src/crypto/tls/handshake_server.go

   1 // Copyright 2009 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 package tls
   6
   7 import (
   8         "crypto"
   9         "crypto/ecdsa"
  10         "crypto/rsa"
  11         "crypto/subtle"
  12         "crypto/x509"
  13         "encoding/asn1"
  14         "errors"
  15         "fmt"
  16         "io"
  17 )
  18
  19 // serverHandshakeState contains details of a server handshake in progress.
  20 // It's discarded once the handshake has completed.
  21 type serverHandshakeState struct {
  22         c                     *Conn
  23         clientHello           *clientHelloMsg
  24         hello                 *serverHelloMsg
  25         suite                 *cipherSuite
  26         ellipticOk            bool
  27         ecdsaOk               bool
  28         rsaDecryptOk          bool
  29         rsaSignOk             bool
  30         sessionState          *sessionState
  31         finishedHash          finishedHash
  32         masterSecret          []byte
  33         certsFromClient       [][]byte
  34         cert                  *Certificate
  35         cachedClientHelloInfo *ClientHelloInfo
  36 }
  37
  38 // serverHandshake performs a TLS handshake as a server.
  39 func (c *Conn) serverHandshake() error {
  40         // If this is the first server handshake, we generate a random key to
  41         // encrypt the tickets with.
  42         c.config.serverInitOnce.Do(func() { c.config.serverInit(nil) })
  43
  44         hs := serverHandshakeState{
  45                 c: c,
  46         }
  47         isResume, err := hs.readClientHello()
  48         if err != nil {
  49                 return err
  50         }
  51
  52         // For an overview of TLS handshaking, see https://tools.ietf.org/html/rfc5246#section-7.3
  53         c.buffering = true
  54         if isResume {
  55                 // The client has included a session ticket and so we do an abbreviated handshake.
  56                 if err := hs.doResumeHandshake(); err != nil {
  57                         return err
  58                 }
  59                 if err := hs.establishKeys(); err != nil {
  60                         return err
  61                 }
  62                 // ticketSupported is set in a resumption handshake if the
  63                 // ticket from the client was encrypted with an old session
  64                 // ticket key and thus a refreshed ticket should be sent.
  65                 if hs.hello.ticketSupported {
  66                         if err := hs.sendSessionTicket(); err != nil {
  67                                 return err
  68                         }
  69                 }
  70                 if err := hs.sendFinished(c.serverFinished[:]); err != nil {
  71                         return err
  72                 }
  73                 if _, err := c.flush(); err != nil {
  74                         return err
  75                 }
  76                 c.clientFinishedIsFirst = false
  77                 if err := hs.readFinished(nil); err != nil {
  78                         return err
  79                 }
  80                 c.didResume = true
  81         } else {
  82                 // The client didn't include a session ticket, or it wasn't
  83                 // valid so we do a full handshake.
  84                 if err := hs.doFullHandshake(); err != nil {
  85                         return err
  86                 }
  87                 if err := hs.establishKeys(); err != nil {
  88                         return err
  89                 }
  90                 if err := hs.readFinished(c.clientFinished[:]); err != nil {
  91                         return err
  92                 }
  93                 c.clientFinishedIsFirst = true
  94                 c.buffering = true
  95                 if err := hs.sendSessionTicket(); err != nil {
  96                         return err
  97                 }
  98                 if err := hs.sendFinished(nil); err != nil {
  99                         return err
 100                 }
 101                 if _, err := c.flush(); err != nil {
 102                         return err
 103                 }
 104         }
 105
 106         c.ekm = ekmFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random)
 107         c.handshakeComplete = true
 108
 109         return nil
 110 }
 111
 112 // readClientHello reads a ClientHello message from the client and decides
 113 // whether we will perform session resumption.
