From d4bd855cfb5319bfa560251d60a93369c0ce0763 Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Wed, 24 May 2023 15:49:56 +0200 Subject: crypto/tls: don't reverify but check certificate expiration on resumption We used to inconsistently run certificate verification on the server on resumption, but not on the client. This made TLS 1.3 resumption pretty much useless, as it didn't save bytes, CPU, or round-trips. This requires serializing the verified chains into the session ticket, so it's a tradeoff making the ticket bigger to save computation (and for consistency). The previous behavior also had a "stickyness" issue: if a ticket contained invalid certificates, they would be used even if the client had in the meantime configured valid certificates for a full handshake. We also didn't check expiration on the client side on resumption if InsecureSkipVerify was set. Again for consistency, we do that now. Also, we used to run VerifyPeerCertificates on resumption even if NoClientCerts was set. Fixes #31641 Change-Id: Icc88269ea4adb544fa81158114aae76f3c91a15f Reviewed-on: https://go-review.googlesource.com/c/go/+/497895 Reviewed-by: Damien Neil TryBot-Result: Gopher Robot Run-TryBot: Filippo Valsorda Reviewed-by: Roland Shoemaker Auto-Submit: Filippo Valsorda --- src/crypto/tls/testdata/Server-TLSv13-RSA-RSAPSS | 166 +++++++++++------------ 1 file changed, 83 insertions(+), 83 deletions(-) (limited to 'src/crypto/tls/testdata/Server-TLSv13-RSA-RSAPSS') diff --git a/src/crypto/tls/testdata/Server-TLSv13-RSA-RSAPSS b/src/crypto/tls/testdata/Server-TLSv13-RSA-RSAPSS index 33d719b8d3..1caf8316fd 100644 --- a/src/crypto/tls/testdata/Server-TLSv13-RSA-RSAPSS +++ b/src/crypto/tls/testdata/Server-TLSv13-RSA-RSAPSS @@ -1,96 +1,96 @@ >>> Flow 1 (client to server) -00000000 16 03 01 00 b2 01 00 00 ae 03 03 5c b1 42 4e f5 |...........\.BN.| -00000010 8f 48 e9 e7 5e 4c bf 3f 25 c1 ba 11 95 de 9a 6e |.H..^L.?%......n| -00000020 a1 c0 55 34 c3 99 bc f5 d1 ec cb 20 dc b0 2a 8e |..U4....... ..*.| -00000030 0a c1 a0 cb 23 ed e4 dd c8 90 97 a9 82 7e 6a d8 |....#........~j.| -00000040 73 65 76 9f ef 2c 3a 44 38 ac 00 ad 00 04 13 03 |sev..,:D8.......| +00000000 16 03 01 00 b2 01 00 00 ae 03 03 4f 1c 96 1a 7c |...........O...|| +00000010 56 ea 59 60 5f bc 59 a4 c8 c1 ab 17 86 0b f9 d6 |V.Y`_.Y.........