src/crypto/tls/handshake_client.go

   1 // Copyright 2009 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 package tls
   6
   7 import (
   8         "bytes"
   9         "crypto"
  10         "crypto/ecdsa"
  11         "crypto/rsa"
  12         "crypto/subtle"
  13         "crypto/x509"
  14         "errors"
  15         "fmt"
  16         "io"
  17         "net"
  18         "strconv"
  19         "strings"
  20 )
  21
  22 type clientHandshakeState struct {
  23         c            *Conn
  24         serverHello  *serverHelloMsg
  25         hello        *clientHelloMsg
  26         suite        *cipherSuite
  27         finishedHash finishedHash
  28         masterSecret []byte
  29         session      *ClientSessionState
  30 }
  31
  32 func makeClientHello(config *Config) (*clientHelloMsg, error) {
  33         if len(config.ServerName) == 0 && !config.InsecureSkipVerify {
  34                 return nil, errors.New("tls: either ServerName or InsecureSkipVerify must be specified in the tls.Config")
  35         }
  36
  37         nextProtosLength := 0
  38         for _, proto := range config.NextProtos {
  39                 if l := len(proto); l == 0 || l > 255 {
  40                         return nil, errors.New("tls: invalid NextProtos value")
  41                 } else {
  42                         nextProtosLength += 1 + l
  43                 }
  44         }
  45
  46         if nextProtosLength > 0xffff {
  47                 return nil, errors.New("tls: NextProtos values too large")
  48         }
  49
  50         hello := &clientHelloMsg{
  51                 vers:                         config.maxVersion(),
  52                 compressionMethods:           []uint8{compressionNone},
  53                 random:                       make([]byte, 32),
  54                 ocspStapling:                 true,
  55                 scts:                         true,
  56                 serverName:                   hostnameInSNI(config.ServerName),
  57                 supportedCurves:              config.curvePreferences(),
  58                 supportedPoints:              []uint8{pointFormatUncompressed},
  59                 nextProtoNeg:                 len(config.NextProtos) > 0,
  60                 secureRenegotiationSupported: true,
  61                 alpnProtocols:                config.NextProtos,
  62         }
  63         possibleCipherSuites := config.cipherSuites()
  64         hello.cipherSuites = make([]uint16, 0, len(possibleCipherSuites))
  65
  66 NextCipherSuite:
  67         for _, suiteId := range possibleCipherSuites {
  68                 for _, suite := range cipherSuites {
  69                         if suite.id != suiteId {
  70                                 continue
  71                         }
  72                         // Don't advertise TLS 1.2-only cipher suites unless
  73                         // we're attempting TLS 1.2.
  74                         if hello.vers < VersionTLS12 && suite.flags&suiteTLS12 != 0 {
  75                                 continue
  76                         }
  77                         hello.cipherSuites = append(hello.cipherSuites, suiteId)
  78                         continue NextCipherSuite
  79                 }
  80         }
  81
  82         _, err := io.ReadFull(config.rand(), hello.random)
  83         if err != nil {
  84                 return nil, errors.New("tls: short read from Rand: " + err.Error())
  85         }
  86
  87         if hello.vers >= VersionTLS12 {
  88                 hello.supportedSignatureAlgorithms = supportedSignatureAlgorithms()
  89         }
  90         if testingOnlyForceClientHelloSignatureAlgorithms != nil {
  91                 hello.supportedSignatureAlgorithms = testingOnlyForceClientHelloSignatureAlgorithms
  92         }
  93
  94         return hello, nil
  95 }
  96
  97 // c.out.Mutex <= L; c.handshakeMutex <= L.
  98 func (c *Conn) clientHandshake() error {
  99         if c.config == nil {
 100                 c.config = defaultConfig()
 101         }
 102
 103         // This may be a renegotiation handshake, in which case some fields
 104         // need to be reset.
 105         c.didResume = false
 106
 107         hello, err := makeClientHello(c.config)
 108         if err != nil {
 109                 return err
 110         }
 111
 112         if c.handshakes > 0 {
 113                 hello.secureRenegotiation = c.clientFinished[:]
 114         }
 115
 116         var session *ClientSessionState
 117         var cacheKey string
 118         sessionCache := c.config.ClientSessionCache
 119         if c.config.SessionTicketsDisabled {
 120                 sessionCache = nil
 121         }
 122
 123         if sessionCache != nil {
 124                 hello.ticketSupported = true
 125         }
 126
 127         // Session resumption is not allowed if renegotiating because
 128         // renegotiation is primarily used to allow a client to send a client
 129         // certificate, which would be skipped if session resumption occurred.