 114 func (hs *serverHandshakeState) readClientHello() (isResume bool, err error) {
 115         c := hs.c
 116
 117         msg, err := c.readHandshake()
 118         if err != nil {
 119                 return false, err
 120         }
 121         var ok bool
 122         hs.clientHello, ok = msg.(*clientHelloMsg)
 123         if !ok {
 124                 c.sendAlert(alertUnexpectedMessage)
 125                 return false, unexpectedMessageError(hs.clientHello, msg)
 126         }
 127
 128         if c.config.GetConfigForClient != nil {
 129                 if newConfig, err := c.config.GetConfigForClient(hs.clientHelloInfo()); err != nil {
 130                         c.sendAlert(alertInternalError)
 131                         return false, err
 132                 } else if newConfig != nil {
 133                         newConfig.serverInitOnce.Do(func() { newConfig.serverInit(c.config) })
 134                         c.config = newConfig
 135                 }
 136         }
 137
 138         c.vers, ok = c.config.mutualVersion(hs.clientHello.vers)
 139         if !ok {
 140                 c.sendAlert(alertProtocolVersion)
 141                 return false, fmt.Errorf("tls: client offered an unsupported, maximum protocol version of %x", hs.clientHello.vers)
 142         }
 143         c.haveVers = true
 144
 145         hs.hello = new(serverHelloMsg)
 146
 147         supportedCurve := false
 148         preferredCurves := c.config.curvePreferences()
 149 Curves:
 150         for _, curve := range hs.clientHello.supportedCurves {
 151                 for _, supported := range preferredCurves {
 152                         if supported == curve {
 153                                 supportedCurve = true
 154                                 break Curves
 155                         }
 156                 }
 157         }
 158
 159         supportedPointFormat := false
 160         for _, pointFormat := range hs.clientHello.supportedPoints {
 161                 if pointFormat == pointFormatUncompressed {
 162                         supportedPointFormat = true
 163                         break
 164                 }
 165         }
 166         hs.ellipticOk = supportedCurve && supportedPointFormat
 167
 168         foundCompression := false
 169         // We only support null compression, so check that the client offered it.
 170         for _, compression := range hs.clientHello.compressionMethods {
 171                 if compression == compressionNone {
 172                         foundCompression = true
 173                         break
 174                 }
 175         }
 176
 177         if !foundCompression {
 178                 c.sendAlert(alertHandshakeFailure)
 179                 return false, errors.New("tls: client does not support uncompressed connections")
 180         }
 181
 182         hs.hello.vers = c.vers
 183         hs.hello.random = make([]byte, 32)
 184         _, err = io.ReadFull(c.config.rand(), hs.hello.random)
 185         if err != nil {
 186                 c.sendAlert(alertInternalError)
 187                 return false, err
 188         }
 189
 190         if len(hs.clientHello.secureRenegotiation) != 0 {
 191                 c.sendAlert(alertHandshakeFailure)
 192                 return false, errors.New("tls: initial handshake had non-empty renegotiation extension")
 193         }
 194
 195         hs.hello.secureRenegotiationSupported = hs.clientHello.secureRenegotiationSupported
 196         hs.hello.compressionMethod = compressionNone
 197         if len(hs.clientHello.serverName) > 0 {
 198                 c.serverName = hs.clientHello.serverName
 199         }
 200
 201         if len(hs.clientHello.alpnProtocols) > 0 {
 202                 if selectedProto, fallback := mutualProtocol(hs.clientHello.alpnProtocols, c.config.NextProtos); !fallback {
 203                         hs.hello.alpnProtocol = selectedProto
 204                         c.clientProtocol = selectedProto
 205                 }
 206         } else {
 207                 // Although sending an empty NPN extension is reasonable, Firefox has
 208                 // had a bug around this. Best to send nothing at all if
 209                 // c.config.NextProtos is empty. See
 210                 // https://golang.org/issue/5445.
