Source file src/crypto/tls/handshake_server.go

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"context"
     9  	"crypto"
    10  	"crypto/ecdsa"
    11  	"crypto/ed25519"
    12  	"crypto/mldsa"
    13  	"crypto/rsa"
    14  	"crypto/subtle"
    15  	"crypto/tls/internal/fips140tls"
    16  	"crypto/x509"
    17  	"errors"
    18  	"fmt"
    19  	"hash"
    20  	"io"
    21  	"time"
    22  )
    23  
    24  // serverHandshakeState contains details of a server handshake in progress.
    25  // It's discarded once the handshake has completed.
    26  type serverHandshakeState struct {
    27  	c            *Conn
    28  	ctx          context.Context
    29  	clientHello  *clientHelloMsg
    30  	hello        *serverHelloMsg
    31  	suite        *cipherSuite
    32  	ecdheOk      bool
    33  	ecSignOk     bool
    34  	rsaDecryptOk bool
    35  	rsaSignOk    bool
    36  	sessionState *SessionState
    37  	finishedHash finishedHash
    38  	masterSecret []byte
    39  	cert         *Certificate
    40  }
    41  
    42  // serverHandshake performs a TLS handshake as a server.
    43  func (c *Conn) serverHandshake(ctx context.Context) error {
    44  	clientHello, ech, err := c.readClientHello(ctx)
    45  	if err != nil {
    46  		return err
    47  	}
    48  
    49  	if c.vers == VersionTLS13 {
    50  		hs := serverHandshakeStateTLS13{
    51  			c:           c,
    52  			ctx:         ctx,
    53  			clientHello: clientHello,
    54  			echContext:  ech,
    55  		}
    56  		return hs.handshake()
    57  	}
    58  
    59  	hs := serverHandshakeState{
    60  		c:           c,
    61  		ctx:         ctx,
    62  		clientHello: clientHello,
    63  	}
    64  	return hs.handshake()
    65  }
    66  
    67  func (hs *serverHandshakeState) handshake() error {
    68  	c := hs.c
    69  
    70  	if err := hs.processClientHello(); err != nil {
    71  		return err
    72  	}
    73  
    74  	// For an overview of TLS handshaking, see RFC 5246, Section 7.3.
    75  	c.buffering = true
    76  	if err := hs.checkForResumption(); err != nil {
    77  		return err
    78  	}
    79  	if hs.sessionState != nil {
    80  		// The client has included a session ticket and so we do an abbreviated handshake.
    81  		if err := hs.doResumeHandshake(); err != nil {
    82  			return err
    83  		}
    84  		if err := hs.establishKeys(); err != nil {
    85  			return err
    86  		}
    87  		if err := hs.sendSessionTicket(); err != nil {
    88  			return err
    89  		}
    90  		if err := hs.sendFinished(c.serverFinished[:]); err != nil {
    91  			return err
    92  		}
    93  		if _, err := c.flush(); err != nil {
    94  			return err
    95  		}
    96  		c.clientFinishedIsFirst = false
    97  		if err := hs.readFinished(nil); err != nil {
    98  			return err
    99  		}
   100  	} else {
   101  		// The client didn't include a session ticket, or it wasn't
   102  		// valid so we do a full handshake.
   103  		if err := hs.pickCipherSuite(); err != nil {
   104  			return err
   105  		}
   106  		if err := hs.doFullHandshake(); err != nil {
   107  			return err
   108  		}
   109  		if err := hs.establishKeys(); err != nil {
   110  			return err
   111  		}
   112  		if err := hs.readFinished(c.clientFinished[:]); err != nil {
   113  			return err
   114  		}
   115  		c.clientFinishedIsFirst = true
   116  		c.buffering = true
   117  		if err := hs.sendSessionTicket(); err != nil {
   118  			return err
   119  		}
   120  		if err := hs.sendFinished(nil); err != nil {
   121  			return err
   122  		}
   123  		if _, err := c.flush(); err != nil {
   124  			return err
   125  		}
   126  	}
   127  
   128  	c.ekm = ekmFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random)
   129  	c.isHandshakeComplete.Store(true)
   130  
   131  	return nil
   132  }
   133  
   134  // readClientHello reads a ClientHello message and selects the protocol version.
   135  func (c *Conn) readClientHello(ctx context.Context) (*clientHelloMsg, *echServerContext, error) {
   136  	// clientHelloMsg is included in the transcript, but we haven't initialized
   137  	// it yet. The respective handshake functions will record it themselves.
   138  	msg, err := c.readHandshake(nil)
   139  	if err != nil {
   140  		return nil, nil, err
   141  	}
   142  	clientHello, ok := msg.(*clientHelloMsg)
   143  	if !ok {
   144  		c.sendAlert(alertUnexpectedMessage)
   145  		return nil, nil, unexpectedMessageError(clientHello, msg)
   146  	}
   147  
   148  	// ECH processing has to be done before we do any other negotiation based on
   149  	// the contents of the client hello, since we may swap it out completely.
