mirror of
https://github.com/refraction-networking/utls.git
synced 2025-04-04 20:47:36 +03:00
Merge TLS 1.3 from upstream
uTLS not adapted to this change yet, uTLS changes will be in a separate commmit.
This commit is contained in:
Sergey Frolov
commit
23b79cad14
132 changed files with 14748 additions and 5407 deletions
391
common.go
391
common.go
|
|
@ -27,17 +27,16 @@ const (
|
|||
VersionTLS10 = 0x0301
|
||||
VersionTLS11 = 0x0302
|
||||
VersionTLS12 = 0x0303
|
||||
VersionTLS13 = 0x0304
|
||||
)
|
||||
|
||||
const (
|
||||
maxPlaintext = 16384 // maximum plaintext payload length
|
||||
maxCiphertext = 16384 + 2048 // maximum ciphertext payload length
|
||||
recordHeaderLen = 5 // record header length
|
||||
maxHandshake = 65536 // maximum handshake we support (protocol max is 16 MB)
|
||||
maxWarnAlertCount = 5 // maximum number of consecutive warning alerts
|
||||
|
||||
minVersion = VersionTLS10
|
||||
maxVersion = VersionTLS12
|
||||
maxPlaintext = 16384 // maximum plaintext payload length
|
||||
maxCiphertext = 16384 + 2048 // maximum ciphertext payload length
|
||||
maxCiphertextTLS13 = 16384 + 256 // maximum ciphertext length in TLS 1.3
|
||||
recordHeaderLen = 5 // record header length
|
||||
maxHandshake = 65536 // maximum handshake we support (protocol max is 16 MB)
|
||||
maxUselessRecords = 16 // maximum number of consecutive non-advancing records
|
||||
)
|
||||
|
||||
// TLS record types.
|
||||
|
|
@ -52,19 +51,23 @@ const (
|
|||
|
||||
// TLS handshake message types.
|
||||
const (
|
||||
typeHelloRequest uint8 = 0
|
||||
typeClientHello uint8 = 1
|
||||
typeServerHello uint8 = 2
|
||||
typeNewSessionTicket uint8 = 4
|
||||
typeCertificate uint8 = 11
|
||||
typeServerKeyExchange uint8 = 12
|
||||
typeCertificateRequest uint8 = 13
|
||||
typeServerHelloDone uint8 = 14
|
||||
typeCertificateVerify uint8 = 15
|
||||
typeClientKeyExchange uint8 = 16
|
||||
typeFinished uint8 = 20
|
||||
typeCertificateStatus uint8 = 22
|
||||
typeNextProtocol uint8 = 67 // Not IANA assigned
|
||||
typeHelloRequest uint8 = 0
|
||||
typeClientHello uint8 = 1
|
||||
typeServerHello uint8 = 2
|
||||
typeNewSessionTicket uint8 = 4
|
||||
typeEndOfEarlyData uint8 = 5
|
||||
typeEncryptedExtensions uint8 = 8
|
||||
typeCertificate uint8 = 11
|
||||
typeServerKeyExchange uint8 = 12
|
||||
typeCertificateRequest uint8 = 13
|
||||
typeServerHelloDone uint8 = 14
|
||||
typeCertificateVerify uint8 = 15
|
||||
typeClientKeyExchange uint8 = 16
|
||||
typeFinished uint8 = 20
|
||||
typeCertificateStatus uint8 = 22
|
||||
typeKeyUpdate uint8 = 24
|
||||
typeNextProtocol uint8 = 67 // Not IANA assigned
|
||||
typeMessageHash uint8 = 254 // synthetic message
|
||||
)
|
||||
|
||||
// TLS compression types.
