Source file src/crypto/tls/handshake_server_tls13.go

Documentation: crypto/tls

		 1  // Copyright 2018 The Go Authors. All rights reserved.
		 2  // Use of this source code is governed by a BSD-style
		 3  // license that can be found in the LICENSE file.
		 4  
		 5  package tls
		 6  
		 7  import (
		 8  	"bytes"
		 9  	"context"
		10  	"crypto"
		11  	"crypto/hmac"
		12  	"crypto/rsa"
		13  	"encoding/binary"
		14  	"errors"
		15  	"hash"
		16  	"io"
		17  	"sync/atomic"
		18  	"time"
		19  )
		20  
		21  // maxClientPSKIdentities is the number of client PSK identities the server will
		22  // attempt to validate. It will ignore the rest not to let cheap ClientHello
		23  // messages cause too much work in session ticket decryption attempts.
		24  const maxClientPSKIdentities = 5
		25  
		26  type serverHandshakeStateTLS13 struct {
		27  	c							 *Conn
		28  	ctx						 context.Context
		29  	clientHello		 *clientHelloMsg
		30  	hello					 *serverHelloMsg
		31  	sentDummyCCS		bool
		32  	usingPSK				bool
		33  	suite					 *cipherSuiteTLS13
		34  	cert						*Certificate
		35  	sigAlg					SignatureScheme
		36  	earlySecret		 []byte
		37  	sharedKey			 []byte
		38  	handshakeSecret []byte
		39  	masterSecret		[]byte
		40  	trafficSecret	 []byte // client_application_traffic_secret_0
		41  	transcript			hash.Hash
		42  	clientFinished	[]byte
		43  }
		44  
		45  func (hs *serverHandshakeStateTLS13) handshake() error {
		46  	c := hs.c
		47  
		48  	// For an overview of the TLS 1.3 handshake, see RFC 8446, Section 2.
		49  	if err := hs.processClientHello(); err != nil {
		50  		return err
		51  	}
		52  	if err := hs.checkForResumption(); err != nil {
		53  		return err
		54  	}
		55  	if err := hs.pickCertificate(); err != nil {
		56  		return err
		57  	}
		58  	c.buffering = true
		59  	if err := hs.sendServerParameters(); err != nil {
		60  		return err
		61  	}
		62  	if err := hs.sendServerCertificate(); err != nil {
		63  		return err
		64  	}
		65  	if err := hs.sendServerFinished(); err != nil {
		66  		return err
		67  	}
		68  	// Note that at this point we could start sending application data without
		69  	// waiting for the client's second flight, but the application might not
		70  	// expect the lack of replay protection of the ClientHello parameters.
		71  	if _, err := c.flush(); err != nil {
		72  		return err
		73  	}
		74  	if err := hs.readClientCertificate(); err != nil {
		75  		return err
		76  	}
		77  	if err := hs.readClientFinished(); err != nil {
		78  		return err
		79  	}
		80  
		81  	atomic.StoreUint32(&c.handshakeStatus, 1)
		82  
		83  	return nil
		84  }
		85  
		86  func (hs *serverHandshakeStateTLS13) processClientHello() error {
		87  	c := hs.c
		88  
		89  	hs.hello = new(serverHelloMsg)
		90  
		91  	// TLS 1.3 froze the ServerHello.legacy_version field, and uses
		92  	// supported_versions instead. See RFC 8446, sections 4.1.3 and 4.2.1.
		93  	hs.hello.vers = VersionTLS12
		94  	hs.hello.supportedVersion = c.vers
		95  
		96  	if len(hs.clientHello.supportedVersions) == 0 {
		97  		c.sendAlert(alertIllegalParameter)
		98  		return errors.New("tls: client used the legacy version field to negotiate TLS 1.3")
		99  	}
	 100  
	 101  	// Abort if the client is doing a fallback and landing lower than what we
	 102  	// support. See RFC 7507, which however does not specify the interaction
	 103  	// with supported_versions. The only difference is that with
	 104  	// supported_versions a client has a chance to attempt a [TLS 1.2, TLS 1.4]
	 105  	// handshake in case TLS 1.3 is broken but 1.2 is not. Alas, in that case,
	 106  	// it will have to drop the TLS_FALLBACK_SCSV protection if it falls back to
	 107  	// TLS 1.2, because a TLS 1.3 server would abort here. The situation before
	 108  	// supported_versions was not better because there was just no way to do a
	 109  	// TLS 1.4 handshake without risking the server selecting TLS 1.3.
	 110  	for _, id := range hs.clientHello.cipherSuites {
	 111  		if id == TLS_FALLBACK_SCSV {
	 112  			// Use c.vers instead of max(supported_versions) because an attacker
	 113  			// could defeat this by adding an arbitrary high version otherwise.
