy_version;
	const uint8_t *random;
	const uint8_t *legacy_session_id;
	size_t legacy_session_id_len;
	const uint8_t *cipher_suites;
	size_t cipher_suites_len;
	const uint8_t *legacy_comp_methods;
	size_t legacy_comp_methods_len;
	const uint8_t *exts;
	size_t extslen;

	// extensions
	const uint8_t *supported_versions = NULL;
	size_t supported_versions_len;
	const uint8_t *supported_groups = NULL;
	size_t supported_groups_len;
	const uint8_t *signature_algorithms = NULL;
	size_t signature_algorithms_len;
	const uint8_t *signature_algorithms_cert = NULL;
	size_t signature_algorithms_cert_len;
	const uint8_t *certificate_authorities = NULL;
	size_t certificate_authorities_len;
	const uint8_t *key_share = NULL;
	size_t key_share_len;
	const uint8_t *server_name = NULL;
	size_t server_name_len;
	const uint8_t *psk_key_exchange_modes = NULL;
	size_t psk_key_exchange_modes_len;
	const uint8_t *pre_shared_key = NULL;
	size_t pre_shared_key_len;
	const uint8_t *status_request = NULL;
	size_t status_request_len;
	int signed_certificate_timestamp = 0;
	int early_data = 0;

	int common_versions[4];
	size_t common_versions_cnt = 0;
	int common_groups[4];
	size_t common_groups_cnt = 0;
	int common_sig_algs[4];
	size_t common_sig_algs_cnt = 0;
	int common_sig_algs_cert[4];
	size_t common_sig_algs_cert_cnt = 0;

	const uint8_t *host_name = NULL;
	size_t host_name_len;

	int common_key_exchange_modes = 0;

	const uint8_t *ca_names = NULL;
	size_t ca_names_len = 0;


	// 这个判断应该改为一个函数
	/*
	if (client_verify)
		tls_client_verify_init(&conn->client_verify_ctx);
	*/


	tls_trace("recv ClientHello\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}
	tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

	if (tls_record_protocol(record) != TLS_protocol_tls1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}
	if ((ret = tls_record_get_handshake_client_hello(conn->record,
		&legacy_version, &random, &legacy_session_id, &legacy_session_id_len,
		&cipher_suites, &cipher_suites_len, &exts, &extslen)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}

	// legacy_version
	if (legacy_version != TLS_protocol_tls12) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}

	// random
	memcpy(conn->client_random, random, 32);

	// legacy_session_id
	if (legacy_session_id_len) {
		// tls13 server ignore legacy_session_id
		warning_print();
	}

	// cipher_suites
	if ((ret = tls_cipher_suites_select(cipher_suites, cipher_suites_len,
		conn->ctx->cipher_suites, conn->ctx->cipher_suites_cnt,
		&conn->cipher_suite)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_handshake_failure);
		return -1;
	}

	tls13_cipher_suite_get(conn->cipher_suite, &conn->cipher, &conn->digest);

	// digest_update(client_hello) until conn->hello_retry_request


	while (extslen) {
		int ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;

		if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}

		// exts in CH (RFC 8446 page 37), only oid_filter not in CH
		//  * supported_versions
		//  * signature_algorithms
		//  * signature_algorithms_cert
		//  * certificate_authorities
		//  * server_name
		//  * status_request
		//  * signed_certificate_timestamp
		//  * supported_groups
		//  * key_share
		//  * psk_key_exchange_modes
		//  * pre_shared_key
		//  * early_data (only in ClientHello1)
		//  * max_fragment_length
		//  * use_srtp
		//  * heartbeat
		//  * application_layer_protocol_negotiation
		//  * server_certificate_type: if client accept raw/x509
		//  * client_certificate_type: if client sned raw/x509
		//  * padding
		//  * post_handshake_auth: client support post handshake auth
		//  * cookie (only in ClientHello2)


		switch (ext_type) {
		case TLS_extension_supported_versions:
		case TLS_extension_supported_groups:
		case TLS_extension_signature_algorithms:
		case TLS_extension_signature_algorithms_cert:
		case TLS_extension_certificate_authorities:
		case TLS_extension_key_share:
		case TLS_extension_server_name:
		case TLS_extension_psk_key_exchange_modes:
		case TLS_extension_pre_shared_key:
		case TLS_extension_status_request:
			if (!ext_data) {
				error_print();
				return -1;
			}
			break;
		case TLS_extension_signed_certificate_timestamp:
		case TLS_extension_early_data:
			if (ext_data) {
				error_print();
				return -1;
			}
			break;
		}

		switch (ext_type) {
		case TLS_extension_supported_versions:
			if (supported_versions) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			supported_versions = ext_data;
			supported_versions_len = ext_datalen;
			break;

		case TLS_extension_supported_groups:
			if (supported_groups) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			supported_groups = ext_data;
			supported_groups_len = ext_datalen;
			break;

		case TLS_extension_signature_algorithms:
			if (signature_algorithms) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			signature_algorithms = ext_data;
			signature_algorithms_len = ext_datalen;
			break;

		case TLS_extension_signature_algorithms_cert:
			if (signature_algorithms_cert) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			signature_algorithms_cert = ext_data;
			signature_algorithms_cert_len = ext_datalen;
			break;

		case TLS_extension_certificate_authorities:
			if (certificate_authorities) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			certificate_authorities = ext_data;
			certificate_authorities_len = ext_datalen;
			break;

		case TLS_extension_key_share:
			if (key_share) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			key_share = ext_data;
			key_share_len = ext_datalen;
			break;

		case TLS_extension_server_name:
			if (server_name) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			server_name = ext_data;
			server_name_len = ext_datalen;
			break;

		case TLS_extension_psk_key_exchange_modes:
			if (psk_key_exchange_modes) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			psk_key_exchange_modes = ext_data;
			psk_key_exchange_modes_len = ext_datalen;
			break;

		case TLS_extension_pre_shared_key:
			if (pre_shared_key) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			pre_shared_key = ext_data;
			pre_shared_key_len = ext_datalen;
			break;

		case TLS_extension_status_request:
			if (status_request) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			status_request = ext_data;
			status_request_len = ext_datalen;
			break;

		case TLS_extension_signed_certificate_timestamp:
			if (signed_certificate_timestamp) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			signed_certificate_timestamp = 1;
			break;

		case TLS_extension_early_data:
			if (early_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			early_data = 1;
			break;

		case TLS_extension_max_fragment_length:
		case TLS_extension_use_srtp:
		case TLS_extension_heartbeat:
		case TLS_extension_application_layer_protocol_negotiation:
		case TLS_extension_server_certificate_type:
		case TLS_extension_client_certificate_type:
		case TLS_extension_padding:
		case TLS_extension_post_handshake_auth:
			break;

		case TLS_extension_cookie:
			error_print();
		default:
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	}

	// from RFC 8446 section 9.2
	//   * supported_versions required for CH, SH, HRR
	//   * if no pre_shared_key, signature_algorithms + supported_groups must exist
	//   * supported_groups + key_share must exist together
	//   * empty key_share is permitted
	//
	if (!supported_versions) {
		error_print();
		tls13_send_alert(conn, TLS_alert_missing_extension);
		return -1;
	}
	if (!pre_shared_key) {
		if (!(signature_algorithms && supported_groups)) {
			error_print();
			tls13_send_alert(conn, TLS_alert_missing_extension);
			return -1;
		}
	}
	if ((supported_groups && !key_share)
		|| (!supported_groups && key_share)) {
		error_print();
		tls13_send_alert(conn, TLS_alert_missing_extension);
		return -1;
	}
	if ((psk_key_exchange_modes && !pre_shared_key)
		|| (!psk_key_exchange_modes && pre_shared_key)) {
		error_print();
		tls13_send_alert(conn, TLS_alert_missing_extension);
		return -1;
	}

	// supported_versions
	if ((ret = tls13_process_client_supported_versions(
		supported_versions, supported_versions_len,
		conn->ctx->supported_versions, conn->ctx->supported_versions_cnt,
		common_versions, &common_versions_cnt,
		sizeof(common_versions)/sizeof(common_versions[0]))) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}
	if (common_versions[0] != TLS_protocol_tls13) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}
	conn->protocol = common_versions[0];


