2014-06-20 20:00:00 +01:00
|
|
|
// Copyright 2009 The Go Authors. All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
|
|
|
"bytes"
|
2014-07-18 20:03:41 +01:00
|
|
|
"crypto"
|
2014-06-20 20:00:00 +01:00
|
|
|
"crypto/ecdsa"
|
2014-08-24 06:44:23 +01:00
|
|
|
"crypto/elliptic"
|
2014-06-20 20:00:00 +01:00
|
|
|
"crypto/rsa"
|
|
|
|
"crypto/subtle"
|
|
|
|
"crypto/x509"
|
|
|
|
"encoding/asn1"
|
|
|
|
"errors"
|
|
|
|
"fmt"
|
|
|
|
"io"
|
2014-07-18 20:03:41 +01:00
|
|
|
"math/big"
|
2014-06-20 20:00:00 +01:00
|
|
|
"net"
|
|
|
|
"strconv"
|
|
|
|
)
|
|
|
|
|
|
|
|
type clientHandshakeState struct {
|
|
|
|
c *Conn
|
|
|
|
serverHello *serverHelloMsg
|
|
|
|
hello *clientHelloMsg
|
|
|
|
suite *cipherSuite
|
|
|
|
finishedHash finishedHash
|
|
|
|
masterSecret []byte
|
|
|
|
session *ClientSessionState
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *Conn) clientHandshake() error {
|
|
|
|
if c.config == nil {
|
|
|
|
c.config = defaultConfig()
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(c.config.ServerName) == 0 && !c.config.InsecureSkipVerify {
|
|
|
|
return errors.New("tls: either ServerName or InsecureSkipVerify must be specified in the tls.Config")
|
|
|
|
}
|
|
|
|
|
2014-08-04 06:23:53 +01:00
|
|
|
c.sendHandshakeSeq = 0
|
|
|
|
c.recvHandshakeSeq = 0
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
hello := &clientHelloMsg{
|
2014-08-04 06:23:53 +01:00
|
|
|
isDTLS: c.isDTLS,
|
2014-06-20 20:00:00 +01:00
|
|
|
vers: c.config.maxVersion(),
|
|
|
|
compressionMethods: []uint8{compressionNone},
|
|
|
|
random: make([]byte, 32),
|
|
|
|
ocspStapling: true,
|
|
|
|
serverName: c.config.ServerName,
|
|
|
|
supportedCurves: c.config.curvePreferences(),
|
|
|
|
supportedPoints: []uint8{pointFormatUncompressed},
|
|
|
|
nextProtoNeg: len(c.config.NextProtos) > 0,
|
|
|
|
secureRenegotiation: true,
|
2014-07-05 05:23:20 +01:00
|
|
|
duplicateExtension: c.config.Bugs.DuplicateExtension,
|
2014-08-24 06:44:23 +01:00
|
|
|
channelIDSupported: c.config.ChannelID != nil,
|
2014-06-20 20:00:00 +01:00
|
|
|
}
|
|
|
|
|
2014-08-08 18:24:34 +01:00
|
|
|
if c.config.Bugs.SendClientVersion != 0 {
|
|
|
|
hello.vers = c.config.Bugs.SendClientVersion
|
|
|
|
}
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
possibleCipherSuites := c.config.cipherSuites()
|
|
|
|
hello.cipherSuites = make([]uint16, 0, len(possibleCipherSuites))
|
|
|
|
|
|
|
|
NextCipherSuite:
|
|
|
|
for _, suiteId := range possibleCipherSuites {
|
|
|
|
for _, suite := range cipherSuites {
|
|
|
|
if suite.id != suiteId {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
// Don't advertise TLS 1.2-only cipher suites unless
|
|
|
|
// we're attempting TLS 1.2.
|
|
|
|
if hello.vers < VersionTLS12 && suite.flags&suiteTLS12 != 0 {
|
|
|
|
continue
|
|
|
|
}
|
2014-08-04 06:23:53 +01:00
|
|
|
// Don't advertise non-DTLS cipher suites on DTLS.
