1// Copyright 2009 The Go Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style
3// license that can be found in the LICENSE file.
4
5package runner
6
7import (
8	"bytes"
9	"encoding/binary"
10)
11
12func writeLen(buf []byte, v, size int) {
13	for i := 0; i < size; i++ {
14		buf[size-i-1] = byte(v)
15		v >>= 8
16	}
17	if v != 0 {
18		panic("length is too long")
19	}
20}
21
22type byteBuilder struct {
23	buf       *[]byte
24	start     int
25	prefixLen int
26	child     *byteBuilder
27}
28
29func newByteBuilder() *byteBuilder {
30	buf := make([]byte, 0, 32)
31	return &byteBuilder{buf: &buf}
32}
33
34func (bb *byteBuilder) len() int {
35	return len(*bb.buf) - bb.start - bb.prefixLen
36}
37
38func (bb *byteBuilder) flush() {
39	if bb.child == nil {
40		return
41	}
42	bb.child.flush()
43	writeLen((*bb.buf)[bb.child.start:], bb.child.len(), bb.child.prefixLen)
44	bb.child = nil
45	return
46}
47
48func (bb *byteBuilder) finish() []byte {
49	bb.flush()
50	return *bb.buf
51}
52
53func (bb *byteBuilder) addU8(u uint8) {
54	bb.flush()
55	*bb.buf = append(*bb.buf, u)
56}
57
58func (bb *byteBuilder) addU16(u uint16) {
59	bb.flush()
60	*bb.buf = append(*bb.buf, byte(u>>8), byte(u))
61}
62
63func (bb *byteBuilder) addU24(u int) {
64	bb.flush()
65	*bb.buf = append(*bb.buf, byte(u>>16), byte(u>>8), byte(u))
66}
67
68func (bb *byteBuilder) addU32(u uint32) {
69	bb.flush()
70	*bb.buf = append(*bb.buf, byte(u>>24), byte(u>>16), byte(u>>8), byte(u))
71}
72
73func (bb *byteBuilder) addU64(u uint64) {
74	bb.flush()
75	var b [8]byte
76	binary.BigEndian.PutUint64(b[:], u)
77	*bb.buf = append(*bb.buf, b[:]...)
78}
79
80func (bb *byteBuilder) addU8LengthPrefixed() *byteBuilder {
81	return bb.createChild(1)
82}
83
84func (bb *byteBuilder) addU16LengthPrefixed() *byteBuilder {
85	return bb.createChild(2)
86}
87
88func (bb *byteBuilder) addU24LengthPrefixed() *byteBuilder {
89	return bb.createChild(3)
90}
91
92func (bb *byteBuilder) addU32LengthPrefixed() *byteBuilder {
93	return bb.createChild(4)
94}
95
96func (bb *byteBuilder) addBytes(b []byte) {
97	bb.flush()
98	*bb.buf = append(*bb.buf, b...)
99}
100
101func (bb *byteBuilder) createChild(lengthPrefixSize int) *byteBuilder {
102	bb.flush()
103	bb.child = &byteBuilder{
104		buf:       bb.buf,
105		start:     len(*bb.buf),
106		prefixLen: lengthPrefixSize,
107	}
108	for i := 0; i < lengthPrefixSize; i++ {
109		*bb.buf = append(*bb.buf, 0)
110	}
111	return bb.child
112}
113
114func (bb *byteBuilder) discardChild() {
115	if bb.child != nil {
116		return
117	}
118	bb.child = nil
119	*bb.buf = (*bb.buf)[:bb.start]
120}
121
122type keyShareEntry struct {
123	group       CurveID
124	keyExchange []byte
125}
126
127type pskIdentity struct {
128	ticket              []uint8
129	obfuscatedTicketAge uint32
130}
131
132type clientHelloMsg struct {
133	raw                     []byte
134	isDTLS                  bool
135	vers                    uint16
136	random                  []byte
137	sessionId               []byte
138	cookie                  []byte
139	cipherSuites            []uint16
140	compressionMethods      []uint8
141	nextProtoNeg            bool
142	serverName              string
143	ocspStapling            bool
144	supportedCurves         []CurveID
145	supportedPoints         []uint8
146	hasKeyShares            bool
147	keyShares               []keyShareEntry
148	trailingKeyShareData    bool
149	pskIdentities           []pskIdentity
150	pskKEModes              []byte
151	pskBinders              [][]uint8
152	hasEarlyData            bool
153	tls13Cookie             []byte
154	ticketSupported         bool
155	sessionTicket           []uint8
156	signatureAlgorithms     []signatureAlgorithm
157	supportedVersions       []uint16
158	secureRenegotiation     []byte
159	alpnProtocols           []string
160	duplicateExtension      bool
161	channelIDSupported      bool
162	npnAfterAlpn            bool
163	extendedMasterSecret    bool
164	srtpProtectionProfiles  []uint16
165	srtpMasterKeyIdentifier string
166	sctListSupported        bool
167	customExtension         string
168	hasGREASEExtension      bool
169	pskBinderFirst          bool
170}
171
172func (m *clientHelloMsg) equal(i interface{}) bool {
173	m1, ok := i.(*clientHelloMsg)
174	if !ok {
175		return false
176	}
177
178	return bytes.Equal(m.raw, m1.raw) &&
179		m.isDTLS == m1.isDTLS &&
180		m.vers == m1.vers &&
181		bytes.Equal(m.random, m1.random) &&
182		bytes.Equal(m.sessionId, m1.sessionId) &&
183		bytes.Equal(m.cookie, m1.cookie) &&
184		eqUint16s(m.cipherSuites, m1.cipherSuites) &&
185		bytes.Equal(m.compressionMethods, m1.compressionMethods) &&
186		m.nextProtoNeg == m1.nextProtoNeg &&
187		m.serverName == m1.serverName &&
188		m.ocspStapling == m1.ocspStapling &&
189		eqCurveIDs(m.supportedCurves, m1.supportedCurves) &&
190		bytes.Equal(m.supportedPoints, m1.supportedPoints) &&
191		m.hasKeyShares == m1.hasKeyShares &&
192		eqKeyShareEntryLists(m.keyShares, m1.keyShares) &&
193		m.trailingKeyShareData == m1.trailingKeyShareData &&
194		eqPSKIdentityLists(m.pskIdentities, m1.pskIdentities) &&
195		bytes.Equal(m.pskKEModes, m1.pskKEModes) &&
196		eqByteSlices(m.pskBinders, m1.pskBinders) &&
197		m.hasEarlyData == m1.hasEarlyData &&
198		bytes.Equal(m.tls13Cookie, m1.tls13Cookie) &&
199		m.ticketSupported == m1.ticketSupported &&
200		bytes.Equal(m.sessionTicket, m1.sessionTicket) &&
201		eqSignatureAlgorithms(m.signatureAlgorithms, m1.signatureAlgorithms) &&
202		eqUint16s(m.supportedVersions, m1.supportedVersions) &&
203		bytes.Equal(m.secureRenegotiation, m1.secureRenegotiation) &&
204		(m.secureRenegotiation == nil) == (m1.secureRenegotiation == nil) &&
205		eqStrings(m.alpnProtocols, m1.alpnProtocols) &&
206		m.duplicateExtension == m1.duplicateExtension &&
207		m.channelIDSupported == m1.channelIDSupported &&
208		m.npnAfterAlpn == m1.npnAfterAlpn &&
209		m.extendedMasterSecret == m1.extendedMasterSecret &&
210		eqUint16s(m.srtpProtectionProfiles, m1.srtpProtectionProfiles) &&
211		m.srtpMasterKeyIdentifier == m1.srtpMasterKeyIdentifier &&
212		m.sctListSupported == m1.sctListSupported &&
213		m.customExtension == m1.customExtension &&
214		m.hasGREASEExtension == m1.hasGREASEExtension &&
215		m.pskBinderFirst == m1.pskBinderFirst
216}
217
218func (m *clientHelloMsg) marshal() []byte {
219	if m.raw != nil {
220		return m.raw
221	}
222
223	handshakeMsg := newByteBuilder()
224	handshakeMsg.addU8(typeClientHello)
225	hello := handshakeMsg.addU24LengthPrefixed()
226	hello.addU16(m.vers)
227	hello.addBytes(m.random)
228	sessionId := hello.addU8LengthPrefixed()
229	sessionId.addBytes(m.sessionId)
230	if m.isDTLS {
231		cookie := hello.addU8LengthPrefixed()
232		cookie.addBytes(m.cookie)
233	}
234	cipherSuites := hello.addU16LengthPrefixed()
235	for _, suite := range m.cipherSuites {
236		cipherSuites.addU16(suite)
237	}
238	compressionMethods := hello.addU8LengthPrefixed()
239	compressionMethods.addBytes(m.compressionMethods)
240
241	extensions := hello.addU16LengthPrefixed()
242	if len(m.pskIdentities) > 0 && m.pskBinderFirst {
243		extensions.addU16(extensionPreSharedKey)
244		pskExtension := extensions.addU16LengthPrefixed()
245
246		pskIdentities := pskExtension.addU16LengthPrefixed()
247		for _, psk := range m.pskIdentities {
248			pskIdentities.addU16LengthPrefixed().addBytes(psk.ticket)
249			pskIdentities.addU32(psk.obfuscatedTicketAge)
250		}
251		pskBinders := pskExtension.addU16LengthPrefixed()
252		for _, binder := range m.pskBinders {
253			pskBinders.addU8LengthPrefixed().addBytes(binder)
254		}
255	}
256	if m.duplicateExtension {
257		// Add a duplicate bogus extension at the beginning and end.
