Source file src/crypto/tls/handshake_server.go

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"context"
     9  	"crypto"
    10  	"crypto/ecdsa"
    11  	"crypto/ed25519"
    12  	"crypto/rsa"
    13  	"crypto/subtle"
    14  	"crypto/tls/internal/fips140tls"
    15  	"crypto/x509"
    16  	"errors"
    17  	"fmt"
    18  	"hash"
    19  	"io"
    20  	"time"
    21  )
    22  
    23  // serverHandshakeState contains details of a server handshake in progress.
    24  // It's discarded once the handshake has completed.
    25  type serverHandshakeState struct {
    26  	c            *Conn
    27  	ctx          context.Context
    28  	clientHello  *clientHelloMsg
    29  	hello        *serverHelloMsg
    30  	suite        *cipherSuite
    31  	ecdheOk      bool
    32  	ecSignOk     bool
    33  	rsaDecryptOk bool
    34  	rsaSignOk    bool
    35  	sessionState *SessionState
    36  	finishedHash finishedHash
    37  	masterSecret []byte
    38  	cert         *Certificate
    39  }
    40  
    41  // serverHandshake performs a TLS handshake as a server.
    42  func (c *Conn) serverHandshake(ctx context.Context) error {
    43  	clientHello, ech, err := c.readClientHello(ctx)
    44  	if err != nil {
    45  		return err
    46  	}
    47  
    48  	if c.vers == VersionTLS13 {
    49  		hs := serverHandshakeStateTLS13{
    50  			c:           c,
    51  			ctx:         ctx,
    52  			clientHello: clientHello,
    53  			echContext:  ech,
    54  		}
    55  		return hs.handshake()
    56  	}
    57  
    58  	hs := serverHandshakeState{
    59  		c:           c,
    60  		ctx:         ctx,
    61  		clientHello: clientHello,
    62  	}
    63  	return hs.handshake()
    64  }
    65  
    66  func (hs *serverHandshakeState) handshake() error {
    67  	c := hs.c
    68  
    69  	if err := hs.processClientHello(); err != nil {
    70  		return err
    71  	}
    72  
    73  	// For an overview of TLS handshaking, see RFC 5246, Section 7.3.
    74  	c.buffering = true
    75  	if err := hs.checkForResumption(); err != nil {
    76  		return err
    77  	}
    78  	if hs.sessionState != nil {
    79  		// The client has included a session ticket and so we do an abbreviated handshake.
    80  		if err := hs.doResumeHandshake(); err != nil {
    81  			return err
    82  		}
    83  		if err := hs.establishKeys(); err != nil {
    84  			return err
    85  		}
    86  		if err := hs.sendSessionTicket(); err != nil {
    87  			return err
    88  		}
    89  		if err := hs.sendFinished(c.serverFinished[:]); err != nil {
    90  			return err
    91  		}
    92  		if _, err := c.flush(); err != nil {
    93  			return err
    94  		}
    95  		c.clientFinishedIsFirst = false
    96  		if err := hs.readFinished(nil); err != nil {
    97  			return err
    98  		}
    99  	} else {
   100  		// The client didn't include a session ticket, or it wasn't
   101  		// valid so we do a full handshake.
   102  		if err := hs.pickCipherSuite(); err != nil {
   103  			return err
   104  		}
   105  		if err := hs.doFullHandshake(); err != nil {
   106  			return err
   107  		}
   108  		if err := hs.establishKeys(); err != nil {
   109  			return err
   110  		}
   111  		if err := hs.readFinished(c.clientFinished[:]); err != nil {
   112  			return err
   113  		}
   114  		c.clientFinishedIsFirst = true
   115  		c.buffering = true
   116  		if err := hs.sendSessionTicket(); err != nil {
   117  			return err
   118  		}
   119  		if err := hs.sendFinished(nil); err != nil {
   120  			return err
   121  		}
   122  		if _, err := c.flush(); err != nil {
   123  			return err
   124  		}
   125  	}
   126  
   127  	c.ekm = ekmFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random)
   128  	c.isHandshakeComplete.Store(true)
   129  
   130  	return nil
   131  }
   132  
   133  // readClientHello reads a ClientHello message and selects the protocol version.
   134  func (c *Conn) readClientHello(ctx context.Context) (*clientHelloMsg, *echServerContext, error) {
   135  	// clientHelloMsg is included in the transcript, but we haven't initialized
   136  	// it yet. The respective handshake functions will record it themselves.
   137  	msg, err := c.readHandshake(nil)
   138  	if err != nil {
   139  		return nil, nil, err
   140  	}
   141  	clientHello, ok := msg.(*clientHelloMsg)
   142  	if !ok {
   143  		c.sendAlert(alertUnexpectedMessage)
   144  		return nil, nil, unexpectedMessageError(clientHello, msg)
   145  	}
   146  
   147  	// ECH processing has to be done before we do any other negotiation based on
   148  	// the contents of the client hello, since we may swap it out completely.