 130         if sessionCache != nil && c.handshakes == 0 {
 131                 // Try to resume a previously negotiated TLS session, if
 132                 // available.
 133                 cacheKey = clientSessionCacheKey(c.conn.RemoteAddr(), c.config)
 134                 candidateSession, ok := sessionCache.Get(cacheKey)
 135                 if ok {
 136                         // Check that the ciphersuite/version used for the
 137                         // previous session are still valid.
 138                         cipherSuiteOk := false
 139                         for _, id := range hello.cipherSuites {
 140                                 if id == candidateSession.cipherSuite {
 141                                         cipherSuiteOk = true
 142                                         break
 143                                 }
 144                         }
 145
 146                         versOk := candidateSession.vers >= c.config.minVersion() &&
 147                                 candidateSession.vers <= c.config.maxVersion()
 148                         if versOk && cipherSuiteOk {
 149                                 session = candidateSession
 150                         }
 151                 }
 152         }
 153
 154         if session != nil {
 155                 hello.sessionTicket = session.sessionTicket
 156                 // A random session ID is used to detect when the
 157                 // server accepted the ticket and is resuming a session
 158                 // (see RFC 5077).
 159                 hello.sessionId = make([]byte, 16)
 160                 if _, err := io.ReadFull(c.config.rand(), hello.sessionId); err != nil {
 161                         return errors.New("tls: short read from Rand: " + err.Error())
 162                 }
 163         }
 164
 165         hs := &clientHandshakeState{
 166                 c:       c,
 167                 hello:   hello,
 168                 session: session,
 169         }
 170
 171         if err = hs.handshake(); err != nil {
 172                 return err
 173         }
 174
 175         // If we had a successful handshake and hs.session is different from
 176         // the one already cached - cache a new one
 177         if sessionCache != nil && hs.session != nil && session != hs.session {
 178                 sessionCache.Put(cacheKey, hs.session)
 179         }
 180
 181         return nil
 182 }
 183
 184 // Does the handshake, either a full one or resumes old session.
 185 // Requires hs.c, hs.hello, and, optionally, hs.session to be set.
 186 func (hs *clientHandshakeState) handshake() error {
 187         c := hs.c
 188
 189         // send ClientHello
 190         if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil {
 191                 return err
 192         }
 193
 194         msg, err := c.readHandshake()
 195         if err != nil {
 196                 return err
 197         }
 198
 199         var ok bool
 200         if hs.serverHello, ok = msg.(*serverHelloMsg); !ok {
 201                 c.sendAlert(alertUnexpectedMessage)
 202                 return unexpectedMessageError(hs.serverHello, msg)
 203         }
 204
 205         if err = hs.pickTLSVersion(); err != nil {
 206                 return err
 207         }
 208
 209         if err = hs.pickCipherSuite(); err != nil {
 210                 return err
 211         }
 212
 213         isResume, err := hs.processServerHello()
 214         if err != nil {
 215                 return err
 216         }
 217
 218         hs.finishedHash = newFinishedHash(c.vers, hs.suite)
 219
 220         // No signatures of the handshake are needed in a resumption.
 221         // Otherwise, in a full handshake, if we don't have any certificates
 222         // configured then we will never send a CertificateVerify message and
 223         // thus no signatures are needed in that case either.