|
|
|
|
if c.isDTLS && suite.flags&suiteNoDTLS != 0 {
|
|
|
|
continue
|
|
|
|
}
|
2014-06-20 20:00:00 +01:00
|
|
|
hello.cipherSuites = append(hello.cipherSuites, suiteId)
|
|
|
|
continue NextCipherSuite
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-08-02 09:22:02 +01:00
|
|
|
if c.config.Bugs.SendFallbackSCSV {
|
|
|
|
hello.cipherSuites = append(hello.cipherSuites, fallbackSCSV)
|
|
|
|
}
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
_, err := io.ReadFull(c.config.rand(), hello.random)
|
|
|
|
if err != nil {
|
|
|
|
c.sendAlert(alertInternalError)
|
|
|
|
return errors.New("tls: short read from Rand: " + err.Error())
|
|
|
|
}
|
|
|
|
|
|
|
|
if hello.vers >= VersionTLS12 {
|
|
|
|
hello.signatureAndHashes = supportedSKXSignatureAlgorithms
|
|
|
|
}
|
|
|
|
|
|
|
|
var session *ClientSessionState
|
|
|
|
var cacheKey string
|
|
|
|
sessionCache := c.config.ClientSessionCache
|
|
|
|
if c.config.SessionTicketsDisabled {
|
|
|
|
sessionCache = nil
|
|
|
|
}
|
|
|
|
|
|
|
|
if sessionCache != nil {
|
|
|
|
hello.ticketSupported = true
|
|
|
|
|
|
|
|
// Try to resume a previously negotiated TLS session, if
|
|
|
|
// available.
|
|
|
|
cacheKey = clientSessionCacheKey(c.conn.RemoteAddr(), c.config)
|
|
|
|
candidateSession, ok := sessionCache.Get(cacheKey)
|
|
|
|
if ok {
|
|
|
|
// Check that the ciphersuite/version used for the
|
|
|
|
// previous session are still valid.
|
|
|
|
cipherSuiteOk := false
|
|
|
|
for _, id := range hello.cipherSuites {
|
|
|
|
if id == candidateSession.cipherSuite {
|
|
|
|
cipherSuiteOk = true
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
versOk := candidateSession.vers >= c.config.minVersion() &&
|
|
|
|
candidateSession.vers <= c.config.maxVersion()
|
|
|
|
if versOk && cipherSuiteOk {
|
|
|
|
session = candidateSession
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if session != nil {
|
|
|
|
hello.sessionTicket = session.sessionTicket
|
|
|
|
// A random session ID is used to detect when the
|
|
|
|
// server accepted the ticket and is resuming a session
|
|
|
|
// (see RFC 5077).
|
|
|
|
hello.sessionId = make([]byte, 16)
|
|
|
|
if _, err := io.ReadFull(c.config.rand(), hello.sessionId); err != nil {
|
|
|
|
c.sendAlert(alertInternalError)
|
|
|
|
return errors.New("tls: short read from Rand: " + err.Error())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-08-02 09:07:12 +01:00
|
|
|
var helloBytes []byte
|
|
|
|
if c.config.Bugs.SendV2ClientHello {
|
|
|
|
v2Hello := &v2ClientHelloMsg{
|
|
|
|
vers: hello.vers,
|
|
|
|
cipherSuites: hello.cipherSuites,
|
|
|
|
// No session resumption for V2ClientHello.
|
|
|
|
sessionId: nil,
|
|
|
|
challenge: hello.random,
|
|
|
|
}
|
|
|
|
helloBytes = v2Hello.marshal()
|
|
|
|
c.writeV2Record(helloBytes)
|
|
|
|
} else {
|
|
|
|
helloBytes = hello.marshal()
|
|
|
|
c.writeRecord(recordTypeHandshake, helloBytes)
|
|
|
|
}
|
2014-06-20 20:00:00 +01:00
|
|
|
|
|
|
|
msg, err := c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2014-08-04 06:23:53 +01:00
|
|
|
|
|
|
|
if c.isDTLS {
|
|
|
|
helloVerifyRequest, ok := msg.(*helloVerifyRequestMsg)
|
|
|
|
if ok {
|
2014-08-16 17:07:27 +01:00
|
|
|
if helloVerifyRequest.vers != VersionTLS10 {
|
|
|
|
// Per RFC 6347, the version field in
|
|
|
|
// HelloVerifyRequest SHOULD be always DTLS
|
|
|
|
// 1.0. Enforce this for testing purposes.
