Source file src/crypto/tls/handshake_server.go

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"context"
     9  	"crypto"
    10  	"crypto/ecdsa"
    11  	"crypto/ed25519"
    12  	"crypto/rsa"
    13  	"crypto/subtle"
    14  	"crypto/tls/internal/fips140tls"
    15  	"crypto/x509"
    16  	"errors"
    17  	"fmt"
    18  	"hash"
    19  	"internal/byteorder"
    20  	"io"
    21  	"time"
    22  )
    23  
    24  // serverHandshakeState contains details of a server handshake in progress.
    25  // It's discarded once the handshake has completed.
    26  type serverHandshakeState struct {
    27  	c            *Conn
    28  	ctx          context.Context
    29  	clientHello  *clientHelloMsg
    30  	hello        *serverHelloMsg
    31  	suite        *cipherSuite
    32  	ecdheOk      bool
    33  	ecSignOk     bool
    34  	rsaDecryptOk bool
    35  	rsaSignOk    bool
    36  	sessionState *SessionState
    37  	finishedHash finishedHash
    38  	masterSecret []byte
    39  	cert         *Certificate
    40  }
    41  
    42  // serverHandshake performs a TLS handshake as a server.
    43  func (c *Conn) serverHandshake(ctx context.Context) error {
    44  	clientHello, ech, err := c.readClientHello(ctx)
    45  	if err != nil {
    46  		return err
    47  	}
    48  
    49  	if c.vers == VersionTLS13 {
    50  		hs := serverHandshakeStateTLS13{
    51  			c:           c,
    52  			ctx:         ctx,
    53  			clientHello: clientHello,
    54  			echContext:  ech,
    55  		}
    56  		return hs.handshake()
    57  	}
    58  
    59  	hs := serverHandshakeState{
    60  		c:           c,
    61  		ctx:         ctx,
    62  		clientHello: clientHello,
    63  	}
    64  	return hs.handshake()
    65  }
    66  
    67  func (hs *serverHandshakeState) handshake() error {
    68  	c := hs.c
    69  
    70  	if err := hs.processClientHello(); err != nil {
    71  		return err
    72  	}
    73  
    74  	// For an overview of TLS handshaking, see RFC 5246, Section 7.3.
    75  	c.buffering = true
    76  	if err := hs.checkForResumption(); err != nil {
    77  		return err
    78  	}
    79  	if hs.sessionState != nil {
    80  		// The client has included a session ticket and so we do an abbreviated handshake.
    81  		if err := hs.doResumeHandshake(); err != nil {
    82  			return err
    83  		}
    84  		if err := hs.establishKeys(); err != nil {
    85  			return err
    86  		}
    87  		if err := hs.sendSessionTicket(); err != nil {
    88  			return err
    89  		}
    90  		if err := hs.sendFinished(c.serverFinished[:]); err != nil {
    91  			return err
    92  		}
    93  		if _, err := c.flush(); err != nil {
    94  			return err
    95  		}
    96  		c.clientFinishedIsFirst = false
    97  		if err := hs.readFinished(nil); err != nil {
    98  			return err
    99  		}
   100  	} else {
   101  		// The client didn't include a session ticket, or it wasn't
   102  		// valid so we do a full handshake.
   103  		if err := hs.pickCipherSuite(); err != nil {
   104  			return err
   105  		}
   106  		if err := hs.doFullHandshake(); err != nil {
   107  			return err
   108  		}
   109  		if err := hs.establishKeys(); err != nil {
   110  			return err
   111  		}
   112  		if err := hs.readFinished(c.clientFinished[:]); err != nil {
   113  			return err
   114  		}
   115  		c.clientFinishedIsFirst = true
   116  		c.buffering = true
   117  		if err := hs.sendSessionTicket(); err != nil {
   118  			return err
   119  		}
   120  		if err := hs.sendFinished(nil); err != nil {
   121  			return err
   122  		}
   123  		if _, err := c.flush(); err != nil {
   124  			return err
   125  		}
   126  	}
   127  
   128  	c.ekm = ekmFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random)
   129  	c.isHandshakeComplete.Store(true)
   130  
   131  	return nil
   132  }
   133  
   134  // readClientHello reads a ClientHello message and selects the protocol version.
   135  func (c *Conn) readClientHello(ctx context.Context) (*clientHelloMsg, *echServerContext, error) {
   136  	// clientHelloMsg is included in the transcript, but we haven't initialized
   137  	// it yet. The respective handshake functions will record it themselves.
   138  	msg, err := c.readHandshake(nil)
   139  	if err != nil {
   140  		return nil, nil, err
   141  	}
   142  	clientHello, ok := msg.(*clientHelloMsg)
   143  	if !ok {
   144  		c.sendAlert(alertUnexpectedMessage)
   145  		return nil, nil, unexpectedMessageError(clientHello, msg)
   146  	}
   147  
   148  	// ECH processing has to be done before we do any other negotiation based on
   149  	// the contents of the client hello, since we may swap it out completely.