	 114  			if c.vers < c.config.maxSupportedVersion() {
	 115  				c.sendAlert(alertInappropriateFallback)
	 116  				return errors.New("tls: client using inappropriate protocol fallback")
	 117  			}
	 118  			break
	 119  		}
	 120  	}
	 121  
	 122  	if len(hs.clientHello.compressionMethods) != 1 ||
	 123  		hs.clientHello.compressionMethods[0] != compressionNone {
	 124  		c.sendAlert(alertIllegalParameter)
	 125  		return errors.New("tls: TLS 1.3 client supports illegal compression methods")
	 126  	}
	 127  
	 128  	hs.hello.random = make([]byte, 32)
	 129  	if _, err := io.ReadFull(c.config.rand(), hs.hello.random); err != nil {
	 130  		c.sendAlert(alertInternalError)
	 131  		return err
	 132  	}
	 133  
	 134  	if len(hs.clientHello.secureRenegotiation) != 0 {
	 135  		c.sendAlert(alertHandshakeFailure)
	 136  		return errors.New("tls: initial handshake had non-empty renegotiation extension")
	 137  	}
	 138  
	 139  	if hs.clientHello.earlyData {
	 140  		// See RFC 8446, Section 4.2.10 for the complicated behavior required
	 141  		// here. The scenario is that a different server at our address offered
	 142  		// to accept early data in the past, which we can't handle. For now, all
	 143  		// 0-RTT enabled session tickets need to expire before a Go server can
	 144  		// replace a server or join a pool. That's the same requirement that
	 145  		// applies to mixing or replacing with any TLS 1.2 server.
	 146  		c.sendAlert(alertUnsupportedExtension)
	 147  		return errors.New("tls: client sent unexpected early data")
	 148  	}
	 149  
	 150  	hs.hello.sessionId = hs.clientHello.sessionId
	 151  	hs.hello.compressionMethod = compressionNone
	 152  
	 153  	preferenceList := defaultCipherSuitesTLS13
	 154  	if !hasAESGCMHardwareSupport || !aesgcmPreferred(hs.clientHello.cipherSuites) {
	 155  		preferenceList = defaultCipherSuitesTLS13NoAES
	 156  	}
	 157  	for _, suiteID := range preferenceList {
	 158  		hs.suite = mutualCipherSuiteTLS13(hs.clientHello.cipherSuites, suiteID)
	 159  		if hs.suite != nil {
	 160  			break
	 161  		}
	 162  	}
	 163  	if hs.suite == nil {
	 164  		c.sendAlert(alertHandshakeFailure)
	 165  		return errors.New("tls: no cipher suite supported by both client and server")
	 166  	}
	 167  	c.cipherSuite = hs.suite.id
	 168  	hs.hello.cipherSuite = hs.suite.id
	 169  	hs.transcript = hs.suite.hash.New()
	 170  
	 171  	// Pick the ECDHE group in server preference order, but give priority to
	 172  	// groups with a key share, to avoid a HelloRetryRequest round-trip.
	 173  	var selectedGroup CurveID
	 174  	var clientKeyShare *keyShare
	 175  GroupSelection:
	 176  	for _, preferredGroup := range c.config.curvePreferences() {
	 177  		for _, ks := range hs.clientHello.keyShares {
	 178  			if ks.group == preferredGroup {
	 179  				selectedGroup = ks.group
	 180  				clientKeyShare = &ks
	 181  				break GroupSelection
	 182  			}
	 183  		}
	 184  		if selectedGroup != 0 {
	 185  			continue
	 186  		}
	 187  		for _, group := range hs.clientHello.supportedCurves {
	 188  			if group == preferredGroup {
	 189  				selectedGroup = group
	 190  				break
	 191  			}
	 192  		}
	 193  	}
	 194  	if selectedGroup == 0 {
	 195  		c.sendAlert(alertHandshakeFailure)
	 196  		return errors.New("tls: no ECDHE curve supported by both client and server")
	 197  	}
	 198  	if clientKeyShare == nil {
	 199  		if err := hs.doHelloRetryRequest(selectedGroup); err != nil {
	 200  			return err
	 201  		}
	 202  		clientKeyShare = &hs.clientHello.keyShares[0]
	 203  	}
	 204  
	 205  	if _, ok := curveForCurveID(selectedGroup); selectedGroup != X25519 && !ok {
	 206  		c.sendAlert(alertInternalError)
	 207  		return errors.New("tls: CurvePreferences includes unsupported curve")
	 208  	}
	 209  	params, err := generateECDHEParameters(c.config.rand(), selectedGroup)
	 210  	if err != nil {
	 211  		c.sendAlert(alertInternalError)
	 212  		return err
	 213  	}
	 214  	hs.hello.serverShare = keyShare{group: selectedGroup, data: params.PublicKey()}
	 215  	hs.sharedKey = params.SharedKey(clientKeyShare.data)
