Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-12-08 06:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: simpler implementation of record layer

Browse source 
Depends on CL 957045, 980043, 1004043.
Fixes #715.

R=agl1, agl
CC=golang-dev
https://golang.org/cl/943043
This commit is contained in:
Russ Cox 2010-04-26 22:19:04 -07:00
parent 47a0533411
commit 72d9322032
15 changed files with 1076 additions and 1323 deletions
Download patch file Download diff file Expand all files Collapse all files

190
src/pkg/crypto/tls/handshake_client.go
View file

@ -12,74 +12,63 @@ import (
"crypto/subtle"
"crypto/x509"
"io"
"os"
)
// A serverHandshake performs the server side of the TLS 1.1 handshake protocol.
type clientHandshake struct {
writeChan chan<- interface{}
controlChan chan<- interface{}
msgChan <-chan interface{}
config *Config
}
func (h *clientHandshake) loop(writeChan chan<- interface{}, controlChan chan<- interface{}, msgChan <-chan interface{}, config *Config) {
h.writeChan = writeChan
h.controlChan = controlChan
h.msgChan = msgChan
h.config = config
defer close(writeChan)
defer close(controlChan)
func (c *Conn) clientHandshake() os.Error {
finishedHash := newFinishedHash()
config := defaultConfig()
hello := &clientHelloMsg{
major: defaultMajor,
minor: defaultMinor,
vers: maxVersion,
cipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA},
compressionMethods: []uint8{compressionNone},
random: make([]byte, 32),
}
currentTime := uint32(config.Time())
hello.random[0] = byte(currentTime >> 24)
hello.random[1] = byte(currentTime >> 16)
hello.random[2] = byte(currentTime >> 8)
hello.random[3] = byte(currentTime)
t := uint32(config.Time())
hello.random[0] = byte(t >> 24)
hello.random[1] = byte(t >> 16)
hello.random[2] = byte(t >> 8)
hello.random[3] = byte(t)
_, err := io.ReadFull(config.Rand, hello.random[4:])
if err != nil {
h.error(alertInternalError)
return
return c.sendAlert(alertInternalError)
}
finishedHash.Write(hello.marshal())
writeChan <- writerSetVersion{defaultMajor, defaultMinor}
writeChan <- hello
c.writeRecord(recordTypeHandshake, hello.marshal())
serverHello, ok := h.readHandshakeMsg().(*serverHelloMsg)
msg, err := c.readHandshake()
if err != nil {
return err
}
serverHello, ok := msg.(*serverHelloMsg)
if !ok {
h.error(alertUnexpectedMessage)
return
return c.sendAlert(alertUnexpectedMessage)
}
finishedHash.Write(serverHello.marshal())
major, minor, ok := mutualVersion(serverHello.major, serverHello.minor)
if !ok {
h.error(alertProtocolVersion)
return
}
writeChan <- writerSetVersion{major, minor}
vers, ok := mutualVersion(serverHello.vers)
if !ok {
c.sendAlert(alertProtocolVersion)
}
c.vers = vers
c.haveVers = true
if serverHello.cipherSuite != TLS_RSA_WITH_RC4_128_SHA ||
serverHello.compressionMethod != compressionNone {
h.error(alertUnexpectedMessage)
return
return c.sendAlert(alertUnexpectedMessage)
}
certMsg, ok := h.readHandshakeMsg().(*certificateMsg)
msg, err = c.readHandshake()
if err != nil {
return err
}
certMsg, ok := msg.(*certificateMsg)
if !ok || len(certMsg.certificates) == 0 {
h.error(alertUnexpectedMessage)
return
return c.sendAlert(alertUnexpectedMessage)
}
finishedHash.Write(certMsg.marshal())
@ -87,139 +76,98 @@ func (h *clientHandshake) loop(writeChan chan<- interface{}, controlChan chan<-
for i, asn1Data := range certMsg.certificates {
cert, err := x509.ParseCertificate(asn1Data)
if err != nil {
h.error(alertBadCertificate)
return
return c.sendAlert(alertBadCertificate)
}
certs[i] = cert
}
// TODO(agl): do better validation of certs: max path length, name restrictions etc.
for i := 1; i < len(certs); i++ {
if certs[i-1].CheckSignatureFrom(certs[i]) != nil {
h.error(alertBadCertificate)
return
if err := certs[i-1].CheckSignatureFrom(certs[i]); err != nil {
return c.sendAlert(alertBadCertificate)
}
}
if config.RootCAs != nil {
// TODO(rsc): Find certificates for OS X 10.6.
if false && config.RootCAs != nil {
root := config.RootCAs.FindParent(certs[len(certs)-1])
if root == nil {