|
|
|
|
return errors.New("dtls: bad HelloVerifyRequest version")
|
|
|
|
}
|
|
|
|
|
2014-08-04 06:23:53 +01:00
|
|
|
hello.raw = nil
|
|
|
|
hello.cookie = helloVerifyRequest.cookie
|
|
|
|
helloBytes = hello.marshal()
|
|
|
|
c.writeRecord(recordTypeHandshake, helloBytes)
|
|
|
|
|
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
serverHello, ok := msg.(*serverHelloMsg)
|
|
|
|
if !ok {
|
|
|
|
c.sendAlert(alertUnexpectedMessage)
|
|
|
|
return unexpectedMessageError(serverHello, msg)
|
|
|
|
}
|
|
|
|
|
2014-08-14 21:25:34 +01:00
|
|
|
c.vers, ok = c.config.mutualVersion(serverHello.vers)
|
|
|
|
if !ok {
|
2014-06-20 20:00:00 +01:00
|
|
|
c.sendAlert(alertProtocolVersion)
|
|
|
|
return fmt.Errorf("tls: server selected unsupported protocol version %x", serverHello.vers)
|
|
|
|
}
|
|
|
|
c.haveVers = true
|
|
|
|
|
|
|
|
suite := mutualCipherSuite(c.config.cipherSuites(), serverHello.cipherSuite)
|
|
|
|
if suite == nil {
|
|
|
|
c.sendAlert(alertHandshakeFailure)
|
|
|
|
return fmt.Errorf("tls: server selected an unsupported cipher suite")
|
|
|
|
}
|
|
|
|
|
|
|
|
hs := &clientHandshakeState{
|
|
|
|
c: c,
|
|
|
|
serverHello: serverHello,
|
|
|
|
hello: hello,
|
|
|
|
suite: suite,
|
|
|
|
finishedHash: newFinishedHash(c.vers, suite),
|
|
|
|
session: session,
|
|
|
|
}
|
|
|
|
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeHash(helloBytes, hs.c.sendHandshakeSeq-1)
|
|
|
|
hs.writeServerHash(hs.serverHello.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
|
2014-07-22 03:42:34 +01:00
|
|
|
if c.config.Bugs.EarlyChangeCipherSpec > 0 {
|
|
|
|
hs.establishKeys()
|
|
|
|
c.writeRecord(recordTypeChangeCipherSpec, []byte{1})
|
|
|
|
}
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
isResume, err := hs.processServerHello()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
if isResume {
|
2014-07-22 03:42:34 +01:00
|
|
|
if c.config.Bugs.EarlyChangeCipherSpec == 0 {
|
|
|
|
if err := hs.establishKeys(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2014-06-20 20:00:00 +01:00
|
|
|
}
|
|
|
|
if err := hs.readSessionTicket(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := hs.readFinished(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2014-08-24 06:44:23 +01:00
|
|
|
if err := hs.sendFinished(isResume); err != nil {
|
2014-06-20 20:00:00 +01:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
if err := hs.doFullHandshake(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := hs.establishKeys(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2014-08-24 06:44:23 +01:00
|
|
|
if err := hs.sendFinished(isResume); err != nil {
|
2014-06-20 20:00:00 +01:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := hs.readSessionTicket(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := hs.readFinished(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if sessionCache != nil && hs.session != nil && session != hs.session {
|
|
|
|
sessionCache.Put(cacheKey, hs.session)
|
|
|
|
}
|
|
|
|
|
|
|
|
c.didResume = isResume
|
|
|
|
c.handshakeComplete = true
|
|
|
|
c.cipherSuite = suite.id
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (hs *clientHandshakeState) doFullHandshake() error {
|
|
|
|
c := hs.c
|
|
|
|
|
|
|
|
msg, err := c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
certMsg, ok := msg.(*certificateMsg)
|
|
|
|
if !ok || len(certMsg.certificates) == 0 {
|
|
|
|
c.sendAlert(alertUnexpectedMessage)
|
|
|
|
return unexpectedMessageError(certMsg, msg)
|
|
|
|
}
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeServerHash(certMsg.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
|
|
|
|
certs := make([]*x509.Certificate, len(certMsg.certificates))
|
|
|
|
for i, asn1Data := range certMsg.certificates {
|
|
|
|
cert, err := x509.ParseCertificate(asn1Data)
|
|
|
|
if err != nil {
|
|
|
|
c.sendAlert(alertBadCertificate)
|
|
|
|
return errors.New("tls: failed to parse certificate from server: " + err.Error())
|
|
|
|
}
|
|
|
|
certs[i] = cert
|
|
|
|
}
|
|
|
|
|
|
|
|
if !c.config.InsecureSkipVerify {
|
|
|
|
opts := x509.VerifyOptions{
|
|
|
|
Roots: c.config.RootCAs,
|
|
|
|
CurrentTime: c.config.time(),
|
|
|
|
DNSName: c.config.ServerName,
|
|
|
|
Intermediates: x509.NewCertPool(),
|
|
|
|
}
|
|
|
|
|
|
|
|
for i, cert := range certs {
|
|
|
|
if i == 0 {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
opts.Intermediates.AddCert(cert)
|
|
|
|
}
|
|
|
|
c.verifiedChains, err = certs[0].Verify(opts)
|
|
|
|
if err != nil {
|
|
|
|
c.sendAlert(alertBadCertificate)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
