src/crypto/tls/handshake_server.go

   1 // Copyright 2009 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 package tls
   6
   7 import (
   8         "context"
   9         "crypto"
  10         "crypto/ecdsa"
  11         "crypto/ed25519"
  12         "crypto/rsa"
  13         "crypto/subtle"
  14         "crypto/x509"
  15         "errors"
  16         "fmt"
  17         "hash"
  18         "io"
  19         "time"
  20 )
  21
  22 // serverHandshakeState contains details of a server handshake in progress.
  23 // It's discarded once the handshake has completed.
  24 type serverHandshakeState struct {
  25         c            *Conn
  26         ctx          context.Context
  27         clientHello  *clientHelloMsg
  28         hello        *serverHelloMsg
  29         suite        *cipherSuite
  30         ecdheOk      bool
  31         ecSignOk     bool
  32         rsaDecryptOk bool
  33         rsaSignOk    bool
  34         sessionState *sessionState
  35         finishedHash finishedHash
  36         masterSecret []byte
  37         cert         *Certificate
  38 }
  39
  40 // serverHandshake performs a TLS handshake as a server.
  41 func (c *Conn) serverHandshake(ctx context.Context) error {
  42         clientHello, err := c.readClientHello(ctx)
  43         if err != nil {
  44                 return err
  45         }
  46
  47         if c.vers == VersionTLS13 {
  48                 hs := serverHandshakeStateTLS13{
  49                         c:           c,
  50                         ctx:         ctx,
  51                         clientHello: clientHello,
  52                 }
  53                 return hs.handshake()
  54         }
  55
  56         hs := serverHandshakeState{
  57                 c:           c,
  58                 ctx:         ctx,
  59                 clientHello: clientHello,
  60         }
  61         return hs.handshake()
  62 }
  63
  64 func (hs *serverHandshakeState) handshake() error {
  65         c := hs.c
  66
  67         if err := hs.processClientHello(); err != nil {
  68                 return err
  69         }
  70
  71         // For an overview of TLS handshaking, see RFC 5246, Section 7.3.
  72         c.buffering = true
  73         if hs.checkForResumption() {
  74                 // The client has included a session ticket and so we do an abbreviated handshake.
  75                 c.didResume = true
  76                 if err := hs.doResumeHandshake(); err != nil {
  77                         return err
  78                 }
  79                 if err := hs.establishKeys(); err != nil {
  80                         return err
  81                 }
  82                 if err := hs.sendSessionTicket(); err != nil {
  83                         return err
  84                 }
  85                 if err := hs.sendFinished(c.serverFinished[:]); err != nil {
  86                         return err
  87                 }
  88                 if _, err := c.flush(); err != nil {
  89                         return err
  90                 }
  91                 c.clientFinishedIsFirst = false
  92                 if err := hs.readFinished(nil); err != nil {
  93                         return err
  94                 }
  95         } else {
  96                 // The client didn't include a session ticket, or it wasn't
  97                 // valid so we do a full handshake.
  98                 if err := hs.pickCipherSuite(); err != nil {
  99                         return err
 100                 }
 101                 if err := hs.doFullHandshake(); err != nil {
 102                         return err
 103                 }
 104                 if err := hs.establishKeys(); err != nil {
 105                         return err
 106                 }
 107                 if err := hs.readFinished(c.clientFinished[:]); err != nil {
 108                         return err
 109                 }
 110                 c.clientFinishedIsFirst = true
 111                 c.buffering = true
 112                 if err := hs.sendSessionTicket(); err != nil {
 113                         return err
 114                 }
 115                 if err := hs.sendFinished(nil); err != nil {
 116                         return err
 117                 }
 118                 if _, err := c.flush(); err != nil {
 119                         return err
 120                 }
 121         }
 122
 123         c.ekm = ekmFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random)
 124         c.isHandshakeComplete.Store(true)
 125
 126         return nil
 127 }
 128
 129 // readClientHello reads a ClientHello message and selects the protocol version.
 130 func (c *Conn) readClientHello(ctx context.Context) (*clientHelloMsg, error) {
 131         // clientHelloMsg is included in the transcript, but we haven't initialized
 132         // it yet. The respective handshake functions will record it themselves.
