src/crypto/tls/handshake_server.go

   1 // Copyright 2009 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 package tls
   6
   7 import (
   8         "crypto"
   9         "crypto/ecdsa"
  10         "crypto/ed25519"
  11         "crypto/rsa"
  12         "crypto/subtle"
  13         "crypto/x509"
  14         "errors"
  15         "fmt"
  16         "io"
  17         "sync/atomic"
  18 )
  19
  20 // serverHandshakeState contains details of a server handshake in progress.
  21 // It's discarded once the handshake has completed.
  22 type serverHandshakeState struct {
  23         c            *Conn
  24         clientHello  *clientHelloMsg
  25         hello        *serverHelloMsg
  26         suite        *cipherSuite
  27         ecdheOk      bool
  28         ecSignOk     bool
  29         rsaDecryptOk bool
  30         rsaSignOk    bool
  31         sessionState *sessionState
  32         finishedHash finishedHash
  33         masterSecret []byte
  34         cert         *Certificate
  35 }
  36
  37 // serverHandshake performs a TLS handshake as a server.
  38 func (c *Conn) serverHandshake() error {
  39         // If this is the first server handshake, we generate a random key to
  40         // encrypt the tickets with.
  41         c.config.serverInitOnce.Do(func() { c.config.serverInit(nil) })
  42
  43         clientHello, err := c.readClientHello()
  44         if err != nil {
  45                 return err
  46         }
  47
  48         if c.vers == VersionTLS13 {
  49                 hs := serverHandshakeStateTLS13{
  50                         c:           c,
  51                         clientHello: clientHello,
  52                 }
  53                 return hs.handshake()
  54         }
  55
  56         hs := serverHandshakeState{
  57                 c:           c,
  58                 clientHello: clientHello,
  59         }
  60         return hs.handshake()
  61 }
  62
  63 func (hs *serverHandshakeState) handshake() error {
  64         c := hs.c
  65
  66         if err := hs.processClientHello(); err != nil {
  67                 return err
  68         }
  69
  70         // For an overview of TLS handshaking, see RFC 5246, Section 7.3.
  71         c.buffering = true
  72         if hs.checkForResumption() {
  73                 // The client has included a session ticket and so we do an abbreviated handshake.
  74                 if err := hs.doResumeHandshake(); err != nil {
  75                         return err
  76                 }
  77                 if err := hs.establishKeys(); err != nil {
  78                         return err
  79                 }
  80                 // ticketSupported is set in a resumption handshake if the
  81                 // ticket from the client was encrypted with an old session
  82                 // ticket key and thus a refreshed ticket should be sent.
  83                 if hs.hello.ticketSupported {
  84                         if err := hs.sendSessionTicket(); err != nil {
  85                                 return err
  86                         }
  87                 }
  88                 if err := hs.sendFinished(c.serverFinished[:]); err != nil {
  89                         return err
  90                 }
  91                 if _, err := c.flush(); err != nil {
  92                         return err
  93                 }
  94                 c.clientFinishedIsFirst = false
  95                 if err := hs.readFinished(nil); err != nil {
  96                         return err
  97                 }
  98                 c.didResume = true
  99         } else {
 100                 // The client didn't include a session ticket, or it wasn't
 101                 // valid so we do a full handshake.
 102                 if err := hs.pickCipherSuite(); err != nil {
 103                         return err
 104                 }
 105                 if err := hs.doFullHandshake(); err != nil {
 106                         return err
 107                 }
 108                 if err := hs.establishKeys(); err != nil {
 109                         return err
 110                 }
 111                 if err := hs.readFinished(c.clientFinished[:]); err != nil {
 112                         return err
 113                 }
 114                 c.clientFinishedIsFirst = true
 115                 c.buffering = true
 116                 if err := hs.sendSessionTicket(); err != nil {
 117                         return err
 118                 }
 119                 if err := hs.sendFinished(nil); err != nil {
 120                         return err
 121                 }
 122                 if _, err := c.flush(); err != nil {
 123                         return err
 124                 }
 125         }
 126
 127         c.ekm = ekmFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random)
 128         atomic.StoreUint32(&c.handshakeStatus, 1)
 129
 130         return nil
 131 }
 132
 133 // readClientHello reads a ClientHello message and selects the protocol version.
