src/crypto/tls/handshake_server.go

   1 // Copyright 2009 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 package tls
   6
   7 import (
   8         "context"
   9         "crypto"
  10         "crypto/ecdsa"
  11         "crypto/ed25519"
  12         "crypto/rsa"
  13         "crypto/subtle"
  14         "crypto/x509"
  15         "errors"
  16         "fmt"
  17         "hash"
  18         "io"
  19         "time"
  20 )
  21
  22 // serverHandshakeState contains details of a server handshake in progress.
  23 // It's discarded once the handshake has completed.
  24 type serverHandshakeState struct {
  25         c            *Conn
  26         ctx          context.Context
  27         clientHello  *clientHelloMsg
  28         hello        *serverHelloMsg
  29         suite        *cipherSuite
  30         ecdheOk      bool
  31         ecSignOk     bool
  32         rsaDecryptOk bool
  33         rsaSignOk    bool
  34         sessionState *SessionState
  35         finishedHash finishedHash
  36         masterSecret []byte
  37         cert         *Certificate
  38 }
  39
  40 // serverHandshake performs a TLS handshake as a server.
  41 func (c *Conn) serverHandshake(ctx context.Context) error {
  42         clientHello, err := c.readClientHello(ctx)
  43         if err != nil {
  44                 return err
  45         }
  46
  47         if c.vers == VersionTLS13 {
  48                 hs := serverHandshakeStateTLS13{
  49                         c:           c,
  50                         ctx:         ctx,
  51                         clientHello: clientHello,
  52                 }
  53                 return hs.handshake()
  54         }
  55
  56         hs := serverHandshakeState{
  57                 c:           c,
  58                 ctx:         ctx,
  59                 clientHello: clientHello,
  60         }
  61         return hs.handshake()
  62 }
  63
  64 func (hs *serverHandshakeState) handshake() error {
  65         c := hs.c
  66
  67         if err := hs.processClientHello(); err != nil {
  68                 return err
  69         }
  70
  71         // For an overview of TLS handshaking, see RFC 5246, Section 7.3.
  72         c.buffering = true
  73         if err := hs.checkForResumption(); err != nil {
  74                 return err
  75         }
  76         if hs.sessionState != nil {
  77                 // The client has included a session ticket and so we do an abbreviated handshake.
  78                 if err := hs.doResumeHandshake(); err != nil {
  79                         return err
  80                 }
  81                 if err := hs.establishKeys(); err != nil {
  82                         return err
  83                 }
  84                 if err := hs.sendSessionTicket(); err != nil {
  85                         return err
  86                 }
  87                 if err := hs.sendFinished(c.serverFinished[:]); err != nil {
  88                         return err
  89                 }
  90                 if _, err := c.flush(); err != nil {
  91                         return err
  92                 }
  93                 c.clientFinishedIsFirst = false
  94                 if err := hs.readFinished(nil); err != nil {
  95                         return err
  96                 }
  97         } else {
  98                 // The client didn't include a session ticket, or it wasn't
  99                 // valid so we do a full handshake.
 100                 if err := hs.pickCipherSuite(); err != nil {
 101                         return err
 102                 }
 103                 if err := hs.doFullHandshake(); err != nil {
 104                         return err
 105                 }
 106                 if err := hs.establishKeys(); err != nil {
 107                         return err
 108                 }
 109                 if err := hs.readFinished(c.clientFinished[:]); err != nil {
 110                         return err
 111                 }
 112                 c.clientFinishedIsFirst = true
 113                 c.buffering = true
 114                 if err := hs.sendSessionTicket(); err != nil {
 115                         return err
 116                 }
 117                 if err := hs.sendFinished(nil); err != nil {
 118                         return err
 119                 }
 120                 if _, err := c.flush(); err != nil {
 121                         return err
 122                 }
 123         }
 124
 125         c.ekm = ekmFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random)
 126         c.isHandshakeComplete.Store(true)
 127
 128         return nil
 129 }
 130
 131 // readClientHello reads a ClientHello message and selects the protocol version.
 132 func (c *Conn) readClientHello(ctx context.Context) (*clientHelloMsg, error) {
 133         // clientHelloMsg is included in the transcript, but we haven't initialized
 134         // it yet. The respective handshake functions will record it themselves.