	// psk_key_exchange_modes
	if (psk_key_exchange_modes) {
		if (tls13_psk_key_exchange_modes_from_bytes(&common_key_exchange_modes,
			psk_key_exchange_modes, psk_key_exchange_modes_len) != 1) {
			error_print();
			return -1;
		}
	}
	// client key_exchange_modes
	if (supported_groups && signature_algorithms) {
		common_key_exchange_modes |= TLS_KE_CERT_DHE;
	}

	// common key_exchange_modes
	common_key_exchange_modes &= conn->key_exchange_modes;
	if (!common_key_exchange_modes) {
		error_print();
		tls13_send_alert(conn, TLS_alert_handshake_failure);
		return -1;
	}

	// signature_algorithms
	if (signature_algorithms) {
		if ((ret = tls_process_signature_algorithms(
			signature_algorithms, signature_algorithms_len,
			conn->ctx->signature_algorithms, conn->ctx->signature_algorithms_cnt,
			common_sig_algs, &common_sig_algs_cnt,
			sizeof(common_sig_algs)/sizeof(common_sig_algs[0]))) < 0) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		} else if (ret == 0) {
			common_key_exchange_modes &= ~TLS_KE_CERT_DHE;
		}
	}

	// signature_algorithms_cert
	if (signature_algorithms_cert) {
		if ((ret = tls_process_signature_algorithms(
			signature_algorithms_cert, signature_algorithms_cert_len,
			conn->ctx->signature_algorithms, conn->ctx->signature_algorithms_cnt,
			common_sig_algs_cert, &common_sig_algs_cert_cnt,
			sizeof(common_sig_algs_cert)/sizeof(common_sig_algs_cert[0]))) < 0) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		} else if (ret == 0) {
			common_key_exchange_modes &= ~TLS_KE_CERT_DHE;
		}
	}

	// certificate_authorities
	if (certificate_authorities) {
		if (tls13_certificate_authorities_from_bytes(&ca_names, &ca_names_len,
			certificate_authorities, certificate_authorities_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	}

	// server_name
	if (server_name) {
		if (tls_server_name_from_bytes(&host_name, &host_name_len,
			server_name, server_name_len) != 1) {
			error_print();
			return -1;
		}
		conn->server_name = 1;
	}

	// select server cert_chain
	//	* signature_algorithms
	//	* [signature_algorithms_cert]
	//	* [certificate_authorities]
	//	* [server_name.host_name]
	//
	if (common_key_exchange_modes & TLS_KE_CERT_DHE) {
		if ((ret = tls13_cert_chains_select(
			conn->ctx->cert_chains, conn->ctx->cert_chains_len,
			common_sig_algs, common_sig_algs_cnt,
			common_sig_algs_cert, common_sig_algs_cert_cnt,
			ca_names, ca_names_len,
			NULL, 0, // oid_filters
			host_name, host_name_len,
			&conn->cert_chain, &conn->cert_chain_len, &conn->cert_chain_idx, &conn->sig_alg)) < 0) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		} else if (ret == 0) {
			error_print();
			common_key_exchange_modes &= ~TLS_KE_CERT_DHE;
		}
	}

	// status_request
	if (status_request) {
		int status_type;
		const uint8_t *responder_id_list;
		size_t responder_id_list_len;
		const uint8_t *request_exts;
		size_t request_exts_len;

		if (tls_client_status_request_from_bytes(&status_type,
			&responder_id_list, &responder_id_list_len,
			&request_exts, &request_exts_len,
			status_request, status_request_len) != 1) {
			error_print();
			return -1;
		}
		if (status_type != TLS_certificate_status_type_ocsp) {
			error_print();
			return -1;
		}
		if (conn->cert_chain) {
			const uint8_t *cp = conn->ctx->status_request_ocsp_responses;
			size_t len = conn->ctx->status_request_ocsp_responses_len;
			size_t i;

			// get ocsp_response
			for (i = 0; i < conn->cert_chain_idx; i++) {
				if (tls_uint24array_from_bytes(
					&conn->status_request_ocsp_response,
					&conn->status_request_ocsp_response_len,
					&cp, &len) != 1) {
					error_print();
					return -1;
				}
			}
			// check if ocsp_response match the status_request
			if (conn->status_request_ocsp_response) {
				if ((ret = tls_ocsp_response_match_status_request(
					conn->status_request_ocsp_response,
					conn->status_request_ocsp_response_len,
					responder_id_list, responder_id_list_len,
					request_exts, request_exts_len)) < 0) {
					error_print();
					return -1;
				} else if (ret == 0) {
					conn->status_request_ocsp_response = NULL;
					conn->status_request_ocsp_response_len = 0;
				}
			}
		}
		// send CertificateRequest.status_request
		conn->status_request = 1;
	}

	// signed_certificate_timestamp
	if (signed_certificate_timestamp) {
		if (conn->cert_chain) {
			const uint8_t *sct_lists = conn->ctx->signed_certificate_timestamp_lists;
			size_t sct_lists_len = conn->ctx->signed_certificate_timestamp_lists_len;
			size_t i;

			for (i = 0; i < conn->cert_chain_idx; i++) {
				if (tls_uint16array_from_bytes(
					&conn->signed_certificate_timestamp_list,
					&conn->signed_certificate_timestamp_list_len,
					&sct_lists, &sct_lists_len) != 1) {
					error_print();
					return -1;
				}
			}
		}
		// send CertificateRequest.signed_certificate_timestamp
		conn->signed_certificate_timestamp = 1;
	}

	// supported_groups
	if (supported_groups) {
		if ((ret = tls_process_supported_groups(
			supported_groups, supported_groups_len,
			conn->ctx->supported_groups, conn->ctx->supported_groups_cnt,
			common_groups, &common_groups_cnt,
			sizeof(common_groups)/sizeof(common_groups[0]))) < 0) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		} else if (ret == 0) {
			common_key_exchange_modes &= ~(TLS_KE_CERT_DHE|TLS_KE_PSK_DHE);
		}
	}

	// key_share
	if (key_share) {
		int group = 0;
		const uint8_t *key_exchange = NULL;
		size_t key_exchange_len = 0;

		if (common_groups_cnt) {
			if ((ret = tls13_process_key_share_client_hello(
				key_share, key_share_len, common_groups, common_groups_cnt,
				&group, &key_exchange, &key_exchange_len)) < 0) {
				error_print();
				tls13_send_alert(conn, TLS_alert_decode_error);
				return -1;
			} else if (ret == 0) {
				// send HelloRetryRequest if modes == CERT_DHE|PSK_DHE
				conn->key_exchange_group = common_groups[0];
			} else {
				conn->key_exchange_group = group;
				memcpy(conn->peer_key_exchange, key_exchange, key_exchange_len);
				conn->peer_key_exchange_len = key_exchange_len;
			}
		}
	}

	// pre_shared_key
	if (pre_shared_key) {
		if (common_key_exchange_modes & (TLS_KE_PSK_DHE|TLS_KE_PSK)) {
			if (conn->psk_identities_len) {
				if ((ret = tls13_process_client_pre_shared_key_external(conn,
					pre_shared_key, pre_shared_key_len)) < 0) {
					error_print();
					return -1;
				} else if (ret == 0) {
					common_key_exchange_modes &= ~(TLS_KE_PSK_DHE|TLS_KE_PSK);
				}
			} else if (conn->ctx->session_ticket_key) {
				if ((ret = tls13_process_client_pre_shared_key_from_ticket(conn,
					pre_shared_key, pre_shared_key_len)) < 0) {
					error_print();
					return -1;
				} else if (ret == 0) {
					common_key_exchange_modes &= ~(TLS_KE_PSK_DHE|TLS_KE_PSK);
				}
			} else {
				// caller should set session_ticket_key or psk_keys
				error_print();
				return -1;
			}

			//format_print(stderr, 0, 0, "selected_psk_identity: %d\n", conn->selected_psk_identity - 1);
			//format_bytes(stderr, 0, 0, "selected_psk", conn->psk, conn->psk_len);
		}
	}

	/*
	decide the final key exchange mode and  hello_retry_request

	PSK_DHE
		* selected_psk_identity
		* key_exchange_group
		* [key_exchanges_cnt]

