update master-with-bazel from master branch
This commit is contained in:
BoringSSL Robot
@@ -1,22 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDtTCCAp2gAwIBAgIJALW2IrlaBKUhMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
|
||||
BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
|
||||
aWRnaXRzIFB0eSBMdGQwHhcNMTYwNzA5MDQzODA5WhcNMTYwODA4MDQzODA5WjBF
|
||||
MQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50
|
||||
ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
|
||||
CgKCAQEAugvahBkSAUF1fC49vb1bvlPrcl80kop1iLpiuYoz4Qptwy57+EWssZBc
|
||||
HprZ5BkWf6PeGZ7F5AX1PyJbGHZLqvMCvViP6pd4MFox/igESISEHEixoiXCzepB
|
||||
rhtp5UQSjHD4D4hKtgdMgVxX+LRtwgW3mnu/vBu7rzpr/DS8io99p3lqZ1Aky+aN
|
||||
lcMj6MYy8U+YFEevb/V0lRY9oqwmW7BHnXikm/vi6sjIS350U8zb/mRzYeIs2R65
|
||||
LUduTL50+UMgat9ocewI2dv8aO9Dph+8NdGtg8LFYyTTHcUxJoMr1PTOgnmET19W
|
||||
JH4PrFwk7ZE1QJQQ1L4iKmPeQistuQIDAQABo4GnMIGkMB0GA1UdDgQWBBT5m6Vv
|
||||
zYjVYHG30iBE+j2XDhUE8jB1BgNVHSMEbjBsgBT5m6VvzYjVYHG30iBE+j2XDhUE
|
||||
8qFJpEcwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNV
|
||||
BAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZIIJALW2IrlaBKUhMAwGA1UdEwQF
|
||||
MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAD7Jg68SArYWlcoHfZAB90Pmyrt5H6D8
|
||||
LRi+W2Ri1fBNxREELnezWJ2scjl4UMcsKYp4Pi950gVN+62IgrImcCNvtb5I1Cfy
|
||||
/MNNur9ffas6X334D0hYVIQTePyFk3umI+2mJQrtZZyMPIKSY/sYGQHhGGX6wGK+
|
||||
GO/og0PQk/Vu6D+GU2XRnDV0YZg1lsAsHd21XryK6fDmNkEMwbIWrts4xc7scRrG
|
||||
HWy+iMf6/7p/Ak/SIicM4XSwmlQ8pPxAZPr+E2LoVd9pMpWUwpW2UbtO5wsGTrY5
|
||||
sO45tFNN/y+jtUheB1C2ijObG/tXELaiyCdM+S/waeuv0MXtI4xnn1A=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1,5 +1,5 @@
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIPwxu50c7LEhVNRYJFRWBUnoaz7JSos96T5hBp4rjyptoAoGCCqGSM49
|
||||
AwEHoUQDQgAEzFSVTE5guxJRQ0VbZ8dicPs5e/DT7xpW7Yc9hq0VOchv7cbXuI/T
|
||||
CwadDjGWX/oaz0ftFqrVmfkwZu+C58ioWg==
|
||||
-----END EC PRIVATE KEY-----
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg/DG7nRzssSFU1Fgk
|
||||
VFYFSehrPslKiz3pPmEGniuPKm2hRANCAATMVJVMTmC7ElFDRVtnx2Jw+zl78NPv
|
||||
Glbthz2GrRU5yG/txte4j9MLBp0OMZZf+hrPR+0WqtWZ+TBm74LnyKha
|
||||
-----END PRIVATE KEY-----
|
||||
|
||||
@@ -28,8 +28,8 @@ type keyAgreement interface {
|
||||
// In the case that the key agreement protocol doesn't use a
|
||||
// ServerKeyExchange message, generateServerKeyExchange can return nil,
|
||||
// nil.
|
||||
generateServerKeyExchange(*Config, *Certificate, *clientHelloMsg, *serverHelloMsg, uint16) (*serverKeyExchangeMsg, error)
|
||||
processClientKeyExchange(*Config, *Certificate, *clientKeyExchangeMsg, uint16) ([]byte, error)
|
||||
generateServerKeyExchange(*Config, *CertificateChain, *clientHelloMsg, *serverHelloMsg, uint16) (*serverKeyExchangeMsg, error)
|
||||
processClientKeyExchange(*Config, *CertificateChain, *clientKeyExchangeMsg, uint16) ([]byte, error)
|
||||
|
||||
// On the client side, the next two methods are called in order.
|
||||
|
||||
|
||||
+121
-22
@@ -10,9 +10,12 @@ import (
|
||||
"crypto/ecdsa"
|
||||
"crypto/rand"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/pem"
|
||||
"fmt"
|
||||
"io"
|
||||
"math/big"
|
||||
"os"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
@@ -439,18 +442,18 @@ type Config struct {
|
||||
// If Time is nil, TLS uses time.Now.
|
||||
Time func() time.Time
|
||||
|
||||
// Certificates contains one or more certificate chains
|
||||
// Chains contains one or more certificate chains
|
||||
// to present to the other side of the connection.
|
||||
// Server configurations must include at least one certificate.
|
||||
Certificates []Certificate
|
||||
Chains []CertificateChain
|
||||
|
||||
// NameToCertificate maps from a certificate name to an element of
|
||||
// Certificates. Note that a certificate name can be of the form
|
||||
// NameToChain maps from a certificate name to an element of
|
||||
// Chains. Note that a certificate name can be of the form
|
||||
// '*.example.com' and so doesn't have to be a domain name as such.
|
||||
// See Config.BuildNameToCertificate
|
||||
// The nil value causes the first element of Certificates to be used
|
||||
// The nil value causes the first element of Chains to be used
|
||||
// for all connections.
|
||||
NameToCertificate map[string]*Certificate
|
||||
NameToChain map[string]*CertificateChain
|
||||
|
||||
// RootCAs defines the set of root certificate authorities
|
||||
// that clients use when verifying server certificates.