| +00000020 7d 15 e4 b7 01 d3 27 55 af 8d 45 20 4b 2c f9 5c |}.....'U..E K,.\| +00000030 05 ff 79 28 e6 63 7e 1f d7 10 26 07 2d ec c7 ed |..y(.c~...&.-...| +00000040 1c c2 07 f1 ac 3b e9 2d 1a 8d 71 a0 00 04 13 03 |.....;.-..q.....| 00000050 00 ff 01 00 00 61 00 0b 00 04 03 00 01 02 00 0a |.....a..........| 00000060 00 0c 00 0a 00 1d 00 17 00 1e 00 19 00 18 00 16 |................| 00000070 00 00 00 17 00 00 00 0d 00 06 00 04 08 06 08 04 |................| 00000080 00 2b 00 03 02 03 04 00 2d 00 02 01 01 00 33 00 |.+......-.....3.| -00000090 26 00 24 00 1d 00 20 85 c1 c2 cb 1a 48 84 5e 22 |&.$... .....H.^"| -000000a0 20 47 32 02 5c f4 8d d6 45 32 bb 88 87 9c 30 3d | G2.\...E2....0=| -000000b0 83 cf 1f e5 8e 7c 28 |.....|(| +00000090 26 00 24 00 1d 00 20 bd 6f e3 5c 82 72 3d cf 0d |&.$... .o.\.r=..| +000000a0 2e 49 d0 c9 7e cc 36 88 ff 05 ed b3 c6 f1 93 9b |.I..~.6.........| +000000b0 2a 6c 5f ca e5 eb 0f |*l_....| >>> Flow 2 (server to client) 00000000 16 03 03 00 7a 02 00 00 76 03 03 00 00 00 00 00 |....z...v.......| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| -00000020 00 00 00 00 00 00 00 00 00 00 00 20 dc b0 2a 8e |........... ..*.| -00000030 0a c1 a0 cb 23 ed e4 dd c8 90 97 a9 82 7e 6a d8 |....#........~j.| -00000040 73 65 76 9f ef 2c 3a 44 38 ac 00 ad 13 03 00 00 |sev..,:D8.......| +00000020 00 00 00 00 00 00 00 00 00 00 00 20 4b 2c f9 5c |........... K,.\| +00000030 05 ff 79 28 e6 63 7e 1f d7 10 26 07 2d ec c7 ed |..y(.c~...&.-...| +00000040 1c c2 07 f1 ac 3b e9 2d 1a 8d 71 a0 13 03 00 00 |.....;.-..q.....| 00000050 2e 00 2b 00 02 03 04 00 33 00 24 00 1d 00 20 2f |..+.....3.$... /| 00000060 e5 7d a3 47 cd 62 43 15 28 da ac 5f bb 29 07 30 |.}.G.bC.(.._.).0| 00000070 ff f6 84 af c4 cf c2 ed 90 99 5f 58 cb 3b 74 14 |.........._X.;t.| -00000080 03 03 00 01 01 17 03 03 00 17 31 a8 1f 92 5a 76 |..........1...Zv| -00000090 1b e0 15 cd 31 83 e9 1f 35 26 00 c4 07 a3 78 b3 |....1...5&....x.| -000000a0 07 17 03 03 02 6d e9 b2 fd 16 24 36 f1 43 17 27 |.....m....$6.C.'| -000000b0 cf e2 4f b3 36 50 af f1 79 9b a7 1f 2e 0e 3a a8 |..O.6P..y.....:.| -000000c0 ae f2 c9 5c ed e3 87 1e 4f 1a 87 58 a7 25 ea 08 |...\....O..X.%..| -000000d0 ad 1a fd 12 52 ad ca db bf 46 2d b4 34 29 cc 62 |....R....F-.4).b| -000000e0 b3 86 cc f9 64 47 e3 a9 f3 98 04 6a 95 f5 13 ae |....dG.....j....