kris/th5
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
539 Commits 3 Branches 0 Tags 2.6 MiB
cb67de3e1f
Commit Graph

539 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Filippo Valsorda
80f82d89c7 crypto/tls: avoid sending empty OCSP or SCT cert extensions 2017-09-05 21:06:35 +01:00
Filippo Valsorda
815d56e5a7 tris: update README for public consumption 2017-09-05 21:06:35 +01:00
Filippo Valsorda
4f7b5988a3 crypto/tls: add ConnectionState.Unique0RTTToken 2017-09-05 21:06:35 +01:00
Filippo Valsorda
563bf91c28 tris: update to Go 1.8rc3+ 2017-09-05 21:06:35 +01:00
Filippo Valsorda
0d97989e0d tris: move Commit to just before key share generation 
In particular move it to after cipher suite negotiation and after
HelloRetryRequest check.
 2017-09-05 21:06:35 +01:00
Brendan Mc
ed105dc308 crypto/tls: add SignedCertificateTimestamps and OCSPStaple to 1.3 2017-09-05 21:06:35 +01:00
Filippo Valsorda
9b94b65b7b crypto/tls: send two session tickets to TLS 1.3 clients 2017-09-05 21:06:35 +01:00
Filippo Valsorda
44df381ccb crypto/tls: peek at unencrypted alerts to give better errors 2017-09-05 21:06:35 +01:00
Filippo Valsorda
740fc926aa tris: add single line TLSDEBUG=short 2017-09-05 21:06:35 +01:00
Filippo Valsorda
7aa542753f tris: update to Go 1.8rc2 2017-09-05 21:06:35 +01:00
Filippo Valsorda
6bff168a06 tris: add proper BoGo tests 2017-09-05 21:06:35 +01:00
Filippo Valsorda
c758567785 crypto/tls: detect unexpected leftover handshake data 
There should be no data in the Handshake buffer on encryption state
changes (including implicit 1.3 transitions). Checking that also blocks
all Handshake messages fragmented across CCS.

BoGo: PartialClientFinishedWithClientHello
 2017-09-05 21:06:35 +01:00
Filippo Valsorda
de613b152d crypto/tls: disallow handshake messages fragmented across CCS 
BoGo: FragmentAcrossChangeCipherSpec-Server-Packed
 2017-09-05 21:06:35 +01:00
Filippo Valsorda
4191962f25 crypto/tls: use correct alerts 
BoGo: Resume-Server-PSKBinderFirstExtension
BoGo: Resume-Server-ExtraPSKBinder
BoGo: Resume-Server-ExtraIdentityNoBinder
BoGo: Renegotiate-Server-Forbidden
BoGo: NoNullCompression
BoGo: TrailingMessageData-*
 2017-09-05 21:06:35 +01:00
Filippo Valsorda
5406418371 crypto/tls: fix panic in PSK binders parsing 
BoGo: Resume-Server-ExtraPSKBinder
 2017-09-05 21:06:35 +01:00
Filippo Valsorda
bbb712bfd8 crypto/tls: simplify supported points handling to match BoringSSL 
BoGo: PointFormat-Server-*
 2017-09-05 21:06:35 +01:00
Filippo Valsorda
922b99e473 crypto/tls: make 1.3 version negotiation more robust 
BoGo: IgnoreClientVersionOrder
BoGO: *VersionTolerance
BoGo: RejectFinalTLS13
 2017-09-05 21:06:34 +01:00
Filippo Valsorda
58aab36b6e crypto/tls: use negotiated version for fallback check 
BoGo: FallbackSCSV-VersionMatch-TLS13
 2017-09-05 21:06:34 +01:00
EKR
ed06c77b1d crypto/tls: fix clientHelloMsg fuzzer not to generate the RI SCSV 
It was causing mysterious fuzzing failure because it affects the
unmarshaling of the secureNegotiationSupported field.
 2017-09-05 21:06:34 +01:00
Filippo Valsorda
147d78ad99 tris: switch to Go 1.8beta1 2017-09-05 21:06:34 +01:00
Filippo Valsorda
052978de5e crypto/tls: expose extension versions in ClientHelloInfo.SupportedVersions 2017-09-05 21:06:34 +01:00
Filippo Valsorda
1bc19494f8 tris: tolerate NSS sending obfuscated_ticket_age as seconds 2017-09-05 21:06:34 +01:00
Filippo Valsorda
faefac5f1a crypto/tls: stop ConfirmHandshake from locking on any Read 
ConfirmHandshake should block on a Read until the handshakeConfirmed
state is reached, but past that it shouldn't.
 2017-09-05 21:06:34 +01:00
Filippo Valsorda
1b03258899 crypto/tls: simplify the Handshake locking 
See https://groups.google.com/forum/#!topic/golang-dev/Xxiai-R_jH0

Change-Id: I6052695ece9aff9e3112c2fb176596fde8aa9cb2
 2017-09-05 21:06:34 +01:00
Filippo Valsorda
341de96a61 crypto/tls: fix Conn.phase data races 
Phase should only be accessed under in.Mutex. Handshake and all Read
operations obtain that lock. However, many functions checking for
handshakeRunning only obtain handshakeMutex: reintroduce
handshakeCompleted for them. ConnectionState and Close check for
handshakeConfirmed, introduce an atomic flag for them.
 2017-09-05 21:06:34 +01:00
Filippo Valsorda
f3fe024dc7 crypto/tls: do not drain 0-RTT data on Close 
There is no reason a server can't just send a CloseNotify in its first
flight, and then close the connection without reading the 0-RTT data.

Also, it's not expected of Close to block on reading, and interlocking
with a Read can cause a deadlock.