	PSK
		* selected_psk_identity

	CERT_DHE
		* cert_chain
		* key_exchange_group
		* [key_exchanges_cnt]
	*/
	if (common_key_exchange_modes & TLS_KE_PSK_DHE) {
		if (conn->selected_psk_identity && conn->key_exchange_group) {
			conn->key_exchange_modes = TLS_KE_PSK_DHE;
			if (!conn->peer_key_exchange_len) {
				conn->hello_retry_request = 1;
			}
		}
	} else if (common_key_exchange_modes & TLS_KE_PSK) {
		if (conn->selected_psk_identity) {
			conn->key_exchange_modes = TLS_KE_PSK;
		}
	} else if (common_key_exchange_modes & TLS_KE_CERT_DHE) {
		if (conn->cert_chain && conn->key_exchange_group) {
			conn->key_exchange_modes = TLS_KE_CERT_DHE;
		}
		if (!conn->peer_key_exchange_len) {
			conn->hello_retry_request = 1;
		}
	} else {
		error_print();
		tls13_send_alert(conn, TLS_alert_handshake_failure);
		return -1;
	}

	//tls_key_exchange_modes_print(stderr, 0, 0, ">>>> key_exchange_modes", conn->key_exchange_modes);

	// hello_retry_request
	if (conn->hello_retry_request) {
		uint8_t message_hash[4 + 32];
		size_t dgstlen;

		// cache ClientHello1, need by recv_client_hello_again
		memcpy(conn->plain_record, conn->record, conn->recordlen);
		conn->plain_recordlen = conn->recordlen;


		// message_hash handshake
		message_hash[0] = TLS_handshake_message_hash;
		message_hash[1] = 0;
		message_hash[2] = 0;
		message_hash[3] = 32;

		if (digest_init(&conn->dgst_ctx, conn->digest) != 1
			|| digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1
			|| digest_finish(&conn->dgst_ctx, message_hash + 4, &dgstlen) != 1) {
			error_print();
			return -1;
		}
		if (digest_init(&conn->dgst_ctx, conn->digest) != 1
			|| digest_update(&conn->dgst_ctx, message_hash, sizeof(message_hash)) != 1) {
			error_print();
			return -1;
		}
	} else {
		if (digest_init(&conn->dgst_ctx, conn->digest) != 1
			|| digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
			error_print();
			return -1;
		}
		tls_handshake_digest_print(stderr, 0, 0, "ClientHello", &conn->dgst_ctx);
	}

	// early_data
	conn->early_data =
		(conn->early_data) &&
		(conn->key_exchange_modes & (TLS_KE_PSK_DHE | TLS_KE_PSK)) &&
		(early_data) &&
		(conn->hello_retry_request == 0);

	// generate early_data keys
	if (conn->early_data) {
		if (tls13_generate_early_data_keys(conn) != 1) {
			error_print();
			return -1;
		}
	}

	if (client_verify)
		tls_client_verify_update(&conn->client_verify_ctx, conn->record + 5, conn->recordlen - 5);

	tls_clean_record(conn);

	return 1;
}

int tls13_send_hello_retry_request(TLS_CONNECT *conn)
{
	int ret;

	tls_trace("send HelloRetryRequest\n");

	if (conn->recordlen == 0) {
		const uint8_t *legacy_session_id_echo = NULL;
		size_t legacy_session_id_echo_len = 0;
		int legacy_compress_meth = 0;
		uint8_t exts[256];
		uint8_t *pexts = exts;
		size_t extslen = 0;
		int curve_oid;
		uint8_t cookie[256];
		size_t cookie_len;

		tls_record_set_protocol(conn->record, TLS_protocol_tls12);

		if (tls13_random_generate(conn->server_random) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}

		if (conn->session_id_len) {
			legacy_session_id_echo = conn->session_id;
			legacy_session_id_echo_len = conn->session_id_len;
		}

		// exts in HRR
		//  * supported_versions
		//  * key_share
		//  * [cookie]

		// supported_versions
		if (tls13_server_supported_versions_ext_to_bytes(
			TLS_protocol_tls13, &pexts, &extslen) != 1) {
			error_print();
			return -1;
		}

		// key_share
		if (tls13_key_share_hello_retry_request_ext_to_bytes(
			conn->key_exchange_group, &pexts, &extslen) != 1) {
			error_print();
			return -1;
		}

		// cookie
		if (conn->cookie) {
			// TODO: cookie = {ClientHello}
			if (tls13_cookie_generate(&conn->ctx->cookie_key, NULL, 0,
				cookie, &cookie_len) != 1) {
				error_print();
				return -1;
			}
			if (tls13_cookie_ext_to_bytes(
				cookie, sizeof(cookie), &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		if (tls13_record_set_handshake_hello_retry_request(
			conn->record, &conn->recordlen,
			TLS_protocol_tls12, conn->server_random,
			legacy_session_id_echo, legacy_session_id_echo_len,
			conn->cipher_suite, legacy_compress_meth, exts, extslen) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
		error_print();
		return -1;
	}

	if (conn->ctx->cacertslen) {
		tls_client_verify_update(&conn->client_verify_ctx, conn->record + 5, conn->recordlen - 5);
	}

	tls_clean_record(conn);

	return 1;
}

int tls13_recv_client_hello_again(TLS_CONNECT *conn)
{
	int ret;
	uint8_t *record = conn->record;
	size_t recordlen;

	int client_verify = 0;

	int protocol;

	// ClientHello1
	int _legacy_version;
	const uint8_t *_random;
	const uint8_t *_legacy_session_id;
	size_t _legacy_session_id_len;
	const uint8_t *_cipher_suites;
	size_t _cipher_suites_len;
	const uint8_t *_legacy_comp_methods;
	size_t _legacy_comp_methods_len;
	const uint8_t *_exts;
	size_t _extslen;

	// ClientHello2
	int legacy_version;
	const uint8_t *random;
	const uint8_t *legacy_session_id;
	size_t legacy_session_id_len;
	const uint8_t *cipher_suites;
	size_t cipher_suites_len;
	const uint8_t *legacy_comp_methods;
	size_t legacy_comp_methods_len;
	const uint8_t *exts;
	size_t extslen;

	// Extensions
	const uint8_t *key_share = NULL;
	size_t key_share_len;
	const uint8_t *pre_shared_key = NULL;
	size_t pre_shared_key_len;
	const uint8_t *cookie = NULL;
	size_t cookie_len;

	const uint8_t *key_exchange;
	size_t key_exchange_len;


	tls_trace("recv ClientHello again\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}
	tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

	if (tls_record_protocol(record) != TLS_protocol_tls1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}
	if ((ret = tls_record_get_handshake_client_hello(conn->record,
		&legacy_version, &random, &legacy_session_id, &legacy_session_id_len,
		&cipher_suites, &cipher_suites_len, &exts, &extslen)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}
	if (legacy_version != TLS_protocol_tls12) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	// ClientHello1
	if (tls_record_get_handshake_client_hello(conn->plain_record,
		&_legacy_version, &_random, &_legacy_session_id, &_legacy_session_id_len,
		&_cipher_suites, &_cipher_suites_len, &_exts, &_extslen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	}
	if (legacy_version != _legacy_version
		|| legacy_session_id_len != _legacy_session_id_len
		|| memcmp(legacy_session_id, _legacy_session_id, _legacy_session_id_len) != 0
		|| cipher_suites_len != _cipher_suites_len
		|| memcmp(cipher_suites, _cipher_suites, _cipher_suites_len) != 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}
	// client random, should not send the same random
	if (memcmp(random, conn->client_random, 32) == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	// update client_server
	memcpy(conn->client_random, random, 32);

	while (extslen) {
		int ext_type;
		const uint8_t *ext_data;
		size_t ext_datalen;
		int _ext_type;
		const uint8_t *_ext_data;
		size_t _ext_datalen;

		if (tls_ext_from_bytes(&ext_type, &ext_data, &ext_datalen, &exts, &extslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}

		// ClientHello2 extensions
		//	* key_share - must exist, only one key_exchange based on conn->key_exchange_group
		//	* pre_shared_key - might be subset of ClientHello1.pre_shared_key
		//	* early_data - must not exist
		//	* cookie - should exsit if conn->cookie == 1

		// early_data must not in ClientHello2
		if (ext_type == TLS_extension_early_data) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}

		// cookie not in ClientHello1
		if (ext_type == TLS_extension_cookie) {
			if (!conn->cookie) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			if (!ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
			cookie = ext_data;
			cookie_len = ext_datalen;
			continue;
		}

