Skip to content

Commit 67c1704

Browse files
cpugopherbot
cpu
authored and
gopherbot
committed
crypto/tls: empty server_name conf. ext. from server
When a TLS server uses the information from the server_name extension in a client hello, and the connection isn't resuming, it should return an empty server_name extension in its server hello (or encrypted extensions for TLS 1.3). For TLS <1.3 we we do this in doFullHandshake(), by setting the pre-existing serverHelloMsg.serverNameAck bool. We know that the connection isn't resuming based on the context where this function is called. For TLS 1.3, a new encryptedExtensionsMsg.serverNameAck bool is added, and populated as appropriate in sendServerParameters() based on whether the conn was resumed or not. The encryptedExtensionsMsg marshalling is updated to emit the encrypted extension based on that field. These changes allow enabling the ServerNameExtensionServer-* bogo tests that verify both the presence and absence of the server_name extension based on the relevant specifications. Resolves #74282 Updates #72006 Change-Id: I703bc2ec916b50906bdece7b7483a7faed7aa8e4 Reviewed-on: https://go-review.googlesource.com/c/go/+/684795 TryBot-Bypass: Daniel McCarney <[email protected]> Reviewed-by: Carlos Amedee <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]> Auto-Submit: Daniel McCarney <[email protected]>
1 parent 54c9d77 commit 67c1704

File tree

7 files changed

+222
-206
lines changed

7 files changed

+222
-206
lines changed

‎src/crypto/tls/bogo_config.json

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -208,8 +208,6 @@
208208
"EarlyData-UnexpectedHandshake-Server-TLS13": "TODO: first pass, this should be fixed",
209209
"EarlyData-CipherMismatch-Client-TLS13": "TODO: first pass, this should be fixed",
210210

211-
"ServerNameExtensionServer-TLS-*": "https://github.com/golang/go/issues/74282",
212-
213211
"Resume-Server-UnofferedCipher-TLS13": "TODO: first pass, this should be fixed",
214212
"GarbageCertificate-Server-TLS13": "TODO: 2025/06 BoGo update, should be fixed",
215213
"WrongMessageType-TLS13-ClientCertificate-TLS": "TODO: 2025/06 BoGo update, should be fixed",

‎src/crypto/tls/handshake_messages.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1005,6 +1005,7 @@ type encryptedExtensionsMsg struct {
10051005
quicTransportParameters []byte
10061006
earlyData bool
10071007
echRetryConfigs []byte
1008+
serverNameAck bool
10081009
}
10091010

10101011
func (m *encryptedExtensionsMsg) marshal() ([]byte, error) {
@@ -1040,6 +1041,10 @@ func (m *encryptedExtensionsMsg) marshal() ([]byte, error) {
10401041
b.AddBytes(m.echRetryConfigs)
10411042
})
10421043
}
1044+
if m.serverNameAck {
1045+
b.AddUint16(extensionServerName)
1046+
b.AddUint16(0) // empty extension_data
1047+
}
10431048
})
10441049
})
10451050

@@ -1095,6 +1100,11 @@ func (m *encryptedExtensionsMsg) unmarshal(data []byte) bool {
10951100
if !extData.CopyBytes(m.echRetryConfigs) {
10961101
return false
10971102
}
1103+
case extensionServerName:
1104+
if len(extData) != 0 {
1105+
return false
1106+
}
1107+
m.serverNameAck = true
10981108
default:
10991109
// Ignore unknown extensions.
11001110
continue

‎src/crypto/tls/handshake_server.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -594,6 +594,10 @@ func (hs *serverHandshakeState) doFullHandshake() error {
594594
hs.hello.ocspStapling = true
595595
}
596596

597+
if hs.clientHello.serverName != "" {
598+
hs.hello.serverNameAck = true
599+
}
600+
597601
hs.hello.ticketSupported = hs.clientHello.ticketSupported && !c.config.SessionTicketsDisabled
598602
hs.hello.cipherSuite = hs.suite.id
599603