 224         if isResume || (len(c.config.Certificates) == 0 && c.config.GetClientCertificate == nil) {
 225                 hs.finishedHash.discardHandshakeBuffer()
 226         }
 227
 228         hs.finishedHash.Write(hs.hello.marshal())
 229         hs.finishedHash.Write(hs.serverHello.marshal())
 230
 231         c.buffering = true
 232         if isResume {
 233                 if err := hs.establishKeys(); err != nil {
 234                         return err
 235                 }
 236                 if err := hs.readSessionTicket(); err != nil {
 237                         return err
 238                 }
 239                 if err := hs.readFinished(c.serverFinished[:]); err != nil {
 240                         return err
 241                 }
 242                 c.clientFinishedIsFirst = false
 243                 if err := hs.sendFinished(c.clientFinished[:]); err != nil {
 244                         return err
 245                 }
 246                 if _, err := c.flush(); err != nil {
 247                         return err
 248                 }
 249         } else {
 250                 if err := hs.doFullHandshake(); err != nil {
 251                         return err
 252                 }
 253                 if err := hs.establishKeys(); err != nil {
 254                         return err
 255                 }
 256                 if err := hs.sendFinished(c.clientFinished[:]); err != nil {
 257                         return err
 258                 }
 259                 if _, err := c.flush(); err != nil {
 260                         return err
 261                 }
 262                 c.clientFinishedIsFirst = true
 263                 if err := hs.readSessionTicket(); err != nil {
 264                         return err
 265                 }
 266                 if err := hs.readFinished(c.serverFinished[:]); err != nil {
 267                         return err
 268                 }
 269         }
 270
 271         c.didResume = isResume
 272         c.handshakeComplete = true
 273
 274         return nil
 275 }
 276
 277 func (hs *clientHandshakeState) pickTLSVersion() error {
 278         vers, ok := hs.c.config.mutualVersion(hs.serverHello.vers)
 279         if !ok || vers < VersionTLS10 {
 280                 // TLS 1.0 is the minimum version supported as a client.
 281                 hs.c.sendAlert(alertProtocolVersion)
 282                 return fmt.Errorf("tls: server selected unsupported protocol version %x", hs.serverHello.vers)
 283         }
 284
 285         hs.c.vers = vers
 286         hs.c.haveVers = true
 287
 288         return nil
 289 }
 290
 291 func (hs *clientHandshakeState) pickCipherSuite() error {
 292         if hs.suite = mutualCipherSuite(hs.hello.cipherSuites, hs.serverHello.cipherSuite); hs.suite == nil {
 293                 hs.c.sendAlert(alertHandshakeFailure)
 294                 return errors.New("tls: server chose an unconfigured cipher suite")
 295         }
 296
 297         hs.c.cipherSuite = hs.suite.id
 298         return nil
 299 }
 300
 301 func (hs *clientHandshakeState) doFullHandshake() error {
 302         c := hs.c
 303
 304         msg, err := c.readHandshake()
 305         if err != nil {
 306                 return err
 307         }
 308         certMsg, ok := msg.(*certificateMsg)
 309         if !ok || len(certMsg.certificates) == 0 {
 310                 c.sendAlert(alertUnexpectedMessage)
 311                 return unexpectedMessageError(certMsg, msg)
 312         }
 313         hs.finishedHash.Write(certMsg.marshal())
 314
 315         if c.handshakes == 0 {
 316                 // If this is the first handshake on a connection, process and
 317                 // (optionally) verify the server's certificates.
 318                 certs := make([]*x509.Certificate, len(certMsg.certificates))
 319                 for i, asn1Data := range certMsg.certificates {
 320                         cert, err := x509.ParseCertificate(asn1Data)
 321                         if err != nil {
 322                                 c.sendAlert(alertBadCertificate)
 323                                 return errors.New("tls: failed to parse certificate from server: " + err.Error())
 324                         }
 325                         certs[i] = cert
 326                 }
 327
 328                 if !c.config.InsecureSkipVerify {
 329                         opts := x509.VerifyOptions{
 330                                 IsBoring: isBoringCertificate,
 331
 332                                 Roots:         c.config.RootCAs,
 333                                 CurrentTime:   c.config.time(),
 334                                 DNSName:       c.config.ServerName,
 335                                 Intermediates: x509.NewCertPool(),
 336                         }
 337
 338                         for i, cert := range certs {
 339                                 if i == 0 {
 340                                         continue
 341                                 }
 342                                 opts.Intermediates.AddCert(cert)
 343                         }
 344                         c.verifiedChains, err = certs[0].Verify(opts)
 345                         if err != nil {
 346                                 c.sendAlert(alertBadCertificate)
 347                                 return err
 348                         }
 349                 }
 350
 351                 if c.config.VerifyPeerCertificate != nil {
 352                         if err := c.config.VerifyPeerCertificate(certMsg.certificates, c.verifiedChains); err != nil {
 353                                 c.sendAlert(alertBadCertificate)
 354                                 return err
 355                         }
 356                 }
 357
 358                 switch certs[0].PublicKey.(type) {
 359                 case *rsa.PublicKey, *ecdsa.PublicKey:
 360                         break
 361                 default:
 362                         c.sendAlert(alertUnsupportedCertificate)
 363                         return fmt.Errorf("tls: server's certificate contains an unsupported type of public key: %T", certs[0].PublicKey)
 364                 }
 365
 366                 c.peerCertificates = certs
 367         } else {
 368                 // This is a renegotiation handshake. We require that the
 369                 // server's identity (i.e. leaf certificate) is unchanged and
 370                 // thus any previous trust decision is still valid.