|
||||
|
|
@ -74,16 +77,24 @@ const (
|
|||
|
||||
// TLS extension numbers
|
||||
const (
|
||||
extensionServerName uint16 = 0
|
||||
extensionStatusRequest uint16 = 5
|
||||
extensionSupportedCurves uint16 = 10
|
||||
extensionSupportedPoints uint16 = 11
|
||||
extensionSignatureAlgorithms uint16 = 13
|
||||
extensionALPN uint16 = 16
|
||||
extensionSCT uint16 = 18 // https://tools.ietf.org/html/rfc6962#section-6
|
||||
extensionSessionTicket uint16 = 35
|
||||
extensionNextProtoNeg uint16 = 13172 // not IANA assigned
|
||||
extensionRenegotiationInfo uint16 = 0xff01
|
||||
extensionServerName uint16 = 0
|
||||
extensionStatusRequest uint16 = 5
|
||||
extensionSupportedCurves uint16 = 10 // supported_groups in TLS 1.3, see RFC 8446, Section 4.2.7
|
||||
extensionSupportedPoints uint16 = 11
|
||||
extensionSignatureAlgorithms uint16 = 13
|
||||
extensionALPN uint16 = 16
|
||||
extensionSCT uint16 = 18
|
||||
extensionSessionTicket uint16 = 35
|
||||
extensionPreSharedKey uint16 = 41
|
||||
extensionEarlyData uint16 = 42
|
||||
extensionSupportedVersions uint16 = 43
|
||||
extensionCookie uint16 = 44
|
||||
extensionPSKModes uint16 = 45
|
||||
extensionCertificateAuthorities uint16 = 47
|
||||
extensionSignatureAlgorithmsCert uint16 = 50
|
||||
extensionKeyShare uint16 = 51
|
||||
extensionNextProtoNeg uint16 = 13172 // not IANA assigned
|
||||
extensionRenegotiationInfo uint16 = 0xff01
|
||||
)
|
||||
|
||||
// TLS signaling cipher suite values
|
||||
|
|
@ -92,7 +103,10 @@ const (
|
|||
)
|
||||
|
||||
// CurveID is the type of a TLS identifier for an elliptic curve. See
|
||||
// https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8
|
||||
// https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-8.
|
||||
//
|
||||
// In TLS 1.3, this type is called NamedGroup, but at this time this library
|
||||
// only supports Elliptic Curve based groups. See RFC 8446, Section 4.2.7.
|
||||
type CurveID uint16
|
||||
|
||||
const (
|
||||
|
|
@ -102,6 +116,25 @@ const (
|
|||
X25519 CurveID = 29
|
||||
)
|
||||
|
||||
// TLS 1.3 Key Share. See RFC 8446, Section 4.2.8.
|
||||
type keyShare struct {
|
||||
group CurveID
|
||||
data []byte
|
||||
}
|
||||
|
||||
// TLS 1.3 PSK Key Exchange Modes. See RFC 8446, Section 4.2.9.
|
||||
const (
|
||||
pskModePlain uint8 = 0
|
||||
pskModeDHE uint8 = 1
|
||||
)
|
||||
|
||||
// TLS 1.3 PSK Identity. Can be a Session Ticket, or a reference to a saved
|
||||
// session. See RFC 8446, Section 4.2.11.
|
||||
type pskIdentity struct {
|
||||
label []byte
|
||||
obfuscatedTicketAge uint32
|
||||
}
|
||||
|
||||
// TLS Elliptic Curve Point Formats
|
||||
// https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-9
|
||||
const (
|
||||
|
|
@ -115,30 +148,26 @@ const (
|
|||
|
||||
// Certificate types (for certificateRequestMsg)
|
||||
const (
|
||||
certTypeRSASign = 1 // A certificate containing an RSA key
|
||||
certTypeDSSSign = 2 // A certificate containing a DSA key
|
||||
certTypeRSAFixedDH = 3 // A certificate containing a static DH key
|
||||
certTypeDSSFixedDH = 4 // A certificate containing a static DH key
|
||||
|
||||
// See RFC 4492 sections 3 and 5.5.
|
||||
certTypeECDSASign = 64 // A certificate containing an ECDSA-capable public key, signed with ECDSA.
|
||||
certTypeRSAFixedECDH = 65 // A certificate containing an ECDH-capable public key, signed with RSA.
|
||||
certTypeECDSAFixedECDH = 66 // A certificate containing an ECDH-capable public key, signed with ECDSA.
|
||||
|
||||
// Rest of these are reserved by the TLS spec
|
||||
certTypeRSASign = 1
|
||||
certTypeECDSASign = 64 // RFC 4492, Section 5.5
|
||||
)
|
||||
|
||||
// Signature algorithms for TLS 1.2 (See RFC 5246, section A.4.1)
|
||||
// Signature algorithms (for internal signaling use). Starting at 16 to avoid overlap with
|
||||
// TLS 1.2 codepoints (RFC 5246, Appendix A.4.1), with which these have nothing to do.