‎src/crypto/tls/handshake_server_tls13.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -802,6 +802,10 @@ func (hs *serverHandshakeStateTLS13) sendServerParameters() error {
802802
encryptedExtensions.earlyData = hs.earlyData
803803
}
804804

805+
if !hs.c.didResume && hs.clientHello.serverName != "" {
806+
encryptedExtensions.serverNameAck = true
807+
}
808+
805809
// If client sent ECH extension, but we didn't accept it,
806810
// send retry configs, if available.
807811
echKeys := hs.c.config.EncryptedClientHelloKeys

‎src/crypto/tls/testdata/Server-TLSv12-SNI

Lines changed: 68 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,83 +1,83 @@
11
>>> Flow 1 (client to server)
2-
00000000 16 03 01 00 81 01 00 00 7d 03 03 cc a1 7b c4 56 |........}....{.V|
3-
00000010 9f 65 31 01 b0 23 09 18 10 50 7c 1e 14 7b b5 dd |.e1..#...P|..{..|
4-
00000020 d4 70 07 3e 0b 19 19 31 6b f7 4d 00 00 04 00 2f |.p.>...1k.M..../|
2+
00000000 16 03 01 00 81 01 00 00 7d 03 03 5b 8e 50 b3 0e |........}..[.P..|
3+
00000010 1f d7 4f a4 0f 53 de 37 1a c6 86 2f 01 c0 0b 15 |..O..S.7.../....|
4+
00000020 cf a9 f4 f5 30 c0 aa 7e cc 5b 4e 00 00 04 00 2f |....0..~.[N..../|
55
00000030 00 ff 01 00 00 50 00 00 00 10 00 0e 00 00 0b 73 |.....P.........s|
66
00000040 6e 69 74 65 73 74 2e 63 6f 6d 00 16 00 00 00 17 |nitest.com......|
77
00000050 00 00 00 0d 00 30 00 2e 04 03 05 03 06 03 08 07 |.....0..........|
88
00000060 08 08 08 09 08 0a 08 0b 08 04 08 05 08 06 04 01 |................|
99
00000070 05 01 06 01 03 03 02 03 03 01 02 01 03 02 02 02 |................|
1010
00000080 04 02 05 02 06 02 |......|
1111
>>> Flow 2 (server to client)
12-
00000000 16 03 03 00 35 02 00 00 31 03 03 00 00 00 00 00 |....5...1.......|
12+
00000000 16 03 03 00 39 02 00 00 35 03 03 00 00 00 00 00 |....9...5.......|
1313
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
1414
00000020 00 00 00 44 4f 57 4e 47 52 44 01 00 00 2f 00 00 |...DOWNGRD.../..|
15-
00000030 09 ff 01 00 01 00 00 17 00 00 16 03 03 02 59 0b |..............Y.|
16-
00000040 00 02 55 00 02 52 00 02 4f 30 82 02 4b 30 82 01 |..U..R..O0..K0..|
17-
00000050 b4 a0 03 02 01 02 02 09 00 e8 f0 9d 3f e2 5b ea |............?.[.|
18-
00000060 a6 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 |.0...*.H........|
19-
00000070 30 1f 31 0b 30 09 06 03 55 04 0a 13 02 47 6f 31 |0.1.0...U....Go1|
20-
00000080 10 30 0e 06 03 55 04 03 13 07 47 6f 20 52 6f 6f |.0...U....Go Roo|
21-
