2010-12-03 05:34:57 +01:00
// Copyright 2009 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
2013-11-06 20:49:01 +01:00
// Package tls partially implements TLS 1.2, as specified in RFC 5246.
2010-12-03 05:34:57 +01:00
package tls
2017-01-14 01:05:42 +01:00
// BUG(agl): The crypto/tls package only implements some countermeasures
2017-01-23 23:18:42 +01:00
// against Lucky13 attacks on CBC-mode encryption, and only on SHA1
// variants. See http://www.isg.rhul.ac.uk/tls/TLStiming.pdf and
2016-02-03 22:58:02 +01:00
// https://www.imperialviolet.org/2013/02/04/luckythirteen.html.
2010-12-03 05:34:57 +01:00
import (
2012-11-21 08:03:38 +01:00
"crypto"
"crypto/ecdsa"
2010-12-03 05:34:57 +01:00
"crypto/rsa"
"crypto/x509"
"encoding/pem"
2011-12-03 03:17:34 +01:00
"errors"
2016-02-03 22:58:02 +01:00
"fmt"
2010-12-03 05:34:57 +01:00
"io/ioutil"
"net"
"strings"
2014-07-19 10:53:52 +02:00
"time"
2010-12-03 05:34:57 +01:00
)
2011-01-21 19:19:03 +01:00
// Server returns a new TLS server side connection
// using conn as the underlying transport.
2016-02-03 22:58:02 +01:00
// The configuration config must be non-nil and must include
// at least one certificate or else set GetCertificate.
2010-12-03 05:34:57 +01:00
func Server ( conn net . Conn , config * Config ) * Conn {
return & Conn { conn : conn , config : config }
}
2011-01-21 19:19:03 +01:00
// Client returns a new TLS client side connection
// using conn as the underlying transport.
2014-07-19 10:53:52 +02:00
// The config cannot be nil: users must set either ServerName or
2014-06-07 00:37:27 +02:00
// InsecureSkipVerify in the config.
2010-12-03 05:34:57 +01:00
func Client ( conn net . Conn , config * Config ) * Conn {
return & Conn { conn : conn , config : config , isClient : true }
}
2012-02-09 09:19:58 +01:00
// A listener implements a network listener (net.Listener) for TLS connections.
type listener struct {
net . Listener
config * Config
2010-12-03 05:34:57 +01:00
}
2011-01-21 19:19:03 +01:00
// Accept waits for and returns the next incoming TLS connection.
2016-07-22 20:15:38 +02:00
// The returned connection is of type *Conn.
func ( l * listener ) Accept ( ) ( net . Conn , error ) {
c , err := l . Listener . Accept ( )
2010-12-03 05:34:57 +01:00
if err != nil {
2016-07-22 20:15:38 +02:00
return nil , err
2010-12-03 05:34:57 +01:00
}
2016-07-22 20:15:38 +02:00
return Server ( c , l . config ) , nil
2010-12-03 05:34:57 +01:00
}
// NewListener creates a Listener which accepts connections from an inner
// Listener and wraps each connection with Server.
2016-02-03 22:58:02 +01:00
// The configuration config must be non-nil and must include
// at least one certificate or else set GetCertificate.
2012-02-09 09:19:58 +01:00
func NewListener ( inner net . Listener , config * Config ) net . Listener {
l := new ( listener )
l . Listener = inner
2010-12-03 05:34:57 +01:00
l . config = config
2012-02-09 09:19:58 +01:00
return l
2010-12-03 05:34:57 +01:00
}
2011-01-21 19:19:03 +01:00
// Listen creates a TLS listener accepting connections on the
// given network address using net.Listen.
2016-02-03 22:58:02 +01:00
// The configuration config must be non-nil and must include
// at least one certificate or else set GetCertificate.
2012-02-09 09:19:58 +01:00
func Listen ( network , laddr string , config * Config ) ( net . Listener , error ) {
2016-02-03 22:58:02 +01:00
if config == nil || ( len ( config . Certificates ) == 0 && config . GetCertificate == nil ) {
return nil , errors . New ( "tls: neither Certificates nor GetCertificate set in Config" )
2010-12-03 05:34:57 +01:00
}
l , err := net . Listen ( network , laddr )
if err != nil {
return nil , err
}
return NewListener ( l , config ) , nil
}
2014-07-19 10:53:52 +02:00
type timeoutError struct { }
func ( timeoutError ) Error ( ) string { return "tls: DialWithDialer timed out" }
func ( timeoutError ) Timeout ( ) bool { return true }
func ( timeoutError ) Temporary ( ) bool { return true }
// DialWithDialer connects to the given network address using dialer.Dial and
// then initiates a TLS handshake, returning the resulting TLS connection. Any
// timeout or deadline given in the dialer apply to connection and TLS
// handshake as a whole.
//
// DialWithDialer interprets a nil configuration as equivalent to the zero
// configuration; see the documentation of Config for the defaults.
func DialWithDialer ( dialer * net . Dialer , network , addr string , config * Config ) ( * Conn , error ) {
// We want the Timeout and Deadline values from dialer to cover the
// whole process: TCP connection and TLS handshake. This means that we
// also need to start our own timers now.
timeout := dialer . Timeout
if ! dialer . Deadline . IsZero ( ) {
2017-01-14 01:05:42 +01:00
deadlineTimeout := time . Until ( dialer . Deadline )
2014-07-19 10:53:52 +02:00
if timeout == 0 || deadlineTimeout < timeout {
timeout = deadlineTimeout
}
}
var errChannel chan error
if timeout != 0 {
errChannel = make ( chan error , 2 )
time . AfterFunc ( timeout , func ( ) {
errChannel <- timeoutError { }
} )
}
rawConn , err := dialer . Dial ( network , addr )
2010-12-03 05:34:57 +01:00
if err != nil {
return nil , err
}
2014-07-19 10:53:52 +02:00
colonPos := strings . LastIndex ( addr , ":" )
2010-12-03 05:34:57 +01:00
if colonPos == - 1 {
2014-07-19 10:53:52 +02:00
colonPos = len ( addr )
2010-12-03 05:34:57 +01:00
}
2014-07-19 10:53:52 +02:00
hostname := addr [ : colonPos ]
2010-12-03 05:34:57 +01:00
2011-01-21 19:19:03 +01:00
if config == nil {
config = defaultConfig ( )
}
2012-03-30 23:27:11 +02:00
// If no ServerName is set, infer the ServerName
// from the hostname we're connecting to.
if config . ServerName == "" {
2011-01-21 19:19:03 +01:00
// Make a copy to avoid polluting argument or default.
2017-01-14 01:05:42 +01:00
c := config . Clone ( )
2011-01-21 19:19:03 +01:00
c . ServerName = hostname
2016-07-22 20:15:38 +02:00
config = c
2011-01-21 19:19:03 +01:00
}
2014-07-19 10:53:52 +02:00
conn := Client ( rawConn , config )
if timeout == 0 {
err = conn . Handshake ( )
} else {
go func ( ) {
errChannel <- conn . Handshake ( )
} ( )
err = <- errChannel
}
if err != nil {
rawConn . Close ( )
2011-01-21 19:19:03 +01:00
return nil , err
2010-12-03 05:34:57 +01:00
}
2014-07-19 10:53:52 +02:00
2011-01-21 19:19:03 +01:00
return conn , nil
2010-12-03 05:34:57 +01:00
}
2014-07-19 10:53:52 +02:00
// Dial connects to the given network address using net.Dial
// and then initiates a TLS handshake, returning the resulting
// TLS connection.
// Dial interprets a nil configuration as equivalent to
// the zero configuration; see the documentation of Config
// for the defaults.
func Dial ( network , addr string , config * Config ) ( * Conn , error ) {
return DialWithDialer ( new ( net . Dialer ) , network , addr , config )
}
2016-07-22 20:15:38 +02:00
// LoadX509KeyPair reads and parses a public/private key pair from a pair
// of files. The files must contain PEM encoded data. The certificate file
// may contain intermediate certificates following the leaf certificate to
// form a certificate chain. On successful return, Certificate.Leaf will
// be nil because the parsed form of the certificate is not retained.
2015-10-31 01:59:47 +01:00
func LoadX509KeyPair ( certFile , keyFile string ) ( Certificate , error ) {
2010-12-03 05:34:57 +01:00
certPEMBlock , err := ioutil . ReadFile ( certFile )
if err != nil {
2015-10-31 01:59:47 +01:00
return Certificate { } , err
2010-12-03 05:34:57 +01:00
}
2011-04-07 19:09:10 +02:00
keyPEMBlock , err := ioutil . ReadFile ( keyFile )
if err != nil {
2015-10-31 01:59:47 +01:00
return Certificate { } , err
2011-04-07 19:09:10 +02:00
}
return X509KeyPair ( certPEMBlock , keyPEMBlock )
}
2010-12-03 05:34:57 +01:00
2011-04-07 19:09:10 +02:00
// X509KeyPair parses a public/private key pair from a pair of
2016-02-03 22:58:02 +01:00
// PEM encoded data. On successful return, Certificate.Leaf will be nil because
// the parsed form of the certificate is not retained.
2015-10-31 01:59:47 +01:00
func X509KeyPair ( certPEMBlock , keyPEMBlock [ ] byte ) ( Certificate , error ) {
fail := func ( err error ) ( Certificate , error ) { return Certificate { } , err }
2016-02-03 22:58:02 +01:00
var cert Certificate
var skippedBlockTypes [ ] string
2011-03-17 00:05:44 +01:00
for {
2016-02-03 22:58:02 +01:00
var certDERBlock * pem . Block
2011-03-17 00:05:44 +01:00
certDERBlock , certPEMBlock = pem . Decode ( certPEMBlock )
if certDERBlock == nil {
break
}
if certDERBlock . Type == "CERTIFICATE" {
cert . Certificate = append ( cert . Certificate , certDERBlock . Bytes )
2016-02-03 22:58:02 +01:00
} else {
skippedBlockTypes = append ( skippedBlockTypes , certDERBlock . Type )
2011-03-17 00:05:44 +01:00
}
}
if len ( cert . Certificate ) == 0 {
2016-02-03 22:58:02 +01:00
if len ( skippedBlockTypes ) == 0 {
2016-07-22 20:15:38 +02:00
return fail ( errors . New ( "tls: failed to find any PEM data in certificate input" ) )
}
if len ( skippedBlockTypes ) == 1 && strings . HasSuffix ( skippedBlockTypes [ 0 ] , "PRIVATE KEY" ) {
return fail ( errors . New ( "tls: failed to find certificate PEM data in certificate input, but did find a private key; PEM inputs may have been switched" ) )
2016-02-03 22:58:02 +01:00
}
2016-07-22 20:15:38 +02:00
return fail ( fmt . Errorf ( "tls: failed to find \"CERTIFICATE\" PEM block in certificate input after skipping PEM blocks of the following types: %v" , skippedBlockTypes ) )
2010-12-03 05:34:57 +01:00
}
2016-02-03 22:58:02 +01:00
skippedBlockTypes = skippedBlockTypes [ : 0 ]
2012-10-23 06:31:11 +02:00
var keyDERBlock * pem . Block
for {
keyDERBlock , keyPEMBlock = pem . Decode ( keyPEMBlock )
if keyDERBlock == nil {
2016-02-03 22:58:02 +01:00
if len ( skippedBlockTypes ) == 0 {
2016-07-22 20:15:38 +02:00
return fail ( errors . New ( "tls: failed to find any PEM data in key input" ) )
2016-02-03 22:58:02 +01:00
}
2016-07-22 20:15:38 +02:00
if len ( skippedBlockTypes ) == 1 && skippedBlockTypes [ 0 ] == "CERTIFICATE" {
return fail ( errors . New ( "tls: found a certificate rather than a key in the PEM for the private key" ) )
}
return fail ( fmt . Errorf ( "tls: failed to find PEM block with type ending in \"PRIVATE KEY\" in key input after skipping PEM blocks of the following types: %v" , skippedBlockTypes ) )
2012-10-23 06:31:11 +02:00
}
2012-12-13 00:13:29 +01:00
if keyDERBlock . Type == "PRIVATE KEY" || strings . HasSuffix ( keyDERBlock . Type , " PRIVATE KEY" ) {
2012-10-23 06:31:11 +02:00
break
}
2016-02-03 22:58:02 +01:00
skippedBlockTypes = append ( skippedBlockTypes , keyDERBlock . Type )
2010-12-03 05:34:57 +01:00
}
2015-10-31 01:59:47 +01:00
var err error
2012-11-21 08:03:38 +01:00
cert . PrivateKey , err = parsePrivateKey ( keyDERBlock . Bytes )
if err != nil {
2015-10-31 01:59:47 +01:00
return fail ( err )
2010-12-03 05:34:57 +01:00
}
// We don't need to parse the public key for TLS, but we so do anyway
// to check that it looks sane and matches the private key.
2011-03-17 00:05:44 +01:00
x509Cert , err := x509 . ParseCertificate ( cert . Certificate [ 0 ] )
2010-12-03 05:34:57 +01:00
if err != nil {
2015-10-31 01:59:47 +01:00
return fail ( err )
2010-12-03 05:34:57 +01:00
}
2012-11-21 08:03:38 +01:00
switch pub := x509Cert . PublicKey . ( type ) {
case * rsa . PublicKey :
priv , ok := cert . PrivateKey . ( * rsa . PrivateKey )
if ! ok {
2016-07-22 20:15:38 +02:00
return fail ( errors . New ( "tls: private key type does not match public key type" ) )
2012-11-21 08:03:38 +01:00
}
if pub . N . Cmp ( priv . N ) != 0 {
2016-07-22 20:15:38 +02:00
return fail ( errors . New ( "tls: private key does not match public key" ) )
2012-11-21 08:03:38 +01:00
}
case * ecdsa . PublicKey :
priv , ok := cert . PrivateKey . ( * ecdsa . PrivateKey )
if ! ok {
2016-07-22 20:15:38 +02:00
return fail ( errors . New ( "tls: private key type does not match public key type" ) )
2012-11-21 08:03:38 +01:00
}
if pub . X . Cmp ( priv . X ) != 0 || pub . Y . Cmp ( priv . Y ) != 0 {
2016-07-22 20:15:38 +02:00
return fail ( errors . New ( "tls: private key does not match public key" ) )
2012-11-21 08:03:38 +01:00
}
default :
2016-07-22 20:15:38 +02:00
return fail ( errors . New ( "tls: unknown public key algorithm" ) )
2010-12-03 05:34:57 +01:00
}
2015-10-31 01:59:47 +01:00
return cert , nil
2010-12-03 05:34:57 +01:00
}
2012-11-21 08:03:38 +01:00
// Attempt to parse the given private key DER block. OpenSSL 0.9.8 generates
// PKCS#1 private keys by default, while OpenSSL 1.0.0 generates PKCS#8 keys.
// OpenSSL ecparam generates SEC1 EC private keys for ECDSA. We try all three.
func parsePrivateKey ( der [ ] byte ) ( crypto . PrivateKey , error ) {
if key , err := x509 . ParsePKCS1PrivateKey ( der ) ; err == nil {
return key , nil
}
if key , err := x509 . ParsePKCS8PrivateKey ( der ) ; err == nil {
switch key := key . ( type ) {
case * rsa . PrivateKey , * ecdsa . PrivateKey :
return key , nil
default :
2016-07-22 20:15:38 +02:00
return nil , errors . New ( "tls: found unknown private key type in PKCS#8 wrapping" )
2012-11-21 08:03:38 +01:00
}
}
if key , err := x509 . ParseECPrivateKey ( der ) ; err == nil {
return key , nil
}
2016-07-22 20:15:38 +02:00
return nil , errors . New ( "tls: failed to parse private key" )
2012-11-21 08:03:38 +01:00
}