2009-11-05 23:44:32 +00:00
|
|
|
// Copyright 2009 The Go Authors. All rights reserved.
|
|
|
|
// Use of this source code is governed by a BSD-style
|
|
|
|
// license that can be found in the LICENSE file.
|
|
|
|
|
|
|
|
package tls
|
|
|
|
|
|
|
|
// The handshake goroutine reads handshake messages from the record processor
|
|
|
|
// and outputs messages to be written on another channel. It updates the record
|
|
|
|
// processor with the state of the connection via the control channel. In the
|
|
|
|
// case of handshake messages that need synchronous processing (because they
|
|
|
|
// affect the handling of the next record) the record processor knows about
|
|
|
|
// them and either waits for a control message (Finished) or includes a reply
|
|
|
|
// channel in the message (ChangeCipherSpec).
|
|
|
|
|
|
|
|
import (
|
2009-12-15 23:33:31 +00:00
|
|
|
"crypto/hmac"
|
|
|
|
"crypto/rc4"
|
|
|
|
"crypto/rsa"
|
|
|
|
"crypto/subtle"
|
2010-08-16 16:22:22 +01:00
|
|
|
"crypto/x509"
|
2009-12-15 23:33:31 +00:00
|
|
|
"io"
|
2010-04-27 06:19:04 +01:00
|
|
|
"os"
|
2009-11-05 23:44:32 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
type cipherSuite struct {
|
2009-12-15 23:33:31 +00:00
|
|
|
id uint16 // The number of this suite on the wire.
|
|
|
|
hashLength, cipherKeyLength int
|
2009-11-05 23:44:32 +00:00
|
|
|
// TODO(agl): need a method to create the cipher and hash interfaces.
|
|
|
|
}
|
|
|
|
|
|
|
|
var cipherSuites = []cipherSuite{
|
2010-10-22 18:06:33 +01:00
|
|
|
{TLS_RSA_WITH_RC4_128_SHA, 20, 16},
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
|
|
|
|
2010-04-27 06:19:04 +01:00
|
|
|
func (c *Conn) serverHandshake() os.Error {
|
|
|
|
config := c.config
|
|
|
|
msg, err := c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
clientHello, ok := msg.(*clientHelloMsg)
|
2009-11-05 23:44:32 +00:00
|
|
|
if !ok {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertUnexpectedMessage)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
2010-04-27 06:19:04 +01:00
|
|
|
vers, ok := mutualVersion(clientHello.vers)
|
2009-11-05 23:44:32 +00:00
|
|
|
if !ok {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertProtocolVersion)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
2010-04-27 06:19:04 +01:00
|
|
|
c.vers = vers
|
|
|
|
c.haveVers = true
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
finishedHash := newFinishedHash()
|
|
|
|
finishedHash.Write(clientHello.marshal())
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
hello := new(serverHelloMsg)
|
2009-11-05 23:44:32 +00:00
|
|
|
|
|
|
|
// We only support a single ciphersuite so we look for it in the list
|
|
|
|
// of client supported suites.
|
|
|
|
//
|
|
|
|
// TODO(agl): Add additional cipher suites.
|
2009-12-15 23:33:31 +00:00
|
|
|
var suite *cipherSuite
|
2009-11-05 23:44:32 +00:00
|
|
|
|
|
|
|
for _, id := range clientHello.cipherSuites {
|
|
|
|
for _, supported := range cipherSuites {
|
|
|
|
if supported.id == id {
|
2009-12-15 23:33:31 +00:00
|
|
|
suite = &supported
|
|
|
|
break
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
foundCompression := false
|
2009-11-05 23:44:32 +00:00
|
|
|
// We only support null compression, so check that the client offered it.