 134 func (c *Conn) readClientHello() (*clientHelloMsg, error) {
 135         msg, err := c.readHandshake()
 136         if err != nil {
 137                 return nil, err
 138         }
 139         clientHello, ok := msg.(*clientHelloMsg)
 140         if !ok {
 141                 c.sendAlert(alertUnexpectedMessage)
 142                 return nil, unexpectedMessageError(clientHello, msg)
 143         }
 144
 145         if c.config.GetConfigForClient != nil {
 146                 chi := clientHelloInfo(c, clientHello)
 147                 if newConfig, err := c.config.GetConfigForClient(chi); err != nil {
 148                         c.sendAlert(alertInternalError)
 149                         return nil, err
 150                 } else if newConfig != nil {
 151                         newConfig.serverInitOnce.Do(func() { newConfig.serverInit(c.config) })
 152                         c.config = newConfig
 153                 }
 154         }
 155
 156         clientVersions := clientHello.supportedVersions
 157         if len(clientHello.supportedVersions) == 0 {
 158                 clientVersions = supportedVersionsFromMax(clientHello.vers)
 159         }
 160         c.vers, ok = c.config.mutualVersion(clientVersions)
 161         if !ok {
 162                 c.sendAlert(alertProtocolVersion)
 163                 return nil, fmt.Errorf("tls: client offered only unsupported versions: %x", clientVersions)
 164         }
 165         c.haveVers = true
 166         c.in.version = c.vers
 167         c.out.version = c.vers
 168
 169         return clientHello, nil
 170 }
 171
 172 func (hs *serverHandshakeState) processClientHello() error {
 173         c := hs.c
 174
 175         hs.hello = new(serverHelloMsg)
 176         hs.hello.vers = c.vers
 177
 178         foundCompression := false
 179         // We only support null compression, so check that the client offered it.
 180         for _, compression := range hs.clientHello.compressionMethods {
 181                 if compression == compressionNone {
 182                         foundCompression = true
 183                         break
 184                 }
 185         }
 186
 187         if !foundCompression {
 188                 c.sendAlert(alertHandshakeFailure)
 189                 return errors.New("tls: client does not support uncompressed connections")
 190         }
 191
 192         hs.hello.random = make([]byte, 32)
 193         serverRandom := hs.hello.random
 194         // Downgrade protection canaries. See RFC 8446, Section 4.1.3.
 195         maxVers := c.config.maxSupportedVersion()
 196         if maxVers >= VersionTLS12 && c.vers < maxVers {
 197                 if c.vers == VersionTLS12 {
 198                         copy(serverRandom[24:], downgradeCanaryTLS12)
 199                 } else {
 200                         copy(serverRandom[24:], downgradeCanaryTLS11)
 201                 }
 202                 serverRandom = serverRandom[:24]
 203         }
 204         _, err := io.ReadFull(c.config.rand(), serverRandom)
 205         if err != nil {
 206                 c.sendAlert(alertInternalError)
 207                 return err
 208         }
 209
 210         if len(hs.clientHello.secureRenegotiation) != 0 {
 211                 c.sendAlert(alertHandshakeFailure)
 212                 return errors.New("tls: initial handshake had non-empty renegotiation extension")
 213         }
 214
 215         hs.hello.secureRenegotiationSupported = hs.clientHello.secureRenegotiationSupported
 216         hs.hello.compressionMethod = compressionNone
 217         if len(hs.clientHello.serverName) > 0 {
 218                 c.serverName = hs.clientHello.serverName
 219         }
 220
 221         if len(hs.clientHello.alpnProtocols) > 0 {
 222                 if selectedProto, fallback := mutualProtocol(hs.clientHello.alpnProtocols, c.config.NextProtos); !fallback {
 223                         hs.hello.alpnProtocol = selectedProto
 224                         c.clientProtocol = selectedProto
 225                 }
 226         }
 227
 228         hs.cert, err = c.config.getCertificate(clientHelloInfo(c, hs.clientHello))
 229         if err != nil {
 230                 c.sendAlert(alertInternalError)
 231                 return err
 232         }
 233         if hs.clientHello.scts {
 234                 hs.hello.scts = hs.cert.SignedCertificateTimestamps
 235         }
 236
 237         hs.ecdheOk = supportsECDHE(c.config, hs.clientHello.supportedCurves, hs.clientHello.supportedPoints)
 238
 239         if hs.ecdheOk {
 240                 // Although omiting the ec_point_formats extension is permitted, some
 241                 // old OpenSSL version will refuse to handshake if not present.