h.error(alertBadCertificate)
return
return c.sendAlert(alertBadCertificate)
}
if certs[len(certs)-1].CheckSignatureFrom(root) != nil {
h.error(alertBadCertificate)
return
return c.sendAlert(alertBadCertificate)
}
}
pub, ok := certs[0].PublicKey.(*rsa.PublicKey)
if !ok {
h.error(alertUnsupportedCertificate)
return
return c.sendAlert(alertUnsupportedCertificate)
}
shd, ok := h.readHandshakeMsg().(*serverHelloDoneMsg)
msg, err = c.readHandshake()
if err != nil {
return err
}
shd, ok := msg.(*serverHelloDoneMsg)
if !ok {
h.error(alertUnexpectedMessage)
return
return c.sendAlert(alertUnexpectedMessage)
}
finishedHash.Write(shd.marshal())
ckx := new(clientKeyExchangeMsg)
preMasterSecret := make([]byte, 48)
// Note that the version number in the preMasterSecret must be the
// version offered in the ClientHello.
preMasterSecret[0] = defaultMajor
preMasterSecret[1] = defaultMinor
preMasterSecret[0] = byte(hello.vers >> 8)
preMasterSecret[1] = byte(hello.vers)
_, err = io.ReadFull(config.Rand, preMasterSecret[2:])
if err != nil {
h.error(alertInternalError)
return
return c.sendAlert(alertInternalError)
}
ckx.ciphertext, err = rsa.EncryptPKCS1v15(config.Rand, pub, preMasterSecret)
if err != nil {
h.error(alertInternalError)
return
return c.sendAlert(alertInternalError)
}
finishedHash.Write(ckx.marshal())
writeChan <- ckx
c.writeRecord(recordTypeHandshake, ckx.marshal())
suite := cipherSuites[0]
masterSecret, clientMAC, serverMAC, clientKey, serverKey :=
keysFromPreMasterSecret11(preMasterSecret, hello.random, serverHello.random, suite.hashLength, suite.cipherKeyLength)
cipher, _ := rc4.NewCipher(clientKey)
writeChan <- writerChangeCipherSpec{cipher, hmac.New(sha1.New(), clientMAC)}
c.out.prepareCipherSpec(cipher, hmac.New(sha1.New(), clientMAC))
c.writeRecord(recordTypeChangeCipherSpec, []byte{1})
finished := new(finishedMsg)
finished.verifyData = finishedHash.clientSum(masterSecret)
finishedHash.Write(finished.marshal())
writeChan <- finished
// TODO(agl): this is cut-through mode which should probably be an option.
writeChan <- writerEnableApplicationData{}
_, ok = h.readHandshakeMsg().(changeCipherSpec)
if !ok {
h.error(alertUnexpectedMessage)
return
}
c.writeRecord(recordTypeHandshake, finished.marshal())
cipher2, _ := rc4.NewCipher(serverKey)
controlChan <- &newCipherSpec{cipher2, hmac.New(sha1.New(), serverMAC)}
c.in.prepareCipherSpec(cipher2, hmac.New(sha1.New(), serverMAC))
c.readRecord(recordTypeChangeCipherSpec)
if c.err != nil {
return c.err
}
serverFinished, ok := h.readHandshakeMsg().(*finishedMsg)
msg, err = c.readHandshake()
if err != nil {
return err
}
serverFinished, ok := msg.(*finishedMsg)
if !ok {
h.error(alertUnexpectedMessage)
return
return c.sendAlert(alertUnexpectedMessage)
}
verify := finishedHash.serverSum(masterSecret)
if len(verify) != len(serverFinished.verifyData) ||
subtle.ConstantTimeCompare(verify, serverFinished.verifyData) != 1 {
h.error(alertHandshakeFailure)
return
return c.sendAlert(alertHandshakeFailure)
}
controlChan <- ConnectionState{HandshakeComplete: true, CipherSuite: "TLS_RSA_WITH_RC4_128_SHA"}
// This should just block forever.
_ = h.readHandshakeMsg()
h.error(alertUnexpectedMessage)
return
}
func (h *clientHandshake) readHandshakeMsg() interface{} {
v := <-h.msgChan
if closed(h.msgChan) {
// If the channel closed then the processor received an error
// from the peer and we don't want to echo it back to them.
h.msgChan = nil
return 0
}
if _, ok := v.(alert); ok {
// We got an alert from the processor. We forward to the writer
// and shutdown.
h.writeChan <- v
h.msgChan = nil
return 0
}
return v
}
func (h *clientHandshake) error(e alertType) {
if h.msgChan != nil {
// If we didn't get an error from the processor, then we need
// to tell it about the error.
go func() {
for _ = range h.msgChan {
}
}()
h.controlChan <- ConnectionState{Error: e}
close(h.controlChan)
h.writeChan <- alert{alertLevelError, e}
}
c.handshakeComplete = true
c.cipherSuite = TLS_RSA_WITH_RC4_128_SHA
return nil
}