|
|
|
|
for _, compression := range clientHello.compressionMethods {
|
|
|
|
if compression == compressionNone {
|
2009-12-15 23:33:31 +00:00
|
|
|
foundCompression = true
|
|
|
|
break
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if suite == nil || !foundCompression {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertHandshakeFailure)
|
2009-12-15 23:33:31 +00:00
|
|
|
}
|
|
|
|
|
2010-04-27 06:19:04 +01:00
|
|
|
hello.vers = vers
|
2009-12-15 23:33:31 +00:00
|
|
|
hello.cipherSuite = suite.id
|
2010-12-07 21:15:15 +00:00
|
|
|
t := uint32(config.time())
|
2009-12-15 23:33:31 +00:00
|
|
|
hello.random = make([]byte, 32)
|
2010-04-27 06:19:04 +01:00
|
|
|
hello.random[0] = byte(t >> 24)
|
|
|
|
hello.random[1] = byte(t >> 16)
|
|
|
|
hello.random[2] = byte(t >> 8)
|
|
|
|
hello.random[3] = byte(t)
|
2010-12-07 21:15:15 +00:00
|
|
|
_, err = io.ReadFull(config.rand(), hello.random[4:])
|
2009-11-05 23:44:32 +00:00
|
|
|
if err != nil {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertInternalError)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
2009-12-15 23:33:31 +00:00
|
|
|
hello.compressionMethod = compressionNone
|
2009-12-23 19:13:09 +00:00
|
|
|
if clientHello.nextProtoNeg {
|
|
|
|
hello.nextProtoNeg = true
|
|
|
|
hello.nextProtos = config.NextProtos
|
|
|
|
}
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
finishedHash.Write(hello.marshal())
|
2010-04-27 06:19:04 +01:00
|
|
|
c.writeRecord(recordTypeHandshake, hello.marshal())
|
2009-11-05 23:44:32 +00:00
|
|
|
|
|
|
|
if len(config.Certificates) == 0 {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertInternalError)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
certMsg := new(certificateMsg)
|
|
|
|
certMsg.certificates = config.Certificates[0].Certificate
|
|
|
|
finishedHash.Write(certMsg.marshal())
|
2010-04-27 06:19:04 +01:00
|
|
|
c.writeRecord(recordTypeHandshake, certMsg.marshal())
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2010-08-16 16:22:22 +01:00
|
|
|
if config.AuthenticateClient {
|
|
|
|
// Request a client certificate
|
|
|
|
certReq := new(certificateRequestMsg)
|
|
|
|
certReq.certificateTypes = []byte{certTypeRSASign}
|
|
|
|
// An empty list of certificateAuthorities signals to
|
|
|
|
// the client that it may send any certificate in response
|
|
|
|
// to our request.
|
|
|
|
|
|
|
|
finishedHash.Write(certReq.marshal())
|
|
|
|
c.writeRecord(recordTypeHandshake, certReq.marshal())
|
|
|
|
}
|
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
helloDone := new(serverHelloDoneMsg)
|
|
|
|
finishedHash.Write(helloDone.marshal())
|
2010-04-27 06:19:04 +01:00
|
|
|
c.writeRecord(recordTypeHandshake, helloDone.marshal())
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2010-08-16 16:22:22 +01:00
|
|
|
var pub *rsa.PublicKey
|
|
|
|
if config.AuthenticateClient {
|
|
|
|
// Get client certificate
|
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
certMsg, ok = msg.(*certificateMsg)
|
|
|
|
if !ok {
|
|
|
|
return c.sendAlert(alertUnexpectedMessage)
|
|
|
|
}
|
|
|
|
finishedHash.Write(certMsg.marshal())
|
|
|
|
|
|
|
|
certs := make([]*x509.Certificate, len(certMsg.certificates))
|
|
|
|
for i, asn1Data := range certMsg.certificates {
|
|
|
|
cert, err := x509.ParseCertificate(asn1Data)
|
|
|
|
if err != nil {
|
2010-10-11 15:39:56 +01:00
|
|
|
c.sendAlert(alertBadCertificate)
|
|
|
|
return os.ErrorString("could not parse client's certificate: " + err.String())
|
2010-08-16 16:22:22 +01:00
|
|
|
}
|
|
|
|
certs[i] = cert
|
|
|
|
}
|
|
|
|
|
|
|
|
// TODO(agl): do better validation of certs: max path length, name restrictions etc.
|
|
|
|
for i := 1; i < len(certs); i++ {
|
|
|
|
if err := certs[i-1].CheckSignatureFrom(certs[i]); err != nil {
|
2010-10-11 15:39:56 +01:00
|
|
|
c.sendAlert(alertBadCertificate)
|
|
|
|
return os.ErrorString("could not validate certificate signature: " + err.String())
|
2010-08-16 16:22:22 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(certs) > 0 {
|
|
|
|
key, ok := certs[0].PublicKey.(*rsa.PublicKey)
|
|
|
|
if !ok {
|
|
|
|
return c.sendAlert(alertUnsupportedCertificate)
|
|
|
|
}
|
|
|
|
pub = key
|
|
|
|
c.peerCertificates = certs
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get client key exchange
|
2010-04-27 06:19:04 +01:00
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
ckx, ok := msg.(*clientKeyExchangeMsg)
|
2009-11-05 23:44:32 +00:00
|
|
|
if !ok {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertUnexpectedMessage)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
2009-12-15 23:33:31 +00:00
|
|
|
finishedHash.Write(ckx.marshal())
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2010-08-16 16:22:22 +01:00
|
|
|
// If we received a client cert in response to our certificate request message,
|
|
|
|
// the client will send us a certificateVerifyMsg immediately after the
|
|
|
|
// clientKeyExchangeMsg. This message is a MD5SHA1 digest of all preceeding
|
|
|
|
// handshake-layer messages that is signed using the private key corresponding
|
|
|
|
// to the client's certificate. This allows us to verify that the client is in
|
|
|
|
// posession of the private key of the certificate.