 133         msg, err := c.readHandshake(nil)
 134         if err != nil {
 135                 return nil, err
 136         }
 137         clientHello, ok := msg.(*clientHelloMsg)
 138         if !ok {
 139                 c.sendAlert(alertUnexpectedMessage)
 140                 return nil, unexpectedMessageError(clientHello, msg)
 141         }
 142
 143         var configForClient *Config
 144         originalConfig := c.config
 145         if c.config.GetConfigForClient != nil {
 146                 chi := clientHelloInfo(ctx, c, clientHello)
 147                 if configForClient, err = c.config.GetConfigForClient(chi); err != nil {
 148                         c.sendAlert(alertInternalError)
 149                         return nil, err
 150                 } else if configForClient != nil {
 151                         c.config = configForClient
 152                 }
 153         }
 154         c.ticketKeys = originalConfig.ticketKeys(configForClient)
 155
 156         clientVersions := clientHello.supportedVersions
 157         if len(clientHello.supportedVersions) == 0 {
 158                 clientVersions = supportedVersionsFromMax(clientHello.vers)
 159         }
 160         c.vers, ok = c.config.mutualVersion(roleServer, clientVersions)
 161         if !ok {
 162                 c.sendAlert(alertProtocolVersion)
 163                 return nil, fmt.Errorf("tls: client offered only unsupported versions: %x", clientVersions)
 164         }
 165         c.haveVers = true
 166         c.in.version = c.vers
 167         c.out.version = c.vers
 168
 169         return clientHello, nil
 170 }
 171
 172 func (hs *serverHandshakeState) processClientHello() error {
 173         c := hs.c
 174
 175         hs.hello = new(serverHelloMsg)
 176         hs.hello.vers = c.vers
 177
 178         foundCompression := false
 179         // We only support null compression, so check that the client offered it.
 180         for _, compression := range hs.clientHello.compressionMethods {
 181                 if compression == compressionNone {
 182                         foundCompression = true
 183                         break
 184                 }
 185         }
 186
 187         if !foundCompression {
 188                 c.sendAlert(alertHandshakeFailure)
 189                 return errors.New("tls: client does not support uncompressed connections")
 190         }
 191
 192         hs.hello.random = make([]byte, 32)
 193         serverRandom := hs.hello.random
 194         // Downgrade protection canaries. See RFC 8446, Section 4.1.3.
 195         maxVers := c.config.maxSupportedVersion(roleServer)
 196         if maxVers >= VersionTLS12 && c.vers < maxVers || testingOnlyForceDowngradeCanary {
 197                 if c.vers == VersionTLS12 {
 198                         copy(serverRandom[24:], downgradeCanaryTLS12)
 199                 } else {
 200                         copy(serverRandom[24:], downgradeCanaryTLS11)
 201                 }
 202                 serverRandom = serverRandom[:24]
 203         }
 204         _, err := io.ReadFull(c.config.rand(), serverRandom)
 205         if err != nil {
 206                 c.sendAlert(alertInternalError)
 207                 return err
 208         }
 209
 210         if len(hs.clientHello.secureRenegotiation) != 0 {
 211                 c.sendAlert(alertHandshakeFailure)
 212                 return errors.New("tls: initial handshake had non-empty renegotiation extension")
 213         }
 214
 215         hs.hello.secureRenegotiationSupported = hs.clientHello.secureRenegotiationSupported
 216         hs.hello.compressionMethod = compressionNone
 217         if len(hs.clientHello.serverName) > 0 {
 218                 c.serverName = hs.clientHello.serverName
 219         }
 220
 221         selectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols, false)
 222         if err != nil {
 223                 c.sendAlert(alertNoApplicationProtocol)
 224                 return err
 225         }
 226         hs.hello.alpnProtocol = selectedProto
 227         c.clientProtocol = selectedProto
 228
 229         hs.cert, err = c.config.getCertificate(clientHelloInfo(hs.ctx, c, hs.clientHello))
 230         if err != nil {
 231                 if err == errNoCertificates {
 232                         c.sendAlert(alertUnrecognizedName)
 233                 } else {
 234                         c.sendAlert(alertInternalError)
 235                 }
 236                 return err
 237         }
 238         if hs.clientHello.scts {
 239                 hs.hello.scts = hs.cert.SignedCertificateTimestamps
 240         }
 241
 242         hs.ecdheOk = supportsECDHE(c.config, hs.clientHello.supportedCurves, hs.clientHello.supportedPoints)
 243
 244         if hs.ecdheOk && len(hs.clientHello.supportedPoints) > 0 {
 245                 // Although omitting the ec_point_formats extension is permitted, some
 246                 // old OpenSSL version will refuse to handshake if not present.