switch certs[0].PublicKey.(type) {
|
|
|
|
case *rsa.PublicKey, *ecdsa.PublicKey:
|
|
|
|
break
|
|
|
|
default:
|
|
|
|
c.sendAlert(alertUnsupportedCertificate)
|
|
|
|
return fmt.Errorf("tls: server's certificate contains an unsupported type of public key: %T", certs[0].PublicKey)
|
|
|
|
}
|
|
|
|
|
|
|
|
c.peerCertificates = certs
|
|
|
|
|
|
|
|
if hs.serverHello.ocspStapling {
|
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
cs, ok := msg.(*certificateStatusMsg)
|
|
|
|
if !ok {
|
|
|
|
c.sendAlert(alertUnexpectedMessage)
|
|
|
|
return unexpectedMessageError(cs, msg)
|
|
|
|
}
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeServerHash(cs.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
|
|
|
|
if cs.statusType == statusTypeOCSP {
|
|
|
|
c.ocspResponse = cs.response
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
keyAgreement := hs.suite.ka(c.vers)
|
|
|
|
|
|
|
|
skx, ok := msg.(*serverKeyExchangeMsg)
|
|
|
|
if ok {
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeServerHash(skx.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
err = keyAgreement.processServerKeyExchange(c.config, hs.hello, hs.serverHello, certs[0], skx)
|
|
|
|
if err != nil {
|
|
|
|
c.sendAlert(alertUnexpectedMessage)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
var chainToSend *Certificate
|
|
|
|
var certRequested bool
|
|
|
|
certReq, ok := msg.(*certificateRequestMsg)
|
|
|
|
if ok {
|
|
|
|
certRequested = true
|
|
|
|
|
|
|
|
// RFC 4346 on the certificateAuthorities field:
|
|
|
|
// A list of the distinguished names of acceptable certificate
|
|
|
|
// authorities. These distinguished names may specify a desired
|
|
|
|
// distinguished name for a root CA or for a subordinate CA;
|
|
|
|
// thus, this message can be used to describe both known roots
|
|
|
|
// and a desired authorization space. If the
|
|
|
|
// certificate_authorities list is empty then the client MAY
|
|
|
|
// send any certificate of the appropriate
|
|
|
|
// ClientCertificateType, unless there is some external
|
|
|
|
// arrangement to the contrary.
|
|
|
|
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeServerHash(certReq.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
|
|
|
|
var rsaAvail, ecdsaAvail bool
|
|
|
|
for _, certType := range certReq.certificateTypes {
|
|
|
|
switch certType {
|
2014-07-08 22:30:11 +01:00
|
|
|
case CertTypeRSASign:
|
2014-06-20 20:00:00 +01:00
|
|
|
rsaAvail = true
|
2014-07-08 22:30:11 +01:00
|
|
|
case CertTypeECDSASign:
|
2014-06-20 20:00:00 +01:00
|
|
|
ecdsaAvail = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// We need to search our list of client certs for one
|
|
|
|
// where SignatureAlgorithm is RSA and the Issuer is in
|
|
|
|
// certReq.certificateAuthorities
|
|
|
|
findCert:
|
|
|
|
for i, chain := range c.config.Certificates {
|
|
|
|
if !rsaAvail && !ecdsaAvail {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
for j, cert := range chain.Certificate {
|
|
|
|
x509Cert := chain.Leaf
|
|
|
|
// parse the certificate if this isn't the leaf
|
|
|
|
// node, or if chain.Leaf was nil
|
|
|
|
if j != 0 || x509Cert == nil {
|
|
|
|
if x509Cert, err = x509.ParseCertificate(cert); err != nil {
|
|
|
|
c.sendAlert(alertInternalError)
|
|
|
|
return errors.New("tls: failed to parse client certificate #" + strconv.Itoa(i) + ": " + err.Error())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
switch {
|
|
|
|
case rsaAvail && x509Cert.PublicKeyAlgorithm == x509.RSA:
|
|
|
|
case ecdsaAvail && x509Cert.PublicKeyAlgorithm == x509.ECDSA:
|
|
|
|
default:
|
|
|
|
continue findCert
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(certReq.certificateAuthorities) == 0 {
|
|
|
|
// they gave us an empty list, so just take the
|
|
|
|
// first RSA cert from c.config.Certificates
|
|
|
|
chainToSend = &chain
|
|
|
|
break findCert
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, ca := range certReq.certificateAuthorities {
|
|
|
|
if bytes.Equal(x509Cert.RawIssuer, ca) {
|
|
|
|
chainToSend = &chain
|
|
|
|
break findCert
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
shd, ok := msg.(*serverHelloDoneMsg)
|
|
|
|
if !ok {
|
|
|
|
c.sendAlert(alertUnexpectedMessage)
|
|
|
|
return unexpectedMessageError(shd, msg)
|
|
|
|
}
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeServerHash(shd.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
|
|
|
|
// If the server requested a certificate then we have to send a
|
|
|
|
// Certificate message, even if it's empty because we don't have a
|
|
|
|
// certificate to send.