   150  	var ech *echServerContext
   151  	if len(clientHello.encryptedClientHello) != 0 {
   152  		echKeys := c.config.EncryptedClientHelloKeys
   153  		if c.config.GetEncryptedClientHelloKeys != nil {
   154  			echKeys, err = c.config.GetEncryptedClientHelloKeys(clientHelloInfo(ctx, c, clientHello))
   155  			if err != nil {
   156  				c.sendAlert(alertInternalError)
   157  				return nil, nil, err
   158  			}
   159  		}
   160  		clientHello, ech, err = c.processECHClientHello(clientHello, echKeys)
   161  		if err != nil {
   162  			return nil, nil, err
   163  		}
   164  	}
   165  
   166  	var configForClient *Config
   167  	originalConfig := c.config
   168  	if c.config.GetConfigForClient != nil {
   169  		chi := clientHelloInfo(ctx, c, clientHello)
   170  		if configForClient, err = c.config.GetConfigForClient(chi); err != nil {
   171  			c.sendAlert(alertInternalError)
   172  			return nil, nil, err
   173  		} else if configForClient != nil {
   174  			c.config = configForClient
   175  		}
   176  	}
   177  	c.ticketKeys = originalConfig.ticketKeys(configForClient)
   178  
   179  	clientVersions := clientHello.supportedVersions
   180  	if clientHello.vers >= VersionTLS13 && len(clientVersions) == 0 {
   181  		// RFC 8446 4.2.1 indicates when the supported_versions extension is not sent,
   182  		// compatible servers MUST negotiate TLS 1.2 or earlier if supported, even
   183  		// if the client legacy version is TLS 1.3 or later.
   184  		//
   185  		// Since we reject empty extensionSupportedVersions in the client hello unmarshal
   186  		// finding the supportedVersions empty indicates the extension was not present.
   187  		clientVersions = supportedVersionsFromMax(VersionTLS12)
   188  	} else if len(clientVersions) == 0 {
   189  		clientVersions = supportedVersionsFromMax(clientHello.vers)
   190  	}
   191  	c.vers, ok = c.config.mutualVersion(roleServer, c.quic != nil, clientVersions)
   192  	if !ok {
   193  		c.sendAlert(alertProtocolVersion)
   194  		return nil, nil, fmt.Errorf("tls: client offered only unsupported versions: %x", clientVersions)
   195  	}
   196  	c.haveVers = true
   197  	c.in.version = c.vers
   198  	c.out.version = c.vers
   199  
   200  	// This check reflects some odd specification implied behavior. Client-facing servers
   201  	// are supposed to reject hellos with outer ECH and inner ECH that offers 1.2, but
   202  	// backend servers are allowed to accept hellos with inner ECH that offer 1.2, since
   203  	// they cannot expect client-facing servers to behave properly. Since we act as both
   204  	// a client-facing and backend server, we only enforce 1.3 being negotiated if we
   205  	// saw a hello with outer ECH first. The spec probably should've made this an error,
   206  	// but it didn't, and this matches the boringssl behavior.
   207  	if c.vers != VersionTLS13 && (ech != nil && !ech.inner) {
   208  		c.sendAlert(alertIllegalParameter)
   209  		return nil, nil, errors.New("tls: Encrypted Client Hello cannot be used pre-TLS 1.3")
   210  	}
   211  
   212  	return clientHello, ech, nil
   213  }
   214  
   215  func (hs *serverHandshakeState) processClientHello() error {
   216  	c := hs.c
   217  
   218  	hs.hello = new(serverHelloMsg)
   219  	hs.hello.vers = c.vers
   220  
   221  	foundCompression := false
   222  	// We only support null compression, so check that the client offered it.
   223  	for _, compression := range hs.clientHello.compressionMethods {
   224  		if compression == compressionNone {
   225  			foundCompression = true
   226  			break
   227  		}
   228  	}
   229  
   230  	if !foundCompression {
   231  		c.sendAlert(alertIllegalParameter)
   232  		return errors.New("tls: client does not support uncompressed connections")
   233  	}
   234  
   235  	hs.hello.random = make([]byte, 32)
   236  	serverRandom := hs.hello.random
   237  	// Downgrade protection canaries. See RFC 8446, Section 4.1.3.
   238  	maxVers := c.config.maxSupportedVersion(roleServer, c.quic != nil)
   239  	if maxVers >= VersionTLS12 && c.vers < maxVers || testingOnlyForceDowngradeCanary {
   240  		if c.vers == VersionTLS12 {
   241  			copy(serverRandom[24:], downgradeCanaryTLS12)
   242  		} else {
   243  			copy(serverRandom[24:], downgradeCanaryTLS11)
   244  		}
   245  		serverRandom = serverRandom[:24]
   246  	}
   247  	_, err := io.ReadFull(c.config.rand(), serverRandom)
   248  	if err != nil {
   249  		c.sendAlert(alertInternalError)
   250  		return err
   251  	}
   252  
   253  	if len(hs.clientHello.secureRenegotiation) != 0 {
   254  		c.sendAlert(alertHandshakeFailure)
   255  		return errors.New("tls: initial handshake had non-empty renegotiation extension")
   256  	}
   257  
   258  	hs.hello.extendedMasterSecret = hs.clientHello.extendedMasterSecret
   259  	hs.hello.secureRenegotiationSupported = hs.clientHello.secureRenegotiationSupported
   260  	hs.hello.compressionMethod = compressionNone
   261  	if len(hs.clientHello.serverName) > 0 {
   262  		c.serverName = hs.clientHello.serverName
   263  	}
   264  
   265  	selectedProto, err := negotiateALPN(c.config.NextProtos, hs.clientHello.alpnProtocols, false)
   266  	if err != nil {
   267  		c.sendAlert(alertNoApplicationProtocol)
   268  		return err
   269  	}
   270  	hs.hello.alpnProtocol = selectedProto
   271  	c.clientProtocol = selectedProto
   272  
   273  	hs.cert, err = c.config.getCertificate(clientHelloInfo(hs.ctx, c, hs.clientHello))
   274  	if err != nil {
   275  		if err == errNoCertificates {
   276  			c.sendAlert(alertUnrecognizedName)
   277  		} else {
   278  			c.sendAlert(alertInternalError)
   279  		}
   280  		return err
   281  	}
   282  
   283  	if hs.clientHello.scts {
   284  		hs.hello.scts = hs.cert.SignedCertificateTimestamps
   285  	}
   286  
   287  	hs.ecdheOk, err = supportsECDHE(c.config, c.vers, hs.clientHello.supportedCurves, hs.clientHello.supportedPoints)
   288  	if err != nil {
   289  		c.sendAlert(alertMissingExtension)
   290  		return err
   291  	}
   292  
   293  	if hs.ecdheOk && len(hs.clientHello.supportedPoints) > 0 {
   294  		// Although omitting the ec_point_formats extension is permitted, some
   295  		// old OpenSSL version will refuse to handshake if not present.
