Preserve TLS 1.3 Certificate transcript bytes

auth_test.go

@@ -8,7 +8,7 @@ import (
 	"crypto"
 	"testing"
 
-	"github.com/refraction-networking/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/fips140tls"
 )
 
 func TestSignatureSelection(t *testing.T) {

cipher_suites.go

@@ -18,7 +18,7 @@ import (
 	"runtime"
 	_ "unsafe" // for linkname
 
-	"github.com/refraction-networking/utls/internal/boring"
+	"github.com/kernel/utls/internal/boring"
 	"golang.org/x/sys/cpu"
 
 	"golang.org/x/crypto/chacha20poly1305"

common.go

@@ -26,7 +26,7 @@ import (
 	"time"
 	_ "unsafe" // for linkname
 
-	"github.com/refraction-networking/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/fips140tls"
 )
 
 const (

ech.go

@@ -11,7 +11,7 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/refraction-networking/utls/internal/hpke"
+	"github.com/kernel/utls/internal/hpke"
 
 	"golang.org/x/crypto/cryptobyte"
 )

examples/ech/main.go

@@ -15,7 +15,7 @@ import (
 	"os"
 	"time"
 
-	tls "github.com/refraction-networking/utls"
+	tls "github.com/kernel/utls"
 	"golang.org/x/net/http2"
 )
 

examples/old/examples.go

@@ -10,7 +10,7 @@ import (
 	"net/url"
 	"time"
 
-	tls "github.com/refraction-networking/utls"
+	tls "github.com/kernel/utls"
 	"golang.org/x/net/http2"
 )
 

examples/tls-resumption/main.go

@@ -6,7 +6,7 @@ import (
 	"strings"
 	"time"
 
-	tls "github.com/refraction-networking/utls"
+	tls "github.com/kernel/utls"
 )
 
 type ClientSessionCache struct {

go.mod

@@ -1,4 +1,4 @@
-module github.com/refraction-networking/utls
+module github.com/kernel/utls
 
 go 1.24
 

handshake_client.go

@@ -23,10 +23,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/fips140tls"
-	"github.com/refraction-networking/utls/internal/hpke"
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/hpke"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 type clientHandshakeState struct {

handshake_client_test.go

@@ -31,8 +31,8 @@ import (
 	"testing"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/fips140tls"
 )
 
 // Note: see comment in handshake_test.go for details of how the reference

handshake_client_tls13.go

@@ -19,8 +19,8 @@ import (
 	"slices"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/hkdf"
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/hkdf"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 type clientHandshakeStateTLS13 struct {

handshake_messages.go

@@ -1499,6 +1499,7 @@ func (m *certificateMsg) unmarshal(data []byte) bool {
 }
 
 type certificateMsgTLS13 struct {
+	original     []byte // [uTLS]
 	certificate  Certificate
 	ocspStapling bool
 	scts         bool
@@ -1561,7 +1562,7 @@ func marshalCertificate(b *cryptobyte.Builder, certificate Certificate) {
 }
 
 func (m *certificateMsgTLS13) unmarshal(data []byte) bool {
-	*m = certificateMsgTLS13{}
+	*m = certificateMsgTLS13{original: data} // [uTLS]
 	s := cryptobyte.String(data)
 
 	var context cryptobyte.String
@@ -1578,6 +1579,22 @@ func (m *certificateMsgTLS13) unmarshal(data []byte) bool {
 	return true
 }
 