|
||||
const (
|
||||
signatureRSA uint8 = 1
|
||||
signatureECDSA uint8 = 3
|
||||
signaturePKCS1v15 uint8 = iota + 16
|
||||
signatureECDSA
|
||||
signatureRSAPSS
|
||||
)
|
||||
|
||||
// SupportedSignatureAlgorithms contains the signature and hash algorithms that
|
||||
// supportedSignatureAlgorithms contains the signature and hash algorithms that
|
||||
// the code advertises as supported in a TLS 1.2 ClientHello and in a TLS 1.2
|
||||
// CertificateRequest. The two fields are merged to match with TLS 1.3.
|
||||
// Note that in TLS 1.2, the ECDSA algorithms are not constrained to P-256, etc.
|
||||
var supportedSignatureAlgorithms = []SignatureScheme{
|
||||
PSSWithSHA256,
|
||||
PSSWithSHA384,
|
||||
PSSWithSHA512,
|
||||
PKCS1WithSHA256,
|
||||
ECDSAWithP256AndSHA256,
|
||||
PKCS1WithSHA384,
|
||||
|
|
@ -149,6 +178,23 @@ var supportedSignatureAlgorithms = []SignatureScheme{
|
|||
ECDSAWithSHA1,
|
||||
}
|
||||
|
||||
// helloRetryRequestRandom is set as the Random value of a ServerHello
|
||||
// to signal that the message is actually a HelloRetryRequest.
|
||||
var helloRetryRequestRandom = []byte{ // See RFC 8446, Section 4.1.3.
|
||||
0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11,
|
||||
0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
|
||||
0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E,
|
||||
0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33, 0x9C,
|
||||
}
|
||||
|
||||
const (
|
||||
// downgradeCanaryTLS12 or downgradeCanaryTLS11 is embedded in the server
|
||||
// random as a downgrade protection if the server would be capable of
|
||||
// negotiating a higher version. See RFC 8446, Section 4.1.3.
|
||||
downgradeCanaryTLS12 = "DOWNGRD\x01"
|
||||
downgradeCanaryTLS11 = "DOWNGRD\x00"
|
||||
)
|
||||
|
||||
// ConnectionState records basic TLS details about the connection.
|
||||
type ConnectionState struct {
|
||||
Version uint16 // TLS version used by the connection (e.g. VersionTLS12)
|
||||
|
|
@ -160,24 +206,29 @@ type ConnectionState struct {
|
|||
ServerName string // server name requested by client, if any (server side only)
|
||||
PeerCertificates []*x509.Certificate // certificate chain presented by remote peer
|
||||
VerifiedChains [][]*x509.Certificate // verified chains built from PeerCertificates
|
||||
SignedCertificateTimestamps [][]byte // SCTs from the server, if any
|
||||
OCSPResponse []byte // stapled OCSP response from server, if any
|
||||
SignedCertificateTimestamps [][]byte // SCTs from the peer, if any
|
||||
OCSPResponse []byte // stapled OCSP response from peer, if any
|
||||
|
||||
// ExportKeyMaterial returns length bytes of exported key material as
|
||||
// defined in https://tools.ietf.org/html/rfc5705. If context is nil, it is
|
||||
// not used as part of the seed. If Config.Renegotiation was set to allow
|
||||
// renegotiation, this function will always return nil, false.
|
||||
ExportKeyingMaterial func(label string, context []byte, length int) ([]byte, bool)
|
||||
// ekm is a closure exposed via ExportKeyingMaterial.
|
||||
ekm func(label string, context []byte, length int) ([]byte, error)
|
||||
|
||||
// TLSUnique contains the "tls-unique" channel binding value (see RFC
|
||||
// 5929, section 3). For resumed sessions this value will be nil
|
||||
// because resumption does not include enough context (see
|
||||
// https://mitls.org/pages/attacks/3SHAKE#channelbindings). This will
|
||||
// change in future versions of Go once the TLS master-secret fix has
|
||||
// been standardized and implemented.
|
||||
// been standardized and implemented. It is not defined in TLS 1.3.
|
||||
TLSUnique []byte
|
||||
}
|
||||
|
||||
// ExportKeyingMaterial returns length bytes of exported key material in a new
|
||||
// slice as defined in RFC 5705. If context is nil, it is not used as part of
|
||||
// the seed. If the connection was set to allow renegotiation via
|
||||
// Config.Renegotiation, this function will return an error.
|
||||
func (cs *ConnectionState) ExportKeyingMaterial(label string, context []byte, length int) ([]byte, error) {
|
||||
return cs.ekm(label, context, length)
|
||||
}
|
||||
|
||||
// ClientAuthType declares the policy the server will follow for
|
||||
// TLS Client Authentication.