258		extensions.addU16(0xffff)
259		extensions.addU16(0) // 0-length for empty extension
260	}
261	if m.nextProtoNeg && !m.npnAfterAlpn {
262		extensions.addU16(extensionNextProtoNeg)
263		extensions.addU16(0) // The length is always 0
264	}
265	if len(m.serverName) > 0 {
266		extensions.addU16(extensionServerName)
267		serverNameList := extensions.addU16LengthPrefixed()
268
269		// RFC 3546, section 3.1
270		//
271		// struct {
272		//     NameType name_type;
273		//     select (name_type) {
274		//         case host_name: HostName;
275		//     } name;
276		// } ServerName;
277		//
278		// enum {
279		//     host_name(0), (255)
280		// } NameType;
281		//
282		// opaque HostName<1..2^16-1>;
283		//
284		// struct {
285		//     ServerName server_name_list<1..2^16-1>
286		// } ServerNameList;
287
288		serverName := serverNameList.addU16LengthPrefixed()
289		serverName.addU8(0) // NameType host_name(0)
290		hostName := serverName.addU16LengthPrefixed()
291		hostName.addBytes([]byte(m.serverName))
292	}
293	if m.ocspStapling {
294		extensions.addU16(extensionStatusRequest)
295		certificateStatusRequest := extensions.addU16LengthPrefixed()
296
297		// RFC 4366, section 3.6
298		certificateStatusRequest.addU8(1) // OCSP type
299		// Two zero valued uint16s for the two lengths.
300		certificateStatusRequest.addU16(0) // ResponderID length
301		certificateStatusRequest.addU16(0) // Extensions length
302	}
303	if len(m.supportedCurves) > 0 {
304		// http://tools.ietf.org/html/rfc4492#section-5.1.1
305		extensions.addU16(extensionSupportedCurves)
306		supportedCurvesList := extensions.addU16LengthPrefixed()
307		supportedCurves := supportedCurvesList.addU16LengthPrefixed()
308		for _, curve := range m.supportedCurves {
309			supportedCurves.addU16(uint16(curve))
310		}
311	}
312	if len(m.supportedPoints) > 0 {
313		// http://tools.ietf.org/html/rfc4492#section-5.1.2
314		extensions.addU16(extensionSupportedPoints)
315		supportedPointsList := extensions.addU16LengthPrefixed()
316		supportedPoints := supportedPointsList.addU8LengthPrefixed()
317		supportedPoints.addBytes(m.supportedPoints)
318	}
319	if m.hasKeyShares {
320		extensions.addU16(extensionKeyShare)
321		keyShareList := extensions.addU16LengthPrefixed()
322
323		keyShares := keyShareList.addU16LengthPrefixed()
324		for _, keyShare := range m.keyShares {
325			keyShares.addU16(uint16(keyShare.group))
326			keyExchange := keyShares.addU16LengthPrefixed()
327			keyExchange.addBytes(keyShare.keyExchange)
328		}
329
330		if m.trailingKeyShareData {
331			keyShares.addU8(0)
332		}
333	}
334	if len(m.pskKEModes) > 0 {
335		extensions.addU16(extensionPSKKeyExchangeModes)
336		pskModesExtension := extensions.addU16LengthPrefixed()
337		pskModesExtension.addU8LengthPrefixed().addBytes(m.pskKEModes)
338	}
339	if m.hasEarlyData {
340		extensions.addU16(extensionEarlyData)
341		extensions.addU16(0) // The length is zero.
342	}
343	if len(m.tls13Cookie) > 0 {
344		extensions.addU16(extensionCookie)
345		body := extensions.addU16LengthPrefixed()
346		body.addU16LengthPrefixed().addBytes(m.tls13Cookie)
347	}
348	if m.ticketSupported {
349		// http://tools.ietf.org/html/rfc5077#section-3.2
350		extensions.addU16(extensionSessionTicket)
351		sessionTicketExtension := extensions.addU16LengthPrefixed()
352		sessionTicketExtension.addBytes(m.sessionTicket)
353	}
354	if len(m.signatureAlgorithms) > 0 {
355		// https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
356		extensions.addU16(extensionSignatureAlgorithms)
357		signatureAlgorithmsExtension := extensions.addU16LengthPrefixed()
358		signatureAlgorithms := signatureAlgorithmsExtension.addU16LengthPrefixed()
359		for _, sigAlg := range m.signatureAlgorithms {
360			signatureAlgorithms.addU16(uint16(sigAlg))
361		}
362	}
363	if len(m.supportedVersions) > 0 {
364		extensions.addU16(extensionSupportedVersions)
365		supportedVersionsExtension := extensions.addU16LengthPrefixed()
366		supportedVersions := supportedVersionsExtension.addU8LengthPrefixed()
367		for _, version := range m.supportedVersions {
368			supportedVersions.addU16(uint16(version))
369		}
370	}
371	if m.secureRenegotiation != nil {
372		extensions.addU16(extensionRenegotiationInfo)
373		secureRenegoExt := extensions.addU16LengthPrefixed()
374		secureRenego := secureRenegoExt.addU8LengthPrefixed()
375		secureRenego.addBytes(m.secureRenegotiation)
376	}
377	if len(m.alpnProtocols) > 0 {
378		// https://tools.ietf.org/html/rfc7301#section-3.1
379		extensions.addU16(extensionALPN)
380		alpnExtension := extensions.addU16LengthPrefixed()
381
382		protocolNameList := alpnExtension.addU16LengthPrefixed()
383		for _, s := range m.alpnProtocols {
384			protocolName := protocolNameList.addU8LengthPrefixed()
385			protocolName.addBytes([]byte(s))
386		}
387	}
388	if m.channelIDSupported {
389		extensions.addU16(extensionChannelID)
390		extensions.addU16(0) // Length is always 0
391	}
392	if m.nextProtoNeg && m.npnAfterAlpn {
393		extensions.addU16(extensionNextProtoNeg)
394		extensions.addU16(0) // Length is always 0
395	}
396	if m.duplicateExtension {
397		// Add a duplicate bogus extension at the beginning and end.
398		extensions.addU16(0xffff)
399		extensions.addU16(0)
400	}
401	if m.extendedMasterSecret {
402		// https://tools.ietf.org/html/rfc7627
403		extensions.addU16(extensionExtendedMasterSecret)
404		extensions.addU16(0) // Length is always 0
405	}
406	if len(m.srtpProtectionProfiles) > 0 {
407		// https://tools.ietf.org/html/rfc5764#section-4.1.1
408		extensions.addU16(extensionUseSRTP)
409		useSrtpExt := extensions.addU16LengthPrefixed()
410
411		srtpProtectionProfiles := useSrtpExt.addU16LengthPrefixed()
412		for _, p := range m.srtpProtectionProfiles {
413			// An SRTPProtectionProfile is defined as uint8[2],
414			// not uint16. For some reason, we're storing it
415			// as a uint16.
416			srtpProtectionProfiles.addU8(byte(p >> 8))
417			srtpProtectionProfiles.addU8(byte(p))
418		}
419		srtpMki := useSrtpExt.addU8LengthPrefixed()
420		srtpMki.addBytes([]byte(m.srtpMasterKeyIdentifier))
421	}
422	if m.sctListSupported {
423		extensions.addU16(extensionSignedCertificateTimestamp)
424		extensions.addU16(0) // Length is always 0
425	}
426	if l := len(m.customExtension); l > 0 {
427		extensions.addU16(extensionCustom)
428		customExt := extensions.addU16LengthPrefixed()
429		customExt.addBytes([]byte(m.customExtension))
430	}
431	// The PSK extension must be last (draft-ietf-tls-tls13-18 section 4.2.6).
