src/third_party/boringssl/src/ssl/test/runner/handshake_client.go

   1 // Copyright 2009 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 package main
   6
   7 import (
   8         "bytes"
   9         "crypto"
  10         "crypto/ecdsa"
  11         "crypto/elliptic"
  12         "crypto/rsa"
  13         "crypto/subtle"
  14         "crypto/x509"
  15         "encoding/asn1"
  16         "errors"
  17         "fmt"
  18         "io"
  19         "math/big"
  20         "net"
  21         "strconv"
  22 )
  23
  24 type clientHandshakeState struct {
  25         c            *Conn
  26         serverHello  *serverHelloMsg
  27         hello        *clientHelloMsg
  28         suite        *cipherSuite
  29         finishedHash finishedHash
  30         masterSecret []byte
  31         session      *ClientSessionState
  32 }
  33
  34 func (c *Conn) clientHandshake() error {
  35         if c.config == nil {
  36                 c.config = defaultConfig()
  37         }
  38
  39         if len(c.config.ServerName) == 0 && !c.config.InsecureSkipVerify {
  40                 return errors.New("tls: either ServerName or InsecureSkipVerify must be specified in the tls.Config")
  41         }
  42
  43         c.sendHandshakeSeq = 0
  44         c.recvHandshakeSeq = 0
  45
  46         nextProtosLength := 0
  47         for _, proto := range c.config.NextProtos {
  48                 if l := len(proto); l == 0 || l > 255 {
  49                         return errors.New("tls: invalid NextProtos value")
  50                 } else {
  51                         nextProtosLength += 1 + l
  52                 }
  53         }
  54         if nextProtosLength > 0xffff {
  55                 return errors.New("tls: NextProtos values too large")
  56         }
  57
  58         hello := &clientHelloMsg{
  59                 isDTLS:               c.isDTLS,
  60                 vers:                 c.config.maxVersion(),
  61                 compressionMethods:   []uint8{compressionNone},
  62                 random:               make([]byte, 32),
  63                 ocspStapling:         true,
  64                 serverName:           c.config.ServerName,
  65                 supportedCurves:      c.config.curvePreferences(),
  66                 supportedPoints:      []uint8{pointFormatUncompressed},
  67                 nextProtoNeg:         len(c.config.NextProtos) > 0,
  68                 secureRenegotiation:  []byte{},
  69                 alpnProtocols:        c.config.NextProtos,
  70                 duplicateExtension:   c.config.Bugs.DuplicateExtension,
  71                 channelIDSupported:   c.config.ChannelID != nil,
  72                 npnLast:              c.config.Bugs.SwapNPNAndALPN,
  73                 extendedMasterSecret: c.config.maxVersion() >= VersionTLS10,
  74         }
  75
  76         if c.config.Bugs.SendClientVersion != 0 {
  77                 hello.vers = c.config.Bugs.SendClientVersion
  78         }
  79
  80         if c.config.Bugs.NoExtendedMasterSecret {
  81                 hello.extendedMasterSecret = false
  82         }
  83
  84         if len(c.clientVerify) > 0 && !c.config.Bugs.EmptyRenegotiationInfo {
  85                 if c.config.Bugs.BadRenegotiationInfo {
  86                         hello.secureRenegotiation = append(hello.secureRenegotiation, c.clientVerify...)
  87                         hello.secureRenegotiation[0] ^= 0x80
  88                 } else {
  89                         hello.secureRenegotiation = c.clientVerify
  90                 }
  91         }
  92
  93         possibleCipherSuites := c.config.cipherSuites()
  94         hello.cipherSuites = make([]uint16, 0, len(possibleCipherSuites))
  95
  96 NextCipherSuite:
  97         for _, suiteId := range possibleCipherSuites {
  98                 for _, suite := range cipherSuites {
  99                         if suite.id != suiteId {
 100                                 continue
 101                         }
 102                         // Don't advertise TLS 1.2-only cipher suites unless
 103                         // we're attempting TLS 1.2.
 104                         if hello.vers < VersionTLS12 && suite.flags&suiteTLS12 != 0 {
 105                                 continue
 106                         }
 107                         // Don't advertise non-DTLS cipher suites on DTLS.