 135         msg, err := c.readHandshake(nil)
 136         if err != nil {
 137                 return nil, err
 138         }
 139         clientHello, ok := msg.(*clientHelloMsg)
 140         if !ok {
 141                 c.sendAlert(alertUnexpectedMessage)
 142                 return nil, unexpectedMessageError(clientHello, msg)
 143         }
 144
 145         var configForClient *Config
 146         originalConfig := c.config
 147         if c.config.GetConfigForClient != nil {
 148                 chi := clientHelloInfo(ctx, c, clientHello)
 149                 if configForClient, err = c.config.GetConfigForClient(chi); err != nil {
 150                         c.sendAlert(alertInternalError)
 151                         return nil, err
 152                 } else if configForClient != nil {
 153                         c.config = configForClient
 154                 }
 155         }
 156         c.ticketKeys = originalConfig.ticketKeys(configForClient)
 157
 158         clientVersions := clientHello.supportedVersions
 159         if len(clientHello.supportedVersions) == 0 {
 160                 clientVersions = supportedVersionsFromMax(clientHello.vers)
 161         }
 162         c.vers, ok = c.config.mutualVersion(roleServer, clientVersions)
 163         if !ok {
 164                 c.sendAlert(alertProtocolVersion)
 165                 return nil, fmt.Errorf("tls: client offered only unsupported versions: %x", clientVersions)
 166         }
 167         c.haveVers = true
 168         c.in.version = c.vers
 169         c.out.version = c.vers
 170
 171         return clientHello, nil
 172 }
 173
 174 func (hs *serverHandshakeState) processClientHello() error {
 175         c := hs.c
 176
 177         hs.hello = new(serverHelloMsg)
 178         hs.hello.vers = c.vers
 179
 180         foundCompression := false
 181         // We only support null compression, so check that the client offered it.
 182         for _, compression := range hs.clientHello.compressionMethods {
 183                 if compression == compressionNone {
 184                         foundCompression = true
 185                         break
 186                 }
 187         }
 188
 189         if !foundCompression {
 190                 c.sendAlert(alertHandshakeFailure)
 191                 return errors.New("tls: client does not support uncompressed connections")
 192         }
 193
 194         hs.hello.random = make([]byte, 32)
 195         serverRandom := hs.hello.random
 196         // Downgrade protection canaries. See RFC 8446, Section 4.1.3.
 197         maxVers := c.config.maxSupportedVersion(roleServer)
 198         if maxVers >= VersionTLS12 && c.vers < maxVers || testingOnlyForceDowngradeCanary {
 199                 if c.vers == VersionTLS12 {
 200                         copy(serverRandom[24:], downgradeCanaryTLS12)
 201                 } else {
 202                         copy(serverRandom[24:], downgradeCanaryTLS11)
 203                 }
 204                 serverRandom = serverRandom[:24]
 205         }
 206         _, err := io.ReadFull(c.config.rand(), serverRandom)
 207         if err != nil {
 208                 c.sendAlert(alertInternalError)
 209                 return err
 210         }
 211
 212         if len(hs.clientHello.secureRenegotiation) != 0 {
 213                 c.sendAlert(alertHandshakeFailure)
 214                 return errors.New("tls: initial handshake had non-empty renegotiation extension")
 215         }
 216
 217         hs.hello.extendedMasterSecret = hs.clientHello.extendedMasterSecret
 218         hs.hello.secureRenegotiationSupported = hs.clientHello.secureRenegotiationSupported
 219         hs.hello.compressionMethod = compressionNone
 220         if len(hs.clientHello.serverName) > 0 {
 221                 c.serverName = hs.clientHello.serverName
 222         }
 223
 224         selectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols, false)
 225         if err != nil {
 226                 c.sendAlert(alertNoApplicationProtocol)
 227                 return err
 228         }
 229         hs.hello.alpnProtocol = selectedProto
 230         c.clientProtocol = selectedProto
 231
 232         hs.cert, err = c.config.getCertificate(clientHelloInfo(hs.ctx, c, hs.clientHello))
 233         if err != nil {
 234                 if err == errNoCertificates {
 235                         c.sendAlert(alertUnrecognizedName)
 236                 } else {
 237                         c.sendAlert(alertInternalError)
 238                 }
 239                 return err
 240         }
 241         if hs.clientHello.scts {
 242                 hs.hello.scts = hs.cert.SignedCertificateTimestamps
 243         }
 244
 245         hs.ecdheOk = supportsECDHE(c.config, hs.clientHello.supportedCurves, hs.clientHello.supportedPoints)
 246
 247         if hs.ecdheOk && len(hs.clientHello.supportedPoints) > 0 {
 248                 // Although omitting the ec_point_formats extension is permitted, some
 249                 // old OpenSSL version will refuse to handshake if not present.