00000090 74 30 1e 17 0d 31 36 30 31 30 31 30 30 30 30 30 |t0...16010100000|
22-
000000a0 30 5a 17 0d 32 35 30 31 30 31 30 30 30 30 30 30 |0Z..250101000000|
23-
000000b0 5a 30 1a 31 0b 30 09 06 03 55 04 0a 13 02 47 6f |Z0.1.0...U....Go|
24-
000000c0 31 0b 30 09 06 03 55 04 03 13 02 47 6f 30 81 9f |1.0...U....Go0..|
25-
000000d0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 |0...*.H.........|
26-
000000e0 81 8d 00 30 81 89 02 81 81 00 db 46 7d 93 2e 12 |...0.......F}...|
27-
000000f0 27 06 48 bc 06 28 21 ab 7e c4 b6 a2 5d fe 1e 52 |'.H..(!.~...]..R|
28-
00000100 45 88 7a 36 47 a5 08 0d 92 42 5b c2 81 c0 be 97 |E.z6G....B[.....|
29-
00000110 79 98 40 fb 4f 6d 14 fd 2b 13 8b c2 a5 2e 67 d8 |[email protected]..+.....g.|
30-
00000120 d4 09 9e d6 22 38 b7 4a 0b 74 73 2b c2 34 f1 d1 |...."8.J.ts+.4..|
31-
00000130 93 e5 96 d9 74 7b f3 58 9f 6c 61 3c c0 b0 41 d4 |....t{.X.la<..A.|
32-
00000140 d9 2b 2b 24 23 77 5b 1c 3b bd 75 5d ce 20 54 cf |.++$#w[.;.u]. T.|
33-
00000150 a1 63 87 1d 1e 24 c4 f3 1d 1a 50 8b aa b6 14 43 |.c...$....P....C|
34-
00000160 ed 97 a7 75 62 f4 14 c8 52 d7 02 03 01 00 01 a3 |...ub...R.......|
35-
00000170 81 93 30 81 90 30 0e 06 03 55 1d 0f 01 01 ff 04 |..0..0...U......|
36-
00000180 04 03 02 05 a0 30 1d 06 03 55 1d 25 04 16 30 14 |.....0...U.%..0.|
37-
00000190 06 08 2b 06 01 05 05 07 03 01 06 08 2b 06 01 05 |..+.........+...|
38-
000001a0 05 07 03 02 30 0c 06 03 55 1d 13 01 01 ff 04 02 |....0...U.......|
39-
000001b0 30 00 30 19 06 03 55 1d 0e 04 12 04 10 9f 91 16 |0.0...U.........|
40-
000001c0 1f 43 43 3e 49 a6 de 6d b6 80 d7 9f 60 30 1b 06 |.CC>I..m....`0..|
41-
000001d0 03 55 1d 23 04 14 30 12 80 10 48 13 49 4d 13 7e |.U.#..0...H.IM.~|
42-
000001e0 16 31 bb a3 01 d5 ac ab 6e 7b 30 19 06 03 55 1d |.1......n{0...U.|
43-
000001f0 11 04 12 30 10 82 0e 65 78 61 6d 70 6c 65 2e 67 |...0...example.g|
44-
00000200 6f 6c 61 6e 67 30 0d 06 09 2a 86 48 86 f7 0d 01 |olang0...*.H....|
45-
00000210 01 0b 05 00 03 81 81 00 9d 30 cc 40 2b 5b 50 a0 |.........0.@+[P.|
46-
00000220 61 cb ba e5 53 58 e1 ed 83 28 a9 58 1a a9 38 a4 |a...SX...(.X..8.|
47-
00000230 95 a1 ac 31 5a 1a 84 66 3d 43 d3 2d d9 0b f2 97 |...1Z..f=C.-....|
48-
00000240 df d3 20 64 38 92 24 3a 00 bc cf 9c 7d b7 40 20 |.. d8.$:....}.@ |
49-
00000250 01 5f aa d3 16 61 09 a2 76 fd 13 c3 cc e1 0c 5c |._...a..v......\|
50-
00000260 ee b1 87 82 f1 6c 04 ed 73 bb b3 43 77 8d 0c 1c |.....l..s..Cw...|
51-
00000270 f1 0f a1 d8 40 83 61 c9 4c 72 2b 9d ae db 46 06 |[email protected]+...F.|