 247                 //
 248                 // Per RFC 4492, section 5.1.2, implementations MUST support the
 249                 // uncompressed point format. See golang.org/issue/31943.
 250                 hs.hello.supportedPoints = []uint8{pointFormatUncompressed}
 251         }
 252
 253         if priv, ok := hs.cert.PrivateKey.(crypto.Signer); ok {
 254                 switch priv.Public().(type) {
 255                 case *ecdsa.PublicKey:
 256                         hs.ecSignOk = true
 257                 case ed25519.PublicKey:
 258                         hs.ecSignOk = true
 259                 case *rsa.PublicKey:
 260                         hs.rsaSignOk = true
 261                 default:
 262                         c.sendAlert(alertInternalError)
 263                         return fmt.Errorf("tls: unsupported signing key type (%T)", priv.Public())
 264                 }
 265         }
 266         if priv, ok := hs.cert.PrivateKey.(crypto.Decrypter); ok {
 267                 switch priv.Public().(type) {
 268                 case *rsa.PublicKey:
 269                         hs.rsaDecryptOk = true
 270                 default:
 271                         c.sendAlert(alertInternalError)
 272                         return fmt.Errorf("tls: unsupported decryption key type (%T)", priv.Public())
 273                 }
 274         }
 275
 276         return nil
 277 }
 278
 279 // negotiateALPN picks a shared ALPN protocol that both sides support in server
 280 // preference order. If ALPN is not configured or the peer doesn't support it,
 281 // it returns "" and no error.
 282 func negotiateALPN(serverProtos, clientProtos []string, quic bool) (string, error) {
 283         if len(serverProtos) == 0 || len(clientProtos) == 0 {
 284                 if quic && len(serverProtos) != 0 {
 285                         // RFC 9001, Section 8.1
 286                         return "", fmt.Errorf("tls: client did not request an application protocol")
 287                 }
 288                 return "", nil
 289         }
 290         var http11fallback bool
 291         for _, s := range serverProtos {
 292                 for _, c := range clientProtos {
 293                         if s == c {
 294                                 return s, nil
 295                         }
 296                         if s == "h2" && c == "http/1.1" {
 297                                 http11fallback = true
 298                         }
 299                 }
 300         }
 301         // As a special case, let http/1.1 clients connect to h2 servers as if they
 302         // didn't support ALPN. We used not to enforce protocol overlap, so over
 303         // time a number of HTTP servers were configured with only "h2", but
 304         // expected to accept connections from "http/1.1" clients. See Issue 46310.
 305         if http11fallback {
 306                 return "", nil
 307         }
 308         return "", fmt.Errorf("tls: client requested unsupported application protocols (%s)", clientProtos)
 309 }
 310
 311 // supportsECDHE returns whether ECDHE key exchanges can be used with this
 312 // pre-TLS 1.3 client.
 313 func supportsECDHE(c *Config, supportedCurves []CurveID, supportedPoints []uint8) bool {
 314         supportsCurve := false
 315         for _, curve := range supportedCurves {
 316                 if c.supportsCurve(curve) {
 317                         supportsCurve = true
 318                         break
 319                 }
 320         }
 321
 322         supportsPointFormat := false
 323         for _, pointFormat := range supportedPoints {
 324                 if pointFormat == pointFormatUncompressed {
 325                         supportsPointFormat = true
 326                         break
 327                 }
 328         }
 329         // Per RFC 8422, Section 5.1.2, if the Supported Point Formats extension is
 330         // missing, uncompressed points are supported. If supportedPoints is empty,
 331         // the extension must be missing, as an empty extension body is rejected by
 332         // the parser. See https://go.dev/issue/49126.