 250                 //
 251                 // Per RFC 4492, section 5.1.2, implementations MUST support the
 252                 // uncompressed point format. See golang.org/issue/31943.
 253                 hs.hello.supportedPoints = []uint8{pointFormatUncompressed}
 254         }
 255
 256         if priv, ok := hs.cert.PrivateKey.(crypto.Signer); ok {
 257                 switch priv.Public().(type) {
 258                 case *ecdsa.PublicKey:
 259                         hs.ecSignOk = true
 260                 case ed25519.PublicKey:
 261                         hs.ecSignOk = true
 262                 case *rsa.PublicKey:
 263                         hs.rsaSignOk = true
 264                 default:
 265                         c.sendAlert(alertInternalError)
 266                         return fmt.Errorf("tls: unsupported signing key type (%T)", priv.Public())
 267                 }
 268         }
 269         if priv, ok := hs.cert.PrivateKey.(crypto.Decrypter); ok {
 270                 switch priv.Public().(type) {
 271                 case *rsa.PublicKey:
 272                         hs.rsaDecryptOk = true
 273                 default:
 274                         c.sendAlert(alertInternalError)
 275                         return fmt.Errorf("tls: unsupported decryption key type (%T)", priv.Public())
 276                 }
 277         }
 278
 279         return nil
 280 }
 281
 282 // negotiateALPN picks a shared ALPN protocol that both sides support in server
 283 // preference order. If ALPN is not configured or the peer doesn't support it,
 284 // it returns "" and no error.
 285 func negotiateALPN(serverProtos, clientProtos []string, quic bool) (string, error) {
 286         if len(serverProtos) == 0 || len(clientProtos) == 0 {
 287                 if quic && len(serverProtos) != 0 {
 288                         // RFC 9001, Section 8.1
 289                         return "", fmt.Errorf("tls: client did not request an application protocol")
 290                 }
 291                 return "", nil
 292         }
 293         var http11fallback bool
 294         for _, s := range serverProtos {
 295                 for _, c := range clientProtos {
 296                         if s == c {
 297                                 return s, nil
 298                         }
 299                         if s == "h2" && c == "http/1.1" {
 300                                 http11fallback = true
 301                         }
 302                 }
 303         }
 304         // As a special case, let http/1.1 clients connect to h2 servers as if they
 305         // didn't support ALPN. We used not to enforce protocol overlap, so over
 306         // time a number of HTTP servers were configured with only "h2", but
 307         // expected to accept connections from "http/1.1" clients. See Issue 46310.
 308         if http11fallback {
 309                 return "", nil
 310         }
 311         return "", fmt.Errorf("tls: client requested unsupported application protocols (%s)", clientProtos)
 312 }
 313
 314 // supportsECDHE returns whether ECDHE key exchanges can be used with this
 315 // pre-TLS 1.3 client.
 316 func supportsECDHE(c *Config, supportedCurves []CurveID, supportedPoints []uint8) bool {
 317         supportsCurve := false
 318         for _, curve := range supportedCurves {
 319                 if c.supportsCurve(curve) {
 320                         supportsCurve = true
 321                         break
 322                 }
 323         }
 324
 325         supportsPointFormat := false
 326         for _, pointFormat := range supportedPoints {
 327                 if pointFormat == pointFormatUncompressed {
 328                         supportsPointFormat = true
 329                         break
 330                 }
 331         }
 332         // Per RFC 8422, Section 5.1.2, if the Supported Point Formats extension is
 333         // missing, uncompressed points are supported. If supportedPoints is empty,
 334         // the extension must be missing, as an empty extension body is rejected by
 335         // the parser. See https://go.dev/issue/49126.