   149  	var ech *echServerContext
   150  	if len(clientHello.encryptedClientHello) != 0 {
   151  		echKeys := c.config.EncryptedClientHelloKeys
   152  		if c.config.GetEncryptedClientHelloKeys != nil {
   153  			echKeys, err = c.config.GetEncryptedClientHelloKeys(clientHelloInfo(ctx, c, clientHello))
   154  			if err != nil {
   155  				c.sendAlert(alertInternalError)
   156  				return nil, nil, err
   157  			}
   158  		}
   159  		clientHello, ech, err = c.processECHClientHello(clientHello, echKeys)
   160  		if err != nil {
   161  			return nil, nil, err
   162  		}
   163  	}
   164  
   165  	var configForClient *Config
   166  	originalConfig := c.config
   167  	if c.config.GetConfigForClient != nil {
   168  		chi := clientHelloInfo(ctx, c, clientHello)
   169  		if configForClient, err = c.config.GetConfigForClient(chi); err != nil {
   170  			c.sendAlert(alertInternalError)
   171  			return nil, nil, err
   172  		} else if configForClient != nil {
   173  			c.config = configForClient
   174  		}
   175  	}
   176  	c.ticketKeys = originalConfig.ticketKeys(configForClient)
   177  
   178  	clientVersions := clientHello.supportedVersions
   179  	if clientHello.vers >= VersionTLS13 && len(clientVersions) == 0 {
   180  		// RFC 8446 4.2.1 indicates when the supported_versions extension is not sent,
   181  		// compatible servers MUST negotiate TLS 1.2 or earlier if supported, even
   182  		// if the client legacy version is TLS 1.3 or later.
   183  		//
   184  		// Since we reject empty extensionSupportedVersions in the client hello unmarshal
   185  		// finding the supportedVersions empty indicates the extension was not present.
   186  		clientVersions = supportedVersionsFromMax(VersionTLS12)
   187  	} else if len(clientVersions) == 0 {
   188  		clientVersions = supportedVersionsFromMax(clientHello.vers)
   189  	}
   190  	c.vers, ok = c.config.mutualVersion(roleServer, clientVersions)
   191  	if !ok {
   192  		c.sendAlert(alertProtocolVersion)
   193  		return nil, nil, fmt.Errorf("tls: client offered only unsupported versions: %x", clientVersions)
   194  	}
   195  	c.haveVers = true
   196  	c.in.version = c.vers
   197  	c.out.version = c.vers
   198  
   199  	// This check reflects some odd specification implied behavior. Client-facing servers
   200  	// are supposed to reject hellos with outer ECH and inner ECH that offers 1.2, but
   201  	// backend servers are allowed to accept hellos with inner ECH that offer 1.2, since
   202  	// they cannot expect client-facing servers to behave properly. Since we act as both
   203  	// a client-facing and backend server, we only enforce 1.3 being negotiated if we
   204  	// saw a hello with outer ECH first. The spec probably should've made this an error,
   205  	// but it didn't, and this matches the boringssl behavior.
   206  	if c.vers != VersionTLS13 && (ech != nil && !ech.inner) {
   207  		c.sendAlert(alertIllegalParameter)
   208  		return nil, nil, errors.New("tls: Encrypted Client Hello cannot be used pre-TLS 1.3")
   209  	}
   210  
   211  	if c.config.MinVersion == 0 && c.vers < VersionTLS12 {
   212  		tls10server.Value() // ensure godebug is initialized
   213  		tls10server.IncNonDefault()
   214  	}
   215  
   216  	return clientHello, ech, nil
   217  }
   218  
   219  func (hs *serverHandshakeState) processClientHello() error {
   220  	c := hs.c
   221  
   222  	hs.hello = new(serverHelloMsg)
   223  	hs.hello.vers = c.vers
   224  
   225  	foundCompression := false
   226  	// We only support null compression, so check that the client offered it.
   227  	for _, compression := range hs.clientHello.compressionMethods {
   228  		if compression == compressionNone {
   229  			foundCompression = true
   230  			break
   231  		}
   232  	}
   233  
   234  	if !foundCompression {
   235  		c.sendAlert(alertIllegalParameter)
   236  		return errors.New("tls: client does not support uncompressed connections")
   237  	}
   238  
   239  	hs.hello.random = make([]byte, 32)
   240  	serverRandom := hs.hello.random
   241  	// Downgrade protection canaries. See RFC 8446, Section 4.1.3.