 371                 //
 372                 // See https://mitls.org/pages/attacks/3SHAKE for the
 373                 // motivation behind this requirement.
 374                 if !bytes.Equal(c.peerCertificates[0].Raw, certMsg.certificates[0]) {
 375                         c.sendAlert(alertBadCertificate)
 376                         return errors.New("tls: server's identity changed during renegotiation")
 377                 }
 378         }
 379
 380         if hs.serverHello.ocspStapling {
 381                 msg, err = c.readHandshake()
 382                 if err != nil {
 383                         return err
 384                 }
 385                 cs, ok := msg.(*certificateStatusMsg)
 386                 if !ok {
 387                         c.sendAlert(alertUnexpectedMessage)
 388                         return unexpectedMessageError(cs, msg)
 389                 }
 390                 hs.finishedHash.Write(cs.marshal())
 391
 392                 if cs.statusType == statusTypeOCSP {
 393                         c.ocspResponse = cs.response
 394                 }
 395         }
 396
 397         msg, err = c.readHandshake()
 398         if err != nil {
 399                 return err
 400         }
 401
 402         keyAgreement := hs.suite.ka(c.vers)
 403
 404         skx, ok := msg.(*serverKeyExchangeMsg)
 405         if ok {
 406                 hs.finishedHash.Write(skx.marshal())
 407                 err = keyAgreement.processServerKeyExchange(c.config, hs.hello, hs.serverHello, c.peerCertificates[0], skx)
 408                 if err != nil {
 409                         c.sendAlert(alertUnexpectedMessage)
 410                         return err
 411                 }
 412
 413                 msg, err = c.readHandshake()
 414                 if err != nil {
 415                         return err
 416                 }
 417         }
 418
 419         var chainToSend *Certificate
 420         var certRequested bool
 421         certReq, ok := msg.(*certificateRequestMsg)
 422         if ok {
 423                 certRequested = true
 424                 hs.finishedHash.Write(certReq.marshal())
 425
 426                 if chainToSend, err = hs.getCertificate(certReq); err != nil {
 427                         c.sendAlert(alertInternalError)
 428                         return err
 429                 }
 430
 431                 msg, err = c.readHandshake()
 432                 if err != nil {
 433                         return err
 434                 }
 435         }
 436
 437         shd, ok := msg.(*serverHelloDoneMsg)
 438         if !ok {
 439                 c.sendAlert(alertUnexpectedMessage)
 440                 return unexpectedMessageError(shd, msg)
 441         }
 442         hs.finishedHash.Write(shd.marshal())
 443
 444         // If the server requested a certificate then we have to send a
 445         // Certificate message, even if it's empty because we don't have a
 446         // certificate to send.