 333         if len(supportedPoints) == 0 {
 334                 supportsPointFormat = true
 335         }
 336
 337         return supportsCurve && supportsPointFormat
 338 }
 339
 340 func (hs *serverHandshakeState) pickCipherSuite() error {
 341         c := hs.c
 342
 343         preferenceOrder := cipherSuitesPreferenceOrder
 344         if !hasAESGCMHardwareSupport || !aesgcmPreferred(hs.clientHello.cipherSuites) {
 345                 preferenceOrder = cipherSuitesPreferenceOrderNoAES
 346         }
 347
 348         configCipherSuites := c.config.cipherSuites()
 349         preferenceList := make([]uint16, 0, len(configCipherSuites))
 350         for _, suiteID := range preferenceOrder {
 351                 for _, id := range configCipherSuites {
 352                         if id == suiteID {
 353                                 preferenceList = append(preferenceList, id)
 354                                 break
 355                         }
 356                 }
 357         }
 358
 359         hs.suite = selectCipherSuite(preferenceList, hs.clientHello.cipherSuites, hs.cipherSuiteOk)
 360         if hs.suite == nil {
 361                 c.sendAlert(alertHandshakeFailure)
 362                 return errors.New("tls: no cipher suite supported by both client and server")
 363         }
 364         c.cipherSuite = hs.suite.id
 365
 366         for _, id := range hs.clientHello.cipherSuites {
 367                 if id == TLS_FALLBACK_SCSV {
 368                         // The client is doing a fallback connection. See RFC 7507.
 369                         if hs.clientHello.vers < c.config.maxSupportedVersion(roleServer) {
 370                                 c.sendAlert(alertInappropriateFallback)
 371                                 return errors.New("tls: client using inappropriate protocol fallback")
 372                         }
 373                         break
 374                 }
 375         }
 376
 377         return nil
 378 }
 379
 380 func (hs *serverHandshakeState) cipherSuiteOk(c *cipherSuite) bool {
 381         if c.flags&suiteECDHE != 0 {
 382                 if !hs.ecdheOk {
 383                         return false
 384                 }
 385                 if c.flags&suiteECSign != 0 {
 386                         if !hs.ecSignOk {
 387                                 return false
 388                         }
 389                 } else if !hs.rsaSignOk {
 390                         return false
 391                 }
 392         } else if !hs.rsaDecryptOk {
 393                 return false
 394         }
 395         if hs.c.vers < VersionTLS12 && c.flags&suiteTLS12 != 0 {
 396                 return false
 397         }
 398         return true
 399 }
 400
 401 // checkForResumption reports whether we should perform resumption on this connection.
 402 func (hs *serverHandshakeState) checkForResumption() bool {
 403         c := hs.c
 404
 405         if c.config.SessionTicketsDisabled {
 406                 return false
 407         }
 408
 409         plaintext := c.decryptTicket(hs.clientHello.sessionTicket)
 410         if plaintext == nil {
 411                 return false
 412         }
 413         hs.sessionState = &sessionState{}
 414         ok := hs.sessionState.unmarshal(plaintext)
 415         if !ok {
 416                 return false
 417         }
 418
 419         // TLS 1.2 tickets don't natively have a lifetime, but we want to avoid
 420         // re-wrapping the same master secret in different tickets over and over for
 421         // too long, weakening forward secrecy.
 422         createdAt := time.Unix(int64(hs.sessionState.createdAt), 0)
 423         if c.config.time().Sub(createdAt) > maxSessionTicketLifetime {
 424                 return false
 425         }
 426
 427         // Never resume a session for a different TLS version.
 428         if c.vers != hs.sessionState.vers {
 429                 return false
 430         }
 431
 432         cipherSuiteOk := false
 433         // Check that the client is still offering the ciphersuite in the session.
 434         for _, id := range hs.clientHello.cipherSuites {
 435                 if id == hs.sessionState.cipherSuite {
 436                         cipherSuiteOk = true
 437                         break
 438                 }
 439         }
 440         if !cipherSuiteOk {
 441                 return false
 442         }
 443
 444         // Check that we also support the ciphersuite from the session.