|
|
|
|
if certRequested {
|
|
|
|
certMsg = new(certificateMsg)
|
|
|
|
if chainToSend != nil {
|
|
|
|
certMsg.certificates = chainToSend.Certificate
|
|
|
|
}
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeClientHash(certMsg.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
c.writeRecord(recordTypeHandshake, certMsg.marshal())
|
|
|
|
}
|
|
|
|
|
|
|
|
preMasterSecret, ckx, err := keyAgreement.generateClientKeyExchange(c.config, hs.hello, certs[0])
|
|
|
|
if err != nil {
|
|
|
|
c.sendAlert(alertInternalError)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if ckx != nil {
|
2014-07-22 03:42:34 +01:00
|
|
|
if c.config.Bugs.EarlyChangeCipherSpec < 2 {
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeClientHash(ckx.marshal())
|
2014-07-22 03:42:34 +01:00
|
|
|
}
|
2014-06-20 20:00:00 +01:00
|
|
|
c.writeRecord(recordTypeHandshake, ckx.marshal())
|
|
|
|
}
|
|
|
|
|
|
|
|
if chainToSend != nil {
|
|
|
|
var signed []byte
|
|
|
|
certVerify := &certificateVerifyMsg{
|
|
|
|
hasSignatureAndHash: c.vers >= VersionTLS12,
|
|
|
|
}
|
|
|
|
|
|
|
|
switch key := c.config.Certificates[0].PrivateKey.(type) {
|
|
|
|
case *ecdsa.PrivateKey:
|
2014-07-18 20:03:41 +01:00
|
|
|
certVerify.signatureAndHash, err = hs.finishedHash.selectClientCertSignatureAlgorithm(certReq.signatureAndHashes, signatureECDSA)
|
|
|
|
if err != nil {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
var digest []byte
|
|
|
|
digest, _, err = hs.finishedHash.hashForClientCertificate(certVerify.signatureAndHash)
|
|
|
|
if err != nil {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
var r, s *big.Int
|
|
|
|
r, s, err = ecdsa.Sign(c.config.rand(), key, digest)
|
2014-06-20 20:00:00 +01:00
|
|
|
if err == nil {
|
|
|
|
signed, err = asn1.Marshal(ecdsaSignature{r, s})
|
|
|
|
}
|
|
|
|
case *rsa.PrivateKey:
|
2014-07-18 20:03:41 +01:00
|
|
|
certVerify.signatureAndHash, err = hs.finishedHash.selectClientCertSignatureAlgorithm(certReq.signatureAndHashes, signatureRSA)
|
|
|
|
if err != nil {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
var digest []byte
|
|
|
|
var hashFunc crypto.Hash
|
|
|
|
digest, hashFunc, err = hs.finishedHash.hashForClientCertificate(certVerify.signatureAndHash)
|
|
|
|
if err != nil {
|
|
|
|
break
|
|
|
|
}
|
2014-06-20 20:00:00 +01:00
|
|
|
signed, err = rsa.SignPKCS1v15(c.config.rand(), key, hashFunc, digest)
|
|
|
|
default:
|
|
|
|
err = errors.New("unknown private key type")
|
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
c.sendAlert(alertInternalError)
|
|
|
|
return errors.New("tls: failed to sign handshake with client certificate: " + err.Error())
|
|
|
|
}
|
|
|
|
certVerify.signature = signed
|
|
|
|
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeClientHash(certVerify.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
c.writeRecord(recordTypeHandshake, certVerify.marshal())
|
|
|
|
}
|
|
|
|
|
|
|
|
hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.hello.random, hs.serverHello.random)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (hs *clientHandshakeState) establishKeys() error {
|
|
|
|
c := hs.c
|
|
|
|
|
|
|
|
clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