   242  	maxVers := c.config.maxSupportedVersion(roleServer)
   243  	if maxVers >= VersionTLS12 && c.vers < maxVers || testingOnlyForceDowngradeCanary {
   244  		if c.vers == VersionTLS12 {
   245  			copy(serverRandom[24:], downgradeCanaryTLS12)
   246  		} else {
   247  			copy(serverRandom[24:], downgradeCanaryTLS11)
   248  		}
   249  		serverRandom = serverRandom[:24]
   250  	}
   251  	_, err := io.ReadFull(c.config.rand(), serverRandom)
   252  	if err != nil {
   253  		c.sendAlert(alertInternalError)
   254  		return err
   255  	}
   256  
   257  	if len(hs.clientHello.secureRenegotiation) != 0 {
   258  		c.sendAlert(alertHandshakeFailure)
   259  		return errors.New("tls: initial handshake had non-empty renegotiation extension")
   260  	}
   261  
   262  	hs.hello.extendedMasterSecret = hs.clientHello.extendedMasterSecret
   263  	hs.hello.secureRenegotiationSupported = hs.clientHello.secureRenegotiationSupported
   264  	hs.hello.compressionMethod = compressionNone
   265  	if len(hs.clientHello.serverName) > 0 {
   266  		c.serverName = hs.clientHello.serverName
   267  	}
   268  
   269  	selectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols, false)
   270  	if err != nil {
   271  		c.sendAlert(alertNoApplicationProtocol)
   272  		return err
   273  	}
   274  	hs.hello.alpnProtocol = selectedProto
   275  	c.clientProtocol = selectedProto
   276  
   277  	hs.cert, err = c.config.getCertificate(clientHelloInfo(hs.ctx, c, hs.clientHello))
   278  	if err != nil {
   279  		if err == errNoCertificates {
   280  			c.sendAlert(alertUnrecognizedName)
   281  		} else {
   282  			c.sendAlert(alertInternalError)
   283  		}
   284  		return err
   285  	}
   286  	if hs.clientHello.scts {
   287  		hs.hello.scts = hs.cert.SignedCertificateTimestamps
   288  	}
   289  
   290  	hs.ecdheOk, err = supportsECDHE(c.config, c.vers, hs.clientHello.supportedCurves, hs.clientHello.supportedPoints)
   291  	if err != nil {
   292  		c.sendAlert(alertMissingExtension)
   293  		return err
   294  	}
   295  
   296  	if hs.ecdheOk && len(hs.clientHello.supportedPoints) > 0 {
   297  		// Although omitting the ec_point_formats extension is permitted, some
   298  		// old OpenSSL version will refuse to handshake if not present.
   299  		//
   300  		// Per RFC 4492, section 5.1.2, implementations MUST support the
   301  		// uncompressed point format. See golang.org/issue/31943.
   302  		hs.hello.supportedPoints = []uint8{pointFormatUncompressed}
   303  	}
   304  
   305  	if priv, ok := hs.cert.PrivateKey.(crypto.Signer); ok {
   306  		switch priv.Public().(type) {
   307  		case *ecdsa.PublicKey:
   308  			hs.ecSignOk = true
   309  		case ed25519.PublicKey:
   310  			hs.ecSignOk = true
   311  		case *rsa.PublicKey:
   312  			hs.rsaSignOk = true
   313  		default:
   314  			c.sendAlert(alertInternalError)
   315  			return fmt.Errorf("tls: unsupported signing key type (%T)", priv.Public())
   316  		}
   317  	}
   318  	if priv, ok := hs.cert.PrivateKey.(crypto.Decrypter); ok {
   319  		switch priv.Public().(type) {
   320  		case *rsa.PublicKey:
   321  			hs.rsaDecryptOk = true
   322  		default:
   323  			c.sendAlert(alertInternalError)
   324  			return fmt.Errorf("tls: unsupported decryption key type (%T)", priv.Public())
   325  		}
   326  	}
   327  
   328  	return nil
   329  }
   330  
   331  // negotiateALPN picks a shared ALPN protocol that both sides support in server
   332  // preference order. If ALPN is not configured or the peer doesn't support it,
   333  // it returns "" and no error.
   334  func negotiateALPN(serverProtos, clientProtos []string, quic bool) (string, error) {
   335  	if len(serverProtos) == 0 || len(clientProtos) == 0 {
   336  		if quic && len(serverProtos) != 0 {
   337  			// RFC 9001, Section 8.1
   338  			return "", fmt.Errorf("tls: client did not request an application protocol")
   339  		}
   340  		return "", nil
   341  	}
   342  	var http11fallback bool
   343  	for _, s := range serverProtos {
   344  		for _, c := range clientProtos {
   345  			if s == c {
   346  				return s, nil
   347  			}
   348  			if s == "h2" && c == "http/1.1" {
   349  				http11fallback = true
   350  			}
   351  		}
   352  	}
   353  	// As a special case, let http/1.1 clients connect to h2 servers as if they
   354  	// didn't support ALPN. We used not to enforce protocol overlap, so over
   355  	// time a number of HTTP servers were configured with only "h2", but
   356  	// expected to accept connections from "http/1.1" clients. See Issue 46310.
   357  	if http11fallback {
   358  		return "", nil
   359  	}
   360  	return "", fmt.Errorf("tls: client requested unsupported application protocols (%q)", clientProtos)
   361  }
   362  
   363  // supportsECDHE returns whether ECDHE key exchanges can be used with this
   364  // pre-TLS 1.3 client.
   365  func supportsECDHE(c *Config, version uint16, supportedCurves []CurveID, supportedPoints []uint8) (bool, error) {
   366  	supportsCurve := false
   367  	for _, curve := range supportedCurves {
   368  		if c.supportsCurve(version, curve) {
   369  			supportsCurve = true
   370  			break
   371  		}
   372  	}
   373  
   374  	supportsPointFormat := false
   375  	offeredNonCompressedFormat := false
   376  	for _, pointFormat := range supportedPoints {
   377  		if pointFormat == pointFormatUncompressed {
   378  			supportsPointFormat = true
   379  		} else {
   380  			offeredNonCompressedFormat = true
   381  		}
   382  	}
   383  	// Per RFC 8422, Section 5.1.2, if the Supported Point Formats extension is
   384  	// missing, uncompressed points are supported. If supportedPoints is empty,
   385  	// the extension must be missing, as an empty extension body is rejected by
   386  	// the parser. See https://go.dev/issue/49126.