 211                 if hs.clientHello.nextProtoNeg && len(c.config.NextProtos) > 0 {
 212                         hs.hello.nextProtoNeg = true
 213                         hs.hello.nextProtos = c.config.NextProtos
 214                 }
 215         }
 216
 217         hs.cert, err = c.config.getCertificate(hs.clientHelloInfo())
 218         if err != nil {
 219                 c.sendAlert(alertInternalError)
 220                 return false, err
 221         }
 222         if hs.clientHello.scts {
 223                 hs.hello.scts = hs.cert.SignedCertificateTimestamps
 224         }
 225
 226         if priv, ok := hs.cert.PrivateKey.(crypto.Signer); ok {
 227                 switch priv.Public().(type) {
 228                 case *ecdsa.PublicKey:
 229                         hs.ecdsaOk = true
 230                 case *rsa.PublicKey:
 231                         hs.rsaSignOk = true
 232                 default:
 233                         c.sendAlert(alertInternalError)
 234                         return false, fmt.Errorf("tls: unsupported signing key type (%T)", priv.Public())
 235                 }
 236         }
 237         if priv, ok := hs.cert.PrivateKey.(crypto.Decrypter); ok {
 238                 switch priv.Public().(type) {
 239                 case *rsa.PublicKey:
 240                         hs.rsaDecryptOk = true
 241                 default:
 242                         c.sendAlert(alertInternalError)
 243                         return false, fmt.Errorf("tls: unsupported decryption key type (%T)", priv.Public())
 244                 }
 245         }
 246
 247         if hs.checkForResumption() {
 248                 return true, nil
 249         }
 250
 251         var preferenceList, supportedList []uint16
 252         if c.config.PreferServerCipherSuites {
 253                 preferenceList = c.config.cipherSuites()
 254                 supportedList = hs.clientHello.cipherSuites
 255         } else {
 256                 preferenceList = hs.clientHello.cipherSuites
 257                 supportedList = c.config.cipherSuites()
 258         }
 259
 260         for _, id := range preferenceList {
 261                 if hs.setCipherSuite(id, supportedList, c.vers) {
 262                         break
 263                 }
 264         }
 265
 266         if hs.suite == nil {
 267                 c.sendAlert(alertHandshakeFailure)
 268                 return false, errors.New("tls: no cipher suite supported by both client and server")
 269         }
 270
 271         // See https://tools.ietf.org/html/rfc7507.
 272         for _, id := range hs.clientHello.cipherSuites {
 273                 if id == TLS_FALLBACK_SCSV {
 274                         // The client is doing a fallback connection.
 275                         if hs.clientHello.vers < c.config.maxVersion() {
 276                                 c.sendAlert(alertInappropriateFallback)
 277                                 return false, errors.New("tls: client using inappropriate protocol fallback")
 278                         }
 279                         break
 280                 }
 281         }
 282
 283         return false, nil
 284 }
 285
 286 // checkForResumption reports whether we should perform resumption on this connection.
 287 func (hs *serverHandshakeState) checkForResumption() bool {
 288         c := hs.c
 289
 290         if c.config.SessionTicketsDisabled {
 291                 return false
 292         }
 293
 294         var ok bool
 295         var sessionTicket = append([]uint8{}, hs.clientHello.sessionTicket...)
 296         if hs.sessionState, ok = c.decryptTicket(sessionTicket); !ok {
 297                 return false
 298         }
 299
 300         // Never resume a session for a different TLS version.
 301         if c.vers != hs.sessionState.vers {
 302                 return false
 303         }
 304
 305         cipherSuiteOk := false
 306         // Check that the client is still offering the ciphersuite in the session.
 307         for _, id := range hs.clientHello.cipherSuites {
 308                 if id == hs.sessionState.cipherSuite {
 309                         cipherSuiteOk = true
 310                         break
 311                 }
 312         }
 313         if !cipherSuiteOk {
 314                 return false
 315         }
 316
 317         // Check that we also support the ciphersuite from the session.
 318         if !hs.setCipherSuite(hs.sessionState.cipherSuite, c.config.cipherSuites(), hs.sessionState.vers) {
 319                 return false
 320         }
 321
 322         sessionHasClientCerts := len(hs.sessionState.certificates) != 0
 323         needClientCerts := c.config.ClientAuth == RequireAnyClientCert || c.config.ClientAuth == RequireAndVerifyClientCert
 324         if needClientCerts && !sessionHasClientCerts {
 325                 return false
 326         }
 327         if sessionHasClientCerts && c.config.ClientAuth == NoClientCert {
 328                 return false
 329         }
 330
 331         return true
 332 }
 333
 334 func (hs *serverHandshakeState) doResumeHandshake() error {
 335         c := hs.c
 336
 337         hs.hello.cipherSuite = hs.suite.id
 338         // We echo the client's session ID in the ServerHello to let it know
 339         // that we're doing a resumption.