   150  	var ech *echServerContext
   151  	if len(clientHello.encryptedClientHello) != 0 {
   152  		clientHello, ech, err = c.processECHClientHello(clientHello)
   153  		if err != nil {
   154  			return nil, nil, err
   155  		}
   156  	}
   157  
   158  	var configForClient *Config
   159  	originalConfig := c.config
   160  	if c.config.GetConfigForClient != nil {
   161  		chi := clientHelloInfo(ctx, c, clientHello)
   162  		if configForClient, err = c.config.GetConfigForClient(chi); err != nil {
   163  			c.sendAlert(alertInternalError)
   164  			return nil, nil, err
   165  		} else if configForClient != nil {
   166  			c.config = configForClient
   167  		}
   168  	}
   169  	c.ticketKeys = originalConfig.ticketKeys(configForClient)
   170  
   171  	clientVersions := clientHello.supportedVersions
   172  	if len(clientHello.supportedVersions) == 0 {
   173  		clientVersions = supportedVersionsFromMax(clientHello.vers)
   174  	}
   175  	c.vers, ok = c.config.mutualVersion(roleServer, clientVersions)
   176  	if !ok {
   177  		c.sendAlert(alertProtocolVersion)
   178  		return nil, nil, fmt.Errorf("tls: client offered only unsupported versions: %x", clientVersions)
   179  	}
   180  	c.haveVers = true
   181  	c.in.version = c.vers
   182  	c.out.version = c.vers
   183  
   184  	// This check reflects some odd specification implied behavior. Client-facing servers
   185  	// are supposed to reject hellos with outer ECH and inner ECH that offers 1.2, but
   186  	// backend servers are allowed to accept hellos with inner ECH that offer 1.2, since
   187  	// they cannot expect client-facing servers to behave properly. Since we act as both
   188  	// a client-facing and backend server, we only enforce 1.3 being negotiated if we
   189  	// saw a hello with outer ECH first. The spec probably should've made this an error,
   190  	// but it didn't, and this matches the boringssl behavior.
   191  	if c.vers != VersionTLS13 && (ech != nil && !ech.inner) {
   192  		c.sendAlert(alertIllegalParameter)
   193  		return nil, nil, errors.New("tls: Encrypted Client Hello cannot be used pre-TLS 1.3")
   194  	}
   195  
   196  	if c.config.MinVersion == 0 && c.vers < VersionTLS12 {
   197  		tls10server.Value() // ensure godebug is initialized
   198  		tls10server.IncNonDefault()
   199  	}
   200  
   201  	return clientHello, ech, nil
   202  }
   203  
   204  func (hs *serverHandshakeState) processClientHello() error {
   205  	c := hs.c
   206  
   207  	hs.hello = new(serverHelloMsg)
   208  	hs.hello.vers = c.vers
   209  
   210  	foundCompression := false
   211  	// We only support null compression, so check that the client offered it.
   212  	for _, compression := range hs.clientHello.compressionMethods {
   213  		if compression == compressionNone {
   214  			foundCompression = true
   215  			break
   216  		}
   217  	}
   218  
   219  	if !foundCompression {
   220  		c.sendAlert(alertHandshakeFailure)
   221  		return errors.New("tls: client does not support uncompressed connections")
   222  	}
   223  
   224  	hs.hello.random = make([]byte, 32)
   225  	serverRandom := hs.hello.random
   226  	// Downgrade protection canaries. See RFC 8446, Section 4.1.3.
   227  	maxVers := c.config.maxSupportedVersion(roleServer)
   228  	if maxVers >= VersionTLS12 && c.vers < maxVers || testingOnlyForceDowngradeCanary {
   229  		if c.vers == VersionTLS12 {
   230  			copy(serverRandom[24:], downgradeCanaryTLS12)
   231  		} else {
   232  			copy(serverRandom[24:], downgradeCanaryTLS11)
   233  		}
   234  		serverRandom = serverRandom[:24]
   235  	}
   236  	_, err := io.ReadFull(c.config.rand(), serverRandom)
   237  	if err != nil {
   238  		c.sendAlert(alertInternalError)
   239  		return err
   240  	}
   241  
   242  	if len(hs.clientHello.secureRenegotiation) != 0 {
   243  		c.sendAlert(alertHandshakeFailure)
   244  		return errors.New("tls: initial handshake had non-empty renegotiation extension")
   245  	}
   246  
   247  	hs.hello.extendedMasterSecret = hs.clientHello.extendedMasterSecret
   248  	hs.hello.secureRenegotiationSupported = hs.clientHello.secureRenegotiationSupported
   249  	hs.hello.compressionMethod = compressionNone
   250  	if len(hs.clientHello.serverName) > 0 {
   251  		c.serverName = hs.clientHello.serverName
   252  	}
   253  
   254  	selectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols, false)
   255  	if err != nil {
   256  		c.sendAlert(alertNoApplicationProtocol)
   257  		return err
   258  	}
   259  	hs.hello.alpnProtocol = selectedProto
   260  	c.clientProtocol = selectedProto
   261  
   262  	hs.cert, err = c.config.getCertificate(clientHelloInfo(hs.ctx, c, hs.clientHello))
   263  	if err != nil {
   264  		if err == errNoCertificates {
   265  			c.sendAlert(alertUnrecognizedName)
   266  		} else {
   267  			c.sendAlert(alertInternalError)
   268  		}
   269  		return err
   270  	}
   271  	if hs.clientHello.scts {
   272  		hs.hello.scts = hs.cert.SignedCertificateTimestamps
   273  	}
   274  
   275  	hs.ecdheOk = supportsECDHE(c.config, c.vers, hs.clientHello.supportedCurves, hs.clientHello.supportedPoints)
   276  
   277  	if hs.ecdheOk && len(hs.clientHello.supportedPoints) > 0 {
   278  		// Although omitting the ec_point_formats extension is permitted, some
   279  		// old OpenSSL version will refuse to handshake if not present.