 447         if certRequested {
 448                 certMsg = new(certificateMsg)
 449                 certMsg.certificates = chainToSend.Certificate
 450                 hs.finishedHash.Write(certMsg.marshal())
 451                 if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil {
 452                         return err
 453                 }
 454         }
 455
 456         preMasterSecret, ckx, err := keyAgreement.generateClientKeyExchange(c.config, hs.hello, c.peerCertificates[0])
 457         if err != nil {
 458                 c.sendAlert(alertInternalError)
 459                 return err
 460         }
 461         if ckx != nil {
 462                 hs.finishedHash.Write(ckx.marshal())
 463                 if _, err := c.writeRecord(recordTypeHandshake, ckx.marshal()); err != nil {
 464                         return err
 465                 }
 466         }
 467
 468         if chainToSend != nil && len(chainToSend.Certificate) > 0 {
 469                 certVerify := &certificateVerifyMsg{
 470                         hasSignatureAndHash: c.vers >= VersionTLS12,
 471                 }
 472
 473                 key, ok := chainToSend.PrivateKey.(crypto.Signer)
 474                 if !ok {
 475                         c.sendAlert(alertInternalError)
 476                         return fmt.Errorf("tls: client certificate private key of type %T does not implement crypto.Signer", chainToSend.PrivateKey)
 477                 }
 478
 479                 var signatureType uint8
 480                 switch key.Public().(type) {
 481                 case *ecdsa.PublicKey:
 482                         signatureType = signatureECDSA
 483                 case *rsa.PublicKey:
 484                         signatureType = signatureRSA
 485                 default:
 486                         c.sendAlert(alertInternalError)
 487                         return fmt.Errorf("tls: failed to sign handshake with client certificate: unknown client certificate key type: %T", key)
 488                 }
 489
 490                 // SignatureAndHashAlgorithm was introduced in TLS 1.2.
 491                 if certVerify.hasSignatureAndHash {
 492                         certVerify.signatureAlgorithm, err = hs.finishedHash.selectClientCertSignatureAlgorithm(certReq.supportedSignatureAlgorithms, signatureType)
 493                         if err != nil {
 494                                 c.sendAlert(alertInternalError)
 495                                 return err
 496                         }
 497                 }
 498                 digest, hashFunc, err := hs.finishedHash.hashForClientCertificate(signatureType, certVerify.signatureAlgorithm, hs.masterSecret)
 499                 if err != nil {
 500                         c.sendAlert(alertInternalError)
 501                         return err
 502                 }
 503                 certVerify.signature, err = key.Sign(c.config.rand(), digest, hashFunc)
 504                 if err != nil {
 505                         c.sendAlert(alertInternalError)
 506                         return err
 507                 }
 508
 509                 hs.finishedHash.Write(certVerify.marshal())
 510                 if _, err := c.writeRecord(recordTypeHandshake, certVerify.marshal()); err != nil {
 511                         return err
 512                 }
 513         }
 514
 515         hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.hello.random, hs.serverHello.random)
 516         if err := c.config.writeKeyLog(hs.hello.random, hs.masterSecret); err != nil {
 517                 c.sendAlert(alertInternalError)
 518                 return errors.New("tls: failed to write to key log: " + err.Error())
 519         }
 520
 521         hs.finishedHash.discardHandshakeBuffer()
 522
 523         return nil
 524 }
 525
 526 func (hs *clientHandshakeState) establishKeys() error {
 527         c := hs.c
 528
 529         clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
 530                 keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.hello.random, hs.serverHello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
 531         var clientCipher, serverCipher interface{}
 532         var clientHash, serverHash macFunction
 533         if hs.suite.cipher != nil {
 534                 clientCipher = hs.suite.cipher(clientKey, clientIV, false /* not for reading */)
 535                 clientHash = hs.suite.mac(c.vers, clientMAC)
 536                 serverCipher = hs.suite.cipher(serverKey, serverIV, true /* for reading */)
 537                 serverHash = hs.suite.mac(c.vers, serverMAC)
 538         } else {
 539                 clientCipher = hs.suite.aead(clientKey, clientIV)
 540                 serverCipher = hs.suite.aead(serverKey, serverIV)
 541         }
 542
 543         c.in.prepareCipherSpec(c.vers, serverCipher, serverHash)
 544         c.out.prepareCipherSpec(c.vers, clientCipher, clientHash)
 545         return nil
 546 }
 547
 548 func (hs *clientHandshakeState) serverResumedSession() bool {
 549         // If the server responded with the same sessionId then it means the
 550         // sessionTicket is being used to resume a TLS session.