| -000000f0 72 ff 0e 21 eb f8 25 30 31 5e 80 20 e4 64 fe fb |r..!..%01^. .d..| -00000100 a4 e7 55 fb ce 01 3f 08 6e 48 e3 e2 64 f1 a6 54 |..U...?.nH..d..T| -00000110 43 8f 43 f8 6a b7 bc a4 c5 9c 33 00 42 a2 41 db |C.C.j.....3.B.A.| -00000120 98 43 8b f0 05 2a 75 8d a1 cd 18 0f 4e c5 79 b0 |.C...*u.....N.y.| -00000130 12 5e 98 2a 5e 2d 02 30 9c f6 2f 94 02 89 42 a0 |.^.*^-.0../...B.| -00000140 83 69 0f 8f 24 96 f6 ce 78 12 ff d2 6e d6 74 ed |.i..$...x...n.t.| -00000150 31 1b 09 7e 38 c8 8c cb e1 ea eb ce 9d 77 46 47 |1..~8........wFG| -00000160 ae c8 88 41 fe 46 b6 c0 14 e2 5e 49 f8 e6 bc 51 |...A.F....^I...Q| -00000170 13 0a 60 66 78 9b 94 09 cc 56 06 61 62 2d cd 95 |..`fx....V.ab-..| -00000180 93 e8 fe 5a c1 b6 b8 5e 30 94 a3 3c 5c 77 1a 41 |...Z...^0..<\w.A| -00000190 b6 7d 6c 77 73 6a 30 87 9e 85 cf b6 e3 53 44 f1 |.}lwsj0......SD.| -000001a0 87 19 4a d1 a7 58 cc da 43 87 dd 0d ff c4 74 cb |..J..X..C.....t.| -000001b0 c0 a6 ca 80 d7 29 bb 85 bb a0 ad 5b c8 52 6b 97 |.....).....[.Rk.| -000001c0 d1 cd cb 9b e0 69 58 d8 2a bc 5c 62 5c 4a 15 28 |.....iX.*.\b\J.(| -000001d0 db ba d9 8b b2 d5 94 c2 40 7c 96 91 cc ef 26 f1 |........@|....&.| -000001e0 1d a7 9e 3b f7 2f be 5d 46 65 14 77 0f 40 d4 e3 |...;./.]Fe.w.@..| -000001f0 26 42 c0 f9 db 9f cc 93 06 37 e2 84 31 61 ce 13 |&B.......7..1a..| -00000200 40 0a e5 20 eb 7b 93 ed 77 d8 1d 04 62 c2 e3 76 |@.. .{..w...b..v| -00000210 9f 5f 5e 44 10 4a 8e c8 7e b0 23 8a 3c 4a df af |._^D.J..~.#...| -00000390 f0 fc 64 28 71 8c fd ff fa 72 bd 3c f9 d9 13 b5 |..d(q....r.<....| -000003a0 e3 a2 46 20 b3 67 04 58 79 df aa ca b7 9b b9 6f |..F .g.Xy......o| -000003b0 33 17 03 03 00 35 e6 33 b7 50 67 b4 f0 1e 6a 29 |3....5.3.Pg...j)| -000003c0 25 22 23 f6 3c a1 72 4e 46 19 16 76 7e 80 5f c3 |%"#.<.rNF..v~._.| -000003d0 06 46 16 02 6e 9e 5e 0f 60 7c 0a 0a 9f 84 95 28 |.F..n.^.`|.....(| -000003e0 64 f1 9d 40 c2 56 99 49 97 f1 5e 17 03 03 00 88 |d..@.V.I..^.....| -000003f0 bd 43 c9 3d 7c 7c 07 af 6a 03 5e d0 59 c5 9e 7c |.C.=||..j.^.Y..|| -00000400 1f 23 08 c4 17 95 16 fa 73 37 1b 0a a3 e6 5f b1 |.#......s7...._.| -00000410 08 4c 95 ef ae e6 d8 12 0c b6 d3 81 95 71 b7 e4 |.L...........q..| -00000420 f9 52 fb c1 da 82 db 83 b6 0d a3 71 57 44 27 e1 |.R.........qWD'.