|
||||
type ClientAuthType int
|
||||
|
|
@ -190,33 +241,54 @@ const (
|
|||
RequireAndVerifyClientCert
|
||||
)
|
||||
|
||||
// requiresClientCert returns whether the ClientAuthType requires a client
|
||||
// certificate to be provided.
|
||||
func requiresClientCert(c ClientAuthType) bool {
|
||||
switch c {
|
||||
case RequireAnyClientCert, RequireAndVerifyClientCert:
|
||||
return true
|
||||
default:
|
||||
return false
|
||||
}
|
||||
}
|
||||
|
||||
// ClientSessionState contains the state needed by clients to resume TLS
|
||||
// sessions.
|
||||
type ClientSessionState struct {
|
||||
sessionTicket []uint8 // Encrypted ticket used for session resumption with server
|
||||
vers uint16 // SSL/TLS version negotiated for the session
|
||||
cipherSuite uint16 // Ciphersuite negotiated for the session
|
||||
masterSecret []byte // MasterSecret generated by client on a full handshake
|
||||
masterSecret []byte // Full handshake MasterSecret, or TLS 1.3 resumption_master_secret
|
||||
serverCertificates []*x509.Certificate // Certificate chain presented by the server
|
||||
verifiedChains [][]*x509.Certificate // Certificate chains we built for verification
|
||||
receivedAt time.Time // When the session ticket was received from the server
|
||||
|
||||
// TLS 1.3 fields.
|
||||
nonce []byte // Ticket nonce sent by the server, to derive PSK
|
||||
useBy time.Time // Expiration of the ticket lifetime as set by the server
|
||||
ageAdd uint32 // Random obfuscation factor for sending the ticket age
|
||||
}
|
||||
|
||||
// ClientSessionCache is a cache of ClientSessionState objects that can be used
|
||||
// by a client to resume a TLS session with a given server. ClientSessionCache
|
||||
// implementations should expect to be called concurrently from different
|
||||
// goroutines. Only ticket-based resumption is supported, not SessionID-based
|
||||
// resumption.
|
||||
// goroutines. Up to TLS 1.2, only ticket-based resumption is supported, not
|
||||
// SessionID-based resumption. In TLS 1.3 they were merged into PSK modes, which
|
||||
// are supported via this interface.
|
||||
type ClientSessionCache interface {
|
||||
// Get searches for a ClientSessionState associated with the given key.
|
||||
// On return, ok is true if one was found.
|
||||
Get(sessionKey string) (session *ClientSessionState, ok bool)
|
||||
|
||||
// Put adds the ClientSessionState to the cache with the given key.
|
||||
// Put adds the ClientSessionState to the cache with the given key. It might
|
||||
// get called multiple times in a connection if a TLS 1.3 server provides
|
||||
// more than one session ticket. If called with a nil *ClientSessionState,
|
||||
// it should remove the cache entry.
|
||||
Put(sessionKey string, cs *ClientSessionState)
|
||||
}
|
||||
|
||||
// SignatureScheme identifies a signature algorithm supported by TLS. See
|
||||
// https://tools.ietf.org/html/draft-ietf-tls-tls13-18#section-4.2.3.
|
||||
// RFC 8446, Section 4.2.3.
|
||||
type SignatureScheme uint16
|
||||
|
||||
const (
|
||||
|
|
@ -225,6 +297,7 @@ const (
|
|||
PKCS1WithSHA384 SignatureScheme = 0x0501
|
||||
PKCS1WithSHA512 SignatureScheme = 0x0601
|
||||
|
||||
// RSASSA-PSS algorithms with public key OID rsaEncryption.
|
||||
PSSWithSHA256 SignatureScheme = 0x0804
|
||||
PSSWithSHA384 SignatureScheme = 0x0805
|
||||
PSSWithSHA512 SignatureScheme = 0x0806
|
||||
|
|
@ -246,32 +319,27 @@ type ClientHelloInfo struct {
|
|||
|
||||
// ServerName indicates the name of the server requested by the client
|
||||
// in order to support virtual hosting. ServerName is only set if the
|
||||
// client is using SNI (see
|
||||
// https://tools.ietf.org/html/rfc4366#section-3.1).
|
||||
// client is using SNI (see RFC 4366, Section 3.1).
|
||||
ServerName string
|
||||
|
||||
// SupportedCurves lists the elliptic curves supported by the client.