 336         if len(supportedPoints) == 0 {
 337                 supportsPointFormat = true
 338         }
 339
 340         return supportsCurve && supportsPointFormat
 341 }
 342
 343 func (hs *serverHandshakeState) pickCipherSuite() error {
 344         c := hs.c
 345
 346         preferenceOrder := cipherSuitesPreferenceOrder
 347         if !hasAESGCMHardwareSupport || !aesgcmPreferred(hs.clientHello.cipherSuites) {
 348                 preferenceOrder = cipherSuitesPreferenceOrderNoAES
 349         }
 350
 351         configCipherSuites := c.config.cipherSuites()
 352         preferenceList := make([]uint16, 0, len(configCipherSuites))
 353         for _, suiteID := range preferenceOrder {
 354                 for _, id := range configCipherSuites {
 355                         if id == suiteID {
 356                                 preferenceList = append(preferenceList, id)
 357                                 break
 358                         }
 359                 }
 360         }
 361
 362         hs.suite = selectCipherSuite(preferenceList, hs.clientHello.cipherSuites, hs.cipherSuiteOk)
 363         if hs.suite == nil {
 364                 c.sendAlert(alertHandshakeFailure)
 365                 return errors.New("tls: no cipher suite supported by both client and server")
 366         }
 367         c.cipherSuite = hs.suite.id
 368
 369         for _, id := range hs.clientHello.cipherSuites {
 370                 if id == TLS_FALLBACK_SCSV {
 371                         // The client is doing a fallback connection. See RFC 7507.
 372                         if hs.clientHello.vers < c.config.maxSupportedVersion(roleServer) {
 373                                 c.sendAlert(alertInappropriateFallback)
 374                                 return errors.New("tls: client using inappropriate protocol fallback")
 375                         }
 376                         break
 377                 }
 378         }
 379
 380         return nil
 381 }
 382
 383 func (hs *serverHandshakeState) cipherSuiteOk(c *cipherSuite) bool {
 384         if c.flags&suiteECDHE != 0 {
 385                 if !hs.ecdheOk {
 386                         return false
 387                 }
 388                 if c.flags&suiteECSign != 0 {
 389                         if !hs.ecSignOk {
 390                                 return false
 391                         }
 392                 } else if !hs.rsaSignOk {
 393                         return false
 394                 }
 395         } else if !hs.rsaDecryptOk {
 396                 return false
 397         }
 398         if hs.c.vers < VersionTLS12 && c.flags&suiteTLS12 != 0 {
 399                 return false
 400         }
 401         return true
 402 }
 403
 404 // checkForResumption reports whether we should perform resumption on this connection.
 405 func (hs *serverHandshakeState) checkForResumption() error {
 406         c := hs.c
 407
 408         if c.config.SessionTicketsDisabled {
 409                 return nil
 410         }
 411
 412         var sessionState *SessionState
 413         if c.config.UnwrapSession != nil {
 414                 ss, err := c.config.UnwrapSession(hs.clientHello.sessionTicket, c.connectionStateLocked())
 415                 if err != nil {
 416                         return err
 417                 }
 418                 if ss == nil {
 419                         return nil
 420                 }
 421                 sessionState = ss
 422         } else {
 423                 plaintext := c.config.decryptTicket(hs.clientHello.sessionTicket, c.ticketKeys)
 424                 if plaintext == nil {
 425                         return nil
 426                 }
 427                 ss, err := ParseSessionState(plaintext)
 428                 if err != nil {
 429                         return nil
 430                 }
 431                 sessionState = ss
 432         }
 433
 434         // TLS 1.2 tickets don't natively have a lifetime, but we want to avoid
 435         // re-wrapping the same master secret in different tickets over and over for
 436         // too long, weakening forward secrecy.
 437         createdAt := time.Unix(int64(sessionState.createdAt), 0)
 438         if c.config.time().Sub(createdAt) > maxSessionTicketLifetime {
 439                 return nil
 440         }
 441
 442         // Never resume a session for a different TLS version.
 443         if c.vers != sessionState.version {
 444                 return nil
 445         }
 446
 447         cipherSuiteOk := false
 448         // Check that the client is still offering the ciphersuite in the session.
 449         for _, id := range hs.clientHello.cipherSuites {
 450                 if id == sessionState.cipherSuite {
 451                         cipherSuiteOk = true
 452                         break
 453                 }
 454         }
 455         if !cipherSuiteOk {
 456                 return nil
 457         }
 458
 459         // Check that we also support the ciphersuite from the session.