|
||||
@@ -1844,7 +1847,7 @@ type ProtocolBugs struct {
|
||||
|
||||
// RenegotiationCertificate, if not nil, is the certificate to use on
|
||||
// renegotiation handshakes.
|
||||
RenegotiationCertificate *Certificate
|
||||
RenegotiationCertificate *CertificateChain
|
||||
|
||||
// ExpectNoCertificateAuthoritiesExtension, if true, causes the client to
|
||||
// reject CertificateRequest with the CertificateAuthorities extension.
|
||||
@@ -2132,12 +2135,12 @@ func (c *Config) supportedVersions(isDTLS, requireTLS13 bool) []uint16 {
|
||||
}
|
||||
|
||||
// getCertificateForName returns the best certificate for the given name,
|
||||
// defaulting to the first element of c.Certificates if there are no good
|
||||
// defaulting to the first element of c.Chains if there are no good
|
||||
// options.
|
||||
func (c *Config) getCertificateForName(name string) *Certificate {
|
||||
if len(c.Certificates) == 1 || c.NameToCertificate == nil {
|
||||
func (c *Config) getCertificateForName(name string) *CertificateChain {
|
||||
if len(c.Chains) == 1 || c.NameToChain == nil {
|
||||
// There's only one choice, so no point doing any work.
|
||||
return &c.Certificates[0]
|
||||
return &c.Chains[0]
|
||||
}
|
||||
|
||||
name = strings.ToLower(name)
|
||||
@@ -2145,7 +2148,7 @@ func (c *Config) getCertificateForName(name string) *Certificate {
|
||||
name = name[:len(name)-1]
|
||||
}
|
||||
|
||||
if cert, ok := c.NameToCertificate[name]; ok {
|
||||
if cert, ok := c.NameToChain[name]; ok {
|
||||
return cert
|
||||
}
|
||||
|
||||
@@ -2155,13 +2158,13 @@ func (c *Config) getCertificateForName(name string) *Certificate {
|
||||
for i := range labels {
|
||||
labels[i] = "*"
|
||||
candidate := strings.Join(labels, ".")
|
||||
if cert, ok := c.NameToCertificate[candidate]; ok {
|
||||
if cert, ok := c.NameToChain[candidate]; ok {
|
||||
return cert
|
||||
}
|
||||
}
|
||||
|
||||
// If nothing matches, return the first certificate.
|
||||
return &c.Certificates[0]
|
||||
return &c.Chains[0]
|
||||
}
|
||||
|
||||
func (c *Config) signSignatureAlgorithms() []signatureAlgorithm {
|
||||
@@ -2178,28 +2181,28 @@ func (c *Config) verifySignatureAlgorithms() []signatureAlgorithm {
|
||||
return supportedSignatureAlgorithms
|
||||
}
|
||||
|
||||
// BuildNameToCertificate parses c.Certificates and builds c.NameToCertificate
|
||||
// BuildNameToCertificate parses c.Chains and builds c.NameToCertificate
|
||||
// from the CommonName and SubjectAlternateName fields of each of the leaf
|
||||
// certificates.
|
||||
func (c *Config) BuildNameToCertificate() {
|
||||
c.NameToCertificate = make(map[string]*Certificate)
|
||||
for i := range c.Certificates {
|
||||
cert := &c.Certificates[i]
|
||||
c.NameToChain = make(map[string]*CertificateChain)
|
||||
for i := range c.Chains {
|
||||
cert := &c.Chains[i]
|
||||
x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
if len(x509Cert.Subject.CommonName) > 0 {
|
||||
c.NameToCertificate[x509Cert.Subject.CommonName] = cert
|
||||
c.NameToChain[x509Cert.Subject.CommonName] = cert
|
||||
}
|
||||
for _, san := range x509Cert.DNSNames {
|
||||
c.NameToCertificate[san] = cert
|
||||
c.NameToChain[san] = cert
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// A Certificate is a chain of one or more certificates, leaf first.
|
||||
type Certificate struct {
|
||||
// A CertificateChain is a chain of one or more certificates, leaf first.
|
||||
type CertificateChain struct {
|
||||
Certificate [][]byte
|
||||
PrivateKey crypto.PrivateKey // supported types: *rsa.PrivateKey, *ecdsa.PrivateKey
|
||||
// OCSPStaple contains an optional OCSP response which will be served
|
||||
@@ -2214,6 +2217,15 @@ type Certificate struct {
|
||||
// processing for TLS clients doing client authentication. If nil, the
|
||||
// leaf certificate will be parsed as needed.
|
||||
Leaf *x509.Certificate
|
||||
// ChainPath is the path to the temporary on disk copy of the certificate
|
||||
// chain.
|
||||
ChainPath string
|
||||
// KeyPath is the path to the temporary on disk copy of the key.
|
||||
KeyPath string
|
||||
// RootPath is the path to the temporary on disk copy of the root of the
|
||||
// certificate chain. If the chain only contains one certificate ChainPath
|
||||
// and RootPath will be the same.
|
||||
RootPath string
|
||||
}
|
||||
|
||||
// A TLS record.