	 216  	if hs.sharedKey == nil {
	 217  		c.sendAlert(alertIllegalParameter)
	 218  		return errors.New("tls: invalid client key share")
	 219  	}
	 220  
	 221  	c.serverName = hs.clientHello.serverName
	 222  	return nil
	 223  }
	 224  
	 225  func (hs *serverHandshakeStateTLS13) checkForResumption() error {
	 226  	c := hs.c
	 227  
	 228  	if c.config.SessionTicketsDisabled {
	 229  		return nil
	 230  	}
	 231  
	 232  	modeOK := false
	 233  	for _, mode := range hs.clientHello.pskModes {
	 234  		if mode == pskModeDHE {
	 235  			modeOK = true
	 236  			break
	 237  		}
	 238  	}
	 239  	if !modeOK {
	 240  		return nil
	 241  	}
	 242  
	 243  	if len(hs.clientHello.pskIdentities) != len(hs.clientHello.pskBinders) {
	 244  		c.sendAlert(alertIllegalParameter)
	 245  		return errors.New("tls: invalid or missing PSK binders")
	 246  	}
	 247  	if len(hs.clientHello.pskIdentities) == 0 {
	 248  		return nil
	 249  	}
	 250  
	 251  	for i, identity := range hs.clientHello.pskIdentities {
	 252  		if i >= maxClientPSKIdentities {
	 253  			break
	 254  		}
	 255  
	 256  		plaintext, _ := c.decryptTicket(identity.label)
	 257  		if plaintext == nil {
	 258  			continue
	 259  		}
	 260  		sessionState := new(sessionStateTLS13)
	 261  		if ok := sessionState.unmarshal(plaintext); !ok {
	 262  			continue
	 263  		}
	 264  
	 265  		createdAt := time.Unix(int64(sessionState.createdAt), 0)
	 266  		if c.config.time().Sub(createdAt) > maxSessionTicketLifetime {
	 267  			continue
	 268  		}
	 269  
	 270  		// We don't check the obfuscated ticket age because it's affected by
	 271  		// clock skew and it's only a freshness signal useful for shrinking the
	 272  		// window for replay attacks, which don't affect us as we don't do 0-RTT.
	 273  
	 274  		pskSuite := cipherSuiteTLS13ByID(sessionState.cipherSuite)
	 275  		if pskSuite == nil || pskSuite.hash != hs.suite.hash {
	 276  			continue
	 277  		}
	 278  
	 279  		// PSK connections don't re-establish client certificates, but carry
	 280  		// them over in the session ticket. Ensure the presence of client certs
	 281  		// in the ticket is consistent with the configured requirements.
	 282  		sessionHasClientCerts := len(sessionState.certificate.Certificate) != 0
	 283  		needClientCerts := requiresClientCert(c.config.ClientAuth)
	 284  		if needClientCerts && !sessionHasClientCerts {
	 285  			continue
	 286  		}
	 287  		if sessionHasClientCerts && c.config.ClientAuth == NoClientCert {
	 288  			continue
	 289  		}
	 290  
	 291  		psk := hs.suite.expandLabel(sessionState.resumptionSecret, "resumption",
	 292  			nil, hs.suite.hash.Size())
	 293  		hs.earlySecret = hs.suite.extract(psk, nil)
	 294  		binderKey := hs.suite.deriveSecret(hs.earlySecret, resumptionBinderLabel, nil)
	 295  		// Clone the transcript in case a HelloRetryRequest was recorded.
	 296  		transcript := cloneHash(hs.transcript, hs.suite.hash)
	 297  		if transcript == nil {
	 298  			c.sendAlert(alertInternalError)
	 299  			return errors.New("tls: internal error: failed to clone hash")
	 300  		}
	 301  		transcript.Write(hs.clientHello.marshalWithoutBinders())
	 302  		pskBinder := hs.suite.finishedHash(binderKey, transcript)
	 303  		if !hmac.Equal(hs.clientHello.pskBinders[i], pskBinder) {
	 304  			c.sendAlert(alertDecryptError)
	 305  			return errors.New("tls: invalid PSK binder")
	 306  		}
	 307  
	 308  		c.didResume = true
	 309  		if err := c.processCertsFromClient(sessionState.certificate); err != nil {
	 310  			return err
	 311  		}
	 312  
	 313  		hs.hello.selectedIdentityPresent = true
	 314  		hs.hello.selectedIdentity = uint16(i)
	 315  		hs.usingPSK = true
	 316  		return nil
	 317  	}
	 318  
	 319  	return nil
	 320  }
	 321  
	 322  // cloneHash uses the encoding.BinaryMarshaler and encoding.BinaryUnmarshaler
	 323  // interfaces implemented by standard library hashes to clone the state of in
	 324  // to a new instance of h. It returns nil if the operation fails.
	 325  func cloneHash(in hash.Hash, h crypto.Hash) hash.Hash {
	 326  	// Recreate the interface to avoid importing encoding.