|
|
|
|
keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.hello.random, hs.serverHello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
|
|
|
|
var clientCipher, serverCipher interface{}
|
|
|
|
var clientHash, serverHash macFunction
|
|
|
|
if hs.suite.cipher != nil {
|
|
|
|
clientCipher = hs.suite.cipher(clientKey, clientIV, false /* not for reading */)
|
|
|
|
clientHash = hs.suite.mac(c.vers, clientMAC)
|
|
|
|
serverCipher = hs.suite.cipher(serverKey, serverIV, true /* for reading */)
|
|
|
|
serverHash = hs.suite.mac(c.vers, serverMAC)
|
|
|
|
} else {
|
|
|
|
clientCipher = hs.suite.aead(clientKey, clientIV)
|
|
|
|
serverCipher = hs.suite.aead(serverKey, serverIV)
|
|
|
|
}
|
|
|
|
|
|
|
|
c.in.prepareCipherSpec(c.vers, serverCipher, serverHash)
|
|
|
|
c.out.prepareCipherSpec(c.vers, clientCipher, clientHash)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (hs *clientHandshakeState) serverResumedSession() bool {
|
|
|
|
// If the server responded with the same sessionId then it means the
|
|
|
|
// sessionTicket is being used to resume a TLS session.
|
|
|
|
return hs.session != nil && hs.hello.sessionId != nil &&
|
|
|
|
bytes.Equal(hs.serverHello.sessionId, hs.hello.sessionId)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (hs *clientHandshakeState) processServerHello() (bool, error) {
|
|
|
|
c := hs.c
|
|
|
|
|
|
|
|
if hs.serverHello.compressionMethod != compressionNone {
|
|
|
|
c.sendAlert(alertUnexpectedMessage)
|
|
|
|
return false, errors.New("tls: server selected unsupported compression format")
|
|
|
|
}
|
|
|
|
|
|
|
|
if !hs.hello.nextProtoNeg && hs.serverHello.nextProtoNeg {
|
|
|
|
c.sendAlert(alertHandshakeFailure)
|
|
|
|
return false, errors.New("server advertised unrequested NPN extension")
|
|
|
|
}
|
|
|
|
|
2014-08-24 06:44:23 +01:00
|
|
|
if !hs.hello.channelIDSupported && hs.serverHello.channelIDRequested {
|
|
|
|
c.sendAlert(alertHandshakeFailure)
|
|
|
|
return false, errors.New("server advertised unrequested Channel ID extension")
|
|
|
|
}
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
if hs.serverResumedSession() {
|
|
|
|
// Restore masterSecret and peerCerts from previous state
|
|
|
|
hs.masterSecret = hs.session.masterSecret
|
|
|
|
c.peerCertificates = hs.session.serverCertificates
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (hs *clientHandshakeState) readFinished() error {
|
|
|
|
c := hs.c
|
|
|
|
|
|
|
|
c.readRecord(recordTypeChangeCipherSpec)
|
|
|
|
if err := c.in.error(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
msg, err := c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
serverFinished, ok := msg.(*finishedMsg)
|
|
|
|
if !ok {
|
|
|
|
c.sendAlert(alertUnexpectedMessage)
|
|
|
|
return unexpectedMessageError(serverFinished, msg)
|
|
|
|
}
|
|
|
|
|
2014-07-22 03:42:34 +01:00
|
|
|
if c.config.Bugs.EarlyChangeCipherSpec == 0 {
|
|
|
|
verify := hs.finishedHash.serverSum(hs.masterSecret)
|
|
|
|
if len(verify) != len(serverFinished.verifyData) ||
|
|
|
|
subtle.ConstantTimeCompare(verify, serverFinished.verifyData) != 1 {
|
|
|
|
c.sendAlert(alertHandshakeFailure)
|
|
|
|
return errors.New("tls: server's Finished message was incorrect")