|
||||
@@ -2425,3 +2437,90 @@ func isAllZero(v []byte) bool {
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
var baseCertTemplate = &x509.Certificate{
|
||||
SerialNumber: big.NewInt(57005),
|
||||
Subject: pkix.Name{
|
||||
CommonName: "test cert",
|
||||
Country: []string{"US"},
|
||||
Province: []string{"Some-State"},
|
||||
Organization: []string{"Internet Widgits Pty Ltd"},
|
||||
},
|
||||
NotBefore: time.Now().Add(-time.Hour),
|
||||
NotAfter: time.Now().Add(time.Hour),
|
||||
DNSNames: []string{"test"},
|
||||
IsCA: true,
|
||||
BasicConstraintsValid: true,
|
||||
}
|
||||
|
||||
var tmpDir string
|
||||
|
||||
func generateSingleCertChain(template *x509.Certificate, key crypto.Signer, ocspStaple, sctList []byte) CertificateChain {
|
||||
cert := generateTestCert(template, nil, key, ocspStaple, sctList)
|
||||
tmpCertPath, tmpKeyPath := writeTempCertFile([]*x509.Certificate{cert}), writeTempKeyFile(key)
|
||||
return CertificateChain{
|
||||
Certificate: [][]byte{cert.Raw},
|
||||
PrivateKey: key,
|
||||
OCSPStaple: ocspStaple,
|
||||
SignedCertificateTimestampList: sctList,
|
||||
Leaf: cert,
|
||||
ChainPath: tmpCertPath,
|
||||
KeyPath: tmpKeyPath,
|
||||
RootPath: tmpCertPath,
|
||||
}
|
||||
}
|
||||
|
||||
func writeTempCertFile(certs []*x509.Certificate) string {
|
||||
f, err := os.CreateTemp(tmpDir, "test-cert")
|
||||
if err != nil {
|
||||
panic(fmt.Sprintf("failed to create temp file: %s", err))
|
||||
}
|
||||
for _, cert := range certs {
|
||||
if _, err := f.Write(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})); err != nil {
|
||||
panic(fmt.Sprintf("failed to write test certificate: %s", err))
|
||||
}
|
||||
}
|
||||
tmpCertPath := f.Name()
|
||||
if err := f.Close(); err != nil {
|
||||
panic(fmt.Sprintf("failed to close test certificate temp file: %s", err))
|
||||
}
|
||||
return tmpCertPath
|
||||
}
|
||||
|
||||
func writeTempKeyFile(privKey crypto.Signer) string {
|
||||
f, err := os.CreateTemp(tmpDir, "test-key")
|
||||
if err != nil {
|
||||
panic(fmt.Sprintf("failed to create temp file: %s", err))
|
||||
}
|
||||
keyDER, err := x509.MarshalPKCS8PrivateKey(privKey)
|
||||
if err != nil {
|
||||
panic(fmt.Sprintf("failed to marshal test key: %s", err))
|
||||
}
|
||||
if _, err := f.Write(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: keyDER})); err != nil {
|
||||
panic(fmt.Sprintf("failed to write test key: %s", err))
|
||||
}
|
||||
tmpKeyPath := f.Name()
|
||||
if err := f.Close(); err != nil {
|
||||
panic(fmt.Sprintf("failed to close test key temp file: %s", err))
|
||||
}
|
||||
return tmpKeyPath
|
||||
}
|
||||
|
||||
func generateTestCert(template, issuer *x509.Certificate, key crypto.Signer, ocspStaple, sctList []byte) *x509.Certificate {
|
||||
if template == nil {
|
||||
template = baseCertTemplate
|
||||
}
|
||||
if issuer == nil {
|
||||
issuer = template
|
||||
}
|
||||
der, err := x509.CreateCertificate(rand.Reader, template, issuer, key.Public(), key)
|
||||
if err != nil {
|
||||
panic(fmt.Sprintf("failed to create test certificate: %s", err))
|
||||
}
|
||||
cert, err := x509.ParseCertificate(der)
|
||||
if err != nil {
|
||||
panic(fmt.Sprintf("failed to parse test certificate: %s", err))
|
||||
}
|
||||
|
||||
return cert
|
||||
}
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIBvjCCAWygAwIBAgIJAPlkrPTq4HgnMAoGCCqGSM49BAMCMEUxCzAJBgNVBAYT
|
||||
AkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRn
|
||||
aXRzIFB0eSBMdGQwHhcNMTcwMjI3MjAxOTIzWhcNMTkwMjI3MjAxOTIzWjBFMQsw
|
||||
CQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJu
|
||||
ZXQgV2lkZ2l0cyBQdHkgTHRkME4wEAYHKoZIzj0CAQYFK4EEACEDOgAE6dul6dL0
|
||||
+CyooFiKK4V+EYNYPbMZoLTxRcjRgrw3db6QzBAviDSxKADTVuyRmaVC74Mf6boB
|
||||
HDmjUDBOMB0GA1UdDgQWBBSMtlkUJ7SCZ4zRqkjXMWvOebSgpTAfBgNVHSMEGDAW
|
||||
gBSMtlkUJ7SCZ4zRqkjXMWvOebSgpTAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMC
|
||||
A0AAMD0CHHolWPktSLbVMy9ukQUb2E7+Jb3hcNFqAXh47pYCHQC+jv2EE6oOEZ9F
|
||||
tLkFLtap71+83P0NUEJX4Etu
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1,12 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIBzzCCAXagAwIBAgIJANlMBNpJfb/rMAkGByqGSM49BAEwRTELMAkGA1UEBhMC
|
||||
QVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdp
|
||||