52-
00000280 06 4d f4 c1 b3 3e c0 d1 bd 42 d4 db fe 3d 13 60 |.M...>...B...=.`|
53-
00000290 84 5c 21 d3 3b e9 fa e7 16 03 03 00 04 0e 00 00 |.\!.;...........|
54-
000002a0 00 |.|
15+
00000030 0d ff 01 00 01 00 00 17 00 00 00 00 00 00 16 03 |................|
16+
00000040 03 02 59 0b 00 02 55 00 02 52 00 02 4f 30 82 02 |..Y...U..R..O0..|
17+
00000050 4b 30 82 01 b4 a0 03 02 01 02 02 09 00 e8 f0 9d |K0..............|
18+
00000060 3f e2 5b ea a6 30 0d 06 09 2a 86 48 86 f7 0d 01 |?.[..0...*.H....|
19+
00000070 01 0b 05 00 30 1f 31 0b 30 09 06 03 55 04 0a 13 |....0.1.0...U...|
20+
00000080 02 47 6f 31 10 30 0e 06 03 55 04 03 13 07 47 6f |.Go1.0...U....Go|
21+
00000090 20 52 6f 6f 74 30 1e 17 0d 31 36 30 31 30 31 30 | Root0...1601010|
22+
000000a0 30 30 30 30 30 5a 17 0d 32 35 30 31 30 31 30 30 |00000Z..25010100|
23+
000000b0 30 30 30 30 5a 30 1a 31 0b 30 09 06 03 55 04 0a |0000Z0.1.0...U..|
24+
000000c0 13 02 47 6f 31 0b 30 09 06 03 55 04 03 13 02 47 |..Go1.0...U....G|
25+
000000d0 6f 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 |o0..0...*.H.....|
26+
000000e0 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 db 46 |.......0.......F|
27+
000000f0 7d 93 2e 12 27 06 48 bc 06 28 21 ab 7e c4 b6 a2 |}...'.H..(!.~...|
28+
00000100 5d fe 1e 52 45 88 7a 36 47 a5 08 0d 92 42 5b c2 |]..RE.z6G....B[.|
29+
00000110 81 c0 be 97 79 98 40 fb 4f 6d 14 fd 2b 13 8b c2 |....[email protected]..+...|
30+
00000120 a5 2e 67 d8 d4 09 9e d6 22 38 b7 4a 0b 74 73 2b |..g....."8.J.ts+|
31+
00000130 c2 34 f1 d1 93 e5 96 d9 74 7b f3 58 9f 6c 61 3c |.4......t{.X.la<|
32+
00000140 c0 b0 41 d4 d9 2b 2b 24 23 77 5b 1c 3b bd 75 5d |..A..++$#w[.;.u]|
33+
00000150 ce 20 54 cf a1 63 87 1d 1e 24 c4 f3 1d 1a 50 8b |. T..c...$....P.|
34+
00000160 aa b6 14 43 ed 97 a7 75 62 f4 14 c8 52 d7 02 03 |...C...ub...R...|
35+
00000170 01 00 01 a3 81 93 30 81 90 30 0e 06 03 55 1d 0f |......0..0...U..|
36+
00000180 01 01 ff 04 04 03 02 05 a0 30 1d 06 03 55 1d 25 |.........0...U.%|
37+
00000190 04 16 30 14 06 08 2b 06 01 05 05 07 03 01 06 08 |..0...+.........|
38+
000001a0 2b 06 01 05 05 07 03 02 30 0c 06 03 55 1d 13 01 |+.......0...U...|
39+
000001b0 01 ff 04 02 30 00 30 19 06 03 55 1d 0e 04 12 04 |....0.0...U.....|
40+
000001c0 10 9f 91 16 1f 43 43 3e 49 a6 de 6d b6 80 d7 9f |.....CC>I..m....|
41+
000001d0 60 30 1b 06 03 55 1d 23 04 14 30 12 80 10 48 13 |`0...U.#..0...H.|
42+
000001e0 49 4d 13 7e 16 31 bb a3 01 d5 ac ab 6e 7b 30 19 |IM.~.1......n{0.|
