mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: don't reverify but check certificate expiration on resumption

Browse source 
We used to inconsistently run certificate verification on the server on
resumption, but not on the client. This made TLS 1.3 resumption pretty
much useless, as it didn't save bytes, CPU, or round-trips.

This requires serializing the verified chains into the session ticket,
so it's a tradeoff making the ticket bigger to save computation (and for
consistency).

The previous behavior also had a "stickyness" issue: if a ticket
contained invalid certificates, they would be used even if the client
had in the meantime configured valid certificates for a full handshake.

We also didn't check expiration on the client side on resumption if
InsecureSkipVerify was set. Again for consistency, we do that now.

Also, we used to run VerifyPeerCertificates on resumption even if
NoClientCerts was set.

Fixes #31641

Change-Id: Icc88269ea4adb544fa81158114aae76f3c91a15f
Reviewed-on: https://go-review.googlesource.com/c/go/+/497895
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
Filippo Valsorda 2023-05-24 15:49:56 +02:00 • committed by Gopher Robot
parent b6a93d8a50
commit 5ca720fc5e
36 changed files with 2436 additions and 2275 deletions
Download patch file Download diff file Expand all files Collapse all files

158
testdata/Server-TLSv13-ECDHE-ECDSA-AES vendored
View file

@ -1,93 +1,93 @@
>>> Flow 1 (client to server)
00000000 16 03 01 00 ca 01 00 00 c6 03 03 64 e9 94 6e 11 |...........d..n.|
00000010 99 79 12 f5 f1 a4 ad 5f cb 1d ae d6 3d 2a 3e ff |.y....._....=*>.|
00000020 0a 22 84 74 c2 80 c1 7f c3 5a ee 20 d6 6a 14 f7 |.".t.....Z. .j..|
00000030 30 ad 5a 3e a5 7e da 10 a9 96 c1 3b 42 9b 02 4f |0.Z>.~.....;B..O|
00000040 d2 8e 8c 24 10 c0 60 da 09 f2 29 c7 00 04 13 01 |...$..`...).....|
00000000 16 03 01 00 ca 01 00 00 c6 03 03 be 5b 8c 08 2b |............[..+|
00000010 26 a0 41 0f e3 4e b6 5c 9f 5d 53 04 67 4a 1d a2 |&.A..N.\.]S.gJ..|
00000020 26 3b 83 ab b4 7b c6 ec f8 a6 41 20 a6 de ad e2 |&;...{....A ....|
00000030 0c fd 02 99 11 51 c6 be e8 52 df 0b e2 b3 6f fe |.....Q...R....o.|
00000040 33 3e 2f 90 ac d2 e8 a2 53 8b d9 05 00 04 13 01 |3>/.....S.......|
00000050 00 ff 01 00 00 79 00 0b 00 04 03 00 01 02 00 0a |.....y..........|
00000060 00 0c 00 0a 00 1d 00 17 00 1e 00 19 00 18 00 16 |................|