|
||||
// SupportedCurves is set only if the Supported Elliptic Curves
|
||||
// Extension is being used (see
|
||||
// https://tools.ietf.org/html/rfc4492#section-5.1.1).
|
||||
// Extension is being used (see RFC 4492, Section 5.1.1).
|
||||
SupportedCurves []CurveID
|
||||
|
||||
// SupportedPoints lists the point formats supported by the client.
|
||||
// SupportedPoints is set only if the Supported Point Formats Extension
|
||||
// is being used (see
|
||||
// https://tools.ietf.org/html/rfc4492#section-5.1.2).
|
||||
// is being used (see RFC 4492, Section 5.1.2).
|
||||
SupportedPoints []uint8
|
||||
|
||||
// SignatureSchemes lists the signature and hash schemes that the client
|
||||
// is willing to verify. SignatureSchemes is set only if the Signature
|
||||
// Algorithms Extension is being used (see
|
||||
// https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1).
|
||||
// Algorithms Extension is being used (see RFC 5246, Section 7.4.1.4.1).
|
||||
SignatureSchemes []SignatureScheme
|
||||
|
||||
// SupportedProtos lists the application protocols supported by the client.
|
||||
// SupportedProtos is set only if the Application-Layer Protocol
|
||||
// Negotiation Extension is being used (see
|
||||
// https://tools.ietf.org/html/rfc7301#section-3.1).
|
||||
// Negotiation Extension is being used (see RFC 7301, Section 3.1).
|
||||
//
|
||||
// Servers can select a protocol by setting Config.NextProtos in a
|
||||
// GetConfigForClient return value.
|
||||
|
|
@ -316,6 +384,8 @@ type CertificateRequestInfo struct {
|
|||
// handshake and application data flow is not permitted so renegotiation can
|
||||
// only be used with protocols that synchronise with the renegotiation, such as
|
||||
// HTTPS.
|
||||
//
|
||||
// Renegotiation is not defined in TLS 1.3.
|
||||
type RenegotiationSupport int
|
||||
|
||||
const (
|
||||
|
|
@ -423,7 +493,8 @@ type Config struct {
|
|||
// If RootCAs is nil, TLS uses the host's root CA set.
|
||||
RootCAs *x509.CertPool
|
||||
|
||||
// NextProtos is a list of supported, application level protocols.
|
||||
// NextProtos is a list of supported application level protocols, in
|
||||
// order of preference.
|
||||
NextProtos []string
|
||||
|
||||
// ServerName is used to verify the hostname on the returned
|
||||
|
|
@ -459,19 +530,19 @@ type Config struct {
|
|||
// the order of elements in CipherSuites, is used.
|
||||
PreferServerCipherSuites bool
|
||||
|
||||
// SessionTicketsDisabled may be set to true to disable session ticket
|
||||
// (resumption) support. Note that on clients, session ticket support is
|
||||
// SessionTicketsDisabled may be set to true to disable session ticket and
|
||||
// PSK (resumption) support. Note that on clients, session ticket support is
|
||||
// also disabled if ClientSessionCache is nil.
|
||||
SessionTicketsDisabled bool
|
||||
|
||||
// SessionTicketKey is used by TLS servers to provide session
|
||||
// resumption. See RFC 5077. If zero, it will be filled with
|
||||
// random data before the first server handshake.
|
||||
// SessionTicketKey is used by TLS servers to provide session resumption.
|
||||
// See RFC 5077 and the PSK mode of RFC 8446. If zero, it will be filled
|
||||
// with random data before the first server handshake.
|
||||
//
|
||||
// If multiple servers are terminating connections for the same host
|
||||
// they should all have the same SessionTicketKey. If the
|
||||
// SessionTicketKey leaks, previously recorded and future TLS
|
||||
// connections using that key are compromised.
|
||||
// connections using that key might be compromised.
|
||||
SessionTicketKey [32]byte
|
||||
|
||||
// ClientSessionCache is a cache of ClientSessionState entries for TLS
|
||||
|
|
@ -484,12 +555,13 @@ type Config struct {
|
|||
|
||||
// MaxVersion contains the maximum SSL/TLS version that is acceptable.
|
||||
// If zero, then the maximum version supported by this package is used,
|
||||
// which is currently TLS 1.2.
|
||||
// which is currently TLS 1.3.
|
||||
MaxVersion uint16
|
||||
|
||||
// CurvePreferences contains the elliptic curves that will be used in
|
||||
// an ECDHE handshake, in preference order. If empty, the default will
|
||||
// be used.