43+
000001f0 06 03 55 1d 11 04 12 30 10 82 0e 65 78 61 6d 70 |..U....0...examp|
44+
00000200 6c 65 2e 67 6f 6c 61 6e 67 30 0d 06 09 2a 86 48 |le.golang0...*.H|
45+
00000210 86 f7 0d 01 01 0b 05 00 03 81 81 00 9d 30 cc 40 |.............0.@|
46+
00000220 2b 5b 50 a0 61 cb ba e5 53 58 e1 ed 83 28 a9 58 |+[P.a...SX...(.X|
47+
00000230 1a a9 38 a4 95 a1 ac 31 5a 1a 84 66 3d 43 d3 2d |..8....1Z..f=C.-|
48+
00000240 d9 0b f2 97 df d3 20 64 38 92 24 3a 00 bc cf 9c |...... d8.$:....|
49+
00000250 7d b7 40 20 01 5f aa d3 16 61 09 a2 76 fd 13 c3 |}.@ ._...a..v...|
50+
00000260 cc e1 0c 5c ee b1 87 82 f1 6c 04 ed 73 bb b3 43 |...\.....l..s..C|
51+
00000270 77 8d 0c 1c f1 0f a1 d8 40 83 61 c9 4c 72 2b 9d |w.......@.a.Lr+.|
52+
00000280 ae db 46 06 06 4d f4 c1 b3 3e c0 d1 bd 42 d4 db |..F..M...>...B..|
53+
00000290 fe 3d 13 60 84 5c 21 d3 3b e9 fa e7 16 03 03 00 |.=.`.\!.;.......|
54+
000002a0 04 0e 00 00 00 |.....|
5555
>>> Flow 3 (client to server)
56-
00000000 16 03 03 00 86 10 00 00 82 00 80 04 36 4c 25 96 |............6L%.|
57-
00000010 b0 1a 33 80 88 98 4f 2a c8 93 24 81 0a 78 6c 85 |..3...O*..$..xl.|
58-
00000020 06 4d f1 cf 25 18 e0 f0 61 50 c5 45 c1 24 1b b3 |.M..%...aP.E.$..|
59-
00000030 d6 3c d3 49 a6 40 81 2c bb ef 49 76 c0 10 4c ad |.<.I.@.,..Iv..L.|
60-
00000040 2e 7d 4d f4 0b 96 bc 1c eb 3d 1d 7d 18 25 34 14 |.}M......=.}.%4.|
61-
00000050 ed 76 f2 a1 17 aa 87 1b ef ff 11 93 a7 44 0c 33 |.v...........D.3|
62-
00000060 86 27 38 3d 5d 3f bb f1 8d a9 f5 44 28 d1 28 41 |.'8=]?.....D(.(A|
63-
00000070 bb b7 9a fb 83 81 91 92 4e 7d 71 55 43 ed 42 12 |........N}qUC.B.|
64-
00000080 86 5f de 02 13 1f c4 63 08 87 db 14 03 03 00 01 |._.....c........|
65-
00000090 01 16 03 03 00 40 32 01 5f a2 e1 08 cf 6b ce 11 |.....@2._....k..|
66-
000000a0 db 82 94 c5 f1 12 9a ac 68 dc f9 c8 2c 00 a5 dd |........h...,...|
67-
000000b0 6b 49 c8 8b b7 9f e3 90 27 a5 c2 45 fc 75 e5 ac |kI......'..E.u..|
68-
000000c0 77 0c 80 bd 43 41 d4 00 c0 fb 8d 08 a6 f4 f7 63 |w...CA.........c|
69-
000000d0 07 01 09 06 e5 fc |......|
56+
00000000 16 03 03 00 86 10 00 00 82 00 80 25 3d 8b d1 c0 |...........%=...|
57+
00000010 ef 86 34 20 a5 4b 4b 94 d9 c8 04 ff 02 13 24 57 |..4 .KK.......$W|
58+
00000020 21 7f f1 c1 06 0b ea 1f b1 06 e8 fa 9b 5c 34 96 |!............\4.|
59+
00000030 23 2a 4b ef cb d7 47 75 05 74 f3 7f ed fb 28 6a |#*K...Gu.t....(j|
60+
00000040 cd b8 16 12 96 4b b7 cf 0c c3 b0 93 c3 ea b0 78 |.....K.........x|
61+