dHMgUHR5IEx0ZDAeFw0xNDA0MjMyMzIxNTdaFw0xNDA1MjMyMzIxNTdaMEUxCzAJ
|
||||
BgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5l
|
||||
dCBXaWRnaXRzIFB0eSBMdGQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATmK2ni
|
||||
v2Wfl74vHg2UikzVl2u3qR4NRvvdqakendy6WgHn1peoChj5w8SjHlbifINI2xYa
|
||||
HPUdfvGULUvPciLBo1AwTjAdBgNVHQ4EFgQUq4TSrKuV8IJOFngHVVdf5CaNgtEw
|
||||
HwYDVR0jBBgwFoAUq4TSrKuV8IJOFngHVVdf5CaNgtEwDAYDVR0TBAUwAwEB/zAJ
|
||||
BgcqhkjOPQQBA0gAMEUCIQDyoDVeUTo2w4J5m+4nUIWOcAZ0lVfSKXQA9L4Vh13E
|
||||
BwIgfB55FGohg/B6dGh5XxSZmmi08cueFV7mHzJSYV51yRQ=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1,15 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICZTCCAeugAwIBAgIJAN+/LubpDwxNMAkGByqGSM49BAEwRTELMAkGA1UEBhMC
|
||||
QVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdp
|
||||
dHMgUHR5IEx0ZDAeFw0xNjA3MDkwMDAxMzJaFw0xNjA4MDgwMDAxMzJaMEUxCzAJ
|
||||
BgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5l
|
||||
dCBXaWRnaXRzIFB0eSBMdGQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQOdTJNqxiZ
|
||||
+B68tCZV4GEJwDJ18jK9gFzvefcEAQluBijjrMjflL+RZAT64ExWzedRMp9PD9CW
|
||||
Tz9hG/Kz4q/l952YsIhy7LTGXzwy7549WUOi+N3aW8psDjtwzWNZXqWjgacwgaQw
|
||||
HQYDVR0OBBYEFKmYPjADcOlogOMU6D9wlftIWMj6MHUGA1UdIwRuMGyAFKmYPjAD
|
||||
cOlogOMU6D9wlftIWMj6oUmkRzBFMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29t
|
||||
ZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkggkA378u
|
||||
5ukPDE0wDAYDVR0TBAUwAwEB/zAJBgcqhkjOPQQBA2kAMGYCMQDTfL0OkRGnS5Ze
|
||||
tsxagAuZqM2Zyv5a2g7u6eFLCx2rpTuQndWOtEnmVo3wjTDtkDcCMQCg+05XSqEF
|
||||
cqxdXMZJMhqj2jS+tWucdgDstp/1KzJkbsupSjBzIycjVBKLdRwtNg8=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1,17 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICrzCCAhGgAwIBAgIJAMZT7oSqTg/lMAkGByqGSM49BAEwRTELMAkGA1UEBhMC
|
||||
QVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdp
|
||||
dHMgUHR5IEx0ZDAeFw0xNjA3MDkwMDAwNTBaFw0xNjA4MDgwMDAwNTBaMEUxCzAJ
|
||||
BgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5l
|
||||
dCBXaWRnaXRzIFB0eSBMdGQwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABAFD0TiZ
|
||||
InCoCYDI66FvoaZ0tniUhaNk2YnjEPikfmYHDwstbqkTEqnGAq3pKF2y/MHTBXFd
|
||||
E0KcFOPs5Ju8EgIcqwGvCkwHPmZtvvOrf+nJNHdm1gZfBUy09f3fVe/mHwfM2++H
|
||||
dz54nHKxtQqvdafhmMV77R/rBuI24MLKbMihxRgQKaOBpzCBpDAdBgNVHQ4EFgQU
|
||||
mLWm6ZtGfvih6iFx0+duYfHjGsYwdQYDVR0jBG4wbIAUmLWm6ZtGfvih6iFx0+du
|
||||
YfHjGsahSaRHMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEw
|
||||
HwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGSCCQDGU+6Eqk4P5TAMBgNV
|
||||
HRMEBTADAQH/MAkGByqGSM49BAEDgYwAMIGIAkIBL/oEXMMQH9fefVd8onvgQbWI
|
||||
/CJXYE+kLO15gO8satasGutVpXtYGeP8gZeuHrq+jWxzj7dGM7YzkW0pAu+wOAkC
|
||||
QgFJSvKFcmbreLIjuwYik5aXeaUnTCvTQumG07cF0hZRgCf/kTxxmu2ffRoGCDTz
|
||||
XoPqlxwaO7K+gaAS//CvR0E3lw==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1,11 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIBkTCCAUOgAwIBAgIJAJwooam0UCDmMAUGAytlcDBFMQswCQYDVQQGEwJBVTET
|
||||
MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQ
|
||||
dHkgTHRkMB4XDTE0MDQyMzIzMjE1N1oXDTE0MDUyMzIzMjE1N1owRTELMAkGA1UE
|
||||
BhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdp
|
||||
ZGdpdHMgUHR5IEx0ZDAqMAUGAytlcAMhANdamAGCsQq31Uv+08lkBzoO4XLz2qYj
|
||||
Ja8CGmj3B1Eao1AwTjAdBgNVHQ4EFgQUoux7eV+fJK2v3ah6QPU/lj1/+7UwHwYD
|
||||
VR0jBBgwFoAUoux7eV+fJK2v3ah6QPU/lj1/+7UwDAYDVR0TBAUwAwEB/zAFBgMr
|
||||
ZXADQQBuCzqji8VP9xU8mHEMjXGChX7YP5J664UyVKHKH9Z1u4wEbB8dJ3ScaWSL
|
||||
r+VHVKUhsrvcdCelnXRrrSD7xWAL
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1183,7 +1183,7 @@ func (hs *clientHandshakeState) doTLS13Handshake(msg any) error {
|
||||
return err
|
||||
}
|
||||
|
||||
var chainToSend *Certificate
|
||||
var chainToSend *CertificateChain
|
||||
var certReq *certificateRequestMsg
|
||||
if c.didResume {
|
||||
// Copy over authentication from the session.
|
||||
@@ -1691,7 +1691,7 @@ func (hs *clientHandshakeState) doFullHandshake() error {
|
||||
}
|
||||
}
|
||||
|
||||
var chainToSend *Certificate
|
||||
var chainToSend *CertificateChain
|
||||
var certRequested bool
|
||||
certReq, ok := msg.(*certificateRequestMsg)
|
||||
if ok {
|
||||
@@ -1769,7 +1769,7 @@ func (hs *clientHandshakeState) doFullHandshake() error {
|
||||
}
|
||||
|
||||
// Determine the hash to sign.