|
||||
// be used. The client will use the first preference as the type for
|
||||
// its key share in TLS 1.3. This may change in the future.
|
||||
CurvePreferences []CurveID
|
||||
|
||||
// DynamicRecordSizingDisabled disables adaptive sizing of TLS records.
|
||||
|
|
@ -545,6 +617,10 @@ func ticketKeyFromBytes(b [32]byte) (key ticketKey) {
|
|||
return key
|
||||
}
|
||||
|
||||
// maxSessionTicketLifetime is the maximum allowed lifetime of a TLS 1.3 session
|
||||
// ticket, and the lifetime we set for tickets we send.
|
||||
const maxSessionTicketLifetime = 7 * 24 * time.Hour
|
||||
|
||||
// Clone returns a shallow clone of c. It is safe to clone a Config that is
|
||||
// being used concurrently by a TLS client or server.
|
||||
func (c *Config) Clone() *Config {
|
||||
|
|
@ -674,18 +750,52 @@ func (c *Config) cipherSuites() []uint16 {
|
|||
return s
|
||||
}
|
||||
|
||||
func (c *Config) minVersion() uint16 {
|
||||
if c == nil || c.MinVersion == 0 {
|
||||
return minVersion
|
||||
}
|
||||
return c.MinVersion
|
||||
var supportedVersions = []uint16{
|
||||
VersionTLS13,
|
||||
VersionTLS12,
|
||||
VersionTLS11,
|
||||
VersionTLS10,
|
||||
VersionSSL30,
|
||||
}
|
||||
|
||||
func (c *Config) maxVersion() uint16 {
|
||||
if c == nil || c.MaxVersion == 0 {
|
||||
return maxVersion
|
||||
func (c *Config) supportedVersions(isClient bool) []uint16 {
|
||||
versions := make([]uint16, 0, len(supportedVersions))
|
||||
for _, v := range supportedVersions {
|
||||
if c != nil && c.MinVersion != 0 && v < c.MinVersion {
|
||||
continue
|
||||
}
|
||||
if c != nil && c.MaxVersion != 0 && v > c.MaxVersion {
|
||||
continue
|
||||
}
|
||||
// TLS 1.0 is the minimum version supported as a client.
|
||||
if isClient && v < VersionTLS10 {
|
||||
continue
|
||||
}
|
||||
versions = append(versions, v)
|
||||
}
|
||||
return c.MaxVersion
|
||||
return versions
|
||||
}
|
||||
|
||||
func (c *Config) maxSupportedVersion(isClient bool) uint16 {
|
||||
supportedVersions := c.supportedVersions(isClient)
|
||||
if len(supportedVersions) == 0 {
|
||||
return 0
|
||||
}
|
||||
return supportedVersions[0]
|
||||
}
|
||||
|
||||
// supportedVersionsFromMax returns a list of supported versions derived from a
|
||||
// legacy maximum version value. Note that only versions supported by this
|
||||
// library are returned. Any newer peer will use supportedVersions anyway.
|
||||
func supportedVersionsFromMax(maxVersion uint16) []uint16 {
|
||||
versions := make([]uint16, 0, len(supportedVersions))
|
||||
for _, v := range supportedVersions {
|
||||
if v > maxVersion {
|
||||
continue
|
||||
}
|
||||
versions = append(versions, v)
|
||||
}
|
||||
return versions
|
||||
}
|
||||
|
||||
var defaultCurvePreferences = []CurveID{X25519, CurveP256, CurveP384, CurveP521}
|
||||
|
|
@ -698,18 +808,17 @@ func (c *Config) curvePreferences() []CurveID {
|
|||
}
|
||||
|
||||
// mutualVersion returns the protocol version to use given the advertised
|
||||
// version of the peer.
|
||||
func (c *Config) mutualVersion(vers uint16) (uint16, bool) {
|
||||
minVersion := c.minVersion()
|
||||
maxVersion := c.maxVersion()
|
||||
|
||||
if vers < minVersion {
|
||||
return 0, false
|
||||
// versions of the peer. Priority is given to the peer preference order.