   296  		//
   297  		// Per RFC 4492, section 5.1.2, implementations MUST support the
   298  		// uncompressed point format. See golang.org/issue/31943.
   299  		hs.hello.supportedPoints = []uint8{pointFormatUncompressed}
   300  	}
   301  
   302  	if priv, ok := hs.cert.PrivateKey.(crypto.Signer); ok {
   303  		switch priv.Public().(type) {
   304  		case *ecdsa.PublicKey:
   305  			hs.ecSignOk = true
   306  		case ed25519.PublicKey:
   307  			hs.ecSignOk = true
   308  		case *rsa.PublicKey:
   309  			hs.rsaSignOk = true
   310  		case *mldsa.PublicKey:
   311  			// ML-DSA can only be used with TLS 1.3.
   312  			c.sendAlert(alertInternalError)
   313  			return fmt.Errorf("tls: ML-DSA certificates require TLS 1.3, but client negotiated %s",
   314  				VersionName(c.vers))
   315  		default:
   316  			c.sendAlert(alertInternalError)
   317  			return fmt.Errorf("tls: unsupported signing key type (%T)", priv.Public())
   318  		}
   319  	}
   320  	if priv, ok := hs.cert.PrivateKey.(crypto.Decrypter); ok {
   321  		switch priv.Public().(type) {
   322  		case *rsa.PublicKey:
   323  			hs.rsaDecryptOk = true
   324  		default:
   325  			c.sendAlert(alertInternalError)
   326  			return fmt.Errorf("tls: unsupported decryption key type (%T)", priv.Public())
   327  		}
   328  	}
   329  
   330  	return nil
   331  }
   332  
   333  // negotiateALPN picks a shared ALPN protocol that both sides support in server
   334  // preference order. If ALPN is not configured or the peer doesn't support it,
   335  // it returns "" and no error.
   336  func negotiateALPN(serverProtos, clientProtos []string, quic bool) (string, error) {
   337  	if len(serverProtos) == 0 || len(clientProtos) == 0 {
   338  		if quic && len(serverProtos) != 0 {
   339  			// RFC 9001, Section 8.1
   340  			return "", fmt.Errorf("tls: client did not request an application protocol")
   341  		}
   342  		return "", nil
   343  	}
   344  	var http11fallback bool
   345  	for _, s := range serverProtos {
   346  		for _, c := range clientProtos {
   347  			if s == c {
   348  				return s, nil
   349  			}
   350  			if s == "h2" && c == "http/1.1" {
   351  				http11fallback = true
   352  			}
   353  		}
   354  	}
   355  	// As a special case, let http/1.1 clients connect to h2 servers as if they
   356  	// didn't support ALPN. We used not to enforce protocol overlap, so over
   357  	// time a number of HTTP servers were configured with only "h2", but
   358  	// expected to accept connections from "http/1.1" clients. See Issue 46310.
   359  	if http11fallback {
   360  		return "", nil
   361  	}
   362  	return "", fmt.Errorf("tls: client requested unsupported application protocols (%q)", clientProtos)
   363  }
   364  
   365  // supportsECDHE returns whether ECDHE key exchanges can be used with this
   366  // pre-TLS 1.3 client.
   367  func supportsECDHE(c *Config, version uint16, supportedCurves []CurveID, supportedPoints []uint8) (bool, error) {
   368  	supportsCurve := false
   369  	for _, curve := range supportedCurves {
   370  		if c.supportsCurve(version, curve) {
   371  			supportsCurve = true
   372  			break
   373  		}
   374  	}
   375  
   376  	supportsPointFormat := false
   377  	offeredNonCompressedFormat := false
   378  	for _, pointFormat := range supportedPoints {
   379  		if pointFormat == pointFormatUncompressed {
   380  			supportsPointFormat = true
   381  		} else {
   382  			offeredNonCompressedFormat = true
   383  		}
   384  	}
   385  	// Per RFC 8422, Section 5.1.2, if the Supported Point Formats extension is
   386  	// missing, uncompressed points are supported. If supportedPoints is empty,
   387  	// the extension must be missing, as an empty extension body is rejected by
   388  	// the parser. See https://go.dev/issue/49126.