 340         hs.hello.sessionId = hs.clientHello.sessionId
 341         hs.hello.ticketSupported = hs.sessionState.usedOldKey
 342         hs.finishedHash = newFinishedHash(c.vers, hs.suite)
 343         hs.finishedHash.discardHandshakeBuffer()
 344         hs.finishedHash.Write(hs.clientHello.marshal())
 345         hs.finishedHash.Write(hs.hello.marshal())
 346         if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil {
 347                 return err
 348         }
 349
 350         if len(hs.sessionState.certificates) > 0 {
 351                 if _, err := hs.processCertsFromClient(hs.sessionState.certificates); err != nil {
 352                         return err
 353                 }
 354         }
 355
 356         hs.masterSecret = hs.sessionState.masterSecret
 357
 358         return nil
 359 }
 360
 361 func (hs *serverHandshakeState) doFullHandshake() error {
 362         c := hs.c
 363
 364         if hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 {
 365                 hs.hello.ocspStapling = true
 366         }
 367
 368         hs.hello.ticketSupported = hs.clientHello.ticketSupported && !c.config.SessionTicketsDisabled
 369         hs.hello.cipherSuite = hs.suite.id
 370
 371         hs.finishedHash = newFinishedHash(hs.c.vers, hs.suite)
 372         if c.config.ClientAuth == NoClientCert {
 373                 // No need to keep a full record of the handshake if client
 374                 // certificates won't be used.
 375                 hs.finishedHash.discardHandshakeBuffer()
 376         }
 377         hs.finishedHash.Write(hs.clientHello.marshal())
 378         hs.finishedHash.Write(hs.hello.marshal())
 379         if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil {
 380                 return err
 381         }
 382
 383         certMsg := new(certificateMsg)
 384         certMsg.certificates = hs.cert.Certificate
 385         hs.finishedHash.Write(certMsg.marshal())
 386         if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil {
 387                 return err
 388         }
 389
 390         if hs.hello.ocspStapling {
 391                 certStatus := new(certificateStatusMsg)
 392                 certStatus.statusType = statusTypeOCSP
 393                 certStatus.response = hs.cert.OCSPStaple
 394                 hs.finishedHash.Write(certStatus.marshal())
 395                 if _, err := c.writeRecord(recordTypeHandshake, certStatus.marshal()); err != nil {
 396                         return err
 397                 }
 398         }
 399
 400         keyAgreement := hs.suite.ka(c.vers)
 401         skx, err := keyAgreement.generateServerKeyExchange(c.config, hs.cert, hs.clientHello, hs.hello)
 402         if err != nil {
 403                 c.sendAlert(alertHandshakeFailure)
 404                 return err
 405         }
 406         if skx != nil {
 407                 hs.finishedHash.Write(skx.marshal())
 408                 if _, err := c.writeRecord(recordTypeHandshake, skx.marshal()); err != nil {
 409                         return err
 410                 }
 411         }
 412
 413         if c.config.ClientAuth >= RequestClientCert {
 414                 // Request a client certificate
 415                 certReq := new(certificateRequestMsg)
 416                 certReq.certificateTypes = []byte{
 417                         byte(certTypeRSASign),
 418                         byte(certTypeECDSASign),
 419                 }
 420                 if c.vers >= VersionTLS12 {
 421                         certReq.hasSignatureAndHash = true
 422                         certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms()
 423                 }
 424
 425                 // An empty list of certificateAuthorities signals to
 426                 // the client that it may send any certificate in response
 427                 // to our request. When we know the CAs we trust, then
 428                 // we can send them down, so that the client can choose
 429                 // an appropriate certificate to give to us.