|
||||
privKey := c.config.Certificates[0].PrivateKey
|
||||
privKey := c.config.Chains[0].PrivateKey
|
||||
|
||||
if certVerify.hasSignatureAlgorithm {
|
||||
certVerify.signatureAlgorithm, err = selectSignatureAlgorithm(c.vers, privKey, c.config, certReq.signatureAlgorithms)
|
||||
@@ -2403,18 +2403,18 @@ func (hs *clientHandshakeState) writeServerHash(msg []byte) {
|
||||
// selectClientCertificate selects a certificate for use with the given
|
||||
// certificate, or none if none match. It may return a particular certificate or
|
||||
// nil on success, or an error on internal error.
|
||||
func selectClientCertificate(c *Conn, certReq *certificateRequestMsg) (*Certificate, error) {
|
||||
if len(c.config.Certificates) == 0 {
|
||||
func selectClientCertificate(c *Conn, certReq *certificateRequestMsg) (*CertificateChain, error) {
|
||||
if len(c.config.Chains) == 0 {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
// The test is assumed to have configured the certificate it meant to
|
||||
// send.
|
||||
if len(c.config.Certificates) > 1 {
|
||||
if len(c.config.Chains) > 1 {
|
||||
return nil, errors.New("tls: multiple certificates configured")
|
||||
}
|
||||
|
||||
return &c.config.Certificates[0], nil
|
||||
return &c.config.Chains[0], nil
|
||||
}
|
||||
|
||||
// clientSessionCacheKey returns a key used to cache sessionTickets that could
|
||||
|
||||
@@ -36,7 +36,7 @@ type serverHandshakeState struct {
|
||||
finishedHash finishedHash
|
||||
masterSecret []byte
|
||||
certsFromClient [][]byte
|
||||
cert *Certificate
|
||||
cert *CertificateChain
|
||||
finishedBytes []byte
|
||||
echHPKEContext *hpke.Context
|
||||
echConfigID uint8
|
||||
@@ -1587,11 +1587,11 @@ func (hs *serverHandshakeState) processClientExtensions(serverExtensions *server
|
||||
if len(hs.clientHello.serverName) > 0 {
|
||||
c.serverName = hs.clientHello.serverName
|
||||
}
|
||||
if len(config.Certificates) == 0 {
|
||||
if len(config.Chains) == 0 {
|
||||
c.sendAlert(alertInternalError)
|
||||
return errors.New("tls: no certificates configured")
|
||||
}
|
||||
hs.cert = &config.Certificates[0]
|
||||
hs.cert = &config.Chains[0]
|
||||
if len(hs.clientHello.serverName) > 0 {
|
||||
hs.cert = config.getCertificateForName(hs.clientHello.serverName)
|
||||
}
|
||||
|
||||
@@ -39,7 +39,7 @@ type rsaKeyAgreement struct {
|
||||
exportKey *rsa.PrivateKey
|
||||
}
|
||||
|
||||
func (ka *rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, version uint16) (*serverKeyExchangeMsg, error) {
|
||||
func (ka *rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *CertificateChain, clientHello *clientHelloMsg, hello *serverHelloMsg, version uint16) (*serverKeyExchangeMsg, error) {
|
||||
// Save the client version for comparison later.
|
||||
ka.clientVersion = clientHello.vers
|
||||
|
||||
@@ -96,7 +96,7 @@ func (ka *rsaKeyAgreement) generateServerKeyExchange(config *Config, cert *Certi
|
||||
return skx, nil
|
||||
}
|
||||
|
||||
func (ka *rsaKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
|
||||
func (ka *rsaKeyAgreement) processClientKeyExchange(config *Config, cert *CertificateChain, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
|
||||
preMasterSecret := make([]byte, 48)
|
||||
_, err := io.ReadFull(config.rand(), preMasterSecret[2:])
|
||||
if err != nil {
|
||||
@@ -453,7 +453,7 @@ func kemForCurveID(id CurveID, config *Config) (kemImplementation, bool) {
|
||||
// keyAgreementAuthentication is a helper interface that specifies how
|
||||
// to authenticate the ServerKeyExchange parameters.
|
||||
type keyAgreementAuthentication interface {
|
||||
signParameters(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error)
|
||||
signParameters(config *Config, cert *CertificateChain, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error)
|
||||
verifyParameters(config *Config, clientHello *clientHelloMsg, serverHello *serverHelloMsg, key crypto.PublicKey, params []byte, sig []byte) error
|
||||
}
|
||||
|
||||
@@ -461,7 +461,7 @@ type keyAgreementAuthentication interface {
|
||||
// agreement parameters.
|
||||
type nilKeyAgreementAuthentication struct{}
|
||||
|
||||
func (ka *nilKeyAgreementAuthentication) signParameters(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error) {
|
||||
func (ka *nilKeyAgreementAuthentication) signParameters(config *Config, cert *CertificateChain, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error) {
|
||||
skx := new(serverKeyExchangeMsg)
|
||||
skx.key = params
|
||||
return skx, nil
|
||||
@@ -479,7 +479,7 @@ type signedKeyAgreement struct {
|
||||
peerSignatureAlgorithm signatureAlgorithm
|
||||
}
|
||||
|
||||
func (ka *signedKeyAgreement) signParameters(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error) {
|
||||
func (ka *signedKeyAgreement) signParameters(config *Config, cert *CertificateChain, clientHello *clientHelloMsg, hello *serverHelloMsg, params []byte) (*serverKeyExchangeMsg, error) {
|
||||
// The message to be signed is prepended by the randoms.
|
||||
var msg []byte
|
||||
msg = append(msg, clientHello.random...)
|
||||
@@ -585,7 +585,7 @@ type ecdheKeyAgreement struct {
|
||||
peerKey []byte
|
||||
}
|
||||
|
||||
func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, version uint16) (*serverKeyExchangeMsg, error) {
|
||||
func (ka *ecdheKeyAgreement) generateServerKeyExchange(config *Config, cert *CertificateChain, clientHello *clientHelloMsg, hello *serverHelloMsg, version uint16) (*serverKeyExchangeMsg, error) {
|
||||
var curveid CurveID
|
||||
preferredCurves := config.curvePreferences()
|
||||
|
||||
@@ -636,7 +636,7 @@ NextCandidate:
|
||||
return ka.auth.signParameters(config, cert, clientHello, hello, serverECDHParams)
|
||||
}
|
||||
|
||||
func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
|
||||
func (ka *ecdheKeyAgreement) processClientKeyExchange(config *Config, cert *CertificateChain, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
|
||||
if len(ckx.ciphertext) == 0 || int(ckx.ciphertext[0]) != len(ckx.ciphertext)-1 {
|
||||
return nil, errClientKeyExchange
|
||||
}
|
||||
@@ -703,11 +703,11 @@ func (ka *ecdheKeyAgreement) peerSignatureAlgorithm() signatureAlgorithm {
|
||||
// exchange.
|
||||
type nilKeyAgreement struct{}
|
||||
|
||||
func (ka *nilKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, version uint16) (*serverKeyExchangeMsg, error) {
|
||||
func (ka *nilKeyAgreement) generateServerKeyExchange(config *Config, cert *CertificateChain, clientHello *clientHelloMsg, hello *serverHelloMsg, version uint16) (*serverKeyExchangeMsg, error) {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
func (ka *nilKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
|
||||
func (ka *nilKeyAgreement) processClientKeyExchange(config *Config, cert *CertificateChain, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
|
||||
if len(ckx.ciphertext) != 0 {
|
||||
return nil, errClientKeyExchange
|
||||
}
|
||||
@@ -755,7 +755,7 @@ type pskKeyAgreement struct {
|
||||
identityHint string
|
||||
}
|
||||
|
||||
func (ka *pskKeyAgreement) generateServerKeyExchange(config *Config, cert *Certificate, clientHello *clientHelloMsg, hello *serverHelloMsg, version uint16) (*serverKeyExchangeMsg, error) {
|
||||
func (ka *pskKeyAgreement) generateServerKeyExchange(config *Config, cert *CertificateChain, clientHello *clientHelloMsg, hello *serverHelloMsg, version uint16) (*serverKeyExchangeMsg, error) {
|
||||
// Assemble the identity hint.
|
||||
bytes := make([]byte, 2+len(config.PreSharedKeyIdentity))
|
||||
bytes[0] = byte(len(config.PreSharedKeyIdentity) >> 8)
|
||||
@@ -782,7 +782,7 @@ func (ka *pskKeyAgreement) generateServerKeyExchange(config *Config, cert *Certi
|
||||
return skx, nil
|
||||
}
|
||||
|
||||
func (ka *pskKeyAgreement) processClientKeyExchange(config *Config, cert *Certificate, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
|
||||
func (ka *pskKeyAgreement) processClientKeyExchange(config *Config, cert *CertificateChain, ckx *clientKeyExchangeMsg, version uint16) ([]byte, error) {
|
||||
// First, process the PSK identity.
|
||||
if len(ckx.ciphertext) < 2 {
|
||||
return nil, errClientKeyExchange
|
||||
|
||||
@@ -1,15 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICWDCCAcGgAwIBAgIJAPuwTC6rEJsMMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
|
||||
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
|
||||
aWRnaXRzIFB0eSBMdGQwHhcNMTQwNDIzMjA1MDQwWhcNMTcwNDIyMjA1MDQwWjBF
|
||||
MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
|
||||
ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
|
||||
gQDYK8imMuRi/03z0K1Zi0WnvfFHvwlYeyK9Na6XJYaUoIDAtB92kWdGMdAQhLci
|
||||
HnAjkXLI6W15OoV3gA/ElRZ1xUpxTMhjP6PyY5wqT5r6y8FxbiiFKKAnHmUcrgfV
|
||||
W28tQ+0rkLGMryRtrukXOgXBv7gcrmU7G1jC2a7WqmeI8QIDAQABo1AwTjAdBgNV
|
||||
HQ4EFgQUi3XVrMsIvg4fZbf6Vr5sp3Xaha8wHwYDVR0jBBgwFoAUi3XVrMsIvg4f
|
||||
Zbf6Vr5sp3Xaha8wDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQA76Hht
|
||||
ldY9avcTGSwbwoiuIqv0jTL1fHFnzy3RHMLDh+Lpvolc5DSrSJHCP5WuK0eeJXhr
|
||||
T5oQpHL9z/cCDLAKCKRa4uV0fhEdOWBqyR9p8y5jJtye72t6CuFUV5iqcpF4BH4f
|
||||
j2VNHwsSrJwkD4QUGlUtH7vwnQmyCFxZMmWAJg==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1,35 +0,0 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIC0jCCAbqgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwDzENMAsGA1UEAwwEQiBD
|
||||
QTAeFw0xNjAyMjgyMDI3MDNaFw0yNjAyMjUyMDI3MDNaMBgxFjAUBgNVBAMMDUNs
|
||||
aWVudCBDZXJ0IEEwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDRvaz8
|
||||
CC/cshpCafJo4jLkHEoBqDLhdgFelJoAiQUyIqyWl2O7YHPnpJH+TgR7oelzNzt/
|
||||
kLRcH89M/TszB6zqyLTC4aqmvzKL0peD/jL2LWBucR0WXIvjA3zoRuF/x86+rYH3
|
||||
tHb+xs2PSs8EGL/Ev+ss+qTzTGEn26fuGNHkNw6tOwPpc+o8+wUtzf/kAthamo+c
|
||||
IDs2rQ+lP7+aLZTLeU/q4gcLutlzcK5imex5xy2jPkweq48kijK0kIzl1cPlA5d1
|
||||
z7C8jU50Pj9X9sQDJTN32j7UYRisJeeYQF8GaaN8SbrDI6zHgKzrRLyxDt/KQa9V
|
||||
iLeXANgZi+Xx9KgfAgMBAAGjLzAtMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYI
|
||||
KwYBBQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQBFEVbmYl+2RtNw
|
||||
rDftRDF1v2QUbcN2ouSnQDHxeDQdSgasLzT3ui8iYu0Rw2WWcZ0DV5e0ztGPhWq7
|
||||
AO0B120aFRMOY+4+bzu9Q2FFkQqc7/fKTvTDzIJI5wrMnFvUfzzvxh3OHWMYSs/w
|
||||
giq33hTKeHEq6Jyk3btCny0Ycecyc3yGXH10sizUfiHlhviCkDuESk8mFDwDDzqW
|
||||
ZF0IipzFbEDHoIxLlm3GQxpiLoEV4k8KYJp3R5KBLFyxM6UGPz8h72mIPCJp2RuK
|
||||
MYgF91UDvVzvnYm6TfseM2+ewKirC00GOrZ7rEcFvtxnKSqYf4ckqfNdSU1Y+RRC
|
||||
1ngWZ7Ih
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICwjCCAaqgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwFDESMBAGA1UEAwwJQyBS
|
||||
b290IENBMB4XDTE2MDIyODIwMjcwM1oXDTI2MDIyNTIwMjcwM1owDzENMAsGA1UE
|
||||
AwwEQiBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALsSCYmDip2D
|
||||
GkjFxw7ykz26JSjELkl6ArlYjFJ3aT/SCh8qbS4gln7RH8CPBd78oFdfhIKQrwtZ
|
||||
3/q21ykD9BAS3qHe2YdcJfm8/kWAy5DvXk6NXU4qX334KofBAEpgdA/igEFq1P1l
|
||||
HAuIfZCpMRfT+i5WohVsGi8f/NgpRvVaMONLNfgw57mz1lbtFeBEISmX0kbsuJxF
|
||||
Qj/Bwhi5/0HAEXG8e7zN4cEx0yPRvmOATRdVb/8dW2pwOHRJq9R5M0NUkIsTSnL7
|
||||
6N/z8hRAHMsV3IudC5Yd7GXW1AGu9a+iKU+Q4xcZCoj0DC99tL4VKujrV1kAeqsM
|
||||
cz5/dKzi6+cCAwEAAaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
|
||||
AQYwDQYJKoZIhvcNAQELBQADggEBAIIeZiEeNhWWQ8Y4D+AGDwqUUeG8NjCbKrXQ
|
||||
BlHg5wZ8xftFaiP1Dp/UAezmx2LNazdmuwrYB8lm3FVTyaPDTKEGIPS4wJKHgqH1
|
||||
QPDhqNm85ey7TEtI9oYjsNim/Rb+iGkIAMXaxt58SzxbjvP0kMr1JfJIZbic9vye
|
||||
NwIspMFIpP3FB8ywyu0T0hWtCQgL4J47nigCHpOu58deP88fS/Nyz/fyGVWOZ76b
|
||||
WhWwgM3P3X95fQ3d7oFPR/bVh0YV+Cf861INwplokXgXQ3/TCQ+HNXeAMWn3JLWv
|
||||
XFwk8owk9dq/kQGdndGgy3KTEW4ctPX5GNhf3LJ9Q7dLji4ReQ4=
|
||||
-----END CERTIFICATE-----
|
||||
@@ -1,28 +0,0 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDRvaz8CC/cshpC
|
||||
afJo4jLkHEoBqDLhdgFelJoAiQUyIqyWl2O7YHPnpJH+TgR7oelzNzt/kLRcH89M
|
||||
/TszB6zqyLTC4aqmvzKL0peD/jL2LWBucR0WXIvjA3zoRuF/x86+rYH3tHb+xs2P
|
||||
Ss8EGL/Ev+ss+qTzTGEn26fuGNHkNw6tOwPpc+o8+wUtzf/kAthamo+cIDs2rQ+l
|
||||
P7+aLZTLeU/q4gcLutlzcK5imex5xy2jPkweq48kijK0kIzl1cPlA5d1z7C8jU50
|
||||
Pj9X9sQDJTN32j7UYRisJeeYQF8GaaN8SbrDI6zHgKzrRLyxDt/KQa9ViLeXANgZ
|
||||
i+Xx9KgfAgMBAAECggEBAK0VjSJzkyPaamcyTVSWjo7GdaBGcK60lk657RjR+lK0
|
||||
YJ7pkej4oM2hdsVZFsP8Cs4E33nXLa/0pDsRov/qrp0WQm2skwqGMC1I/bZ0WRPk
|
||||
wHaDrBBfESWnJDX/AGpVtlyOjPmgmK6J2usMPihQUDkKdAYrVWJePrMIxt1q6BMe
|
||||
iczs3qriMmtY3bUc4UyUwJ5fhDLjshHvfuIpYQyI6EXZM6dZksn9LylXJnigY6QJ
|
||||
HxOYO0BDwOsZ8yQ8J8afLk88i0GizEkgE1z3REtQUwgWfxr1WV/ud+T6/ZhSAgH9
|
||||
042mQvSFZnIUSEsmCvjhWuAunfxHKCTcAoYISWfzWpkCgYEA7gpf3HHU5Tn+CgUn
|
||||
1X5uGpG3DmcMgfeGgs2r2f/IIg/5Ac1dfYILiybL1tN9zbyLCJfcbFpWBc9hJL6f
|
||||
CPc5hUiwWFJqBJewxQkC1Ae/HakHbip+IZ+Jr0842O4BAArvixk4Lb7/N2Ct9sTE
|
||||
NJO6RtK9lbEZ5uK61DglHy8CS2UCgYEA4ZC1o36kPAMQBggajgnucb2yuUEelk0f
|
||||
AEr+GI32MGE+93xMr7rAhBoqLg4AITyIfEnOSQ5HwagnIHonBbv1LV/Gf9ursx8Z
|
||||
YOGbvT8zzzC+SU1bkDzdjAYnFQVGIjMtKOBJ3K07++ypwX1fr4QsQ8uKL8WSOWwt
|
||||
Z3Bym6XiZzMCgYADnhy+2OwHX85AkLt+PyGlPbmuelpyTzS4IDAQbBa6jcuW/2wA
|
||||
UE2km75VUXmD+u2R/9zVuLm99NzhFhSMqlUxdV1YukfqMfP5yp1EY6m/5aW7QuIP
|
||||