+// [UTLS SECTION BEGINS]
+// originalBytes lets transcriptMsg hash this Certificate message exactly as it
+// was received, instead of a re-marshal via marshalCertificate(). The re-marshal
+// is not guaranteed to be byte-identical to the peer's encoding (only leaf
+// OCSP/SCT are re-emitted, in a fixed order; other per-certificate extensions
+// and non-canonical length encodings are lost), which diverges the TLS 1.3
+// handshake transcript and causes CertificateVerify to fail with
+// "crypto/rsa: verification error". clientHelloMsg, serverHelloMsg and
+// certificateRequestMsgTLS13 already preserve their original bytes for the same
+// reason.
+func (m *certificateMsgTLS13) originalBytes() []byte {
+	return m.original
+}
+
+// [UTLS SECTION ENDS]
+
 func unmarshalCertificate(s *cryptobyte.String, certificate *Certificate) bool {
 	var certList cryptobyte.String
 	if !s.ReadUint24LengthPrefixed(&certList) {

handshake_messages_test.go

@@ -100,6 +100,8 @@ func TestMarshalUnmarshal(t *testing.T) {
 					t.original = nil
 				case *certificateRequestMsgTLS13: // [UTLS]
 					t.original = nil // [UTLS]
+				case *certificateMsgTLS13: // [UTLS]
+					t.original = nil // [UTLS]
 				}
 
 				if !reflect.DeepEqual(m1, m) {

handshake_server.go

@@ -18,7 +18,7 @@ import (
 	"io"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/byteorder"
 )
 
 // serverHandshakeState contains details of a server handshake in progress.

handshake_server_test.go

@@ -27,7 +27,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/fips140tls"
 )
 
 func testClientHello(t *testing.T, serverConfig *Config, m handshakeMessage) {

handshake_server_tls13.go

@@ -18,11 +18,11 @@ import (
 	"sort"
 	"time"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/fips140tls"
-	"github.com/refraction-networking/utls/internal/hkdf"
-	"github.com/refraction-networking/utls/internal/hpke"
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/hkdf"
+	"github.com/kernel/utls/internal/hpke"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 // maxClientPSKIdentities is the number of client PSK identities the server will

internal/hpke/hpke.go

@@ -13,8 +13,8 @@ import (
 	"errors"
 	"math/bits"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/hkdf"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/hkdf"
 	"golang.org/x/crypto/chacha20poly1305"
 )
 

internal/quicvarint/varint.go

@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/refraction-networking/utls/internal/quicvarint/protocol"
+	"github.com/kernel/utls/internal/quicvarint/protocol"
 )
 
 // taken from the QUIC draft

internal/tls13/tls13.go

@@ -9,8 +9,8 @@ package tls13
 import (
 	fips140 "hash"
 
-	"github.com/refraction-networking/utls/internal/byteorder"
-	"github.com/refraction-networking/utls/internal/hkdf"
+	"github.com/kernel/utls/internal/byteorder"
+	"github.com/kernel/utls/internal/hkdf"
 )
 
 // We don't set the service indicator in this package but we delegate that to

key_schedule.go

@@ -12,7 +12,7 @@ import (
 	"hash"
 	"io"
 
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 // This file contains the functions necessary to compute the TLS 1.3 key

key_schedule_test.go

@@ -12,7 +12,7 @@ import (
 	"testing"
 	"unicode"
 
-	"github.com/refraction-networking/utls/internal/tls13"
+	"github.com/kernel/utls/internal/tls13"
 )
 
 func TestACVPVectors(t *testing.T) {

link_test.go

@@ -11,7 +11,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/refraction-networking/utls/testenv"
+	"github.com/kernel/utls/testenv"
 )
 
 // Tests that the linker is able to remove references to the Client or Server if unused.

prf.go

@@ -15,7 +15,7 @@ import (
 	"fmt"
 	"hash"
 
-	"github.com/refraction-networking/utls/internal/tls12"
+	"github.com/kernel/utls/internal/tls12"
 )
 