 430                 if c.config.ClientCAs != nil {
 431                         certReq.certificateAuthorities = c.config.ClientCAs.Subjects()
 432                 }
 433                 hs.finishedHash.Write(certReq.marshal())
 434                 if _, err := c.writeRecord(recordTypeHandshake, certReq.marshal()); err != nil {
 435                         return err
 436                 }
 437         }
 438
 439         helloDone := new(serverHelloDoneMsg)
 440         hs.finishedHash.Write(helloDone.marshal())
 441         if _, err := c.writeRecord(recordTypeHandshake, helloDone.marshal()); err != nil {
 442                 return err
 443         }
 444
 445         if _, err := c.flush(); err != nil {
 446                 return err
 447         }
 448
 449         var pub crypto.PublicKey // public key for client auth, if any
 450
 451         msg, err := c.readHandshake()
 452         if err != nil {
 453                 return err
 454         }
 455
 456         var ok bool
 457         // If we requested a client certificate, then the client must send a
 458         // certificate message, even if it's empty.
 459         if c.config.ClientAuth >= RequestClientCert {
 460                 if certMsg, ok = msg.(*certificateMsg); !ok {
 461                         c.sendAlert(alertUnexpectedMessage)
 462                         return unexpectedMessageError(certMsg, msg)
 463                 }
 464                 hs.finishedHash.Write(certMsg.marshal())
 465
 466                 if len(certMsg.certificates) == 0 {
 467                         // The client didn't actually send a certificate
 468                         switch c.config.ClientAuth {
 469                         case RequireAnyClientCert, RequireAndVerifyClientCert:
 470                                 c.sendAlert(alertBadCertificate)
 471                                 return errors.New("tls: client didn't provide a certificate")
 472                         }
 473                 }
 474
 475                 pub, err = hs.processCertsFromClient(certMsg.certificates)
 476                 if err != nil {
 477                         return err
 478                 }
 479
 480                 msg, err = c.readHandshake()
 481                 if err != nil {
 482                         return err
 483                 }
 484         }
 485
 486         // Get client key exchange
 487         ckx, ok := msg.(*clientKeyExchangeMsg)
 488         if !ok {
 489                 c.sendAlert(alertUnexpectedMessage)
 490                 return unexpectedMessageError(ckx, msg)
 491         }
 492         hs.finishedHash.Write(ckx.marshal())
 493
 494         preMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers)
 495         if err != nil {
 496                 c.sendAlert(alertHandshakeFailure)
 497                 return err
 498         }
 499         hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.clientHello.random, hs.hello.random)
 500         if err := c.config.writeKeyLog(hs.clientHello.random, hs.masterSecret); err != nil {
 501                 c.sendAlert(alertInternalError)
 502                 return err
 503         }
 504
 505         // If we received a client cert in response to our certificate request message,
 506         // the client will send us a certificateVerifyMsg immediately after the
 507         // clientKeyExchangeMsg. This message is a digest of all preceding
 508         // handshake-layer messages that is signed using the private key corresponding
 509         // to the client's certificate. This allows us to verify that the client is in
 510         // possession of the private key of the certificate.
 511         if len(c.peerCertificates) > 0 {
 512                 msg, err = c.readHandshake()
 513                 if err != nil {
 514                         return err
 515                 }
 516                 certVerify, ok := msg.(*certificateVerifyMsg)
 517                 if !ok {
 518                         c.sendAlert(alertUnexpectedMessage)
 519                         return unexpectedMessageError(certVerify, msg)
 520                 }
 521
 522                 // Determine the signature type.
 523                 var signatureAlgorithm SignatureScheme
 524                 var sigType uint8
 525                 if certVerify.hasSignatureAndHash {
 526                         signatureAlgorithm = certVerify.signatureAlgorithm
 527                         if !isSupportedSignatureAlgorithm(signatureAlgorithm, supportedSignatureAlgorithms()) {
 528                                 return errors.New("tls: unsupported hash function for client certificate")
 529                         }
 530                         sigType = signatureFromSignatureScheme(signatureAlgorithm)
 531                 } else {
 532                         // Before TLS 1.2 the signature algorithm was implicit
 533                         // from the key type, and only one hash per signature
 534                         // algorithm was possible. Leave signatureAlgorithm
 535                         // unset.