| -00000430 45 12 08 48 f8 21 33 51 51 42 d7 7a 1e 81 6c 28 |E..H.!3QQB.z..l(| -00000440 50 79 18 1a 02 45 9f 63 bc c9 fb 9b aa 35 51 48 |Py...E.c.....5QH| -00000450 d4 64 55 bf 27 dd 99 fd d2 d1 60 05 18 0e 6f 08 |.dU.'.....`...o.| -00000460 fe ea 8e af 1f 70 c3 e3 34 83 41 52 3e 57 d1 7d |.....p..4.AR>W.}| -00000470 88 2f 03 e0 1e 1a 0b c7 |./......| +00000080 03 03 00 01 01 17 03 03 00 17 ce 73 37 c4 06 32 |...........s7..2| +00000090 74 c4 3d 2d 55 10 b4 ce 3f 66 fa ec 9a 8c d1 4a |t.=-U...?f.....J| +000000a0 cd 17 03 03 02 6d 6a 73 5d 98 e7 fc 37 d2 b8 5d |.....mjs]...7..]| +000000b0 2a 1c 75 80 b3 a9 ce 6e e2 d0 b5 5c 70 2b e5 c0 |*.u....n...\p+..| +000000c0 28 4e bf 8c af 5a 78 a2 bc 29 fd 60 68 f8 fa ed |(N...Zx..).`h...| +000000d0 5d 92 b2 d0 e8 69 e7 f7 1b 71 0b 30 4b c5 46 53 |]....i...q.0K.FS| +000000e0 df 73 b9 95 65 6e cd df 26 b3 2b fd 7a 41 e9 4b |.s..en..&.+.zA.K| +000000f0 8c 27 a3 d5 96 ed 44 01 9d 50 a8 39 28 f7 63 3d |.'....D..P.9(.c=| +00000100 9e b7 1c 70 bf 2c d9 c4 67 5f 4f a7 7d b1 7a 4d |...p.,..g_O.}.zM| +00000110 eb bd a3 4c 3b 0b ca 92 c4 db 21 dd 36 f2 4e ce |...L;.....!.6.N.| +00000120 17 95 25 df bc 4a 2a 82 bb 5c 12 e4 6f ab 5a 03 |..%..J*..\..o.Z.| +00000130 b7 7b 9f 8b 8e df ce c1 14 61 39 f1 8d f6 bb 90 |.{.......a9.....| +00000140 a6 3a c0 21 13 9b a0 28 f6 05 34 a1 5a c5 ed 13 |.:.!...(..4.Z...| +00000150 43 3d b6 3a 06 f8 89 ac fe 8f 71 76 58 43 32 56 |C=.:......qvXC2V| +00000160 71 5c ad 4c 19 e6 54 ba 32 49 83 c7 b6 5a a8 9d |q\.L..T.2I...Z..| +00000170 00 37 05 09 50 db c9 52 98 0d 96 03 11 22 a3 39 |.7..P..R.....".9| +00000180 75 fe a7 34 20 0e f6 9c a9 79 0f 9e 05 fc 5a 4e |u..4 ....y....ZN| +00000190 76 7c 13 0e a7 6a 1e 4a f7 ba a7 a8 18 8d 89 4a |v|...j.J.......J| +000001a0 ad 34 40 81 2c e9 07 18 ba 95 48 dd 11 e7 11 0b |.4@.,.....H.....| +000001b0 27 fe 9f 3c e6 44 72 16 89 dc 7d 8e 22 cf 4d 96 |'..<.Dr...}.".M.| +000001c0 60 3c 78 7a ed 6e a9 ba d1 c3 59 b7 a7 32 bc 44 |`C...| +00000360 41 51 24 49 1f e3 09 16 cd b6 4a db 62 ce 8f 79 |AQ$I......J.b..y| +00000370 19 6b 4d e4 e9 61 4f ef 43 31 e1 82 e3 57 32 01 |.kM..aO.C1...W2.| +00000380 58 d5 67 5f bd 5e d6 f5 b9 3c 91 65 96 49 81 b2 |X.g_.^...<.e.I..| +00000390 8c 6d a8 ba 37 2f dd 8b bc 3a 33 9a 44 8a da e7 |.m..7/...:3.D...