2MDa7TVL9rIFMiVZ09RKvbBbQxjhuzPQKL6X/PPspnhiTefQ+dl2k9xREQKBgHDS
|
||||
fMfGNEeAEKezrfSVqxphE9/tXms3L+ZpnCaT+yu/uEr5dTIAawKoQ6i9f/sf1/Sy
|
||||
xedsqR+IB+oKrzIDDWMgoJybN4pkZ8E5lzhVQIjFjKgFdWLzzqyW9z1gYfABQPlN
|
||||
FiS20WX0vgP1vcKAjdNrHzc9zyHBpgQzDmAj3NZZAoGBAI8vKCKdH7w3aL5CNkZQ
|
||||
2buIeWNA2HZazVwAGG5F2TU/LmXfRKnG6dX5bkU+AkBZh56jNZy//hfFSewJB4Kk
|
||||
buB7ERSdaNbO21zXt9FEA3+z0RfMd/Zv2vlIWOSB5nzl/7UKti3sribK6s9ZVLfi
|
||||
SxpiPQ8d/hmSGwn4ksrWUsJD
|
||||
-----END PRIVATE KEY-----
|
||||
+458
-660
File diff suppressed because it is too large
Load Diff
@@ -73,7 +73,7 @@ func NewListener(inner net.Listener, config *Config) net.Listener {
|
||||
// The configuration config must be non-nil and must have
|
||||
// at least one certificate.
|
||||
func Listen(network, laddr string, config *Config) (net.Listener, error) {
|
||||
if config == nil || len(config.Certificates) == 0 {
|
||||
if config == nil || len(config.Chains) == 0 {
|
||||
return nil, errors.New("tls.Listen: no certificates in configuration")
|
||||
}
|
||||
l, err := net.Listen(network, laddr)
|
||||
@@ -173,7 +173,7 @@ func Dial(network, addr string, config *Config) (*Conn, error) {
|
||||
|
||||
// LoadX509KeyPair reads and parses a public/private key pair from a pair of
|
||||
// files. The files must contain PEM encoded data.
|
||||
func LoadX509KeyPair(certFile, keyFile string) (cert Certificate, err error) {
|
||||
func LoadX509KeyPair(certFile, keyFile string) (cert CertificateChain, err error) {
|
||||
certPEMBlock, err := os.ReadFile(certFile)
|
||||
if err != nil {
|
||||
return
|
||||
@@ -187,7 +187,7 @@ func LoadX509KeyPair(certFile, keyFile string) (cert Certificate, err error) {
|
||||
|
||||
// X509KeyPair parses a public/private key pair from a pair of
|
||||
// PEM encoded data.
|
||||
func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (cert Certificate, err error) {
|
||||
func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (cert CertificateChain, err error) {
|
||||
var certDERBlock *pem.Block
|
||||
for {
|
||||
certDERBlock, certPEMBlock = pem.Decode(certPEMBlock)
|
||||
|
||||
@@ -218,6 +218,7 @@ std::vector<Flag> SortedFlags() {
|
||||
IntVectorFlag("-curves", &TestConfig::curves),
|
||||
StringFlag("-key-file", &TestConfig::key_file),
|
||||
StringFlag("-cert-file", &TestConfig::cert_file),
|
||||
StringFlag("-trust-cert", &TestConfig::trust_cert),
|
||||
StringFlag("-expect-server-name", &TestConfig::expect_server_name),
|
||||
BoolFlag("-enable-ech-grease", &TestConfig::enable_ech_grease),
|
||||
Base64VectorFlag("-ech-server-config", &TestConfig::ech_server_configs),
|
||||
|
||||
@@ -40,6 +40,7 @@ struct TestConfig {
|
||||
std::vector<uint16_t> curves;
|
||||
std::string key_file;
|
||||
std::string cert_file;
|
||||
std::string trust_cert;
|
||||
std::string expect_server_name;
|
||||
bool enable_ech_grease = false;
|
||||
std::vector<std::string> ech_server_configs;
|
||||
|
||||
@@ -354,23 +354,14 @@ func main() {
|
||||
binaries = append(binaries, "ssl/test/bssl_shim")
|
||||
files = append(files,
|
||||
"BUILDING.md",
|
||||
"ssl/test/runner/cert.pem",
|
||||
"ssl/test/runner/channel_id_key.pem",
|
||||
"ssl/test/runner/ecdsa_p224_cert.pem",
|
||||
"ssl/test/runner/ecdsa_p224_key.pem",
|
||||
"ssl/test/runner/ecdsa_p256_cert.pem",
|
||||
"ssl/test/runner/ecdsa_p256_key.pem",
|
||||
"ssl/test/runner/ecdsa_p384_cert.pem",
|
||||
"ssl/test/runner/ecdsa_p384_key.pem",
|
||||
"ssl/test/runner/ecdsa_p521_cert.pem",
|
||||
"ssl/test/runner/ecdsa_p521_key.pem",
|
||||
"ssl/test/runner/ed25519_cert.pem",
|
||||
"ssl/test/runner/ed25519_key.pem",
|
||||
"ssl/test/runner/key.pem",
|
||||
"ssl/test/runner/rsa_1024_cert.pem",
|
||||
"ssl/test/runner/rsa_2048_key.pem",
|
||||
"ssl/test/runner/rsa_1024_key.pem",
|
||||
"ssl/test/runner/rsa_chain_cert.pem",
|
||||
"ssl/test/runner/rsa_chain_key.pem",
|
||||
"util/all_tests.json",
|
||||
)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user