 108                         if c.isDTLS && suite.flags&suiteNoDTLS != 0 {
 109                                 continue
 110                         }
 111                         hello.cipherSuites = append(hello.cipherSuites, suiteId)
 112                         continue NextCipherSuite
 113                 }
 114         }
 115
 116         if c.config.Bugs.SendFallbackSCSV {
 117                 hello.cipherSuites = append(hello.cipherSuites, fallbackSCSV)
 118         }
 119
 120         _, err := io.ReadFull(c.config.rand(), hello.random)
 121         if err != nil {
 122                 c.sendAlert(alertInternalError)
 123                 return errors.New("tls: short read from Rand: " + err.Error())
 124         }
 125
 126         if hello.vers >= VersionTLS12 {
 127                 hello.signatureAndHashes = supportedSKXSignatureAlgorithms
 128         }
 129
 130         var session *ClientSessionState
 131         var cacheKey string
 132         sessionCache := c.config.ClientSessionCache
 133         if c.config.SessionTicketsDisabled {
 134                 sessionCache = nil
 135         }
 136
 137         if sessionCache != nil {
 138                 hello.ticketSupported = true
 139
 140                 // Try to resume a previously negotiated TLS session, if
 141                 // available.
 142                 cacheKey = clientSessionCacheKey(c.conn.RemoteAddr(), c.config)
 143                 candidateSession, ok := sessionCache.Get(cacheKey)
 144                 if ok {
 145                         // Check that the ciphersuite/version used for the
 146                         // previous session are still valid.
 147                         cipherSuiteOk := false
 148                         for _, id := range hello.cipherSuites {
 149                                 if id == candidateSession.cipherSuite {
 150                                         cipherSuiteOk = true
 151                                         break
 152                                 }
 153                         }
 154
 155                         versOk := candidateSession.vers >= c.config.minVersion() &&
 156                                 candidateSession.vers <= c.config.maxVersion()
 157                         if versOk && cipherSuiteOk {
 158                                 session = candidateSession
 159                         }
 160                 }
 161         }
 162
 163         if session != nil {
 164                 hello.sessionTicket = session.sessionTicket
 165                 if c.config.Bugs.CorruptTicket {
 166                         hello.sessionTicket = make([]byte, len(session.sessionTicket))
 167                         copy(hello.sessionTicket, session.sessionTicket)
 168                         if len(hello.sessionTicket) > 0 {
 169                                 offset := 40
 170                                 if offset > len(hello.sessionTicket) {
 171                                         offset = len(hello.sessionTicket) - 1
 172                                 }
 173                                 hello.sessionTicket[offset] ^= 0x40
 174                         }
 175                 }
 176                 // A random session ID is used to detect when the
 177                 // server accepted the ticket and is resuming a session
 178                 // (see RFC 5077).
 179                 sessionIdLen := 16
 180                 if c.config.Bugs.OversizedSessionId {
 181                         sessionIdLen = 33
 182                 }
 183                 hello.sessionId = make([]byte, sessionIdLen)
 184                 if _, err := io.ReadFull(c.config.rand(), hello.sessionId); err != nil {
 185                         c.sendAlert(alertInternalError)
 186                         return errors.New("tls: short read from Rand: " + err.Error())
 187                 }
 188         }
 189
 190         var helloBytes []byte
 191         if c.config.Bugs.SendV2ClientHello {
 192                 v2Hello := &v2ClientHelloMsg{
 193                         vers:         hello.vers,
 194                         cipherSuites: hello.cipherSuites,
 195                         // No session resumption for V2ClientHello.
 196                         sessionId: nil,
 197                         challenge: hello.random,
 198                 }
 199                 helloBytes = v2Hello.marshal()
 200                 c.writeV2Record(helloBytes)
 201         } else {
 202                 helloBytes = hello.marshal()
 203                 c.writeRecord(recordTypeHandshake, helloBytes)
 204         }
 205
 206         msg, err := c.readHandshake()
 207         if err != nil {
 208                 return err
 209         }
 210
 211         if c.isDTLS {
 212                 helloVerifyRequest, ok := msg.(*helloVerifyRequestMsg)
 213                 if ok {
 214                         if helloVerifyRequest.vers != VersionTLS10 {
 215                                 // Per RFC 6347, the version field in
 216                                 // HelloVerifyRequest SHOULD be always DTLS
 217                                 // 1.0. Enforce this for testing purposes.