 445         hs.suite = selectCipherSuite([]uint16{hs.sessionState.cipherSuite},
 446                 c.config.cipherSuites(), hs.cipherSuiteOk)
 447         if hs.suite == nil {
 448                 return false
 449         }
 450
 451         sessionHasClientCerts := len(hs.sessionState.certificates) != 0
 452         needClientCerts := requiresClientCert(c.config.ClientAuth)
 453         if needClientCerts && !sessionHasClientCerts {
 454                 return false
 455         }
 456         if sessionHasClientCerts && c.config.ClientAuth == NoClientCert {
 457                 return false
 458         }
 459
 460         return true
 461 }
 462
 463 func (hs *serverHandshakeState) doResumeHandshake() error {
 464         c := hs.c
 465
 466         hs.hello.cipherSuite = hs.suite.id
 467         c.cipherSuite = hs.suite.id
 468         // We echo the client's session ID in the ServerHello to let it know
 469         // that we're doing a resumption.
 470         hs.hello.sessionId = hs.clientHello.sessionId
 471         // We always send a new session ticket, even if it wraps the same master
 472         // secret and it's potentially encrypted with the same key, to help the
 473         // client avoid cross-connection tracking from a network observer.
 474         hs.hello.ticketSupported = true
 475         hs.finishedHash = newFinishedHash(c.vers, hs.suite)
 476         hs.finishedHash.discardHandshakeBuffer()
 477         if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
 478                 return err
 479         }
 480         if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
 481                 return err
 482         }
 483
 484         if err := c.processCertsFromClient(Certificate{
 485                 Certificate: hs.sessionState.certificates,
 486         }); err != nil {
 487                 return err
 488         }
 489
 490         if c.config.VerifyConnection != nil {
 491                 if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
 492                         c.sendAlert(alertBadCertificate)
 493                         return err
 494                 }
 495         }
 496
 497         hs.masterSecret = hs.sessionState.masterSecret
 498
 499         return nil
 500 }
 501
 502 func (hs *serverHandshakeState) doFullHandshake() error {
 503         c := hs.c
 504
 505         if hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 {
 506                 hs.hello.ocspStapling = true
 507         }
 508
 509         hs.hello.ticketSupported = hs.clientHello.ticketSupported && !c.config.SessionTicketsDisabled
 510         hs.hello.cipherSuite = hs.suite.id
 511
 512         hs.finishedHash = newFinishedHash(hs.c.vers, hs.suite)
 513         if c.config.ClientAuth == NoClientCert {
 514                 // No need to keep a full record of the handshake if client
 515                 // certificates won't be used.
 516                 hs.finishedHash.discardHandshakeBuffer()
 517         }
 518         if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
 519                 return err
 520         }
 521         if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
 522                 return err
 523         }
 524
 525         certMsg := new(certificateMsg)
 526         certMsg.certificates = hs.cert.Certificate
 527         if _, err := hs.c.writeHandshakeRecord(certMsg, &hs.finishedHash); err != nil {
 528                 return err
 529         }
 530
 531         if hs.hello.ocspStapling {
 532                 certStatus := new(certificateStatusMsg)
 533                 certStatus.response = hs.cert.OCSPStaple
 534                 if _, err := hs.c.writeHandshakeRecord(certStatus, &hs.finishedHash); err != nil {
 535                         return err
 536                 }
 537         }
 538
 539         keyAgreement := hs.suite.ka(c.vers)
 540         skx, err := keyAgreement.generateServerKeyExchange(c.config, hs.cert, hs.clientHello, hs.hello)
 541         if err != nil {
 542                 c.sendAlert(alertHandshakeFailure)
 543                 return err
 544         }
 545         if skx != nil {
 546                 if _, err := hs.c.writeHandshakeRecord(skx, &hs.finishedHash); err != nil {
 547                         return err
 548                 }
 549         }
 550
 551         var certReq *certificateRequestMsg
 552         if c.config.ClientAuth >= RequestClientCert {
 553                 // Request a client certificate
 554                 certReq = new(certificateRequestMsg)
 555                 certReq.certificateTypes = []byte{
 556                         byte(certTypeRSASign),
 557                         byte(certTypeECDSASign),
 558                 }
 559                 if c.vers >= VersionTLS12 {
 560                         certReq.hasSignatureAlgorithm = true
 561                         certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms()
 562                 }
 563
 564                 // An empty list of certificateAuthorities signals to
 565                 // the client that it may send any certificate in response
 566                 // to our request. When we know the CAs we trust, then
 567                 // we can send them down, so that the client can choose
 568                 // an appropriate certificate to give to us.