00000050 65 93 9d 6d a9 d5 b7 ed be 8b 3a f6 12 bb 5d ae |e..m......:...].|
62+
00000060 2b 17 2f 62 ca 21 68 7d 12 52 e3 2c cc 32 4b 94 |+./b.!h}.R.,.2K.|
63+
00000070 4b 1d 73 9a 2e 60 60 da e6 32 dd d3 4d 39 69 c8 |K.s..``..2..M9i.|
64+
00000080 b7 9d 8a 1d d8 57 90 13 4c 2a a9 14 03 03 00 01 |.....W..L*......|
65+
00000090 01 16 03 03 00 40 c4 71 f6 06 63 08 15 02 63 0a |.....@.q..c...c.|
66+
000000a0 59 40 55 52 28 17 3f 16 c8 48 93 af 80 87 e6 a8 |Y@UR(.?..H......|
67+
000000b0 37 a4 4f 20 f0 37 88 5b 55 f3 32 60 c7 c4 1d ce |7.O .7.[U.2`....|
68+
000000c0 b2 b8 d1 2d 8b fb a6 87 39 c8 75 31 22 77 33 82 |...-....9.u1"w3.|
69+
000000d0 64 0f f2 10 9d ee |d.....|
7070
>>> Flow 4 (server to client)
7171
00000000 14 03 03 00 01 01 16 03 03 00 40 00 00 00 00 00 |..........@.....|
72-
00000010 00 00 00 00 00 00 00 00 00 00 00 6d 31 fe 01 3d |...........m1..=|
73-
00000020 2a c3 97 67 9f 08 f8 c9 ce 57 5c 4a e6 da 17 f2 |*..g.....W\J....|
74-
00000030 f8 47 2b d9 9d 7e af 59 b8 a9 23 9d 7e d5 ed 77 |.G+..~.Y..#.~..w|
75-
00000040 3b cd d4 b7 76 5b 6f 6d 09 bd 0c 17 03 03 00 40 |;...v[om.......@|
72+
00000010 00 00 00 00 00 00 00 00 00 00 00 f2 12 bf 38 31 |..............81|
73+
00000020 ee c9 9a 6a 8d fb 1c 53 41 f1 06 3a 44 9c 31 31 |...j...SA..:D.11|
74+
00000030 25 7b 28 08 f5 3a 85 84 f1 83 61 9b 8c e3 cf 79 |%{(..:....a....y|
75+
00000040 3a c2 ce e2 9c b8 52 ca 4f 5c b1 17 03 03 00 40 |:.....R.O\.....@|
7676
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
77-
00000060 d2 8c 47 46 36 47 fa d8 f8 1c b4 fc f6 fd fb 4b |..GF6G.........K|
78-
00000070 79 e1 a3 39 df ac 6c 94 61 dd 20 1a e7 c0 4c 9c |y..9..l.a. ...L.|
79-
00000080 45 69 69 cf 73 cb b1 6c fc 71 49 de 41 ca 4d 4f |Eii.s..l.qI.A.MO|
77+
00000060 56 57 a0 ee c3 3e 4a 13 70 d5 05 2a 7d ed 49 81 |VW...>J.p..*}.I.|
78+
00000070 52 37 e0 dc bd d0 e3 de f8 8e 18 a2 8b f8 62 71 |R7............bq|
79+
00000080 7f a9 35 50 91 81 6f 33 63 e3 c5 ec cf fa 1b 05 |..5P..o3c.......|
8080
00000090 15 03 03 00 30 00 00 00 00 00 00 00 00 00 00 00 |....0...........|
81-
000000a0 00 00 00 00 00 d1 66 64 ce 59 eb 23 13 e9 92 28 |......fd.Y.#...(|
82-
000000b0 a4 2a 7a b0 e1 79 ce 92 34 77 6e b3 8d d3 bb e6 |.*z..y..4wn.....|
83-
000000c0 ad 90 e8 a2 1a |.....|
81+
000000a0 00 00 00 00 00 e5 05 33 38 e8 33 35 a3 f0 aa f8 |.......38.35....|
82+
000000b0 8c b7 c5 2b 8c d0 9e 40 57 c5 c9 52 61 ae 5e c7 |.[email protected].^.|
83+
000000c0 50 f1 5a 28 50 |P.Z(P|

0 commit comments

Comments
 (0)