[dev.boringcrypto] all: merge commit 9d0819b27c (CL 314609) into dev.boringcrypto

[gostls13.git] / src / crypto / tls / handshake_client.go

diff --git a/src/crypto/tls/handshake_client.go b/src/crypto/tls/handshake_client.go
index 94747a7c4109a8c22e923747c79e7a72ee12b21d..9582a7f867514d9fedf63b218c08c27c131228bd 100644 (file)
--- a/src/crypto/tls/handshake_client.go
+++ b/src/crypto/tls/handshake_client.go
@@ -6,6 +6,7 @@ package tls
 
 import (
        "bytes"
+       "context"
        "crypto"
        "crypto/ecdsa"
        "crypto/ed25519"
@@ -24,6 +25,7 @@ import (
 
 type clientHandshakeState struct {
        c            *Conn
+       ctx          context.Context
        serverHello  *serverHelloMsg
        hello        *clientHelloMsg
        suite        *cipherSuite
@@ -82,22 +84,24 @@ func (c *Conn) makeClientHello() (*clientHelloMsg, ecdheParameters, error) {
                hello.secureRenegotiation = c.clientFinished[:]
        }
 
-       possibleCipherSuites := config.cipherSuites()
-       hello.cipherSuites = make([]uint16, 0, len(possibleCipherSuites))
+       preferenceOrder := cipherSuitesPreferenceOrder
+       if !hasAESGCMHardwareSupport {
+               preferenceOrder = cipherSuitesPreferenceOrderNoAES
+       }
+       configCipherSuites := config.cipherSuites()
+       hello.cipherSuites = make([]uint16, 0, len(configCipherSuites))
 
-       for _, suiteId := range possibleCipherSuites {
-               for _, suite := range cipherSuites {
-                       if suite.id != suiteId {
-                               continue
-                       }
-                       // Don't advertise TLS 1.2-only cipher suites unless
-                       // we're attempting TLS 1.2.
-                       if hello.vers < VersionTLS12 && suite.flags&suiteTLS12 != 0 {
-                               break
-                       }
-                       hello.cipherSuites = append(hello.cipherSuites, suiteId)
-                       break
+       for _, suiteId := range preferenceOrder {
+               suite := mutualCipherSuite(configCipherSuites, suiteId)
+               if suite == nil {
+                       continue
                }
+               // Don't advertise TLS 1.2-only cipher suites unless
+               // we're attempting TLS 1.2.
+               if hello.vers < VersionTLS12 && suite.flags&suiteTLS12 != 0 {
+                       continue
+               }
+               hello.cipherSuites = append(hello.cipherSuites, suiteId)
        }
 
        _, err := io.ReadFull(config.rand(), hello.random)
@@ -121,7 +125,11 @@ func (c *Conn) makeClientHello() (*clientHelloMsg, ecdheParameters, error) {
 
        var params ecdheParameters
        if hello.supportedVersions[0] == VersionTLS13 {
-               hello.cipherSuites = append(hello.cipherSuites, defaultCipherSuitesTLS13()...)
+               if hasAESGCMHardwareSupport {
+                       hello.cipherSuites = append(hello.cipherSuites, defaultCipherSuitesTLS13...)
+               } else {
+                       hello.cipherSuites = append(hello.cipherSuites, defaultCipherSuitesTLS13NoAES...)
+               }
 
                curveID := config.curvePreferences()[0]
                if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok {
@@ -137,7 +145,7 @@ func (c *Conn) makeClientHello() (*clientHelloMsg, ecdheParameters, error) {
        return hello, params, nil
 }
 
-func (c *Conn) clientHandshake() (err error) {
+func (c *Conn) clientHandshake(ctx context.Context) (err error) {
        if c.config == nil {
                c.config = defaultConfig()
        }
@@ -201,6 +209,7 @@ func (c *Conn) clientHandshake() (err error) {
        if c.vers == VersionTLS13 {
                hs := &clientHandshakeStateTLS13{
                        c:           c,
+                       ctx:         ctx,
                        serverHello: serverHello,
                        hello:       hello,
                        ecdheParams: ecdheParams,
@@ -215,6 +224,7 @@ func (c *Conn) clientHandshake() (err error) {
 
        hs := &clientHandshakeState{
                c:           c,
+               ctx:         ctx,
                serverHello: serverHello,
                hello:       hello,
                session:     session,
@@ -543,7 +553,7 @@ func (hs *clientHandshakeState) doFullHandshake() error {
                certRequested = true
                hs.finishedHash.Write(certReq.marshal())
 
-               cri := certificateRequestInfoFromMsg(c.vers, certReq)
+               cri := certificateRequestInfoFromMsg(hs.ctx, c.vers, certReq)
                if chainToSend, err = c.getClientCertificate(cri); err != nil {
                        c.sendAlert(alertInternalError)
                        return err
@@ -885,10 +895,11 @@ func (c *Conn) verifyServerCertificate(certificates [][]byte) error {
 
 // certificateRequestInfoFromMsg generates a CertificateRequestInfo from a TLS
 // <= 1.2 CertificateRequest, making an effort to fill in missing information.
-func certificateRequestInfoFromMsg(vers uint16, certReq *certificateRequestMsg) *CertificateRequestInfo {
+func certificateRequestInfoFromMsg(ctx context.Context, vers uint16, certReq *certificateRequestMsg) *CertificateRequestInfo {
        cri := &CertificateRequestInfo{
                AcceptableCAs: certReq.certificateAuthorities,
                Version:       vers,
+               ctx:           ctx,
        }
 
        var rsaAvail, ecAvail bool