| +000003a0 16 e1 d7 67 09 3a 3c d6 9f be bd 2b 50 d6 5d 3f |...g.:<....+P.]?| +000003b0 96 17 03 03 00 35 77 34 06 35 5c 89 77 e6 a2 f8 |.....5w4.5\.w...| +000003c0 3f b4 9e 45 ce 29 a8 f7 24 45 7c 00 36 96 f9 c4 |?..E.)..$E|.6...| +000003d0 7b 6b 29 78 9e 13 78 95 9f 21 64 cb 5f a0 f1 ef |{k)x..x..!d._...| +000003e0 3b 19 47 30 85 08 67 8f 84 b8 9c 17 03 03 00 8b |;.G0..g.........| +000003f0 af fb c3 c3 f4 33 c3 e7 52 e0 c2 1b 3d f3 7f 40 |.....3..R...=..@| +00000400 7d 33 38 8e 59 7d 3e 4f 8e 93 95 f8 9c 09 56 1b |}38.Y}>O......V.| +00000410 68 d8 0c 11 a9 e6 6a c6 ea 6c 00 1e eb 3d d1 7b |h.....j..l...=.{| +00000420 fc 1b 8e 52 69 f1 30 8c 3d 9d 3a 26 6e 9e 72 d9 |...Ri.0.=.:&n.r.| +00000430 c4 00 a1 ae 87 ca 21 fc 45 ae af 58 9f 09 38 10 |......!.E..X..8.| +00000440 94 b2 4c 58 46 da 8f fd c5 4a 60 0c ee 79 b7 6b |..LXF....J`..y.k| +00000450 5a 74 f6 b4 e6 a0 1b 0c 8f 94 d9 79 07 36 05 ea |Zt.........y.6..| +00000460 3b a3 11 ec 4a 86 b8 22 3c 94 eb da e1 d6 d4 91 |;...J.."<.......| +00000470 e7 99 af 6b 39 4a 6c ef d7 8b c7 |...k9Jl....| >>> Flow 3 (client to server) -00000000 14 03 03 00 01 01 17 03 03 00 35 af f3 03 dd 6d |..........5....m| -00000010 fa 9f 5b fe 8a 97 0e 2e ea a1 f1 ff 35 d5 39 a3 |..[.........5.9.| -00000020 d7 cd 47 0d 1b ae 57 aa d0 74 3d 63 e1 87 59 b1 |..G...W..t=c..Y.| -00000030 57 24 c6 1c 38 2f ea d9 c1 4e b1 f3 17 37 34 a4 |W$..8/...N...74.| +00000000 14 03 03 00 01 01 17 03 03 00 35 e9 ef 1b b1 01 |..........5.....| +00000010 b9 f2 6f e6 eb a0 52 01 81 f6 18 cf 28 f7 8a 09 |..o...R.....(...| +00000020 65 32 30 4b 67 1b df d5 9c 4c cb 83 11 4e 3d 7f |e20Kg....L...N=.| +00000030 d2 b8 a2 03 de 28 2d ef d0 68 b0 92 db 70 04 e2 |.....(-..h...p..| >>> Flow 4 (server to client) -00000000 17 03 03 00 1e a0 9b 1d d1 c2 bb b4 5b a8 43 d0 |............[.C.| -00000010 58 8d 38 41 4a 93 53 95 35 5e 68 a1 00 7d b0 39 |X.8AJ.S.5^h..}.9| -00000020 a5 38 e2 17 03 03 00 13 00 bc 3c d2 ec 93 64 fb |.8........<...d.| -00000030 2c 8c 18 ef 7f 1b 1d d6 5d 35 2c |,.......]5,| +00000000 17 03 03 00 1e d8 d0 6a a0 02 0a cf 78 95 08 e1 |.......j....x...| +00000010 2f dd 6b e3 db dc 8c f7 e3 5d 6e e2 48 5d d7 2c |/.k......]n.H].,| +00000020 2c 26 7b 17 03 03 00 13 0a cd 02 95 d2 79 5a 1c |,&{..........yZ.| +00000030 8a 27 a4 90 d3 7f ff 5c f1 b9 d8 |.'.....\...| -- cgit v1.3