 type prfFunc func(secret []byte, label string, seed []byte, keyLen int) []byte

testdata/Client-TLSv13-CertificateEntryUnknownExtension

@@ -0,0 +1,92 @@
+>>> Flow 1 (client to server)
+00000000  16 03 01 00 e3 01 00 00  df 03 03 00 00 00 00 00  |................|
+00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000020  00 00 00 00 00 00 00 00  00 00 00 20 00 00 00 00  |........... ....|
+00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 06 13 03  |................|
+00000050  13 01 13 02 01 00 00 90  00 00 00 13 00 11 00 00  |................|
+00000060  0e 65 78 61 6d 70 6c 65  2e 67 6f 6c 61 6e 67 00  |.example.golang.|
+00000070  0b 00 02 01 00 ff 01 00  01 00 00 17 00 00 00 12  |................|
+00000080  00 00 00 05 00 05 01 00  00 00 00 00 0a 00 0a 00  |................|
+00000090  08 00 1d 00 17 00 18 00  19 00 0d 00 1a 00 18 08  |................|
+000000a0  04 04 03 08 07 08 05 08  06 04 01 05 01 06 01 05  |................|
+000000b0  03 06 03 02 01 02 03 00  2b 00 03 02 03 04 00 33  |........+......3|
+000000c0  00 26 00 24 00 1d 00 20  2f e5 7d a3 47 cd 62 43  |.&.$... /.}.G.bC|
+000000d0  15 28 da ac 5f bb 29 07  30 ff f6 84 af c4 cf c2  |.(.._.).0.......|
+000000e0  ed 90 99 5f 58 cb 3b 74                           |..._X.;t|
+>>> Flow 2 (server to client)
+00000000  16 03 03 00 7a 02 00 00  76 03 03 00 00 00 00 00  |....z...v.......|
+00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000020  00 00 00 00 00 00 00 00  00 00 00 20 00 00 00 00  |........... ....|
+00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
+00000040  00 00 00 00 00 00 00 00  00 00 00 00 13 03 00 00  |................|
+00000050  2e 00 2b 00 02 03 04 00  33 00 24 00 1d 00 20 2f  |..+.....3.$... /|
+00000060  e5 7d a3 47 cd 62 43 15  28 da ac 5f bb 29 07 30  |.}.G.bC.(.._.).0|
+00000070  ff f6 84 af c4 cf c2 ed  90 99 5f 58 cb 3b 74 14  |.........._X.;t.|
+00000080  03 03 00 01 01 17 03 03  00 17 c3 5c 75 b6 bc 4f  |...........\u..O|
+00000090  a0 0b fa ed bc 13 9f c0  6c cf 00 40 55 db b6 6f  |........l..@U..o|
+000000a0  5b 17 03 03 02 94 84 ee  ac d7 21 dd d4 1c 04 3f  |[.........!....?|
+000000b0  54 89 43 9c ab e3 0a 6a  04 3c 0a ae 7b b8 58 23  |T.C....j.<..{.X#|
+000000c0  ff e1 53 51 81 b7 f1 b8  26 fc 6d 9e 25 d9 1c 52  |..SQ....&.m.%..R|
+000000d0  d4 65 62 67 f5 1b d0 dd  48 35 41 d3 7a 15 cd e1  |.ebg....H5A.z...|
+000000e0  25 e5 c8 da dd a7 d3 28  aa a1 ed 42 f2 cb 76 a3  |%......(...B..v.|
+000000f0  00 bf 22 0d 5b fd 85 6a  1a 81 c6 e4 a2 0e c8 19  |..".[..j........|