 536                         switch pub.(type) {
 537                         case *ecdsa.PublicKey:
 538                                 sigType = signatureECDSA
 539                         case *rsa.PublicKey:
 540                                 sigType = signatureRSA
 541                         }
 542                 }
 543
 544                 switch key := pub.(type) {
 545                 case *ecdsa.PublicKey:
 546                         if sigType != signatureECDSA {
 547                                 err = errors.New("tls: bad signature type for client's ECDSA certificate")
 548                                 break
 549                         }
 550                         ecdsaSig := new(ecdsaSignature)
 551                         if _, err = asn1.Unmarshal(certVerify.signature, ecdsaSig); err != nil {
 552                                 break
 553                         }
 554                         if ecdsaSig.R.Sign() <= 0 || ecdsaSig.S.Sign() <= 0 {
 555                                 err = errors.New("tls: ECDSA signature contained zero or negative values")
 556                                 break
 557                         }
 558                         var digest []byte
 559                         if digest, _, err = hs.finishedHash.hashForClientCertificate(sigType, signatureAlgorithm, hs.masterSecret); err != nil {
 560                                 break
 561                         }
 562                         if !ecdsa.Verify(key, digest, ecdsaSig.R, ecdsaSig.S) {
 563                                 err = errors.New("tls: ECDSA verification failure")
 564                         }
 565                 case *rsa.PublicKey:
 566                         if sigType != signatureRSA {
 567                                 err = errors.New("tls: bad signature type for client's RSA certificate")
 568                                 break
 569                         }
 570                         var digest []byte
 571                         var hashFunc crypto.Hash
 572                         if digest, hashFunc, err = hs.finishedHash.hashForClientCertificate(sigType, signatureAlgorithm, hs.masterSecret); err != nil {
 573                                 break
 574                         }
 575                         err = rsa.VerifyPKCS1v15(key, hashFunc, digest, certVerify.signature)
 576                 }
 577                 if err != nil {
 578                         c.sendAlert(alertBadCertificate)
 579                         return errors.New("tls: could not validate signature of connection nonces: " + err.Error())
 580                 }
 581
 582                 hs.finishedHash.Write(certVerify.marshal())
 583         }
 584
 585         hs.finishedHash.discardHandshakeBuffer()
 586
 587         return nil
 588 }
 589
 590 func (hs *serverHandshakeState) establishKeys() error {
 591         c := hs.c
 592
 593         clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
 594                 keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
 595
 596         var clientCipher, serverCipher interface{}
 597         var clientHash, serverHash macFunction
 598
 599         if hs.suite.aead == nil {
 600                 clientCipher = hs.suite.cipher(clientKey, clientIV, true /* for reading */)
 601                 clientHash = hs.suite.mac(c.vers, clientMAC)
 602                 serverCipher = hs.suite.cipher(serverKey, serverIV, false /* not for reading */)
 603                 serverHash = hs.suite.mac(c.vers, serverMAC)
 604         } else {
 605                 clientCipher = hs.suite.aead(clientKey, clientIV)