432	if len(m.pskIdentities) > 0 && !m.pskBinderFirst {
433		extensions.addU16(extensionPreSharedKey)
434		pskExtension := extensions.addU16LengthPrefixed()
435
436		pskIdentities := pskExtension.addU16LengthPrefixed()
437		for _, psk := range m.pskIdentities {
438			pskIdentities.addU16LengthPrefixed().addBytes(psk.ticket)
439			pskIdentities.addU32(psk.obfuscatedTicketAge)
440		}
441		pskBinders := pskExtension.addU16LengthPrefixed()
442		for _, binder := range m.pskBinders {
443			pskBinders.addU8LengthPrefixed().addBytes(binder)
444		}
445	}
446
447	if extensions.len() == 0 {
448		hello.discardChild()
449	}
450
451	m.raw = handshakeMsg.finish()
452	return m.raw
453}
454
455func (m *clientHelloMsg) unmarshal(data []byte) bool {
456	if len(data) < 42 {
457		return false
458	}
459	m.raw = data
460	m.vers = uint16(data[4])<<8 | uint16(data[5])
461	m.random = data[6:38]
462	sessionIdLen := int(data[38])
463	if sessionIdLen > 32 || len(data) < 39+sessionIdLen {
464		return false
465	}
466	m.sessionId = data[39 : 39+sessionIdLen]
467	data = data[39+sessionIdLen:]
468	if m.isDTLS {
469		if len(data) < 1 {
470			return false
471		}
472		cookieLen := int(data[0])
473		if cookieLen > 32 || len(data) < 1+cookieLen {
474			return false
475		}
476		m.cookie = data[1 : 1+cookieLen]
477		data = data[1+cookieLen:]
478	}
479	if len(data) < 2 {
480		return false
481	}
482	// cipherSuiteLen is the number of bytes of cipher suite numbers. Since
483	// they are uint16s, the number must be even.
484	cipherSuiteLen := int(data[0])<<8 | int(data[1])
485	if cipherSuiteLen%2 == 1 || len(data) < 2+cipherSuiteLen {
486		return false
487	}
488	numCipherSuites := cipherSuiteLen / 2
489	m.cipherSuites = make([]uint16, numCipherSuites)
490	for i := 0; i < numCipherSuites; i++ {
491		m.cipherSuites[i] = uint16(data[2+2*i])<<8 | uint16(data[3+2*i])
492		if m.cipherSuites[i] == scsvRenegotiation {
493			m.secureRenegotiation = []byte{}
494		}
495	}
496	data = data[2+cipherSuiteLen:]
497	if len(data) < 1 {
498		return false
499	}
500	compressionMethodsLen := int(data[0])
501	if len(data) < 1+compressionMethodsLen {
502		return false
503	}
504	m.compressionMethods = data[1 : 1+compressionMethodsLen]
505
506	data = data[1+compressionMethodsLen:]
507
508	m.nextProtoNeg = false
509	m.serverName = ""
510	m.ocspStapling = false
511	m.keyShares = nil
512	m.pskIdentities = nil
513	m.hasEarlyData = false
514	m.ticketSupported = false
515	m.sessionTicket = nil
516	m.signatureAlgorithms = nil
517	m.supportedVersions = nil
518	m.alpnProtocols = nil
519	m.extendedMasterSecret = false
520	m.customExtension = ""
521
522	if len(data) == 0 {
523		// ClientHello is optionally followed by extension data
524		return true
525	}
526	if len(data) < 2 {
527		return false
528	}
529
530	extensionsLength := int(data[0])<<8 | int(data[1])
531	data = data[2:]
532	if extensionsLength != len(data) {
533		return false
534	}
535
536	for len(data) != 0 {
537		if len(data) < 4 {
538			return false
539		}
540		extension := uint16(data[0])<<8 | uint16(data[1])
541		length := int(data[2])<<8 | int(data[3])
542		data = data[4:]
543		if len(data) < length {
544			return false
545		}
546
547		switch extension {
548		case extensionServerName:
549			if length < 2 {
550				return false
551			}
552			numNames := int(data[0])<<8 | int(data[1])
553			d := data[2:]
554			for i := 0; i < numNames; i++ {
555				if len(d) < 3 {
556					return false
557				}
558				nameType := d[0]
559				nameLen := int(d[1])<<8 | int(d[2])
560				d = d[3:]
561				if len(d) < nameLen {
562					return false
563				}
564				if nameType == 0 {
565					m.serverName = string(d[0:nameLen])
566					break
567				}
568				d = d[nameLen:]
569			}
570		case extensionNextProtoNeg:
571			if length > 0 {
572				return false
573			}
574			m.nextProtoNeg = true
575		case extensionStatusRequest:
576			m.ocspStapling = length > 0 && data[0] == statusTypeOCSP
577		case extensionSupportedCurves:
578			// http://tools.ietf.org/html/rfc4492#section-5.5.1
579			if length < 2 {
580				return false
581			}
582			l := int(data[0])<<8 | int(data[1])
583			if l%2 == 1 || length != l+2 {
584				return false
585			}
586			numCurves := l / 2
587			m.supportedCurves = make([]CurveID, numCurves)
588			d := data[2:]
589			for i := 0; i < numCurves; i++ {
590				m.supportedCurves[i] = CurveID(d[0])<<8 | CurveID(d[1])
591				d = d[2:]
592			}
593		case extensionSupportedPoints:
594			// http://tools.ietf.org/html/rfc4492#section-5.5.2
595			if length < 1 {
596				return false
597			}
598			l := int(data[0])
599			if length != l+1 {
600				return false
601			}
602			m.supportedPoints = data[1 : 1+l]
603		case extensionSessionTicket:
604			// http://tools.ietf.org/html/rfc5077#section-3.2
605			m.ticketSupported = true
606			m.sessionTicket = data[:length]
607		case extensionKeyShare:
608			// draft-ietf-tls-tls13 section 6.3.2.3
609			if length < 2 {
610				return false
611			}
612			l := int(data[0])<<8 | int(data[1])
613			if l != length-2 {
614				return false
615			}
616			d := data[2:length]
617			m.hasKeyShares = true
618			for len(d) > 0 {
619				// The next KeyShareEntry contains a NamedGroup (2 bytes) and a
620				// key_exchange (2-byte length prefix with at least 1 byte of content).
621				if len(d) < 5 {
622					return false
623				}
624				entry := keyShareEntry{}
625				entry.group = CurveID(d[0])<<8 | CurveID(d[1])
626				keyExchLen := int(d[2])<<8 | int(d[3])
627				d = d[4:]
628				if len(d) < keyExchLen {
629					return false
630				}
631				entry.keyExchange = d[:keyExchLen]
632				d = d[keyExchLen:]
633				m.keyShares = append(m.keyShares, entry)
634			}
635		case extensionPreSharedKey:
636			// draft-ietf-tls-tls13-18 section 4.2.6
637			if length < 2 {
638				return false
639			}
640			l := int(data[0])<<8 | int(data[1])
641			d := data[2 : l+2]
642			// Parse PSK identities.
643			for len(d) > 0 {
644				if len(d) < 2 {
645					return false
646				}
647				pskLen := int(d[0])<<8 | int(d[1])
648				d = d[2:]
649
650				if len(d) < pskLen+4 {
651					return false
652				}
653				ticket := d[:pskLen]
654				obfuscatedTicketAge := uint32(d[pskLen])<<24 | uint32(d[pskLen+1])<<16 | uint32(d[pskLen+2])<<8 | uint32(d[pskLen+3])
655				psk := pskIdentity{
656					ticket:              ticket,
657					obfuscatedTicketAge: obfuscatedTicketAge,
658				}
659				m.pskIdentities = append(m.pskIdentities, psk)
660				d = d[pskLen+4:]
661			}
662			d = data[l+2:]
663			if len(d) < 2 {
664				return false
665			}
666			l = int(d[0])<<8 | int(d[1])
667			d = d[2:]
668			if l != len(d) {
669				return false
670			}
671			// Parse PSK binders.
672			for len(d) > 0 {
673				if len(d) < 1 {
674					return false
675				}
676				binderLen := int(d[0])
677				d = d[1:]
678				if binderLen > len(d) {
679					return false
680				}
681				m.pskBinders = append(m.pskBinders, d[:binderLen])
682				d = d[binderLen:]
683			}
684
685			// There must be the same number of identities as binders.