 218                                 return errors.New("dtls: bad HelloVerifyRequest version")
 219                         }
 220
 221                         hello.raw = nil
 222                         hello.cookie = helloVerifyRequest.cookie
 223                         helloBytes = hello.marshal()
 224                         c.writeRecord(recordTypeHandshake, helloBytes)
 225
 226                         msg, err = c.readHandshake()
 227                         if err != nil {
 228                                 return err
 229                         }
 230                 }
 231         }
 232
 233         serverHello, ok := msg.(*serverHelloMsg)
 234         if !ok {
 235                 c.sendAlert(alertUnexpectedMessage)
 236                 return unexpectedMessageError(serverHello, msg)
 237         }
 238
 239         c.vers, ok = c.config.mutualVersion(serverHello.vers)
 240         if !ok {
 241                 c.sendAlert(alertProtocolVersion)
 242                 return fmt.Errorf("tls: server selected unsupported protocol version %x", serverHello.vers)
 243         }
 244         c.haveVers = true
 245
 246         suite := mutualCipherSuite(c.config.cipherSuites(), serverHello.cipherSuite)
 247         if suite == nil {
 248                 c.sendAlert(alertHandshakeFailure)
 249                 return fmt.Errorf("tls: server selected an unsupported cipher suite")
 250         }
 251
 252         if len(c.clientVerify) > 0 {
 253                 var expectedRenegInfo []byte
 254                 expectedRenegInfo = append(expectedRenegInfo, c.clientVerify...)
 255                 expectedRenegInfo = append(expectedRenegInfo, c.serverVerify...)
 256                 if !bytes.Equal(serverHello.secureRenegotiation, expectedRenegInfo) {
 257                         c.sendAlert(alertHandshakeFailure)
 258                         return fmt.Errorf("tls: renegotiation mismatch")
 259                 }
 260         }
 261
 262         hs := &clientHandshakeState{
 263                 c:            c,
 264                 serverHello:  serverHello,
 265                 hello:        hello,
 266                 suite:        suite,
 267                 finishedHash: newFinishedHash(c.vers, suite),
 268                 session:      session,
 269         }
 270
 271         hs.writeHash(helloBytes, hs.c.sendHandshakeSeq-1)
 272         hs.writeServerHash(hs.serverHello.marshal())
 273
 274         if c.config.Bugs.EarlyChangeCipherSpec > 0 {
 275                 hs.establishKeys()
 276                 c.writeRecord(recordTypeChangeCipherSpec, []byte{1})
 277         }
 278
 279         isResume, err := hs.processServerHello()
 280         if err != nil {
 281                 return err
 282         }
 283
 284         if isResume {
 285                 if c.config.Bugs.EarlyChangeCipherSpec == 0 {
 286                         if err := hs.establishKeys(); err != nil {
 287                                 return err
 288                         }
 289                 }
 290                 if err := hs.readSessionTicket(); err != nil {
 291                         return err
 292                 }
 293                 if err := hs.readFinished(); err != nil {
 294                         return err
 295                 }
 296                 if err := hs.sendFinished(isResume); err != nil {
 297                         return err
 298                 }
 299         } else {
 300                 if err := hs.doFullHandshake(); err != nil {
 301                         return err
 302                 }
 303                 if err := hs.establishKeys(); err != nil {
 304                         return err
 305                 }
 306                 if err := hs.sendFinished(isResume); err != nil {
 307                         return err
 308                 }
 309                 if err := hs.readSessionTicket(); err != nil {
 310                         return err
 311                 }
 312                 if err := hs.readFinished(); err != nil {
 313                         return err
 314                 }
 315         }
 316
 317         if sessionCache != nil && hs.session != nil && session != hs.session {
 318                 sessionCache.Put(cacheKey, hs.session)
 319         }
 320
 321         c.didResume = isResume
 322         c.handshakeComplete = true
 323         c.cipherSuite = suite.id
 324         return nil
 325 }
 326
 327 func (hs *clientHandshakeState) doFullHandshake() error {
 328         c := hs.c
 329
 330         var leaf *x509.Certificate
 331         if hs.suite.flags&suitePSK == 0 {
 332                 msg, err := c.readHandshake()
 333                 if err != nil {
 334                         return err
 335                 }
 336
 337                 certMsg, ok := msg.(*certificateMsg)