   387  	if len(supportedPoints) == 0 {
   388  		supportsPointFormat = true
   389  	} else if offeredNonCompressedFormat && !supportsPointFormat {
   390  		return false, errors.New("tls: client offered only incompatible point formats")
   391  	}
   392  
   393  	return supportsCurve && supportsPointFormat, nil
   394  }
   395  
   396  func (hs *serverHandshakeState) pickCipherSuite() error {
   397  	c := hs.c
   398  
   399  	preferenceList := c.config.cipherSuites(isAESGCMPreferred(hs.clientHello.cipherSuites))
   400  
   401  	hs.suite = selectCipherSuite(preferenceList, hs.clientHello.cipherSuites, hs.cipherSuiteOk)
   402  	if hs.suite == nil {
   403  		c.sendAlert(alertHandshakeFailure)
   404  		return fmt.Errorf("tls: no cipher suite supported by both client and server; client offered: %x",
   405  			hs.clientHello.cipherSuites)
   406  	}
   407  	c.cipherSuite = hs.suite.id
   408  
   409  	if c.config.CipherSuites == nil && !fips140tls.Required() && rsaKexCiphers[hs.suite.id] {
   410  		tlsrsakex.Value() // ensure godebug is initialized
   411  		tlsrsakex.IncNonDefault()
   412  	}
   413  	if c.config.CipherSuites == nil && !fips140tls.Required() && tdesCiphers[hs.suite.id] {
   414  		tls3des.Value() // ensure godebug is initialized
   415  		tls3des.IncNonDefault()
   416  	}
   417  
   418  	for _, id := range hs.clientHello.cipherSuites {
   419  		if id == TLS_FALLBACK_SCSV {
   420  			// The client is doing a fallback connection. See RFC 7507.
   421  			if hs.clientHello.vers < c.config.maxSupportedVersion(roleServer) {
   422  				c.sendAlert(alertInappropriateFallback)
   423  				return errors.New("tls: client using inappropriate protocol fallback")
   424  			}
   425  			break
   426  		}
   427  	}
   428  
   429  	return nil
   430  }
   431  
   432  func (hs *serverHandshakeState) cipherSuiteOk(c *cipherSuite) bool {
   433  	if c.flags&suiteECDHE != 0 {
   434  		if !hs.ecdheOk {
   435  			return false
   436  		}
   437  		if c.flags&suiteECSign != 0 {
   438  			if !hs.ecSignOk {
   439  				return false
   440  			}
   441  		} else if !hs.rsaSignOk {
   442  			return false
   443  		}
   444  	} else if !hs.rsaDecryptOk {
   445  		return false
   446  	}
   447  	if hs.c.vers < VersionTLS12 && c.flags&suiteTLS12 != 0 {
   448  		return false
   449  	}
   450  	return true
   451  }
   452  
   453  // checkForResumption reports whether we should perform resumption on this connection.
   454  func (hs *serverHandshakeState) checkForResumption() error {
   455  	c := hs.c
   456  
   457  	if c.config.SessionTicketsDisabled {
   458  		return nil
   459  	}
   460  
   461  	var sessionState *SessionState
   462  	if c.config.UnwrapSession != nil {
   463  		ss, err := c.config.UnwrapSession(hs.clientHello.sessionTicket, c.connectionStateLocked())
   464  		if err != nil {
   465  			return err
   466  		}
   467  		if ss == nil {
   468  			return nil
   469  		}
   470  		sessionState = ss
   471  	} else {
   472  		plaintext := c.config.decryptTicket(hs.clientHello.sessionTicket, c.ticketKeys)
   473  		if plaintext == nil {
   474  			return nil
   475  		}
   476  		ss, err := ParseSessionState(plaintext)
   477  		if err != nil {
   478  			return nil
   479  		}
   480  		sessionState = ss
   481  	}
   482  
   483  	// TLS 1.2 tickets don't natively have a lifetime, but we want to avoid
   484  	// re-wrapping the same master secret in different tickets over and over for
   485  	// too long, weakening forward secrecy.
   486  	createdAt := time.Unix(int64(sessionState.createdAt), 0)
   487  	if c.config.time().Sub(createdAt) > maxSessionTicketLifetime {
   488  		return nil
   489  	}
   490  
   491  	// Never resume a session for a different TLS version.
   492  	if c.vers != sessionState.version {
   493  		return nil
   494  	}
   495  
   496  	cipherSuiteOk := false
   497  	// Check that the client is still offering the ciphersuite in the session.
   498  	for _, id := range hs.clientHello.cipherSuites {
   499  		if id == sessionState.cipherSuite {
   500  			cipherSuiteOk = true
   501  			break
   502  		}
   503  	}
   504  	if !cipherSuiteOk {
   505  		return nil
   506  	}
   507  
   508  	// Check that we also support the ciphersuite from the session.