		// get ext in ClientHello1 (omit early_data)
		if (tls_ext_from_bytes(&_ext_type, &_ext_data, &_ext_datalen, &_exts, &_extslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}
		if (_ext_type == TLS_extension_early_data) {
			if (tls_ext_from_bytes(&_ext_type, &_ext_data, &_ext_datalen, &_exts, &_extslen) != 1) {
				error_print();
				tls13_send_alert(conn, TLS_alert_decode_error);
				return -1;
			}
		}
		if (ext_type != _ext_type) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}

		// check ext_data
		switch (ext_type) {
		case TLS_extension_key_share:
			if (!ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_decode_error);
				return -1;
			}
			key_share = ext_data;
			key_share_len = ext_datalen;
			break;

		case TLS_extension_pre_shared_key:
			{
			const uint8_t *psk_identities;
			size_t psk_identities_len;
			const uint8_t *binders;
			size_t binders_len;
			const uint8_t *_psk_identities;
			size_t _psk_identities_len;

			if (!ext_data) {
				error_print();
				tls13_send_alert(conn, TLS_alert_decode_error);
				return -1;
			}
			if (tls13_client_pre_shared_key_from_bytes(&psk_identities, &psk_identities_len,
				&binders, &binders_len, ext_data, ext_datalen) != 1) {
				error_print();
				tls13_send_alert(conn, TLS_alert_decode_error);
				return -1;
			}
			if (tls13_client_pre_shared_key_from_bytes(&_psk_identities, &_psk_identities_len,
				&binders, &binders_len, _ext_data, _ext_datalen) != 1) {
				error_print();
				return -1;
			}
			while (psk_identities_len) {
				const uint8_t *id;
				size_t idlen;
				uint32_t age;
				const uint8_t *_id;
				size_t _idlen;
				int match = 0;

				if (tls13_psk_identity_from_bytes(&id, &idlen, &age, &psk_identities, &psk_identities_len) != 1) {
					error_print();
					tls13_send_alert(conn, TLS_alert_decode_error);
					return -1;
				}
				while (_psk_identities_len) {
					if (tls13_psk_identity_from_bytes(&_id, &_idlen, &age, &_psk_identities, &_psk_identities_len) != 1) {
						error_print();
						return -1;
					}
					if (idlen == _idlen && memcmp(id, _id, _idlen) == 0) {
						match = 1;
						break;
					}
				}
				if (!match) {
					error_print();
					tls13_send_alert(conn, TLS_alert_illegal_parameter);
					return -1;
				}
			}
			pre_shared_key = ext_data;
			pre_shared_key_len = ext_datalen;
			}
			break;

		default:
			if (ext_datalen != _ext_datalen
				|| memcmp(ext_data, _ext_data, _ext_datalen) != 0) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
		}
	}

	// client must echo ClientHello1.cookie
	if (conn->cookie && !cookie) {
		error_print();
		tls13_send_alert(conn, TLS_alert_missing_extension);
		return -1;
	}

	// cookie
	if (cookie) {
		const uint8_t *cookie_data;
		size_t cookie_datalen;

		if (!conn->cookie) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
		if (tls13_cookie_from_bytes(&cookie_data, &cookie_datalen, cookie, cookie_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_decode_error);
			return -1;
		}
		if (tls13_cookie_verify(&conn->ctx->cookie_key, NULL, 0, cookie_data, cookie_datalen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_illegal_parameter);
			return -1;
		}
	}

	// key_share
	if (tls13_process_key_share_client_hello_again(key_share, key_share_len,
		conn->key_exchange_group, &key_exchange, &key_exchange_len) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	}
	if (key_exchange_len != 65) {
		error_print();
		return -1;
	}
	memcpy(conn->peer_key_exchange, key_exchange, key_exchange_len);
	conn->peer_key_exchange_len = key_exchange_len;

	// pre_shared_key
	if (pre_shared_key) {
		if (conn->key_exchange_modes & (TLS_KE_PSK_DHE|TLS_KE_PSK)) {
			size_t selected_psk_identity = conn->selected_psk_identity;
			conn->selected_psk_identity = 0;

			if (conn->psk_identities_len) {
				if (tls13_process_client_pre_shared_key_external(conn,
					pre_shared_key, pre_shared_key_len) != 1) {
					tls13_send_alert(conn, TLS_alert_illegal_parameter);
					error_print();
					return -1;
				}
			} else if (conn->ctx->session_ticket_key) {
				if (tls13_process_client_pre_shared_key_from_ticket(conn,
					pre_shared_key, pre_shared_key_len) != 1) {
					error_print();
					tls13_send_alert(conn, TLS_alert_illegal_parameter);
					return -1;
				}
			}
			if (conn->selected_psk_identity != selected_psk_identity) {
				error_print();
				tls13_send_alert(conn, TLS_alert_illegal_parameter);
				return -1;
			}
		}
	}

	if (digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
		error_print();
		return -1;
	}

	if (client_verify)
		tls_client_verify_update(&conn->client_verify_ctx, conn->record + 5, conn->recordlen - 5);

	tls_clean_record(conn);
	return 1;
}

int tls13_send_server_hello(TLS_CONNECT *conn)
{
	int ret;

	tls_trace("send ServerHello\n");

	if (conn->recordlen == 0) {
		uint8_t exts[256];
		uint8_t *pexts = exts;
		size_t extslen = 0;

		tls_record_set_protocol(conn->record, TLS_protocol_tls12);

		// server_random
		if (tls13_random_generate(conn->server_random) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}

		// exts in SH
		//  * supported_versions
		//  * key_share
		//  * pre_shared_key

		// supported_versions
		if (tls13_server_supported_versions_ext_to_bytes(
			conn->protocol, &pexts, &extslen) != 1) {
			error_print();
			return -1;
		}

		// key_share
		if (conn->key_exchange_modes & (TLS_KE_CERT_DHE|TLS_KE_PSK_DHE)) {
			int curve_oid;

			if (!conn->key_exchange_group) {
				error_print();
				return -1;
			}
			if ((curve_oid = tls_named_curve_oid(conn->key_exchange_group)) == OID_undef) {
				error_print();
				return -1;
			}
			if (x509_key_generate(&conn->key_exchanges[0],
				OID_ec_public_key, &curve_oid, sizeof(curve_oid)) != 1) {
				error_print();
				return -1;
			}
			conn->key_exchange_idx = 0;
			conn->key_exchanges_cnt = 1;
			if (tls13_key_share_server_hello_ext_to_bytes(
				&conn->key_exchanges[0], &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// pre_shared_key
		if (conn->key_exchange_modes & (TLS_KE_PSK_DHE|TLS_KE_PSK)) {
			if (tls13_server_pre_shared_key_ext_to_bytes(
				conn->selected_psk_identity, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		if (tls_record_set_handshake_server_hello(conn->record, &conn->recordlen,
			TLS_protocol_tls12, conn->server_random, NULL, 0,
			conn->cipher_suite, exts, extslen) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

		if (digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
			error_print();
			return -1;
		}
		tls_handshake_digest_print(stderr, 0, 0, "ServerHello", &conn->dgst_ctx);

		if (tls13_generate_handshake_keys(conn) != 1) {
			error_print();
			return -1;
		}
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (conn->ctx->cacertslen) {
		tls_client_verify_update(&conn->client_verify_ctx, conn->record + 5, conn->recordlen - 5);
	}

	tls_clean_record(conn);
	return 1;
}

int tls13_send_alert(TLS_CONNECT *conn, int alert)
{
	int ret;
	size_t padding_len;

	tls_trace("send {Alert}\n");

	tls_record_set_protocol(conn->plain_record, TLS_protocol_tls12);
	tls_record_set_alert(conn->plain_record, &conn->plain_recordlen, TLS_alert_level_fatal, alert);

	switch (conn->state) {
	case TLS_handshake_client_hello:
	case TLS_handshake_server_hello:
	case TLS_handshake_hello_retry_request:
		tls_socket_send(conn->sock, conn->plain_record, conn->plain_recordlen, 0);
		break;
	default:
		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->server_write_key, conn->server_write_iv,
			conn->server_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			return -1;
		}
		tls_seq_num_incr(conn->server_seq_num);

		if ((ret = tls_send_record(conn)) != 1) {
			if (ret != TLS_ERROR_SEND_AGAIN) {
				error_print();
			}
			return ret;
		}
	}

	return 1;
}

int tls13_send_encrypted_extensions(TLS_CONNECT *conn)
{
	int ret;
	tls_trace("send {EncryptedExtensions}\n");

	if (conn->recordlen == 0) {
		uint8_t exts[256];
		uint8_t *pexts = exts;
		size_t extslen = 0;
		size_t padding_len;

		tls_record_set_protocol(conn->plain_record, TLS_protocol_tls12);