   389  	if len(supportedPoints) == 0 {
   390  		supportsPointFormat = true
   391  	} else if offeredNonCompressedFormat && !supportsPointFormat {
   392  		return false, errors.New("tls: client offered only incompatible point formats")
   393  	}
   394  
   395  	return supportsCurve && supportsPointFormat, nil
   396  }
   397  
   398  func (hs *serverHandshakeState) pickCipherSuite() error {
   399  	c := hs.c
   400  
   401  	preferenceList := c.config.cipherSuites(isAESGCMPreferred(hs.clientHello.cipherSuites))
   402  
   403  	hs.suite = selectCipherSuite(preferenceList, hs.clientHello.cipherSuites, hs.cipherSuiteOk)
   404  	if hs.suite == nil {
   405  		c.sendAlert(alertHandshakeFailure)
   406  		return fmt.Errorf("tls: no cipher suite supported by both client and server; client offered: %x",
   407  			hs.clientHello.cipherSuites)
   408  	}
   409  	c.cipherSuite = hs.suite.id
   410  
   411  	for _, id := range hs.clientHello.cipherSuites {
   412  		if id == TLS_FALLBACK_SCSV {
   413  			// The client is doing a fallback connection. See RFC 7507.
   414  			if hs.clientHello.vers < c.config.maxSupportedVersion(roleServer, c.quic != nil) {
   415  				c.sendAlert(alertInappropriateFallback)
   416  				return errors.New("tls: client using inappropriate protocol fallback")
   417  			}
   418  			break
   419  		}
   420  	}
   421  
   422  	return nil
   423  }
   424  
   425  func (hs *serverHandshakeState) cipherSuiteOk(c *cipherSuite) bool {
   426  	if c.flags&suiteECDHE != 0 {
   427  		if !hs.ecdheOk {
   428  			return false
   429  		}
   430  		if c.flags&suiteECSign != 0 {
   431  			if !hs.ecSignOk {
   432  				return false
   433  			}
   434  		} else if !hs.rsaSignOk {
   435  			return false
   436  		}
   437  	} else if !hs.rsaDecryptOk {
   438  		return false
   439  	}
   440  	if hs.c.vers < VersionTLS12 && c.flags&suiteTLS12 != 0 {
   441  		return false
   442  	}
   443  	return true
   444  }
   445  
   446  // checkForResumption reports whether we should perform resumption on this connection.
   447  func (hs *serverHandshakeState) checkForResumption() error {
   448  	c := hs.c
   449  
   450  	if c.config.SessionTicketsDisabled {
   451  		return nil
   452  	}
   453  
   454  	var sessionState *SessionState
   455  	if c.config.UnwrapSession != nil {
   456  		ss, err := c.config.UnwrapSession(hs.clientHello.sessionTicket, c.connectionStateLocked())
   457  		if err != nil {
   458  			return err
   459  		}
   460  		if ss == nil {
   461  			return nil
   462  		}
   463  		sessionState = ss
   464  	} else {
   465  		plaintext := c.config.decryptTicket(hs.clientHello.sessionTicket, c.ticketKeys)
   466  		if plaintext == nil {
   467  			return nil
   468  		}
   469  		ss, err := ParseSessionState(plaintext)
   470  		if err != nil {
   471  			return nil
   472  		}
   473  		sessionState = ss
   474  	}
   475  
   476  	// TLS 1.2 tickets don't natively have a lifetime, but we want to avoid
   477  	// re-wrapping the same master secret in different tickets over and over for
   478  	// too long, weakening forward secrecy.
   479  	createdAt := time.Unix(int64(sessionState.createdAt), 0)
   480  	if c.config.time().Sub(createdAt) > maxSessionTicketLifetime {
   481  		return nil
   482  	}
   483  
   484  	// Never resume a session for a different TLS version.
   485  	if c.vers != sessionState.version {
   486  		return nil
   487  	}
   488  
   489  	cipherSuiteOk := false
   490  	// Check that the client is still offering the ciphersuite in the session.
   491  	for _, id := range hs.clientHello.cipherSuites {
   492  		if id == sessionState.cipherSuite {
   493  			cipherSuiteOk = true
   494  			break
   495  		}
   496  	}
   497  	if !cipherSuiteOk {
   498  		return nil
   499  	}
   500  
   501  	// Check that we also support the ciphersuite from the session.
   502  	suite := selectCipherSuite([]uint16{sessionState.cipherSuite},
   503  		c.config.supportedCipherSuites(), hs.cipherSuiteOk)
   504  	if suite == nil {
   505  		return nil
   506  	}
   507  
   508  	sessionHasClientCerts := len(sessionState.peerCertificates) != 0
   509  	needClientCerts := requiresClientCert(c.config.ClientAuth)
   510  	if needClientCerts && !sessionHasClientCerts {
   511  		return nil
   512  	}
   513  	if sessionHasClientCerts && c.config.ClientAuth == NoClientCert {
   514  		return nil
   515  	}
   516  	if sessionHasClientCerts && c.config.time().After(sessionState.peerCertificates[0].NotAfter) {
   517  		return nil
   518  	}
   519  	opts := x509.VerifyOptions{
   520  		CurrentTime: c.config.time(),
   521  		Roots:       c.config.ClientCAs,
   522  		KeyUsages:   []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
   523  	}
   524  	if sessionHasClientCerts && c.config.ClientAuth >= VerifyClientCertIfGiven &&
   525  		!anyValidVerifiedChain(sessionState.verifiedChains, opts) {
   526  		return nil
   527  	}
   528  
   529  	// RFC 7627, Section 5.3
   530  	if !sessionState.extMasterSecret && hs.clientHello.extendedMasterSecret {
   531  		return nil
   532  	}
   533  	if sessionState.extMasterSecret && !hs.clientHello.extendedMasterSecret {
   534  		// Aborting is somewhat harsh, but it's a MUST and it would indicate a
   535  		// weird downgrade in client capabilities.