 606                 serverCipher = hs.suite.aead(serverKey, serverIV)
 607         }
 608
 609         c.in.prepareCipherSpec(c.vers, clientCipher, clientHash)
 610         c.out.prepareCipherSpec(c.vers, serverCipher, serverHash)
 611
 612         return nil
 613 }
 614
 615 func (hs *serverHandshakeState) readFinished(out []byte) error {
 616         c := hs.c
 617
 618         c.readRecord(recordTypeChangeCipherSpec)
 619         if c.in.err != nil {
 620                 return c.in.err
 621         }
 622
 623         if hs.hello.nextProtoNeg {
 624                 msg, err := c.readHandshake()
 625                 if err != nil {
 626                         return err
 627                 }
 628                 nextProto, ok := msg.(*nextProtoMsg)
 629                 if !ok {
 630                         c.sendAlert(alertUnexpectedMessage)
 631                         return unexpectedMessageError(nextProto, msg)
 632                 }
 633                 hs.finishedHash.Write(nextProto.marshal())
 634                 c.clientProtocol = nextProto.proto
 635         }
 636
 637         msg, err := c.readHandshake()
 638         if err != nil {
 639                 return err
 640         }
 641         clientFinished, ok := msg.(*finishedMsg)
 642         if !ok {
 643                 c.sendAlert(alertUnexpectedMessage)
 644                 return unexpectedMessageError(clientFinished, msg)
 645         }
 646
 647         verify := hs.finishedHash.clientSum(hs.masterSecret)
 648         if len(verify) != len(clientFinished.verifyData) ||
 649                 subtle.ConstantTimeCompare(verify, clientFinished.verifyData) != 1 {
 650                 c.sendAlert(alertHandshakeFailure)
 651                 return errors.New("tls: client's Finished message is incorrect")
 652         }
 653
 654         hs.finishedHash.Write(clientFinished.marshal())
 655         copy(out, verify)
 656         return nil
 657 }
 658
 659 func (hs *serverHandshakeState) sendSessionTicket() error {
 660         if !hs.hello.ticketSupported {
 661                 return nil
 662         }
 663
 664         c := hs.c
 665         m := new(newSessionTicketMsg)
 666
 667         var err error
 668         state := sessionState{
 669                 vers:         c.vers,
 670                 cipherSuite:  hs.suite.id,
 671                 masterSecret: hs.masterSecret,
 672                 certificates: hs.certsFromClient,
 673         }
 674         m.ticket, err = c.encryptTicket(&state)
 675         if err != nil {
 676                 return err
 677         }
 678
 679         hs.finishedHash.Write(m.marshal())
 680         if _, err := c.writeRecord(recordTypeHandshake, m.marshal()); err != nil {
 681                 return err
 682         }
 683
 684         return nil
 685 }
 686
 687 func (hs *serverHandshakeState) sendFinished(out []byte) error {
 688         c := hs.c
 689
 690         if _, err := c.writeRecord(recordTypeChangeCipherSpec, []byte{1}); err != nil {
 691                 return err
 692         }
 693
 694         finished := new(finishedMsg)
 695         finished.verifyData = hs.finishedHash.serverSum(hs.masterSecret)
 696         hs.finishedHash.Write(finished.marshal())
 697         if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil {
 698                 return err
 699         }
 700
 701         c.cipherSuite = hs.suite.id
 702         copy(out, finished.verifyData)
 703
 704         return nil
 705 }
 706
 707 // processCertsFromClient takes a chain of client certificates either from a
 708 // Certificates message or from a sessionState and verifies them. It returns
 709 // the public key of the leaf certificate.