686			if len(m.pskIdentities) != len(m.pskBinders) {
687				return false
688			}
689		case extensionPSKKeyExchangeModes:
690			// draft-ietf-tls-tls13-18 section 4.2.7
691			if length < 1 {
692				return false
693			}
694			l := int(data[0])
695			if l != length-1 {
696				return false
697			}
698			m.pskKEModes = data[1:length]
699		case extensionEarlyData:
700			// draft-ietf-tls-tls13 section 6.3.2.5
701			if length != 0 {
702				return false
703			}
704			m.hasEarlyData = true
705		case extensionCookie:
706			if length < 2 {
707				return false
708			}
709			l := int(data[0])<<8 | int(data[1])
710			if l != length-2 || l == 0 {
711				return false
712			}
713			m.tls13Cookie = data[2 : 2+l]
714		case extensionSignatureAlgorithms:
715			// https://tools.ietf.org/html/rfc5246#section-7.4.1.4.1
716			if length < 2 || length&1 != 0 {
717				return false
718			}
719			l := int(data[0])<<8 | int(data[1])
720			if l != length-2 {
721				return false
722			}
723			n := l / 2
724			d := data[2:]
725			m.signatureAlgorithms = make([]signatureAlgorithm, n)
726			for i := range m.signatureAlgorithms {
727				m.signatureAlgorithms[i] = signatureAlgorithm(d[0])<<8 | signatureAlgorithm(d[1])
728				d = d[2:]
729			}
730		case extensionSupportedVersions:
731			if length < 1+2 {
732				return false
733			}
734			l := int(data[0])
735			if l != length-1 || l%2 == 1 || l < 2 {
736				return false
737			}
738			n := l / 2
739			d := data[1:]
740			m.supportedVersions = make([]uint16, n)
741			for i := range m.supportedVersions {
742				m.supportedVersions[i] = uint16(d[0])<<8 | uint16(d[1])
743				d = d[2:]
744			}
745		case extensionRenegotiationInfo:
746			if length < 1 || length != int(data[0])+1 {
747				return false
748			}
749			m.secureRenegotiation = data[1:length]
750		case extensionALPN:
751			if length < 2 {
752				return false
753			}
754			l := int(data[0])<<8 | int(data[1])
755			if l != length-2 {
756				return false
757			}
758			d := data[2:length]
759			for len(d) != 0 {
760				stringLen := int(d[0])
761				d = d[1:]
762				if stringLen == 0 || stringLen > len(d) {
763					return false
764				}
765				m.alpnProtocols = append(m.alpnProtocols, string(d[:stringLen]))
766				d = d[stringLen:]
767			}
768		case extensionChannelID:
769			if length > 0 {
770				return false
771			}
772			m.channelIDSupported = true
773		case extensionExtendedMasterSecret:
774			if length != 0 {
775				return false
776			}
777			m.extendedMasterSecret = true
778		case extensionUseSRTP:
779			if length < 2 {
780				return false
781			}
782			l := int(data[0])<<8 | int(data[1])
783			if l > length-2 || l%2 != 0 {
784				return false
785			}
786			n := l / 2
787			m.srtpProtectionProfiles = make([]uint16, n)
788			d := data[2:length]
789			for i := 0; i < n; i++ {
790				m.srtpProtectionProfiles[i] = uint16(d[0])<<8 | uint16(d[1])
791				d = d[2:]
792			}
793			if len(d) < 1 || int(d[0]) != len(d)-1 {
794				return false
795			}
796			m.srtpMasterKeyIdentifier = string(d[1:])
797		case extensionSignedCertificateTimestamp:
798			if length != 0 {
799				return false
800			}
801			m.sctListSupported = true
802		case extensionCustom:
803			m.customExtension = string(data[:length])
804		}
805		data = data[length:]
806
807		if isGREASEValue(extension) {
808			m.hasGREASEExtension = true
809		}
810	}
811
812	return true
813}
814
815type serverHelloMsg struct {
816	raw               []byte
817	isDTLS            bool
818	vers              uint16
819	versOverride      uint16
820	random            []byte
821	sessionId         []byte
822	cipherSuite       uint16
823	hasKeyShare       bool
824	keyShare          keyShareEntry
825	hasPSKIdentity    bool
826	pskIdentity       uint16
827	compressionMethod uint8
828	customExtension   string
829	unencryptedALPN   string
830	extensions        serverExtensions
831}
832
833func (m *serverHelloMsg) marshal() []byte {
834	if m.raw != nil {
835		return m.raw
836	}
837
838	handshakeMsg := newByteBuilder()
839	handshakeMsg.addU8(typeServerHello)
840	hello := handshakeMsg.addU24LengthPrefixed()
841
842	// m.vers is used both to determine the format of the rest of the
843	// ServerHello and to override the value, so include a second version
844	// field.
845	vers, ok := wireToVersion(m.vers, m.isDTLS)
846	if !ok {
847		panic("unknown version")
848	}
849	if m.versOverride != 0 {
850		hello.addU16(m.versOverride)
851	} else {
852		hello.addU16(m.vers)
853	}
854
855	hello.addBytes(m.random)
856	if vers < VersionTLS13 {
857		sessionId := hello.addU8LengthPrefixed()
858		sessionId.addBytes(m.sessionId)
859	}
860	hello.addU16(m.cipherSuite)
861	if vers < VersionTLS13 {
862		hello.addU8(m.compressionMethod)
863	}
864
865	extensions := hello.addU16LengthPrefixed()
866
867	if vers >= VersionTLS13 {
868		if m.hasKeyShare {
869			extensions.addU16(extensionKeyShare)
870			keyShare := extensions.addU16LengthPrefixed()
871			keyShare.addU16(uint16(m.keyShare.group))
872			keyExchange := keyShare.addU16LengthPrefixed()
873			keyExchange.addBytes(m.keyShare.keyExchange)
874		}
875		if m.hasPSKIdentity {
876			extensions.addU16(extensionPreSharedKey)
877			extensions.addU16(2) // Length
878			extensions.addU16(m.pskIdentity)
879		}
880		if len(m.customExtension) > 0 {
881			extensions.addU16(extensionCustom)
882			customExt := extensions.addU16LengthPrefixed()
883			customExt.addBytes([]byte(m.customExtension))
884		}
885		if len(m.unencryptedALPN) > 0 {
886			extensions.addU16(extensionALPN)
887			extension := extensions.addU16LengthPrefixed()
888
889			protocolNameList := extension.addU16LengthPrefixed()
890			protocolName := protocolNameList.addU8LengthPrefixed()
891			protocolName.addBytes([]byte(m.unencryptedALPN))
892		}
893	} else {
894		m.extensions.marshal(extensions)
895		if extensions.len() == 0 {
896			hello.discardChild()
897		}
898	}
899
900	m.raw = handshakeMsg.finish()
901	return m.raw
902}
903
904func (m *serverHelloMsg) unmarshal(data []byte) bool {
905	if len(data) < 42 {
906		return false
907	}
908	m.raw = data
909	m.vers = uint16(data[4])<<8 | uint16(data[5])
910	vers, ok := wireToVersion(m.vers, m.isDTLS)
911	if !ok {
912		return false
913	}
914	m.random = data[6:38]
915	data = data[38:]
916	if vers < VersionTLS13 {
917		sessionIdLen := int(data[0])
918		if sessionIdLen > 32 || len(data) < 1+sessionIdLen {
919			return false
920		}
921		m.sessionId = data[1 : 1+sessionIdLen]
922		data = data[1+sessionIdLen:]
923	}
924	if len(data) < 2 {
925		return false
926	}
927	m.cipherSuite = uint16(data[0])<<8 | uint16(data[1])
928	data = data[2:]
929	if vers < VersionTLS13 {
930		if len(data) < 1 {
931			return false
932		}
933		m.compressionMethod = data[0]
934		data = data[1:]
935	}
936
937	if len(data) == 0 && m.vers < VersionTLS13 {
938		// Extension data is optional before TLS 1.3.
939		m.extensions = serverExtensions{}
940		return true
941	}
942	if len(data) < 2 {
943		return false
944	}
945
946	extensionsLength := int(data[0])<<8 | int(data[1])
947	data = data[2:]
948	if len(data) != extensionsLength {
949		return false
950	}
951
952	if vers >= VersionTLS13 {
953		for len(data) != 0 {
954			if len(data) < 4 {
955				return false
956			}
957			extension := uint16(data[0])<<8 | uint16(data[1])
958			length := int(data[2])<<8 | int(data[3])
959			data = data[4:]
960
961			if len(data) < length {
962				return false
963			}
964			d := data[:length]
965			data = data[length:]
966
967			switch extension {
968			case extensionKeyShare:
969				m.hasKeyShare = true
970				if len(d) < 4 {
971					return false
972				}
973				m.keyShare.group = CurveID(uint16(d[0])<<8 | uint16(d[1]))
974				keyExchLen := int(d[2])<<8 | int(d[3])
975				if keyExchLen != len(d)-4 {
976					return false
977				}
978				m.keyShare.keyExchange = make([]byte, keyExchLen)
979				copy(m.keyShare.keyExchange, d[4:])
980			case extensionPreSharedKey:
981				if len(d) != 2 {
982					return false
983				}
984				m.pskIdentity = uint16(d[0])<<8 | uint16(d[1])
985				m.hasPSKIdentity = true
986			default:
987				// Only allow the 3 extensions that are sent in
988				// the clear in TLS 1.3.