|
|
|
|
if len(c.peerCertificates) > 0 {
|
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
certVerify, ok := msg.(*certificateVerifyMsg)
|
|
|
|
if !ok {
|
|
|
|
return c.sendAlert(alertUnexpectedMessage)
|
|
|
|
}
|
|
|
|
|
|
|
|
digest := make([]byte, 36)
|
|
|
|
copy(digest[0:16], finishedHash.serverMD5.Sum())
|
|
|
|
copy(digest[16:36], finishedHash.serverSHA1.Sum())
|
|
|
|
err = rsa.VerifyPKCS1v15(pub, rsa.HashMD5SHA1, digest, certVerify.signature)
|
|
|
|
if err != nil {
|
2010-10-11 15:39:56 +01:00
|
|
|
c.sendAlert(alertBadCertificate)
|
|
|
|
return os.ErrorString("could not validate signature of connection nonces: " + err.String())
|
2010-08-16 16:22:22 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
finishedHash.Write(certVerify.marshal())
|
|
|
|
}
|
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
preMasterSecret := make([]byte, 48)
|
2010-12-07 21:15:15 +00:00
|
|
|
_, err = io.ReadFull(config.rand(), preMasterSecret[2:])
|
2009-11-05 23:44:32 +00:00
|
|
|
if err != nil {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertInternalError)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
|
|
|
|
2010-12-07 21:15:15 +00:00
|
|
|
err = rsa.DecryptPKCS1v15SessionKey(config.rand(), config.Certificates[0].PrivateKey, ckx.ciphertext, preMasterSecret)
|
2009-11-05 23:44:32 +00:00
|
|
|
if err != nil {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertHandshakeFailure)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
|
|
|
// We don't check the version number in the premaster secret. For one,
|
|
|
|
// by checking it, we would leak information about the validity of the
|
|
|
|
// encrypted pre-master secret. Secondly, it provides only a small
|
|
|
|
// benefit against a downgrade attack and some implementations send the
|
|
|
|
// wrong version anyway. See the discussion at the end of section
|
|
|
|
// 7.4.7.1 of RFC 4346.
|
|
|
|
|
|
|
|
masterSecret, clientMAC, serverMAC, clientKey, serverKey :=
|
2009-12-15 23:33:31 +00:00
|
|
|
keysFromPreMasterSecret11(preMasterSecret, clientHello.random, hello.random, suite.hashLength, suite.cipherKeyLength)
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
cipher, _ := rc4.NewCipher(clientKey)
|
2010-08-26 18:32:29 +01:00
|
|
|
c.in.prepareCipherSpec(cipher, hmac.NewSHA1(clientMAC))
|
2010-04-27 06:19:04 +01:00
|
|
|
c.readRecord(recordTypeChangeCipherSpec)
|
|
|
|
if err := c.error(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2009-12-23 19:13:09 +00:00
|
|
|
if hello.nextProtoNeg {
|
2010-04-27 06:19:04 +01:00
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
nextProto, ok := msg.(*nextProtoMsg)
|
2009-12-23 19:13:09 +00:00
|
|
|
if !ok {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertUnexpectedMessage)
|
2009-12-23 19:13:09 +00:00
|
|
|
}
|
|
|
|
finishedHash.Write(nextProto.marshal())
|
2010-04-27 06:19:04 +01:00
|
|
|
c.clientProtocol = nextProto.proto
|
2009-12-23 19:13:09 +00:00
|
|
|
}
|
|
|
|
|
2010-04-27 06:19:04 +01:00
|
|
|
msg, err = c.readHandshake()
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
clientFinished, ok := msg.(*finishedMsg)
|
2009-11-05 23:44:32 +00:00
|
|
|
if !ok {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertUnexpectedMessage)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
verify := finishedHash.clientSum(masterSecret)
|
2009-11-05 23:44:32 +00:00
|
|
|
if len(verify) != len(clientFinished.verifyData) ||
|
|
|
|
subtle.ConstantTimeCompare(verify, clientFinished.verifyData) != 1 {
|
2010-04-27 06:19:04 +01:00
|
|
|
return c.sendAlert(alertHandshakeFailure)
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
finishedHash.Write(clientFinished.marshal())
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
cipher2, _ := rc4.NewCipher(serverKey)
|
2010-08-26 18:32:29 +01:00
|
|
|
c.out.prepareCipherSpec(cipher2, hmac.NewSHA1(serverMAC))
|
2010-04-27 06:19:04 +01:00
|
|
|
c.writeRecord(recordTypeChangeCipherSpec, []byte{1})
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2009-12-15 23:33:31 +00:00
|
|
|
finished := new(finishedMsg)
|
|
|
|
finished.verifyData = finishedHash.serverSum(masterSecret)
|
2010-04-27 06:19:04 +01:00
|
|
|
c.writeRecord(recordTypeHandshake, finished.marshal())
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2010-04-27 06:19:04 +01:00
|
|
|
c.handshakeComplete = true
|
|
|
|
c.cipherSuite = TLS_RSA_WITH_RC4_128_SHA
|
2009-11-05 23:44:32 +00:00
|
|
|
|
2010-04-27 06:19:04 +01:00
|
|
|
return nil
|
2009-11-05 23:44:32 +00:00
|
|
|
}
|