 710 func (hs *serverHandshakeState) processCertsFromClient(certificates [][]byte) (crypto.PublicKey, error) {
 711         c := hs.c
 712
 713         hs.certsFromClient = certificates
 714         certs := make([]*x509.Certificate, len(certificates))
 715         var err error
 716         for i, asn1Data := range certificates {
 717                 if certs[i], err = x509.ParseCertificate(asn1Data); err != nil {
 718                         c.sendAlert(alertBadCertificate)
 719                         return nil, errors.New("tls: failed to parse client certificate: " + err.Error())
 720                 }
 721         }
 722
 723         if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
 724                 opts := x509.VerifyOptions{
 725                         IsBoring: isBoringCertificate,
 726
 727                         Roots:         c.config.ClientCAs,
 728                         CurrentTime:   c.config.time(),
 729                         Intermediates: x509.NewCertPool(),
 730                         KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 731                 }
 732
 733                 for _, cert := range certs[1:] {
 734                         opts.Intermediates.AddCert(cert)
 735                 }
 736
 737                 chains, err := certs[0].Verify(opts)
 738                 if err != nil {
 739                         c.sendAlert(alertBadCertificate)
 740                         return nil, errors.New("tls: failed to verify client's certificate: " + err.Error())
 741                 }
 742
 743                 c.verifiedChains = chains
 744         }
 745
 746         if c.config.VerifyPeerCertificate != nil {
 747                 if err := c.config.VerifyPeerCertificate(certificates, c.verifiedChains); err != nil {
 748                         c.sendAlert(alertBadCertificate)
 749                         return nil, err
 750                 }
 751         }
 752
 753         if len(certs) == 0 {
 754                 return nil, nil
 755         }
 756
 757         var pub crypto.PublicKey
 758         switch key := certs[0].PublicKey.(type) {
 759         case *ecdsa.PublicKey, *rsa.PublicKey:
 760                 pub = key
 761         default:
 762                 c.sendAlert(alertUnsupportedCertificate)
 763                 return nil, fmt.Errorf("tls: client's certificate contains an unsupported public key of type %T", certs[0].PublicKey)
 764         }
 765         c.peerCertificates = certs
 766         return pub, nil
 767 }
 768
 769 // setCipherSuite sets a cipherSuite with the given id as the serverHandshakeState
 770 // suite if that cipher suite is acceptable to use.
 771 // It returns a bool indicating if the suite was set.
 772 func (hs *serverHandshakeState) setCipherSuite(id uint16, supportedCipherSuites []uint16, version uint16) bool {
 773         for _, supported := range supportedCipherSuites {
 774                 if id == supported {
 775                         var candidate *cipherSuite
 776
 777                         for _, s := range cipherSuites {
 778                                 if s.id == id {
 779                                         candidate = s
 780                                         break
 781                                 }
 782                         }
 783                         if candidate == nil {
 784                                 continue
 785                         }
 786                         // Don't select a ciphersuite which we can't
 787                         // support for this client.
 788                         if candidate.flags&suiteECDHE != 0 {
 789                                 if !hs.ellipticOk {
 790                                         continue
 791                                 }
 792                                 if candidate.flags&suiteECDSA != 0 {
 793                                         if !hs.ecdsaOk {
 794                                                 continue
 795                                         }
 796                                 } else if !hs.rsaSignOk {
 797                                         continue
 798                                 }
 799                         } else if !hs.rsaDecryptOk {
 800                                 continue
 801                         }
 802                         if version < VersionTLS12 && candidate.flags&suiteTLS12 != 0 {
 803                                 continue
 804                         }
 805                         hs.suite = candidate
 806                         return true
 807                 }
 808         }
 809         return false
 810 }
 811
 812 // suppVersArray is the backing array of ClientHelloInfo.SupportedVersions
 813 var suppVersArray = [...]uint16{VersionTLS12, VersionTLS11, VersionTLS10, VersionSSL30}
 814
 815 func (hs *serverHandshakeState) clientHelloInfo() *ClientHelloInfo {
 816         if hs.cachedClientHelloInfo != nil {
 817                 return hs.cachedClientHelloInfo
 818         }
 819
 820         var supportedVersions []uint16
 821         if hs.clientHello.vers > VersionTLS12 {
 822                 supportedVersions = suppVersArray[:]
 823         } else if hs.clientHello.vers >= VersionSSL30 {
 824                 supportedVersions = suppVersArray[VersionTLS12-hs.clientHello.vers:]
 825         }
 826
 827         hs.cachedClientHelloInfo = &ClientHelloInfo{
 828                 CipherSuites:      hs.clientHello.cipherSuites,
 829                 ServerName:        hs.clientHello.serverName,
 830                 SupportedCurves:   hs.clientHello.supportedCurves,
 831                 SupportedPoints:   hs.clientHello.supportedPoints,
 832                 SignatureSchemes:  hs.clientHello.supportedSignatureAlgorithms,
 833                 SupportedProtos:   hs.clientHello.alpnProtocols,
 834                 SupportedVersions: supportedVersions,
 835                 Conn:              hs.c.conn,
 836         }
 837
 838         return hs.cachedClientHelloInfo
 839 }