+00000100  fb 53 7d e5 8b 4d 8b 78  0d 3a 66 ff b8 bf a6 a8  |.S}..M.x.:f.....|
+00000110  ea f6 6d af 12 df 76 b4  d7 fa 29 5e dc d7 ee dd  |..m...v...)^....|
+00000120  9d 5e 23 2e c7 00 c0 8d  1f bb 50 35 0f 30 fe 70  |.^#.......P5.0.p|
+00000130  98 e0 48 7c 25 90 bd 84  09 19 31 a8 50 a4 98 74  |..H|%.....1.P..t|
+00000140  71 13 04 c7 93 b7 3c 12  ef 49 1d fa bf 33 da 93  |q.....<..I...3..|
+00000150  a8 e2 86 85 fd 2f 57 3a  82 b7 2d a9 ec 3b ee fc  |...../W:..-..;..|
+00000160  f5 4d a7 d3 e5 e7 bc 21  69 bb 17 0e eb 86 e4 a8  |.M.....!i.......|
+00000170  19 d4 ec a4 67 81 14 0d  1b 20 6d f2 db 9d b5 7a  |....g.... m....z|
+00000180  9a b2 0d 75 57 c8 8c f9  eb fa 33 c7 8e f4 ec 15  |...uW.....3.....|
+00000190  e1 de 0a c5 29 40 25 3c  8f 3b e6 4c 15 c1 f5 7d  |....)@%<.;.L...}|
+000001a0  89 80 d7 c7 6f 4e 25 7e  fb be 19 b2 6a 9c 4e 99  |....oN%~....j.N.|
+000001b0  87 e4 cc 0e be dc 3b 0a  7e 9b b3 6d 73 66 35 57  |......;.~..msf5W|
+000001c0  47 e9 e9 24 65 b6 1b de  ea 65 c9 b7 6e 48 23 9a  |G..$e....e..nH#.|
+000001d0  92 53 4e 39 c6 a7 d8 af  e9 f0 7a 5b 1c a1 3a b6  |.SN9......z[..:.|
+000001e0  6f ea 10 29 91 43 15 f3  c5 cc 57 2e 81 b2 80 dc  |o..).C....W.....|
+000001f0  d4 70 12 62 06 05 ea 29  3f 1e 6e 6f d9 69 54 99  |.p.b...)?.no.iT.|
+00000200  72 94 1c 39 09 60 e7 14  fb 67 0e 44 75 cc 17 f2  |r..9.`...g.Du...|
+00000210  94 07 40 58 e6 ea 22 d1  0a fb de 36 21 b8 dc a9  |..@X.."....6!...|
+00000220  3f a7 c2 0d 20 18 9d 93  1d fb 1d 03 b9 2b 5e 9e  |?... ........+^.|
+00000230  eb b9 0a 17 98 fe b0 01  da 29 da 97 4c d9 bb b3  |.........)..L...|
+00000240  7c 1d 44 19 bc 90 df ce  23 17 f7 a0 4f db 4b 5f  ||.D.....#...O.K_|
+00000250  b1 0f d1 5d b1 6c 4a 5e  e9 d9 dd 89 07 62 e8 e5  |...].lJ^.....b..|
+00000260  69 bb 7e ef db 79 2c 18  5f 42 fe d1 39 41 fa 77  |i.~..y,._B..9A.w|
+00000270  3b be 55 29 a4 ef 94 79  87 6b a6 bc 05 c0 c5 ae  |;.U)...y.k......|
+00000280  ac 16 36 ae 9e 0d 7a 19  b2 5c 1d e9 3d 3c 5e fe  |..6...z..\..=<^.|
+00000290  4b 2d 60 cb cf c4 1a 15  48 75 15 99 63 07 24 0c  |K-`.....Hu..c.$.|
+000002a0  8a 51 f0 59 b0 03 9c 71  a1 61 f6 79 74 75 16 51  |.Q.Y...q.a.ytu.Q|
+000002b0  bd 65 6e 58 1f 00 ed 07  c0 80 2d c3 9e 12 a7 b1  |.enX......-.....|
+000002c0  08 8f 1e c0 8a 98 d2 fa  dc 92 b2 f4 b6 d8 63 d9  |..............c.|
+000002d0  d4 aa e5 f4 9e e8 3e 49  fa 66 4f a1 5a 5c 46 b2  |......>I.fO.Z\F.|
+000002e0  2c 97 14 b7 19 cb ac 02  fa a4 c6 23 3e 4f 9b f2  |,..........#>O..|
+000002f0  83 34 0b 42 50 48 a8 36  b0 50 a2 39 41 2d 9f 11  |.4.BPH.6.P.9A-..|