00000070 00 00 00 17 00 00 00 0d 00 1e 00 1c 04 03 05 03 |................|
00000080 06 03 08 07 08 08 08 09 08 0a 08 0b 08 04 08 05 |................|
00000090 08 06 04 01 05 01 06 01 00 2b 00 03 02 03 04 00 |.........+......|
000000a0 2d 00 02 01 01 00 33 00 26 00 24 00 1d 00 20 ba |-.....3.&.$... .|
000000b0 20 43 fb 3f f4 a0 b9 06 47 72 39 5a 36 04 e0 2c | C.?....Gr9Z6..,|
000000c0 73 d7 1c e4 55 bd 9a b5 8b 93 83 91 40 9e 79 |s...U.......@.y|
000000a0 2d 00 02 01 01 00 33 00 26 00 24 00 1d 00 20 31 |-.....3.&.$... 1|
000000b0 8e dd f4 7c cf 22 04 c1 c3 04 5c 24 49 db ae ab |...|."....\$I...|
000000c0 0a d0 42 e8 70 51 c7 4f 88 e2 4e 2e 0b 80 65 |..B.pQ.O..N...e|
>>> Flow 2 (server to client)
00000000 16 03 03 00 7a 02 00 00 76 03 03 00 00 00 00 00 |....z...v.......|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000020 00 00 00 00 00 00 00 00 00 00 00 20 d6 6a 14 f7 |........... .j..|
00000030 30 ad 5a 3e a5 7e da 10 a9 96 c1 3b 42 9b 02 4f |0.Z>.~.....;B..O|
00000040 d2 8e 8c 24 10 c0 60 da 09 f2 29 c7 13 01 00 00 |...$..`...).....|
00000020 00 00 00 00 00 00 00 00 00 00 00 20 a6 de ad e2 |........... ....|
00000030 0c fd 02 99 11 51 c6 be e8 52 df 0b e2 b3 6f fe |.....Q...R....o.|
00000040 33 3e 2f 90 ac d2 e8 a2 53 8b d9 05 13 01 00 00 |3>/.....S.......|
00000050 2e 00 2b 00 02 03 04 00 33 00 24 00 1d 00 20 2f |..+.....3.$... /|
00000060 e5 7d a3 47 cd 62 43 15 28 da ac 5f bb 29 07 30 |.}.G.bC.(.._.).0|
00000070 ff f6 84 af c4 cf c2 ed 90 99 5f 58 cb 3b 74 14 |.........._X.;t.|
00000080 03 03 00 01 01 17 03 03 00 17 97 f6 12 8c a3 14 |................|
00000090 6f e3 e2 c3 19 38 79 4c 56 2a a5 8f cd f4 41 90 |o....8yLV*....A.|
000000a0 b4 17 03 03 02 22 9f 20 4f 27 f6 79 fb 69 a5 50 |.....". O'.y.i.P|
000000b0 99 55 c8 8a 29 88 3a 7d 48 08 a1 d1 f4 2b 96 91 |.U..).:}H....+..|
000000c0 e2 a4 b2 25 b8 5b de 43 03 91 aa a0 66 29 b1 f4 |...%.[.C....f)..|
000000d0 0c fa 77 fc a6 88 3c 15 69 a0 74 cb af 0c d5 4f |..w...<.i.t....O|
000000e0 bf 8c 56 2b 74 b7 dd d8 f2 f3 3a 25 34 d6 2c a5 |..V+t.....:%4.,.|
000000f0 ec 1b e3 a8 02 80 01 f6 a0 cd 7a 43 dc 8a 4a c5 |..........zC..J.|
00000100 44 54 23 2d 62 ad 66 22 db d9 bb 56 df 2d 7e 61 |DT#-b.f"...V.-~a|
00000110 8b 13 cc 96 4e e8 08 a2 d1 06 38 2a d5 f1 9b 70 |....N.....8*...p|
00000120 55 2b dc 6c e8 7f ca b6 15 9a 13 bd cb 51 5b ff |U+.l.........Q[.|