 551         return hs.session != nil && hs.hello.sessionId != nil &&
 552                 bytes.Equal(hs.serverHello.sessionId, hs.hello.sessionId)
 553 }
 554
 555 func (hs *clientHandshakeState) processServerHello() (bool, error) {
 556         c := hs.c
 557
 558         if hs.serverHello.compressionMethod != compressionNone {
 559                 c.sendAlert(alertUnexpectedMessage)
 560                 return false, errors.New("tls: server selected unsupported compression format")
 561         }
 562
 563         if c.handshakes == 0 && hs.serverHello.secureRenegotiationSupported {
 564                 c.secureRenegotiation = true
 565                 if len(hs.serverHello.secureRenegotiation) != 0 {
 566                         c.sendAlert(alertHandshakeFailure)
 567                         return false, errors.New("tls: initial handshake had non-empty renegotiation extension")
 568                 }
 569         }
 570
 571         if c.handshakes > 0 && c.secureRenegotiation {
 572                 var expectedSecureRenegotiation [24]byte
 573                 copy(expectedSecureRenegotiation[:], c.clientFinished[:])
 574                 copy(expectedSecureRenegotiation[12:], c.serverFinished[:])
 575                 if !bytes.Equal(hs.serverHello.secureRenegotiation, expectedSecureRenegotiation[:]) {
 576                         c.sendAlert(alertHandshakeFailure)
 577                         return false, errors.New("tls: incorrect renegotiation extension contents")
 578                 }
 579         }
 580
 581         clientDidNPN := hs.hello.nextProtoNeg
 582         clientDidALPN := len(hs.hello.alpnProtocols) > 0
 583         serverHasNPN := hs.serverHello.nextProtoNeg
 584         serverHasALPN := len(hs.serverHello.alpnProtocol) > 0
 585
 586         if !clientDidNPN && serverHasNPN {
 587                 c.sendAlert(alertHandshakeFailure)
 588                 return false, errors.New("tls: server advertised unrequested NPN extension")
 589         }
 590
 591         if !clientDidALPN && serverHasALPN {
 592                 c.sendAlert(alertHandshakeFailure)
 593                 return false, errors.New("tls: server advertised unrequested ALPN extension")
 594         }
 595
 596         if serverHasNPN && serverHasALPN {
 597                 c.sendAlert(alertHandshakeFailure)
 598                 return false, errors.New("tls: server advertised both NPN and ALPN extensions")
 599         }
 600
 601         if serverHasALPN {
 602                 c.clientProtocol = hs.serverHello.alpnProtocol
 603                 c.clientProtocolFallback = false
 604         }
 605         c.scts = hs.serverHello.scts
 606
 607         if !hs.serverResumedSession() {
 608                 return false, nil
 609         }
 610
 611         if hs.session.vers != c.vers {
 612                 c.sendAlert(alertHandshakeFailure)
 613                 return false, errors.New("tls: server resumed a session with a different version")
 614         }
 615
 616         if hs.session.cipherSuite != hs.suite.id {
 617                 c.sendAlert(alertHandshakeFailure)
 618                 return false, errors.New("tls: server resumed a session with a different cipher suite")
 619         }
 620
 621         // Restore masterSecret and peerCerts from previous state
 622         hs.masterSecret = hs.session.masterSecret
 623         c.peerCertificates = hs.session.serverCertificates
 624         c.verifiedChains = hs.session.verifiedChains
 625         return true, nil
 626 }
 627
 628 func (hs *clientHandshakeState) readFinished(out []byte) error {
 629         c := hs.c
 630
 631         c.readRecord(recordTypeChangeCipherSpec)
 632         if c.in.err != nil {
 633                 return c.in.err
 634         }
 635
 636         msg, err := c.readHandshake()
 637         if err != nil {
 638                 return err
 639         }
 640         serverFinished, ok := msg.(*finishedMsg)
 641         if !ok {
 642                 c.sendAlert(alertUnexpectedMessage)
 643                 return unexpectedMessageError(serverFinished, msg)
 644         }
 645
 646         verify := hs.finishedHash.serverSum(hs.masterSecret)
 647         if len(verify) != len(serverFinished.verifyData) ||
 648                 subtle.ConstantTimeCompare(verify, serverFinished.verifyData) != 1 {
 649                 c.sendAlert(alertHandshakeFailure)
 650                 return errors.New("tls: server's Finished message was incorrect")
 651         }
 652         hs.finishedHash.Write(serverFinished.marshal())
 653         copy(out, verify)
 654         return nil
 655 }
 656
 657 func (hs *clientHandshakeState) readSessionTicket() error {
 658         if !hs.serverHello.ticketSupported {
 659                 return nil
 660         }
 661
 662         c := hs.c