 460         suite := selectCipherSuite([]uint16{sessionState.cipherSuite},
 461                 c.config.cipherSuites(), hs.cipherSuiteOk)
 462         if suite == nil {
 463                 return nil
 464         }
 465
 466         sessionHasClientCerts := len(sessionState.peerCertificates) != 0
 467         needClientCerts := requiresClientCert(c.config.ClientAuth)
 468         if needClientCerts && !sessionHasClientCerts {
 469                 return nil
 470         }
 471         if sessionHasClientCerts && c.config.ClientAuth == NoClientCert {
 472                 return nil
 473         }
 474
 475         // RFC 7627, Section 5.3
 476         if !sessionState.extMasterSecret && hs.clientHello.extendedMasterSecret {
 477                 return nil
 478         }
 479         if sessionState.extMasterSecret && !hs.clientHello.extendedMasterSecret {
 480                 // Aborting is somewhat harsh, but it's a MUST and it would indicate a
 481                 // weird downgrade in client capabilities.
 482                 return errors.New("tls: session supported extended_master_secret but client does not")
 483         }
 484
 485         c.extMasterSecret = sessionState.extMasterSecret
 486         hs.sessionState = sessionState
 487         hs.suite = suite
 488         c.didResume = true
 489         return nil
 490 }
 491
 492 func (hs *serverHandshakeState) doResumeHandshake() error {
 493         c := hs.c
 494
 495         hs.hello.cipherSuite = hs.suite.id
 496         c.cipherSuite = hs.suite.id
 497         // We echo the client's session ID in the ServerHello to let it know
 498         // that we're doing a resumption.
 499         hs.hello.sessionId = hs.clientHello.sessionId
 500         // We always send a new session ticket, even if it wraps the same master
 501         // secret and it's potentially encrypted with the same key, to help the
 502         // client avoid cross-connection tracking from a network observer.
 503         hs.hello.ticketSupported = true
 504         hs.finishedHash = newFinishedHash(c.vers, hs.suite)
 505         hs.finishedHash.discardHandshakeBuffer()
 506         if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
 507                 return err
 508         }
 509         if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
 510                 return err
 511         }
 512
 513         if err := c.processCertsFromClient(hs.sessionState.certificate()); err != nil {
 514                 return err
 515         }
 516
 517         if c.config.VerifyConnection != nil {
 518                 if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
 519                         c.sendAlert(alertBadCertificate)
 520                         return err
 521                 }
 522         }
 523
 524         hs.masterSecret = hs.sessionState.secret
 525
 526         return nil
 527 }
 528
 529 func (hs *serverHandshakeState) doFullHandshake() error {
 530         c := hs.c
 531
 532         if hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 {
 533                 hs.hello.ocspStapling = true
 534         }
 535
 536         hs.hello.ticketSupported = hs.clientHello.ticketSupported && !c.config.SessionTicketsDisabled
 537         hs.hello.cipherSuite = hs.suite.id
 538
 539         hs.finishedHash = newFinishedHash(hs.c.vers, hs.suite)
 540         if c.config.ClientAuth == NoClientCert {
 541                 // No need to keep a full record of the handshake if client
 542                 // certificates won't be used.
 543                 hs.finishedHash.discardHandshakeBuffer()
 544         }
 545         if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
 546                 return err
 547         }
 548         if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
 549                 return err
 550         }
 551
 552         certMsg := new(certificateMsg)
 553         certMsg.certificates = hs.cert.Certificate
 554         if _, err := hs.c.writeHandshakeRecord(certMsg, &hs.finishedHash); err != nil {
 555                 return err
 556         }
 557
 558         if hs.hello.ocspStapling {
 559                 certStatus := new(certificateStatusMsg)
 560                 certStatus.response = hs.cert.OCSPStaple
 561                 if _, err := hs.c.writeHandshakeRecord(certStatus, &hs.finishedHash); err != nil {
 562                         return err
 563                 }
 564         }
 565
 566         keyAgreement := hs.suite.ka(c.vers)
 567         skx, err := keyAgreement.generateServerKeyExchange(c.config, hs.cert, hs.clientHello, hs.hello)
 568         if err != nil {
 569                 c.sendAlert(alertHandshakeFailure)
 570                 return err
 571         }
 572         if skx != nil {
 573                 if _, err := hs.c.writeHandshakeRecord(skx, &hs.finishedHash); err != nil {
 574                         return err
 575                 }
 576         }
 577
 578         var certReq *certificateRequestMsg
 579         if c.config.ClientAuth >= RequestClientCert {
 580                 // Request a client certificate
 581                 certReq = new(certificateRequestMsg)
 582                 certReq.certificateTypes = []byte{
 583                         byte(certTypeRSASign),
 584                         byte(certTypeECDSASign),
 585                 }
 586                 if c.vers >= VersionTLS12 {
 587                         certReq.hasSignatureAlgorithm = true
 588                         certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms()
 589                 }
 590
 591                 // An empty list of certificateAuthorities signals to
 592                 // the client that it may send any certificate in response
 593                 // to our request. When we know the CAs we trust, then
 594                 // we can send them down, so that the client can choose
 595                 // an appropriate certificate to give to us.