	 327  	type binaryMarshaler interface {
	 328  		MarshalBinary() (data []byte, err error)
	 329  		UnmarshalBinary(data []byte) error
	 330  	}
	 331  	marshaler, ok := in.(binaryMarshaler)
	 332  	if !ok {
	 333  		return nil
	 334  	}
	 335  	state, err := marshaler.MarshalBinary()
	 336  	if err != nil {
	 337  		return nil
	 338  	}
	 339  	out := h.New()
	 340  	unmarshaler, ok := out.(binaryMarshaler)
	 341  	if !ok {
	 342  		return nil
	 343  	}
	 344  	if err := unmarshaler.UnmarshalBinary(state); err != nil {
	 345  		return nil
	 346  	}
	 347  	return out
	 348  }
	 349  
	 350  func (hs *serverHandshakeStateTLS13) pickCertificate() error {
	 351  	c := hs.c
	 352  
	 353  	// Only one of PSK and certificates are used at a time.
	 354  	if hs.usingPSK {
	 355  		return nil
	 356  	}
	 357  
	 358  	// signature_algorithms is required in TLS 1.3. See RFC 8446, Section 4.2.3.
	 359  	if len(hs.clientHello.supportedSignatureAlgorithms) == 0 {
	 360  		return c.sendAlert(alertMissingExtension)
	 361  	}
	 362  
	 363  	certificate, err := c.config.getCertificate(clientHelloInfo(hs.ctx, c, hs.clientHello))
	 364  	if err != nil {
	 365  		if err == errNoCertificates {
	 366  			c.sendAlert(alertUnrecognizedName)
	 367  		} else {
	 368  			c.sendAlert(alertInternalError)
	 369  		}
	 370  		return err
	 371  	}
	 372  	hs.sigAlg, err = selectSignatureScheme(c.vers, certificate, hs.clientHello.supportedSignatureAlgorithms)
	 373  	if err != nil {
	 374  		// getCertificate returned a certificate that is unsupported or
	 375  		// incompatible with the client's signature algorithms.
	 376  		c.sendAlert(alertHandshakeFailure)
	 377  		return err
	 378  	}
	 379  	hs.cert = certificate
	 380  
	 381  	return nil
	 382  }
	 383  
	 384  // sendDummyChangeCipherSpec sends a ChangeCipherSpec record for compatibility
	 385  // with middleboxes that didn't implement TLS correctly. See RFC 8446, Appendix D.4.
	 386  func (hs *serverHandshakeStateTLS13) sendDummyChangeCipherSpec() error {
	 387  	if hs.sentDummyCCS {
	 388  		return nil
	 389  	}
	 390  	hs.sentDummyCCS = true
	 391  
	 392  	_, err := hs.c.writeRecord(recordTypeChangeCipherSpec, []byte{1})
	 393  	return err
	 394  }
	 395  
	 396  func (hs *serverHandshakeStateTLS13) doHelloRetryRequest(selectedGroup CurveID) error {
	 397  	c := hs.c
	 398  
	 399  	// The first ClientHello gets double-hashed into the transcript upon a
	 400  	// HelloRetryRequest. See RFC 8446, Section 4.4.1.
	 401  	hs.transcript.Write(hs.clientHello.marshal())
	 402  	chHash := hs.transcript.Sum(nil)
	 403  	hs.transcript.Reset()
	 404  	hs.transcript.Write([]byte{typeMessageHash, 0, 0, uint8(len(chHash))})
	 405  	hs.transcript.Write(chHash)
	 406  
	 407  	helloRetryRequest := &serverHelloMsg{
	 408  		vers:							hs.hello.vers,
	 409  		random:						helloRetryRequestRandom,
	 410  		sessionId:				 hs.hello.sessionId,
	 411  		cipherSuite:			 hs.hello.cipherSuite,
	 412  		compressionMethod: hs.hello.compressionMethod,
	 413  		supportedVersion:	hs.hello.supportedVersion,
	 414  		selectedGroup:		 selectedGroup,
	 415  	}
	 416  
	 417  	hs.transcript.Write(helloRetryRequest.marshal())
	 418  	if _, err := c.writeRecord(recordTypeHandshake, helloRetryRequest.marshal()); err != nil {
	 419  		return err
	 420  	}
	 421  
	 422  	if err := hs.sendDummyChangeCipherSpec(); err != nil {
	 423  		return err
	 424  	}
	 425  
	 426  	msg, err := c.readHandshake()
	 427  	if err != nil {
	 428  		return err
	 429  	}
	 430  
	 431  	clientHello, ok := msg.(*clientHelloMsg)
	 432  	if !ok {
	 433  		c.sendAlert(alertUnexpectedMessage)
	 434  		return unexpectedMessageError(clientHello, msg)
	 435  	}
	 436  
	 437  	if len(clientHello.keyShares) != 1 || clientHello.keyShares[0].group != selectedGroup {
	 438  		c.sendAlert(alertIllegalParameter)
	 439  		return errors.New("tls: client sent invalid key share in second ClientHello")
	 440  	}
	 441  
	 442  	if clientHello.earlyData {
	 443  		c.sendAlert(alertIllegalParameter)
	 444  		return errors.New("tls: client indicated early data in second ClientHello")
	 445  	}
	 446  
	 447  	if illegalClientHelloChange(clientHello, hs.clientHello) {
	 448  		c.sendAlert(alertIllegalParameter)
	 449  		return errors.New("tls: client illegally modified second ClientHello")
	 450  	}
	 451  
	 452  	hs.clientHello = clientHello
	 453  	return nil
	 454  }
	 455  
	 456  // illegalClientHelloChange reports whether the two ClientHello messages are
	 457  // different, with the exception of the changes allowed before and after a
	 458  // HelloRetryRequest. See RFC 8446, Section 4.1.2.