|
||||
func (c *Config) mutualVersion(isClient bool, peerVersions []uint16) (uint16, bool) {
|
||||
supportedVersions := c.supportedVersions(isClient)
|
||||
for _, peerVersion := range peerVersions {
|
||||
for _, v := range supportedVersions {
|
||||
if v == peerVersion {
|
||||
return v, true
|
||||
}
|
||||
}
|
||||
}
|
||||
if vers > maxVersion {
|
||||
vers = maxVersion
|
||||
}
|
||||
return vers, true
|
||||
return 0, false
|
||||
}
|
||||
|
||||
// getCertificate returns the best certificate for the given ClientHelloInfo,
|
||||
|
|
@ -763,9 +872,13 @@ func (c *Config) BuildNameToCertificate() {
|
|||
c.NameToCertificate = make(map[string]*Certificate)
|
||||
for i := range c.Certificates {
|
||||
cert := &c.Certificates[i]
|
||||
x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
|
||||
if err != nil {
|
||||
continue
|
||||
x509Cert := cert.Leaf
|
||||
if x509Cert == nil {
|
||||
var err error
|
||||
x509Cert, err = x509.ParseCertificate(cert.Certificate[0])
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
}
|
||||
if len(x509Cert.Subject.CommonName) > 0 {
|
||||
c.NameToCertificate[x509Cert.Subject.CommonName] = cert
|
||||
|
|
@ -776,14 +889,20 @@ func (c *Config) BuildNameToCertificate() {
|
|||
}
|
||||
}
|
||||
|
||||
// writeKeyLog logs client random and master secret if logging was enabled by
|
||||
// setting c.KeyLogWriter.
|
||||
func (c *Config) writeKeyLog(clientRandom, masterSecret []byte) error {
|
||||
const (
|
||||
keyLogLabelTLS12 = "CLIENT_RANDOM"
|
||||
keyLogLabelClientHandshake = "CLIENT_HANDSHAKE_TRAFFIC_SECRET"
|
||||
keyLogLabelServerHandshake = "SERVER_HANDSHAKE_TRAFFIC_SECRET"
|
||||
keyLogLabelClientTraffic = "CLIENT_TRAFFIC_SECRET_0"
|
||||
keyLogLabelServerTraffic = "SERVER_TRAFFIC_SECRET_0"
|
||||
)
|
||||
|
||||
func (c *Config) writeKeyLog(label string, clientRandom, secret []byte) error {
|
||||
if c.KeyLogWriter == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
logLine := []byte(fmt.Sprintf("CLIENT_RANDOM %x %x\n", clientRandom, masterSecret))
|
||||
logLine := []byte(fmt.Sprintf("%s %x %x\n", label, clientRandom, secret))
|
||||
|
||||
writerMutex.Lock()
|
||||
_, err := c.KeyLogWriter.Write(logLine)
|
||||
|
|
@ -854,15 +973,21 @@ func NewLRUClientSessionCache(capacity int) ClientSessionCache {
|
|||
}
|
||||
}
|
||||
|
||||
// Put adds the provided (sessionKey, cs) pair to the cache.
|
||||
// Put adds the provided (sessionKey, cs) pair to the cache. If cs is nil, the entry
|
||||
// corresponding to sessionKey is removed from the cache instead.
|
||||
func (c *lruSessionCache) Put(sessionKey string, cs *ClientSessionState) {
|
||||
c.Lock()
|
||||
defer c.Unlock()
|
||||
|
||||
if elem, ok := c.m[sessionKey]; ok {
|
||||
entry := elem.Value.(*lruSessionCacheEntry)
|
||||
entry.state = cs
|
||||
c.q.MoveToFront(elem)
|
||||
if cs == nil {
|
||||
c.q.Remove(elem)
|
||||
delete(c.m, sessionKey)
|
||||
} else {
|
||||
entry := elem.Value.(*lruSessionCacheEntry)
|
||||
entry.state = cs
|
||||
c.q.MoveToFront(elem)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
|
|
@ -908,8 +1033,9 @@ func defaultConfig() *Config {
|
|||
}
|
||||
|
||||
var (
|
||||
once sync.Once
|
||||
varDefaultCipherSuites []uint16
|
||||
once sync.Once
|
||||
varDefaultCipherSuites []uint16
|
||||
varDefaultCipherSuitesTLS13 []uint16
|
||||
)
|
||||
|
||||
func defaultCipherSuites() []uint16 {
|
||||
|
|
@ -917,24 +1043,25 @@ func defaultCipherSuites() []uint16 {
|
|||
return varDefaultCipherSuites
|
||||
}
|
||||
|
||||
func defaultCipherSuitesTLS13() []uint16 {
|
||||
once.Do(initDefaultCipherSuites)
|
||||
return varDefaultCipherSuitesTLS13
|
||||
}
|
||||
|
||||
func initDefaultCipherSuites() {
|
||||
var topCipherSuites []uint16
|
||||
|
||||
// Check the cpu flags for each platform that has optimized GCM implementations.