989				return false
990			}
991		}
992	} else if !m.extensions.unmarshal(data, vers) {
993		return false
994	}
995
996	return true
997}
998
999type encryptedExtensionsMsg struct {
1000	raw        []byte
1001	extensions serverExtensions
1002	empty      bool
1003}
1004
1005func (m *encryptedExtensionsMsg) marshal() []byte {
1006	if m.raw != nil {
1007		return m.raw
1008	}
1009
1010	encryptedExtensionsMsg := newByteBuilder()
1011	encryptedExtensionsMsg.addU8(typeEncryptedExtensions)
1012	encryptedExtensions := encryptedExtensionsMsg.addU24LengthPrefixed()
1013	if !m.empty {
1014		extensions := encryptedExtensions.addU16LengthPrefixed()
1015		m.extensions.marshal(extensions)
1016	}
1017
1018	m.raw = encryptedExtensionsMsg.finish()
1019	return m.raw
1020}
1021
1022func (m *encryptedExtensionsMsg) unmarshal(data []byte) bool {
1023	m.raw = data
1024	if len(data) < 6 {
1025		return false
1026	}
1027	if data[0] != typeEncryptedExtensions {
1028		return false
1029	}
1030	msgLen := int(data[1])<<16 | int(data[2])<<8 | int(data[3])
1031	data = data[4:]
1032	if len(data) != msgLen {
1033		return false
1034	}
1035	extLen := int(data[0])<<8 | int(data[1])
1036	data = data[2:]
1037	if extLen != len(data) {
1038		return false
1039	}
1040	return m.extensions.unmarshal(data, VersionTLS13)
1041}
1042
1043type serverExtensions struct {
1044	nextProtoNeg            bool
1045	nextProtos              []string
1046	ocspStapling            bool
1047	ticketSupported         bool
1048	secureRenegotiation     []byte
1049	alpnProtocol            string
1050	alpnProtocolEmpty       bool
1051	duplicateExtension      bool
1052	channelIDRequested      bool
1053	extendedMasterSecret    bool
1054	srtpProtectionProfile   uint16
1055	srtpMasterKeyIdentifier string
1056	sctList                 []byte
1057	customExtension         string
1058	npnAfterAlpn            bool
1059	hasKeyShare             bool
1060	hasEarlyData            bool
1061	keyShare                keyShareEntry
1062	supportedPoints         []uint8
1063	serverNameAck           bool
1064}
1065
1066func (m *serverExtensions) marshal(extensions *byteBuilder) {
1067	if m.duplicateExtension {
1068		// Add a duplicate bogus extension at the beginning and end.
1069		extensions.addU16(0xffff)
1070		extensions.addU16(0) // length = 0 for empty extension
1071	}
1072	if m.nextProtoNeg && !m.npnAfterAlpn {
1073		extensions.addU16(extensionNextProtoNeg)
1074		extension := extensions.addU16LengthPrefixed()
1075
1076		for _, v := range m.nextProtos {
1077			if len(v) > 255 {
1078				v = v[:255]
1079			}
1080			npn := extension.addU8LengthPrefixed()
1081			npn.addBytes([]byte(v))
1082		}
1083	}
1084	if m.ocspStapling {
1085		extensions.addU16(extensionStatusRequest)
1086		extensions.addU16(0)
1087	}
1088	if m.ticketSupported {
1089		extensions.addU16(extensionSessionTicket)
1090		extensions.addU16(0)
1091	}
1092	if m.secureRenegotiation != nil {
1093		extensions.addU16(extensionRenegotiationInfo)
1094		extension := extensions.addU16LengthPrefixed()
1095		secureRenego := extension.addU8LengthPrefixed()
1096		secureRenego.addBytes(m.secureRenegotiation)
1097	}
1098	if len(m.alpnProtocol) > 0 || m.alpnProtocolEmpty {
1099		extensions.addU16(extensionALPN)
1100		extension := extensions.addU16LengthPrefixed()
1101
1102		protocolNameList := extension.addU16LengthPrefixed()
1103		protocolName := protocolNameList.addU8LengthPrefixed()
1104		protocolName.addBytes([]byte(m.alpnProtocol))
1105	}
1106	if m.channelIDRequested {
1107		extensions.addU16(extensionChannelID)
1108		extensions.addU16(0)
1109	}
1110	if m.duplicateExtension {
1111		// Add a duplicate bogus extension at the beginning and end.
1112		extensions.addU16(0xffff)
1113		extensions.addU16(0)
1114	}
1115	if m.extendedMasterSecret {
1116		extensions.addU16(extensionExtendedMasterSecret)
1117		extensions.addU16(0)
1118	}
1119	if m.srtpProtectionProfile != 0 {
1120		extensions.addU16(extensionUseSRTP)
1121		extension := extensions.addU16LengthPrefixed()
1122
1123		srtpProtectionProfiles := extension.addU16LengthPrefixed()
1124		srtpProtectionProfiles.addU8(byte(m.srtpProtectionProfile >> 8))
1125		srtpProtectionProfiles.addU8(byte(m.srtpProtectionProfile))
1126		srtpMki := extension.addU8LengthPrefixed()
1127		srtpMki.addBytes([]byte(m.srtpMasterKeyIdentifier))
1128	}
1129	if m.sctList != nil {
1130		extensions.addU16(extensionSignedCertificateTimestamp)
1131		extension := extensions.addU16LengthPrefixed()
1132		extension.addBytes(m.sctList)
1133	}
1134	if l := len(m.customExtension); l > 0 {
1135		extensions.addU16(extensionCustom)
1136		customExt := extensions.addU16LengthPrefixed()
1137		customExt.addBytes([]byte(m.customExtension))
1138	}
1139	if m.nextProtoNeg && m.npnAfterAlpn {
1140		extensions.addU16(extensionNextProtoNeg)
1141		extension := extensions.addU16LengthPrefixed()
1142
1143		for _, v := range m.nextProtos {
1144			if len(v) > 255 {
1145				v = v[0:255]
1146			}
1147			npn := extension.addU8LengthPrefixed()
1148			npn.addBytes([]byte(v))
1149		}
1150	}
1151	if m.hasKeyShare {
1152		extensions.addU16(extensionKeyShare)
1153		keyShare := extensions.addU16LengthPrefixed()
1154		keyShare.addU16(uint16(m.keyShare.group))
1155		keyExchange := keyShare.addU16LengthPrefixed()
1156		keyExchange.addBytes(m.keyShare.keyExchange)
1157	}
1158	if len(m.supportedPoints) > 0 {
1159		// http://tools.ietf.org/html/rfc4492#section-5.1.2
1160		extensions.addU16(extensionSupportedPoints)
1161		supportedPointsList := extensions.addU16LengthPrefixed()
1162		supportedPoints := supportedPointsList.addU8LengthPrefixed()
1163		supportedPoints.addBytes(m.supportedPoints)
1164	}
1165	if m.hasEarlyData {
1166		extensions.addU16(extensionEarlyData)
1167		extensions.addBytes([]byte{0, 0})
1168	}
1169	if m.serverNameAck {
1170		extensions.addU16(extensionServerName)
1171		extensions.addU16(0) // zero length
1172	}
1173}
1174
1175func (m *serverExtensions) unmarshal(data []byte, version uint16) bool {
1176	// Reset all fields.
1177	*m = serverExtensions{}
1178
1179	for len(data) != 0 {
1180		if len(data) < 4 {
1181			return false
1182		}
1183		extension := uint16(data[0])<<8 | uint16(data[1])
1184		length := int(data[2])<<8 | int(data[3])
1185		data = data[4:]
1186		if len(data) < length {
1187			return false
1188		}
1189
1190		switch extension {
1191		case extensionNextProtoNeg:
1192			m.nextProtoNeg = true
1193			d := data[:length]
1194			for len(d) > 0 {
1195				l := int(d[0])
1196				d = d[1:]
1197				if l == 0 || l > len(d) {
1198					return false
1199				}
1200				m.nextProtos = append(m.nextProtos, string(d[:l]))
1201				d = d[l:]
1202			}
1203		case extensionStatusRequest:
1204			if length > 0 {
1205				return false
1206			}
1207			m.ocspStapling = true
1208		case extensionSessionTicket:
1209			if length > 0 {
1210				return false
1211			}
1212			m.ticketSupported = true
1213		case extensionRenegotiationInfo:
1214			if length < 1 || length != int(data[0])+1 {
1215				return false
1216			}
1217			m.secureRenegotiation = data[1:length]
1218		case extensionALPN:
1219			d := data[:length]
1220			if len(d) < 3 {
1221				return false
1222			}
1223			l := int(d[0])<<8 | int(d[1])
1224			if l != len(d)-2 {
1225				return false
1226			}
1227			d = d[2:]
1228			l = int(d[0])
1229			if l != len(d)-1 {
1230				return false
1231			}
1232			d = d[1:]
1233			m.alpnProtocol = string(d)
1234			m.alpnProtocolEmpty = len(d) == 0
1235		case extensionChannelID:
1236			if length > 0 {
1237				return false
1238			}
1239			m.channelIDRequested = true
1240		case extensionExtendedMasterSecret:
1241			if length != 0 {
1242				return false
1243			}
1244			m.extendedMasterSecret = true
1245		case extensionUseSRTP:
1246			if length < 2+2+1 {
1247				return false
1248			}
1249			if data[0] != 0 || data[1] != 2 {
1250				return false
1251			}
1252			m.srtpProtectionProfile = uint16(data[2])<<8 | uint16(data[3])
1253			d := data[4:length]
1254			l := int(d[0])
1255			if l != len(d)-1 {
1256				return false
1257			}
1258			m.srtpMasterKeyIdentifier = string(d[1:])
1259		case extensionSignedCertificateTimestamp:
1260			m.sctList = data[:length]
1261		case extensionCustom:
1262			m.customExtension = string(data[:length])
1263		case extensionServerName:
1264			if length != 0 {
1265				return false
1266			}
1267			m.serverNameAck = true
1268		case extensionSupportedPoints:
1269			// supported_points is illegal in TLS 1.3.