   280  		//
   281  		// Per RFC 4492, section 5.1.2, implementations MUST support the
   282  		// uncompressed point format. See golang.org/issue/31943.
   283  		hs.hello.supportedPoints = []uint8{pointFormatUncompressed}
   284  	}
   285  
   286  	if priv, ok := hs.cert.PrivateKey.(crypto.Signer); ok {
   287  		switch priv.Public().(type) {
   288  		case *ecdsa.PublicKey:
   289  			hs.ecSignOk = true
   290  		case ed25519.PublicKey:
   291  			hs.ecSignOk = true
   292  		case *rsa.PublicKey:
   293  			hs.rsaSignOk = true
   294  		default:
   295  			c.sendAlert(alertInternalError)
   296  			return fmt.Errorf("tls: unsupported signing key type (%T)", priv.Public())
   297  		}
   298  	}
   299  	if priv, ok := hs.cert.PrivateKey.(crypto.Decrypter); ok {
   300  		switch priv.Public().(type) {
   301  		case *rsa.PublicKey:
   302  			hs.rsaDecryptOk = true
   303  		default:
   304  			c.sendAlert(alertInternalError)
   305  			return fmt.Errorf("tls: unsupported decryption key type (%T)", priv.Public())
   306  		}
   307  	}
   308  
   309  	return nil
   310  }
   311  
   312  // negotiateALPN picks a shared ALPN protocol that both sides support in server
   313  // preference order. If ALPN is not configured or the peer doesn't support it,
   314  // it returns "" and no error.
   315  func negotiateALPN(serverProtos, clientProtos []string, quic bool) (string, error) {
   316  	if len(serverProtos) == 0 || len(clientProtos) == 0 {
   317  		if quic && len(serverProtos) != 0 {
   318  			// RFC 9001, Section 8.1
   319  			return "", fmt.Errorf("tls: client did not request an application protocol")
   320  		}
   321  		return "", nil
   322  	}
   323  	var http11fallback bool
   324  	for _, s := range serverProtos {
   325  		for _, c := range clientProtos {
   326  			if s == c {
   327  				return s, nil
   328  			}
   329  			if s == "h2" && c == "http/1.1" {
   330  				http11fallback = true
   331  			}
   332  		}
   333  	}
   334  	// As a special case, let http/1.1 clients connect to h2 servers as if they
   335  	// didn't support ALPN. We used not to enforce protocol overlap, so over
   336  	// time a number of HTTP servers were configured with only "h2", but
   337  	// expected to accept connections from "http/1.1" clients. See Issue 46310.
   338  	if http11fallback {
   339  		return "", nil
   340  	}
   341  	return "", fmt.Errorf("tls: client requested unsupported application protocols (%s)", clientProtos)
   342  }
   343  
   344  // supportsECDHE returns whether ECDHE key exchanges can be used with this
   345  // pre-TLS 1.3 client.
   346  func supportsECDHE(c *Config, version uint16, supportedCurves []CurveID, supportedPoints []uint8) bool {
   347  	supportsCurve := false
   348  	for _, curve := range supportedCurves {
   349  		if c.supportsCurve(version, curve) {
   350  			supportsCurve = true
   351  			break
   352  		}
   353  	}
   354  
   355  	supportsPointFormat := false
   356  	for _, pointFormat := range supportedPoints {
   357  		if pointFormat == pointFormatUncompressed {
   358  			supportsPointFormat = true
   359  			break
   360  		}
   361  	}
   362  	// Per RFC 8422, Section 5.1.2, if the Supported Point Formats extension is
   363  	// missing, uncompressed points are supported. If supportedPoints is empty,
   364  	// the extension must be missing, as an empty extension body is rejected by
   365  	// the parser. See https://go.dev/issue/49126.