   536  		return errors.New("tls: session supported extended_master_secret but client does not")
   537  	}
   538  	if !sessionState.extMasterSecret && fips140tls.Required() {
   539  		if fips140ems.Value() != "0" {
   540  			// FIPS 140-3 requires the use of Extended Master Secret.
   541  			return nil
   542  		}
   543  		fips140ems.IncNonDefault()
   544  	}
   545  
   546  	c.peerCertificates = sessionState.peerCertificates
   547  	c.ocspResponse = sessionState.ocspResponse
   548  	c.scts = sessionState.scts
   549  	c.verifiedChains = sessionState.verifiedChains
   550  	c.extMasterSecret = sessionState.extMasterSecret
   551  	hs.sessionState = sessionState
   552  	hs.suite = suite
   553  	c.curveID = sessionState.curveID
   554  	c.didResume = true
   555  	return nil
   556  }
   557  
   558  func (hs *serverHandshakeState) doResumeHandshake() error {
   559  	c := hs.c
   560  
   561  	hs.hello.cipherSuite = hs.suite.id
   562  	c.cipherSuite = hs.suite.id
   563  	// We echo the client's session ID in the ServerHello to let it know
   564  	// that we're doing a resumption.
   565  	hs.hello.sessionId = hs.clientHello.sessionId
   566  	// We always send a new session ticket, even if it wraps the same master
   567  	// secret and it's potentially encrypted with the same key, to help the
   568  	// client avoid cross-connection tracking from a network observer.
   569  	hs.hello.ticketSupported = true
   570  	hs.finishedHash = newFinishedHash(c.vers, hs.suite)
   571  	hs.finishedHash.discardHandshakeBuffer()
   572  	if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
   573  		return err
   574  	}
   575  	if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
   576  		return err
   577  	}
   578  
   579  	if c.config.VerifyConnection != nil {
   580  		if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
   581  			c.sendAlert(alertBadCertificate)
   582  			return err
   583  		}
   584  	}
   585  
   586  	hs.masterSecret = hs.sessionState.secret
   587  
   588  	return nil
   589  }
   590  
   591  func (hs *serverHandshakeState) doFullHandshake() error {
   592  	c := hs.c
   593  
   594  	if hs.clientHello.ocspStapling && len(hs.cert.OCSPStaple) > 0 {
   595  		hs.hello.ocspStapling = true
   596  	}
   597  
   598  	if hs.clientHello.serverName != "" {
   599  		hs.hello.serverNameAck = true
   600  	}
   601  
   602  	hs.hello.ticketSupported = hs.clientHello.ticketSupported && !c.config.SessionTicketsDisabled
   603  	hs.hello.cipherSuite = hs.suite.id
   604  
   605  	hs.finishedHash = newFinishedHash(hs.c.vers, hs.suite)
   606  	if c.config.ClientAuth == NoClientCert {
   607  		// No need to keep a full record of the handshake if client
   608  		// certificates won't be used.
   609  		hs.finishedHash.discardHandshakeBuffer()
   610  	}
   611  	if err := transcriptMsg(hs.clientHello, &hs.finishedHash); err != nil {
   612  		return err
   613  	}
   614  	if _, err := hs.c.writeHandshakeRecord(hs.hello, &hs.finishedHash); err != nil {
   615  		return err
   616  	}
   617  
   618  	certMsg := new(certificateMsg)
   619  	certMsg.certificates = hs.cert.Certificate
   620  	// Set localCertificate here, rather than at certificate selection time, so
   621  	// that it is only populated when a certificate is actually presented to the
   622  	// peer, and not on resumed connections.
   623  	c.localCertificate = hs.cert.Certificate
   624  	if _, err := hs.c.writeHandshakeRecord(certMsg, &hs.finishedHash); err != nil {
   625  		return err
   626  	}
   627  
   628  	if hs.hello.ocspStapling {
   629  		certStatus := new(certificateStatusMsg)
   630  		certStatus.response = hs.cert.OCSPStaple
   631  		if _, err := hs.c.writeHandshakeRecord(certStatus, &hs.finishedHash); err != nil {
   632  			return err
   633  		}
   634  	}
   635  
   636  	keyAgreement := hs.suite.ka(c.vers)
   637  	skx, err := keyAgreement.generateServerKeyExchange(c.config, hs.cert, hs.clientHello, hs.hello)
   638  	if err != nil {
   639  		c.sendAlert(alertHandshakeFailure)
   640  		return err
   641  	}
   642  	if skx != nil {
   643  		if keyAgreement, ok := keyAgreement.(*ecdheKeyAgreement); ok {
   644  			c.curveID = keyAgreement.curveID
   645  			c.peerSigAlg = keyAgreement.signatureAlgorithm
   646  		}
   647  		if _, err := hs.c.writeHandshakeRecord(skx, &hs.finishedHash); err != nil {
   648  			return err
   649  		}
   650  	}
   651  
   652  	var certReq *certificateRequestMsg
   653  	if c.config.ClientAuth >= RequestClientCert {
   654  		// Request a client certificate
   655  		certReq = new(certificateRequestMsg)
   656  		certReq.certificateTypes = []byte{
   657  			byte(certTypeRSASign),
   658  			byte(certTypeECDSASign),
   659  		}
   660  		if c.vers >= VersionTLS12 {
   661  			certReq.hasSignatureAlgorithm = true
   662  			certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms(c.vers, c.vers)
   663  		}
   664  
   665  		// An empty list of certificateAuthorities signals to
   666  		// the client that it may send any certificate in response
   667  		// to our request. When we know the CAs we trust, then
   668  		// we can send them down, so that the client can choose
   669  		// an appropriate certificate to give to us.
