mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-04 20:47:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

Fix Client Certificate Verification when Using Extended Master Secret (#143)

Browse source
This commit is contained in:
DunyaKokoschka 2022-11-18 15:32:12 +00:00 • committed by GitHub
parent fb99df2a2e
commit ef21c925ea
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

10
handshake_client.go
View file

@ -600,6 +600,11 @@ func (hs *clientHandshakeState) doFullHandshake() error {
} }
} }
// [UTLS SECTION START]
/* sessionHash does not include CertificateVerify */
sessionHash := hs.finishedHash.Sum()
// [UTLS SECTION END]
if chainToSend != nil && len(chainToSend.Certificate) > 0 { if chainToSend != nil && len(chainToSend.Certificate) > 0 {
certVerify := &certificateVerifyMsg{} certVerify := &certificateVerifyMsg{}
@ -648,11 +653,14 @@ func (hs *clientHandshakeState) doFullHandshake() error {
} }
} }
// [UTLS SECTION START]
if hs.hello.ems && hs.serverHello.ems { if hs.hello.ems && hs.serverHello.ems {
hs.masterSecret = extendedMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.finishedHash) hs.masterSecret = extendedMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, sessionHash)
} else { } else {
hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.hello.random, hs.serverHello.random) hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.hello.random, hs.serverHello.random)
} }
// [UTLS SECTION END]
if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.hello.random, hs.masterSecret); err != nil { if err := c.config.writeKeyLog(keyLogLabelTLS12, hs.hello.random, hs.masterSecret); err != nil {
c.sendAlert(alertInternalError) c.sendAlert(alertInternalError)
return errors.New("tls: failed to write to key log: " + err.Error()) return errors.New("tls: failed to write to key log: " + err.Error())

3
u_tls_extensions.go
View file

@ -522,8 +522,7 @@ var extendedMasterSecretLabel = []byte("extended master secret")
// extendedMasterFromPreMasterSecret generates the master secret from the pre-master // extendedMasterFromPreMasterSecret generates the master secret from the pre-master
// secret and session hash. See https://tools.ietf.org/html/rfc7627#section-4 // secret and session hash. See https://tools.ietf.org/html/rfc7627#section-4
func extendedMasterFromPreMasterSecret(version uint16, suite *cipherSuite, preMasterSecret []byte, fh finishedHash) []byte { func extendedMasterFromPreMasterSecret(version uint16, suite *cipherSuite, preMasterSecret []byte, sessionHash []byte) []byte {
sessionHash := fh.Sum()
masterSecret := make([]byte, masterSecretLength) masterSecret := make([]byte, masterSecretLength)
prfForVersion(version, suite)(masterSecret, preMasterSecret, extendedMasterSecretLabel, sessionHash) prfForVersion(version, suite)(masterSecret, preMasterSecret, extendedMasterSecretLabel, sessionHash)
return masterSecret return masterSecret