   366  	if len(supportedPoints) == 0 {
   367  		supportsPointFormat = true
   368  	}
   369  
   370  	return supportsCurve && supportsPointFormat
   371  }
   372  
   373  func (hs *serverHandshakeState) pickCipherSuite() error {
   374  	c := hs.c
   375  
   376  	preferenceOrder := cipherSuitesPreferenceOrder
   377  	if !hasAESGCMHardwareSupport || !aesgcmPreferred(hs.clientHello.cipherSuites) {
   378  		preferenceOrder = cipherSuitesPreferenceOrderNoAES
   379  	}
   380  
   381  	configCipherSuites := c.config.cipherSuites()
   382  	preferenceList := make([]uint16, 0, len(configCipherSuites))
   383  	for _, suiteID := range preferenceOrder {
   384  		for _, id := range configCipherSuites {
   385  			if id == suiteID {
   386  				preferenceList = append(preferenceList, id)
   387  				break
   388  			}
   389  		}
   390  	}
   391  
   392  	hs.suite = selectCipherSuite(preferenceList, hs.clientHello.cipherSuites, hs.cipherSuiteOk)
   393  	if hs.suite == nil {
   394  		c.sendAlert(alertHandshakeFailure)
   395  		return errors.New("tls: no cipher suite supported by both client and server")
   396  	}
   397  	c.cipherSuite = hs.suite.id
   398  
   399  	if c.config.CipherSuites == nil && !fips140tls.Required() && rsaKexCiphers[hs.suite.id] {
   400  		tlsrsakex.Value() // ensure godebug is initialized
   401  		tlsrsakex.IncNonDefault()
   402  	}
   403  	if c.config.CipherSuites == nil && !fips140tls.Required() && tdesCiphers[hs.suite.id] {
   404  		tls3des.Value() // ensure godebug is initialized
   405  		tls3des.IncNonDefault()
   406  	}
   407  
   408  	for _, id := range hs.clientHello.cipherSuites {
   409  		if id == TLS_FALLBACK_SCSV {
   410  			// The client is doing a fallback connection. See RFC 7507.
   411  			if hs.clientHello.vers < c.config.maxSupportedVersion(roleServer) {
   412  				c.sendAlert(alertInappropriateFallback)
   413  				return errors.New("tls: client using inappropriate protocol fallback")
   414  			}
   415  			break
   416  		}
   417  	}
   418  
   419  	return nil
   420  }
   421  
   422  func (hs *serverHandshakeState) cipherSuiteOk(c *cipherSuite) bool {
   423  	if c.flags&suiteECDHE != 0 {
   424  		if !hs.ecdheOk {
   425  			return false
   426  		}
   427  		if c.flags&suiteECSign != 0 {
   428  			if !hs.ecSignOk {
   429  				return false
   430  			}
   431  		} else if !hs.rsaSignOk {
   432  			return false
   433  		}
   434  	} else if !hs.rsaDecryptOk {
   435  		return false
   436  	}
   437  	if hs.c.vers < VersionTLS12 && c.flags&suiteTLS12 != 0 {
   438  		return false
   439  	}
   440  	return true
   441  }
   442  
   443  // checkForResumption reports whether we should perform resumption on this connection.
   444  func (hs *serverHandshakeState) checkForResumption() error {
   445  	c := hs.c
   446  
   447  	if c.config.SessionTicketsDisabled {
   448  		return nil
   449  	}
   450  
   451  	var sessionState *SessionState
   452  	if c.config.UnwrapSession != nil {
   453  		ss, err := c.config.UnwrapSession(hs.clientHello.sessionTicket, c.connectionStateLocked())
   454  		if err != nil {
   455  			return err
   456  		}
   457  		if ss == nil {
   458  			return nil
   459  		}
   460  		sessionState = ss
   461  	} else {
   462  		plaintext := c.config.decryptTicket(hs.clientHello.sessionTicket, c.ticketKeys)
   463  		if plaintext == nil {
   464  			return nil
   465  		}
   466  		ss, err := ParseSessionState(plaintext)
   467  		if err != nil {
   468  			return nil
   469  		}
   470  		sessionState = ss
   471  	}
   472  
   473  	// TLS 1.2 tickets don't natively have a lifetime, but we want to avoid
   474  	// re-wrapping the same master secret in different tickets over and over for
   475  	// too long, weakening forward secrecy.
   476  	createdAt := time.Unix(int64(sessionState.createdAt), 0)
   477  	if c.config.time().Sub(createdAt) > maxSessionTicketLifetime {
   478  		return nil
   479  	}
   480  
   481  	// Never resume a session for a different TLS version.
   482  	if c.vers != sessionState.version {
   483  		return nil
   484  	}
   485  
   486  	cipherSuiteOk := false
   487  	// Check that the client is still offering the ciphersuite in the session.
   488  	for _, id := range hs.clientHello.cipherSuites {
   489  		if id == sessionState.cipherSuite {
   490  			cipherSuiteOk = true
   491  			break
   492  		}
   493  	}
   494  	if !cipherSuiteOk {
   495  		return nil
   496  	}
   497  
   498  	// Check that we also support the ciphersuite from the session.
   499  	suite := selectCipherSuite([]uint16{sessionState.cipherSuite},
   500  		c.config.cipherSuites(), hs.cipherSuiteOk)
   501  	if suite == nil {
   502  		return nil
   503  	}
   504  
   505  	sessionHasClientCerts := len(sessionState.peerCertificates) != 0
   506  	needClientCerts := requiresClientCert(c.config.ClientAuth)
   507  	if needClientCerts && !sessionHasClientCerts {
   508  		return nil
   509  	}
   510  	if sessionHasClientCerts && c.config.ClientAuth == NoClientCert {
   511  		return nil
   512  	}
   513  	if sessionHasClientCerts && c.config.time().After(sessionState.peerCertificates[0].NotAfter) {
   514  		return nil
   515  	}
   516  	if sessionHasClientCerts && c.config.ClientAuth >= VerifyClientCertIfGiven &&
   517  		len(sessionState.verifiedChains) == 0 {
   518  		return nil
   519  	}
   520  
   521  	// RFC 7627, Section 5.3
   522  	if !sessionState.extMasterSecret && hs.clientHello.extendedMasterSecret {
   523  		return nil
   524  	}
   525  	if sessionState.extMasterSecret && !hs.clientHello.extendedMasterSecret {
   526  		// Aborting is somewhat harsh, but it's a MUST and it would indicate a
   527  		// weird downgrade in client capabilities.
   528  		return errors.New("tls: session supported extended_master_secret but client does not")
   529  	}
   530  
   531  	c.peerCertificates = sessionState.peerCertificates
   532  	c.ocspResponse = sessionState.ocspResponse
   533  	c.scts = sessionState.scts
   534  	c.verifiedChains = sessionState.verifiedChains
   535  	c.extMasterSecret = sessionState.extMasterSecret
   536  	hs.sessionState = sessionState
   537  	hs.suite = suite
   538  	c.didResume = true
   539  	return nil
   540  }
   541  
   542  func (hs *serverHandshakeState) doResumeHandshake() error {
   543  	c := hs.c
   544  
   545  	hs.hello.cipherSuite = hs.suite.id
   546  	c.cipherSuite = hs.suite.id
   547  	// We echo the client's session ID in the ServerHello to let it know
   548  	// that we're doing a resumption.
   549  	hs.hello.sessionId = hs.clientHello.sessionId
   550  	// We always send a new session ticket, even if it wraps the same master
   551  	// secret and it's potentially encrypted with the same key, to help the
   552  	// client avoid cross-connection tracking from a network observer.
   553  	hs.hello.ticketSupported = true
   554  	hs.finishedHash = newFinishedHash(c.vers, hs.suite)
   555  	hs.finishedHash.discardHandshakeBuffer()
   556  	if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
   557  		return err
   558  	}
   559  	if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
   560  		return err
   561  	}
   562  
   563  	if c.config.VerifyConnection != nil {
   564  		if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
   565  			c.sendAlert(alertBadCertificate)
   566  			return err
   567  		}
   568  	}
   569  
   570  	hs.masterSecret = hs.sessionState.secret
   571  
   572  	return nil
   573  }
   574  
   575  func (hs *serverHandshakeState) doFullHandshake() error {
   576  	c := hs.c
   577  
   578  	if hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 {
   579  		hs.hello.ocspStapling = true
   580  	}
   581  
   582  	hs.hello.ticketSupported = hs.clientHello.ticketSupported && !c.config.SessionTicketsDisabled
   583  	hs.hello.cipherSuite = hs.suite.id
   584  
   585  	hs.finishedHash = newFinishedHash(hs.c.vers, hs.suite)
   586  	if c.config.ClientAuth == NoClientCert {
   587  		// No need to keep a full record of the handshake if client
   588  		// certificates won't be used.
   589  		hs.finishedHash.discardHandshakeBuffer()
   590  	}
   591  	if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
   592  		return err
   593  	}
   594  	if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
   595  		return err
   596  	}
   597  
   598  	certMsg := new(certificateMsg)
   599  	certMsg.certificates = hs.cert.Certificate
   600  	if _, err := hs.c.writeHandshakeRecord(certMsg, &hs.finishedHash); err != nil {
   601  		return err
   602  	}
   603  
   604  	if hs.hello.ocspStapling {
   605  		certStatus := new(certificateStatusMsg)
   606  		certStatus.response = hs.cert.OCSPStaple
   607  		if _, err := hs.c.writeHandshakeRecord(certStatus, &hs.finishedHash); err != nil {
   608  			return err
   609  		}
   610  	}
   611  
   612  	keyAgreement := hs.suite.ka(c.vers)
   613  	skx, err := keyAgreement.generateServerKeyExchange(c.config, hs.cert, hs.clientHello, hs.hello)
   614  	if err != nil {
   615  		c.sendAlert(alertHandshakeFailure)
   616  		return err
   617  	}
   618  	if skx != nil {
   619  		if len(skx.key) >= 3 && skx.key[0] == 3 /* named curve */ {
   620  			c.curveID = CurveID(byteorder.BEUint16(skx.key[1:]))
   621  		}
   622  		if _, err := hs.c.writeHandshakeRecord(skx, &hs.finishedHash); err != nil {
   623  			return err
   624  		}
   625  	}
   626  
   627  	var certReq *certificateRequestMsg
   628  	if c.config.ClientAuth >= RequestClientCert {
   629  		// Request a client certificate
   630  		certReq = new(certificateRequestMsg)
   631  		certReq.certificateTypes = []byte{
   632  			byte(certTypeRSASign),
   633  			byte(certTypeECDSASign),
   634  		}
   635  		if c.vers >= VersionTLS12 {
   636  			certReq.hasSignatureAlgorithm = true
   637  			certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms()
   638  		}
   639  
   640  		// An empty list of certificateAuthorities signals to
   641  		// the client that it may send any certificate in response
   642  		// to our request. When we know the CAs we trust, then
   643  		// we can send them down, so that the client can choose
   644  		// an appropriate certificate to give to us.