 596                 if c.config.ClientCAs != nil {
 597                         certReq.certificateAuthorities = c.config.ClientCAs.Subjects()
 598                 }
 599                 if _, err := hs.c.writeHandshakeRecord(certReq, &hs.finishedHash); err != nil {
 600                         return err
 601                 }
 602         }
 603
 604         helloDone := new(serverHelloDoneMsg)
 605         if _, err := hs.c.writeHandshakeRecord(helloDone, &hs.finishedHash); err != nil {
 606                 return err
 607         }
 608
 609         if _, err := c.flush(); err != nil {
 610                 return err
 611         }
 612
 613         var pub crypto.PublicKey // public key for client auth, if any
 614
 615         msg, err := c.readHandshake(&hs.finishedHash)
 616         if err != nil {
 617                 return err
 618         }
 619
 620         // If we requested a client certificate, then the client must send a
 621         // certificate message, even if it's empty.
 622         if c.config.ClientAuth >= RequestClientCert {
 623                 certMsg, ok := msg.(*certificateMsg)
 624                 if !ok {
 625                         c.sendAlert(alertUnexpectedMessage)
 626                         return unexpectedMessageError(certMsg, msg)
 627                 }
 628
 629                 if err := c.processCertsFromClient(Certificate{
 630                         Certificate: certMsg.certificates,
 631                 }); err != nil {
 632                         return err
 633                 }
 634                 if len(certMsg.certificates) != 0 {
 635                         pub = c.peerCertificates[0].PublicKey
 636                 }
 637
 638                 msg, err = c.readHandshake(&hs.finishedHash)
 639                 if err != nil {
 640                         return err
 641                 }
 642         }
 643         if c.config.VerifyConnection != nil {
 644                 if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
 645                         c.sendAlert(alertBadCertificate)
 646                         return err
 647                 }
 648         }
 649
 650         // Get client key exchange
 651         ckx, ok := msg.(*clientKeyExchangeMsg)
 652         if !ok {
 653                 c.sendAlert(alertUnexpectedMessage)
 654                 return unexpectedMessageError(ckx, msg)
 655         }
 656
 657         preMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers)
 658         if err != nil {
 659                 c.sendAlert(alertHandshakeFailure)
 660                 return err
 661         }
 662         if hs.hello.extendedMasterSecret {
 663                 c.extMasterSecret = true
 664                 hs.masterSecret = extMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
 665                         hs.finishedHash.Sum())
 666         } else {
 667                 hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
 668                         hs.clientHello.random, hs.hello.random)
 669         }
 670         if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.clientHello.random, hs.masterSecret); err != nil {
 671                 c.sendAlert(alertInternalError)
 672                 return err
 673         }
 674
 675         // If we received a client cert in response to our certificate request message,
 676         // the client will send us a certificateVerifyMsg immediately after the
 677         // clientKeyExchangeMsg. This message is a digest of all preceding
 678         // handshake-layer messages that is signed using the private key corresponding
 679         // to the client's certificate. This allows us to verify that the client is in
 680         // possession of the private key of the certificate.
 681         if len(c.peerCertificates) > 0 {
 682                 // certificateVerifyMsg is included in the transcript, but not until
 683                 // after we verify the handshake signature, since the state before
 684                 // this message was sent is used.