 569                 if c.config.ClientCAs != nil {
 570                         certReq.certificateAuthorities = c.config.ClientCAs.Subjects()
 571                 }
 572                 if _, err := hs.c.writeHandshakeRecord(certReq, &hs.finishedHash); err != nil {
 573                         return err
 574                 }
 575         }
 576
 577         helloDone := new(serverHelloDoneMsg)
 578         if _, err := hs.c.writeHandshakeRecord(helloDone, &hs.finishedHash); err != nil {
 579                 return err
 580         }
 581
 582         if _, err := c.flush(); err != nil {
 583                 return err
 584         }
 585
 586         var pub crypto.PublicKey // public key for client auth, if any
 587
 588         msg, err := c.readHandshake(&hs.finishedHash)
 589         if err != nil {
 590                 return err
 591         }
 592
 593         // If we requested a client certificate, then the client must send a
 594         // certificate message, even if it's empty.
 595         if c.config.ClientAuth >= RequestClientCert {
 596                 certMsg, ok := msg.(*certificateMsg)
 597                 if !ok {
 598                         c.sendAlert(alertUnexpectedMessage)
 599                         return unexpectedMessageError(certMsg, msg)
 600                 }
 601
 602                 if err := c.processCertsFromClient(Certificate{
 603                         Certificate: certMsg.certificates,
 604                 }); err != nil {
 605                         return err
 606                 }
 607                 if len(certMsg.certificates) != 0 {
 608                         pub = c.peerCertificates[0].PublicKey
 609                 }
 610
 611                 msg, err = c.readHandshake(&hs.finishedHash)
 612                 if err != nil {
 613                         return err
 614                 }
 615         }
 616         if c.config.VerifyConnection != nil {
 617                 if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
 618                         c.sendAlert(alertBadCertificate)
 619                         return err
 620                 }
 621         }
 622
 623         // Get client key exchange
 624         ckx, ok := msg.(*clientKeyExchangeMsg)
 625         if !ok {
 626                 c.sendAlert(alertUnexpectedMessage)
 627                 return unexpectedMessageError(ckx, msg)
 628         }
 629
 630         preMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers)
 631         if err != nil {
 632                 c.sendAlert(alertHandshakeFailure)
 633                 return err
 634         }
 635         hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.clientHello.random, hs.hello.random)
 636         if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.clientHello.random, hs.masterSecret); err != nil {
 637                 c.sendAlert(alertInternalError)
 638                 return err
 639         }
 640
 641         // If we received a client cert in response to our certificate request message,
 642         // the client will send us a certificateVerifyMsg immediately after the
 643         // clientKeyExchangeMsg. This message is a digest of all preceding
 644         // handshake-layer messages that is signed using the private key corresponding
 645         // to the client's certificate. This allows us to verify that the client is in
 646         // possession of the private key of the certificate.
 647         if len(c.peerCertificates) > 0 {
 648                 // certificateVerifyMsg is included in the transcript, but not until
 649                 // after we verify the handshake signature, since the state before
 650                 // this message was sent is used.
 651                 msg, err = c.readHandshake(nil)
 652                 if err != nil {
 653                         return err
 654                 }
 655                 certVerify, ok := msg.(*certificateVerifyMsg)
 656                 if !ok {
 657                         c.sendAlert(alertUnexpectedMessage)
 658                         return unexpectedMessageError(certVerify, msg)
 659                 }
 660
 661                 var sigType uint8
 662                 var sigHash crypto.Hash
 663                 if c.vers >= VersionTLS12 {
 664                         if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, certReq.supportedSignatureAlgorithms) {
 665                                 c.sendAlert(alertIllegalParameter)
 666                                 return errors.New("tls: client certificate used with invalid signature algorithm")
 667                         }
 668                         sigType, sigHash, err = typeAndHashFromSignatureScheme(certVerify.signatureAlgorithm)
 669                         if err != nil {
 670                                 return c.sendAlert(alertInternalError)
 671                         }
 672                 } else {
 673                         sigType, sigHash, err = legacyTypeAndHashFromPublicKey(pub)
 674                         if err != nil {
 675                                 c.sendAlert(alertIllegalParameter)
 676                                 return err
 677                         }
 678                 }
 679