 242                 //
 243                 // Per RFC 4492, section 5.1.2, implementations MUST support the
 244                 // uncompressed point format. See golang.org/issue/31943.
 245                 hs.hello.supportedPoints = []uint8{pointFormatUncompressed}
 246         }
 247
 248         if priv, ok := hs.cert.PrivateKey.(crypto.Signer); ok {
 249                 switch priv.Public().(type) {
 250                 case *ecdsa.PublicKey:
 251                         hs.ecSignOk = true
 252                 case ed25519.PublicKey:
 253                         hs.ecSignOk = true
 254                 case *rsa.PublicKey:
 255                         hs.rsaSignOk = true
 256                 default:
 257                         c.sendAlert(alertInternalError)
 258                         return fmt.Errorf("tls: unsupported signing key type (%T)", priv.Public())
 259                 }
 260         }
 261         if priv, ok := hs.cert.PrivateKey.(crypto.Decrypter); ok {
 262                 switch priv.Public().(type) {
 263                 case *rsa.PublicKey:
 264                         hs.rsaDecryptOk = true
 265                 default:
 266                         c.sendAlert(alertInternalError)
 267                         return fmt.Errorf("tls: unsupported decryption key type (%T)", priv.Public())
 268                 }
 269         }
 270
 271         return nil
 272 }
 273
 274 // supportsECDHE returns whether ECDHE key exchanges can be used with this
 275 // pre-TLS 1.3 client.
 276 func supportsECDHE(c *Config, supportedCurves []CurveID, supportedPoints []uint8) bool {
 277         supportsCurve := false
 278         for _, curve := range supportedCurves {
 279                 if c.supportsCurve(curve) {
 280                         supportsCurve = true
 281                         break
 282                 }
 283         }
 284
 285         supportsPointFormat := false
 286         for _, pointFormat := range supportedPoints {
 287                 if pointFormat == pointFormatUncompressed {
 288                         supportsPointFormat = true
 289                         break
 290                 }
 291         }
 292
 293         return supportsCurve && supportsPointFormat
 294 }
 295
 296 func (hs *serverHandshakeState) pickCipherSuite() error {
 297         c := hs.c
 298
 299         var preferenceList, supportedList []uint16
 300         if c.config.PreferServerCipherSuites {
 301                 preferenceList = c.config.cipherSuites()
 302                 supportedList = hs.clientHello.cipherSuites
 303         } else {
 304                 preferenceList = hs.clientHello.cipherSuites
 305                 supportedList = c.config.cipherSuites()
 306         }
 307
 308         hs.suite = selectCipherSuite(preferenceList, supportedList, hs.cipherSuiteOk)
 309         if hs.suite == nil {
 310                 c.sendAlert(alertHandshakeFailure)
 311                 return errors.New("tls: no cipher suite supported by both client and server")
 312         }
 313
 314         for _, id := range hs.clientHello.cipherSuites {
 315                 if id == TLS_FALLBACK_SCSV {
 316                         // The client is doing a fallback connection. See RFC 7507.
 317                         if hs.clientHello.vers < c.config.maxSupportedVersion() {
 318                                 c.sendAlert(alertInappropriateFallback)
 319                                 return errors.New("tls: client using inappropriate protocol fallback")
 320                         }
 321                         break
 322                 }
 323         }
 324
 325         return nil
 326 }
 327
 328 func (hs *serverHandshakeState) cipherSuiteOk(c *cipherSuite) bool {
 329         if c.flags&suiteECDHE != 0 {
 330                 if !hs.ecdheOk {
 331                         return false
 332                 }
 333                 if c.flags&suiteECSign != 0 {
 334                         if !hs.ecSignOk {
 335                                 return false
 336                         }
 337                 } else if !hs.rsaSignOk {
 338                         return false
 339                 }
 340         } else if !hs.rsaDecryptOk {
 341                 return false
 342         }
 343         if hs.c.vers < VersionTLS12 && c.flags&suiteTLS12 != 0 {
 344                 return false
 345         }
 346         return true
 347 }
 348
 349 // checkForResumption reports whether we should perform resumption on this connection.