1270			if version >= VersionTLS13 {
1271				return false
1272			}
1273			// http://tools.ietf.org/html/rfc4492#section-5.5.2
1274			if length < 1 {
1275				return false
1276			}
1277			l := int(data[0])
1278			if length != l+1 {
1279				return false
1280			}
1281			m.supportedPoints = data[1 : 1+l]
1282		case extensionSupportedCurves:
1283			// The server can only send supported_curves in TLS 1.3.
1284			if version < VersionTLS13 {
1285				return false
1286			}
1287		case extensionEarlyData:
1288			if version < VersionTLS13 || length != 0 {
1289				return false
1290			}
1291			m.hasEarlyData = true
1292		default:
1293			// Unknown extensions are illegal from the server.
1294			return false
1295		}
1296		data = data[length:]
1297	}
1298
1299	return true
1300}
1301
1302type helloRetryRequestMsg struct {
1303	raw                 []byte
1304	vers                uint16
1305	hasSelectedGroup    bool
1306	selectedGroup       CurveID
1307	cookie              []byte
1308	customExtension     string
1309	duplicateExtensions bool
1310}
1311
1312func (m *helloRetryRequestMsg) marshal() []byte {
1313	if m.raw != nil {
1314		return m.raw
1315	}
1316
1317	retryRequestMsg := newByteBuilder()
1318	retryRequestMsg.addU8(typeHelloRetryRequest)
1319	retryRequest := retryRequestMsg.addU24LengthPrefixed()
1320	retryRequest.addU16(m.vers)
1321	extensions := retryRequest.addU16LengthPrefixed()
1322
1323	count := 1
1324	if m.duplicateExtensions {
1325		count = 2
1326	}
1327
1328	for i := 0; i < count; i++ {
1329		if m.hasSelectedGroup {
1330			extensions.addU16(extensionKeyShare)
1331			extensions.addU16(2) // length
1332			extensions.addU16(uint16(m.selectedGroup))
1333		}
1334		if len(m.cookie) > 0 {
1335			extensions.addU16(extensionCookie)
1336			body := extensions.addU16LengthPrefixed()
1337			body.addU16LengthPrefixed().addBytes(m.cookie)
1338		}
1339		if len(m.customExtension) > 0 {
1340			extensions.addU16(extensionCustom)
1341			extensions.addU16LengthPrefixed().addBytes([]byte(m.customExtension))
1342		}
1343	}
1344
1345	m.raw = retryRequestMsg.finish()
1346	return m.raw
1347}
1348
1349func (m *helloRetryRequestMsg) unmarshal(data []byte) bool {
1350	m.raw = data
1351	if len(data) < 8 {
1352		return false
1353	}
1354	m.vers = uint16(data[4])<<8 | uint16(data[5])
1355	extLen := int(data[6])<<8 | int(data[7])
1356	data = data[8:]
1357	if len(data) != extLen || len(data) == 0 {
1358		return false
1359	}
1360	for len(data) > 0 {
1361		if len(data) < 4 {
1362			return false
1363		}
1364		extension := uint16(data[0])<<8 | uint16(data[1])
1365		length := int(data[2])<<8 | int(data[3])
1366		data = data[4:]
1367		if len(data) < length {
1368			return false
1369		}
1370
1371		switch extension {
1372		case extensionKeyShare:
1373			if length != 2 {
1374				return false
1375			}
1376			m.hasSelectedGroup = true
1377			m.selectedGroup = CurveID(data[0])<<8 | CurveID(data[1])
1378		case extensionCookie:
1379			if length < 2 {
1380				return false
1381			}
1382			cookieLen := int(data[0])<<8 | int(data[1])
1383			if 2+cookieLen != length {
1384				return false
1385			}
1386			m.cookie = data[2 : 2+cookieLen]
1387		default:
1388			// Unknown extensions are illegal from the server.
1389			return false
1390		}
1391		data = data[length:]
1392	}
1393	return true
1394}
1395
1396type certificateEntry struct {
1397	data                []byte
1398	ocspResponse        []byte
1399	sctList             []byte
1400	duplicateExtensions bool
1401	extraExtension      []byte
1402}
1403
1404type certificateMsg struct {
1405	raw               []byte
1406	hasRequestContext bool
1407	requestContext    []byte
1408	certificates      []certificateEntry
1409}
1410
1411func (m *certificateMsg) marshal() (x []byte) {
1412	if m.raw != nil {
1413		return m.raw
1414	}
1415
1416	certMsg := newByteBuilder()
1417	certMsg.addU8(typeCertificate)
1418	certificate := certMsg.addU24LengthPrefixed()
1419	if m.hasRequestContext {
1420		context := certificate.addU8LengthPrefixed()
1421		context.addBytes(m.requestContext)
1422	}
1423	certificateList := certificate.addU24LengthPrefixed()
1424	for _, cert := range m.certificates {
1425		certEntry := certificateList.addU24LengthPrefixed()
1426		certEntry.addBytes(cert.data)
1427		if m.hasRequestContext {
1428			extensions := certificateList.addU16LengthPrefixed()
1429			count := 1
1430			if cert.duplicateExtensions {
1431				count = 2
1432			}
1433
1434			for i := 0; i < count; i++ {
1435				if cert.ocspResponse != nil {
1436					extensions.addU16(extensionStatusRequest)
1437					body := extensions.addU16LengthPrefixed()
1438					body.addU8(statusTypeOCSP)
1439					response := body.addU24LengthPrefixed()
1440					response.addBytes(cert.ocspResponse)
1441				}
1442
1443				if cert.sctList != nil {
1444					extensions.addU16(extensionSignedCertificateTimestamp)
1445					extension := extensions.addU16LengthPrefixed()
1446					extension.addBytes(cert.sctList)
1447				}
1448			}
1449			if cert.extraExtension != nil {
1450				extensions.addBytes(cert.extraExtension)
1451			}
1452		}
1453	}
1454
1455	m.raw = certMsg.finish()
1456	return m.raw
1457}
1458
1459func (m *certificateMsg) unmarshal(data []byte) bool {
1460	if len(data) < 4 {
1461		return false
1462	}
1463
1464	m.raw = data
1465	data = data[4:]
1466
1467	if m.hasRequestContext {
1468		if len(data) == 0 {
1469			return false
1470		}
1471		contextLen := int(data[0])
1472		if len(data) < 1+contextLen {
1473			return false
1474		}
1475		m.requestContext = make([]byte, contextLen)
1476		copy(m.requestContext, data[1:])
1477		data = data[1+contextLen:]
1478	}
1479
1480	if len(data) < 3 {
1481		return false
1482	}
1483	certsLen := int(data[0])<<16 | int(data[1])<<8 | int(data[2])
1484	data = data[3:]
1485	if len(data) != certsLen {
1486		return false
1487	}
1488
1489	m.certificates = nil
1490	for len(data) != 0 {
1491		if len(data) < 3 {
1492			return false
1493		}
1494		certLen := int(data[0])<<16 | int(data[1])<<8 | int(data[2])
1495		if len(data) < 3+certLen {
1496			return false
1497		}
1498		cert := certificateEntry{
1499			data: data[3 : 3+certLen],
1500		}
1501		data = data[3+certLen:]
1502		if m.hasRequestContext {
1503			if len(data) < 2 {
1504				return false
1505			}
1506			extensionsLen := int(data[0])<<8 | int(data[1])
1507			if len(data) < 2+extensionsLen {
1508				return false
1509			}
1510			extensions := data[2 : 2+extensionsLen]
1511			data = data[2+extensionsLen:]
1512			for len(extensions) != 0 {
1513				if len(extensions) < 4 {
1514					return false
1515				}
1516				extension := uint16(extensions[0])<<8 | uint16(extensions[1])
1517				length := int(extensions[2])<<8 | int(extensions[3])
1518				if len(extensions) < 4+length {
1519					return false
1520				}
1521				contents := extensions[4 : 4+length]
1522				extensions = extensions[4+length:]
1523
1524				switch extension {
1525				case extensionStatusRequest:
1526					if length < 4 {
1527						return false
1528					}
1529					if contents[0] != statusTypeOCSP {
1530						return false
1531					}
1532					respLen := int(contents[1])<<16 | int(contents[2])<<8 | int(contents[3])
1533					if respLen+4 != len(contents) || respLen == 0 {
1534						return false
1535					}
1536					cert.ocspResponse = contents[4:]
1537				case extensionSignedCertificateTimestamp:
1538					cert.sctList = contents
1539				default:
1540					return false
1541				}
1542			}
1543		}
1544		m.certificates = append(m.certificates, cert)
1545	}
1546
1547	return true
1548}
1549
1550type serverKeyExchangeMsg struct {
1551	raw []byte
1552	key []byte
1553}
1554
1555func (m *serverKeyExchangeMsg) marshal() []byte {
1556	if m.raw != nil {
1557		return m.raw
1558	}
1559	length := len(m.key)
1560	x := make([]byte, length+4)
1561	x[0] = typeServerKeyExchange
1562	x[1] = uint8(length >> 16)
1563	x[2] = uint8(length >> 8)
1564	x[3] = uint8(length)
1565	copy(x[4:], m.key)
1566
1567	m.raw = x
1568	return x
1569}
