Source file src/crypto/tls/handshake_client_tls13.go

Documentation: crypto/tls

     1  // Copyright 2018 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"bytes"
     9  	"context"
    10  	"crypto"
    11  	"crypto/hmac"
    12  	"crypto/rsa"
    13  	"errors"
    14  	"hash"
    15  	"sync/atomic"
    16  	"time"
    17  )
    18  
    19  type clientHandshakeStateTLS13 struct {
    20  	c           *Conn
    21  	ctx         context.Context
    22  	serverHello *serverHelloMsg
    23  	hello       *clientHelloMsg
    24  	ecdheParams ecdheParameters
    25  
    26  	session     *ClientSessionState
    27  	earlySecret []byte
    28  	binderKey   []byte
    29  
    30  	certReq       *certificateRequestMsgTLS13
    31  	usingPSK      bool
    32  	sentDummyCCS  bool
    33  	suite         *cipherSuiteTLS13
    34  	transcript    hash.Hash
    35  	masterSecret  []byte
    36  	trafficSecret []byte // client_application_traffic_secret_0
    37  }
    38  
    39  // handshake requires hs.c, hs.hello, hs.serverHello, hs.ecdheParams, and,
    40  // optionally, hs.session, hs.earlySecret and hs.binderKey to be set.
    41  func (hs *clientHandshakeStateTLS13) handshake() error {
    42  	c := hs.c
    43  
    44  	// The server must not select TLS 1.3 in a renegotiation. See RFC 8446,
    45  	// sections 4.1.2 and 4.1.3.
    46  	if c.handshakes > 0 {
    47  		c.sendAlert(alertProtocolVersion)
    48  		return errors.New("tls: server selected TLS 1.3 in a renegotiation")
    49  	}
    50  
    51  	// Consistency check on the presence of a keyShare and its parameters.
    52  	if hs.ecdheParams == nil || len(hs.hello.keyShares) != 1 {
    53  		return c.sendAlert(alertInternalError)
    54  	}
    55  
    56  	if err := hs.checkServerHelloOrHRR(); err != nil {
    57  		return err
    58  	}
    59  
    60  	hs.transcript = hs.suite.hash.New()
    61  	hs.transcript.Write(hs.hello.marshal())
    62  
    63  	if bytes.Equal(hs.serverHello.random, helloRetryRequestRandom) {
    64  		if err := hs.sendDummyChangeCipherSpec(); err != nil {
    65  			return err
    66  		}
    67  		if err := hs.processHelloRetryRequest(); err != nil {
    68  			return err
    69  		}
    70  	}
    71  
    72  	hs.transcript.Write(hs.serverHello.marshal())
    73  
    74  	c.buffering = true
    75  	if err := hs.processServerHello(); err != nil {
    76  		return err
    77  	}
    78  	if err := hs.sendDummyChangeCipherSpec(); err != nil {
    79  		return err
    80  	}
    81  	if err := hs.establishHandshakeKeys(); err != nil {
    82  		return err
    83  	}
    84  	if err := hs.readServerParameters(); err != nil {
    85  		return err
    86  	}
    87  	if err := hs.readServerCertificate(); err != nil {
    88  		return err
    89  	}
    90  	if err := hs.readServerFinished(); err != nil {
    91  		return err
    92  	}
    93  	if err := hs.sendClientCertificate(); err != nil {
    94  		return err
    95  	}
    96  	if err := hs.sendClientFinished(); err != nil {
    97  		return err
    98  	}
    99  	if _, err := c.flush(); err != nil {
   100  		return err
   101  	}
   102  
   103  	atomic.StoreUint32(&c.handshakeStatus, 1)
   104  
   105  	return nil
   106  }
   107  
   108  // checkServerHelloOrHRR does validity checks that apply to both ServerHello and
   109  // HelloRetryRequest messages. It sets hs.suite.