 350 func (hs *serverHandshakeState) checkForResumption() bool {
 351         c := hs.c
 352
 353         if c.config.SessionTicketsDisabled {
 354                 return false
 355         }
 356
 357         plaintext, usedOldKey := c.decryptTicket(hs.clientHello.sessionTicket)
 358         if plaintext == nil {
 359                 return false
 360         }
 361         hs.sessionState = &sessionState{usedOldKey: usedOldKey}
 362         ok := hs.sessionState.unmarshal(plaintext)
 363         if !ok {
 364                 return false
 365         }
 366
 367         // Never resume a session for a different TLS version.
 368         if c.vers != hs.sessionState.vers {
 369                 return false
 370         }
 371
 372         cipherSuiteOk := false
 373         // Check that the client is still offering the ciphersuite in the session.
 374         for _, id := range hs.clientHello.cipherSuites {
 375                 if id == hs.sessionState.cipherSuite {
 376                         cipherSuiteOk = true
 377                         break
 378                 }
 379         }
 380         if !cipherSuiteOk {
 381                 return false
 382         }
 383
 384         // Check that we also support the ciphersuite from the session.
 385         hs.suite = selectCipherSuite([]uint16{hs.sessionState.cipherSuite},
 386                 c.config.cipherSuites(), hs.cipherSuiteOk)
 387         if hs.suite == nil {
 388                 return false
 389         }
 390
 391         sessionHasClientCerts := len(hs.sessionState.certificates) != 0
 392         needClientCerts := requiresClientCert(c.config.ClientAuth)
 393         if needClientCerts && !sessionHasClientCerts {
 394                 return false
 395         }
 396         if sessionHasClientCerts && c.config.ClientAuth == NoClientCert {
 397                 return false
 398         }
 399
 400         return true
 401 }
 402
 403 func (hs *serverHandshakeState) doResumeHandshake() error {
 404         c := hs.c
 405
 406         hs.hello.cipherSuite = hs.suite.id
 407         // We echo the client's session ID in the ServerHello to let it know
 408         // that we're doing a resumption.
 409         hs.hello.sessionId = hs.clientHello.sessionId
 410         hs.hello.ticketSupported = hs.sessionState.usedOldKey
 411         hs.finishedHash = newFinishedHash(c.vers, hs.suite)
 412         hs.finishedHash.discardHandshakeBuffer()
 413         hs.finishedHash.Write(hs.clientHello.marshal())
 414         hs.finishedHash.Write(hs.hello.marshal())
 415         if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil {
 416                 return err
 417         }
 418
 419         if err := c.processCertsFromClient(Certificate{
 420                 Certificate: hs.sessionState.certificates,
 421         }); err != nil {
 422                 return err
 423         }
 424
 425         hs.masterSecret = hs.sessionState.masterSecret
 426
 427         return nil
 428 }
 429
 430 func (hs *serverHandshakeState) doFullHandshake() error {
 431         c := hs.c
 432
 433         if hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 {
 434                 hs.hello.ocspStapling = true
 435         }
 436
 437         hs.hello.ticketSupported = hs.clientHello.ticketSupported && !c.config.SessionTicketsDisabled
 438         hs.hello.cipherSuite = hs.suite.id
 439
 440         hs.finishedHash = newFinishedHash(hs.c.vers, hs.suite)
 441         if c.config.ClientAuth == NoClientCert {
 442                 // No need to keep a full record of the handshake if client
 443                 // certificates won't be used.
