mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: select only compatible chains from Certificates

Browse source 
Now that we have a full implementation of the logic to check certificate
compatibility, we can let applications just list multiple chains in
Certificates (for example, an RSA and an ECDSA one) and choose the most
appropriate automatically.

NameToCertificate only maps each name to one chain, so simply deprecate
it, and while at it simplify its implementation by not stripping
trailing dots from the SNI (which is specified not to have any, see RFC
6066, Section 3) and by not supporting multi-level wildcards, which are
not a thing in the WebPKI (and in crypto/x509).

The performance of SupportsCertificate without Leaf is poor, but doesn't
affect current users. For now document that, and address it properly in
the next cycle. See #35504.

While cleaning up the Certificates/GetCertificate/GetConfigForClient
behavior, also support leaving Certificates/GetCertificate nil if
GetConfigForClient is set, and send unrecognized_name when there are no
available certificates.

Fixes #29139
Fixes #18377

Change-Id: I26604db48806fe4d608388e55da52f34b7ca4566
Reviewed-on: https://go-review.googlesource.com/c/go/+/205059
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
This commit is contained in:
Filippo Valsorda 2019-11-02 14:43:34 -04:00
parent 87d4ef8a3f
commit 0e7f9b3702
7 changed files with 82 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

24
handshake_server_test.go
View file

@ -8,6 +8,7 @@ import (
"bytes"
"crypto"
"crypto/elliptic"
"crypto/x509"
"encoding/pem"
"errors"
"fmt"
@ -1662,3 +1663,26 @@ T+E0J8wlH24pgwQHzy7Ko2qLwn1b5PW8ecrlvP1g
serverConfig.MaxVersion = VersionTLS12
testHandshake(t, testConfig, serverConfig)
}
func TestMultipleCertificates(t *testing.T) {
clientConfig := testConfig.Clone()
clientConfig.CipherSuites = []uint16{TLS_RSA_WITH_AES_128_GCM_SHA256}
clientConfig.MaxVersion = VersionTLS12
serverConfig := testConfig.Clone()
serverConfig.Certificates = []Certificate{{
Certificate: [][]byte{testECDSACertificate},
PrivateKey: testECDSAPrivateKey,
}, {
Certificate: [][]byte{testRSACertificate},
PrivateKey: testRSAPrivateKey,
}}
_, clientState, err := testHandshake(t, clientConfig, serverConfig)
if err != nil {
t.Fatal(err)
}
if got := clientState.PeerCertificates[0].PublicKeyAlgorithm; got != x509.RSA {
t.Errorf("expected RSA certificate, got %v", got)
}
}