mirrors/XTLS_REALITY
0
0
Fork 0
mirror of https://github.com/XTLS/REALITY.git synced 2025-08-22 14:38:35 +00:00
Code

crypto/tls: disable ExportKeyingMaterial without EMS

Browse Source 
Fixes #43922

Change-Id: Idaad7daa6784807ae3a5e4d944e88e13d01fd0b2
Reviewed-on: https://go-review.googlesource.com/c/go/+/544155
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
yuhan6665 2024-08-18 18:55:40 -04:00
parent 90b3d86d6a
commit 4abbcfc426
3 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
common.go
View File

@ -303,11 +303,13 @@ type ConnectionState struct {
// ExportKeyingMaterial returns length bytes of exported key material in a new // ExportKeyingMaterial returns length bytes of exported key material in a new
// slice as defined in RFC 5705. If context is nil, it is not used as part of // slice as defined in RFC 5705. If context is nil, it is not used as part of
// the seed. If the connection was set to allow renegotiation via // the seed. If the connection was set to allow renegotiation via
// Config.Renegotiation, this function will return an error. // Config.Renegotiation, or if the connections supports neither TLS 1.3 nor
// Extended Master Secret, this function will return an error.
// //
// There are conditions in which the returned values might not be unique to a // Exporting key material without Extended Master Secret or TLS 1.3 was disabled
// connection. See the Security Considerations sections of RFC 5705 and RFC 7627, // in Go 1.22 due to security issues (see the Security Considerations sections
// and https://mitls.org/pages/attacks/3SHAKE#channelbindings. // of RFC 5705 and RFC 7627), but can be re-enabled with the GODEBUG setting
// tlsunsafeekm=1.
func (cs *ConnectionState) ExportKeyingMaterial(label string, context []byte, length int) ([]byte, error) { func (cs *ConnectionState) ExportKeyingMaterial(label string, context []byte, length int) ([]byte, error) {
return cs.ekm(label, context, length) return cs.ekm(label, context, length)
} }

10
conn.go
View File

@ -1684,7 +1684,15 @@ func (c *Conn) connectionStateLocked() ConnectionState {
} }
} }
if c.config.Renegotiation != RenegotiateNever { if c.config.Renegotiation != RenegotiateNever {
state.ekm = noExportedKeyingMaterial state.ekm = noEKMBecauseRenegotiation
} else if c.vers != VersionTLS13 && !c.extMasterSecret {
state.ekm = func(label string, context []byte, length int) ([]byte, error) {
// if ekmgodebug.Value() == "1" {
// ekmgodebug.IncNonDefault()
// return c.ekm(label, context, length)
// }
return noEKMBecauseNoEMS(label, context, length)
}
} else { } else {
state.ekm = c.ekm state.ekm = c.ekm
} }

11
prf.go
View File

@ -252,13 +252,20 @@ func (h *finishedHash) discardHandshakeBuffer() {
h.buffer = nil h.buffer = nil
} }
// noExportedKeyingMaterial is used as a value of // noEKMBecauseRenegotiation is used as a value of
// ConnectionState.ekm when renegotiation is enabled and thus // ConnectionState.ekm when renegotiation is enabled and thus
// we wish to fail all key-material export requests. // we wish to fail all key-material export requests.
func noExportedKeyingMaterial(label string, context []byte, length int) ([]byte, error) { func noEKMBecauseRenegotiation(label string, context []byte, length int) ([]byte, error) {
return nil, errors.New("crypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabled") return nil, errors.New("crypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabled")
} }
// noEKMBecauseNoEMS is used as a value of ConnectionState.ekm when Extended
// Master Secret is not negotiated and thus we wish to fail all key-material
// export requests.
func noEKMBecauseNoEMS(label string, context []byte, length int) ([]byte, error) {
return nil, errors.New("crypto/tls: ExportKeyingMaterial is unavailable when neither TLS 1.3 nor Extended Master Secret are negotiated; override with GODEBUG=tlsunsafeekm=1")
}
// ekmFromMasterSecret generates exported keying material as defined in RFC 5705. // ekmFromMasterSecret generates exported keying material as defined in RFC 5705.
func ekmFromMasterSecret(version uint16, suite *cipherSuite, masterSecret, clientRandom, serverRandom []byte) func(string, []byte, int) ([]byte, error) { func ekmFromMasterSecret(version uint16, suite *cipherSuite, masterSecret, clientRandom, serverRandom []byte) func(string, []byte, int) ([]byte, error) {
return func(label string, context []byte, length int) ([]byte, error) { return func(label string, context []byte, length int) ([]byte, error) {