 685                 msg, err = c.readHandshake(nil)
 686                 if err != nil {
 687                         return err
 688                 }
 689                 certVerify, ok := msg.(*certificateVerifyMsg)
 690                 if !ok {
 691                         c.sendAlert(alertUnexpectedMessage)
 692                         return unexpectedMessageError(certVerify, msg)
 693                 }
 694
 695                 var sigType uint8
 696                 var sigHash crypto.Hash
 697                 if c.vers >= VersionTLS12 {
 698                         if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, certReq.supportedSignatureAlgorithms) {
 699                                 c.sendAlert(alertIllegalParameter)
 700                                 return errors.New("tls: client certificate used with invalid signature algorithm")
 701                         }
 702                         sigType, sigHash, err = typeAndHashFromSignatureScheme(certVerify.signatureAlgorithm)
 703                         if err != nil {
 704                                 return c.sendAlert(alertInternalError)
 705                         }
 706                 } else {
 707                         sigType, sigHash, err = legacyTypeAndHashFromPublicKey(pub)
 708                         if err != nil {
 709                                 c.sendAlert(alertIllegalParameter)
 710                                 return err
 711                         }
 712                 }
 713
 714                 signed := hs.finishedHash.hashForClientCertificate(sigType, sigHash)
 715                 if err := verifyHandshakeSignature(sigType, pub, sigHash, signed, certVerify.signature); err != nil {
 716                         c.sendAlert(alertDecryptError)
 717                         return errors.New("tls: invalid signature by the client certificate: " + err.Error())
 718                 }
 719
 720                 if err := transcriptMsg(certVerify, &hs.finishedHash); err != nil {
 721                         return err
 722                 }
 723         }
 724
 725         hs.finishedHash.discardHandshakeBuffer()
 726
 727         return nil
 728 }
 729
 730 func (hs *serverHandshakeState) establishKeys() error {
 731         c := hs.c
 732
 733         clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
 734                 keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
 735
 736         var clientCipher, serverCipher any
 737         var clientHash, serverHash hash.Hash
 738
 739         if hs.suite.aead == nil {
 740                 clientCipher = hs.suite.cipher(clientKey, clientIV, true /* for reading */)
 741                 clientHash = hs.suite.mac(clientMAC)
 742                 serverCipher = hs.suite.cipher(serverKey, serverIV, false /* not for reading */)
 743                 serverHash = hs.suite.mac(serverMAC)
 744         } else {
 745                 clientCipher = hs.suite.aead(clientKey, clientIV)
 746                 serverCipher = hs.suite.aead(serverKey, serverIV)
 747         }
 748
 749         c.in.prepareCipherSpec(c.vers, clientCipher, clientHash)
 750         c.out.prepareCipherSpec(c.vers, serverCipher, serverHash)
 751
 752         return nil
 753 }
 754
 755 func (hs *serverHandshakeState) readFinished(out []byte) error {
 756         c := hs.c
 757
 758         if err := c.readChangeCipherSpec(); err != nil {
 759                 return err
 760         }
 761
 762         // finishedMsg is included in the transcript, but not until after we
 763         // check the client version, since the state before this message was
 764         // sent is used during verification.
 765         msg, err := c.readHandshake(nil)
 766         if err != nil {
 767                 return err
 768         }
 769         clientFinished, ok := msg.(*finishedMsg)
 770         if !ok {
 771                 c.sendAlert(alertUnexpectedMessage)
 772                 return unexpectedMessageError(clientFinished, msg)
 773         }
 774
 775         verify := hs.finishedHash.clientSum(hs.masterSecret)
 776         if len(verify) != len(clientFinished.verifyData) ||
 777                 subtle.ConstantTimeCompare(verify, clientFinished.verifyData) != 1 {
 778                 c.sendAlert(alertHandshakeFailure)
 779                 return errors.New("tls: client's Finished message is incorrect")
 780         }
 781
 782         if err := transcriptMsg(clientFinished, &hs.finishedHash); err != nil {
 783                 return err
 784         }
 785
 786         copy(out, verify)
 787         return nil
 788 }
 789
 790 func (hs *serverHandshakeState) sendSessionTicket() error {
 791         if !hs.hello.ticketSupported {
 792                 return nil
 793         }
 794
 795         c := hs.c
 796         m := new(newSessionTicketMsg)
 797
 798         state, err := c.sessionState()
 799         if err != nil {
 800                 return err
 801         }
 802         state.secret = hs.masterSecret
 803         if hs.sessionState != nil {
 804                 // If this is re-wrapping an old key, then keep
 805                 // the original time it was created.
 806                 state.createdAt = hs.sessionState.createdAt
 807         }
 808         if c.config.WrapSession != nil {
 809                 m.ticket, err = c.config.WrapSession(c.connectionStateLocked(), state)
 810                 if err != nil {
 811                         return err
 812                 }
 813         } else {
 814                 stateBytes, err := state.Bytes()
 815                 if err != nil {
 816                         return err
 817                 }
 818                 m.ticket, err = c.config.encryptTicket(stateBytes, c.ticketKeys)
 819                 if err != nil {
 820                         return err
 821                 }
 822         }
 823
 824         if _, err := hs.c.writeHandshakeRecord(m, &hs.finishedHash); err != nil {
 825                 return err
 826         }
 827
 828         return nil
 829 }
 830
 831 func (hs *serverHandshakeState) sendFinished(out []byte) error {
 832         c := hs.c
 833
 834         if err := c.writeChangeCipherRecord(); err != nil {
 835                 return err
 836         }
 837
 838         finished := new(finishedMsg)
 839         finished.verifyData = hs.finishedHash.serverSum(hs.masterSecret)
 840         if _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil {
 841                 return err
 842         }
 843
 844         copy(out, finished.verifyData)
 845
 846         return nil
 847 }
 848
 849 // processCertsFromClient takes a chain of client certificates either from a
 850 // Certificates message or from a sessionState and verifies them. It returns
 851 // the public key of the leaf certificate.