		// Exts in EE (see RFC 8446 page 37)
		//  * supported_groups
		//  * server_name
		//  * early_data
		//  * application_layer_protocol_negotiation
		//  * use_srtp
		//  * client_certificate_type
		//  * server_certificate_type
		//  * max_fragment_length
		//  * heartbeat
		//  * record_size_limit (RFC 8449)

		// supported_groups
		if (conn->key_exchange_modes & (TLS_KE_CERT_DHE|TLS_KE_PSK_DHE)) {
			if (tls_supported_groups_ext_to_bytes(conn->ctx->supported_groups,
				conn->ctx->supported_groups_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// server_name
		if (conn->server_name) {
			if (tls_ext_to_bytes(TLS_extension_server_name, NULL, 0, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// early_data
		//	ClientHello.early_data
		//	PSK_DHE or PSK
		//	no HelloRetryRequest
		if (conn->early_data) {
			if (tls_ext_to_bytes(TLS_extension_early_data, NULL, 0, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		if (tls13_record_set_handshake_encrypted_extensions(
			conn->plain_record, &conn->plain_recordlen,
			exts, extslen) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);
		digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5);


		tls_handshake_digest_print(stderr, 0, 0, "EncryptedExtensions", &conn->dgst_ctx);


		tls13_padding_len_rand(&padding_len);

		format_bytes(stderr, 0, 0, "server_seq_num", conn->server_seq_num, 8);
		if (tls13_record_encrypt(&conn->server_write_key, conn->server_write_iv,
			conn->server_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			return -1;
		}
		tls_seq_num_incr(conn->server_seq_num);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}


	if (conn->ctx->cacertslen) {
		tls_client_verify_update(&conn->client_verify_ctx, conn->record + 5, conn->recordlen - 5);
	}

	tls_clean_record(conn);
	return 1;
}


int tls13_send_certificate_request(TLS_CONNECT *conn)
{
	int ret;
	tls_trace("send {CertificateRequest*}\n");

	if (conn->recordlen == 0) {
		const uint8_t *request_context = NULL;
		size_t request_context_len = 0;
		uint8_t exts[256];
		uint8_t *pexts = exts;
		size_t extslen = 0;
		size_t padding_len;

		// exts in CR (from RFC 8446 page 37)
		//  * signature_algorithms
		//  * signature_algorithms_cert
		//  * certificate_authorities
		//  * oid_filters
		//  * status_request
		//  * signed_certificate_timestamp

		// signature_algorithms
		if (!conn->signature_algorithms_cnt) {
			error_print();
			return -1;
		}
		// subset of ClientHello.signature_algorithms
		if (tls_signature_algorithms_ext_to_bytes(
			conn->signature_algorithms, conn->signature_algorithms_cnt,
			&pexts, &extslen) != 1) {
			error_print();
			return -1;
		}

		// signature_algorithms_cert, only when ClientHello.signature_algorithms_cert
		if (conn->signature_algorithms_cert) {
			if (tls13_signature_algorithms_cert_ext_to_bytes(
				conn->signature_algorithms, conn->signature_algorithms_cnt, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// certificate_authorities
		if (conn->certificate_authorities) {
			if (tls13_certificate_authorities_ext_to_bytes(
				conn->ctx->ca_names, conn->ctx->ca_names_len, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// oid_filters
		if (conn->oid_filters) {
			if (tls13_oid_filters_ext_to_bytes(
				conn->ctx->oid_filters, conn->ctx->oid_filters_len, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// status_request
		if (conn->status_request) {
			if (tls_ext_to_bytes(TLS_extension_status_request, NULL, 0, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		// signed_certificate_timestamp
		if (conn->signed_certificate_timestamp) {
			if (tls_ext_to_bytes(TLS_extension_signed_certificate_timestamp, NULL, 0, &pexts, &extslen) != 1) {
				error_print();
				return -1;
			}
		}

		if (tls13_record_set_handshake_certificate_request(
			conn->plain_record, &conn->plain_recordlen,
			request_context, request_context_len, exts, extslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

		format_bytes(stderr, 0, 0, "server_seq_num", conn->server_seq_num, 8);
		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->server_write_key, conn->server_write_iv,
			conn->server_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		tls_seq_num_incr(conn->server_seq_num);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	return 1;
}

int tls13_send_server_certificate(TLS_CONNECT *conn)
{
	int ret;

	tls_trace("send server {Certificate}\n");

	if (conn->recordlen == 0) {
		const uint8_t *request_context = NULL;
		size_t request_context_len = 0;
		const uint8_t *entity_status_request_ocsp_response = NULL;
		size_t entity_status_request_ocsp_response_len = 0;
		const uint8_t *entity_signed_certificate_timestamp = NULL;
		size_t entity_signed_certificate_timestamp_len = 0;
		size_t padding_len;

		// status_request
		if (conn->status_request) {
			entity_status_request_ocsp_response = conn->status_request_ocsp_response;
			entity_status_request_ocsp_response_len = conn->status_request_ocsp_response_len;
		}
		// if ClientHello.status_request, CertificateRequest.status_request = 1

		// signed_certificate_timestamp
		if (conn->signed_certificate_timestamp) {
			entity_signed_certificate_timestamp = conn->signed_certificate_timestamp_list;
			entity_signed_certificate_timestamp_len = conn->signed_certificate_timestamp_list_len;
		}
		// if ClientHello.signed_certificate_timestamp, CertificateRequest.signed_certificate_timestamp = 1

		if (tls13_record_set_handshake_certificate(conn->plain_record, &conn->plain_recordlen,
			request_context, request_context_len,
			conn->cert_chain, conn->cert_chain_len,
			entity_status_request_ocsp_response, entity_status_request_ocsp_response_len,
			entity_signed_certificate_timestamp, entity_signed_certificate_timestamp_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

		if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
			error_print();
			return -1;
		}
		tls_handshake_digest_print(stderr, 0, 0, "ServerCertificate", &conn->dgst_ctx);

		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->server_write_key, conn->server_write_iv,
			conn->server_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			return -1;
		}
		tls_seq_num_incr(conn->server_seq_num);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	return 1;
}


int tls13_send_server_certificate_verify(TLS_CONNECT *conn)
{
	int ret;

	tls_trace("send server {CertificateVerify}\n");

	if (conn->recordlen == 0) {
		X509_KEY *sign_key = &conn->ctx->x509_keys[conn->cert_chain_idx - 1];
		uint8_t sig[SM2_MAX_SIGNATURE_SIZE];
		size_t siglen;
		size_t padding_len;

		if (tls13_sign_certificate_verify(TLS_server_mode, conn->sig_alg,
			sign_key, &conn->dgst_ctx, sig, &siglen) != 1) {
			error_print();
			return -1;
		}

		if (tls13_record_set_handshake_certificate_verify(
			conn->plain_record, &conn->plain_recordlen,
			conn->sig_alg, sig, siglen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_internal_error);
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

		if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
			error_print();
			return -1;
		}

		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->server_write_key, conn->server_write_iv,
			conn->server_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			return -1;
		}
		tls_seq_num_incr(conn->server_seq_num);

	}
	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}
	return 1;
}

int tls13_send_server_finished(TLS_CONNECT *conn)
{
	int ret;
	size_t padding_len;

	tls_trace("send server {Finished}\n");


	if (conn->recordlen == 0) {
		uint8_t verify_data[64];
		size_t verify_data_len;
		uint8_t server_write_key[16];