 680                 signed := hs.finishedHash.hashForClientCertificate(sigType, sigHash)
 681                 if err := verifyHandshakeSignature(sigType, pub, sigHash, signed, certVerify.signature); err != nil {
 682                         c.sendAlert(alertDecryptError)
 683                         return errors.New("tls: invalid signature by the client certificate: " + err.Error())
 684                 }
 685
 686                 if err := transcriptMsg(certVerify, &hs.finishedHash); err != nil {
 687                         return err
 688                 }
 689         }
 690
 691         hs.finishedHash.discardHandshakeBuffer()
 692
 693         return nil
 694 }
 695
 696 func (hs *serverHandshakeState) establishKeys() error {
 697         c := hs.c
 698
 699         clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
 700                 keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
 701
 702         var clientCipher, serverCipher any
 703         var clientHash, serverHash hash.Hash
 704
 705         if hs.suite.aead == nil {
 706                 clientCipher = hs.suite.cipher(clientKey, clientIV, true /* for reading */)
 707                 clientHash = hs.suite.mac(clientMAC)
 708                 serverCipher = hs.suite.cipher(serverKey, serverIV, false /* not for reading */)
 709                 serverHash = hs.suite.mac(serverMAC)
 710         } else {
 711                 clientCipher = hs.suite.aead(clientKey, clientIV)
 712                 serverCipher = hs.suite.aead(serverKey, serverIV)
 713         }
 714
 715         c.in.prepareCipherSpec(c.vers, clientCipher, clientHash)
 716         c.out.prepareCipherSpec(c.vers, serverCipher, serverHash)
 717
 718         return nil
 719 }
 720
 721 func (hs *serverHandshakeState) readFinished(out []byte) error {
 722         c := hs.c
 723
 724         if err := c.readChangeCipherSpec(); err != nil {
 725                 return err
 726         }
 727
 728         // finishedMsg is included in the transcript, but not until after we
 729         // check the client version, since the state before this message was
 730         // sent is used during verification.
 731         msg, err := c.readHandshake(nil)
 732         if err != nil {
 733                 return err
 734         }
 735         clientFinished, ok := msg.(*finishedMsg)
 736         if !ok {
 737                 c.sendAlert(alertUnexpectedMessage)
 738                 return unexpectedMessageError(clientFinished, msg)
 739         }
 740
 741         verify := hs.finishedHash.clientSum(hs.masterSecret)
 742         if len(verify) != len(clientFinished.verifyData) ||
 743                 subtle.ConstantTimeCompare(verify, clientFinished.verifyData) != 1 {
 744                 c.sendAlert(alertHandshakeFailure)
 745                 return errors.New("tls: client's Finished message is incorrect")
 746         }
 747
 748         if err := transcriptMsg(clientFinished, &hs.finishedHash); err != nil {
 749                 return err
 750         }
 751
 752         copy(out, verify)
 753         return nil
 754 }
 755
 756 func (hs *serverHandshakeState) sendSessionTicket() error {
 757         if !hs.hello.ticketSupported {
 758                 return nil
 759         }
 760
 761         c := hs.c
 762         m := new(newSessionTicketMsg)
 763
 764         createdAt := uint64(c.config.time().Unix())
 765         if hs.sessionState != nil {
 766                 // If this is re-wrapping an old key, then keep
 767                 // the original time it was created.
 768                 createdAt = hs.sessionState.createdAt
 769         }
 770
 771         var certsFromClient [][]byte
 772         for _, cert := range c.peerCertificates {
 773                 certsFromClient = append(certsFromClient, cert.Raw)
 774         }
 775         state := sessionState{
 776                 vers:         c.vers,
 777                 cipherSuite:  hs.suite.id,
 778                 createdAt:    createdAt,
 779                 masterSecret: hs.masterSecret,
 780                 certificates: certsFromClient,
 781         }
 782         stateBytes, err := state.marshal()
 783         if err != nil {
 784                 return err
 785         }
 786         m.ticket, err = c.encryptTicket(stateBytes)
 787         if err != nil {
 788                 return err
 789         }
 790
 791         if _, err := hs.c.writeHandshakeRecord(m, &hs.finishedHash); err != nil {
 792                 return err
 793         }
 794
 795         return nil
 796 }
 797
 798 func (hs *serverHandshakeState) sendFinished(out []byte) error {
 799         c := hs.c
 800
 801         if err := c.writeChangeCipherRecord(); err != nil {
 802                 return err
 803         }
 804
 805         finished := new(finishedMsg)
 806         finished.verifyData = hs.finishedHash.serverSum(hs.masterSecret)
 807         if _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil {
 808                 return err
 809         }
 810
 811         copy(out, finished.verifyData)
 812
 813         return nil
 814 }
 815
 816 // processCertsFromClient takes a chain of client certificates either from a
 817 // Certificates message or from a sessionState and verifies them. It returns
 818 // the public key of the leaf certificate.