+00000300  57 3c 99 88 9f 1f 07 d6  1a e4 8b 95 37 0f fd 8c  |W<..........7...|
+00000310  c8 f4 ee 71 ba 20 bb 9d  4a b4 a6 f2 9c ad 0a 6c  |...q. ..J......l|
+00000320  14 23 bb 93 8e 7b cb 20  13 a2 af 0d 83 f2 01 33  |.#...{. .......3|
+00000330  8f d3 25 5c 0f 74 00 a1  ee d9 17 03 03 00 99 dc  |..%\.t..........|
+00000340  f2 0b ec 67 a2 40 d2 8c  b6 f1 47 2b e5 cd 14 8a  |...g.@....G+....|
+00000350  df 0f b5 12 b5 56 90 4d  70 b8 46 05 46 8e a6 94  |.....V.Mp.F.F...|
+00000360  49 b7 6d 1f fe ab 8f d9  69 45 6e 5c 78 fd 05 ec  |I.m.....iEn\x...|
+00000370  6e 48 f3 48 78 f4 26 81  07 39 0b 8c 13 db 03 29  |nH.Hx.&..9.....)|
+00000380  c6 92 ba 44 da 0f b6 04  6a f5 fa a5 e8 57 97 a9  |...D....j....W..|
+00000390  de d7 51 4e 55 ee 90 8a  96 ee 68 62 15 bb 53 c2  |..QNU.....hb..S.|
+000003a0  8d 78 bc d5 d1 55 70 c4  09 09 ff 4b f5 4b 17 50  |.x...Up....K.K.P|
+000003b0  ed 46 88 db 92 9f c8 02  fc 32 dd b2 f0 7d ec 73  |.F.......2...}.s|
+000003c0  0c 74 d2 55 6d 3c 84 2b  08 ea d8 64 ea c5 53 09  |.t.Um<.+...d..S.|
+000003d0  cf e6 5f 75 7d ab 48 5d  17 03 03 00 35 1b 97 f0  |.._u}.H]....5...|
+000003e0  da 63 43 8f de 14 df 00  33 89 6e c7 3a 85 79 15  |.cC.....3.n.:.y.|
+000003f0  6e 4b c4 80 3f 6e 23 ff  85 98 b9 db c0 be 0b 4c  |nK..?n#........L|
+00000400  85 c8 bd d7 81 97 27 4b  63 cb f9 d5 3d 7a be 7b  |......'Kc...=z.{|
+00000410  a1 c6                                             |..|
+>>> Flow 3 (client to server)
+00000000  14 03 03 00 01 01 17 03  03 00 35 90 a8 14 67 6f  |..........5...go|
+00000010  57 19 0f 8d bf 48 f0 3d  a2 a8 12 e1 23 d9 ff 7c  |W....H.=....#..||
+00000020  cb 3a 62 49 3c 53 7f 83  c1 65 54 17 50 70 91 57  |.:bI<S...eT.Pp.W|
+00000030  cb 01 f8 66 af 52 ee 83  77 dc 47 21 08 6d ef e8  |...f.R..w.G!.m..|
+00000040  17 03 03 00 17 4d 04 17  19 6d 99 7b 7c 6a b1 7d  |.....M...m.{|j.}|
+00000050  81 b6 54 f7 7f 23 be 5f  fa d2 c5 8d 17 03 03 00  |..T..#._........|
+00000060  13 9c 67 89 58 55 d9 bf  ff 6e 60 d7 a5 f3 1e ae  |..g.XU...n`.....|
+00000070  f2 7f b1 65                                       |...e|

tls_test.go

@@ -31,9 +31,9 @@ import (
 
 	"golang.org/x/crypto/cryptobyte"
 
-	"github.com/refraction-networking/utls/internal/fips140tls"
-	"github.com/refraction-networking/utls/internal/hpke"
-	"github.com/refraction-networking/utls/testenv"
+	"github.com/kernel/utls/internal/fips140tls"
+	"github.com/kernel/utls/internal/hpke"
+	"github.com/kernel/utls/testenv"
 )
 
 var rsaCertPEM = `-----BEGIN CERTIFICATE-----