	 459  func illegalClientHelloChange(ch, ch1 *clientHelloMsg) bool {
	 460  	if len(ch.supportedVersions) != len(ch1.supportedVersions) ||
	 461  		len(ch.cipherSuites) != len(ch1.cipherSuites) ||
	 462  		len(ch.supportedCurves) != len(ch1.supportedCurves) ||
	 463  		len(ch.supportedSignatureAlgorithms) != len(ch1.supportedSignatureAlgorithms) ||
	 464  		len(ch.supportedSignatureAlgorithmsCert) != len(ch1.supportedSignatureAlgorithmsCert) ||
	 465  		len(ch.alpnProtocols) != len(ch1.alpnProtocols) {
	 466  		return true
	 467  	}
	 468  	for i := range ch.supportedVersions {
	 469  		if ch.supportedVersions[i] != ch1.supportedVersions[i] {
	 470  			return true
	 471  		}
	 472  	}
	 473  	for i := range ch.cipherSuites {
	 474  		if ch.cipherSuites[i] != ch1.cipherSuites[i] {
	 475  			return true
	 476  		}
	 477  	}
	 478  	for i := range ch.supportedCurves {
	 479  		if ch.supportedCurves[i] != ch1.supportedCurves[i] {
	 480  			return true
	 481  		}
	 482  	}
	 483  	for i := range ch.supportedSignatureAlgorithms {
	 484  		if ch.supportedSignatureAlgorithms[i] != ch1.supportedSignatureAlgorithms[i] {
	 485  			return true
	 486  		}
	 487  	}
	 488  	for i := range ch.supportedSignatureAlgorithmsCert {
	 489  		if ch.supportedSignatureAlgorithmsCert[i] != ch1.supportedSignatureAlgorithmsCert[i] {
	 490  			return true
	 491  		}
	 492  	}
	 493  	for i := range ch.alpnProtocols {
	 494  		if ch.alpnProtocols[i] != ch1.alpnProtocols[i] {
	 495  			return true
	 496  		}
	 497  	}
	 498  	return ch.vers != ch1.vers ||
	 499  		!bytes.Equal(ch.random, ch1.random) ||
	 500  		!bytes.Equal(ch.sessionId, ch1.sessionId) ||
	 501  		!bytes.Equal(ch.compressionMethods, ch1.compressionMethods) ||
	 502  		ch.serverName != ch1.serverName ||
	 503  		ch.ocspStapling != ch1.ocspStapling ||
	 504  		!bytes.Equal(ch.supportedPoints, ch1.supportedPoints) ||
	 505  		ch.ticketSupported != ch1.ticketSupported ||
	 506  		!bytes.Equal(ch.sessionTicket, ch1.sessionTicket) ||
	 507  		ch.secureRenegotiationSupported != ch1.secureRenegotiationSupported ||
	 508  		!bytes.Equal(ch.secureRenegotiation, ch1.secureRenegotiation) ||
	 509  		ch.scts != ch1.scts ||
	 510  		!bytes.Equal(ch.cookie, ch1.cookie) ||
	 511  		!bytes.Equal(ch.pskModes, ch1.pskModes)
	 512  }
	 513  
	 514  func (hs *serverHandshakeStateTLS13) sendServerParameters() error {
	 515  	c := hs.c
	 516  
	 517  	hs.transcript.Write(hs.clientHello.marshal())
	 518  	hs.transcript.Write(hs.hello.marshal())
	 519  	if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil {
	 520  		return err
	 521  	}
	 522  
	 523  	if err := hs.sendDummyChangeCipherSpec(); err != nil {
	 524  		return err
	 525  	}
	 526  
	 527  	earlySecret := hs.earlySecret
	 528  	if earlySecret == nil {
	 529  		earlySecret = hs.suite.extract(nil, nil)
	 530  	}
	 531  	hs.handshakeSecret = hs.suite.extract(hs.sharedKey,
	 532  		hs.suite.deriveSecret(earlySecret, "derived", nil))
	 533  
	 534  	clientSecret := hs.suite.deriveSecret(hs.handshakeSecret,
	 535  		clientHandshakeTrafficLabel, hs.transcript)
	 536  	c.in.setTrafficSecret(hs.suite, clientSecret)
	 537  	serverSecret := hs.suite.deriveSecret(hs.handshakeSecret,
	 538  		serverHandshakeTrafficLabel, hs.transcript)
	 539  	c.out.setTrafficSecret(hs.suite, serverSecret)
	 540  
	 541  	err := c.config.writeKeyLog(keyLogLabelClientHandshake, hs.clientHello.random, clientSecret)
	 542  	if err != nil {
	 543  		c.sendAlert(alertInternalError)
	 544  		return err
	 545  	}
	 546  	err = c.config.writeKeyLog(keyLogLabelServerHandshake, hs.clientHello.random, serverSecret)
	 547  	if err != nil {
	 548  		c.sendAlert(alertInternalError)
	 549  		return err
	 550  	}
	 551  
	 552  	encryptedExtensions := new(encryptedExtensionsMsg)
	 553  