		// compute server verify_data before digest_update()
		tls13_compute_verify_data(conn->server_handshake_traffic_secret,
			&conn->dgst_ctx, verify_data, &verify_data_len);

		if (tls13_record_set_handshake_finished(conn->plain_record, &conn->plain_recordlen,
			verify_data, verify_data_len) != 1) {
			error_print();
			return -1;
		}
		if (digest_update(&conn->dgst_ctx, conn->plain_record + 5, conn->plain_recordlen - 5) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

		tls_handshake_digest_print(stderr, 0, 0, "ServerFinished", &conn->dgst_ctx);


		format_bytes(stderr, 0, 0, "server_seq_num", conn->server_seq_num, 8);
		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->server_write_key, conn->server_write_iv,
			conn->server_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			return -1;
		}
		tls_seq_num_incr(conn->server_seq_num);

		// Generate client_application_traffic_secret
		/* 11 */ tls13_derive_secret(conn->master_secret, "c ap traffic", &conn->dgst_ctx, conn->client_application_traffic_secret);
		// generate server_application_traffic_secret
		/* 12 */ tls13_derive_secret(conn->master_secret, "s ap traffic", &conn->dgst_ctx, conn->server_application_traffic_secret);

		// update server_write_key, server_write_iv, reset server_seq_num
		tls13_hkdf_expand_label(conn->digest, conn->server_application_traffic_secret, "key", NULL, 0, 16, server_write_key);
		block_cipher_set_encrypt_key(&conn->server_write_key, conn->cipher, server_write_key);
		tls13_hkdf_expand_label(conn->digest, conn->server_application_traffic_secret, "iv", NULL, 0, 12, conn->server_write_iv);
		tls_seq_num_reset(conn->server_seq_num);

		format_print(stderr, 0, 0, "update server secrets\n");
		format_bytes(stderr, 0, 4, "server_application_traffic_secret", conn->server_application_traffic_secret, 48);
		format_bytes(stderr, 0, 4, "server_write_key", server_write_key, 16);
		format_bytes(stderr, 0, 4, "server_write_iv", conn->server_write_iv, 12);
		format_print(stderr, 0, 0, "\n");
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}

	return 1;
}

int tls13_recv_client_certificate(TLS_CONNECT *conn)
{
	int ret;
	size_t padding_len;
	const uint8_t *request_context;
	size_t request_context_len;
	const uint8_t *status_request_ocsp_response = NULL;
	size_t status_request_ocsp_response_len;
	const uint8_t *signed_certificate_timestamp = NULL;
	size_t signed_certificate_timestamp_len;

	const int *signature_algorithms_cert = NULL;
	size_t signature_algorithms_cert_cnt = 0;
	const uint8_t *ca_names = NULL;
	size_t ca_names_len = 0;
	const uint8_t *oid_filters = NULL;
	size_t oid_filters_len = 0;

	int verify_result;

	tls_trace("recv {Certificate*}\n");

	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}
	tls13_record_print(stderr, 0, 0, conn->record, conn->recordlen);

	if (tls_record_protocol(conn->record) != TLS_protocol_tls12) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}

	format_bytes(stderr, 0, 0, "client_seq_num", conn->client_seq_num, 8);
	if (tls13_record_decrypt(&conn->client_write_key, conn->client_write_iv,
		conn->client_seq_num, conn->record, conn->recordlen,
		conn->plain_record, &conn->plain_recordlen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_record_mac);
		return -1;
	}
	tls_seq_num_incr(conn->client_seq_num);

	tls13_record_trace(stderr, conn->plain_record, conn->plain_recordlen, 0, 0);

	if (digest_update(&conn->dgst_ctx, conn->record + 5, conn->recordlen - 5) != 1) {
		error_print();
		return -1;
	}

	if ((ret = tls13_record_get_handshake_certificate(conn->plain_record,
		&request_context, &request_context_len,
		conn->peer_cert_chain, &conn->peer_cert_chain_len, sizeof(conn->peer_cert_chain),
		&status_request_ocsp_response, &status_request_ocsp_response_len,
		&signed_certificate_timestamp, &signed_certificate_timestamp_len)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return 0;
	}
	if (request_context) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}
	if (!conn->peer_cert_chain_len) {
		error_print();
		tls13_send_alert(conn, TLS_alert_illegal_parameter);
		return -1;
	}

	// client cert_chain match CertificateRequest extensions
	if (conn->signature_algorithms_cert) {
		signature_algorithms_cert = conn->ctx->signature_algorithms;
		signature_algorithms_cert_cnt = conn->ctx->signature_algorithms_cnt;
	}
	if (conn->certificate_authorities) {
		ca_names = conn->ctx->ca_names;
		ca_names_len = conn->ctx->ca_names_len;
	}
	if (conn->oid_filters) {
		oid_filters = conn->ctx->oid_filters;
		oid_filters_len = conn->ctx->oid_filters_len;
	}
	if (tls_cert_chain_match_extensions(conn->peer_cert_chain, conn->peer_cert_chain_len,
		conn->ctx->signature_algorithms, conn->ctx->signature_algorithms_cnt,
		signature_algorithms_cert, signature_algorithms_cert_cnt,
		ca_names, ca_names_len,
		oid_filters, oid_filters_len,
		NULL, 0, // server_name not in CertificateRequest
		NULL) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_certificate);
		return -1;
	}

	// verify client cert_chain
	if (x509_certs_verify(conn->peer_cert_chain, conn->peer_cert_chain_len, X509_cert_chain_client,
		conn->ctx->cacerts, conn->ctx->cacertslen,
		conn->ctx->verify_depth, &verify_result) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_certificate);
		return -1;
	}
	// status_request
	if (status_request_ocsp_response) {
		if (ocsp_response_verify(
			status_request_ocsp_response, status_request_ocsp_response_len,
			conn->ctx->cacerts, conn->ctx->cacertslen) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_certificate_revoked);
			return -1;
		}
	}
	// signed_certificate_timestamp
	if (signed_certificate_timestamp) {
		if (tls13_signed_certificate_timestamp_verify(
			signed_certificate_timestamp, signed_certificate_timestamp_len) != 1) {
			error_print();
			tls13_send_alert(conn, TLS_alert_bad_certificate);
			return -1;
		}
	}

	return 1;
}

int tls13_recv_client_finished(TLS_CONNECT *conn)
{
	int ret;

	// Finished
	uint8_t local_verify_data[64];
	size_t local_verify_data_len;
	const uint8_t *verify_data;
	size_t verify_data_len;

	uint8_t client_write_key[16];

	tls_trace("recv client {Finished}\n");
	if ((ret = tls_recv_record(conn)) != 1) {
		if (ret != TLS_ERROR_RECV_AGAIN) {
			error_print();
		}
		return ret;
	}

	if (tls_record_protocol(conn->record) != TLS_protocol_tls12) {
		error_print();
		tls13_send_alert(conn, TLS_alert_protocol_version);
		return -1;
	}

	format_bytes(stderr, 0, 0, "client_seq_num", conn->client_seq_num, 8);
	if (tls13_record_decrypt(&conn->client_write_key, conn->client_write_iv,
		conn->client_seq_num, conn->record, conn->recordlen,
		conn->plain_record, &conn->plain_recordlen) != 1) {
		error_print();
		tls13_send_alert(conn, TLS_alert_bad_record_mac);
		return -1;
	}
	tls_seq_num_incr(conn->client_seq_num);

	tls13_record_trace(stderr, conn->plain_record, conn->plain_recordlen, 0, 0);


	if ((ret = tls13_record_get_handshake_finished(conn->plain_record,
		&verify_data, &verify_data_len)) < 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decode_error);
		return -1;
	} else if (ret == 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_unexpected_message);
		return -1;
	}

	tls_handshake_digest_print(stderr, 0, 0, "before ClientFinished", &conn->dgst_ctx);

	if (tls13_compute_verify_data(conn->client_handshake_traffic_secret,
		&conn->dgst_ctx, local_verify_data, &local_verify_data_len) != 1) {
		error_print();
		return -1;
	}
	memset(&conn->dgst_ctx, 0, sizeof(conn->dgst_ctx));

	if (local_verify_data_len != verify_data_len
		|| memcmp(local_verify_data, verify_data, verify_data_len) != 0) {
		error_print();
		tls13_send_alert(conn, TLS_alert_decrypt_error);
		return -1;
	}