|
||||
// Worst case, these variables will just all be false
|
||||
hasGCMAsmAMD64 := cpu.X86.HasAES && cpu.X86.HasPCLMULQDQ
|
||||
// Worst case, these variables will just all be false.
|
||||
var (
|
||||
hasGCMAsmAMD64 = cpu.X86.HasAES && cpu.X86.HasPCLMULQDQ
|
||||
hasGCMAsmARM64 = cpu.ARM64.HasAES && cpu.ARM64.HasPMULL
|
||||
// Keep in sync with crypto/aes/cipher_s390x.go.
|
||||
// hasGCMAsmS390X = cpu.S390X.HasAES && cpu.S390X.HasAESCBC && cpu.S390X.HasAESCTR && (cpu.S390X.HasGHASH || cpu.S390X.HasAESGCM)
|
||||
hasGCMAsmS390X = false // [UTLS: couldn't be bothered to make it work, we won't use it]
|
||||
|
||||
// TODO: enable the arm64 HasAES && HasPMULL feature check after the
|
||||
// optimized AES-GCM implementation for arm64 is merged (CL 107298).
|
||||
// This is explicitly set to false for now to prevent misprioritization
|
||||
// of AES-GCM based cipher suites, which will be slower than chacha20-poly1305
|
||||
hasGCMAsmARM64 := false
|
||||
// hasGCMAsmARM64 := cpu.ARM64.HasAES && cpu.ARM64.HasPMULL
|
||||
|
||||
// Keep in sync with crypto/aes/cipher_s390x.go.
|
||||
hasGCMAsmS390X := false // [UTLS: couldn't be bothered to make it work, we won't use it]
|
||||
|
||||
hasGCMAsm := hasGCMAsmAMD64 || hasGCMAsmARM64 || hasGCMAsmS390X
|
||||
hasGCMAsm = hasGCMAsmAMD64 || hasGCMAsmARM64 || hasGCMAsmS390X
|
||||
)
|
||||
|
||||
if hasGCMAsm {
|
||||
// If AES-GCM hardware is provided then prioritise AES-GCM
|
||||
|
|
@ -947,6 +1074,11 @@ func initDefaultCipherSuites() {
|
|||
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
|
||||
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,
|
||||
}
|
||||
varDefaultCipherSuitesTLS13 = []uint16{
|
||||
TLS_AES_128_GCM_SHA256,
|
||||
TLS_CHACHA20_POLY1305_SHA256,
|
||||
TLS_AES_256_GCM_SHA384,
|
||||
}
|
||||
} else {
|
||||
// Without AES-GCM hardware, we put the ChaCha20-Poly1305
|
||||
// cipher suites first.
|
||||
|
|
@ -958,6 +1090,11 @@ func initDefaultCipherSuites() {
|
|||
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
|
||||
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
|
||||
}
|
||||
varDefaultCipherSuitesTLS13 = []uint16{
|
||||
TLS_CHACHA20_POLY1305_SHA256,
|
||||
TLS_AES_128_GCM_SHA256,
|
||||
TLS_AES_256_GCM_SHA384,
|
||||
}
|
||||
}
|
||||
|
||||
varDefaultCipherSuites = make([]uint16, 0, len(cipherSuites))
|
||||
|
|
@ -995,7 +1132,9 @@ func isSupportedSignatureAlgorithm(sigAlg SignatureScheme, supportedSignatureAlg
|
|||
func signatureFromSignatureScheme(signatureAlgorithm SignatureScheme) uint8 {
|
||||
switch signatureAlgorithm {
|
||||
case PKCS1WithSHA1, PKCS1WithSHA256, PKCS1WithSHA384, PKCS1WithSHA512:
|
||||
return signatureRSA
|
||||
return signaturePKCS1v15
|
||||
case PSSWithSHA256, PSSWithSHA384, PSSWithSHA512:
|
||||
return signatureRSAPSS
|
||||
case ECDSAWithSHA1, ECDSAWithP256AndSHA256, ECDSAWithP384AndSHA384, ECDSAWithP521AndSHA512:
|
||||
return signatureECDSA
|
||||
default:
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue