Source file src/crypto/tls/handshake_messages.go

     1  // Copyright 2009 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package tls
     6  
     7  import (
     8  	"bytes"
     9  	"errors"
    10  	"fmt"
    11  	"slices"
    12  	"strings"
    13  
    14  	"golang.org/x/crypto/cryptobyte"
    15  )
    16  
    17  // The marshalingFunction type is an adapter to allow the use of ordinary
    18  // functions as cryptobyte.MarshalingValue.
    19  type marshalingFunction func(b *cryptobyte.Builder) error
    20  
    21  func (f marshalingFunction) Marshal(b *cryptobyte.Builder) error {
    22  	return f(b)
    23  }
    24  
    25  // addBytesWithLength appends a sequence of bytes to the cryptobyte.Builder. If
    26  // the length of the sequence is not the value specified, it produces an error.
    27  func addBytesWithLength(b *cryptobyte.Builder, v []byte, n int) {
    28  	b.AddValue(marshalingFunction(func(b *cryptobyte.Builder) error {
    29  		if len(v) != n {
    30  			return fmt.Errorf("invalid value length: expected %d, got %d", n, len(v))
    31  		}
    32  		b.AddBytes(v)
    33  		return nil
    34  	}))
    35  }
    36  
    37  // addUint64 appends a big-endian, 64-bit value to the cryptobyte.Builder.
    38  func addUint64(b *cryptobyte.Builder, v uint64) {
    39  	b.AddUint32(uint32(v >> 32))
    40  	b.AddUint32(uint32(v))
    41  }
    42  
    43  // readUint64 decodes a big-endian, 64-bit value into out and advances over it.
    44  // It reports whether the read was successful.
    45  func readUint64(s *cryptobyte.String, out *uint64) bool {
    46  	var hi, lo uint32
    47  	if !s.ReadUint32(&hi) || !s.ReadUint32(&lo) {
    48  		return false
    49  	}
    50  	*out = uint64(hi)<<32 | uint64(lo)
    51  	return true
    52  }
    53  
    54  // readUint8LengthPrefixed acts like s.ReadUint8LengthPrefixed, but targets a
    55  // []byte instead of a cryptobyte.String.
    56  func readUint8LengthPrefixed(s *cryptobyte.String, out *[]byte) bool {
    57  	return s.ReadUint8LengthPrefixed((*cryptobyte.String)(out))
    58  }
    59  
    60  // readUint16LengthPrefixed acts like s.ReadUint16LengthPrefixed, but targets a
    61  // []byte instead of a cryptobyte.String.
    62  func readUint16LengthPrefixed(s *cryptobyte.String, out *[]byte) bool {
    63  	return s.ReadUint16LengthPrefixed((*cryptobyte.String)(out))
    64  }
    65  
    66  // readUint24LengthPrefixed acts like s.ReadUint24LengthPrefixed, but targets a
    67  // []byte instead of a cryptobyte.String.
    68  func readUint24LengthPrefixed(s *cryptobyte.String, out *[]byte) bool {
    69  	return s.ReadUint24LengthPrefixed((*cryptobyte.String)(out))
    70  }
    71  
    72  type clientHelloMsg struct {
    73  	original                         []byte
    74  	vers                             uint16
    75  	random                           []byte
    76  	sessionId                        []byte
    77  	cipherSuites                     []uint16
    78  	compressionMethods               []uint8
    79  	serverName                       string
    80  	ocspStapling                     bool
    81  	supportedCurves                  []CurveID
    82  	supportedPoints                  []uint8
    83  	ticketSupported                  bool
    84  	sessionTicket                    []uint8
    85  	supportedSignatureAlgorithms     []SignatureScheme
    86  	supportedSignatureAlgorithmsCert []SignatureScheme
    87  	secureRenegotiationSupported     bool
    88  	secureRenegotiation              []byte
    89  	extendedMasterSecret             bool
    90  	alpnProtocols                    []string
    91  	scts                             bool
    92  	supportedVersions                []uint16
    93  	cookie                           []byte
    94  	keyShares                        []keyShare
    95  	earlyData                        bool
    96  	pskModes                         []uint8
    97  	pskIdentities                    []pskIdentity
    98  	pskBinders                       [][]byte
    99  	quicTransportParameters          []byte
   100  	encryptedClientHello             []byte
   101  	// extensions are only populated on the server-side of a handshake
   102  	extensions []uint16
   103  }
   104  
   105  func (m *clientHelloMsg) marshalMsg(echInner bool) ([]byte, error) {
   106  	var exts cryptobyte.Builder
   107  	if len(m.serverName) > 0 {
   108  		// RFC 6066, Section 3
   109  		exts.AddUint16(extensionServerName)
   110  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   111  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   112  				exts.AddUint8(0) // name_type = host_name
   113  				exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   114  					exts.AddBytes([]byte(m.serverName))
   115  				})
   116  			})
   117  		})
   118  	}
   119  	if len(m.supportedPoints) > 0 && !echInner {
   120  		// RFC 4492, Section 5.1.2
   121  		exts.AddUint16(extensionSupportedPoints)
   122  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   123  			exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   124  				exts.AddBytes(m.supportedPoints)
   125  			})
   126  		})
   127  	}
   128  	if m.ticketSupported && !echInner {
   129  		// RFC 5077, Section 3.2
   130  		exts.AddUint16(extensionSessionTicket)
   131  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   132  			exts.AddBytes(m.sessionTicket)
   133  		})
   134  	}
   135  	if m.secureRenegotiationSupported && !echInner {
   136  		// RFC 5746, Section 3.2
   137  		exts.AddUint16(extensionRenegotiationInfo)
   138  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   139  			exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   140  				exts.AddBytes(m.secureRenegotiation)
   141  			})
   142  		})
   143  	}
   144  	if m.extendedMasterSecret && !echInner {
   145  		// RFC 7627
   146  		exts.AddUint16(extensionExtendedMasterSecret)
   147  		exts.AddUint16(0) // empty extension_data
   148  	}
   149  	if m.scts {
   150  		// RFC 6962, Section 3.3.1
   151  		exts.AddUint16(extensionSCT)
   152  		exts.AddUint16(0) // empty extension_data
   153  	}
   154  	if m.earlyData {
   155  		// RFC 8446, Section 4.2.10
   156  		exts.AddUint16(extensionEarlyData)
   157  		exts.AddUint16(0) // empty extension_data
   158  	}
   159  	if m.quicTransportParameters != nil { // marshal zero-length parameters when present
   160  		// RFC 9001, Section 8.2
   161  		exts.AddUint16(extensionQUICTransportParameters)
   162  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   163  			exts.AddBytes(m.quicTransportParameters)
   164  		})
   165  	}
   166  	if len(m.encryptedClientHello) > 0 {
   167  		exts.AddUint16(extensionEncryptedClientHello)
   168  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   169  			exts.AddBytes(m.encryptedClientHello)
   170  		})
   171  	}
   172  	// Note that any extension that can be compressed during ECH must be
   173  	// contiguous. If any additional extensions are to be compressed they must
   174  	// be added to the following block, so that they can be properly
   175  	// decompressed on the other side.
   176  	var echOuterExts []uint16
   177  	if m.ocspStapling {
   178  		// RFC 4366, Section 3.6
   179  		if echInner {
   180  			echOuterExts = append(echOuterExts, extensionStatusRequest)
   181  		} else {
   182  			exts.AddUint16(extensionStatusRequest)
   183  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   184  				exts.AddUint8(1)  // status_type = ocsp
   185  				exts.AddUint16(0) // empty responder_id_list
   186  				exts.AddUint16(0) // empty request_extensions
   187  			})
   188  		}
   189  	}
   190  	if len(m.supportedCurves) > 0 {
   191  		// RFC 4492, sections 5.1.1 and RFC 8446, Section 4.2.7
   192  		if echInner {
   193  			echOuterExts = append(echOuterExts, extensionSupportedCurves)
   194  		} else {
   195  			exts.AddUint16(extensionSupportedCurves)
   196  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   197  				exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   198  					for _, curve := range m.supportedCurves {
   199  						exts.AddUint16(uint16(curve))
   200  					}
   201  				})
   202  			})
   203  		}
   204  	}
   205  	if len(m.supportedSignatureAlgorithms) > 0 {
   206  		// RFC 5246, Section 7.4.1.4.1
   207  		if echInner {
   208  			echOuterExts = append(echOuterExts, extensionSignatureAlgorithms)
   209  		} else {
   210  			exts.AddUint16(extensionSignatureAlgorithms)
   211  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   212  				exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   213  					for _, sigAlgo := range m.supportedSignatureAlgorithms {
   214  						exts.AddUint16(uint16(sigAlgo))
   215  					}
   216  				})
   217  			})
   218  		}
   219  	}
   220  	if len(m.supportedSignatureAlgorithmsCert) > 0 {
   221  		// RFC 8446, Section 4.2.3
   222  		if echInner {
   223  			echOuterExts = append(echOuterExts, extensionSignatureAlgorithmsCert)
   224  		} else {
   225  			exts.AddUint16(extensionSignatureAlgorithmsCert)
   226  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   227  				exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   228  					for _, sigAlgo := range m.supportedSignatureAlgorithmsCert {
   229  						exts.AddUint16(uint16(sigAlgo))
   230  					}
   231  				})
   232  			})
   233  		}
   234  	}
   235  	if len(m.alpnProtocols) > 0 {
   236  		// RFC 7301, Section 3.1
   237  		if echInner {
   238  			echOuterExts = append(echOuterExts, extensionALPN)
   239  		} else {
   240  			exts.AddUint16(extensionALPN)
   241  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   242  				exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   243  					for _, proto := range m.alpnProtocols {
   244  						exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   245  							exts.AddBytes([]byte(proto))
   246  						})
   247  					}
   248  				})
   249  			})
   250  		}
   251  	}
   252  	if len(m.supportedVersions) > 0 {
   253  		// RFC 8446, Section 4.2.1
   254  		if echInner {
   255  			echOuterExts = append(echOuterExts, extensionSupportedVersions)
   256  		} else {
   257  			exts.AddUint16(extensionSupportedVersions)
   258  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   259  				exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   260  					for _, vers := range m.supportedVersions {
   261  						exts.AddUint16(vers)
   262  					}
   263  				})
   264  			})
   265  		}
   266  	}
   267  	if len(m.cookie) > 0 {
   268  		// RFC 8446, Section 4.2.2
   269  		if echInner {
   270  			echOuterExts = append(echOuterExts, extensionCookie)
   271  		} else {
   272  			exts.AddUint16(extensionCookie)
   273  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   274  				exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   275  					exts.AddBytes(m.cookie)
   276  				})
   277  			})
   278  		}
   279  	}
   280  	if len(m.keyShares) > 0 {
   281  		// RFC 8446, Section 4.2.8
   282  		if echInner {
   283  			echOuterExts = append(echOuterExts, extensionKeyShare)
   284  		} else {
   285  			exts.AddUint16(extensionKeyShare)
   286  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   287  				exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   288  					for _, ks := range m.keyShares {
   289  						exts.AddUint16(uint16(ks.group))
   290  						exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   291  							exts.AddBytes(ks.data)
   292  						})
   293  					}
   294  				})
   295  			})
   296  		}
   297  	}
   298  	if len(m.pskModes) > 0 {
   299  		// RFC 8446, Section 4.2.9
   300  		if echInner {
   301  			echOuterExts = append(echOuterExts, extensionPSKModes)
   302  		} else {
   303  			exts.AddUint16(extensionPSKModes)
   304  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   305  				exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   306  					exts.AddBytes(m.pskModes)
   307  				})
   308  			})
   309  		}
   310  	}
   311  	if len(echOuterExts) > 0 && echInner {
   312  		exts.AddUint16(extensionECHOuterExtensions)
   313  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   314  			exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   315  				for _, e := range echOuterExts {
   316  					exts.AddUint16(e)
   317  				}
   318  			})
   319  		})
   320  	}
   321  	// pre_shared_key must be the last extension
   322  	if len(m.pskIdentities) > 0 && (echInner || len(m.encryptedClientHello) == 0 || bytes.Equal(m.encryptedClientHello, []byte{byte(innerECHExt)})) {
   323  		// RFC 8446, Section 4.2.11
   324  		exts.AddUint16(extensionPreSharedKey)
   325  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   326  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   327  				for _, psk := range m.pskIdentities {
   328  					exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   329  						exts.AddBytes(psk.label)
   330  					})
   331  					exts.AddUint32(psk.obfuscatedTicketAge)
   332  				}
   333  			})
   334  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   335  				for _, binder := range m.pskBinders {
   336  					exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   337  						exts.AddBytes(binder)
   338  					})
   339  				}
   340  			})
   341  		})
   342  	}
   343  	extBytes, err := exts.Bytes()
   344  	if err != nil {
   345  		return nil, err
   346  	}
   347  
   348  	var b cryptobyte.Builder
   349  	b.AddUint8(typeClientHello)
   350  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
   351  		b.AddUint16(m.vers)
   352  		addBytesWithLength(b, m.random, 32)
   353  		b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
   354  			if !echInner {
   355  				b.AddBytes(m.sessionId)
   356  			}
   357  		})
   358  		b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
   359  			for _, suite := range m.cipherSuites {
   360  				b.AddUint16(suite)
   361  			}
   362  		})
   363  		b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
   364  			b.AddBytes(m.compressionMethods)
   365  		})
   366  
   367  		if len(extBytes) > 0 {
   368  			b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
   369  				b.AddBytes(extBytes)
   370  			})
   371  		}
   372  	})
   373  
   374  	return b.Bytes()
   375  }
   376  
   377  func (m *clientHelloMsg) marshal() ([]byte, error) {
   378  	return m.marshalMsg(false)
   379  }
   380  
   381  // marshalWithoutBinders returns the ClientHello through the
   382  // PreSharedKeyExtension.identities field, according to RFC 8446, Section
   383  // 4.2.11.2. Note that m.pskBinders must be set to slices of the correct length.
   384  func (m *clientHelloMsg) marshalWithoutBinders() ([]byte, error) {
   385  	bindersLen := 2 // uint16 length prefix
   386  	for _, binder := range m.pskBinders {
   387  		bindersLen += 1 // uint8 length prefix
   388  		bindersLen += len(binder)
   389  	}
   390  
   391  	var fullMessage []byte
   392  	if m.original != nil {
   393  		fullMessage = m.original
   394  	} else {
   395  		var err error
   396  		fullMessage, err = m.marshal()
   397  		if err != nil {
   398  			return nil, err
   399  		}
   400  	}
   401  	return fullMessage[:len(fullMessage)-bindersLen], nil
   402  }
   403  
   404  // updateBinders updates the m.pskBinders field. The supplied binders must have
   405  // the same length as the current m.pskBinders.
   406  func (m *clientHelloMsg) updateBinders(pskBinders [][]byte) error {
   407  	if len(pskBinders) != len(m.pskBinders) {
   408  		return errors.New("tls: internal error: pskBinders length mismatch")
   409  	}
   410  	for i := range m.pskBinders {
   411  		if len(pskBinders[i]) != len(m.pskBinders[i]) {
   412  			return errors.New("tls: internal error: pskBinders length mismatch")
   413  		}
   414  	}
   415  	m.pskBinders = pskBinders
   416  
   417  	return nil
   418  }
   419  
   420  func (m *clientHelloMsg) unmarshal(data []byte) bool {
   421  	*m = clientHelloMsg{original: data}
   422  	s := cryptobyte.String(data)
   423  
   424  	if !s.Skip(4) || // message type and uint24 length field
   425  		!s.ReadUint16(&m.vers) || !s.ReadBytes(&m.random, 32) ||
   426  		!readUint8LengthPrefixed(&s, &m.sessionId) {
   427  		return false
   428  	}
   429  
   430  	var cipherSuites cryptobyte.String
   431  	if !s.ReadUint16LengthPrefixed(&cipherSuites) {
   432  		return false
   433  	}
   434  	m.cipherSuites = []uint16{}
   435  	m.secureRenegotiationSupported = false
   436  	for !cipherSuites.Empty() {
   437  		var suite uint16
   438  		if !cipherSuites.ReadUint16(&suite) {
   439  			return false
   440  		}
   441  		if suite == scsvRenegotiation {
   442  			m.secureRenegotiationSupported = true
   443  		}
   444  		m.cipherSuites = append(m.cipherSuites, suite)
   445  	}
   446  
   447  	if !readUint8LengthPrefixed(&s, &m.compressionMethods) {
   448  		return false
   449  	}
   450  
   451  	if s.Empty() {
   452  		// ClientHello is optionally followed by extension data
   453  		return true
   454  	}
   455  
   456  	var extensions cryptobyte.String
   457  	if !s.ReadUint16LengthPrefixed(&extensions) || !s.Empty() {
   458  		return false
   459  	}
   460  
   461  	seenExts := make(map[uint16]bool)
   462  	for !extensions.Empty() {
   463  		var extension uint16
   464  		var extData cryptobyte.String
   465  		if !extensions.ReadUint16(&extension) ||
   466  			!extensions.ReadUint16LengthPrefixed(&extData) {
   467  			return false
   468  		}
   469  
   470  		if seenExts[extension] {
   471  			return false
   472  		}
   473  		seenExts[extension] = true
   474  		m.extensions = append(m.extensions, extension)
   475  
   476  		switch extension {
   477  		case extensionServerName:
   478  			// RFC 6066, Section 3
   479  			var nameList cryptobyte.String
   480  			if !extData.ReadUint16LengthPrefixed(&nameList) || nameList.Empty() {
   481  				return false
   482  			}
   483  			for !nameList.Empty() {
   484  				var nameType uint8
   485  				var serverName cryptobyte.String
   486  				if !nameList.ReadUint8(&nameType) ||
   487  					!nameList.ReadUint16LengthPrefixed(&serverName) ||
   488  					serverName.Empty() {
   489  					return false
   490  				}
   491  				if nameType != 0 {
   492  					continue
   493  				}
   494  				if len(m.serverName) != 0 {
   495  					// Multiple names of the same name_type are prohibited.
   496  					return false
   497  				}
   498  				m.serverName = string(serverName)
   499  				// An SNI value may not include a trailing dot.
   500  				if strings.HasSuffix(m.serverName, ".") {
   501  					return false
   502  				}
   503  			}
   504  		case extensionStatusRequest:
   505  			// RFC 4366, Section 3.6
   506  			var statusType uint8
   507  			var ignored cryptobyte.String
   508  			if !extData.ReadUint8(&statusType) ||
   509  				!extData.ReadUint16LengthPrefixed(&ignored) ||
   510  				!extData.ReadUint16LengthPrefixed(&ignored) {
   511  				return false
   512  			}
   513  			m.ocspStapling = statusType == statusTypeOCSP
   514  		case extensionSupportedCurves:
   515  			// RFC 4492, sections 5.1.1 and RFC 8446, Section 4.2.7
   516  			var curves cryptobyte.String
   517  			if !extData.ReadUint16LengthPrefixed(&curves) || curves.Empty() {
   518  				return false
   519  			}
   520  			for !curves.Empty() {
   521  				var curve uint16
   522  				if !curves.ReadUint16(&curve) {
   523  					return false
   524  				}
   525  				m.supportedCurves = append(m.supportedCurves, CurveID(curve))
   526  			}
   527  		case extensionSupportedPoints:
   528  			// RFC 4492, Section 5.1.2
   529  			if !readUint8LengthPrefixed(&extData, &m.supportedPoints) ||
   530  				len(m.supportedPoints) == 0 {
   531  				return false
   532  			}
   533  		case extensionSessionTicket:
   534  			// RFC 5077, Section 3.2
   535  			m.ticketSupported = true
   536  			extData.ReadBytes(&m.sessionTicket, len(extData))
   537  		case extensionSignatureAlgorithms:
   538  			// RFC 5246, Section 7.4.1.4.1
   539  			var sigAndAlgs cryptobyte.String
   540  			if !extData.ReadUint16LengthPrefixed(&sigAndAlgs) || sigAndAlgs.Empty() {
   541  				return false
   542  			}
   543  			for !sigAndAlgs.Empty() {
   544  				var sigAndAlg uint16
   545  				if !sigAndAlgs.ReadUint16(&sigAndAlg) {
   546  					return false
   547  				}
   548  				m.supportedSignatureAlgorithms = append(
   549  					m.supportedSignatureAlgorithms, SignatureScheme(sigAndAlg))
   550  			}
   551  		case extensionSignatureAlgorithmsCert:
   552  			// RFC 8446, Section 4.2.3
   553  			var sigAndAlgs cryptobyte.String
   554  			if !extData.ReadUint16LengthPrefixed(&sigAndAlgs) || sigAndAlgs.Empty() {
   555  				return false
   556  			}
   557  			for !sigAndAlgs.Empty() {
   558  				var sigAndAlg uint16
   559  				if !sigAndAlgs.ReadUint16(&sigAndAlg) {
   560  					return false
   561  				}
   562  				m.supportedSignatureAlgorithmsCert = append(
   563  					m.supportedSignatureAlgorithmsCert, SignatureScheme(sigAndAlg))
   564  			}
   565  		case extensionRenegotiationInfo:
   566  			// RFC 5746, Section 3.2
   567  			if !readUint8LengthPrefixed(&extData, &m.secureRenegotiation) {
   568  				return false
   569  			}
   570  			m.secureRenegotiationSupported = true
   571  		case extensionExtendedMasterSecret:
   572  			// RFC 7627
   573  			m.extendedMasterSecret = true
   574  		case extensionALPN:
   575  			// RFC 7301, Section 3.1
   576  			var protoList cryptobyte.String
   577  			if !extData.ReadUint16LengthPrefixed(&protoList) || protoList.Empty() {
   578  				return false
   579  			}
   580  			for !protoList.Empty() {
   581  				var proto cryptobyte.String
   582  				if !protoList.ReadUint8LengthPrefixed(&proto) || proto.Empty() {
   583  					return false
   584  				}
   585  				m.alpnProtocols = append(m.alpnProtocols, string(proto))
   586  			}
   587  		case extensionSCT:
   588  			// RFC 6962, Section 3.3.1
   589  			m.scts = true
   590  		case extensionSupportedVersions:
   591  			// RFC 8446, Section 4.2.1
   592  			var versList cryptobyte.String
   593  			if !extData.ReadUint8LengthPrefixed(&versList) || versList.Empty() {
   594  				return false
   595  			}
   596  			for !versList.Empty() {
   597  				var vers uint16
   598  				if !versList.ReadUint16(&vers) {
   599  					return false
   600  				}
   601  				m.supportedVersions = append(m.supportedVersions, vers)
   602  			}
   603  		case extensionCookie:
   604  			// RFC 8446, Section 4.2.2
   605  			if !readUint16LengthPrefixed(&extData, &m.cookie) ||
   606  				len(m.cookie) == 0 {
   607  				return false
   608  			}
   609  		case extensionKeyShare:
   610  			// RFC 8446, Section 4.2.8
   611  			var clientShares cryptobyte.String
   612  			if !extData.ReadUint16LengthPrefixed(&clientShares) {
   613  				return false
   614  			}
   615  			for !clientShares.Empty() {
   616  				var ks keyShare
   617  				if !clientShares.ReadUint16((*uint16)(&ks.group)) ||
   618  					!readUint16LengthPrefixed(&clientShares, &ks.data) ||
   619  					len(ks.data) == 0 {
   620  					return false
   621  				}
   622  				m.keyShares = append(m.keyShares, ks)
   623  			}
   624  		case extensionEarlyData:
   625  			// RFC 8446, Section 4.2.10
   626  			m.earlyData = true
   627  		case extensionPSKModes:
   628  			// RFC 8446, Section 4.2.9
   629  			if !readUint8LengthPrefixed(&extData, &m.pskModes) {
   630  				return false
   631  			}
   632  		case extensionQUICTransportParameters:
   633  			m.quicTransportParameters = make([]byte, len(extData))
   634  			if !extData.CopyBytes(m.quicTransportParameters) {
   635  				return false
   636  			}
   637  		case extensionPreSharedKey:
   638  			// RFC 8446, Section 4.2.11
   639  			if !extensions.Empty() {
   640  				return false // pre_shared_key must be the last extension
   641  			}
   642  			var identities cryptobyte.String
   643  			if !extData.ReadUint16LengthPrefixed(&identities) || identities.Empty() {
   644  				return false
   645  			}
   646  			for !identities.Empty() {
   647  				var psk pskIdentity
   648  				if !readUint16LengthPrefixed(&identities, &psk.label) ||
   649  					!identities.ReadUint32(&psk.obfuscatedTicketAge) ||
   650  					len(psk.label) == 0 {
   651  					return false
   652  				}
   653  				m.pskIdentities = append(m.pskIdentities, psk)
   654  			}
   655  			var binders cryptobyte.String
   656  			if !extData.ReadUint16LengthPrefixed(&binders) || binders.Empty() {
   657  				return false
   658  			}
   659  			for !binders.Empty() {
   660  				var binder []byte
   661  				if !readUint8LengthPrefixed(&binders, &binder) ||
   662  					len(binder) == 0 {
   663  					return false
   664  				}
   665  				m.pskBinders = append(m.pskBinders, binder)
   666  			}
   667  		case extensionEncryptedClientHello:
   668  			if !extData.ReadBytes(&m.encryptedClientHello, len(extData)) {
   669  				return false
   670  			}
   671  		default:
   672  			// Ignore unknown extensions.
   673  			continue
   674  		}
   675  
   676  		if !extData.Empty() {
   677  			return false
   678  		}
   679  	}
   680  
   681  	return true
   682  }
   683  
   684  func (m *clientHelloMsg) originalBytes() []byte {
   685  	return m.original
   686  }
   687  
   688  func (m *clientHelloMsg) clone() *clientHelloMsg {
   689  	return &clientHelloMsg{
   690  		original:                         slices.Clone(m.original),
   691  		vers:                             m.vers,
   692  		random:                           slices.Clone(m.random),
   693  		sessionId:                        slices.Clone(m.sessionId),
   694  		cipherSuites:                     slices.Clone(m.cipherSuites),
   695  		compressionMethods:               slices.Clone(m.compressionMethods),
   696  		serverName:                       m.serverName,
   697  		ocspStapling:                     m.ocspStapling,
   698  		supportedCurves:                  slices.Clone(m.supportedCurves),
   699  		supportedPoints:                  slices.Clone(m.supportedPoints),
   700  		ticketSupported:                  m.ticketSupported,
   701  		sessionTicket:                    slices.Clone(m.sessionTicket),
   702  		supportedSignatureAlgorithms:     slices.Clone(m.supportedSignatureAlgorithms),
   703  		supportedSignatureAlgorithmsCert: slices.Clone(m.supportedSignatureAlgorithmsCert),
   704  		secureRenegotiationSupported:     m.secureRenegotiationSupported,
   705  		secureRenegotiation:              slices.Clone(m.secureRenegotiation),
   706  		extendedMasterSecret:             m.extendedMasterSecret,
   707  		alpnProtocols:                    slices.Clone(m.alpnProtocols),
   708  		scts:                             m.scts,
   709  		supportedVersions:                slices.Clone(m.supportedVersions),
   710  		cookie:                           slices.Clone(m.cookie),
   711  		keyShares:                        slices.Clone(m.keyShares),
   712  		earlyData:                        m.earlyData,
   713  		pskModes:                         slices.Clone(m.pskModes),
   714  		pskIdentities:                    slices.Clone(m.pskIdentities),
   715  		pskBinders:                       slices.Clone(m.pskBinders),
   716  		quicTransportParameters:          slices.Clone(m.quicTransportParameters),
   717  		encryptedClientHello:             slices.Clone(m.encryptedClientHello),
   718  	}
   719  }
   720  
   721  type serverHelloMsg struct {
   722  	original                     []byte
   723  	vers                         uint16
   724  	random                       []byte
   725  	sessionId                    []byte
   726  	cipherSuite                  uint16
   727  	compressionMethod            uint8
   728  	ocspStapling                 bool
   729  	ticketSupported              bool
   730  	secureRenegotiationSupported bool
   731  	secureRenegotiation          []byte
   732  	extendedMasterSecret         bool
   733  	alpnProtocol                 string
   734  	scts                         [][]byte
   735  	supportedVersion             uint16
   736  	serverShare                  keyShare
   737  	selectedIdentityPresent      bool
   738  	selectedIdentity             uint16
   739  	supportedPoints              []uint8
   740  	encryptedClientHello         []byte
   741  	serverNameAck                bool
   742  
   743  	// HelloRetryRequest extensions
   744  	cookie        []byte
   745  	selectedGroup CurveID
   746  }
   747  
   748  func (m *serverHelloMsg) marshal() ([]byte, error) {
   749  	var exts cryptobyte.Builder
   750  	if m.ocspStapling {
   751  		exts.AddUint16(extensionStatusRequest)
   752  		exts.AddUint16(0) // empty extension_data
   753  	}
   754  	if m.ticketSupported {
   755  		exts.AddUint16(extensionSessionTicket)
   756  		exts.AddUint16(0) // empty extension_data
   757  	}
   758  	if m.secureRenegotiationSupported {
   759  		exts.AddUint16(extensionRenegotiationInfo)
   760  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   761  			exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   762  				exts.AddBytes(m.secureRenegotiation)
   763  			})
   764  		})
   765  	}
   766  	if m.extendedMasterSecret {
   767  		exts.AddUint16(extensionExtendedMasterSecret)
   768  		exts.AddUint16(0) // empty extension_data
   769  	}
   770  	if len(m.alpnProtocol) > 0 {
   771  		exts.AddUint16(extensionALPN)
   772  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   773  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   774  				exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   775  					exts.AddBytes([]byte(m.alpnProtocol))
   776  				})
   777  			})
   778  		})
   779  	}
   780  	if len(m.scts) > 0 {
   781  		exts.AddUint16(extensionSCT)
   782  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   783  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   784  				for _, sct := range m.scts {
   785  					exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   786  						exts.AddBytes(sct)
   787  					})
   788  				}
   789  			})
   790  		})
   791  	}
   792  	if m.supportedVersion != 0 {
   793  		exts.AddUint16(extensionSupportedVersions)
   794  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   795  			exts.AddUint16(m.supportedVersion)
   796  		})
   797  	}
   798  	if m.serverShare.group != 0 {
   799  		exts.AddUint16(extensionKeyShare)
   800  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   801  			exts.AddUint16(uint16(m.serverShare.group))
   802  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   803  				exts.AddBytes(m.serverShare.data)
   804  			})
   805  		})
   806  	}
   807  	if m.selectedIdentityPresent {
   808  		exts.AddUint16(extensionPreSharedKey)
   809  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   810  			exts.AddUint16(m.selectedIdentity)
   811  		})
   812  	}
   813  
   814  	if len(m.cookie) > 0 {
   815  		exts.AddUint16(extensionCookie)
   816  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   817  			exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   818  				exts.AddBytes(m.cookie)
   819  			})
   820  		})
   821  	}
   822  	if m.selectedGroup != 0 {
   823  		exts.AddUint16(extensionKeyShare)
   824  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   825  			exts.AddUint16(uint16(m.selectedGroup))
   826  		})
   827  	}
   828  	if len(m.supportedPoints) > 0 {
   829  		exts.AddUint16(extensionSupportedPoints)
   830  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   831  			exts.AddUint8LengthPrefixed(func(exts *cryptobyte.Builder) {
   832  				exts.AddBytes(m.supportedPoints)
   833  			})
   834  		})
   835  	}
   836  	if len(m.encryptedClientHello) > 0 {
   837  		exts.AddUint16(extensionEncryptedClientHello)
   838  		exts.AddUint16LengthPrefixed(func(exts *cryptobyte.Builder) {
   839  			exts.AddBytes(m.encryptedClientHello)
   840  		})
   841  	}
   842  	if m.serverNameAck {
   843  		exts.AddUint16(extensionServerName)
   844  		exts.AddUint16(0)
   845  	}
   846  
   847  	extBytes, err := exts.Bytes()
   848  	if err != nil {
   849  		return nil, err
   850  	}
   851  
   852  	var b cryptobyte.Builder
   853  	b.AddUint8(typeServerHello)
   854  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
   855  		b.AddUint16(m.vers)
   856  		addBytesWithLength(b, m.random, 32)
   857  		b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
   858  			b.AddBytes(m.sessionId)
   859  		})
   860  		b.AddUint16(m.cipherSuite)
   861  		b.AddUint8(m.compressionMethod)
   862  
   863  		if len(extBytes) > 0 {
   864  			b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
   865  				b.AddBytes(extBytes)
   866  			})
   867  		}
   868  	})
   869  
   870  	return b.Bytes()
   871  }
   872  
   873  func (m *serverHelloMsg) unmarshal(data []byte) bool {
   874  	*m = serverHelloMsg{original: data}
   875  	s := cryptobyte.String(data)
   876  
   877  	if !s.Skip(4) || // message type and uint24 length field
   878  		!s.ReadUint16(&m.vers) || !s.ReadBytes(&m.random, 32) ||
   879  		!readUint8LengthPrefixed(&s, &m.sessionId) ||
   880  		!s.ReadUint16(&m.cipherSuite) ||
   881  		!s.ReadUint8(&m.compressionMethod) {
   882  		return false
   883  	}
   884  
   885  	if s.Empty() {
   886  		// ServerHello is optionally followed by extension data
   887  		return true
   888  	}
   889  
   890  	var extensions cryptobyte.String
   891  	if !s.ReadUint16LengthPrefixed(&extensions) || !s.Empty() {
   892  		return false
   893  	}
   894  
   895  	seenExts := make(map[uint16]bool)
   896  	for !extensions.Empty() {
   897  		var extension uint16
   898  		var extData cryptobyte.String
   899  		if !extensions.ReadUint16(&extension) ||
   900  			!extensions.ReadUint16LengthPrefixed(&extData) {
   901  			return false
   902  		}
   903  
   904  		if seenExts[extension] {
   905  			return false
   906  		}
   907  		seenExts[extension] = true
   908  
   909  		switch extension {
   910  		case extensionStatusRequest:
   911  			m.ocspStapling = true
   912  		case extensionSessionTicket:
   913  			m.ticketSupported = true
   914  		case extensionRenegotiationInfo:
   915  			if !readUint8LengthPrefixed(&extData, &m.secureRenegotiation) {
   916  				return false
   917  			}
   918  			m.secureRenegotiationSupported = true
   919  		case extensionExtendedMasterSecret:
   920  			m.extendedMasterSecret = true
   921  		case extensionALPN:
   922  			var protoList cryptobyte.String
   923  			if !extData.ReadUint16LengthPrefixed(&protoList) || protoList.Empty() {
   924  				return false
   925  			}
   926  			var proto cryptobyte.String
   927  			if !protoList.ReadUint8LengthPrefixed(&proto) ||
   928  				proto.Empty() || !protoList.Empty() {
   929  				return false
   930  			}
   931  			m.alpnProtocol = string(proto)
   932  		case extensionSCT:
   933  			var sctList cryptobyte.String
   934  			if !extData.ReadUint16LengthPrefixed(&sctList) || sctList.Empty() {
   935  				return false
   936  			}
   937  			for !sctList.Empty() {
   938  				var sct []byte
   939  				if !readUint16LengthPrefixed(&sctList, &sct) ||
   940  					len(sct) == 0 {
   941  					return false
   942  				}
   943  				m.scts = append(m.scts, sct)
   944  			}
   945  		case extensionSupportedVersions:
   946  			if !extData.ReadUint16(&m.supportedVersion) {
   947  				return false
   948  			}
   949  		case extensionCookie:
   950  			if !readUint16LengthPrefixed(&extData, &m.cookie) ||
   951  				len(m.cookie) == 0 {
   952  				return false
   953  			}
   954  		case extensionKeyShare:
   955  			// This extension has different formats in SH and HRR, accept either
   956  			// and let the handshake logic decide. See RFC 8446, Section 4.2.8.
   957  			if len(extData) == 2 {
   958  				if !extData.ReadUint16((*uint16)(&m.selectedGroup)) {
   959  					return false
   960  				}
   961  			} else {
   962  				if !extData.ReadUint16((*uint16)(&m.serverShare.group)) ||
   963  					!readUint16LengthPrefixed(&extData, &m.serverShare.data) {
   964  					return false
   965  				}
   966  			}
   967  		case extensionPreSharedKey:
   968  			m.selectedIdentityPresent = true
   969  			if !extData.ReadUint16(&m.selectedIdentity) {
   970  				return false
   971  			}
   972  		case extensionSupportedPoints:
   973  			// RFC 4492, Section 5.1.2
   974  			if !readUint8LengthPrefixed(&extData, &m.supportedPoints) ||
   975  				len(m.supportedPoints) == 0 {
   976  				return false
   977  			}
   978  		case extensionEncryptedClientHello: // encrypted_client_hello
   979  			m.encryptedClientHello = make([]byte, len(extData))
   980  			if !extData.CopyBytes(m.encryptedClientHello) {
   981  				return false
   982  			}
   983  		case extensionServerName:
   984  			if len(extData) != 0 {
   985  				return false
   986  			}
   987  			m.serverNameAck = true
   988  		default:
   989  			// Ignore unknown extensions.
   990  			continue
   991  		}
   992  
   993  		if !extData.Empty() {
   994  			return false
   995  		}
   996  	}
   997  
   998  	return true
   999  }
  1000  
  1001  func (m *serverHelloMsg) originalBytes() []byte {
  1002  	return m.original
  1003  }
  1004  
  1005  type encryptedExtensionsMsg struct {
  1006  	alpnProtocol            string
  1007  	quicTransportParameters []byte
  1008  	earlyData               bool
  1009  	echRetryConfigs         []byte
  1010  	serverNameAck           bool
  1011  }
  1012  
  1013  func (m *encryptedExtensionsMsg) marshal() ([]byte, error) {
  1014  	var b cryptobyte.Builder
  1015  	b.AddUint8(typeEncryptedExtensions)
  1016  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1017  		b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1018  			if len(m.alpnProtocol) > 0 {
  1019  				b.AddUint16(extensionALPN)
  1020  				b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1021  					b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1022  						b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
  1023  							b.AddBytes([]byte(m.alpnProtocol))
  1024  						})
  1025  					})
  1026  				})
  1027  			}
  1028  			if m.quicTransportParameters != nil { // marshal zero-length parameters when present
  1029  				// draft-ietf-quic-tls-32, Section 8.2
  1030  				b.AddUint16(extensionQUICTransportParameters)
  1031  				b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1032  					b.AddBytes(m.quicTransportParameters)
  1033  				})
  1034  			}
  1035  			if m.earlyData {
  1036  				// RFC 8446, Section 4.2.10
  1037  				b.AddUint16(extensionEarlyData)
  1038  				b.AddUint16(0) // empty extension_data
  1039  			}
  1040  			if len(m.echRetryConfigs) > 0 {
  1041  				b.AddUint16(extensionEncryptedClientHello)
  1042  				b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1043  					b.AddBytes(m.echRetryConfigs)
  1044  				})
  1045  			}
  1046  			if m.serverNameAck {
  1047  				b.AddUint16(extensionServerName)
  1048  				b.AddUint16(0) // empty extension_data
  1049  			}
  1050  		})
  1051  	})
  1052  
  1053  	return b.Bytes()
  1054  }
  1055  
  1056  func (m *encryptedExtensionsMsg) unmarshal(data []byte) bool {
  1057  	*m = encryptedExtensionsMsg{}
  1058  	s := cryptobyte.String(data)
  1059  
  1060  	var extensions cryptobyte.String
  1061  	if !s.Skip(4) || // message type and uint24 length field
  1062  		!s.ReadUint16LengthPrefixed(&extensions) || !s.Empty() {
  1063  		return false
  1064  	}
  1065  
  1066  	seenExts := make(map[uint16]bool)
  1067  	for !extensions.Empty() {
  1068  		var extension uint16
  1069  		var extData cryptobyte.String
  1070  		if !extensions.ReadUint16(&extension) ||
  1071  			!extensions.ReadUint16LengthPrefixed(&extData) {
  1072  			return false
  1073  		}
  1074  
  1075  		if seenExts[extension] {
  1076  			return false
  1077  		}
  1078  		seenExts[extension] = true
  1079  
  1080  		switch extension {
  1081  		case extensionALPN:
  1082  			var protoList cryptobyte.String
  1083  			if !extData.ReadUint16LengthPrefixed(&protoList) || protoList.Empty() {
  1084  				return false
  1085  			}
  1086  			var proto cryptobyte.String
  1087  			if !protoList.ReadUint8LengthPrefixed(&proto) ||
  1088  				proto.Empty() || !protoList.Empty() {
  1089  				return false
  1090  			}
  1091  			m.alpnProtocol = string(proto)
  1092  		case extensionQUICTransportParameters:
  1093  			m.quicTransportParameters = make([]byte, len(extData))
  1094  			if !extData.CopyBytes(m.quicTransportParameters) {
  1095  				return false
  1096  			}
  1097  		case extensionEarlyData:
  1098  			// RFC 8446, Section 4.2.10
  1099  			m.earlyData = true
  1100  		case extensionEncryptedClientHello:
  1101  			m.echRetryConfigs = make([]byte, len(extData))
  1102  			if !extData.CopyBytes(m.echRetryConfigs) {
  1103  				return false
  1104  			}
  1105  		case extensionServerName:
  1106  			if len(extData) != 0 {
  1107  				return false
  1108  			}
  1109  			m.serverNameAck = true
  1110  		default:
  1111  			// Ignore unknown extensions.
  1112  			continue
  1113  		}
  1114  
  1115  		if !extData.Empty() {
  1116  			return false
  1117  		}
  1118  	}
  1119  
  1120  	return true
  1121  }
  1122  
  1123  type endOfEarlyDataMsg struct{}
  1124  
  1125  func (m *endOfEarlyDataMsg) marshal() ([]byte, error) {
  1126  	x := make([]byte, 4)
  1127  	x[0] = typeEndOfEarlyData
  1128  	return x, nil
  1129  }
  1130  
  1131  func (m *endOfEarlyDataMsg) unmarshal(data []byte) bool {
  1132  	return len(data) == 4
  1133  }
  1134  
  1135  type keyUpdateMsg struct {
  1136  	updateRequested bool
  1137  }
  1138  
  1139  func (m *keyUpdateMsg) marshal() ([]byte, error) {
  1140  	var b cryptobyte.Builder
  1141  	b.AddUint8(typeKeyUpdate)
  1142  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1143  		if m.updateRequested {
  1144  			b.AddUint8(1)
  1145  		} else {
  1146  			b.AddUint8(0)
  1147  		}
  1148  	})
  1149  
  1150  	return b.Bytes()
  1151  }
  1152  
  1153  func (m *keyUpdateMsg) unmarshal(data []byte) bool {
  1154  	s := cryptobyte.String(data)
  1155  
  1156  	var updateRequested uint8
  1157  	if !s.Skip(4) || // message type and uint24 length field
  1158  		!s.ReadUint8(&updateRequested) || !s.Empty() {
  1159  		return false
  1160  	}
  1161  	switch updateRequested {
  1162  	case 0:
  1163  		m.updateRequested = false
  1164  	case 1:
  1165  		m.updateRequested = true
  1166  	default:
  1167  		return false
  1168  	}
  1169  	return true
  1170  }
  1171  
  1172  type newSessionTicketMsgTLS13 struct {
  1173  	lifetime     uint32
  1174  	ageAdd       uint32
  1175  	nonce        []byte
  1176  	label        []byte
  1177  	maxEarlyData uint32
  1178  }
  1179  
  1180  func (m *newSessionTicketMsgTLS13) marshal() ([]byte, error) {
  1181  	var b cryptobyte.Builder
  1182  	b.AddUint8(typeNewSessionTicket)
  1183  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1184  		b.AddUint32(m.lifetime)
  1185  		b.AddUint32(m.ageAdd)
  1186  		b.AddUint8LengthPrefixed(func(b *cryptobyte.Builder) {
  1187  			b.AddBytes(m.nonce)
  1188  		})
  1189  		b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1190  			b.AddBytes(m.label)
  1191  		})
  1192  
  1193  		b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1194  			if m.maxEarlyData > 0 {
  1195  				b.AddUint16(extensionEarlyData)
  1196  				b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1197  					b.AddUint32(m.maxEarlyData)
  1198  				})
  1199  			}
  1200  		})
  1201  	})
  1202  
  1203  	return b.Bytes()
  1204  }
  1205  
  1206  func (m *newSessionTicketMsgTLS13) unmarshal(data []byte) bool {
  1207  	*m = newSessionTicketMsgTLS13{}
  1208  	s := cryptobyte.String(data)
  1209  
  1210  	var extensions cryptobyte.String
  1211  	if !s.Skip(4) || // message type and uint24 length field
  1212  		!s.ReadUint32(&m.lifetime) ||
  1213  		!s.ReadUint32(&m.ageAdd) ||
  1214  		!readUint8LengthPrefixed(&s, &m.nonce) ||
  1215  		!readUint16LengthPrefixed(&s, &m.label) ||
  1216  		!s.ReadUint16LengthPrefixed(&extensions) ||
  1217  		!s.Empty() {
  1218  		return false
  1219  	}
  1220  
  1221  	for !extensions.Empty() {
  1222  		var extension uint16
  1223  		var extData cryptobyte.String
  1224  		if !extensions.ReadUint16(&extension) ||
  1225  			!extensions.ReadUint16LengthPrefixed(&extData) {
  1226  			return false
  1227  		}
  1228  
  1229  		switch extension {
  1230  		case extensionEarlyData:
  1231  			if !extData.ReadUint32(&m.maxEarlyData) {
  1232  				return false
  1233  			}
  1234  		default:
  1235  			// Ignore unknown extensions.
  1236  			continue
  1237  		}
  1238  
  1239  		if !extData.Empty() {
  1240  			return false
  1241  		}
  1242  	}
  1243  
  1244  	return true
  1245  }
  1246  
  1247  type certificateRequestMsgTLS13 struct {
  1248  	ocspStapling                     bool
  1249  	scts                             bool
  1250  	supportedSignatureAlgorithms     []SignatureScheme
  1251  	supportedSignatureAlgorithmsCert []SignatureScheme
  1252  	certificateAuthorities           [][]byte
  1253  }
  1254  
  1255  func (m *certificateRequestMsgTLS13) marshal() ([]byte, error) {
  1256  	var b cryptobyte.Builder
  1257  	b.AddUint8(typeCertificateRequest)
  1258  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1259  		// certificate_request_context (SHALL be zero length unless used for
  1260  		// post-handshake authentication)
  1261  		b.AddUint8(0)
  1262  
  1263  		b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1264  			if m.ocspStapling {
  1265  				b.AddUint16(extensionStatusRequest)
  1266  				b.AddUint16(0) // empty extension_data
  1267  			}
  1268  			if m.scts {
  1269  				// RFC 8446, Section 4.4.2.1 makes no mention of
  1270  				// signed_certificate_timestamp in CertificateRequest, but
  1271  				// "Extensions in the Certificate message from the client MUST
  1272  				// correspond to extensions in the CertificateRequest message
  1273  				// from the server." and it appears in the table in Section 4.2.
  1274  				b.AddUint16(extensionSCT)
  1275  				b.AddUint16(0) // empty extension_data
  1276  			}
  1277  			if len(m.supportedSignatureAlgorithms) > 0 {
  1278  				b.AddUint16(extensionSignatureAlgorithms)
  1279  				b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1280  					b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1281  						for _, sigAlgo := range m.supportedSignatureAlgorithms {
  1282  							b.AddUint16(uint16(sigAlgo))
  1283  						}
  1284  					})
  1285  				})
  1286  			}
  1287  			if len(m.supportedSignatureAlgorithmsCert) > 0 {
  1288  				b.AddUint16(extensionSignatureAlgorithmsCert)
  1289  				b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1290  					b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1291  						for _, sigAlgo := range m.supportedSignatureAlgorithmsCert {
  1292  							b.AddUint16(uint16(sigAlgo))
  1293  						}
  1294  					})
  1295  				})
  1296  			}
  1297  			if len(m.certificateAuthorities) > 0 {
  1298  				b.AddUint16(extensionCertificateAuthorities)
  1299  				b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1300  					b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1301  						for _, ca := range m.certificateAuthorities {
  1302  							b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1303  								b.AddBytes(ca)
  1304  							})
  1305  						}
  1306  					})
  1307  				})
  1308  			}
  1309  		})
  1310  	})
  1311  
  1312  	return b.Bytes()
  1313  }
  1314  
  1315  func (m *certificateRequestMsgTLS13) unmarshal(data []byte) bool {
  1316  	*m = certificateRequestMsgTLS13{}
  1317  	s := cryptobyte.String(data)
  1318  
  1319  	var context, extensions cryptobyte.String
  1320  	if !s.Skip(4) || // message type and uint24 length field
  1321  		!s.ReadUint8LengthPrefixed(&context) || !context.Empty() ||
  1322  		!s.ReadUint16LengthPrefixed(&extensions) ||
  1323  		!s.Empty() {
  1324  		return false
  1325  	}
  1326  
  1327  	for !extensions.Empty() {
  1328  		var extension uint16
  1329  		var extData cryptobyte.String
  1330  		if !extensions.ReadUint16(&extension) ||
  1331  			!extensions.ReadUint16LengthPrefixed(&extData) {
  1332  			return false
  1333  		}
  1334  
  1335  		switch extension {
  1336  		case extensionStatusRequest:
  1337  			m.ocspStapling = true
  1338  		case extensionSCT:
  1339  			m.scts = true
  1340  		case extensionSignatureAlgorithms:
  1341  			var sigAndAlgs cryptobyte.String
  1342  			if !extData.ReadUint16LengthPrefixed(&sigAndAlgs) || sigAndAlgs.Empty() {
  1343  				return false
  1344  			}
  1345  			for !sigAndAlgs.Empty() {
  1346  				var sigAndAlg uint16
  1347  				if !sigAndAlgs.ReadUint16(&sigAndAlg) {
  1348  					return false
  1349  				}
  1350  				m.supportedSignatureAlgorithms = append(
  1351  					m.supportedSignatureAlgorithms, SignatureScheme(sigAndAlg))
  1352  			}
  1353  		case extensionSignatureAlgorithmsCert:
  1354  			var sigAndAlgs cryptobyte.String
  1355  			if !extData.ReadUint16LengthPrefixed(&sigAndAlgs) || sigAndAlgs.Empty() {
  1356  				return false
  1357  			}
  1358  			for !sigAndAlgs.Empty() {
  1359  				var sigAndAlg uint16
  1360  				if !sigAndAlgs.ReadUint16(&sigAndAlg) {
  1361  					return false
  1362  				}
  1363  				m.supportedSignatureAlgorithmsCert = append(
  1364  					m.supportedSignatureAlgorithmsCert, SignatureScheme(sigAndAlg))
  1365  			}
  1366  		case extensionCertificateAuthorities:
  1367  			var auths cryptobyte.String
  1368  			if !extData.ReadUint16LengthPrefixed(&auths) || auths.Empty() {
  1369  				return false
  1370  			}
  1371  			for !auths.Empty() {
  1372  				var ca []byte
  1373  				if !readUint16LengthPrefixed(&auths, &ca) || len(ca) == 0 {
  1374  					return false
  1375  				}
  1376  				m.certificateAuthorities = append(m.certificateAuthorities, ca)
  1377  			}
  1378  		default:
  1379  			// Ignore unknown extensions.
  1380  			continue
  1381  		}
  1382  
  1383  		if !extData.Empty() {
  1384  			return false
  1385  		}
  1386  	}
  1387  
  1388  	return true
  1389  }
  1390  
  1391  type certificateMsg struct {
  1392  	certificates [][]byte
  1393  }
  1394  
  1395  func (m *certificateMsg) marshal() ([]byte, error) {
  1396  	var i int
  1397  	for _, slice := range m.certificates {
  1398  		i += len(slice)
  1399  	}
  1400  
  1401  	length := 3 + 3*len(m.certificates) + i
  1402  	x := make([]byte, 4+length)
  1403  	x[0] = typeCertificate
  1404  	x[1] = uint8(length >> 16)
  1405  	x[2] = uint8(length >> 8)
  1406  	x[3] = uint8(length)
  1407  
  1408  	certificateOctets := length - 3
  1409  	x[4] = uint8(certificateOctets >> 16)
  1410  	x[5] = uint8(certificateOctets >> 8)
  1411  	x[6] = uint8(certificateOctets)
  1412  
  1413  	y := x[7:]
  1414  	for _, slice := range m.certificates {
  1415  		y[0] = uint8(len(slice) >> 16)
  1416  		y[1] = uint8(len(slice) >> 8)
  1417  		y[2] = uint8(len(slice))
  1418  		copy(y[3:], slice)
  1419  		y = y[3+len(slice):]
  1420  	}
  1421  
  1422  	return x, nil
  1423  }
  1424  
  1425  func (m *certificateMsg) unmarshal(data []byte) bool {
  1426  	if len(data) < 7 {
  1427  		return false
  1428  	}
  1429  
  1430  	certsLen := uint32(data[4])<<16 | uint32(data[5])<<8 | uint32(data[6])
  1431  	if uint32(len(data)) != certsLen+7 {
  1432  		return false
  1433  	}
  1434  
  1435  	numCerts := 0
  1436  	d := data[7:]
  1437  	for certsLen > 0 {
  1438  		if len(d) < 4 {
  1439  			return false
  1440  		}
  1441  		certLen := uint32(d[0])<<16 | uint32(d[1])<<8 | uint32(d[2])
  1442  		if uint32(len(d)) < 3+certLen {
  1443  			return false
  1444  		}
  1445  		d = d[3+certLen:]
  1446  		certsLen -= 3 + certLen
  1447  		numCerts++
  1448  	}
  1449  
  1450  	m.certificates = make([][]byte, numCerts)
  1451  	d = data[7:]
  1452  	for i := 0; i < numCerts; i++ {
  1453  		certLen := uint32(d[0])<<16 | uint32(d[1])<<8 | uint32(d[2])
  1454  		m.certificates[i] = d[3 : 3+certLen]
  1455  		d = d[3+certLen:]
  1456  	}
  1457  
  1458  	return true
  1459  }
  1460  
  1461  type certificateMsgTLS13 struct {
  1462  	certificate  Certificate
  1463  	ocspStapling bool
  1464  	scts         bool
  1465  }
  1466  
  1467  func (m *certificateMsgTLS13) marshal() ([]byte, error) {
  1468  	var b cryptobyte.Builder
  1469  	b.AddUint8(typeCertificate)
  1470  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1471  		b.AddUint8(0) // certificate_request_context
  1472  
  1473  		certificate := m.certificate
  1474  		if !m.ocspStapling {
  1475  			certificate.OCSPStaple = nil
  1476  		}
  1477  		if !m.scts {
  1478  			certificate.SignedCertificateTimestamps = nil
  1479  		}
  1480  		marshalCertificate(b, certificate)
  1481  	})
  1482  
  1483  	return b.Bytes()
  1484  }
  1485  
  1486  func marshalCertificate(b *cryptobyte.Builder, certificate Certificate) {
  1487  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1488  		for i, cert := range certificate.Certificate {
  1489  			b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1490  				b.AddBytes(cert)
  1491  			})
  1492  			b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1493  				if i > 0 {
  1494  					// This library only supports OCSP and SCT for leaf certificates.