 444                 hs.finishedHash.discardHandshakeBuffer()
 445         }
 446         hs.finishedHash.Write(hs.clientHello.marshal())
 447         hs.finishedHash.Write(hs.hello.marshal())
 448         if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil {
 449                 return err
 450         }
 451
 452         certMsg := new(certificateMsg)
 453         certMsg.certificates = hs.cert.Certificate
 454         hs.finishedHash.Write(certMsg.marshal())
 455         if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil {
 456                 return err
 457         }
 458
 459         if hs.hello.ocspStapling {
 460                 certStatus := new(certificateStatusMsg)
 461                 certStatus.response = hs.cert.OCSPStaple
 462                 hs.finishedHash.Write(certStatus.marshal())
 463                 if _, err := c.writeRecord(recordTypeHandshake, certStatus.marshal()); err != nil {
 464                         return err
 465                 }
 466         }
 467
 468         keyAgreement := hs.suite.ka(c.vers)
 469         skx, err := keyAgreement.generateServerKeyExchange(c.config, hs.cert, hs.clientHello, hs.hello)
 470         if err != nil {
 471                 c.sendAlert(alertHandshakeFailure)
 472                 return err
 473         }
 474         if skx != nil {
 475                 hs.finishedHash.Write(skx.marshal())
 476                 if _, err := c.writeRecord(recordTypeHandshake, skx.marshal()); err != nil {
 477                         return err
 478                 }
 479         }
 480
 481         var certReq *certificateRequestMsg
 482         if c.config.ClientAuth >= RequestClientCert {
 483                 // Request a client certificate
 484                 certReq = new(certificateRequestMsg)
 485                 certReq.certificateTypes = []byte{
 486                         byte(certTypeRSASign),
 487                         byte(certTypeECDSASign),
 488                 }
 489                 if c.vers >= VersionTLS12 {
 490                         certReq.hasSignatureAlgorithm = true
 491                         certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithmsTLS12()
 492                 }
 493
 494                 // An empty list of certificateAuthorities signals to
 495                 // the client that it may send any certificate in response
 496                 // to our request. When we know the CAs we trust, then
 497                 // we can send them down, so that the client can choose
 498                 // an appropriate certificate to give to us.
 499                 if c.config.ClientCAs != nil {
 500                         certReq.certificateAuthorities = c.config.ClientCAs.Subjects()
 501                 }
 502                 hs.finishedHash.Write(certReq.marshal())
 503                 if _, err := c.writeRecord(recordTypeHandshake, certReq.marshal()); err != nil {
 504                         return err
 505                 }
 506         }
 507
 508         helloDone := new(serverHelloDoneMsg)
 509         hs.finishedHash.Write(helloDone.marshal())
 510         if _, err := c.writeRecord(recordTypeHandshake, helloDone.marshal()); err != nil {
 511                 return err
 512         }
 513
 514         if _, err := c.flush(); err != nil {
 515                 return err
 516         }
 517
 518         var pub crypto.PublicKey // public key for client auth, if any
 519
 520         msg, err := c.readHandshake()
 521         if err != nil {
 522                 return err
 523         }
 524
 525         // If we requested a client certificate, then the client must send a
 526         // certificate message, even if it's empty.
 527         if c.config.ClientAuth >= RequestClientCert {
 528                 certMsg, ok := msg.(*certificateMsg)
 529                 if !ok {
 530                         c.sendAlert(alertUnexpectedMessage)
 531                         return unexpectedMessageError(certMsg, msg)
 532                 }
 533                 hs.finishedHash.Write(certMsg.marshal())
 534
 535                 if err := c.processCertsFromClient(Certificate{
 536                         Certificate: certMsg.certificates,
 537                 }); err != nil {
 538                         return err
 539                 }
 540                 if len(certMsg.certificates) != 0 {
 541                         pub = c.peerCertificates[0].PublicKey
 542                 }
 543
 544                 msg, err = c.readHandshake()
 545                 if err != nil {
 546                         return err
 547                 }
 548         }
 549
 550         // Get client key exchange
 551         ckx, ok := msg.(*clientKeyExchangeMsg)
 552         if !ok {
 553                 c.sendAlert(alertUnexpectedMessage)
 554                 return unexpectedMessageError(ckx, msg)
 555         }
 556         hs.finishedHash.Write(ckx.marshal())
 557
 558         preMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers)
 559         if err != nil {
 560                 c.sendAlert(alertHandshakeFailure)
 561                 return err
 562         }
 563         hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.clientHello.random, hs.hello.random)
 564         if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.clientHello.random, hs.masterSecret); err != nil {
 565                 c.sendAlert(alertInternalError)
 566                 return err
 567         }
 568
 569         // If we received a client cert in response to our certificate request message,
 570         // the client will send us a certificateVerifyMsg immediately after the
 571         // clientKeyExchangeMsg. This message is a digest of all preceding
 572         // handshake-layer messages that is signed using the private key corresponding
 573         // to the client's certificate. This allows us to verify that the client is in
 574         // possession of the private key of the certificate.