 819 func (c *Conn) processCertsFromClient(certificate Certificate) error {
 820         certificates := certificate.Certificate
 821         certs := make([]*x509.Certificate, len(certificates))
 822         var err error
 823         for i, asn1Data := range certificates {
 824                 if certs[i], err = x509.ParseCertificate(asn1Data); err != nil {
 825                         c.sendAlert(alertBadCertificate)
 826                         return errors.New("tls: failed to parse client certificate: " + err.Error())
 827                 }
 828         }
 829
 830         if len(certs) == 0 && requiresClientCert(c.config.ClientAuth) {
 831                 if c.vers == VersionTLS13 {
 832                         c.sendAlert(alertCertificateRequired)
 833                 } else {
 834                         c.sendAlert(alertBadCertificate)
 835                 }
 836                 return errors.New("tls: client didn't provide a certificate")
 837         }
 838
 839         if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
 840                 opts := x509.VerifyOptions{
 841                         Roots:         c.config.ClientCAs,
 842                         CurrentTime:   c.config.time(),
 843                         Intermediates: x509.NewCertPool(),
 844                         KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 845                 }
 846
 847                 for _, cert := range certs[1:] {
 848                         opts.Intermediates.AddCert(cert)
 849                 }
 850
 851                 chains, err := certs[0].Verify(opts)
 852                 if err != nil {
 853                         var errCertificateInvalid x509.CertificateInvalidError
 854                         if errors.As(err, &x509.UnknownAuthorityError{}) {
 855                                 c.sendAlert(alertUnknownCA)
 856                         } else if errors.As(err, &errCertificateInvalid) && errCertificateInvalid.Reason == x509.Expired {
 857                                 c.sendAlert(alertCertificateExpired)
 858                         } else {
 859                                 c.sendAlert(alertBadCertificate)
 860                         }
 861                         return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
 862                 }
 863
 864                 c.verifiedChains = chains
 865         }
 866
 867         c.peerCertificates = certs
 868         c.ocspResponse = certificate.OCSPStaple
 869         c.scts = certificate.SignedCertificateTimestamps
 870
 871         if len(certs) > 0 {
 872                 switch certs[0].PublicKey.(type) {
 873                 case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
 874                 default:
 875                         c.sendAlert(alertUnsupportedCertificate)
 876                         return fmt.Errorf("tls: client certificate contains an unsupported public key of type %T", certs[0].PublicKey)
 877                 }
 878         }
 879
 880         if c.config.VerifyPeerCertificate != nil {
 881                 if err := c.config.VerifyPeerCertificate(certificates, c.verifiedChains); err != nil {
 882                         c.sendAlert(alertBadCertificate)
 883                         return err
 884                 }
 885         }
 886
 887         return nil
 888 }
 889
 890 func clientHelloInfo(ctx context.Context, c *Conn, clientHello *clientHelloMsg) *ClientHelloInfo {
 891         supportedVersions := clientHello.supportedVersions
 892         if len(clientHello.supportedVersions) == 0 {
 893                 supportedVersions = supportedVersionsFromMax(clientHello.vers)
 894         }
 895
 896         return &ClientHelloInfo{
 897                 CipherSuites:      clientHello.cipherSuites,
 898                 ServerName:        clientHello.serverName,
 899                 SupportedCurves:   clientHello.supportedCurves,
 900                 SupportedPoints:   clientHello.supportedPoints,
 901                 SignatureSchemes:  clientHello.supportedSignatureAlgorithms,
 902                 SupportedProtos:   clientHello.alpnProtocols,
 903                 SupportedVersions: supportedVersions,
 904                 Conn:              c.conn,
 905                 config:            c.config,
 906                 ctx:               ctx,
 907         }
 908 }