   110  func (hs *clientHandshakeStateTLS13) checkServerHelloOrHRR() error {
   111  	c := hs.c
   112  
   113  	if hs.serverHello.supportedVersion == 0 {
   114  		c.sendAlert(alertMissingExtension)
   115  		return errors.New("tls: server selected TLS 1.3 using the legacy version field")
   116  	}
   117  
   118  	if hs.serverHello.supportedVersion != VersionTLS13 {
   119  		c.sendAlert(alertIllegalParameter)
   120  		return errors.New("tls: server selected an invalid version after a HelloRetryRequest")
   121  	}
   122  
   123  	if hs.serverHello.vers != VersionTLS12 {
   124  		c.sendAlert(alertIllegalParameter)
   125  		return errors.New("tls: server sent an incorrect legacy version")
   126  	}
   127  
   128  	if hs.serverHello.ocspStapling ||
   129  		hs.serverHello.ticketSupported ||
   130  		hs.serverHello.secureRenegotiationSupported ||
   131  		len(hs.serverHello.secureRenegotiation) != 0 ||
   132  		len(hs.serverHello.alpnProtocol) != 0 ||
   133  		len(hs.serverHello.scts) != 0 {
   134  		c.sendAlert(alertUnsupportedExtension)
   135  		return errors.New("tls: server sent a ServerHello extension forbidden in TLS 1.3")
   136  	}
   137  
   138  	if !bytes.Equal(hs.hello.sessionId, hs.serverHello.sessionId) {
   139  		c.sendAlert(alertIllegalParameter)
   140  		return errors.New("tls: server did not echo the legacy session ID")
   141  	}
   142  
   143  	if hs.serverHello.compressionMethod != compressionNone {
   144  		c.sendAlert(alertIllegalParameter)
   145  		return errors.New("tls: server selected unsupported compression format")
   146  	}
   147  
   148  	selectedSuite := mutualCipherSuiteTLS13(hs.hello.cipherSuites, hs.serverHello.cipherSuite)
   149  	if hs.suite != nil && selectedSuite != hs.suite {
   150  		c.sendAlert(alertIllegalParameter)
   151  		return errors.New("tls: server changed cipher suite after a HelloRetryRequest")
   152  	}
   153  	if selectedSuite == nil {
   154  		c.sendAlert(alertIllegalParameter)
   155  		return errors.New("tls: server chose an unconfigured cipher suite")
   156  	}
   157  	hs.suite = selectedSuite
   158  	c.cipherSuite = hs.suite.id
   159  
   160  	return nil
   161  }
   162  
   163  // sendDummyChangeCipherSpec sends a ChangeCipherSpec record for compatibility
   164  // with middleboxes that didn't implement TLS correctly. See RFC 8446, Appendix D.4.
   165  func (hs *clientHandshakeStateTLS13) sendDummyChangeCipherSpec() error {
   166  	if hs.sentDummyCCS {
   167  		return nil
   168  	}
   169  	hs.sentDummyCCS = true
   170  
   171  	_, err := hs.c.writeRecord(recordTypeChangeCipherSpec, []byte{1})
   172  	return err
   173  }
   174  
   175  // processHelloRetryRequest handles the HRR in hs.serverHello, modifies and
   176  // resends hs.hello, and reads the new ServerHello into hs.serverHello.
   177  func (hs *clientHandshakeStateTLS13) processHelloRetryRequest() error {
   178  	c := hs.c
   179  
   180  	// The first ClientHello gets double-hashed into the transcript upon a
   181  	// HelloRetryRequest. (The idea is that the server might offload transcript
   182  	// storage to the client in the cookie.) See RFC 8446, Section 4.4.1.
   183  	chHash := hs.transcript.Sum(nil)
   184  	hs.transcript.Reset()
   185  	hs.transcript.Write([]byte{typeMessageHash, 0, 0, uint8(len(chHash))})
   186  	hs.transcript.Write(chHash)
   187  	hs.transcript.Write(hs.serverHello.marshal())
   188  
   189  	// The only HelloRetryRequest extensions we support are key_share and
   190  	// cookie, and clients must abort the handshake if the HRR would not result
   191  	// in any change in the ClientHello.