   645  		if c.config.ClientCAs != nil {
   646  			certReq.certificateAuthorities = c.config.ClientCAs.Subjects()
   647  		}
   648  		if _, err := hs.c.writeHandshakeRecord(certReq, &hs.finishedHash); err != nil {
   649  			return err
   650  		}
   651  	}
   652  
   653  	helloDone := new(serverHelloDoneMsg)
   654  	if _, err := hs.c.writeHandshakeRecord(helloDone, &hs.finishedHash); err != nil {
   655  		return err
   656  	}
   657  
   658  	if _, err := c.flush(); err != nil {
   659  		return err
   660  	}
   661  
   662  	var pub crypto.PublicKey // public key for client auth, if any
   663  
   664  	msg, err := c.readHandshake(&hs.finishedHash)
   665  	if err != nil {
   666  		return err
   667  	}
   668  
   669  	// If we requested a client certificate, then the client must send a
   670  	// certificate message, even if it's empty.
   671  	if c.config.ClientAuth >= RequestClientCert {
   672  		certMsg, ok := msg.(*certificateMsg)
   673  		if !ok {
   674  			c.sendAlert(alertUnexpectedMessage)
   675  			return unexpectedMessageError(certMsg, msg)
   676  		}
   677  
   678  		if err := c.processCertsFromClient(Certificate{
   679  			Certificate: certMsg.certificates,
   680  		}); err != nil {
   681  			return err
   682  		}
   683  		if len(certMsg.certificates) != 0 {
   684  			pub = c.peerCertificates[0].PublicKey
   685  		}
   686  
   687  		msg, err = c.readHandshake(&hs.finishedHash)
   688  		if err != nil {
   689  			return err
   690  		}
   691  	}
   692  	if c.config.VerifyConnection != nil {
   693  		if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
   694  			c.sendAlert(alertBadCertificate)
   695  			return err
   696  		}
   697  	}
   698  
   699  	// Get client key exchange
   700  	ckx, ok := msg.(*clientKeyExchangeMsg)
   701  	if !ok {
   702  		c.sendAlert(alertUnexpectedMessage)
   703  		return unexpectedMessageError(ckx, msg)
   704  	}
   705  
   706  	preMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers)
   707  	if err != nil {
   708  		c.sendAlert(alertIllegalParameter)
   709  		return err
   710  	}
   711  	if hs.hello.extendedMasterSecret {
   712  		c.extMasterSecret = true
   713  		hs.masterSecret = extMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
   714  			hs.finishedHash.Sum())
   715  	} else {
   716  		hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
   717  			hs.clientHello.random, hs.hello.random)
   718  	}
   719  	if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.clientHello.random, hs.masterSecret); err != nil {
   720  		c.sendAlert(alertInternalError)
   721  		return err
   722  	}
   723  
   724  	// If we received a client cert in response to our certificate request message,
   725  	// the client will send us a certificateVerifyMsg immediately after the
   726  	// clientKeyExchangeMsg. This message is a digest of all preceding
   727  	// handshake-layer messages that is signed using the private key corresponding
   728  	// to the client's certificate. This allows us to verify that the client is in
   729  	// possession of the private key of the certificate.
   730  	if len(c.peerCertificates) > 0 {
   731  		// certificateVerifyMsg is included in the transcript, but not until
   732  		// after we verify the handshake signature, since the state before
   733  		// this message was sent is used.