00000130 aa 75 b6 4a 38 e2 1d 07 ed 82 be fa b9 72 68 e0 |.u.J8........rh.|
00000140 a9 e6 22 a3 f1 02 d8 22 04 6d 0b e1 84 81 01 94 |.."....".m......|
00000150 f5 7e 7a b0 a0 67 bc 25 62 d7 87 18 07 32 1d 32 |.~z..g.%b....2.2|
00000160 b0 70 df 69 24 32 f0 b4 07 8e 4b eb 44 d9 fc ba |.p.i$2....K.D...|
00000170 4c 9e 48 3f 4e 15 51 9b c7 ec a2 3d 30 33 e9 6f |L.H?N.Q....=03.o|
00000180 f9 14 62 9b 8a 27 f0 98 f1 4c 69 1c b0 50 26 86 |..b..'...Li..P&.|
00000190 22 41 c3 2d fb 3a 9c da 8a a2 d0 98 f2 bd 27 10 |"A.-.:........'.|
000001a0 b1 1e a2 06 71 a6 7d 55 70 93 92 11 43 e9 c7 50 |....q.}Up...C..P|
000001b0 98 17 b7 b8 d4 8f 24 36 f5 e2 3a 5f 28 f2 3e dd |......$6..:_(.>.|
000001c0 00 67 5f a9 e6 c7 8b 7f 69 41 8d 4b 30 c6 14 e6 |.g_.....iA.K0...|
000001d0 6c 0c f8 0d b9 bf f0 83 a9 08 95 65 1a 12 c6 86 |l..........e....|
000001e0 00 7f f3 3b ee 47 03 2b a9 3e 9f 59 77 c6 cc ff |...;.G.+.>.Yw...|
000001f0 8c 6b d7 f0 99 32 11 a8 12 23 6d c1 79 14 62 9f |.k...2...#m.y.b.|
00000200 35 ab ad ae dd b5 eb b0 73 a7 a6 eb 83 37 3e 44 |5.......s....7>D|
00000210 be 82 52 f7 e3 09 5c 16 0b 5a 63 d6 b4 0b 7b 8b |..R...\..Zc...{.|
00000220 bc 8c f8 11 de cd fb 52 c3 c3 6c 9c 4c c0 4a 5d |.......R..l.L.J]|
00000230 c5 a5 ff f6 e0 ad 56 61 1c 5f 67 e2 e9 f3 7f 5f |......Va._g...._|
00000240 14 e1 09 8d 66 40 27 d4 74 cf 5f 3f d3 c9 78 86 |....f@'.t._?..x.|
00000250 32 5e 59 8d 9f d3 d7 9b e6 06 23 02 56 b6 4c b7 |2^Y.......#.V.L.|
00000260 38 c6 6e c6 54 64 78 81 6d e1 4b e7 7e 03 3b 1a |8.n.Tdx.m.K.~.;.|
00000270 2c 8d f9 12 4d d5 a9 9c 81 07 80 87 1e 1c db bf |,...M...........|
00000280 20 eb 0a c0 e7 a1 8c 2a 42 17 68 0a 67 38 af ed | ......*B.h.g8..|
00000290 b4 c5 5a 86 dc af bb 7f 05 76 cd 2b 69 c6 f8 6b |..Z......v.+i..k|
000002a0 87 16 b3 d2 a7 ef 8e 71 64 d5 78 d3 26 1e 2d 9c |.......qd.x.&.-.|
000002b0 8c d5 76 6a ae 0b b2 73 6a 18 5a 91 43 ac ec d2 |..vj...sj.Z.C...|
000002c0 dd cb 36 a2 6b 3d cb ee 17 03 03 00 a4 79 13 8c |..6.k=.......y..|
000002d0 8f 9d b5 d0 d8 64 20 f1 8d 13 ff f4 b6 2f d9 94 |.....d ....../..|
000002e0 e7 c4 c8 8a d6 53 45 ff 11 f0 aa 49 fa 15 f9 4a |.....SE....I...J|
000002f0 fd a0 98 fc 62 cc 61 d4 6b 41 d6 b5 3c eb 37 be |....b.a.kA..<.7.|
00000300 1e ab 48 7d 87 71 45 f6 e0 8d 40 b8 ae d2 ac 0d |..H}.qE...@.....|
00000310 3f c4 2d c1 f8 0f f4 ae d7 88 97 dd df 0e d2 d1 |?.-.............|
