OLD | NEW |
1 // Copyright 2009 The Go Authors. All rights reserved. | 1 // Copyright 2009 The Go Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style | 2 // Use of this source code is governed by a BSD-style |
3 // license that can be found in the LICENSE file. | 3 // license that can be found in the LICENSE file. |
4 | 4 |
5 package tls | 5 package tls |
6 | 6 |
7 import ( | 7 import ( |
8 "crypto" | 8 "crypto" |
9 "crypto/rsa" | 9 "crypto/rsa" |
10 "crypto/subtle" | 10 "crypto/subtle" |
(...skipping 22 matching lines...) Expand all Loading... |
33 } | 33 } |
34 | 34 |
35 t := uint32(c.config.time()) | 35 t := uint32(c.config.time()) |
36 hello.random[0] = byte(t >> 24) | 36 hello.random[0] = byte(t >> 24) |
37 hello.random[1] = byte(t >> 16) | 37 hello.random[1] = byte(t >> 16) |
38 hello.random[2] = byte(t >> 8) | 38 hello.random[2] = byte(t >> 8) |
39 hello.random[3] = byte(t) | 39 hello.random[3] = byte(t) |
40 _, err := io.ReadFull(c.config.rand(), hello.random[4:]) | 40 _, err := io.ReadFull(c.config.rand(), hello.random[4:]) |
41 if err != nil { | 41 if err != nil { |
42 c.sendAlert(alertInternalError) | 42 c.sendAlert(alertInternalError) |
43 » » return os.ErrorString("short read from Rand") | 43 » » return os.NewError("short read from Rand") |
44 } | 44 } |
45 | 45 |
46 finishedHash.Write(hello.marshal()) | 46 finishedHash.Write(hello.marshal()) |
47 c.writeRecord(recordTypeHandshake, hello.marshal()) | 47 c.writeRecord(recordTypeHandshake, hello.marshal()) |
48 | 48 |
49 msg, err := c.readHandshake() | 49 msg, err := c.readHandshake() |
50 if err != nil { | 50 if err != nil { |
51 return err | 51 return err |
52 } | 52 } |
53 serverHello, ok := msg.(*serverHelloMsg) | 53 serverHello, ok := msg.(*serverHelloMsg) |
54 if !ok { | 54 if !ok { |
55 return c.sendAlert(alertUnexpectedMessage) | 55 return c.sendAlert(alertUnexpectedMessage) |
56 } | 56 } |
57 finishedHash.Write(serverHello.marshal()) | 57 finishedHash.Write(serverHello.marshal()) |
58 | 58 |
59 vers, ok := mutualVersion(serverHello.vers) | 59 vers, ok := mutualVersion(serverHello.vers) |
60 if !ok { | 60 if !ok { |
61 return c.sendAlert(alertProtocolVersion) | 61 return c.sendAlert(alertProtocolVersion) |
62 } | 62 } |
63 c.vers = vers | 63 c.vers = vers |
64 c.haveVers = true | 64 c.haveVers = true |
65 | 65 |
66 if serverHello.compressionMethod != compressionNone { | 66 if serverHello.compressionMethod != compressionNone { |
67 return c.sendAlert(alertUnexpectedMessage) | 67 return c.sendAlert(alertUnexpectedMessage) |
68 } | 68 } |
69 | 69 |
70 if !hello.nextProtoNeg && serverHello.nextProtoNeg { | 70 if !hello.nextProtoNeg && serverHello.nextProtoNeg { |
71 c.sendAlert(alertHandshakeFailure) | 71 c.sendAlert(alertHandshakeFailure) |
72 » » return os.ErrorString("server advertised unrequested NPN") | 72 » » return os.NewError("server advertised unrequested NPN") |
73 } | 73 } |
74 | 74 |
75 suite, suiteId := mutualCipherSuite(c.config.cipherSuites(), serverHello
.cipherSuite) | 75 suite, suiteId := mutualCipherSuite(c.config.cipherSuites(), serverHello
.cipherSuite) |
76 if suite == nil { | 76 if suite == nil { |
77 return c.sendAlert(alertHandshakeFailure) | 77 return c.sendAlert(alertHandshakeFailure) |
78 } | 78 } |
79 | 79 |
80 msg, err = c.readHandshake() | 80 msg, err = c.readHandshake() |
81 if err != nil { | 81 if err != nil { |
82 return err | 82 return err |
83 } | 83 } |
84 certMsg, ok := msg.(*certificateMsg) | 84 certMsg, ok := msg.(*certificateMsg) |
85 if !ok || len(certMsg.certificates) == 0 { | 85 if !ok || len(certMsg.certificates) == 0 { |
86 return c.sendAlert(alertUnexpectedMessage) | 86 return c.sendAlert(alertUnexpectedMessage) |
87 } | 87 } |
88 finishedHash.Write(certMsg.marshal()) | 88 finishedHash.Write(certMsg.marshal()) |
89 | 89 |
90 certs := make([]*x509.Certificate, len(certMsg.certificates)) | 90 certs := make([]*x509.Certificate, len(certMsg.certificates)) |
91 for i, asn1Data := range certMsg.certificates { | 91 for i, asn1Data := range certMsg.certificates { |
92 cert, err := x509.ParseCertificate(asn1Data) | 92 cert, err := x509.ParseCertificate(asn1Data) |
93 if err != nil { | 93 if err != nil { |
94 c.sendAlert(alertBadCertificate) | 94 c.sendAlert(alertBadCertificate) |
95 » » » return os.ErrorString("failed to parse certificate from
server: " + err.String()) | 95 » » » return os.NewError("failed to parse certificate from ser
ver: " + err.String()) |
96 } | 96 } |
97 certs[i] = cert | 97 certs[i] = cert |
98 } | 98 } |
99 | 99 |
100 // If we don't have a root CA set configured then anything is accepted. | 100 // If we don't have a root CA set configured then anything is accepted. |
101 // TODO(rsc): Find certificates for OS X 10.6. | 101 // TODO(rsc): Find certificates for OS X 10.6. |
102 if c.config.RootCAs != nil { | 102 if c.config.RootCAs != nil { |
103 opts := x509.VerifyOptions{ | 103 opts := x509.VerifyOptions{ |
104 Roots: c.config.RootCAs, | 104 Roots: c.config.RootCAs, |
105 CurrentTime: c.config.time(), | 105 CurrentTime: c.config.time(), |
(...skipping 200 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
306 for _, s := range serverProtos { | 306 for _, s := range serverProtos { |
307 for _, c := range clientProtos { | 307 for _, c := range clientProtos { |
308 if s == c { | 308 if s == c { |
309 return s, false | 309 return s, false |
310 } | 310 } |
311 } | 311 } |
312 } | 312 } |
313 | 313 |
314 return clientProtos[0], true | 314 return clientProtos[0], true |
315 } | 315 } |
OLD | NEW |