   192  	if hs.serverHello.selectedGroup == 0 && hs.serverHello.cookie == nil {
   193  		c.sendAlert(alertIllegalParameter)
   194  		return errors.New("tls: server sent an unnecessary HelloRetryRequest message")
   195  	}
   196  
   197  	if hs.serverHello.cookie != nil {
   198  		hs.hello.cookie = hs.serverHello.cookie
   199  	}
   200  
   201  	if hs.serverHello.serverShare.group != 0 {
   202  		c.sendAlert(alertDecodeError)
   203  		return errors.New("tls: received malformed key_share extension")
   204  	}
   205  
   206  	// If the server sent a key_share extension selecting a group, ensure it's
   207  	// a group we advertised but did not send a key share for, and send a key
   208  	// share for it this time.
   209  	if curveID := hs.serverHello.selectedGroup; curveID != 0 {
   210  		curveOK := false
   211  		for _, id := range hs.hello.supportedCurves {
   212  			if id == curveID {
   213  				curveOK = true
   214  				break
   215  			}
   216  		}
   217  		if !curveOK {
   218  			c.sendAlert(alertIllegalParameter)
   219  			return errors.New("tls: server selected unsupported group")
   220  		}
   221  		if hs.ecdheParams.CurveID() == curveID {
   222  			c.sendAlert(alertIllegalParameter)
   223  			return errors.New("tls: server sent an unnecessary HelloRetryRequest key_share")
   224  		}
   225  		if _, ok := curveForCurveID(curveID); curveID != X25519 && !ok {
   226  			c.sendAlert(alertInternalError)
   227  			return errors.New("tls: CurvePreferences includes unsupported curve")
   228  		}
   229  		params, err := generateECDHEParameters(c.config.rand(), curveID)
   230  		if err != nil {
   231  			c.sendAlert(alertInternalError)
   232  			return err
   233  		}
   234  		hs.ecdheParams = params
   235  		hs.hello.keyShares = []keyShare{{group: curveID, data: params.PublicKey()}}
   236  	}
   237  
   238  	hs.hello.raw = nil
   239  	if len(hs.hello.pskIdentities) > 0 {
   240  		pskSuite := cipherSuiteTLS13ByID(hs.session.cipherSuite)
   241  		if pskSuite == nil {
   242  			return c.sendAlert(alertInternalError)
   243  		}
   244  		if pskSuite.hash == hs.suite.hash {
   245  			// Update binders and obfuscated_ticket_age.
   246  			ticketAge := uint32(c.config.time().Sub(hs.session.receivedAt) / time.Millisecond)
   247  			hs.hello.pskIdentities[0].obfuscatedTicketAge = ticketAge + hs.session.ageAdd
   248  
   249  			transcript := hs.suite.hash.New()
   250  			transcript.Write([]byte{typeMessageHash, 0, 0, uint8(len(chHash))})
   251  			transcript.Write(chHash)
   252  			transcript.Write(hs.serverHello.marshal())
   253  			transcript.Write(hs.hello.marshalWithoutBinders())
   254  			pskBinders := [][]byte{hs.suite.finishedHash(hs.binderKey, transcript)}
   255  			hs.hello.updateBinders(pskBinders)
   256  		} else {
   257  			// Server selected a cipher suite incompatible with the PSK.