   670  		if c.config.ClientCAs != nil {
   671  			certReq.certificateAuthorities = c.config.ClientCAs.Subjects()
   672  		}
   673  		if _, err := hs.c.writeHandshakeRecord(certReq, &hs.finishedHash); err != nil {
   674  			return err
   675  		}
   676  	}
   677  
   678  	helloDone := new(serverHelloDoneMsg)
   679  	if _, err := hs.c.writeHandshakeRecord(helloDone, &hs.finishedHash); err != nil {
   680  		return err
   681  	}
   682  
   683  	if _, err := c.flush(); err != nil {
   684  		return err
   685  	}
   686  
   687  	var pub crypto.PublicKey // public key for client auth, if any
   688  
   689  	msg, err := c.readHandshake(&hs.finishedHash)
   690  	if err != nil {
   691  		return err
   692  	}
   693  
   694  	// If we requested a client certificate, then the client must send a
   695  	// certificate message, even if it's empty.
   696  	if c.config.ClientAuth >= RequestClientCert {
   697  		certMsg, ok := msg.(*certificateMsg)
   698  		if !ok {
   699  			c.sendAlert(alertUnexpectedMessage)
   700  			return unexpectedMessageError(certMsg, msg)
   701  		}
   702  
   703  		if err := c.processCertsFromClient(Certificate{
   704  			Certificate: certMsg.certificates,
   705  		}); err != nil {
   706  			return err
   707  		}
   708  		if len(certMsg.certificates) != 0 {
   709  			pub = c.peerCertificates[0].PublicKey
   710  		}
   711  
   712  		msg, err = c.readHandshake(&hs.finishedHash)
   713  		if err != nil {
   714  			return err
   715  		}
   716  	}
   717  	if c.config.VerifyConnection != nil {
   718  		if err := c.config.VerifyConnection(c.connectionStateLocked()); err != nil {
   719  			c.sendAlert(alertBadCertificate)
   720  			return err
   721  		}
   722  	}
   723  
   724  	// Get client key exchange
   725  	ckx, ok := msg.(*clientKeyExchangeMsg)
   726  	if !ok {
   727  		c.sendAlert(alertUnexpectedMessage)
   728  		return unexpectedMessageError(ckx, msg)
   729  	}
   730  
   731  	preMasterSecret, err := keyAgreement.processClientKeyExchange(c.config, hs.cert, ckx, c.vers)
   732  	if err != nil {
   733  		c.sendAlert(alertIllegalParameter)
   734  		return err
   735  	}
   736  	if hs.hello.extendedMasterSecret {
   737  		c.extMasterSecret = true
   738  		hs.masterSecret = extMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
   739  			hs.finishedHash.Sum())
   740  	} else {
   741  		if fips140tls.Required() {
   742  			if fips140ems.Value() != "0" {
   743  				c.sendAlert(alertHandshakeFailure)
   744  				return errors.New("tls: FIPS 140-3 requires the use of Extended Master Secret")
   745  			}
   746  			fips140ems.IncNonDefault()
   747  		}
   748  		hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret,
   749  			hs.clientHello.random, hs.hello.random)
   750  	}
   751  	if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.clientHello.random, hs.masterSecret); err != nil {
   752  		c.sendAlert(alertInternalError)
   753  		return err
   754  	}
   755  
   756  	// If we received a client cert in response to our certificate request message,
   757  	// the client will send us a certificateVerifyMsg immediately after the
   758  	// clientKeyExchangeMsg. This message is a digest of all preceding
   759  	// handshake-layer messages that is signed using the private key corresponding
   760  	// to the client's certificate. This allows us to verify that the client is in
   761  	// possession of the private key of the certificate.
   762  	if len(c.peerCertificates) > 0 {
   763  		// certificateVerifyMsg is included in the transcript, but not until
   764  		// after we verify the handshake signature, since the state before
   765  		// this message was sent is used.