   509  	suite := selectCipherSuite([]uint16{sessionState.cipherSuite},
   510  		c.config.supportedCipherSuites(), hs.cipherSuiteOk)
   511  	if suite == nil {
   512  		return nil
   513  	}
   514  
   515  	sessionHasClientCerts := len(sessionState.peerCertificates) != 0
   516  	needClientCerts := requiresClientCert(c.config.ClientAuth)
   517  	if needClientCerts && !sessionHasClientCerts {
   518  		return nil
   519  	}
   520  	if sessionHasClientCerts && c.config.ClientAuth == NoClientCert {
   521  		return nil
   522  	}
   523  	if sessionHasClientCerts && c.config.time().After(sessionState.peerCertificates[0].NotAfter) {
   524  		return nil
   525  	}
   526  	opts := x509.VerifyOptions{
   527  		CurrentTime: c.config.time(),
   528  		Roots:       c.config.ClientCAs,
   529  		KeyUsages:   []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
   530  	}
   531  	if sessionHasClientCerts && c.config.ClientAuth >= VerifyClientCertIfGiven &&
   532  		!anyValidVerifiedChain(sessionState.verifiedChains, opts) {
   533  		return nil
   534  	}
   535  
   536  	// RFC 7627, Section 5.3
   537  	if !sessionState.extMasterSecret && hs.clientHello.extendedMasterSecret {
   538  		return nil
   539  	}
   540  	if sessionState.extMasterSecret && !hs.clientHello.extendedMasterSecret {
   541  		// Aborting is somewhat harsh, but it's a MUST and it would indicate a
   542  		// weird downgrade in client capabilities.
   543  		return errors.New("tls: session supported extended_master_secret but client does not")
   544  	}
   545  	if !sessionState.extMasterSecret && fips140tls.Required() {
   546  		if fips140ems.Value() != "0" {
   547  			// FIPS 140-3 requires the use of Extended Master Secret.
   548  			return nil
   549  		}
   550  		fips140ems.IncNonDefault()
   551  	}
   552  
   553  	c.peerCertificates = sessionState.peerCertificates
   554  	c.ocspResponse = sessionState.ocspResponse
   555  	c.scts = sessionState.scts
   556  	c.verifiedChains = sessionState.verifiedChains
   557  	c.extMasterSecret = sessionState.extMasterSecret
   558  	hs.sessionState = sessionState
   559  	hs.suite = suite
   560  	c.curveID = sessionState.curveID
   561  	c.didResume = true
   562  	return nil
   563  }
   564  
   565  func (hs *serverHandshakeState) doResumeHandshake() error {
   566  	c := hs.c
   567  
   568  	hs.hello.cipherSuite = hs.suite.id
   569  	c.cipherSuite = hs.suite.id
   570  	// We echo the client's session ID in the ServerHello to let it know
   571  	// that we're doing a resumption.
   572  	hs.hello.sessionId = hs.clientHello.sessionId
   573  	// We always send a new session ticket, even if it wraps the same master
   574  	// secret and it's potentially encrypted with the same key, to help the
   575  	// client avoid cross-connection tracking from a network observer.
   576  	hs.hello.ticketSupported = true
   577  	hs.finishedHash = newFinishedHash(c.vers, hs.suite)
   578  	hs.finishedHash.discardHandshakeBuffer()
   579  	if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
   580  		return err
   581  	}
   582  	if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
   583  		return err
   584  	}
   585  
   586  	if c.config.VerifyConnection != nil {
   587  		if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
   588  			c.sendAlert(alertBadCertificate)
   589  			return err
   590  		}
   591  	}
   592  
   593  	hs.masterSecret = hs.sessionState.secret
   594  
   595  	return nil
   596  }
   597  
   598  func (hs *serverHandshakeState) doFullHandshake() error {
   599  	c := hs.c
   600  
   601  	if hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 {
   602  		hs.hello.ocspStapling = true
   603  	}
   604  
   605  	if hs.clientHello.serverName != "" {
   606  		hs.hello.serverNameAck = true
   607  	}
   608  
   609  	hs.hello.ticketSupported = hs.clientHello.ticketSupported && !c.config.SessionTicketsDisabled
   610  	hs.hello.cipherSuite = hs.suite.id
   611  
   612  	hs.finishedHash = newFinishedHash(hs.c.vers, hs.suite)
   613  	if c.config.ClientAuth == NoClientCert {
   614  		// No need to keep a full record of the handshake if client
   615  		// certificates won't be used.
   616  		hs.finishedHash.discardHandshakeBuffer()
   617  	}
   618  	if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
   619  		return err
   620  	}
   621  	if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
   622  		return err
   623  	}
   624  
   625  	certMsg := new(certificateMsg)
   626  	certMsg.certificates = hs.cert.Certificate
   627  	if _, err := hs.c.writeHandshakeRecord(certMsg, &hs.finishedHash); err != nil {
   628  		return err
   629  	}
   630  
   631  	if hs.hello.ocspStapling {
   632  		certStatus := new(certificateStatusMsg)
   633  		certStatus.response = hs.cert.OCSPStaple
   634  		if _, err := hs.c.writeHandshakeRecord(certStatus, &hs.finishedHash); err != nil {
   635  			return err
   636  		}
   637  	}
   638  
   639  	keyAgreement := hs.suite.ka(c.vers)
   640  	skx, err := keyAgreement.generateServerKeyExchange(c.config, hs.cert, hs.clientHello, hs.hello)
   641  	if err != nil {
   642  		c.sendAlert(alertHandshakeFailure)
   643  		return err
   644  	}
   645  	if skx != nil {
   646  		if keyAgreement, ok := keyAgreement.(*ecdheKeyAgreement); ok {
   647  			c.curveID = keyAgreement.curveID
   648  			c.peerSigAlg = keyAgreement.signatureAlgorithm
   649  		}
   650  		if _, err := hs.c.writeHandshakeRecord(skx, &hs.finishedHash); err != nil {
   651  			return err
   652  		}
   653  	}
   654  
   655  	var certReq *certificateRequestMsg
   656  	if c.config.ClientAuth >= RequestClientCert {
   657  		// Request a client certificate
   658  		certReq = new(certificateRequestMsg)
   659  		certReq.certificateTypes = []byte{
   660  			byte(certTypeRSASign),
   661  			byte(certTypeECDSASign),
   662  		}
   663  		if c.vers >= VersionTLS12 {
   664  			certReq.hasSignatureAlgorithm = true
   665  			certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms(c.vers)
   666  		}
   667  
   668  		// An empty list of certificateAuthorities signals to
   669  		// the client that it may send any certificate in response
   670  		// to our request. When we know the CAs we trust, then
   671  		// we can send them down, so that the client can choose
   672  		// an appropriate certificate to give to us.