00000320 1c 03 ea a3 71 98 cb df dd 72 f0 39 eb b2 a9 15 |....q....r.9....|
00000330 3f 57 c4 1e f9 87 0b ad 2b 84 2b ff 88 9c 4e 37 |?W......+.+...N7|
00000340 14 b5 8c 2c 30 e7 16 48 3e c9 e6 e7 c1 d9 0b d0 |...,0..H>.......|
00000350 23 4c c7 4e a8 2f ca 7d 98 15 1f 70 c0 42 74 5a |#L.N./.}...p.BtZ|
00000360 86 8e e3 cd e4 1d 56 9d 80 63 3e ad 94 bf d4 6f |......V..c>....o|
00000370 a1 17 03 03 00 35 fe 27 df 5a d3 bd 58 0d 7b 2e |.....5.'.Z..X.{.|
00000380 24 a4 61 4e d4 21 d2 be 64 f5 6d 9d 5a 82 0e 0f |$.aN.!..d.m.Z...|
00000390 90 b6 df a3 e6 e2 66 1e fe bd 1a 59 3a d5 9e 1a |......f....Y:...|
000003a0 bb f3 79 c0 d8 e8 5b 9b 60 4d e4 17 03 03 00 88 |..y...[.`M......|
000003b0 39 91 96 dd 9d 3f 60 30 fb c6 40 57 fb f7 c9 44 |9....?`0..@W...D|
000003c0 df 03 6a e1 e2 df 9a 0a 8f a7 75 ab 40 5e bc 83 |..j.......u.@^..|
000003d0 94 8b 55 91 7f 3d fb a1 0e 57 f7 d0 3c 81 db 34 |..U..=...W..<..4|
000003e0 36 7f 57 92 42 92 67 40 cb a8 f6 9a 80 6d 4f 40 |6.W.B.g@.....mO@|
000003f0 77 a5 3c 31 5c a9 b0 82 58 d9 8f e1 2b 6d 3b 03 |w.<1\...X...+m;.|
00000400 6d 6e 7e 71 4a 57 80 9f 2f 71 51 53 5e c3 31 7e |mn~qJW../qQS^.1~|
00000410 be 5d ea 1c 83 d7 64 46 7f a9 88 e9 e3 47 a6 b1 |.]....dF.....G..|
00000420 c2 1f fa 0a af 54 ce 55 ba 67 cd a2 1a 52 d1 bd |.....T.U.g...R..|
00000430 91 00 e4 a6 8d 92 2e 93 |........|
00000080 03 03 00 01 01 17 03 03 00 17 cc d0 60 a1 dc d6 |............`...|
00000090 46 57 69 3d df 0e 0f 7f a8 34 2d 87 71 84 16 54 |FWi=.....4-.q..T|
000000a0 9d 17 03 03 02 22 cb 9c f9 3e a0 fd bf 07 03 7c |....."...>.....||
000000b0 53 0c 15 22 0b 78 e5 02 36 e6 e7 6c 5b f9 aa 8d |S..".x..6..l[...|
000000c0 54 8e b1 15 d4 23 05 12 5e 6e 0f 0f 65 77 bf b5 |T....#..^n..ew..|
000000d0 32 28 0e 32 ca 9f 61 c3 37 23 87 e8 ec 19 1d ba |2(.2..a.7#......|
000000e0 ef f5 18 eb ba 49 2d 86 a6 d1 f7 c1 9e 67 10 9f |.....I-......g..|
000000f0 a1 d2 62 bd 4c 6c 5e a4 41 f6 1e fa fd e7 55 bc |..b.Ll^.A.....U.|
00000100 16 ad 91 91 de 03 86 d7 e1 88 87 ab 0e f4 f5 bb |................|
00000110 16 da 37 bb a4 ce 4e 6c 5f 88 41 f9 a2 90 9a 2d |..7...Nl_.A....-|
00000120 5c 14 d5 01 28 06 a9 20 a4 ae 92 17 c5 95 b1 dc |\...(.. ........|
00000130 02 a8 3f 3b a7 97 91 5a 4f 56 bb db b6 30 0d 80 |..?;...ZOV...0..|
00000140 35 ac 91 6f 4f ba 1e 10 c6 fc d2 ca 96 e4 9d 1f |5..oO...........|
00000150 2f 29 00 3a 11 b7 77 dd d5 ed 76 9f 67 a1 b1 0c |/).:..w...v.g...|