   258  			hs.hello.pskIdentities = nil
   259  			hs.hello.pskBinders = nil
   260  		}
   261  	}
   262  
   263  	hs.transcript.Write(hs.hello.marshal())
   264  	if _, err := c.writeRecord(recordTypeHandshake, hs.hello.marshal()); err != nil {
   265  		return err
   266  	}
   267  
   268  	msg, err := c.readHandshake()
   269  	if err != nil {
   270  		return err
   271  	}
   272  
   273  	serverHello, ok := msg.(*serverHelloMsg)
   274  	if !ok {
   275  		c.sendAlert(alertUnexpectedMessage)
   276  		return unexpectedMessageError(serverHello, msg)
   277  	}
   278  	hs.serverHello = serverHello
   279  
   280  	if err := hs.checkServerHelloOrHRR(); err != nil {
   281  		return err
   282  	}
   283  
   284  	return nil
   285  }
   286  
   287  func (hs *clientHandshakeStateTLS13) processServerHello() error {
   288  	c := hs.c
   289  
   290  	if bytes.Equal(hs.serverHello.random, helloRetryRequestRandom) {
   291  		c.sendAlert(alertUnexpectedMessage)
   292  		return errors.New("tls: server sent two HelloRetryRequest messages")
   293  	}
   294  
   295  	if len(hs.serverHello.cookie) != 0 {
   296  		c.sendAlert(alertUnsupportedExtension)
   297  		return errors.New("tls: server sent a cookie in a normal ServerHello")
   298  	}
   299  
   300  	if hs.serverHello.selectedGroup != 0 {
   301  		c.sendAlert(alertDecodeError)
   302  		return errors.New("tls: malformed key_share extension")
   303  	}
   304  
   305  	if hs.serverHello.serverShare.group == 0 {
   306  		c.sendAlert(alertIllegalParameter)
   307  		return errors.New("tls: server did not send a key share")
   308  	}
   309  	if hs.serverHello.serverShare.group != hs.ecdheParams.CurveID() {
   310  		c.sendAlert(alertIllegalParameter)
   311  		return errors.New("tls: server selected unsupported group")
   312  	}
   313  
   314  	if !hs.serverHello.selectedIdentityPresent {
   315  		return nil
   316  	}
   317  
   318  	if int(hs.serverHello.selectedIdentity) >= len(hs.hello.pskIdentities) {
   319  		c.sendAlert(alertIllegalParameter)
   320  		return errors.New("tls: server selected an invalid PSK")
   321  	}
   322  
   323  	if len(hs.hello.pskIdentities) != 1 || hs.session == nil {
   324  		return c.sendAlert(alertInternalError)
   325  	}
   326  	pskSuite := cipherSuiteTLS13ByID(hs.session.cipherSuite)
   327  	if pskSuite == nil {
   328  		return c.sendAlert(alertInternalError)
   329  	}
   330  	if pskSuite.hash != hs.suite.hash {
   331  		c.sendAlert(alertIllegalParameter)
   332  		return errors.New("tls: server selected an invalid PSK and cipher suite pair")
   333  	}
   334  
   335  	hs.usingPSK = true
   336  	c.didResume = true
   337  	c.peerCertificates = hs.session.serverCertificates
   338  	c.verifiedChains = hs.session.verifiedChains
   339  	c.ocspResponse = hs.session.ocspResponse
   340  	c.scts = hs.session.scts
   341  	return nil
   342  }
   343  
   344  func (hs *clientHandshakeStateTLS13) establishHandshakeKeys() error {
   345  	c := hs.c
   346  
   347  	sharedKey := hs.ecdheParams.SharedKey(hs.serverHello.serverShare.data)
   348  	if sharedKey == nil {
   349  		c.sendAlert(alertIllegalParameter)
   350  		return errors.New("tls: invalid server key share")
   351  	}
   352  
   353  	earlySecret := hs.earlySecret
   354  	if !hs.usingPSK {
   355  		earlySecret = hs.suite.extract(nil, nil)
   356  	}
   357  	handshakeSecret := hs.suite.extract(sharedKey,
   358  		hs.suite.deriveSecret(earlySecret, "derived", nil))
   359  
   360  	clientSecret := hs.suite.deriveSecret(handshakeSecret,
   361  		clientHandshakeTrafficLabel, hs.transcript)
   362  	c.out.setTrafficSecret(hs.suite, clientSecret)
   363  	serverSecret := hs.suite.deriveSecret(handshakeSecret,
   364  		serverHandshakeTrafficLabel, hs.transcript)
   365  	c.in.setTrafficSecret(hs.suite, serverSecret)
   366  
   367  	err := c.config.writeKeyLog(keyLogLabelClientHandshake, hs.hello.random, clientSecret)
   368  	if err != nil {
   369  		c.sendAlert(alertInternalError)
   370  		return err
   371  	}
   372  	err = c.config.writeKeyLog(keyLogLabelServerHandshake, hs.hello.random, serverSecret)
   373  	if err != nil {
   374  		c.sendAlert(alertInternalError)
   375  		return err
   376  	}
   377  
   378  	hs.masterSecret = hs.suite.extract(nil,
   379  		hs.suite.deriveSecret(handshakeSecret, "derived", nil))
   380  
   381  	return nil
   382  }
   383  
   384  func (hs *clientHandshakeStateTLS13) readServerParameters() error {
   385  	c := hs.c
   386  
   387  	msg, err := c.readHandshake()
   388  	if err != nil {
   389  		return err
   390  	}
   391  
   392  	encryptedExtensions, ok := msg.(*encryptedExtensionsMsg)
   393  	if !ok {
   394  		c.sendAlert(alertUnexpectedMessage)
   395  		return unexpectedMessageError(encryptedExtensions, msg)
   396  	}
   397  	hs.transcript.Write(encryptedExtensions.marshal())
   398  
   399  	if err := checkALPN(hs.hello.alpnProtocols, encryptedExtensions.alpnProtocol); err != nil {
   400  		c.sendAlert(alertUnsupportedExtension)
   401  		return err
   402  	}
   403  	c.clientProtocol = encryptedExtensions.alpnProtocol
   404  
   405  	return nil
   406  }
   407  
   408  func (hs *clientHandshakeStateTLS13) readServerCertificate() error {
   409  	c := hs.c
   410  
   411  	// Either a PSK or a certificate is always used, but not both.