	 554  	selectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols)
	 555  	if err != nil {
	 556  		c.sendAlert(alertNoApplicationProtocol)
	 557  		return err
	 558  	}
	 559  	encryptedExtensions.alpnProtocol = selectedProto
	 560  	c.clientProtocol = selectedProto
	 561  
	 562  	hs.transcript.Write(encryptedExtensions.marshal())
	 563  	if _, err := c.writeRecord(recordTypeHandshake, encryptedExtensions.marshal()); err != nil {
	 564  		return err
	 565  	}
	 566  
	 567  	return nil
	 568  }
	 569  
	 570  func (hs *serverHandshakeStateTLS13) requestClientCert() bool {
	 571  	return hs.c.config.ClientAuth >= RequestClientCert && !hs.usingPSK
	 572  }
	 573  
	 574  func (hs *serverHandshakeStateTLS13) sendServerCertificate() error {
	 575  	c := hs.c
	 576  
	 577  	// Only one of PSK and certificates are used at a time.
	 578  	if hs.usingPSK {
	 579  		return nil
	 580  	}
	 581  
	 582  	if hs.requestClientCert() {
	 583  		// Request a client certificate
	 584  		certReq := new(certificateRequestMsgTLS13)
	 585  		certReq.ocspStapling = true
	 586  		certReq.scts = true
	 587  		certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms
	 588  		if c.config.ClientCAs != nil {
	 589  			certReq.certificateAuthorities = c.config.ClientCAs.Subjects()
	 590  		}
	 591  
	 592  		hs.transcript.Write(certReq.marshal())
	 593  		if _, err := c.writeRecord(recordTypeHandshake, certReq.marshal()); err != nil {
	 594  			return err
	 595  		}
	 596  	}
	 597  
	 598  	certMsg := new(certificateMsgTLS13)
	 599  
	 600  	certMsg.certificate = *hs.cert
	 601  	certMsg.scts = hs.clientHello.scts && len(hs.cert.SignedCertificateTimestamps) > 0
	 602  	certMsg.ocspStapling = hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0
	 603  
	 604  	hs.transcript.Write(certMsg.marshal())
	 605  	if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil {
	 606  		return err
	 607  	}
	 608  
	 609  	certVerifyMsg := new(certificateVerifyMsg)
	 610  	certVerifyMsg.hasSignatureAlgorithm = true
	 611  	certVerifyMsg.signatureAlgorithm = hs.sigAlg
	 612  
	 613  	sigType, sigHash, err := typeAndHashFromSignatureScheme(hs.sigAlg)
	 614  	if err != nil {
	 615  		return c.sendAlert(alertInternalError)
	 616  	}
	 617  
	 618  	signed := signedMessage(sigHash, serverSignatureContext, hs.transcript)
	 619  	signOpts := crypto.SignerOpts(sigHash)
	 620  	if sigType == signatureRSAPSS {
	 621  		signOpts = &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: sigHash}
	 622  	}
	 623  	sig, err := hs.cert.PrivateKey.(crypto.Signer).Sign(c.config.rand(), signed, signOpts)
	 624  	if err != nil {
	 625  		public := hs.cert.PrivateKey.(crypto.Signer).Public()
	 626  		if rsaKey, ok := public.(*rsa.PublicKey); ok && sigType == signatureRSAPSS &&
	 627  			rsaKey.N.BitLen()/8 < sigHash.Size()*2+2 { // key too small for RSA-PSS
	 628  			c.sendAlert(alertHandshakeFailure)
	 629  		} else {
	 630  			c.sendAlert(alertInternalError)
	 631  		}
	 632  		return errors.New("tls: failed to sign handshake: " + err.Error())
	 633  	}
	 634  	certVerifyMsg.signature = sig
	 635  
	 636  	hs.transcript.Write(certVerifyMsg.marshal())
	 637  	if _, err := c.writeRecord(recordTypeHandshake, certVerifyMsg.marshal()); err != nil {
	 638  		return err
	 639  	}
	 640  
	 641  	return nil
	 642  }
	 643  
	 644  func (hs *serverHandshakeStateTLS13) sendServerFinished() error {
	 645  	c := hs.c
	 646  
	 647  	finished := &finishedMsg{
	 648  		verifyData: hs.suite.finishedHash(c.out.trafficSecret, hs.transcript),
	 649  	}
	 650  
	 651  	hs.transcript.Write(finished.marshal())
	 652  	if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil {
	 653  		return err
	 654  	}
	 655  
	 656  	// Derive secrets that take context through the server Finished.