	// update client_write_key, client_write_iv, reset client_seq_num
	tls13_hkdf_expand_label(conn->digest, conn->client_application_traffic_secret, "key", NULL, 0, 16, client_write_key);
	block_cipher_set_encrypt_key(&conn->client_write_key, conn->cipher, client_write_key);
	tls13_hkdf_expand_label(conn->digest, conn->client_application_traffic_secret, "iv", NULL, 0, 12, conn->client_write_iv);
	tls_seq_num_reset(conn->client_seq_num);

	format_print(stderr, 0, 0, "update client secrets\n");
	format_bytes(stderr, 0, 4, "client_write_key", client_write_key, 16);
	format_bytes(stderr, 0, 4, "client_write_iv", conn->client_write_iv, 12);
	format_print(stderr, 0, 0, "\n");

	return 1;
}

int tls13_send_early_data(TLS_CONNECT *conn)
{
	size_t sentlen;

	tls_trace("send EarlyData\n");

	if (!conn->early_data) {
		error_print();
		return -1;
	}
	if (!conn->early_data_len) {
		error_print();
		return -1;
	}

	while (conn->early_data_offset < conn->early_data_len) {
		int ret;
		if ((ret = tls13_send(conn, conn->early_data_buf + conn->early_data_offset,
			conn->early_data_len - conn->early_data_offset, &sentlen)) <= 0) {
			if (ret == TLS_ERROR_SEND_AGAIN) {
				return ret;
			}
		}
		conn->early_data_offset += sentlen;
	}

	return 1;
}

int tls13_update_client_application_keys(TLS_CONNECT *conn)
{
	uint8_t client_write_key[16];

	tls13_hkdf_expand_label(conn->digest, conn->client_application_traffic_secret, "traffic upd", NULL, 0, 48, conn->client_application_traffic_secret);
	tls13_hkdf_expand_label(conn->digest, conn->client_application_traffic_secret, "key", NULL, 0, 16, client_write_key);
	block_cipher_set_encrypt_key(&conn->client_write_key, conn->cipher, client_write_key);
	tls13_hkdf_expand_label(conn->digest, conn->client_application_traffic_secret, "iv", NULL, 0, 12, conn->client_write_iv);
	tls_seq_num_reset(conn->client_seq_num);

	format_print(stderr, 0, 0, "update client secrets\n");
	format_bytes(stderr, 0, 4, "client application_traffic_secret", conn->client_application_traffic_secret, 48);
	format_bytes(stderr, 0, 4, "client_write_key", client_write_key, 16);
	format_bytes(stderr, 0, 4, "client_write_iv", conn->client_write_iv, 12);
	format_print(stderr, 0, 0, "\n");

	return 1;
}

int tls13_update_server_application_keys(TLS_CONNECT *conn)
{
	uint8_t server_write_key[16];

	tls13_hkdf_expand_label(conn->digest, conn->server_application_traffic_secret, "traffic upd", NULL, 0, 48, conn->server_application_traffic_secret);
	tls13_hkdf_expand_label(conn->digest, conn->server_application_traffic_secret, "key", NULL, 0, 16, server_write_key);
	block_cipher_set_encrypt_key(&conn->server_write_key, conn->cipher, server_write_key);
	tls13_hkdf_expand_label(conn->digest, conn->server_application_traffic_secret, "iv", NULL, 0, 12, conn->server_write_iv);
	tls_seq_num_reset(conn->server_seq_num);

	format_print(stderr, 0, 0, "update server secrets\n");
	format_bytes(stderr, 0, 4, "server_application_traffic_secret", conn->server_application_traffic_secret, 48);
	format_bytes(stderr, 0, 4, "server_write_key", server_write_key, 16);
	format_bytes(stderr, 0, 4, "server_write_iv", conn->server_write_iv, 12);
	format_print(stderr, 0, 0, "\n");

	return 1;
}

// 参数request_update应该根据当前状态设置
int tls13_send_client_key_update(TLS_CONNECT *conn, int request_update)
{
	int ret;

	if (conn->recordlen == 0) {
		size_t padding_len = 0;

		tls_trace("send {KeyUpdate}\n");

		if (tls13_record_set_handshake_key_update(conn->plain_record, &conn->plain_recordlen,
			request_update) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->client_write_key, conn->client_write_iv,
			conn->client_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			return -1;
		}

		tls13_update_client_application_keys(conn);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}
	return 1;
}

int tls13_send_server_key_update(TLS_CONNECT *conn, int request_update)
{
	int ret;

	if (conn->recordlen == 0) {
		size_t padding_len = 0;

		tls_trace("send {KeyUpdate}\n");

		if (tls13_record_set_handshake_key_update(conn->plain_record, &conn->plain_recordlen,
			request_update) != 1) {
			error_print();
			return -1;
		}
		tls13_record_print(stderr, 0, 0, conn->plain_record, conn->plain_recordlen);

		tls13_padding_len_rand(&padding_len);
		if (tls13_record_encrypt(&conn->server_write_key, conn->server_write_iv,
			conn->server_seq_num, conn->plain_record, conn->plain_recordlen, padding_len,
			conn->record, &conn->recordlen) != 1) {
			error_print();
			return -1;
		}

		tls13_update_server_application_keys(conn);
	}

	if ((ret = tls_send_record(conn)) != 1) {
		if (ret != TLS_ERROR_SEND_AGAIN) {
			error_print();
		}
		return ret;
	}
	return 1;
}


/*
Post-Handshake-Auth

	客户端在 ClientHello 中发送post_handshake_auht说明支持PHA

	在握手完成并进行数据通信时，如果客户端请求一个特殊的地址 比如 GET /admin
	默认未认证的客户端不能访问此地址，因此服务器端如果发现客户端支持PHA，那么就会给客户端发送一个CertificateRequest

	客户端不需要立即响应，但是如果客户端响应
	则需要发出连续的 Certificate, CertificateVerify, Finished消息



这意味着如果客户端开始发送Certificate
	服务器就必须再次进入到握手的状态机中
	这意味着SSL再次进入到状态机中


是否意味着每次不论上层调用是read/write，SSL都是按照状态机来处理


*/





















int tls13_do_client_handshake(TLS_CONNECT *conn)
{
	int ret;
	int next_state;


	// 客户端的状态机可能还是有问题的

	switch (conn->state) {
	case TLS_state_hello_retry_request:
	case TLS_state_client_hello_again:
	case TLS_state_server_hello:
	case TLS_state_encrypted_extensions:
		if (conn->early_data && conn->early_data_offset < conn->early_data_len) {
			tls_trace("send EarlyData\n");
			if (tls13_send_early_data(conn) != 1) {
				error_print();
				return -1;
			}
		}
		break;
	}

	switch (conn->state) {
	case TLS_state_client_hello:
		ret = tls13_send_client_hello(conn);
		next_state = TLS_state_hello_retry_request;
		break;

	case TLS_state_hello_retry_request: // optional
		ret = tls13_recv_hello_retry_request(conn);
		if (conn->hello_retry_request)
			next_state = TLS_state_client_hello_again;
		else	next_state = TLS_state_server_hello;
		break;

	case TLS_state_client_hello_again:
		ret = tls13_send_client_hello_again(conn);
		next_state = TLS_state_server_hello;
		break;

	case TLS_state_server_hello:
		ret = tls13_recv_server_hello(conn);
		next_state = TLS_state_encrypted_extensions;
		break;

	case TLS_state_encrypted_extensions:
		ret = tls13_recv_encrypted_extensions(conn);
		next_state = TLS_state_certificate_request;
		break;

	case TLS_state_certificate_request: // optional
		ret = tls13_recv_certificate_request(conn);
		if (conn->key_exchange_modes == TLS_KE_CERT_DHE)
			next_state = TLS_state_server_certificate;
		else	next_state = TLS_state_server_finished;
		break;

	case TLS_state_server_certificate:
		ret = tls13_recv_server_certificate(conn);
		next_state = TLS_state_certificate_verify;
		break;

	case TLS_state_certificate_verify:
		ret = tls13_recv_server_certificate_verify(conn);
		next_state = TLS_state_server_finished;
		break;

	case TLS_state_server_finished:
		ret = tls13_recv_server_finished(conn);
		if (conn->early_data)
			next_state = TLS_state_end_of_early_data;
		else if (conn->client_certificate_verify)
			next_state = TLS_state_client_certificate;
		else	next_state = TLS_state_client_finished;
		break;

	case TLS_state_end_of_early_data:
		ret = tls13_send_end_of_early_data(conn);
		next_state = TLS_state_client_finished;
		break;

	case TLS_state_client_certificate:
		// if client has no (proper) certificate
		// client will send {Certificate} with empty certificate_list
		// but will not send {CertificateVerify}
		ret = tls13_send_client_certificate(conn);
		if (conn->cert_chain)
			next_state = TLS_state_client_certificate_verify;
		else	next_state = TLS_state_client_finished;
		break;

	case TLS_state_client_certificate_verify:
		ret = tls13_send_client_certificate_verify(conn);
		next_state = TLS_state_client_finished;
		break;

	case TLS_state_client_finished:
		ret = tls13_send_client_finished(conn);
		next_state = TLS_state_handshake_over;
		break;

	default:
		error_print();
		return -1;
	}

	if (ret < 0) {
		if (ret == TLS_ERROR_RECV_AGAIN || ret == TLS_ERROR_SEND_AGAIN) {
			return ret;
		} else {
			error_print();
			return ret;
		}
	}

	conn->state = next_state;