   412  	// See RFC 8446, Section 4.1.1.
   413  	if hs.usingPSK {
   414  		// Make sure the connection is still being verified whether or not this
   415  		// is a resumption. Resumptions currently don't reverify certificates so
   416  		// they don't call verifyServerCertificate. See Issue 31641.
   417  		if c.config.VerifyConnection != nil {
   418  			if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
   419  				c.sendAlert(alertBadCertificate)
   420  				return err
   421  			}
   422  		}
   423  		return nil
   424  	}
   425  
   426  	msg, err := c.readHandshake()
   427  	if err != nil {
   428  		return err
   429  	}
   430  
   431  	certReq, ok := msg.(*certificateRequestMsgTLS13)
   432  	if ok {
   433  		hs.transcript.Write(certReq.marshal())
   434  
   435  		hs.certReq = certReq
   436  
   437  		msg, err = c.readHandshake()
   438  		if err != nil {
   439  			return err
   440  		}
   441  	}
   442  
   443  	certMsg, ok := msg.(*certificateMsgTLS13)
   444  	if !ok {
   445  		c.sendAlert(alertUnexpectedMessage)
   446  		return unexpectedMessageError(certMsg, msg)
   447  	}
   448  	if len(certMsg.certificate.Certificate) == 0 {
   449  		c.sendAlert(alertDecodeError)
   450  		return errors.New("tls: received empty certificates message")
   451  	}
   452  	hs.transcript.Write(certMsg.marshal())
   453  
   454  	c.scts = certMsg.certificate.SignedCertificateTimestamps
   455  	c.ocspResponse = certMsg.certificate.OCSPStaple
   456  
   457  	if err := c.verifyServerCertificate(certMsg.certificate.Certificate); err != nil {
   458  		return err
   459  	}
   460  
   461  	msg, err = c.readHandshake()
   462  	if err != nil {
   463  		return err
   464  	}
   465  
   466  	certVerify, ok := msg.(*certificateVerifyMsg)
   467  	if !ok {
   468  		c.sendAlert(alertUnexpectedMessage)
   469  		return unexpectedMessageError(certVerify, msg)
   470  	}
   471  
   472  	// See RFC 8446, Section 4.4.3.