	 657  
	 658  	hs.masterSecret = hs.suite.extract(nil,
	 659  		hs.suite.deriveSecret(hs.handshakeSecret, "derived", nil))
	 660  
	 661  	hs.trafficSecret = hs.suite.deriveSecret(hs.masterSecret,
	 662  		clientApplicationTrafficLabel, hs.transcript)
	 663  	serverSecret := hs.suite.deriveSecret(hs.masterSecret,
	 664  		serverApplicationTrafficLabel, hs.transcript)
	 665  	c.out.setTrafficSecret(hs.suite, serverSecret)
	 666  
	 667  	err := c.config.writeKeyLog(keyLogLabelClientTraffic, hs.clientHello.random, hs.trafficSecret)
	 668  	if err != nil {
	 669  		c.sendAlert(alertInternalError)
	 670  		return err
	 671  	}
	 672  	err = c.config.writeKeyLog(keyLogLabelServerTraffic, hs.clientHello.random, serverSecret)
	 673  	if err != nil {
	 674  		c.sendAlert(alertInternalError)
	 675  		return err
	 676  	}
	 677  
	 678  	c.ekm = hs.suite.exportKeyingMaterial(hs.masterSecret, hs.transcript)
	 679  
	 680  	// If we did not request client certificates, at this point we can
	 681  	// precompute the client finished and roll the transcript forward to send
	 682  	// session tickets in our first flight.
	 683  	if !hs.requestClientCert() {
	 684  		if err := hs.sendSessionTickets(); err != nil {
	 685  			return err
	 686  		}
	 687  	}
	 688  
	 689  	return nil
	 690  }
	 691  
	 692  func (hs *serverHandshakeStateTLS13) shouldSendSessionTickets() bool {
	 693  	if hs.c.config.SessionTicketsDisabled {
	 694  		return false
	 695  	}
	 696  
	 697  	// Don't send tickets the client wouldn't use. See RFC 8446, Section 4.2.9.
	 698  	for _, pskMode := range hs.clientHello.pskModes {
	 699  		if pskMode == pskModeDHE {
	 700  			return true
	 701  		}
	 702  	}
	 703  	return false
	 704  }
	 705  
	 706  func (hs *serverHandshakeStateTLS13) sendSessionTickets() error {
	 707  	c := hs.c
	 708  
	 709  	hs.clientFinished = hs.suite.finishedHash(c.in.trafficSecret, hs.transcript)
	 710  	finishedMsg := &finishedMsg{
	 711  		verifyData: hs.clientFinished,
	 712  	}
	 713  	hs.transcript.Write(finishedMsg.marshal())
	 714  
	 715  	if !hs.shouldSendSessionTickets() {
	 716  		return nil
	 717  	}
	 718  
	 719  	resumptionSecret := hs.suite.deriveSecret(hs.masterSecret,
	 720  		resumptionLabel, hs.transcript)
	 721  
	 722  	m := new(newSessionTicketMsgTLS13)
	 723  
	 724  	var certsFromClient [][]byte
	 725  	for _, cert := range c.peerCertificates {
	 726  		certsFromClient = append(certsFromClient, cert.Raw)
	 727  	}
	 728  	state := sessionStateTLS13{
	 729  		cipherSuite:			hs.suite.id,
	 730  		createdAt:				uint64(c.config.time().Unix()),
	 731  		resumptionSecret: resumptionSecret,
	 732  		certificate: Certificate{
	 733  			Certificate:								 certsFromClient,
	 734  			OCSPStaple:									c.ocspResponse,
	 735  			SignedCertificateTimestamps: c.scts,
	 736  		},
	 737  	}
	 738  	var err error
	 739  	m.label, err = c.encryptTicket(state.marshal())
	 740  	if err != nil {
	 741  		return err
	 742  	}
	 743  	m.lifetime = uint32(maxSessionTicketLifetime / time.Second)
	 744  
	 745  	// ticket_age_add is a random 32-bit value. See RFC 8446, section 4.6.1
	 746  	// The value is not stored anywhere; we never need to check the ticket age
	 747  	// because 0-RTT is not supported.