 852 func (c *Conn) processCertsFromClient(certificate Certificate) error {
 853         certificates := certificate.Certificate
 854         certs := make([]*x509.Certificate, len(certificates))
 855         var err error
 856         for i, asn1Data := range certificates {
 857                 if certs[i], err = x509.ParseCertificate(asn1Data); err != nil {
 858                         c.sendAlert(alertBadCertificate)
 859                         return errors.New("tls: failed to parse client certificate: " + err.Error())
 860                 }
 861         }
 862
 863         if len(certs) == 0 && requiresClientCert(c.config.ClientAuth) {
 864                 if c.vers == VersionTLS13 {
 865                         c.sendAlert(alertCertificateRequired)
 866                 } else {
 867                         c.sendAlert(alertBadCertificate)
 868                 }
 869                 return errors.New("tls: client didn't provide a certificate")
 870         }
 871
 872         if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
 873                 opts := x509.VerifyOptions{
 874                         Roots:         c.config.ClientCAs,
 875                         CurrentTime:   c.config.time(),
 876                         Intermediates: x509.NewCertPool(),
 877                         KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 878                 }
 879
 880                 for _, cert := range certs[1:] {
 881                         opts.Intermediates.AddCert(cert)
 882                 }
 883
 884                 chains, err := certs[0].Verify(opts)
 885                 if err != nil {
 886                         var errCertificateInvalid x509.CertificateInvalidError
 887                         if errors.As(err, &x509.UnknownAuthorityError{}) {
 888                                 c.sendAlert(alertUnknownCA)
 889                         } else if errors.As(err, &errCertificateInvalid) && errCertificateInvalid.Reason == x509.Expired {
 890                                 c.sendAlert(alertCertificateExpired)
 891                         } else {
 892                                 c.sendAlert(alertBadCertificate)
 893                         }
 894                         return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
 895                 }
 896
 897                 c.verifiedChains = chains
 898         }
 899
 900         c.peerCertificates = certs
 901         c.ocspResponse = certificate.OCSPStaple
 902         c.scts = certificate.SignedCertificateTimestamps
 903
 904         if len(certs) > 0 {
 905                 switch certs[0].PublicKey.(type) {
 906                 case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
 907                 default:
 908                         c.sendAlert(alertUnsupportedCertificate)
 909                         return fmt.Errorf("tls: client certificate contains an unsupported public key of type %T", certs[0].PublicKey)
 910                 }
 911         }
 912
 913         if c.config.VerifyPeerCertificate != nil {
 914                 if err := c.config.VerifyPeerCertificate(certificates, c.verifiedChains); err != nil {
 915                         c.sendAlert(alertBadCertificate)
 916                         return err
 917                 }
 918         }
 919
 920         return nil
 921 }
 922
 923 func clientHelloInfo(ctx context.Context, c *Conn, clientHello *clientHelloMsg) *ClientHelloInfo {
 924         supportedVersions := clientHello.supportedVersions
 925         if len(clientHello.supportedVersions) == 0 {
 926                 supportedVersions = supportedVersionsFromMax(clientHello.vers)
 927         }
 928
 929         return &ClientHelloInfo{
 930                 CipherSuites:      clientHello.cipherSuites,
 931                 ServerName:        clientHello.serverName,
 932                 SupportedCurves:   clientHello.supportedCurves,
 933                 SupportedPoints:   clientHello.supportedPoints,
 934                 SignatureSchemes:  clientHello.supportedSignatureAlgorithms,
 935                 SupportedProtos:   clientHello.alpnProtocols,
 936                 SupportedVersions: supportedVersions,
 937                 Conn:              c.conn,
 938                 config:            c.config,
 939                 ctx:               ctx,
 940         }
 941 }