 338                 if !ok || len(certMsg.certificates) == 0 {
 339                         c.sendAlert(alertUnexpectedMessage)
 340                         return unexpectedMessageError(certMsg, msg)
 341                 }
 342                 hs.writeServerHash(certMsg.marshal())
 343
 344                 certs := make([]*x509.Certificate, len(certMsg.certificates))
 345                 for i, asn1Data := range certMsg.certificates {
 346                         cert, err := x509.ParseCertificate(asn1Data)
 347                         if err != nil {
 348                                 c.sendAlert(alertBadCertificate)
 349                                 return errors.New("tls: failed to parse certificate from server: " + err.Error())
 350                         }
 351                         certs[i] = cert
 352                 }
 353                 leaf = certs[0]
 354
 355                 if !c.config.InsecureSkipVerify {
 356                         opts := x509.VerifyOptions{
 357                                 Roots:         c.config.RootCAs,
 358                                 CurrentTime:   c.config.time(),
 359                                 DNSName:       c.config.ServerName,
 360                                 Intermediates: x509.NewCertPool(),
 361                         }
 362
 363                         for i, cert := range certs {
 364                                 if i == 0 {
 365                                         continue
 366                                 }
 367                                 opts.Intermediates.AddCert(cert)
 368                         }
 369                         c.verifiedChains, err = leaf.Verify(opts)
 370                         if err != nil {
 371                                 c.sendAlert(alertBadCertificate)
 372                                 return err
 373                         }
 374                 }
 375
 376                 switch leaf.PublicKey.(type) {
 377                 case *rsa.PublicKey, *ecdsa.PublicKey:
 378                         break
 379                 default:
 380                         c.sendAlert(alertUnsupportedCertificate)
 381                         return fmt.Errorf("tls: server's certificate contains an unsupported type of public key: %T", leaf.PublicKey)
 382                 }
 383
 384                 c.peerCertificates = certs
 385         }
 386
 387         if hs.serverHello.ocspStapling {
 388                 msg, err := c.readHandshake()
 389                 if err != nil {
 390                         return err
 391                 }
 392                 cs, ok := msg.(*certificateStatusMsg)
 393                 if !ok {
 394                         c.sendAlert(alertUnexpectedMessage)
 395                         return unexpectedMessageError(cs, msg)
 396                 }
 397                 hs.writeServerHash(cs.marshal())
 398
 399                 if cs.statusType == statusTypeOCSP {
 400                         c.ocspResponse = cs.response
 401                 }
 402         }
 403
 404         msg, err := c.readHandshake()
 405         if err != nil {
 406                 return err
 407         }
 408
 409         keyAgreement := hs.suite.ka(c.vers)
 410
 411         skx, ok := msg.(*serverKeyExchangeMsg)
 412         if ok {
 413                 hs.writeServerHash(skx.marshal())
 414                 err = keyAgreement.processServerKeyExchange(c.config, hs.hello, hs.serverHello, leaf, skx)
 415                 if err != nil {
 416                         c.sendAlert(alertUnexpectedMessage)
 417                         return err
 418                 }
 419
 420                 msg, err = c.readHandshake()
 421                 if err != nil {
 422                         return err
 423                 }
 424         }
 425
 426         var chainToSend *Certificate
 427         var certRequested bool
 428         certReq, ok := msg.(*certificateRequestMsg)
 429         if ok {
 430                 certRequested = true
 431
 432                 // RFC 4346 on the certificateAuthorities field:
 433                 // A list of the distinguished names of acceptable certificate
 434                 // authorities. These distinguished names may specify a desired
 435                 // distinguished name for a root CA or for a subordinate CA;
 436                 // thus, this message can be used to describe both known roots
 437                 // and a desired authorization space. If the
 438                 // certificate_authorities list is empty then the client MAY
 439                 // send any certificate of the appropriate
 440                 // ClientCertificateType, unless there is some external
 441                 // arrangement to the contrary.