   673  		if c.config.ClientCAs != nil {
   674  			certReq.certificateAuthorities = c.config.ClientCAs.Subjects()
   675  		}
   676  		if _, err := hs.c.writeHandshakeRecord(certReq, &hs.finishedHash); err != nil {
   677  			return err
   678  		}
   679  	}
   680  
   681  	helloDone := new(serverHelloDoneMsg)
   682  	if _, err := hs.c.writeHandshakeRecord(helloDone, &hs.finishedHash); err != nil {
   683  		return err
   684  	}
   685  
   686  	if _, err := c.flush(); err != nil {
   687  		return err
   688  	}
   689  
   690  	var pub crypto.PublicKey // public key for client auth, if any
   691  
   692  	msg, err := c.readHandshake(&hs.finishedHash)
   693  	if err != nil {
   694  		return err
   695  	}
   696  
   697  	// If we requested a client certificate, then the client must send a
   698  	// certificate message, even if it's empty.
   699  	if c.config.ClientAuth >= RequestClientCert {
   700  		certMsg, ok := msg.(*certificateMsg)
   701  		if !ok {
   702  			c.sendAlert(alertUnexpectedMessage)
   703  			return unexpectedMessageError(certMsg, msg)
   704  		}
   705  
   706  		if err := c.processCertsFromClient(Certificate{
   707  			Certificate: certMsg.certificates,
   708  		}); err != nil {
   709  			return err
   710  		}
   711  		if len(certMsg.certificates) != 0 {
   712  			pub = c.peerCertificates[0].PublicKey
   713  		}
   714  
   715  		msg, err = c.readHandshake(&hs.finishedHash)
   716  		if err != nil {
   717  			return err
   718  		}
   719  	}
   720  	if c.config.VerifyConnection != nil {
   721  		if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
   722  			c.sendAlert(alertBadCertificate)
   723  			return err
   724  		}
   725  	}
   726  
   727  	// Get client key exchange
   728  	ckx, ok := msg.(*clientKeyExchangeMsg)
   729  	if !ok {
   730  		c.sendAlert(alertUnexpectedMessage)
   731  		return unexpectedMessageError(ckx, msg)
   732  	}
   733  
   734  	preMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers)
   735  	if err != nil {
   736  		c.sendAlert(alertIllegalParameter)
   737  		return err
   738  	}
   739  	if hs.hello.extendedMasterSecret {
   740  		c.extMasterSecret = true
   741  		hs.masterSecret = extMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
   742  			hs.finishedHash.Sum())
   743  	} else {
   744  		if fips140tls.Required() {
   745  			if fips140ems.Value() != "0" {
   746  				c.sendAlert(alertHandshakeFailure)
   747  				return errors.New("tls: FIPS 140-3 requires the use of Extended Master Secret")
   748  			}
   749  			fips140ems.IncNonDefault()
   750  		}
   751  		hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
   752  			hs.clientHello.random, hs.hello.random)
   753  	}
   754  	if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.clientHello.random, hs.masterSecret); err != nil {
   755  		c.sendAlert(alertInternalError)
   756  		return err
   757  	}
   758  
   759  	// If we received a client cert in response to our certificate request message,
   760  	// the client will send us a certificateVerifyMsg immediately after the
   761  	// clientKeyExchangeMsg. This message is a digest of all preceding
   762  	// handshake-layer messages that is signed using the private key corresponding
   763  	// to the client's certificate. This allows us to verify that the client is in
   764  	// possession of the private key of the certificate.
   765  	if len(c.peerCertificates) > 0 {
   766  		// certificateVerifyMsg is included in the transcript, but not until
   767  		// after we verify the handshake signature, since the state before
   768  		// this message was sent is used.