   734  		msg, err = c.readHandshake(nil)
   735  		if err != nil {
   736  			return err
   737  		}
   738  		certVerify, ok := msg.(*certificateVerifyMsg)
   739  		if !ok {
   740  			c.sendAlert(alertUnexpectedMessage)
   741  			return unexpectedMessageError(certVerify, msg)
   742  		}
   743  
   744  		var sigType uint8
   745  		var sigHash crypto.Hash
   746  		if c.vers >= VersionTLS12 {
   747  			if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, certReq.supportedSignatureAlgorithms) {
   748  				c.sendAlert(alertIllegalParameter)
   749  				return errors.New("tls: client certificate used with invalid signature algorithm")
   750  			}
   751  			sigType, sigHash, err = typeAndHashFromSignatureScheme(certVerify.signatureAlgorithm)
   752  			if err != nil {
   753  				return c.sendAlert(alertInternalError)
   754  			}
   755  		} else {
   756  			sigType, sigHash, err = legacyTypeAndHashFromPublicKey(pub)
   757  			if err != nil {
   758  				c.sendAlert(alertIllegalParameter)
   759  				return err
   760  			}
   761  		}
   762  
   763  		signed := hs.finishedHash.hashForClientCertificate(sigType, sigHash)
   764  		if err := verifyHandshakeSignature(sigType, pub, sigHash, signed, certVerify.signature); err != nil {
   765  			c.sendAlert(alertDecryptError)
   766  			return errors.New("tls: invalid signature by the client certificate: " + err.Error())
   767  		}
   768  
   769  		if err := transcriptMsg(certVerify, &hs.finishedHash); err != nil {
   770  			return err
   771  		}
   772  	}
   773  
   774  	hs.finishedHash.discardHandshakeBuffer()
   775  
   776  	return nil
   777  }
   778  
   779  func (hs *serverHandshakeState) establishKeys() error {
   780  	c := hs.c
   781  
   782  	clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
   783  		keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
   784  
   785  	var clientCipher, serverCipher any
   786  	var clientHash, serverHash hash.Hash
   787  
   788  	if hs.suite.aead == nil {
   789  		clientCipher = hs.suite.cipher(clientKey, clientIV, true /* for reading */)
   790  		clientHash = hs.suite.mac(clientMAC)
   791  		serverCipher = hs.suite.cipher(serverKey, serverIV, false /* not for reading */)
   792  		serverHash = hs.suite.mac(serverMAC)
   793  	} else {
   794  		clientCipher = hs.suite.aead(clientKey, clientIV)
   795  		serverCipher = hs.suite.aead(serverKey, serverIV)
   796  	}
   797  
   798  	c.in.prepareCipherSpec(c.vers, clientCipher, clientHash)
   799  	c.out.prepareCipherSpec(c.vers, serverCipher, serverHash)
   800  
   801  	return nil
   802  }
   803  
   804  func (hs *serverHandshakeState) readFinished(out []byte) error {
   805  	c := hs.c
   806  
   807  	if err := c.readChangeCipherSpec(); err != nil {
   808  		return err
   809  	}
   810  
   811  	// finishedMsg is included in the transcript, but not until after we
   812  	// check the client version, since the state before this message was
   813  	// sent is used during verification.
   814  	msg, err := c.readHandshake(nil)
   815  	if err != nil {
   816  		return err
   817  	}
   818  	clientFinished, ok := msg.(*finishedMsg)
   819  	if !ok {
   820  		c.sendAlert(alertUnexpectedMessage)
   821  		return unexpectedMessageError(clientFinished, msg)
   822  	}
   823  
   824  	verify := hs.finishedHash.clientSum(hs.masterSecret)
   825  	if len(verify) != len(clientFinished.verifyData) ||
   826  		subtle.ConstantTimeCompare(verify, clientFinished.verifyData) != 1 {
   827  		c.sendAlert(alertHandshakeFailure)
   828  		return errors.New("tls: client's Finished message is incorrect")
   829  	}
   830  
   831  	if err := transcriptMsg(clientFinished, &hs.finishedHash); err != nil {
   832  		return err
   833  	}
   834  
   835  	copy(out, verify)
   836  	return nil
   837  }
   838  
   839  func (hs *serverHandshakeState) sendSessionTicket() error {
   840  	if !hs.hello.ticketSupported {
   841  		return nil
   842  	}
   843  
   844  	c := hs.c
   845  	m := new(newSessionTicketMsg)
   846  
   847  	state := c.sessionState()
   848  	state.secret = hs.masterSecret
   849  	if hs.sessionState != nil {
   850  		// If this is re-wrapping an old key, then keep
   851  		// the original time it was created.
   852  		state.createdAt = hs.sessionState.createdAt
   853  	}
   854  	if c.config.WrapSession != nil {
   855  		var err error
   856  		m.ticket, err = c.config.WrapSession(c.connectionStateLocked(), state)
   857  		if err != nil {
   858  			return err
   859  		}
   860  	} else {
   861  		stateBytes, err := state.Bytes()
   862  		if err != nil {
   863  			return err
   864  		}
   865  		m.ticket, err = c.config.encryptTicket(stateBytes, c.ticketKeys)
   866  		if err != nil {
   867  			return err
   868  		}
   869  	}
   870  
   871  	if _, err := hs.c.writeHandshakeRecord(m, &hs.finishedHash); err != nil {
   872  		return err
   873  	}
   874  
   875  	return nil
   876  }
   877  
   878  func (hs *serverHandshakeState) sendFinished(out []byte) error {
   879  	c := hs.c
   880  
   881  	if err := c.writeChangeCipherRecord(); err != nil {
   882  		return err
   883  	}
   884  
   885  	finished := new(finishedMsg)
   886  	finished.verifyData = hs.finishedHash.serverSum(hs.masterSecret)
   887  	if _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil {
   888  		return err
   889  	}
   890  
   891  	copy(out, finished.verifyData)
   892  
   893  	return nil
   894  }
   895  
   896  // processCertsFromClient takes a chain of client certificates either from a
   897  // Certificates message and verifies them.