1570
1571func (m *serverKeyExchangeMsg) unmarshal(data []byte) bool {
1572	m.raw = data
1573	if len(data) < 4 {
1574		return false
1575	}
1576	m.key = data[4:]
1577	return true
1578}
1579
1580type certificateStatusMsg struct {
1581	raw        []byte
1582	statusType uint8
1583	response   []byte
1584}
1585
1586func (m *certificateStatusMsg) marshal() []byte {
1587	if m.raw != nil {
1588		return m.raw
1589	}
1590
1591	var x []byte
1592	if m.statusType == statusTypeOCSP {
1593		x = make([]byte, 4+4+len(m.response))
1594		x[0] = typeCertificateStatus
1595		l := len(m.response) + 4
1596		x[1] = byte(l >> 16)
1597		x[2] = byte(l >> 8)
1598		x[3] = byte(l)
1599		x[4] = statusTypeOCSP
1600
1601		l -= 4
1602		x[5] = byte(l >> 16)
1603		x[6] = byte(l >> 8)
1604		x[7] = byte(l)
1605		copy(x[8:], m.response)
1606	} else {
1607		x = []byte{typeCertificateStatus, 0, 0, 1, m.statusType}
1608	}
1609
1610	m.raw = x
1611	return x
1612}
1613
1614func (m *certificateStatusMsg) unmarshal(data []byte) bool {
1615	m.raw = data
1616	if len(data) < 5 {
1617		return false
1618	}
1619	m.statusType = data[4]
1620
1621	m.response = nil
1622	if m.statusType == statusTypeOCSP {
1623		if len(data) < 8 {
1624			return false
1625		}
1626		respLen := uint32(data[5])<<16 | uint32(data[6])<<8 | uint32(data[7])
1627		if uint32(len(data)) != 4+4+respLen {
1628			return false
1629		}
1630		m.response = data[8:]
1631	}
1632	return true
1633}
1634
1635type serverHelloDoneMsg struct{}
1636
1637func (m *serverHelloDoneMsg) marshal() []byte {
1638	x := make([]byte, 4)
1639	x[0] = typeServerHelloDone
1640	return x
1641}
1642
1643func (m *serverHelloDoneMsg) unmarshal(data []byte) bool {
1644	return len(data) == 4
1645}
1646
1647type clientKeyExchangeMsg struct {
1648	raw        []byte
1649	ciphertext []byte
1650}
1651
1652func (m *clientKeyExchangeMsg) marshal() []byte {
1653	if m.raw != nil {
1654		return m.raw
1655	}
1656	length := len(m.ciphertext)
1657	x := make([]byte, length+4)
1658	x[0] = typeClientKeyExchange
1659	x[1] = uint8(length >> 16)
1660	x[2] = uint8(length >> 8)
1661	x[3] = uint8(length)
1662	copy(x[4:], m.ciphertext)
1663
1664	m.raw = x
1665	return x
1666}
1667
1668func (m *clientKeyExchangeMsg) unmarshal(data []byte) bool {
1669	m.raw = data
1670	if len(data) < 4 {
1671		return false
1672	}
1673	l := int(data[1])<<16 | int(data[2])<<8 | int(data[3])
1674	if l != len(data)-4 {
1675		return false
1676	}
1677	m.ciphertext = data[4:]
1678	return true
1679}
1680
1681type finishedMsg struct {
1682	raw        []byte
1683	verifyData []byte
1684}
1685
1686func (m *finishedMsg) marshal() (x []byte) {
1687	if m.raw != nil {
1688		return m.raw
1689	}
1690
1691	x = make([]byte, 4+len(m.verifyData))
1692	x[0] = typeFinished
1693	x[3] = byte(len(m.verifyData))
1694	copy(x[4:], m.verifyData)
1695	m.raw = x
1696	return
1697}
1698
1699func (m *finishedMsg) unmarshal(data []byte) bool {
1700	m.raw = data
1701	if len(data) < 4 {
1702		return false
1703	}
1704	m.verifyData = data[4:]
1705	return true
1706}
1707
1708type nextProtoMsg struct {
1709	raw   []byte
1710	proto string
1711}
1712
1713func (m *nextProtoMsg) marshal() []byte {
1714	if m.raw != nil {
1715		return m.raw
1716	}
1717	l := len(m.proto)
1718	if l > 255 {
1719		l = 255
1720	}
1721
1722	padding := 32 - (l+2)%32
1723	length := l + padding + 2
1724	x := make([]byte, length+4)
1725	x[0] = typeNextProtocol
1726	x[1] = uint8(length >> 16)
1727	x[2] = uint8(length >> 8)
1728	x[3] = uint8(length)
1729
1730	y := x[4:]
1731	y[0] = byte(l)
1732	copy(y[1:], []byte(m.proto[0:l]))
1733	y = y[1+l:]
1734	y[0] = byte(padding)
1735
1736	m.raw = x
1737
1738	return x
1739}
1740
1741func (m *nextProtoMsg) unmarshal(data []byte) bool {
1742	m.raw = data
1743
1744	if len(data) < 5 {
1745		return false
1746	}
1747	data = data[4:]
1748	protoLen := int(data[0])
1749	data = data[1:]
1750	if len(data) < protoLen {
1751		return false
1752	}
1753	m.proto = string(data[0:protoLen])
1754	data = data[protoLen:]
1755
1756	if len(data) < 1 {
1757		return false
1758	}
1759	paddingLen := int(data[0])
1760	data = data[1:]
1761	if len(data) != paddingLen {
1762		return false
1763	}
1764
1765	return true
1766}
1767
1768type certificateRequestMsg struct {
1769	raw []byte
1770	// hasSignatureAlgorithm indicates whether this message includes a list
1771	// of signature and hash functions. This change was introduced with TLS
1772	// 1.2.
1773	hasSignatureAlgorithm bool
1774	// hasRequestContext indicates whether this message includes a context
1775	// field instead of certificateTypes. This change was introduced with
1776	// TLS 1.3.
1777	hasRequestContext bool
1778
1779	certificateTypes       []byte
1780	requestContext         []byte
1781	signatureAlgorithms    []signatureAlgorithm
1782	certificateAuthorities [][]byte
1783}
1784
1785func (m *certificateRequestMsg) marshal() []byte {
1786	if m.raw != nil {
1787		return m.raw
1788	}
1789
1790	// See http://tools.ietf.org/html/rfc4346#section-7.4.4
1791	builder := newByteBuilder()
1792	builder.addU8(typeCertificateRequest)
1793	body := builder.addU24LengthPrefixed()
1794
1795	if m.hasRequestContext {
1796		requestContext := body.addU8LengthPrefixed()
1797		requestContext.addBytes(m.requestContext)
1798	} else {
1799		certificateTypes := body.addU8LengthPrefixed()
1800		certificateTypes.addBytes(m.certificateTypes)
1801	}
1802
1803	if m.hasSignatureAlgorithm {
1804		signatureAlgorithms := body.addU16LengthPrefixed()
1805		for _, sigAlg := range m.signatureAlgorithms {
1806			signatureAlgorithms.addU16(uint16(sigAlg))
1807		}
1808	}
1809
1810	certificateAuthorities := body.addU16LengthPrefixed()
1811	for _, ca := range m.certificateAuthorities {
1812		caEntry := certificateAuthorities.addU16LengthPrefixed()
1813		caEntry.addBytes(ca)
1814	}
1815
1816	if m.hasRequestContext {
1817		// Emit no certificate extensions.
1818		body.addU16(0)
1819	}
1820
1821	m.raw = builder.finish()
1822	return m.raw
1823}
1824
1825func (m *certificateRequestMsg) unmarshal(data []byte) bool {
1826	m.raw = data
1827
1828	if len(data) < 5 {
1829		return false
1830	}
1831	data = data[4:]
1832
1833	if m.hasRequestContext {
1834		contextLen := int(data[0])
1835		if len(data) < 1+contextLen {
1836			return false
1837		}
1838		m.requestContext = make([]byte, contextLen)
1839		copy(m.requestContext, data[1:])
1840		data = data[1+contextLen:]
1841	} else {
1842		numCertTypes := int(data[0])
1843		if len(data) < 1+numCertTypes {
1844			return false
1845		}
1846		m.certificateTypes = make([]byte, numCertTypes)
1847		copy(m.certificateTypes, data[1:])
1848		data = data[1+numCertTypes:]
1849	}
1850
1851	if m.hasSignatureAlgorithm {
1852		if len(data) < 2 {
1853			return false
1854		}
1855		sigAlgsLen := uint16(data[0])<<8 | uint16(data[1])
1856		data = data[2:]
1857		if sigAlgsLen&1 != 0 {
1858			return false
1859		}
1860		if len(data) < int(sigAlgsLen) {
1861			return false
1862		}
1863		numSigAlgs := sigAlgsLen / 2
1864		m.signatureAlgorithms = make([]signatureAlgorithm, numSigAlgs)
1865		for i := range m.signatureAlgorithms {
1866			m.signatureAlgorithms[i] = signatureAlgorithm(data[0])<<8 | signatureAlgorithm(data[1])
1867			data = data[2:]
1868		}
1869	}
1870
1871	if len(data) < 2 {
1872		return false
1873	}
1874	casLength := uint16(data[0])<<8 | uint16(data[1])
1875	data = data[2:]
1876	if len(data) < int(casLength) {
1877		return false
1878	}
1879	cas := make([]byte, casLength)
1880	copy(cas, data)
1881	data = data[casLength:]
1882
1883	m.certificateAuthorities = nil
1884	for len(cas) > 0 {
1885		if len(cas) < 2 {
1886			return false
1887		}
1888		caLen := uint16(cas[0])<<8 | uint16(cas[1])
1889		cas = cas[2:]
1890
1891		if len(cas) < int(caLen) {
1892			return false
1893		}
1894
1895		m.certificateAuthorities = append(m.certificateAuthorities, cas[:caLen])
1896		cas = cas[caLen:]
1897	}
1898
1899	if m.hasRequestContext {
1900		// Ignore certificate extensions.