 442
 443                 hs.writeServerHash(certReq.marshal())
 444
 445                 var rsaAvail, ecdsaAvail bool
 446                 for _, certType := range certReq.certificateTypes {
 447                         switch certType {
 448                         case CertTypeRSASign:
 449                                 rsaAvail = true
 450                         case CertTypeECDSASign:
 451                                 ecdsaAvail = true
 452                         }
 453                 }
 454
 455                 // We need to search our list of client certs for one
 456                 // where SignatureAlgorithm is RSA and the Issuer is in
 457                 // certReq.certificateAuthorities
 458         findCert:
 459                 for i, chain := range c.config.Certificates {
 460                         if !rsaAvail && !ecdsaAvail {
 461                                 continue
 462                         }
 463
 464                         for j, cert := range chain.Certificate {
 465                                 x509Cert := chain.Leaf
 466                                 // parse the certificate if this isn't the leaf
 467                                 // node, or if chain.Leaf was nil
 468                                 if j != 0 || x509Cert == nil {
 469                                         if x509Cert, err = x509.ParseCertificate(cert); err != nil {
 470                                                 c.sendAlert(alertInternalError)
 471                                                 return errors.New("tls: failed to parse client certificate #" + strconv.Itoa(i) + ": " + err.Error())
 472                                         }
 473                                 }
 474
 475                                 switch {
 476                                 case rsaAvail && x509Cert.PublicKeyAlgorithm == x509.RSA:
 477                                 case ecdsaAvail && x509Cert.PublicKeyAlgorithm == x509.ECDSA:
 478                                 default:
 479                                         continue findCert
 480                                 }
 481
 482                                 if len(certReq.certificateAuthorities) == 0 {
 483                                         // they gave us an empty list, so just take the
 484                                         // first RSA cert from c.config.Certificates
 485                                         chainToSend = &chain
 486                                         break findCert
 487                                 }
 488
 489                                 for _, ca := range certReq.certificateAuthorities {
 490                                         if bytes.Equal(x509Cert.RawIssuer, ca) {
 491                                                 chainToSend = &chain
 492                                                 break findCert
 493                                         }
 494                                 }
 495                         }
 496                 }
 497
 498                 msg, err = c.readHandshake()
 499                 if err != nil {
 500                         return err
 501                 }
 502         }
 503
 504         shd, ok := msg.(*serverHelloDoneMsg)
 505         if !ok {
 506                 c.sendAlert(alertUnexpectedMessage)
 507                 return unexpectedMessageError(shd, msg)
 508         }
 509         hs.writeServerHash(shd.marshal())
 510
 511         // If the server requested a certificate then we have to send a
 512         // Certificate message, even if it's empty because we don't have a
 513         // certificate to send.
 514         if certRequested {
 515                 certMsg := new(certificateMsg)
 516                 if chainToSend != nil {
 517                         certMsg.certificates = chainToSend.Certificate
 518                 }
 519                 hs.writeClientHash(certMsg.marshal())
 520                 c.writeRecord(recordTypeHandshake, certMsg.marshal())
 521         }
 522
 523         preMasterSecret, ckx, err := keyAgreement.generateClientKeyExchange(c.config, hs.hello, leaf)
 524         if err != nil {
 525                 c.sendAlert(alertInternalError)
 526                 return err
 527         }
 528         if ckx != nil {
 529                 if c.config.Bugs.EarlyChangeCipherSpec < 2 {
 530                         hs.writeClientHash(ckx.marshal())
 531                 }
 532                 c.writeRecord(recordTypeHandshake, ckx.marshal())
 533         }
 534
 535         if hs.serverHello.extendedMasterSecret && c.vers >= VersionTLS10 {
 536                 hs.masterSecret = extendedMasterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.finishedHash)
 537                 c.extendedMasterSecret = true
 538         } else {
 539                 if c.config.Bugs.RequireExtendedMasterSecret {
 540                         return errors.New("tls: extended master secret required but not supported by peer")
 541                 }