|
|
|
|
}
|
2014-06-20 20:00:00 +01:00
|
|
|
}
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeServerHash(serverFinished.marshal())
|
2014-06-20 20:00:00 +01:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (hs *clientHandshakeState) readSessionTicket() error {
|
|
|
|
if !hs.serverHello.ticketSupported {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
c := hs.c
|
|
|
|
msg, err := c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
sessionTicketMsg, ok := msg.(*newSessionTicketMsg)
|
|
|
|
if !ok {
|
|
|
|
c.sendAlert(alertUnexpectedMessage)
|
|
|
|
return unexpectedMessageError(sessionTicketMsg, msg)
|
|
|
|
}
|
|
|
|
|
|
|
|
hs.session = &ClientSessionState{
|
|
|
|
sessionTicket: sessionTicketMsg.ticket,
|
|
|
|
vers: c.vers,
|
|
|
|
cipherSuite: hs.suite.id,
|
|
|
|
masterSecret: hs.masterSecret,
|
2014-08-24 06:44:23 +01:00
|
|
|
handshakeHash: hs.finishedHash.server.Sum(nil),
|
2014-06-20 20:00:00 +01:00
|
|
|
serverCertificates: c.peerCertificates,
|
|
|
|
}
|
|
|
|
|
2014-08-24 06:44:23 +01:00
|
|
|
hs.writeServerHash(sessionTicketMsg.marshal())
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2014-08-24 06:44:23 +01:00
|
|
|
func (hs *clientHandshakeState) sendFinished(isResume bool) error {
|
2014-06-20 20:00:00 +01:00
|
|
|
c := hs.c
|
|
|
|
|
2014-07-21 21:14:03 +01:00
|
|
|
var postCCSBytes []byte
|
2014-08-04 06:23:53 +01:00
|
|
|
seqno := hs.c.sendHandshakeSeq
|
2014-06-20 20:00:00 +01:00
|
|
|
if hs.serverHello.nextProtoNeg {
|
|
|
|
nextProto := new(nextProtoMsg)
|
|
|
|
proto, fallback := mutualProtocol(c.config.NextProtos, hs.serverHello.nextProtos)
|
|
|
|
nextProto.proto = proto
|
|
|
|
c.clientProtocol = proto
|
|
|
|
c.clientProtocolFallback = fallback
|
|
|
|
|
2014-07-21 21:14:03 +01:00
|
|
|
nextProtoBytes := nextProto.marshal()
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeHash(nextProtoBytes, seqno)
|
|
|
|
seqno++
|
2014-07-21 21:14:03 +01:00
|
|
|
postCCSBytes = append(postCCSBytes, nextProtoBytes...)
|
2014-06-20 20:00:00 +01:00
|
|
|
}
|
|
|
|
|
2014-08-24 06:44:23 +01:00
|
|
|
if hs.serverHello.channelIDRequested {
|
|
|
|
encryptedExtensions := new(encryptedExtensionsMsg)
|
|
|
|
if c.config.ChannelID.Curve != elliptic.P256() {
|
|
|
|
return fmt.Errorf("tls: Channel ID is not on P-256.")
|
|
|
|
}
|
|
|
|
var resumeHash []byte
|
|
|
|
if isResume {
|
|
|
|
resumeHash = hs.session.handshakeHash
|
|
|
|
}
|
|
|
|
r, s, err := ecdsa.Sign(c.config.rand(), c.config.ChannelID, hs.finishedHash.hashForChannelID(resumeHash))
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
channelID := make([]byte, 128)
|
|
|
|
writeIntPadded(channelID[0:32], c.config.ChannelID.X)
|
|
|
|
writeIntPadded(channelID[32:64], c.config.ChannelID.Y)
|
|
|
|
writeIntPadded(channelID[64:96], r)
|
|
|
|
writeIntPadded(channelID[96:128], s)
|
|
|
|
encryptedExtensions.channelID = channelID
|
|
|
|
|
|
|
|
c.channelID = &c.config.ChannelID.PublicKey
|
|
|
|
|
|
|
|
encryptedExtensionsBytes := encryptedExtensions.marshal()
|
|
|
|
hs.writeHash(encryptedExtensionsBytes, seqno)
|
|
|
|
seqno++
|
|
|
|
postCCSBytes = append(postCCSBytes, encryptedExtensionsBytes...)