 663         msg, err := c.readHandshake()
 664         if err != nil {
 665                 return err
 666         }
 667         sessionTicketMsg, ok := msg.(*newSessionTicketMsg)
 668         if !ok {
 669                 c.sendAlert(alertUnexpectedMessage)
 670                 return unexpectedMessageError(sessionTicketMsg, msg)
 671         }
 672         hs.finishedHash.Write(sessionTicketMsg.marshal())
 673
 674         hs.session = &ClientSessionState{
 675                 sessionTicket:      sessionTicketMsg.ticket,
 676                 vers:               c.vers,
 677                 cipherSuite:        hs.suite.id,
 678                 masterSecret:       hs.masterSecret,
 679                 serverCertificates: c.peerCertificates,
 680                 verifiedChains:     c.verifiedChains,
 681         }
 682
 683         return nil
 684 }
 685
 686 func (hs *clientHandshakeState) sendFinished(out []byte) error {
 687         c := hs.c
 688
 689         if _, err := c.writeRecord(recordTypeChangeCipherSpec, []byte{1}); err != nil {
 690                 return err
 691         }
 692         if hs.serverHello.nextProtoNeg {
 693                 nextProto := new(nextProtoMsg)
 694                 proto, fallback := mutualProtocol(c.config.NextProtos, hs.serverHello.nextProtos)
 695                 nextProto.proto = proto
 696                 c.clientProtocol = proto
 697                 c.clientProtocolFallback = fallback
 698
 699                 hs.finishedHash.Write(nextProto.marshal())
 700                 if _, err := c.writeRecord(recordTypeHandshake, nextProto.marshal()); err != nil {
 701                         return err
 702                 }
 703         }
 704
 705         finished := new(finishedMsg)
 706         finished.verifyData = hs.finishedHash.clientSum(hs.masterSecret)
 707         hs.finishedHash.Write(finished.marshal())
 708         if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil {
 709                 return err
 710         }
 711         copy(out, finished.verifyData)
 712         return nil
 713 }
 714
 715 // tls11SignatureSchemes contains the signature schemes that we synthesise for
 716 // a TLS <= 1.1 connection, based on the supported certificate types.
 717 var tls11SignatureSchemes = []SignatureScheme{ECDSAWithP256AndSHA256, ECDSAWithP384AndSHA384, ECDSAWithP521AndSHA512, PKCS1WithSHA256, PKCS1WithSHA384, PKCS1WithSHA512, PKCS1WithSHA1}
 718
 719 const (
 720         // tls11SignatureSchemesNumECDSA is the number of initial elements of
 721         // tls11SignatureSchemes that use ECDSA.
 722         tls11SignatureSchemesNumECDSA = 3
 723         // tls11SignatureSchemesNumRSA is the number of trailing elements of
 724         // tls11SignatureSchemes that use RSA.
 725         tls11SignatureSchemesNumRSA = 4
 726 )
 727
 728 func (hs *clientHandshakeState) getCertificate(certReq *certificateRequestMsg) (*Certificate, error) {
 729         c := hs.c
 730
 731         var rsaAvail, ecdsaAvail bool
 732         for _, certType := range certReq.certificateTypes {
 733                 switch certType {
 734                 case certTypeRSASign:
 735                         rsaAvail = true
 736                 case certTypeECDSASign:
 737                         ecdsaAvail = true
 738                 }
 739         }
 740
 741         if c.config.GetClientCertificate != nil {
 742                 var signatureSchemes []SignatureScheme
 743
 744                 if !certReq.hasSignatureAndHash {
 745                         // Prior to TLS 1.2, the signature schemes were not
 746                         // included in the certificate request message. In this
 747                         // case we use a plausible list based on the acceptable
 748                         // certificate types.
 749                         signatureSchemes = tls11SignatureSchemes
 750                         if !ecdsaAvail {
 751                                 signatureSchemes = signatureSchemes[tls11SignatureSchemesNumECDSA:]
 752                         }
 753                         if !rsaAvail {
 754                                 signatureSchemes = signatureSchemes[:len(signatureSchemes)-tls11SignatureSchemesNumRSA]
 755                         }
 756                 } else {
 757                         signatureSchemes = certReq.supportedSignatureAlgorithms
 758                 }
 759
 760                 return c.config.GetClientCertificate(&CertificateRequestInfo{
 761                         AcceptableCAs:    certReq.certificateAuthorities,
 762                         SignatureSchemes: signatureSchemes,
 763                 })
 764         }
 765
 766         // RFC 4346 on the certificateAuthorities field: A list of the
 767         // distinguished names of acceptable certificate authorities.