 542                 hs.masterSecret = masterFromPreMasterSecret(c.vers, hs.suite, preMasterSecret, hs.hello.random, hs.serverHello.random)
 543         }
 544
 545         if chainToSend != nil {
 546                 var signed []byte
 547                 certVerify := &certificateVerifyMsg{
 548                         hasSignatureAndHash: c.vers >= VersionTLS12,
 549                 }
 550
 551                 switch key := c.config.Certificates[0].PrivateKey.(type) {
 552                 case *ecdsa.PrivateKey:
 553                         certVerify.signatureAndHash, err = hs.finishedHash.selectClientCertSignatureAlgorithm(certReq.signatureAndHashes, signatureECDSA)
 554                         if err != nil {
 555                                 break
 556                         }
 557                         var digest []byte
 558                         digest, _, err = hs.finishedHash.hashForClientCertificate(certVerify.signatureAndHash, hs.masterSecret)
 559                         if err != nil {
 560                                 break
 561                         }
 562                         var r, s *big.Int
 563                         r, s, err = ecdsa.Sign(c.config.rand(), key, digest)
 564                         if err == nil {
 565                                 signed, err = asn1.Marshal(ecdsaSignature{r, s})
 566                         }
 567                 case *rsa.PrivateKey:
 568                         certVerify.signatureAndHash, err = hs.finishedHash.selectClientCertSignatureAlgorithm(certReq.signatureAndHashes, signatureRSA)
 569                         if err != nil {
 570                                 break
 571                         }
 572                         var digest []byte
 573                         var hashFunc crypto.Hash
 574                         digest, hashFunc, err = hs.finishedHash.hashForClientCertificate(certVerify.signatureAndHash, hs.masterSecret)
 575                         if err != nil {
 576                                 break
 577                         }
 578                         signed, err = rsa.SignPKCS1v15(c.config.rand(), key, hashFunc, digest)
 579                 default:
 580                         err = errors.New("unknown private key type")
 581                 }
 582                 if err != nil {
 583                         c.sendAlert(alertInternalError)
 584                         return errors.New("tls: failed to sign handshake with client certificate: " + err.Error())
 585                 }
 586                 certVerify.signature = signed
 587
 588                 hs.writeClientHash(certVerify.marshal())
 589                 c.writeRecord(recordTypeHandshake, certVerify.marshal())
 590         }
 591
 592         hs.finishedHash.discardHandshakeBuffer()
 593
 594         return nil
 595 }
 596
 597 func (hs *clientHandshakeState) establishKeys() error {
 598         c := hs.c
 599
 600         clientMAC, serverMAC, clientKey, serverKey, clientIV, serverIV :=
 601                 keysFromMasterSecret(c.vers, hs.suite, hs.masterSecret, hs.hello.random, hs.serverHello.random, hs.suite.macLen, hs.suite.keyLen, hs.suite.ivLen)
 602         var clientCipher, serverCipher interface{}
 603         var clientHash, serverHash macFunction
 604         if hs.suite.cipher != nil {
 605                 clientCipher = hs.suite.cipher(clientKey, clientIV, false /* not for reading */)
 606                 clientHash = hs.suite.mac(c.vers, clientMAC)
 607                 serverCipher = hs.suite.cipher(serverKey, serverIV, true /* for reading */)
 608                 serverHash = hs.suite.mac(c.vers, serverMAC)
 609         } else {
 610                 clientCipher = hs.suite.aead(clientKey, clientIV)
 611                 serverCipher = hs.suite.aead(serverKey, serverIV)
 612         }
 613
 614         c.in.prepareCipherSpec(c.vers, serverCipher, serverHash)
 615         c.out.prepareCipherSpec(c.vers, clientCipher, clientHash)
 616         return nil
 617 }
 618
 619 func (hs *clientHandshakeState) serverResumedSession() bool {
 620         // If the server responded with the same sessionId then it means the
 621         // sessionTicket is being used to resume a TLS session.
 622         return hs.session != nil && hs.hello.sessionId != nil &&
 623                 bytes.Equal(hs.serverHello.sessionId, hs.hello.sessionId)
 624 }
 625
 626 func (hs *clientHandshakeState) processServerHello() (bool, error) {
 627         c := hs.c
 628
 629         if hs.serverHello.compressionMethod != compressionNone {
 630                 c.sendAlert(alertUnexpectedMessage)
 631                 return false, errors.New("tls: server selected unsupported compression format")
 632         }
 633
 634         clientDidNPN := hs.hello.nextProtoNeg
 635         clientDidALPN := len(hs.hello.alpnProtocols) > 0
 636         serverHasNPN := hs.serverHello.nextProtoNeg
 637         serverHasALPN := len(hs.serverHello.alpnProtocol) > 0
 638