   473  	if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, supportedSignatureAlgorithms) {
   474  		c.sendAlert(alertIllegalParameter)
   475  		return errors.New("tls: certificate used with invalid signature algorithm")
   476  	}
   477  	sigType, sigHash, err := typeAndHashFromSignatureScheme(certVerify.signatureAlgorithm)
   478  	if err != nil {
   479  		return c.sendAlert(alertInternalError)
   480  	}
   481  	if sigType == signaturePKCS1v15 || sigHash == crypto.SHA1 {
   482  		c.sendAlert(alertIllegalParameter)
   483  		return errors.New("tls: certificate used with invalid signature algorithm")
   484  	}
   485  	signed := signedMessage(sigHash, serverSignatureContext, hs.transcript)
   486  	if err := verifyHandshakeSignature(sigType, c.peerCertificates[0].PublicKey,
   487  		sigHash, signed, certVerify.signature); err != nil {
   488  		c.sendAlert(alertDecryptError)
   489  		return errors.New("tls: invalid signature by the server certificate: " + err.Error())
   490  	}
   491  
   492  	hs.transcript.Write(certVerify.marshal())
   493  
   494  	return nil
   495  }
   496  
   497  func (hs *clientHandshakeStateTLS13) readServerFinished() error {
   498  	c := hs.c
   499  
   500  	msg, err := c.readHandshake()
   501  	if err != nil {
   502  		return err
   503  	}
   504  
   505  	finished, ok := msg.(*finishedMsg)
   506  	if !ok {
   507  		c.sendAlert(alertUnexpectedMessage)
   508  		return unexpectedMessageError(finished, msg)
   509  	}
   510  
   511  	expectedMAC := hs.suite.finishedHash(c.in.trafficSecret, hs.transcript)
   512  	if !hmac.Equal(expectedMAC, finished.verifyData) {
   513  		c.sendAlert(alertDecryptError)
   514  		return errors.New("tls: invalid server finished hash")
   515  	}
   516  
   517  	hs.transcript.Write(finished.marshal())
   518  
   519  	// Derive secrets that take context through the server Finished.
   520  
   521  	hs.trafficSecret = hs.suite.deriveSecret(hs.masterSecret,
   522  		clientApplicationTrafficLabel, hs.transcript)
   523  	serverSecret := hs.suite.deriveSecret(hs.masterSecret,
   524  		serverApplicationTrafficLabel, hs.transcript)
   525  	c.in.setTrafficSecret(hs.suite, serverSecret)
   526  
   527  	err = c.config.writeKeyLog(keyLogLabelClientTraffic, hs.hello.random, hs.trafficSecret)
   528  	if err != nil {
   529  		c.sendAlert(alertInternalError)
   530  		return err
   531  	}
   532  	err = c.config.writeKeyLog(keyLogLabelServerTraffic, hs.hello.random, serverSecret)
   533  	if err != nil {
   534  		c.sendAlert(alertInternalError)
   535  		return err
   536  	}
   537  
   538  	c.ekm = hs.suite.exportKeyingMaterial(hs.masterSecret, hs.transcript)
   539  
   540  	return nil
   541  }
   542  
   543  func (hs *clientHandshakeStateTLS13) sendClientCertificate() error {
   544  	c := hs.c
   545  
   546  	if hs.certReq == nil {
   547  		return nil
   548  	}
   549  
   550  	cert, err := c.getClientCertificate(&CertificateRequestInfo{
   551  		AcceptableCAs:    hs.certReq.certificateAuthorities,
   552  		SignatureSchemes: hs.certReq.supportedSignatureAlgorithms,
   553  		Version:          c.vers,
   554  		ctx:              hs.ctx,
   555  	})
   556  	if err != nil {
   557  		return err
   558  	}
   559  
   560  	certMsg := new(certificateMsgTLS13)
   561  
   562  	certMsg.certificate = *cert
   563  	certMsg.scts = hs.certReq.scts && len(cert.SignedCertificateTimestamps) > 0
   564  	certMsg.ocspStapling = hs.certReq.ocspStapling && len(cert.OCSPStaple) > 0
   565  
   566  	hs.transcript.Write(certMsg.marshal())
   567  	if _, err := c.writeRecord(recordTypeHandshake, certMsg.marshal()); err != nil {
   568  		return err
   569  	}
   570  
   571  	// If we sent an empty certificate message, skip the CertificateVerify.
   572  	if len(cert.Certificate) == 0 {
   573  		return nil
   574  	}
   575  
   576  	certVerifyMsg := new(certificateVerifyMsg)
   577  	certVerifyMsg.hasSignatureAlgorithm = true
   578  
   579  	certVerifyMsg.signatureAlgorithm, err = selectSignatureScheme(c.vers, cert, hs.certReq.supportedSignatureAlgorithms)
   580  	if err != nil {
   581  		// getClientCertificate returned a certificate incompatible with the
   582  		// CertificateRequestInfo supported signature algorithms.