 575         if len(c.peerCertificates) > 0 {
 576                 msg, err = c.readHandshake()
 577                 if err != nil {
 578                         return err
 579                 }
 580                 certVerify, ok := msg.(*certificateVerifyMsg)
 581                 if !ok {
 582                         c.sendAlert(alertUnexpectedMessage)
 583                         return unexpectedMessageError(certVerify, msg)
 584                 }
 585
 586                 var sigType uint8
 587                 var sigHash crypto.Hash
 588                 if c.vers >= VersionTLS12 {
 589                         if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, certReq.supportedSignatureAlgorithms) {
 590                                 c.sendAlert(alertIllegalParameter)
 591                                 return errors.New("tls: client certificate used with invalid signature algorithm")
 592                         }
 593                         sigType, sigHash, err = typeAndHashFromSignatureScheme(certVerify.signatureAlgorithm)
 594                         if err != nil {
 595                                 return c.sendAlert(alertInternalError)
 596                         }
 597                 } else {
 598                         sigType, sigHash, err = legacyTypeAndHashFromPublicKey(pub)
 599                         if err != nil {
 600                                 c.sendAlert(alertIllegalParameter)
 601                                 return err
 602                         }
 603                 }
 604
 605                 signed := hs.finishedHash.hashForClientCertificate(sigType, sigHash, hs.masterSecret)
 606                 if err := verifyHandshakeSignature(sigType, pub, sigHash, signed, certVerify.signature); err != nil {
 607                         c.sendAlert(alertDecryptError)
 608                         return errors.New("tls: invalid signature by the client certificate: " + err.Error())
 609                 }
 610
 611                 hs.finishedHash.Write(certVerify.marshal())
 612         }
 613
 614         hs.finishedHash.discardHandshakeBuffer()
 615
 616         return nil
 617 }
 618
 619 func (hs *serverHandshakeState) establishKeys() error {
 620         c := hs.c
 621
 622         clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
 623                 keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
 624
 625         var clientCipher, serverCipher interface{}
 626         var clientHash, serverHash macFunction
 627
 628         if hs.suite.aead == nil {
 629                 clientCipher = hs.suite.cipher(clientKey, clientIV, true /* for reading */)
 630                 clientHash = hs.suite.mac(c.vers, clientMAC)
 631                 serverCipher = hs.suite.cipher(serverKey, serverIV, false /* not for reading */)
 632                 serverHash = hs.suite.mac(c.vers, serverMAC)
 633         } else {
 634                 clientCipher = hs.suite.aead(clientKey, clientIV)
 635                 serverCipher = hs.suite.aead(serverKey, serverIV)
 636         }
 637
 638         c.in.prepareCipherSpec(c.vers, clientCipher, clientHash)
 639         c.out.prepareCipherSpec(c.vers, serverCipher, serverHash)
 640
 641         return nil
 642 }
 643
 644 func (hs *serverHandshakeState) readFinished(out []byte) error {
 645         c := hs.c
 646
 647         if err := c.readChangeCipherSpec(); err != nil {
 648                 return err
 649         }
 650
 651         msg, err := c.readHandshake()
 652         if err != nil {
 653                 return err
 654         }
 655         clientFinished, ok := msg.(*finishedMsg)
 656         if !ok {
 657                 c.sendAlert(alertUnexpectedMessage)
 658                 return unexpectedMessageError(clientFinished, msg)
 659         }
 660
 661         verify := hs.finishedHash.clientSum(hs.masterSecret)
 662         if len(verify) != len(clientFinished.verifyData) ||
 663                 subtle.ConstantTimeCompare(verify, clientFinished.verifyData) != 1 {
 664                 c.sendAlert(alertHandshakeFailure)
 665                 return errors.New("tls: client's Finished message is incorrect")
 666         }
 667
 668         hs.finishedHash.Write(clientFinished.marshal())
 669         copy(out, verify)
 670         return nil
 671 }
 672
 673 func (hs *serverHandshakeState) sendSessionTicket() error {
 674         if !hs.hello.ticketSupported {
 675                 return nil
 676         }
 677
 678         c := hs.c
 679         m := new(newSessionTicketMsg)
 680
 681         var certsFromClient [][]byte
 682         for _, cert := range c.peerCertificates {
 683                 certsFromClient = append(certsFromClient, cert.Raw)
 684         }
 685         state := sessionState{
 686                 vers:         c.vers,
 687                 cipherSuite:  hs.suite.id,
 688                 masterSecret: hs.masterSecret,
 689                 certificates: certsFromClient,
 690         }
 691         var err error
 692         m.ticket, err = c.encryptTicket(state.marshal())
 693         if err != nil {
 694                 return err
 695         }
 696
 697         hs.finishedHash.Write(m.marshal())
 698         if _, err := c.writeRecord(recordTypeHandshake, m.marshal()); err != nil {
 699                 return err
 700         }
 701
 702         return nil
 703 }
 704
 705 func (hs *serverHandshakeState) sendFinished(out []byte) error {
 706         c := hs.c
 707
 708         if _, err := c.writeRecord(recordTypeChangeCipherSpec, []byte{1}); err != nil {
 709                 return err
 710         }
 711
 712         finished := new(finishedMsg)
 713         finished.verifyData = hs.finishedHash.serverSum(hs.masterSecret)
 714         hs.finishedHash.Write(finished.marshal())
 715         if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil {
 716                 return err
 717         }
 718
 719         c.cipherSuite = hs.suite.id
 720         copy(out, finished.verifyData)
 721
 722         return nil
 723 }
 724
 725 // processCertsFromClient takes a chain of client certificates either from a
 726 // Certificates message or from a sessionState and verifies them. It returns
 727 // the public key of the leaf certificate.
