crypto/tls: implement Extended Master Secret

[gostls13.git] / src / crypto / tls / handshake_client.go

diff --git a/src/crypto/tls/handshake_client.go b/src/crypto/tls/handshake_client.go
index dd9f20606784881cb0635fabe48a6723d89322e6..80949f22e21636ec8b6fd863090ebab06c53859e 100644 (file)
--- a/src/crypto/tls/handshake_client.go
+++ b/src/crypto/tls/handshake_client.go
@@ -72,6 +72,7 @@ func (c *Conn) makeClientHello() (*clientHelloMsg, *ecdh.PrivateKey, error) {
                vers:                         clientHelloVersion,
                compressionMethods:           []uint8{compressionNone},
                random:                       make([]byte, 32),
+               extendedMasterSecret:         true,
                ocspStapling:                 true,
                scts:                         true,
                serverName:                   hostnameInSNI(config.ServerName),
@@ -645,6 +646,19 @@ func (hs *clientHandshakeState) doFullHandshake() error {
                }
        }
 
+       if hs.serverHello.extendedMasterSecret {
+               c.extMasterSecret = true
+               hs.masterSecret = extMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
+                       hs.finishedHash.Sum())
+       } else {
+               hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
+                       hs.hello.random, hs.serverHello.random)
+       }
+       if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.hello.random, hs.masterSecret); err != nil {
+               c.sendAlert(alertInternalError)
+               return errors.New("tls: failed to write to key log: " + err.Error())
+       }
+
        if chainToSend != nil && len(chainToSend.Certificate) > 0 {
                certVerify := &certificateVerifyMsg{}
 
@@ -692,12 +706,6 @@ func (hs *clientHandshakeState) doFullHandshake() error {
                }
        }
 
-       hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.hello.random, hs.serverHello.random)
-       if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.hello.random, hs.masterSecret); err != nil {
-               c.sendAlert(alertInternalError)
-               return errors.New("tls: failed to write to key log: " + err.Error())
-       }
-
        hs.finishedHash.discardHandshakeBuffer()
 
        return nil
@@ -784,8 +792,15 @@ func (hs *clientHandshakeState) processServerHello() (bool, error) {
                return false, errors.New("tls: server resumed a session with a different cipher suite")
        }
 
+       // RFC 7627, Section 5.3
+       if hs.session.extMasterSecret != hs.serverHello.extendedMasterSecret {
+               c.sendAlert(alertHandshakeFailure)
+               return false, errors.New("tls: server resumed a session with a different EMS extension")
+       }
+
        // Restore master secret and certificates from previous state
        hs.masterSecret = hs.session.secret
+       c.extMasterSecret = hs.session.extMasterSecret
        c.peerCertificates = hs.session.peerCertificates
        c.activeCertHandles = hs.c.activeCertHandles
        c.verifiedChains = hs.session.verifiedChains