   766  		msg, err = c.readHandshake(nil)
   767  		if err != nil {
   768  			return err
   769  		}
   770  		certVerify, ok := msg.(*certificateVerifyMsg)
   771  		if !ok {
   772  			c.sendAlert(alertUnexpectedMessage)
   773  			return unexpectedMessageError(certVerify, msg)
   774  		}
   775  
   776  		var sigType uint8
   777  		var sigHash crypto.Hash
   778  		if c.vers >= VersionTLS12 {
   779  			if !isSupportedSignatureAlgorithm(certVerify.signatureAlgorithm, certReq.supportedSignatureAlgorithms) {
   780  				c.sendAlert(alertIllegalParameter)
   781  				return errors.New("tls: client certificate used with invalid signature algorithm")
   782  			}
   783  			sigType, sigHash, err = typeAndHashFromSignatureScheme(certVerify.signatureAlgorithm)
   784  			if err != nil {
   785  				return c.sendAlert(alertInternalError)
   786  			}
   787  			if sigHash == crypto.SHA1 {
   788  				tlssha1.Value() // ensure godebug is initialized
   789  				tlssha1.IncNonDefault()
   790  			}
   791  			if hs.finishedHash.buffer == nil {
   792  				c.sendAlert(alertInternalError)
   793  				return errors.New("tls: internal error: did not keep handshake transcript for TLS 1.2")
   794  			}
   795  			if err := verifyHandshakeSignature(sigType, pub, sigHash, hs.finishedHash.buffer, certVerify.signature); err != nil {
   796  				c.sendAlert(alertDecryptError)
   797  				return errors.New("tls: invalid signature by the client certificate: " + err.Error())
   798  			}
   799  		} else {
   800  			sigType, sigHash, err = legacyTypeAndHashFromPublicKey(pub)
   801  			if err != nil {
   802  				c.sendAlert(alertIllegalParameter)
   803  				return err
   804  			}
   805  			signed := hs.finishedHash.hashForClientCertificate(sigType)
   806  			if err := verifyLegacyHandshakeSignature(sigType, pub, sigHash, signed, certVerify.signature); err != nil {
   807  				c.sendAlert(alertDecryptError)
   808  				return errors.New("tls: invalid signature by the client certificate: " + err.Error())
   809  			}
   810  		}
   811  
   812  		c.peerSigAlg = certVerify.signatureAlgorithm
   813  
   814  		if err := transcriptMsg(certVerify, &hs.finishedHash); err != nil {
   815  			return err
   816  		}
   817  	}
   818  
   819  	hs.finishedHash.discardHandshakeBuffer()
   820  
   821  	return nil
   822  }
   823  
   824  func (hs *serverHandshakeState) establishKeys() error {
   825  	c := hs.c
   826  
   827  	clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
   828  		keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.clientHello.random, hs.hello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
   829  
   830  	var clientCipher, serverCipher any
   831  	var clientHash, serverHash hash.Hash
   832  
   833  	if hs.suite.aead == nil {
   834  		clientCipher = hs.suite.cipher(clientKey, clientIV, true /* for reading */)
   835  		clientHash = hs.suite.mac(clientMAC)
   836  		serverCipher = hs.suite.cipher(serverKey, serverIV, false /* not for reading */)
   837  		serverHash = hs.suite.mac(serverMAC)
   838  	} else {
   839  		clientCipher = hs.suite.aead(clientKey, clientIV)
   840  		serverCipher = hs.suite.aead(serverKey, serverIV)
   841  	}
   842  
   843  	c.in.prepareCipherSpec(c.vers, clientCipher, clientHash)
   844  	c.out.prepareCipherSpec(c.vers, serverCipher, serverHash)
   845  
   846  	return nil
   847  }
   848  
   849  func (hs *serverHandshakeState) readFinished(out []byte) error {
   850  	c := hs.c
   851  
   852  	if err := c.readChangeCipherSpec(); err != nil {
   853  		return err
   854  	}
   855  
   856  	// finishedMsg is included in the transcript, but not until after we
   857  	// check the client version, since the state before this message was
   858  	// sent is used during verification.
   859  	msg, err := c.readHandshake(nil)
   860  	if err != nil {
   861  		return err
   862  	}
   863  	clientFinished, ok := msg.(*finishedMsg)
   864  	if !ok {
   865  		c.sendAlert(alertUnexpectedMessage)
   866  		return unexpectedMessageError(clientFinished, msg)
   867  	}
   868  
   869  	verify := hs.finishedHash.clientSum(hs.masterSecret)
   870  	if len(verify) != len(clientFinished.verifyData) ||
   871  		subtle.ConstantTimeCompare(verify, clientFinished.verifyData) != 1 {
   872  		c.sendAlert(alertHandshakeFailure)
   873  		return errors.New("tls: client's Finished message is incorrect")
   874  	}
   875  
   876  	if err := transcriptMsg(clientFinished, &hs.finishedHash); err != nil {
   877  		return err
   878  	}
   879  
   880  	copy(out, verify)
   881  	return nil
   882  }
   883  
   884  func (hs *serverHandshakeState) sendSessionTicket() error {
   885  	if !hs.hello.ticketSupported {
   886  		return nil
   887  	}
   888  
   889  	c := hs.c
   890  	m := new(newSessionTicketMsg)
   891  
   892  	state := c.sessionState()
   893  	state.secret = hs.masterSecret
   894  	if hs.sessionState != nil {
   895  		// If this is re-wrapping an old key, then keep
   896  		// the original time it was created.
   897  		state.createdAt = hs.sessionState.createdAt
   898  	}
   899  	if c.config.WrapSession != nil {
   900  		var err error
   901  		m.ticket, err = c.config.WrapSession(c.connectionStateLocked(), state)
   902  		if err != nil {
   903  			return err
   904  		}
   905  	} else {
   906  		stateBytes, err := state.Bytes()
   907  		if err != nil {
   908  			return err
   909  		}
   910  		m.ticket, err = c.config.encryptTicket(stateBytes, c.ticketKeys)
   911  		if err != nil {
   912  			return err
   913  		}
   914  	}
   915  
   916  	if _, err := hs.c.writeHandshakeRecord(m, &hs.finishedHash); err != nil {
   917  		return err
   918  	}
   919  
   920  	return nil
   921  }
   922  
   923  func (hs *serverHandshakeState) sendFinished(out []byte) error {
   924  	c := hs.c
   925  
   926  	if err := c.writeChangeCipherRecord(); err != nil {
   927  		return err
   928  	}
   929  
   930  	finished := new(finishedMsg)
   931  	finished.verifyData = hs.finishedHash.serverSum(hs.masterSecret)
   932  	if _, err := hs.c.writeHandshakeRecord(finished, &hs.finishedHash); err != nil {
   933  		return err
   934  	}
   935  
   936  	copy(out, finished.verifyData)
   937  
   938  	return nil
   939  }
   940  
   941  // processCertsFromClient takes a chain of client certificates either from a
   942  // certificateMsg message or a certificateMsgTLS13 message and verifies them.