  1495  					return
  1496  				}
  1497  				if certificate.OCSPStaple != nil {
  1498  					b.AddUint16(extensionStatusRequest)
  1499  					b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1500  						b.AddUint8(statusTypeOCSP)
  1501  						b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1502  							b.AddBytes(certificate.OCSPStaple)
  1503  						})
  1504  					})
  1505  				}
  1506  				if certificate.SignedCertificateTimestamps != nil {
  1507  					b.AddUint16(extensionSCT)
  1508  					b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1509  						b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1510  							for _, sct := range certificate.SignedCertificateTimestamps {
  1511  								b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1512  									b.AddBytes(sct)
  1513  								})
  1514  							}
  1515  						})
  1516  					})
  1517  				}
  1518  			})
  1519  		}
  1520  	})
  1521  }
  1522  
  1523  func (m *certificateMsgTLS13) unmarshal(data []byte) bool {
  1524  	*m = certificateMsgTLS13{}
  1525  	s := cryptobyte.String(data)
  1526  
  1527  	var context cryptobyte.String
  1528  	if !s.Skip(4) || // message type and uint24 length field
  1529  		!s.ReadUint8LengthPrefixed(&context) || !context.Empty() ||
  1530  		!unmarshalCertificate(&s, &m.certificate) ||
  1531  		!s.Empty() {
  1532  		return false
  1533  	}
  1534  
  1535  	m.scts = m.certificate.SignedCertificateTimestamps != nil
  1536  	m.ocspStapling = m.certificate.OCSPStaple != nil
  1537  
  1538  	return true
  1539  }
  1540  
  1541  func unmarshalCertificate(s *cryptobyte.String, certificate *Certificate) bool {
  1542  	var certList cryptobyte.String
  1543  	if !s.ReadUint24LengthPrefixed(&certList) {
  1544  		return false
  1545  	}
  1546  	for !certList.Empty() {
  1547  		var cert []byte
  1548  		var extensions cryptobyte.String
  1549  		if !readUint24LengthPrefixed(&certList, &cert) ||
  1550  			!certList.ReadUint16LengthPrefixed(&extensions) {
  1551  			return false
  1552  		}
  1553  		certificate.Certificate = append(certificate.Certificate, cert)
  1554  		for !extensions.Empty() {
  1555  			var extension uint16
  1556  			var extData cryptobyte.String
  1557  			if !extensions.ReadUint16(&extension) ||
  1558  				!extensions.ReadUint16LengthPrefixed(&extData) {
  1559  				return false
  1560  			}
  1561  			if len(certificate.Certificate) > 1 {
  1562  				// This library only supports OCSP and SCT for leaf certificates.
  1563  				continue
  1564  			}
  1565  
  1566  			switch extension {
  1567  			case extensionStatusRequest:
  1568  				var statusType uint8
  1569  				if !extData.ReadUint8(&statusType) || statusType != statusTypeOCSP ||
  1570  					!readUint24LengthPrefixed(&extData, &certificate.OCSPStaple) ||
  1571  					len(certificate.OCSPStaple) == 0 {
  1572  					return false
  1573  				}
  1574  			case extensionSCT:
  1575  				var sctList cryptobyte.String
  1576  				if !extData.ReadUint16LengthPrefixed(&sctList) || sctList.Empty() {
  1577  					return false
  1578  				}
  1579  				for !sctList.Empty() {
  1580  					var sct []byte
  1581  					if !readUint16LengthPrefixed(&sctList, &sct) ||
  1582  						len(sct) == 0 {
  1583  						return false
  1584  					}
  1585  					certificate.SignedCertificateTimestamps = append(
  1586  						certificate.SignedCertificateTimestamps, sct)
  1587  				}
  1588  			default:
  1589  				// Ignore unknown extensions.
  1590  				continue
  1591  			}
  1592  
  1593  			if !extData.Empty() {
  1594  				return false
  1595  			}
  1596  		}
  1597  	}
  1598  	return true
  1599  }
  1600  
  1601  type serverKeyExchangeMsg struct {
  1602  	key []byte
  1603  }
  1604  
  1605  func (m *serverKeyExchangeMsg) marshal() ([]byte, error) {
  1606  	length := len(m.key)
  1607  	x := make([]byte, length+4)
  1608  	x[0] = typeServerKeyExchange
  1609  	x[1] = uint8(length >> 16)
  1610  	x[2] = uint8(length >> 8)
  1611  	x[3] = uint8(length)
  1612  	copy(x[4:], m.key)
  1613  
  1614  	return x, nil
  1615  }
  1616  
  1617  func (m *serverKeyExchangeMsg) unmarshal(data []byte) bool {
  1618  	if len(data) < 4 {
  1619  		return false
  1620  	}
  1621  	m.key = data[4:]
  1622  	return true
  1623  }
  1624  
  1625  type certificateStatusMsg struct {
  1626  	response []byte
  1627  }
  1628  
  1629  func (m *certificateStatusMsg) marshal() ([]byte, error) {
  1630  	var b cryptobyte.Builder
  1631  	b.AddUint8(typeCertificateStatus)
  1632  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1633  		b.AddUint8(statusTypeOCSP)
  1634  		b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1635  			b.AddBytes(m.response)
  1636  		})
  1637  	})
  1638  
  1639  	return b.Bytes()
  1640  }
  1641  
  1642  func (m *certificateStatusMsg) unmarshal(data []byte) bool {
  1643  	s := cryptobyte.String(data)
  1644  
  1645  	var statusType uint8
  1646  	if !s.Skip(4) || // message type and uint24 length field
  1647  		!s.ReadUint8(&statusType) || statusType != statusTypeOCSP ||
  1648  		!readUint24LengthPrefixed(&s, &m.response) ||
  1649  		len(m.response) == 0 || !s.Empty() {
  1650  		return false
  1651  	}
  1652  	return true
  1653  }
  1654  
  1655  type serverHelloDoneMsg struct{}
  1656  
  1657  func (m *serverHelloDoneMsg) marshal() ([]byte, error) {
  1658  	x := make([]byte, 4)
  1659  	x[0] = typeServerHelloDone
  1660  	return x, nil
  1661  }
  1662  
  1663  func (m *serverHelloDoneMsg) unmarshal(data []byte) bool {
  1664  	return len(data) == 4
  1665  }
  1666  
  1667  type clientKeyExchangeMsg struct {
  1668  	ciphertext []byte
  1669  }
  1670  
  1671  func (m *clientKeyExchangeMsg) marshal() ([]byte, error) {
  1672  	length := len(m.ciphertext)
  1673  	x := make([]byte, length+4)
  1674  	x[0] = typeClientKeyExchange
  1675  	x[1] = uint8(length >> 16)
  1676  	x[2] = uint8(length >> 8)
  1677  	x[3] = uint8(length)
  1678  	copy(x[4:], m.ciphertext)
  1679  
  1680  	return x, nil
  1681  }
  1682  
  1683  func (m *clientKeyExchangeMsg) unmarshal(data []byte) bool {
  1684  	if len(data) < 4 {
  1685  		return false
  1686  	}
  1687  	l := int(data[1])<<16 | int(data[2])<<8 | int(data[3])
  1688  	if l != len(data)-4 {
  1689  		return false
  1690  	}
  1691  	m.ciphertext = data[4:]
  1692  	return true
  1693  }
  1694  
  1695  type finishedMsg struct {
  1696  	verifyData []byte
  1697  }
  1698  
  1699  func (m *finishedMsg) marshal() ([]byte, error) {
  1700  	var b cryptobyte.Builder
  1701  	b.AddUint8(typeFinished)
  1702  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1703  		b.AddBytes(m.verifyData)
  1704  	})
  1705  
  1706  	return b.Bytes()
  1707  }
  1708  
  1709  func (m *finishedMsg) unmarshal(data []byte) bool {
  1710  	s := cryptobyte.String(data)
  1711  	return s.Skip(1) &&
  1712  		readUint24LengthPrefixed(&s, &m.verifyData) &&
  1713  		s.Empty()
  1714  }
  1715  
  1716  type certificateRequestMsg struct {
  1717  	// hasSignatureAlgorithm indicates whether this message includes a list of
  1718  	// supported signature algorithms. This change was introduced with TLS 1.2.
  1719  	hasSignatureAlgorithm bool
  1720  
  1721  	certificateTypes             []byte
  1722  	supportedSignatureAlgorithms []SignatureScheme
  1723  	certificateAuthorities       [][]byte
  1724  }
  1725  
  1726  func (m *certificateRequestMsg) marshal() ([]byte, error) {
  1727  	// See RFC 4346, Section 7.4.4.