	// ret == 0 means this step is bypassed
	if (ret == 1) {
		tls_clean_record(conn);
	}

	return 1;
}


int tls13_do_server_handshake(TLS_CONNECT *conn)
{
	int ret;
	int next_state;

	switch (conn->state) {
	case TLS_state_client_hello:
		ret = tls13_recv_client_hello(conn);
		if (conn->early_data)
			next_state = TLS_state_early_data;
		else if (conn->hello_retry_request)
			next_state = TLS_state_hello_retry_request;
		else	next_state = TLS_state_server_hello;
		break;

	case TLS_state_early_data:
		ret = tls13_recv_early_data(conn);
		next_state = TLS_state_server_hello;
		break;

	case TLS_state_hello_retry_request:
		ret = tls13_send_hello_retry_request(conn);
		next_state = TLS_state_client_hello_again;
		break;

	case TLS_state_client_hello_again:
		ret = tls13_recv_client_hello_again(conn);
		next_state = TLS_state_server_hello;
		break;

	case TLS_state_server_hello:
		ret = tls13_send_server_hello(conn);
		next_state = TLS_state_encrypted_extensions;
		break;

	case TLS_state_encrypted_extensions:
		ret = tls13_send_encrypted_extensions(conn);
		if (conn->certificate_request)
			next_state = TLS_state_certificate_request;
		else if (conn->key_exchange_modes == TLS_KE_CERT_DHE)
			next_state = TLS_state_server_certificate;
		else	next_state = TLS_state_server_finished;
		break;

	case TLS_state_certificate_request:
		ret = tls13_send_certificate_request(conn);
		if (conn->key_exchange_modes == TLS_KE_CERT_DHE)
			next_state = TLS_state_server_certificate;
		else	next_state = TLS_state_server_finished;
		break;

	case TLS_state_server_certificate:
		ret = tls13_send_server_certificate(conn);
		next_state = TLS_state_certificate_verify;
		break;
	case TLS_state_certificate_verify:
		ret = tls13_send_server_certificate_verify(conn);
		next_state = TLS_state_server_finished;
		break;

	case TLS_state_server_finished:
		ret = tls13_send_server_finished(conn);
		if (conn->early_data)
			next_state = TLS_state_end_of_early_data;
		else if (conn->certificate_request)
			next_state = TLS_state_client_certificate;
		else	next_state = TLS_state_client_finished;
		break;

	case TLS_state_end_of_early_data:
		ret = tls13_recv_end_of_early_data(conn);
		next_state = TLS_state_client_finished;
		break;

	case TLS_state_client_certificate:
		ret = tls13_recv_client_certificate(conn);
		next_state = TLS_state_client_certificate_verify;
		break;

	case TLS_state_client_certificate_verify:
		ret = tls13_recv_client_certificate_verify(conn);
		next_state = TLS_state_client_finished;
		break;

	case TLS_state_client_finished:
		ret = tls13_recv_client_finished(conn);
		if (conn->new_session_ticket)
			next_state = TLS_state_new_session_ticket;
		else	next_state = TLS_state_handshake_over;
		break;

	case TLS_state_new_session_ticket:
		if (conn->new_session_ticket) {
			ret = tls13_send_new_session_ticket(conn);
			next_state = TLS_state_new_session_ticket;
		} else {
			ret = 1;
			next_state = TLS_state_handshake_over;
		}
		break;

	default:
		error_print();
		return -1;
	}

	if (ret < 0) {
		if (ret == TLS_ERROR_RECV_AGAIN || ret == TLS_ERROR_SEND_AGAIN) {
			return ret;
		} else {
			error_print();
			return ret;
		}

	}

	conn->state = next_state;

	tls_clean_record(conn);

	return 1;
}

int tls13_client_handshake(TLS_CONNECT *conn)
{
	int ret;

	while (conn->state != TLS_state_handshake_over) {

		ret = tls13_do_client_handshake(conn);

		if (ret != 1) {
			if (ret != TLS_ERROR_RECV_AGAIN && ret != TLS_ERROR_SEND_AGAIN) {
				error_print();
			}
			return ret;
		}
	}

	// TODO: cleanup conn?

	return 1;
}

int tls13_server_handshake(TLS_CONNECT *conn)
{
	int ret;

	while (conn->state != TLS_state_handshake_over) {

		ret = tls13_do_server_handshake(conn);

		if (ret != 1) {
			if (ret != TLS_ERROR_RECV_AGAIN && ret != TLS_ERROR_SEND_AGAIN) {
				error_print();
			}
			return ret;
		}
	}

	// TODO: cleanup conn?

	return 1;
}

int tls13_do_connect(TLS_CONNECT *conn)
{
	int ret;
	fd_set rfds;
	fd_set wfds;

	// 应该把protocol_version的初始化放在这里

	conn->state = TLS_state_client_hello;
	sm3_init(&conn->sm3_ctx);

	while (1) {

		ret = tls13_client_handshake(conn);
		if (ret == 1) {
			break;

		} else if (ret == TLS_ERROR_SEND_AGAIN) {
			FD_ZERO(&rfds);
			FD_ZERO(&wfds);
			FD_SET(conn->sock, &rfds);
			select(conn->sock + 1, &rfds, &wfds, NULL, NULL);

		} else if (ret == TLS_ERROR_RECV_AGAIN) {
			FD_ZERO(&rfds);
			FD_ZERO(&wfds);
			FD_SET(conn->sock, &wfds);
			select(conn->sock + 1, &rfds, &wfds, NULL, NULL);

		} else {
			error_print();
			return -1;
		}
	}

	fprintf(stderr, "tls13_do_connect: connected\n");

	return 1;
}

int tls13_do_accept(TLS_CONNECT *conn)
{
	int ret;
	fd_set rfds;
	fd_set wfds;

	conn->state = TLS_state_client_hello;

	sm3_init(&conn->sm3_ctx);

	fprintf(stderr, "tls13_do_accept\n");


	while (1) {

		ret = tls13_server_handshake(conn);

		if (ret == 1) {
			break;

		} else if (ret == TLS_ERROR_SEND_AGAIN) {
			FD_ZERO(&rfds);
			FD_ZERO(&wfds);
			FD_SET(conn->sock, &rfds);
			select(conn->sock + 1, &rfds, &wfds, NULL, NULL);

		} else if (ret == TLS_ERROR_RECV_AGAIN) {
			FD_ZERO(&rfds);
			FD_ZERO(&wfds);
			FD_SET(conn->sock, &wfds);
			select(conn->sock + 1, &rfds, &wfds, NULL, NULL);

		} else {
			error_print();
			return -1;
		}
	}

	fprintf(stderr, "tls13_do_accept: connected\n");

	return 1;
}

// 这个函数应该是属于key_share的，不要放在这个函数里面
int tls13_ctx_set_max_key_exchanges(TLS_CTX *ctx, size_t cnt)
{
	size_t key_exchanges_capacity
		= sizeof(((TLS_CONNECT *)0)->key_exchanges)/sizeof(((TLS_CONNECT *)0)->key_exchanges[0]);

	if (!ctx) {
		error_print();
		return -1;
	}
	if (cnt > key_exchanges_capacity) {
		cnt = key_exchanges_capacity;
	}
	ctx->key_exchanges_cnt = cnt;
	return 1;
}

int tls13_enable_post_handshake_auth(TLS_CONNECT *conn)
{
	if (!conn) {
		error_print();
		return -1;
	}
	conn->post_handshake_auth = 1;
	return 1;
}