   583  		c.sendAlert(alertHandshakeFailure)
   584  		return err
   585  	}
   586  
   587  	sigType, sigHash, err := typeAndHashFromSignatureScheme(certVerifyMsg.signatureAlgorithm)
   588  	if err != nil {
   589  		return c.sendAlert(alertInternalError)
   590  	}
   591  
   592  	signed := signedMessage(sigHash, clientSignatureContext, hs.transcript)
   593  	signOpts := crypto.SignerOpts(sigHash)
   594  	if sigType == signatureRSAPSS {
   595  		signOpts = &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: sigHash}
   596  	}
   597  	sig, err := cert.PrivateKey.(crypto.Signer).Sign(c.config.rand(), signed, signOpts)
   598  	if err != nil {
   599  		c.sendAlert(alertInternalError)
   600  		return errors.New("tls: failed to sign handshake: " + err.Error())
   601  	}
   602  	certVerifyMsg.signature = sig
   603  
   604  	hs.transcript.Write(certVerifyMsg.marshal())
   605  	if _, err := c.writeRecord(recordTypeHandshake, certVerifyMsg.marshal()); err != nil {
   606  		return err
   607  	}
   608  
   609  	return nil
   610  }
   611  
   612  func (hs *clientHandshakeStateTLS13) sendClientFinished() error {
   613  	c := hs.c
   614  
   615  	finished := &finishedMsg{
   616  		verifyData: hs.suite.finishedHash(c.out.trafficSecret, hs.transcript),
   617  	}
   618  
   619  	hs.transcript.Write(finished.marshal())
   620  	if _, err := c.writeRecord(recordTypeHandshake, finished.marshal()); err != nil {
   621  		return err
   622  	}
   623  
   624  	c.out.setTrafficSecret(hs.suite, hs.trafficSecret)
   625  
   626  	if !c.config.SessionTicketsDisabled && c.config.ClientSessionCache != nil {
   627  		c.resumptionSecret = hs.suite.deriveSecret(hs.masterSecret,
   628  			resumptionLabel, hs.transcript)
   629  	}
   630  
   631  	return nil
   632  }
   633  
   634  func (c *Conn) handleNewSessionTicket(msg *newSessionTicketMsgTLS13) error {
   635  	if !c.isClient {
   636  		c.sendAlert(alertUnexpectedMessage)
   637  		return errors.New("tls: received new session ticket from a client")
   638  	}
   639  
   640  	if c.config.SessionTicketsDisabled || c.config.ClientSessionCache == nil {
   641  		return nil
   642  	}
   643  
   644  	// See RFC 8446, Section 4.6.1.
   645  	if msg.lifetime == 0 {
   646  		return nil
   647  	}
   648  	lifetime := time.Duration(msg.lifetime) * time.Second
   649  	if lifetime > maxSessionTicketLifetime {
   650  		c.sendAlert(alertIllegalParameter)
   651  		return errors.New("tls: received a session ticket with invalid lifetime")
   652  	}
   653  
   654  	cipherSuite := cipherSuiteTLS13ByID(c.cipherSuite)
   655  	if cipherSuite == nil || c.resumptionSecret == nil {
   656  		return c.sendAlert(alertInternalError)
   657  	}
   658  
   659  	// Save the resumption_master_secret and nonce instead of deriving the PSK
   660  	// to do the least amount of work on NewSessionTicket messages before we
   661  	// know if the ticket will be used. Forward secrecy of resumed connections
   662  	// is guaranteed by the requirement for pskModeDHE.
   663  	session := &ClientSessionState{
   664  		sessionTicket:      msg.label,
   665  		vers:               c.vers,
   666  		cipherSuite:        c.cipherSuite,
   667  		masterSecret:       c.resumptionSecret,
   668  		serverCertificates: c.peerCertificates,
   669  		verifiedChains:     c.verifiedChains,
   670  		receivedAt:         c.config.time(),
   671  		nonce:              msg.nonce,
   672  		useBy:              c.config.time().Add(lifetime),
   673  		ageAdd:             msg.ageAdd,
   674  		ocspResponse:       c.ocspResponse,
   675  		scts:               c.scts,
   676  	}
   677  
   678  	cacheKey := clientSessionCacheKey(c.conn.RemoteAddr(), c.config)
   679  	c.config.ClientSessionCache.Put(cacheKey, session)
   680  
   681  	return nil
   682  }
   683  

View as plain text