Fixes NCC-2016-001
 2017-09-05 21:06:34 +01:00
Filippo Valsorda
3e31621f57 crypto/tls: pick the first group the client sent a key share for 
Fixes NCC-2016-002
 2017-09-05 21:06:34 +01:00
Filippo Valsorda
831410a948 tris: fix cross-compilation and relocation 2017-09-05 21:06:34 +01:00
Filippo Valsorda
345fbe2a39 tris: fix http2 tls.Conn context 2017-09-05 21:06:34 +01:00
Filippo Valsorda
df557b2b05 tris: fix NSS 0-RTT interop 2017-09-05 21:06:34 +01:00
Filippo Valsorda
5c4af70647 tris: drop QuietError 2017-09-05 21:06:34 +01:00
Filippo Valsorda
2b667f2952 tris: fix mint interop 2017-09-05 21:06:34 +01:00
Filippo Valsorda
180bfdbd68 crypto/tls: finish the session ticket state checks 2017-09-05 21:06:34 +01:00
Filippo Valsorda
6ca044cede tris: add picotls interop 2017-09-05 21:06:34 +01:00
Filippo Valsorda
f8c15889af crypto/tls: implement TLS 1.3 server 0-RTT 2017-09-05 21:06:34 +01:00
Filippo Valsorda
1117f76fcc crypto/tls: return from Handshake before the Client Finished in 1.3 2017-09-05 21:06:34 +01:00
Filippo Valsorda
ee3048cfd2 crypto/tls: implement TLS 1.3 server PSK 2017-09-05 21:06:34 +01:00
Filippo Valsorda
453bd6af77 crypto/tls: implement TLS 1.3 PSK messages 2017-09-05 21:06:34 +01:00
Filippo Valsorda
6c3765bb15 tris: add error tracing with CH dumping 2017-09-05 21:06:34 +01:00
Filippo Valsorda
ea17b0c225 tris: implement Committer 2017-09-05 21:06:34 +01:00
Filippo Valsorda
8052dc002f tris: extend ConnectionInfo 2017-09-05 21:06:34 +01:00
Filippo Valsorda
4b0d17eca3 crypto/tls: implement TLS 1.3 minimal server 2017-09-05 21:06:29 +01:00
Filippo Valsorda
b0eca83785 tris: suppress internal/testenv 2017-09-05 20:29:43 +01:00
Filippo Valsorda
6e85ff94f0 tris: import go wrapper and interoperability tests 2017-09-05 20:29:43 +01:00
Filippo Valsorda
26a95ba46a [dev.tls] crypto/tls: implement TLS 1.3 cipher suites 
I opted for adding a separate TLS13CipherSuites field to the Config
because library users that did not set Config.MaxVersion are
supposed to get TLS 1.3 support automatically, like it has been for
HTTP/2, but having set CipherSuites would effectively disable it.

Updates #9671

Change-Id: I26a2776b68374d6f5ee45629da09f9494fe723ad
 2017-09-05 20:29:39 +01:00
Filippo Valsorda
9bc837c453 [dev.tls] crypto/tls: implement TLS 1.3 messages 
Updates #9671

Change-Id: Ia1b06ae518a4b2821a584a420d99859a2666c8f0
 2017-09-05 20:27:04 +01:00
Filippo Valsorda
7743362eba [dev.tls] crypto/tls: implement TLS 1.3 record layer 
Opening the 1.3 dances with the record layer because it has been the
most stable through the drafts, has the least dependencies, and has been
tricky in my experience.

Note that the record layer version check is entirely removed according
to https://tools.ietf.org/html/draft-ietf-tls-tls13-18#appendix-C.2.

A test that happened to hit that check (but was not made to test for it)
has changed to the next error in the stack.

There are no 1.3 tests at the moment, and I suspect they will all have to
wait for the patch cycle to reach interoperability.

Using > / <= VersionTLS13 for all conditionals to transparently support
draft versions and hypotetical future versions.

See https://tools.ietf.org/html/draft-ietf-tls-tls13-18#section-5.

Updates #9671

Change-Id: I97f0a59439728f194a1c50b48cff041469a0f00b
 2017-09-05 20:27:04 +01:00
Artyom Pervukhin
dd708a5a20 crypto/tls: fix docstring of Config.ClientSessionCache 
Closes #21519

Change-Id: I1247e9435de93aae7e4db2b6e8e5be1b010c296b
Reviewed-on: https://go-review.googlesource.com/56832
Reviewed-by: Avelino <t@avelino.xxx>
Reviewed-by: Adam Langley <agl@golang.org>
 2017-08-25 22:37:26 +00:00
Filippo Valsorda
d6b90c312b crypto/tls: disallow handshake messages fragmented across CCS 
Detected by BoGo test FragmentAcrossChangeCipherSpec-Server-Packed.

Change-Id: I9a76697b9cdeb010642766041971de5c7e533481
Reviewed-on: https://go-review.googlesource.com/48811
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
 2017-08-15 18:45:06 +00:00
Filippo Valsorda
66a1e759f3 crypto/tls: add BenchmarkHandshakeServer 
name                                       time/op
HandshakeServer/RSA-4                      1.10ms ± 0%
HandshakeServer/ECDHE-P256-RSA-4           1.23ms ± 1%
HandshakeServer/ECDHE-P256-ECDSA-P256-4     178µs ± 1%
HandshakeServer/ECDHE-X25519-ECDSA-P256-4   180µs ± 2%
HandshakeServer/ECDHE-P521-ECDSA-P521-4    19.8ms ± 1%

Change-Id: I6b2c79392995d259cfdfc5199be44cc7cc40e155
Reviewed-on: https://go-review.googlesource.com/44730
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
 2017-08-15 18:44:38 +00:00