00000160 5d 34 34 eb 42 49 23 15 49 12 24 24 73 be a9 65 |]44.BI#.I.$$s..e|
00000170 99 b6 b4 3f 18 0c d1 32 26 eb 86 93 5c 0e e8 06 |...?...2&...\...|
00000180 fb d7 9f 0e d9 26 14 47 b8 e5 67 8c c8 cb 0c 55 |.....&.G..g....U|
00000190 61 70 a9 ce 0d 4e bf ca 40 9c e7 0d 2b 5d 54 b7 |ap...N..@...+]T.|
000001a0 5a 64 50 e6 a1 c9 fc 47 7d e7 0a 13 36 8d 70 eb |ZdP....G}...6.p.|
000001b0 68 65 e4 9b 9d 12 d1 d9 0d 32 72 59 0f 46 b2 e2 |he.......2rY.F..|
000001c0 21 ab 13 d4 ab f3 6e b6 44 16 b8 85 bb dc f4 f7 |!.....n.D.......|
000001d0 d6 ce 5c 9f c0 4c 28 8f 36 39 ec 29 c7 33 bd ea |..\..L(.69.).3..|
000001e0 2d 10 16 84 50 c5 18 5b 2c a3 99 bb 3b 0b 70 66 |-...P..[,...;.pf|
000001f0 72 9a 83 01 06 2a bf 4a 60 c5 5d 41 a1 f0 92 bb |r....*.J`.]A....|
00000200 3b 2a 1a 41 3a 57 c3 22 13 2c b4 7b 3e 47 52 ea |;*.A:W.".,.{>GR.|
00000210 79 8a bf ef 2e 2c f7 89 c7 36 5a df 38 c2 04 b6 |y....,...6Z.8...|
00000220 6f 96 cd 7c 01 b3 e3 cd 4a 83 56 40 06 58 8a 7c |o..|....J.V@.X.||
00000230 8c 75 df b6 b8 76 63 71 89 72 0a 64 de 23 7d 50 |.u...vcq.r.d.#}P|
00000240 77 a8 f6 a0 81 9d e9 ed 81 5e 20 c8 9f 65 3c 95 |w........^ ..e<.|
00000250 cf ed 99 80 71 06 5e 00 46 0d 0c 22 b3 88 f0 c5 |....q.^.F.."....|
00000260 33 3e 13 6b f2 07 9c db 20 31 9c 8d ea d7 73 e8 |3>.k.... 1....s.|
00000270 00 e1 2b f4 c8 d7 34 37 4a 98 b9 4d 28 db 15 8a |..+...47J..M(...|
00000280 af 53 14 3b 02 54 a3 0b 5f 10 ff 5d 20 1c 19 ae |.S.;.T.._..] ...|
00000290 6b 8a 99 a5 8f e0 ac dd c1 ba 1f 85 56 a3 94 bc |k...........V...|
000002a0 79 03 5f d5 dd e1 8e 62 b7 82 fa 92 c3 d5 8a fc |y._....b........|
000002b0 6b 17 24 d9 af db 3d 9c 0f 51 82 3d a2 ec 5f 9c |k.$...=..Q.=.._.|
000002c0 dc 69 a5 ce db d8 8b 87 17 03 03 00 a3 69 cd 7b |.i...........i.{|
000002d0 9f ac ad 72 11 b2 5d ee 19 63 d0 35 12 6d 5e 3f |...r..]..c.5.m^?|
000002e0 81 a8 18 4a d4 09 f3 80 38 4a 31 08 3e a0 4c 78 |...J....8J1.>.Lx|
000002f0 48 08 e9 90 ba e7 2a b4 73 2e 2b 2b 15 60 ce 09 |H.....*.s.++.`..|
00000300 7d df 49 31 e1 9d ff 92 1d b4 af 2e 8c f8 a6 2e |}.I1............|
00000310 93 d7 b9 10 69 10 7f 04 0d 8d e2 37 09 a7 d0 2a |....i......7...*|
00000320 ac ea 51 49 50 1d 1c 54 7f b9 15 ad 8c 77 ef 1d |..QIP..T.....w..|
00000330 a6 59 a3 bf b2 53 f7 6c 21 92 e0 36 c5 0d 61 94 |.Y...S.l!..6..a.|
00000340 be 61 5e 77 25 35 df e4 5f 67 c1 c6 af 51 e4 ce |.a^w%5.._g...Q..|