  1728  	length := 1 + len(m.certificateTypes) + 2
  1729  	casLength := 0
  1730  	for _, ca := range m.certificateAuthorities {
  1731  		casLength += 2 + len(ca)
  1732  	}
  1733  	length += casLength
  1734  
  1735  	if m.hasSignatureAlgorithm {
  1736  		length += 2 + 2*len(m.supportedSignatureAlgorithms)
  1737  	}
  1738  
  1739  	x := make([]byte, 4+length)
  1740  	x[0] = typeCertificateRequest
  1741  	x[1] = uint8(length >> 16)
  1742  	x[2] = uint8(length >> 8)
  1743  	x[3] = uint8(length)
  1744  
  1745  	x[4] = uint8(len(m.certificateTypes))
  1746  
  1747  	copy(x[5:], m.certificateTypes)
  1748  	y := x[5+len(m.certificateTypes):]
  1749  
  1750  	if m.hasSignatureAlgorithm {
  1751  		n := len(m.supportedSignatureAlgorithms) * 2
  1752  		y[0] = uint8(n >> 8)
  1753  		y[1] = uint8(n)
  1754  		y = y[2:]
  1755  		for _, sigAlgo := range m.supportedSignatureAlgorithms {
  1756  			y[0] = uint8(sigAlgo >> 8)
  1757  			y[1] = uint8(sigAlgo)
  1758  			y = y[2:]
  1759  		}
  1760  	}
  1761  
  1762  	y[0] = uint8(casLength >> 8)
  1763  	y[1] = uint8(casLength)
  1764  	y = y[2:]
  1765  	for _, ca := range m.certificateAuthorities {
  1766  		y[0] = uint8(len(ca) >> 8)
  1767  		y[1] = uint8(len(ca))
  1768  		y = y[2:]
  1769  		copy(y, ca)
  1770  		y = y[len(ca):]
  1771  	}
  1772  
  1773  	return x, nil
  1774  }
  1775  
  1776  func (m *certificateRequestMsg) unmarshal(data []byte) bool {
  1777  	if len(data) < 5 {
  1778  		return false
  1779  	}
  1780  
  1781  	length := uint32(data[1])<<16 | uint32(data[2])<<8 | uint32(data[3])
  1782  	if uint32(len(data))-4 != length {
  1783  		return false
  1784  	}
  1785  
  1786  	numCertTypes := int(data[4])
  1787  	data = data[5:]
  1788  	if numCertTypes == 0 || len(data) <= numCertTypes {
  1789  		return false
  1790  	}
  1791  
  1792  	m.certificateTypes = make([]byte, numCertTypes)
  1793  	if copy(m.certificateTypes, data) != numCertTypes {
  1794  		return false
  1795  	}
  1796  
  1797  	data = data[numCertTypes:]
  1798  
  1799  	if m.hasSignatureAlgorithm {
  1800  		if len(data) < 2 {
  1801  			return false
  1802  		}
  1803  		sigAndHashLen := uint16(data[0])<<8 | uint16(data[1])
  1804  		data = data[2:]
  1805  		if sigAndHashLen&1 != 0 || sigAndHashLen == 0 {
  1806  			return false
  1807  		}
  1808  		if len(data) < int(sigAndHashLen) {
  1809  			return false
  1810  		}
  1811  		numSigAlgos := sigAndHashLen / 2
  1812  		m.supportedSignatureAlgorithms = make([]SignatureScheme, numSigAlgos)
  1813  		for i := range m.supportedSignatureAlgorithms {
  1814  			m.supportedSignatureAlgorithms[i] = SignatureScheme(data[0])<<8 | SignatureScheme(data[1])
  1815  			data = data[2:]
  1816  		}
  1817  	}
  1818  
  1819  	if len(data) < 2 {
  1820  		return false
  1821  	}
  1822  	casLength := uint16(data[0])<<8 | uint16(data[1])
  1823  	data = data[2:]
  1824  	if len(data) < int(casLength) {
  1825  		return false
  1826  	}
  1827  	cas := make([]byte, casLength)
  1828  	copy(cas, data)
  1829  	data = data[casLength:]
  1830  
  1831  	m.certificateAuthorities = nil
  1832  	for len(cas) > 0 {
  1833  		if len(cas) < 2 {
  1834  			return false
  1835  		}
  1836  		caLen := uint16(cas[0])<<8 | uint16(cas[1])
  1837  		cas = cas[2:]
  1838  
  1839  		if len(cas) < int(caLen) {
  1840  			return false
  1841  		}
  1842  
  1843  		m.certificateAuthorities = append(m.certificateAuthorities, cas[:caLen])
  1844  		cas = cas[caLen:]
  1845  	}
  1846  
  1847  	return len(data) == 0
  1848  }
  1849  
  1850  type certificateVerifyMsg struct {
  1851  	hasSignatureAlgorithm bool // format change introduced in TLS 1.2
  1852  	signatureAlgorithm    SignatureScheme
  1853  	signature             []byte
  1854  }
  1855  
  1856  func (m *certificateVerifyMsg) marshal() ([]byte, error) {
  1857  	var b cryptobyte.Builder
  1858  	b.AddUint8(typeCertificateVerify)
  1859  	b.AddUint24LengthPrefixed(func(b *cryptobyte.Builder) {
  1860  		if m.hasSignatureAlgorithm {
  1861  			b.AddUint16(uint16(m.signatureAlgorithm))
  1862  		}
  1863  		b.AddUint16LengthPrefixed(func(b *cryptobyte.Builder) {
  1864  			b.AddBytes(m.signature)
  1865  		})
  1866  	})
  1867  
  1868  	return b.Bytes()
  1869  }
  1870  
  1871  func (m *certificateVerifyMsg) unmarshal(data []byte) bool {
  1872  	s := cryptobyte.String(data)
  1873  
  1874  	if !s.Skip(4) { // message type and uint24 length field
  1875  		return false
  1876  	}
  1877  	if m.hasSignatureAlgorithm {
  1878  		if !s.ReadUint16((*uint16)(&m.signatureAlgorithm)) {
  1879  			return false
  1880  		}
  1881  	}
  1882  	return readUint16LengthPrefixed(&s, &m.signature) && s.Empty()
  1883  }
  1884  
  1885  type newSessionTicketMsg struct {
  1886  	ticket []byte
  1887  }
  1888  
  1889  func (m *newSessionTicketMsg) marshal() ([]byte, error) {
  1890  	// See RFC 5077, Section 3.3.
  1891  	ticketLen := len(m.ticket)
  1892  	length := 2 + 4 + ticketLen
  1893  	x := make([]byte, 4+length)
  1894  	x[0] = typeNewSessionTicket
  1895  	x[1] = uint8(length >> 16)
  1896  	x[2] = uint8(length >> 8)
  1897  	x[3] = uint8(length)
  1898  	x[8] = uint8(ticketLen >> 8)
  1899  	x[9] = uint8(ticketLen)
  1900  	copy(x[10:], m.ticket)
  1901  
  1902  	return x, nil
  1903  }
  1904  
  1905  func (m *newSessionTicketMsg) unmarshal(data []byte) bool {
  1906  	if len(data) < 10 {
  1907  		return false
  1908  	}
  1909  
  1910  	length := uint32(data[1])<<16 | uint32(data[2])<<8 | uint32(data[3])
  1911  	if uint32(len(data))-4 != length {
  1912  		return false
  1913  	}
  1914  
  1915  	ticketLen := int(data[8])<<8 + int(data[9])
  1916  	if len(data)-10 != ticketLen {
  1917  		return false
  1918  	}
  1919  
  1920  	m.ticket = data[10:]
  1921  
  1922  	return true
  1923  }
  1924  
  1925  type helloRequestMsg struct {
  1926  }
  1927  
  1928  func (*helloRequestMsg) marshal() ([]byte, error) {
  1929  	return []byte{typeHelloRequest, 0, 0, 0}, nil
  1930  }
  1931  
  1932  func (*helloRequestMsg) unmarshal(data []byte) bool {
  1933  	return len(data) == 4
  1934  }
  1935  
  1936  type transcriptHash interface {
  1937  	Write([]byte) (int, error)
  1938  }
  1939  
  1940  // transcriptMsg is a helper used to hash messages which are not hashed when
  1941  // they are read from, or written to, the wire. This is typically the case for
  1942  // messages which are either not sent, or need to be hashed out of order from
  1943  // when they are read/written.
  1944  //
  1945  // For most messages, the message is marshalled using their marshal method,
  1946  // since their wire representation is idempotent. For clientHelloMsg and
  1947  // serverHelloMsg, we store the original wire representation of the message and
  1948  // use that for hashing, since unmarshal/marshal are not idempotent due to
  1949  // extension ordering and other malleable fields, which may cause differences
  1950  // between what was received and what we marshal.
  1951  func transcriptMsg(msg handshakeMessage, h transcriptHash) error {
  1952  	if msgWithOrig, ok := msg.(handshakeMessageWithOriginalBytes); ok {
  1953  		if orig := msgWithOrig.originalBytes(); orig != nil {
  1954  			h.Write(msgWithOrig.originalBytes())
  1955  			return nil
  1956  		}
  1957  	}
  1958  
  1959  	data, err := msg.marshal()
  1960  	if err != nil {
  1961  		return err
  1962  	}
  1963  	h.Write(data)
  1964  	return nil
  1965  }
  1966  

View as plain text