   769  		msg, err = c.readHandshake(nil)
   770  		if err != nil {
   771  			return err
   772  		}
   773  		certVerify, ok := msg.(*certificateVerifyMsg)
   774  		if !ok {
   775  			c.sendAlert(alertUnexpectedMessage)
   776  			return unexpectedMessageError(certVerify, msg)
   777  		}
   778  
   779  		var sigType uint8
   780  		var sigHash crypto.Hash
   781  		if c.vers >= VersionTLS12 {
   782  			if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, certReq.supportedSignatureAlgorithms) {
   783  				c.sendAlert(alertIllegalParameter)
   784  				return errors.New("tls: client certificate used with invalid signature algorithm")
   785  			}
   786  			sigType, sigHash, err = typeAndHashFromSignatureScheme(certVerify.signatureAlgorithm)
   787  			if err != nil {
   788  				return c.sendAlert(alertInternalError)
   789  			}
   790  			if sigHash == crypto.SHA1 {
   791  				tlssha1.Value() // ensure godebug is initialized
   792  				tlssha1.IncNonDefault()
   793  			}
   794  			if hs.finishedHash.buffer == nil {
   795  				c.sendAlert(alertInternalError)
   796  				return errors.New("tls: internal error: did not keep handshake transcript for TLS 1.2")
   797  			}
   798  			if err := verifyHandshakeSignature(sigType, pub, sigHash, hs.finishedHash.buffer, certVerify.signature); err != nil {
   799  				c.sendAlert(alertDecryptError)
   800  				return errors.New("tls: invalid signature by the client certificate: " + err.Error())
   801  			}
   802  		} else {
   803  			sigType, sigHash, err = legacyTypeAndHashFromPublicKey(pub)
   804  			if err != nil {
   805  				c.sendAlert(alertIllegalParameter)
   806  				return err
   807  			}
   808  			signed := hs.finishedHash.hashForClientCertificate(sigType)
   809  			if err := verifyLegacyHandshakeSignature(sigType, pub, sigHash, signed, certVerify.signature); err != nil {
   810  				c.sendAlert(alertDecryptError)
   811  				return errors.New("tls: invalid signature by the client certificate: " + err.Error())
   812  			}
   813  		}
   814  
   815  		c.peerSigAlg = certVerify.signatureAlgorithm
   816  
   817  		if err := transcriptMsg(certVerify, &hs.finishedHash); err != nil {
   818  			return err
   819  		}
   820  	}
   821  
   822  	hs.finishedHash.discardHandshakeBuffer()
   823  
   824  	return nil
   825  }
   826  
   827  func (hs *serverHandshakeState) establishKeys() error {
   828  	c := hs.c
   829  
   830  	clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
   831  		keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
   832  
   833  	var clientCipher, serverCipher any
   834  	var clientHash, serverHash hash.Hash
   835  
   836  	if hs.suite.aead == nil {
   837  		clientCipher = hs.suite.cipher(clientKey, clientIV, true /* for reading */)
   838  		clientHash = hs.suite.mac(clientMAC)
   839  		serverCipher = hs.suite.cipher(serverKey, serverIV, false /* not for reading */)
   840  		serverHash = hs.suite.mac(serverMAC)
   841  	} else {
   842  		clientCipher = hs.suite.aead(clientKey, clientIV)
   843  		serverCipher = hs.suite.aead(serverKey, serverIV)
   844  	}
   845  
   846  	c.in.prepareCipherSpec(c.vers, clientCipher, clientHash)
   847  	c.out.prepareCipherSpec(c.vers, serverCipher, serverHash)
   848  
   849  	return nil
   850  }
   851  
   852  func (hs *serverHandshakeState) readFinished(out []byte) error {
   853  	c := hs.c
   854  
   855  	if err := c.readChangeCipherSpec(); err != nil {
   856  		return err
   857  	}
   858  
   859  	// finishedMsg is included in the transcript, but not until after we
   860  	// check the client version, since the state before this message was
   861  	// sent is used during verification.
   862  	msg, err := c.readHandshake(nil)
   863  	if err != nil {
   864  		return err
   865  	}
   866  	clientFinished, ok := msg.(*finishedMsg)
   867  	if !ok {
   868  		c.sendAlert(alertUnexpectedMessage)
   869  		return unexpectedMessageError(clientFinished, msg)
   870  	}
   871  
   872  	verify := hs.finishedHash.clientSum(hs.masterSecret)
   873  	if len(verify) != len(clientFinished.verifyData) ||
   874  		subtle.ConstantTimeCompare(verify, clientFinished.verifyData) != 1 {
   875  		c.sendAlert(alertHandshakeFailure)
   876  		return errors.New("tls: client's Finished message is incorrect")
   877  	}
   878  
   879  	if err := transcriptMsg(clientFinished, &hs.finishedHash); err != nil {
   880  		return err
   881  	}
   882  
   883  	copy(out, verify)
   884  	return nil
   885  }
   886  
   887  func (hs *serverHandshakeState) sendSessionTicket() error {
   888  	if !hs.hello.ticketSupported {
   889  		return nil
   890  	}
   891  
   892  	c := hs.c
   893  	m := new(newSessionTicketMsg)
   894  
   895  	state := c.sessionState()
   896  	state.secret = hs.masterSecret
   897  	if hs.sessionState != nil {
   898  		// If this is re-wrapping an old key, then keep
   899  		// the original time it was created.
   900  		state.createdAt = hs.sessionState.createdAt
   901  	}
   902  	if c.config.WrapSession != nil {
   903  		var err error
   904  		m.ticket, err = c.config.WrapSession(c.connectionStateLocked(), state)
   905  		if err != nil {
   906  			return err
   907  		}
   908  	} else {
   909  		stateBytes, err := state.Bytes()
   910  		if err != nil {
   911  			return err
   912  		}
   913  		m.ticket, err = c.config.encryptTicket(stateBytes, c.ticketKeys)
   914  		if err != nil {
   915  			return err
   916  		}
   917  	}
   918  
   919  	if _, err := hs.c.writeHandshakeRecord(m, &hs.finishedHash); err != nil {
   920  		return err
   921  	}
   922  
   923  	return nil
   924  }
   925  
   926  func (hs *serverHandshakeState) sendFinished(out []byte) error {
   927  	c := hs.c
   928  
   929  	if err := c.writeChangeCipherRecord(); err != nil {
   930  		return err
   931  	}
   932  
   933  	finished := new(finishedMsg)
   934  	finished.verifyData = hs.finishedHash.serverSum(hs.masterSecret)
   935  	if _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil {
   936  		return err
   937  	}
   938  
   939  	copy(out, finished.verifyData)
   940  
   941  	return nil
   942  }
   943  
   944  // processCertsFromClient takes a chain of client certificates either from a
   945  // certificateMsg message or a certificateMsgTLS13 message and verifies them.