00000350 c4 28 c5 4e bc f6 c6 ba 32 dc 8e c7 45 f3 4d a1 |.(.N....2...E.M.|
00000360 70 53 98 46 8f 39 c2 cc b7 fc f7 24 11 97 72 b3 |pS.F.9.....$..r.|
00000370 17 03 03 00 35 76 be b6 7a 3f e3 08 7a a2 65 25 |....5v..z?..z.e%|
00000380 fd 0b c3 87 be ba eb ca cb 3d c1 25 10 e0 7b 00 |.........=.%..{.|
00000390 37 7a 52 9e d6 b2 e7 ba 8e 51 de 15 c4 e8 16 eb |7zR......Q......|
000003a0 c6 21 92 42 b1 62 f4 ce 27 ba 17 03 03 00 8b 54 |.!.B.b..'......T|
000003b0 03 de d7 a7 85 2f 4b 23 2d d5 3a b4 3d 3d f6 00 |...../K#-.:.==..|
000003c0 ac ab bd 6f dd bf 9f 24 fb 1b d4 01 39 3e c0 87 |...o...$....9>..|
000003d0 bb 32 ca f6 61 b2 ef 5d 9c 2c 1b a5 10 66 7b fd |.2..a..].,...f{.|
000003e0 4b d0 03 dc 53 a9 0d 5a d5 c4 4c 25 9c 55 e6 f8 |K...S..Z..L%.U..|
000003f0 d1 d8 49 dc 36 a1 92 ae f1 3e 2f 11 66 87 93 69 |..I.6....>/.f..i|
00000400 24 2e 5d 6c f6 79 15 68 a8 99 2e 1a 9c e2 85 4e |$.]l.y.h.......N|
00000410 5f d6 a8 3c 70 e1 67 cb df b2 1b ab 2b ed dc b6 |_..<p.g.....+...|
00000420 64 f4 bc 22 35 20 7f ff 64 b3 be d9 eb a1 ab 5d |d.."5 ..d......]|
00000430 d9 3b ae 30 46 76 70 48 04 43 |.;.0FvpH.C|
>>> Flow 3 (client to server)
00000000 14 03 03 00 01 01 17 03 03 00 35 ce a8 2f f5 d3 |..........5../..|
00000010 71 48 2e a0 74 72 7d 21 9f a8 25 9b 72 be 57 8b |qH..tr}!..%.r.W.|
00000020 ee 41 bb 04 f1 dc 4c 2e 0d eb 38 36 75 74 86 19 |.A....L...86ut..|
00000030 49 2c 82 db dc 39 ed ef d5 b6 8b 80 bf 7d cb e7 |I,...9.......}..|
00000000 14 03 03 00 01 01 17 03 03 00 35 46 8b fa 42 0d |..........5F..B.|
00000010 fa 3e 9e 80 76 12 ce 73 ae 85 67 ee af 1e 25 6e |.>..v..s..g...%n|
00000020 0b 46 4c bd 5a 46 8e 5c 27 7a 0a 8d d3 9c 3c 29 |.FL.ZF.\'z....<)|
00000030 4c c8 08 78 ac 9f f4 7a 38 8d 49 6a 01 b6 f5 83 |L..x...z8.Ij....|
>>> Flow 4 (server to client)
00000000 17 03 03 00 1e 3a 52 19 71 50 e3 78 6b e5 92 75 |.....:R.qP.xk..u|
00000010 4d 27 97 32 08 4b c3 70 88 98 42 1b 86 2f 3f 28 |M'.2.K.p..B../?(|
00000020 5a e3 20 17 03 03 00 13 e5 66 35 2a a5 13 b3 eb |Z. ......f5*....|
00000030 b6 1d 09 3a 40 87 ae cb 59 b5 7a |...:@...Y.z|
00000000 17 03 03 00 1e c2 1a dc 0a cb 9a 11 f7 a1 c2 1f |................|
00000010 54 7d 32 6f 0e 13 b6 6b 9f e1 c6 14 63 fc 18 b9 |T}2o...k....c...|
00000020 81 53 44 17 03 03 00 13 c9 72 ae 5e 2b c1 6f 64 |.SD......r.^+.od|
00000030 e0 70 47 15 b1 ec c3 25 00 7f 4e |.pG....%..N|