   943  func (c *Conn) processCertsFromClient(certificate Certificate) error {
   944  	certificates := certificate.Certificate
   945  	certs := make([]*x509.Certificate, len(certificates))
   946  	var err error
   947  	for i, asn1Data := range certificates {
   948  		if certs[i], err = x509.ParseCertificate(asn1Data); err != nil {
   949  			c.sendAlert(alertDecodeError)
   950  			return errors.New("tls: failed to parse client certificate: " + err.Error())
   951  		}
   952  		if certs[i].PublicKeyAlgorithm == x509.RSA {
   953  			n := certs[i].PublicKey.(*rsa.PublicKey).N.BitLen()
   954  			if max, ok := checkKeySize(n); !ok {
   955  				c.sendAlert(alertBadCertificate)
   956  				return fmt.Errorf("tls: client sent certificate containing RSA key larger than %d bits", max)
   957  			}
   958  		}
   959  	}
   960  
   961  	if len(certs) == 0 && requiresClientCert(c.config.ClientAuth) {
   962  		if c.vers == VersionTLS13 {
   963  			c.sendAlert(alertCertificateRequired)
   964  		} else {
   965  			c.sendAlert(alertHandshakeFailure)
   966  		}
   967  		return errors.New("tls: client didn't provide a certificate")
   968  	}
   969  
   970  	if c.config.ClientAuth >= VerifyClientCertIfGiven && len(certs) > 0 {
   971  		opts := x509.VerifyOptions{
   972  			Roots:         c.config.ClientCAs,
   973  			CurrentTime:   c.config.time(),
   974  			Intermediates: x509.NewCertPool(),
   975  			KeyUsages:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
   976  		}
   977  
   978  		for _, cert := range certs[1:] {
   979  			opts.Intermediates.AddCert(cert)
   980  		}
   981  
   982  		chains, err := certs[0].Verify(opts)
   983  		if err != nil {
   984  			if _, ok := errors.AsType[x509.UnknownAuthorityError](err); ok {
   985  				c.sendAlert(alertUnknownCA)
   986  			} else if errCertificateInvalid, ok := errors.AsType[x509.CertificateInvalidError](err); ok && errCertificateInvalid.Reason == x509.Expired {
   987  				c.sendAlert(alertCertificateExpired)
   988  			} else {
   989  				c.sendAlert(alertBadCertificate)
   990  			}
   991  			return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
   992  		}
   993  
   994  		c.verifiedChains, err = fipsAllowedChains(chains)
   995  		if err != nil {
   996  			c.sendAlert(alertBadCertificate)
   997  			return &CertificateVerificationError{UnverifiedCertificates: certs, Err: err}
   998  		}
   999  	}
  1000  
  1001  	c.peerCertificates = certs
  1002  	c.ocspResponse = certificate.OCSPStaple
  1003  	c.scts = certificate.SignedCertificateTimestamps
  1004  
  1005  	if len(certs) > 0 {
  1006  		switch certs[0].PublicKey.(type) {
  1007  		case *ecdsa.PublicKey, *rsa.PublicKey, ed25519.PublicKey:
  1008  		case *mldsa.PublicKey:
  1009  			if c.vers < VersionTLS13 {
  1010  				c.sendAlert(alertIllegalParameter)
  1011  				return errors.New("tls: client certificate uses ML-DSA, which requires TLS 1.3")
  1012  			}
  1013  		default:
  1014  			c.sendAlert(alertUnsupportedCertificate)
  1015  			return fmt.Errorf("tls: client certificate contains an unsupported public key of type %T", certs[0].PublicKey)
  1016  		}
  1017  	}
  1018  
  1019  	if c.config.VerifyPeerCertificate != nil {
  1020  		if err := c.config.VerifyPeerCertificate(certificates, c.verifiedChains); err != nil {
  1021  			c.sendAlert(alertBadCertificate)
  1022  			return err
  1023  		}
  1024  	}
  1025  
  1026  	return nil
  1027  }
  1028  
  1029  func clientHelloInfo(ctx context.Context, c *Conn, clientHello *clientHelloMsg) *ClientHelloInfo {
  1030  	supportedVersions := clientHello.supportedVersions
  1031  	if len(clientHello.supportedVersions) == 0 {
  1032  		supportedVersions = supportedVersionsFromMax(clientHello.vers)
  1033  	}
  1034  
  1035  	conn := c.conn
  1036  	if c.quic != nil {
  1037  		conn = c.quic.clientHelloInfoConn
  1038  	}
  1039  	return &ClientHelloInfo{
  1040  		CipherSuites:      clientHello.cipherSuites,
  1041  		ServerName:        clientHello.serverName,
  1042  		SupportedCurves:   clientHello.supportedCurves,
  1043  		SupportedPoints:   clientHello.supportedPoints,
  1044  		SignatureSchemes:  clientHello.supportedSignatureAlgorithms,
  1045  		SupportedProtos:   clientHello.alpnProtocols,
  1046  		SupportedVersions: supportedVersions,
  1047  		Extensions:        clientHello.extensions,
  1048  		Conn:              conn,
  1049  		HelloRetryRequest: c.didHRR,
  1050  		config:            c.config,
  1051  		isQUIC:            c.quic != nil,
  1052  		ctx:               ctx,
  1053  	}
  1054  }
  1055  

View as plain text