   946  func (c *Conn) processCertsFromClient(certificate Certificate) error {
   947  	certificates := certificate.Certificate
   948  	certs := make([]*x509.Certificate, len(certificates))
   949  	var err error
   950  	for i, asn1Data := range certificates {
   951  		if certs[i], err = x509.ParseCertificate(asn1Data); err != nil {
   952  			c.sendAlert(alertDecodeError)
   953  			return errors.New("tls: failed to parse client certificate: " + err.Error())
   954  		}
   955  		if certs[i].PublicKeyAlgorithm == x509.RSA {
   956  			n := certs[i].PublicKey.(*rsa.PublicKey).N.BitLen()
   957  			if max, ok := checkKeySize(n); !ok {
   958  				c.sendAlert(alertBadCertificate)
   959  				return fmt.Errorf("tls: client sent certificate containing RSA key larger than %d bits", max)
   960  			}
   961  		}
   962  	}
   963  
   964  	if len(certs) == 0 && requiresClientCert(c.config.ClientAuth) {
   965  		if c.vers == VersionTLS13 {
   966  			c.sendAlert(alertCertificateRequired)
   967  		} else {
   968  			c.sendAlert(alertHandshakeFailure)
   969  		}
   970  		return errors.New("tls: client didn't provide a certificate")
   971  	}
   972  
   973  	if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
   974  		opts := x509.VerifyOptions{
   975  			Roots:         c.config.ClientCAs,
   976  			CurrentTime:   c.config.time(),
   977  			Intermediates: x509.NewCertPool(),
   978  			KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
   979  		}
   980  
   981  		for _, cert := range certs[1:] {
   982  			opts.Intermediates.AddCert(cert)
   983  		}
   984  
   985  		chains, err := certs[0].Verify(opts)
   986  		if err != nil {
   987  			if _, ok := errors.AsType[x509.UnknownAuthorityError](err); ok {
   988  				c.sendAlert(alertUnknownCA)
   989  			} else if errCertificateInvalid, ok := errors.AsType[x509.CertificateInvalidError](err); ok && errCertificateInvalid.Reason == x509.Expired {
   990  				c.sendAlert(alertCertificateExpired)
   991  			} else {
   992  				c.sendAlert(alertBadCertificate)
   993  			}
   994  			return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
   995  		}
   996  
   997  		c.verifiedChains, err = fipsAllowedChains(chains)
   998  		if err != nil {
   999  			c.sendAlert(alertBadCertificate)
  1000  			return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
  1001  		}
  1002  	}
  1003  
  1004  	c.peerCertificates = certs
  1005  	c.ocspResponse = certificate.OCSPStaple
  1006  	c.scts = certificate.SignedCertificateTimestamps
  1007  
  1008  	if len(certs) > 0 {
  1009  		switch certs[0].PublicKey.(type) {
  1010  		case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
  1011  		default:
  1012  			c.sendAlert(alertUnsupportedCertificate)
  1013  			return fmt.Errorf("tls: client certificate contains an unsupported public key of type %T", certs[0].PublicKey)
  1014  		}
  1015  	}
  1016  
  1017  	if c.config.VerifyPeerCertificate != nil {
  1018  		if err := c.config.VerifyPeerCertificate(certificates, c.verifiedChains); err != nil {
  1019  			c.sendAlert(alertBadCertificate)
  1020  			return err
  1021  		}
  1022  	}
  1023  
  1024  	return nil
  1025  }
  1026  
  1027  func clientHelloInfo(ctx context.Context, c *Conn, clientHello *clientHelloMsg) *ClientHelloInfo {
  1028  	supportedVersions := clientHello.supportedVersions
  1029  	if len(clientHello.supportedVersions) == 0 {
  1030  		supportedVersions = supportedVersionsFromMax(clientHello.vers)
  1031  	}
  1032  
  1033  	return &ClientHelloInfo{
  1034  		CipherSuites:      clientHello.cipherSuites,
  1035  		ServerName:        clientHello.serverName,
  1036  		SupportedCurves:   clientHello.supportedCurves,
  1037  		SupportedPoints:   clientHello.supportedPoints,
  1038  		SignatureSchemes:  clientHello.supportedSignatureAlgorithms,
  1039  		SupportedProtos:   clientHello.alpnProtocols,
  1040  		SupportedVersions: supportedVersions,
  1041  		Extensions:        clientHello.extensions,
  1042  		Conn:              c.conn,
  1043  		HelloRetryRequest: c.didHRR,
  1044  		config:            c.config,
  1045  		ctx:               ctx,
  1046  	}
  1047  }
  1048  

View as plain text