 768         // These distinguished names may specify a desired
 769         // distinguished name for a root CA or for a subordinate CA;
 770         // thus, this message can be used to describe both known roots
 771         // and a desired authorization space. If the
 772         // certificate_authorities list is empty then the client MAY
 773         // send any certificate of the appropriate
 774         // ClientCertificateType, unless there is some external
 775         // arrangement to the contrary.
 776
 777         // We need to search our list of client certs for one
 778         // where SignatureAlgorithm is acceptable to the server and the
 779         // Issuer is in certReq.certificateAuthorities
 780 findCert:
 781         for i, chain := range c.config.Certificates {
 782                 if !rsaAvail && !ecdsaAvail {
 783                         continue
 784                 }
 785
 786                 for j, cert := range chain.Certificate {
 787                         x509Cert := chain.Leaf
 788                         // parse the certificate if this isn't the leaf
 789                         // node, or if chain.Leaf was nil
 790                         if j != 0 || x509Cert == nil {
 791                                 var err error
 792                                 if x509Cert, err = x509.ParseCertificate(cert); err != nil {
 793                                         c.sendAlert(alertInternalError)
 794                                         return nil, errors.New("tls: failed to parse client certificate #" + strconv.Itoa(i) + ": " + err.Error())
 795                                 }
 796                         }
 797
 798                         switch {
 799                         case rsaAvail && x509Cert.PublicKeyAlgorithm == x509.RSA:
 800                         case ecdsaAvail && x509Cert.PublicKeyAlgorithm == x509.ECDSA:
 801                         default:
 802                                 continue findCert
 803                         }
 804
 805                         if len(certReq.certificateAuthorities) == 0 {
 806                                 // they gave us an empty list, so just take the
 807                                 // first cert from c.config.Certificates
 808                                 return &chain, nil
 809                         }
 810
 811                         for _, ca := range certReq.certificateAuthorities {
 812                                 if bytes.Equal(x509Cert.RawIssuer, ca) {
 813                                         return &chain, nil
 814                                 }
 815                         }
 816                 }
 817         }
 818
 819         // No acceptable certificate found. Don't send a certificate.
 820         return new(Certificate), nil
 821 }
 822
 823 // clientSessionCacheKey returns a key used to cache sessionTickets that could
 824 // be used to resume previously negotiated TLS sessions with a server.
 825 func clientSessionCacheKey(serverAddr net.Addr, config *Config) string {
 826         if len(config.ServerName) > 0 {
 827                 return config.ServerName
 828         }
 829         return serverAddr.String()
 830 }
 831
 832 // mutualProtocol finds the mutual Next Protocol Negotiation or ALPN protocol
 833 // given list of possible protocols and a list of the preference order. The
 834 // first list must not be empty. It returns the resulting protocol and flag
 835 // indicating if the fallback case was reached.
 836 func mutualProtocol(protos, preferenceProtos []string) (string, bool) {
 837         for _, s := range preferenceProtos {
 838                 for _, c := range protos {
 839                         if s == c {
 840                                 return s, false
 841                         }
 842                 }
 843         }
 844
 845         return protos[0], true
 846 }
 847
 848 // hostnameInSNI converts name into an approriate hostname for SNI.
 849 // Literal IP addresses and absolute FQDNs are not permitted as SNI values.
 850 // See https://tools.ietf.org/html/rfc6066#section-3.
 851 func hostnameInSNI(name string) string {
 852         host := name
 853         if len(host) > 0 && host[0] == '[' && host[len(host)-1] == ']' {
 854                 host = host[1 : len(host)-1]
 855         }
 856         if i := strings.LastIndex(host, "%"); i > 0 {
 857                 host = host[:i]
 858         }
 859         if net.ParseIP(host) != nil {
 860                 return ""
 861         }
 862         for len(name) > 0 && name[len(name)-1] == '.' {
 863                 name = name[:len(name)-1]
 864         }
 865         return name
 866 }