	 748  	ageAdd := make([]byte, 4)
	 749  	_, err = hs.c.config.rand().Read(ageAdd)
	 750  	if err != nil {
	 751  		return err
	 752  	}
	 753  	m.ageAdd = binary.LittleEndian.Uint32(ageAdd)
	 754  
	 755  	// ticket_nonce, which must be unique per connection, is always left at
	 756  	// zero because we only ever send one ticket per connection.
	 757  
	 758  	if _, err := c.writeRecord(recordTypeHandshake, m.marshal()); err != nil {
	 759  		return err
	 760  	}
	 761  
	 762  	return nil
	 763  }
	 764  
	 765  func (hs *serverHandshakeStateTLS13) readClientCertificate() error {
	 766  	c := hs.c
	 767  
	 768  	if !hs.requestClientCert() {
	 769  		// Make sure the connection is still being verified whether or not
	 770  		// the server requested a client certificate.
	 771  		if c.config.VerifyConnection != nil {
	 772  			if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
	 773  				c.sendAlert(alertBadCertificate)
	 774  				return err
	 775  			}
	 776  		}
	 777  		return nil
	 778  	}
	 779  
	 780  	// If we requested a client certificate, then the client must send a
	 781  	// certificate message. If it's empty, no CertificateVerify is sent.
	 782  
	 783  	msg, err := c.readHandshake()
	 784  	if err != nil {
	 785  		return err
	 786  	}
	 787  
	 788  	certMsg, ok := msg.(*certificateMsgTLS13)
	 789  	if !ok {
	 790  		c.sendAlert(alertUnexpectedMessage)
	 791  		return unexpectedMessageError(certMsg, msg)
	 792  	}
	 793  	hs.transcript.Write(certMsg.marshal())
	 794  
	 795  	if err := c.processCertsFromClient(certMsg.certificate); err != nil {
	 796  		return err
	 797  	}
	 798  
	 799  	if c.config.VerifyConnection != nil {
	 800  		if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
	 801  			c.sendAlert(alertBadCertificate)
	 802  			return err
	 803  		}
	 804  	}
	 805  
	 806  	if len(certMsg.certificate.Certificate) != 0 {
	 807  		msg, err = c.readHandshake()
	 808  		if err != nil {
	 809  			return err
	 810  		}
	 811  
	 812  		certVerify, ok := msg.(*certificateVerifyMsg)
	 813  		if !ok {
	 814  			c.sendAlert(alertUnexpectedMessage)
	 815  			return unexpectedMessageError(certVerify, msg)
	 816  		}
	 817  
	 818  		// See RFC 8446, Section 4.4.3.
	 819  		if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, supportedSignatureAlgorithms) {
	 820  			c.sendAlert(alertIllegalParameter)
	 821  			return errors.New("tls: client certificate used with invalid signature algorithm")
	 822  		}
	 823  		sigType, sigHash, err := typeAndHashFromSignatureScheme(certVerify.signatureAlgorithm)
	 824  		if err != nil {
	 825  			return c.sendAlert(alertInternalError)
	 826  		}
	 827  		if sigType == signaturePKCS1v15 || sigHash == crypto.SHA1 {
	 828  			c.sendAlert(alertIllegalParameter)
	 829  			return errors.New("tls: client certificate used with invalid signature algorithm")
	 830  		}
	 831  		signed := signedMessage(sigHash, clientSignatureContext, hs.transcript)
	 832  		if err := verifyHandshakeSignature(sigType, c.peerCertificates[0].PublicKey,
	 833  			sigHash, signed, certVerify.signature); err != nil {
	 834  			c.sendAlert(alertDecryptError)
	 835  			return errors.New("tls: invalid signature by the client certificate: " + err.Error())
	 836  		}
	 837  
	 838  		hs.transcript.Write(certVerify.marshal())
	 839  	}
	 840  
	 841  	// If we waited until the client certificates to send session tickets, we
	 842  	// are ready to do it now.
	 843  	if err := hs.sendSessionTickets(); err != nil {
	 844  		return err
	 845  	}
	 846  
	 847  	return nil
	 848  }
	 849  
	 850  func (hs *serverHandshakeStateTLS13) readClientFinished() error {
	 851  	c := hs.c
	 852  
	 853  	msg, err := c.readHandshake()
	 854  	if err != nil {
	 855  		return err
	 856  	}
	 857  
	 858  	finished, ok := msg.(*finishedMsg)
	 859  	if !ok {
	 860  		c.sendAlert(alertUnexpectedMessage)
	 861  		return unexpectedMessageError(finished, msg)
	 862  	}
	 863  
	 864  	if !hmac.Equal(hs.clientFinished, finished.verifyData) {
	 865  		c.sendAlert(alertDecryptError)
	 866  		return errors.New("tls: invalid client finished hash")
	 867  	}
	 868  
	 869  	c.in.setTrafficSecret(hs.suite, hs.trafficSecret)
	 870  
	 871  	return nil
	 872  }
	 873  

View as plain text