   898  func (c *Conn) processCertsFromClient(certificate Certificate) error {
   899  	certificates := certificate.Certificate
   900  	certs := make([]*x509.Certificate, len(certificates))
   901  	var err error
   902  	for i, asn1Data := range certificates {
   903  		if certs[i], err = x509.ParseCertificate(asn1Data); err != nil {
   904  			c.sendAlert(alertBadCertificate)
   905  			return errors.New("tls: failed to parse client certificate: " + err.Error())
   906  		}
   907  		if certs[i].PublicKeyAlgorithm == x509.RSA {
   908  			n := certs[i].PublicKey.(*rsa.PublicKey).N.BitLen()
   909  			if max, ok := checkKeySize(n); !ok {
   910  				c.sendAlert(alertBadCertificate)
   911  				return fmt.Errorf("tls: client sent certificate containing RSA key larger than %d bits", max)
   912  			}
   913  		}
   914  	}
   915  
   916  	if len(certs) == 0 && requiresClientCert(c.config.ClientAuth) {
   917  		if c.vers == VersionTLS13 {
   918  			c.sendAlert(alertCertificateRequired)
   919  		} else {
   920  			c.sendAlert(alertBadCertificate)
   921  		}
   922  		return errors.New("tls: client didn't provide a certificate")
   923  	}
   924  
   925  	if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
   926  		opts := x509.VerifyOptions{
   927  			Roots:         c.config.ClientCAs,
   928  			CurrentTime:   c.config.time(),
   929  			Intermediates: x509.NewCertPool(),
   930  			KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
   931  		}
   932  
   933  		for _, cert := range certs[1:] {
   934  			opts.Intermediates.AddCert(cert)
   935  		}
   936  
   937  		chains, err := certs[0].Verify(opts)
   938  		if err != nil {
   939  			var errCertificateInvalid x509.CertificateInvalidError
   940  			if errors.As(err, &x509.UnknownAuthorityError{}) {
   941  				c.sendAlert(alertUnknownCA)
   942  			} else if errors.As(err, &errCertificateInvalid) && errCertificateInvalid.Reason == x509.Expired {
   943  				c.sendAlert(alertCertificateExpired)
   944  			} else {
   945  				c.sendAlert(alertBadCertificate)
   946  			}
   947  			return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
   948  		}
   949  
   950  		c.verifiedChains, err = fipsAllowedChains(chains)
   951  		if err != nil {
   952  			c.sendAlert(alertBadCertificate)
   953  			return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
   954  		}
   955  	}
   956  
   957  	c.peerCertificates = certs
   958  	c.ocspResponse = certificate.OCSPStaple
   959  	c.scts = certificate.SignedCertificateTimestamps
   960  
   961  	if len(certs) > 0 {
   962  		switch certs[0].PublicKey.(type) {
   963  		case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
   964  		default:
   965  			c.sendAlert(alertUnsupportedCertificate)
   966  			return fmt.Errorf("tls: client certificate contains an unsupported public key of type %T", certs[0].PublicKey)
   967  		}
   968  	}
   969  
   970  	if c.config.VerifyPeerCertificate != nil {
   971  		if err := c.config.VerifyPeerCertificate(certificates, c.verifiedChains); err != nil {
   972  			c.sendAlert(alertBadCertificate)
   973  			return err
   974  		}
   975  	}
   976  
   977  	return nil
   978  }
   979  
   980  func clientHelloInfo(ctx context.Context, c *Conn, clientHello *clientHelloMsg) *ClientHelloInfo {
   981  	supportedVersions := clientHello.supportedVersions
   982  	if len(clientHello.supportedVersions) == 0 {
   983  		supportedVersions = supportedVersionsFromMax(clientHello.vers)
   984  	}
   985  
   986  	return &ClientHelloInfo{
   987  		CipherSuites:      clientHello.cipherSuites,
   988  		ServerName:        clientHello.serverName,
   989  		SupportedCurves:   clientHello.supportedCurves,
   990  		SupportedPoints:   clientHello.supportedPoints,
   991  		SignatureSchemes:  clientHello.supportedSignatureAlgorithms,
   992  		SupportedProtos:   clientHello.alpnProtocols,
   993  		SupportedVersions: supportedVersions,
   994  		Extensions:        clientHello.extensions,
   995  		Conn:              c.conn,
   996  		config:            c.config,
   997  		ctx:               ctx,
   998  	}
   999  }
  1000  

View as plain text