 639         if !clientDidNPN && serverHasNPN {
 640                 c.sendAlert(alertHandshakeFailure)
 641                 return false, errors.New("server advertised unrequested NPN extension")
 642         }
 643
 644         if !clientDidALPN && serverHasALPN {
 645                 c.sendAlert(alertHandshakeFailure)
 646                 return false, errors.New("server advertised unrequested ALPN extension")
 647         }
 648
 649         if serverHasNPN && serverHasALPN {
 650                 c.sendAlert(alertHandshakeFailure)
 651                 return false, errors.New("server advertised both NPN and ALPN extensions")
 652         }
 653
 654         if serverHasALPN {
 655                 c.clientProtocol = hs.serverHello.alpnProtocol
 656                 c.clientProtocolFallback = false
 657                 c.usedALPN = true
 658         }
 659
 660         if !hs.hello.channelIDSupported && hs.serverHello.channelIDRequested {
 661                 c.sendAlert(alertHandshakeFailure)
 662                 return false, errors.New("server advertised unrequested Channel ID extension")
 663         }
 664
 665         if hs.serverResumedSession() {
 666                 // Restore masterSecret and peerCerts from previous state
 667                 hs.masterSecret = hs.session.masterSecret
 668                 c.peerCertificates = hs.session.serverCertificates
 669                 c.extendedMasterSecret = hs.session.extendedMasterSecret
 670                 hs.finishedHash.discardHandshakeBuffer()
 671                 return true, nil
 672         }
 673         return false, nil
 674 }
 675
 676 func (hs *clientHandshakeState) readFinished() error {
 677         c := hs.c
 678
 679         c.readRecord(recordTypeChangeCipherSpec)
 680         if err := c.in.error(); err != nil {
 681                 return err
 682         }
 683
 684         msg, err := c.readHandshake()
 685         if err != nil {
 686                 return err
 687         }
 688         serverFinished, ok := msg.(*finishedMsg)
 689         if !ok {
 690                 c.sendAlert(alertUnexpectedMessage)
 691                 return unexpectedMessageError(serverFinished, msg)
 692         }
 693
 694         if c.config.Bugs.EarlyChangeCipherSpec == 0 {
 695                 verify := hs.finishedHash.serverSum(hs.masterSecret)
 696                 if len(verify) != len(serverFinished.verifyData) ||
 697                         subtle.ConstantTimeCompare(verify, serverFinished.verifyData) != 1 {
 698                         c.sendAlert(alertHandshakeFailure)
 699                         return errors.New("tls: server's Finished message was incorrect")
 700                 }
 701         }
 702         c.serverVerify = append(c.serverVerify[:0], serverFinished.verifyData...)
 703         hs.writeServerHash(serverFinished.marshal())
 704         return nil
 705 }
 706
 707 func (hs *clientHandshakeState) readSessionTicket() error {
 708         if !hs.serverHello.ticketSupported {
 709                 return nil
 710         }
 711
 712         c := hs.c
 713         msg, err := c.readHandshake()
 714         if err != nil {
 715                 return err
 716         }
 717         sessionTicketMsg, ok := msg.(*newSessionTicketMsg)
 718         if !ok {
 719                 c.sendAlert(alertUnexpectedMessage)
 720                 return unexpectedMessageError(sessionTicketMsg, msg)
 721         }
 722
 723         hs.session = &ClientSessionState{
 724                 sessionTicket:      sessionTicketMsg.ticket,
 725                 vers:               c.vers,
 726                 cipherSuite:        hs.suite.id,
 727                 masterSecret:       hs.masterSecret,
 728                 handshakeHash:      hs.finishedHash.server.Sum(nil),
 729                 serverCertificates: c.peerCertificates,
 730         }
 731
 732         hs.writeServerHash(sessionTicketMsg.marshal())
 733
 734         return nil
 735 }
 736
 737 func (hs *clientHandshakeState) sendFinished(isResume bool) error {
 738         c := hs.c
 739
 740         var postCCSBytes []byte
 741         seqno := hs.c.sendHandshakeSeq
 742         if hs.serverHello.nextProtoNeg {
 743                 nextProto := new(nextProtoMsg)
 744                 proto, fallback := mutualProtocol(c.config.NextProtos, hs.serverHello.nextProtos)
 745                 nextProto.proto = proto
 746                 c.clientProtocol = proto
 747                 c.clientProtocolFallback = fallback
 748
 749                 nextProtoBytes := nextProto.marshal()
 750                 hs.writeHash(nextProtoBytes, seqno)
 751                 seqno++
 752                 postCCSBytes = append(postCCSBytes, nextProtoBytes...)
 753         }
 754
 755         if hs.serverHello.channelIDRequested {
 756                 encryptedExtensions := new(encryptedExtensionsMsg)
 757                 if c.config.ChannelID.Curve != elliptic.P256() {
 758                         return fmt.Errorf("tls: Channel ID is not on P-256.")