|
|
|
|
}
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
finished := new(finishedMsg)
|
2014-07-22 03:42:34 +01:00
|
|
|
if c.config.Bugs.EarlyChangeCipherSpec == 2 {
|
|
|
|
finished.verifyData = hs.finishedHash.clientSum(nil)
|
|
|
|
} else {
|
|
|
|
finished.verifyData = hs.finishedHash.clientSum(hs.masterSecret)
|
|
|
|
}
|
2014-07-21 21:14:03 +01:00
|
|
|
finishedBytes := finished.marshal()
|
2014-08-04 06:23:53 +01:00
|
|
|
hs.writeHash(finishedBytes, seqno)
|
2014-07-21 21:14:03 +01:00
|
|
|
postCCSBytes = append(postCCSBytes, finishedBytes...)
|
|
|
|
|
|
|
|
if c.config.Bugs.FragmentAcrossChangeCipherSpec {
|
|
|
|
c.writeRecord(recordTypeHandshake, postCCSBytes[:5])
|
|
|
|
postCCSBytes = postCCSBytes[5:]
|
|
|
|
}
|
|
|
|
|
|
|
|
if !c.config.Bugs.SkipChangeCipherSpec &&
|
|
|
|
c.config.Bugs.EarlyChangeCipherSpec == 0 {
|
|
|
|
c.writeRecord(recordTypeChangeCipherSpec, []byte{1})
|
|
|
|
}
|
|
|
|
|
|
|
|
c.writeRecord(recordTypeHandshake, postCCSBytes)
|
2014-06-20 20:00:00 +01:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2014-08-04 06:23:53 +01:00
|
|
|
func (hs *clientHandshakeState) writeClientHash(msg []byte) {
|
|
|
|
// writeClientHash is called before writeRecord.
|
|
|
|
hs.writeHash(msg, hs.c.sendHandshakeSeq)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (hs *clientHandshakeState) writeServerHash(msg []byte) {
|
|
|
|
// writeServerHash is called after readHandshake.
|
|
|
|
hs.writeHash(msg, hs.c.recvHandshakeSeq-1)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (hs *clientHandshakeState) writeHash(msg []byte, seqno uint16) {
|
|
|
|
if hs.c.isDTLS {
|
|
|
|
// This is somewhat hacky. DTLS hashes a slightly different format.
|
|
|
|
// First, the TLS header.
|
|
|
|
hs.finishedHash.Write(msg[:4])
|
|
|
|
// Then the sequence number and reassembled fragment offset (always 0).
|
|
|
|
hs.finishedHash.Write([]byte{byte(seqno >> 8), byte(seqno), 0, 0, 0})
|
|
|
|
// Then the reassembled fragment (always equal to the message length).
|
|
|
|
hs.finishedHash.Write(msg[1:4])
|
|
|
|
// And then the message body.
|
|
|
|
hs.finishedHash.Write(msg[4:])
|
|
|
|
} else {
|
|
|
|
hs.finishedHash.Write(msg)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-06-20 20:00:00 +01:00
|
|
|
// clientSessionCacheKey returns a key used to cache sessionTickets that could
|
|
|
|
// be used to resume previously negotiated TLS sessions with a server.
|
|
|
|
func clientSessionCacheKey(serverAddr net.Addr, config *Config) string {
|
|
|
|
if len(config.ServerName) > 0 {
|
|
|
|
return config.ServerName
|
|
|
|
}
|
|
|
|
return serverAddr.String()
|
|
|
|
}
|
|
|
|
|
|
|
|
// mutualProtocol finds the mutual Next Protocol Negotiation protocol given the
|
|
|
|
// set of client and server supported protocols. The set of client supported
|
|
|
|
// protocols must not be empty. It returns the resulting protocol and flag
|
|
|
|
// indicating if the fallback case was reached.
|
|
|
|
func mutualProtocol(clientProtos, serverProtos []string) (string, bool) {
|
|
|
|
for _, s := range serverProtos {
|
|
|
|
for _, c := range clientProtos {
|
|
|
|
if s == c {
|
|
|
|
return s, false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return clientProtos[0], true
|
|
|
|
}
|
2014-08-24 06:44:23 +01:00
|
|
|
|
|
|
|
// writeIntPadded writes x into b, padded up with leading zeros as
|
|
|
|
// needed.
|
|
|
|
func writeIntPadded(b []byte, x *big.Int) {
|
|
|
|
for i := range b {
|
|
|
|
b[i] = 0
|
|
|
|
}
|
|
|
|
xb := x.Bytes()
|
|
|
|
copy(b[len(b)-len(xb):], xb)
|
|
|
|
}
|