 728 func (c *Conn) processCertsFromClient(certificate Certificate) error {
 729         certificates := certificate.Certificate
 730         certs := make([]*x509.Certificate, len(certificates))
 731         var err error
 732         for i, asn1Data := range certificates {
 733                 if certs[i], err = x509.ParseCertificate(asn1Data); err != nil {
 734                         c.sendAlert(alertBadCertificate)
 735                         return errors.New("tls: failed to parse client certificate: " + err.Error())
 736                 }
 737         }
 738
 739         if len(certs) == 0 && requiresClientCert(c.config.ClientAuth) {
 740                 c.sendAlert(alertBadCertificate)
 741                 return errors.New("tls: client didn't provide a certificate")
 742         }
 743
 744         if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
 745                 opts := x509.VerifyOptions{
 746                         IsBoring: isBoringCertificate,
 747
 748                         Roots:         c.config.ClientCAs,
 749                         CurrentTime:   c.config.time(),
 750                         Intermediates: x509.NewCertPool(),
 751                         KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
 752                 }
 753
 754                 for _, cert := range certs[1:] {
 755                         opts.Intermediates.AddCert(cert)
 756                 }
 757
 758                 chains, err := certs[0].Verify(opts)
 759                 if err != nil {
 760                         c.sendAlert(alertBadCertificate)
 761                         return errors.New("tls: failed to verify client certificate: " + err.Error())
 762                 }
 763
 764                 c.verifiedChains = chains
 765         }
 766
 767         if c.config.VerifyPeerCertificate != nil {
 768                 if err := c.config.VerifyPeerCertificate(certificates, c.verifiedChains); err != nil {
 769                         c.sendAlert(alertBadCertificate)
 770                         return err
 771                 }
 772         }
 773
 774         if len(certs) == 0 {
 775                 return nil
 776         }
 777
 778         switch certs[0].PublicKey.(type) {
 779         case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
 780         default:
 781                 c.sendAlert(alertUnsupportedCertificate)
 782                 return fmt.Errorf("tls: client certificate contains an unsupported public key of type %T", certs[0].PublicKey)
 783         }
 784
 785         c.peerCertificates = certs
 786         c.ocspResponse = certificate.OCSPStaple
 787         c.scts = certificate.SignedCertificateTimestamps
 788         return nil
 789 }
 790
 791 func clientHelloInfo(c *Conn, clientHello *clientHelloMsg) *ClientHelloInfo {
 792         supportedVersions := clientHello.supportedVersions
 793         if len(clientHello.supportedVersions) == 0 {
 794                 supportedVersions = supportedVersionsFromMax(clientHello.vers)
 795         }
 796
 797         return &ClientHelloInfo{
 798                 CipherSuites:      clientHello.cipherSuites,
 799                 ServerName:        clientHello.serverName,
 800                 SupportedCurves:   clientHello.supportedCurves,
 801                 SupportedPoints:   clientHello.supportedPoints,
 802                 SignatureSchemes:  clientHello.supportedSignatureAlgorithms,
 803                 SupportedProtos:   clientHello.alpnProtocols,
 804                 SupportedVersions: supportedVersions,
 805                 Conn:              c.conn,
 806         }
 807 }