 759                 }
 760                 var resumeHash []byte
 761                 if isResume {
 762                         resumeHash = hs.session.handshakeHash
 763                 }
 764                 r, s, err := ecdsa.Sign(c.config.rand(), c.config.ChannelID, hs.finishedHash.hashForChannelID(resumeHash))
 765                 if err != nil {
 766                         return err
 767                 }
 768                 channelID := make([]byte, 128)
 769                 writeIntPadded(channelID[0:32], c.config.ChannelID.X)
 770                 writeIntPadded(channelID[32:64], c.config.ChannelID.Y)
 771                 writeIntPadded(channelID[64:96], r)
 772                 writeIntPadded(channelID[96:128], s)
 773                 encryptedExtensions.channelID = channelID
 774
 775                 c.channelID = &c.config.ChannelID.PublicKey
 776
 777                 encryptedExtensionsBytes := encryptedExtensions.marshal()
 778                 hs.writeHash(encryptedExtensionsBytes, seqno)
 779                 seqno++
 780                 postCCSBytes = append(postCCSBytes, encryptedExtensionsBytes...)
 781         }
 782
 783         finished := new(finishedMsg)
 784         if c.config.Bugs.EarlyChangeCipherSpec == 2 {
 785                 finished.verifyData = hs.finishedHash.clientSum(nil)
 786         } else {
 787                 finished.verifyData = hs.finishedHash.clientSum(hs.masterSecret)
 788         }
 789         c.clientVerify = append(c.clientVerify[:0], finished.verifyData...)
 790         finishedBytes := finished.marshal()
 791         hs.writeHash(finishedBytes, seqno)
 792         postCCSBytes = append(postCCSBytes, finishedBytes...)
 793
 794         if c.config.Bugs.FragmentAcrossChangeCipherSpec {
 795                 c.writeRecord(recordTypeHandshake, postCCSBytes[:5])
 796                 postCCSBytes = postCCSBytes[5:]
 797         }
 798
 799         if !c.config.Bugs.SkipChangeCipherSpec &&
 800                 c.config.Bugs.EarlyChangeCipherSpec == 0 {
 801                 c.writeRecord(recordTypeChangeCipherSpec, []byte{1})
 802         }
 803
 804         c.writeRecord(recordTypeHandshake, postCCSBytes)
 805         return nil
 806 }
 807
 808 func (hs *clientHandshakeState) writeClientHash(msg []byte) {
 809         // writeClientHash is called before writeRecord.
 810         hs.writeHash(msg, hs.c.sendHandshakeSeq)
 811 }
 812
 813 func (hs *clientHandshakeState) writeServerHash(msg []byte) {
 814         // writeServerHash is called after readHandshake.
 815         hs.writeHash(msg, hs.c.recvHandshakeSeq-1)
 816 }
 817
 818 func (hs *clientHandshakeState) writeHash(msg []byte, seqno uint16) {
 819         if hs.c.isDTLS {
 820                 // This is somewhat hacky. DTLS hashes a slightly different format.
 821                 // First, the TLS header.
 822                 hs.finishedHash.Write(msg[:4])
 823                 // Then the sequence number and reassembled fragment offset (always 0).
 824                 hs.finishedHash.Write([]byte{byte(seqno >> 8), byte(seqno), 0, 0, 0})
 825                 // Then the reassembled fragment (always equal to the message length).
 826                 hs.finishedHash.Write(msg[1:4])
 827                 // And then the message body.
 828                 hs.finishedHash.Write(msg[4:])
 829         } else {
 830                 hs.finishedHash.Write(msg)
 831         }
 832 }
 833
 834 // clientSessionCacheKey returns a key used to cache sessionTickets that could
 835 // be used to resume previously negotiated TLS sessions with a server.
 836 func clientSessionCacheKey(serverAddr net.Addr, config *Config) string {
 837         if len(config.ServerName) > 0 {
 838                 return config.ServerName
 839         }
 840         return serverAddr.String()
 841 }
 842
 843 // mutualProtocol finds the mutual Next Protocol Negotiation or ALPN protocol
 844 // given list of possible protocols and a list of the preference order. The
 845 // first list must not be empty. It returns the resulting protocol and flag
 846 // indicating if the fallback case was reached.
 847 func mutualProtocol(protos, preferenceProtos []string) (string, bool) {
 848         for _, s := range preferenceProtos {
 849                 for _, c := range protos {
 850                         if s == c {
 851                                 return s, false
 852                         }
 853                 }
 854         }
 855
 856         return protos[0], true
 857 }
 858
 859 // writeIntPadded writes x into b, padded up with leading zeros as
 860 // needed.
 861 func writeIntPadded(b []byte, x *big.Int) {
 862         for i := range b {
 863                 b[i] = 0
 864         }
 865         xb := x.Bytes()
 866         copy(b[len(b)-len(xb):], xb)
 867 }