1901		if len(data) < 2 {
1902			return false
1903		}
1904		extsLength := int(data[0])<<8 | int(data[1])
1905		if len(data) < 2+extsLength {
1906			return false
1907		}
1908		data = data[2+extsLength:]
1909	}
1910
1911	if len(data) > 0 {
1912		return false
1913	}
1914
1915	return true
1916}
1917
1918type certificateVerifyMsg struct {
1919	raw                   []byte
1920	hasSignatureAlgorithm bool
1921	signatureAlgorithm    signatureAlgorithm
1922	signature             []byte
1923}
1924
1925func (m *certificateVerifyMsg) marshal() (x []byte) {
1926	if m.raw != nil {
1927		return m.raw
1928	}
1929
1930	// See http://tools.ietf.org/html/rfc4346#section-7.4.8
1931	siglength := len(m.signature)
1932	length := 2 + siglength
1933	if m.hasSignatureAlgorithm {
1934		length += 2
1935	}
1936	x = make([]byte, 4+length)
1937	x[0] = typeCertificateVerify
1938	x[1] = uint8(length >> 16)
1939	x[2] = uint8(length >> 8)
1940	x[3] = uint8(length)
1941	y := x[4:]
1942	if m.hasSignatureAlgorithm {
1943		y[0] = byte(m.signatureAlgorithm >> 8)
1944		y[1] = byte(m.signatureAlgorithm)
1945		y = y[2:]
1946	}
1947	y[0] = uint8(siglength >> 8)
1948	y[1] = uint8(siglength)
1949	copy(y[2:], m.signature)
1950
1951	m.raw = x
1952
1953	return
1954}
1955
1956func (m *certificateVerifyMsg) unmarshal(data []byte) bool {
1957	m.raw = data
1958
1959	if len(data) < 6 {
1960		return false
1961	}
1962
1963	length := uint32(data[1])<<16 | uint32(data[2])<<8 | uint32(data[3])
1964	if uint32(len(data))-4 != length {
1965		return false
1966	}
1967
1968	data = data[4:]
1969	if m.hasSignatureAlgorithm {
1970		m.signatureAlgorithm = signatureAlgorithm(data[0])<<8 | signatureAlgorithm(data[1])
1971		data = data[2:]
1972	}
1973
1974	if len(data) < 2 {
1975		return false
1976	}
1977	siglength := int(data[0])<<8 + int(data[1])
1978	data = data[2:]
1979	if len(data) != siglength {
1980		return false
1981	}
1982
1983	m.signature = data
1984
1985	return true
1986}
1987
1988type newSessionTicketMsg struct {
1989	raw                    []byte
1990	version                uint16
1991	ticketLifetime         uint32
1992	ticketAgeAdd           uint32
1993	ticket                 []byte
1994	maxEarlyDataSize       uint32
1995	customExtension        string
1996	duplicateEarlyDataInfo bool
1997	hasGREASEExtension     bool
1998}
1999
2000func (m *newSessionTicketMsg) marshal() []byte {
2001	if m.raw != nil {
2002		return m.raw
2003	}
2004
2005	// See http://tools.ietf.org/html/rfc5077#section-3.3
2006	ticketMsg := newByteBuilder()
2007	ticketMsg.addU8(typeNewSessionTicket)
2008	body := ticketMsg.addU24LengthPrefixed()
2009	body.addU32(m.ticketLifetime)
2010	if m.version >= VersionTLS13 {
2011		body.addU32(m.ticketAgeAdd)
2012	}
2013
2014	ticket := body.addU16LengthPrefixed()
2015	ticket.addBytes(m.ticket)
2016
2017	if m.version >= VersionTLS13 {
2018		extensions := body.addU16LengthPrefixed()
2019		if m.maxEarlyDataSize > 0 {
2020			extensions.addU16(extensionTicketEarlyDataInfo)
2021			extensions.addU16LengthPrefixed().addU32(m.maxEarlyDataSize)
2022			if m.duplicateEarlyDataInfo {
2023				extensions.addU16(extensionTicketEarlyDataInfo)
2024				extensions.addU16LengthPrefixed().addU32(m.maxEarlyDataSize)
2025			}
2026		}
2027		if len(m.customExtension) > 0 {
2028			extensions.addU16(extensionCustom)
2029			extensions.addU16LengthPrefixed().addBytes([]byte(m.customExtension))
2030		}
2031	}
2032
2033	m.raw = ticketMsg.finish()
2034	return m.raw
2035}
2036
2037func (m *newSessionTicketMsg) unmarshal(data []byte) bool {
2038	m.raw = data
2039
2040	if len(data) < 8 {
2041		return false
2042	}
2043	m.ticketLifetime = uint32(data[4])<<24 | uint32(data[5])<<16 | uint32(data[6])<<8 | uint32(data[7])
2044	data = data[8:]
2045
2046	if m.version >= VersionTLS13 {
2047		if len(data) < 4 {
2048			return false
2049		}
2050		m.ticketAgeAdd = uint32(data[0])<<24 | uint32(data[1])<<16 | uint32(data[2])<<8 | uint32(data[3])
2051		data = data[4:]
2052	}
2053
2054	if len(data) < 2 {
2055		return false
2056	}
2057	ticketLen := int(data[0])<<8 + int(data[1])
2058	data = data[2:]
2059	if len(data) < ticketLen {
2060		return false
2061	}
2062
2063	if m.version >= VersionTLS13 && ticketLen == 0 {
2064		return false
2065	}
2066
2067	m.ticket = data[:ticketLen]
2068	data = data[ticketLen:]
2069
2070	if m.version >= VersionTLS13 {
2071		if len(data) < 2 {
2072			return false
2073		}
2074
2075		extensionsLength := int(data[0])<<8 | int(data[1])
2076		data = data[2:]
2077		if extensionsLength != len(data) {
2078			return false
2079		}
2080
2081		for len(data) != 0 {
2082			if len(data) < 4 {
2083				return false
2084			}
2085			extension := uint16(data[0])<<8 | uint16(data[1])
2086			length := int(data[2])<<8 | int(data[3])
2087			data = data[4:]
2088			if len(data) < length {
2089				return false
2090			}
2091
2092			switch extension {
2093			case extensionTicketEarlyDataInfo:
2094				if length != 4 {
2095					return false
2096				}
2097				m.maxEarlyDataSize = uint32(data[0])<<24 | uint32(data[1])<<16 | uint32(data[2])<<8 | uint32(data[3])
2098			default:
2099				if isGREASEValue(extension) {
2100					m.hasGREASEExtension = true
2101				}
2102			}
2103
2104			data = data[length:]
2105		}
2106	}
2107
2108	if len(data) > 0 {
2109		return false
2110	}
2111
2112	return true
2113}
2114
2115type v2ClientHelloMsg struct {
2116	raw          []byte
2117	vers         uint16
2118	cipherSuites []uint16
2119	sessionId    []byte
2120	challenge    []byte
2121}
2122
2123func (m *v2ClientHelloMsg) marshal() []byte {
2124	if m.raw != nil {
2125		return m.raw
2126	}
2127
2128	length := 1 + 2 + 2 + 2 + 2 + len(m.cipherSuites)*3 + len(m.sessionId) + len(m.challenge)
2129
2130	x := make([]byte, length)
2131	x[0] = 1
2132	x[1] = uint8(m.vers >> 8)
2133	x[2] = uint8(m.vers)
2134	x[3] = uint8((len(m.cipherSuites) * 3) >> 8)
2135	x[4] = uint8(len(m.cipherSuites) * 3)
2136	x[5] = uint8(len(m.sessionId) >> 8)
2137	x[6] = uint8(len(m.sessionId))
2138	x[7] = uint8(len(m.challenge) >> 8)
2139	x[8] = uint8(len(m.challenge))
2140	y := x[9:]
2141	for i, spec := range m.cipherSuites {
2142		y[i*3] = 0
2143		y[i*3+1] = uint8(spec >> 8)
2144		y[i*3+2] = uint8(spec)
2145	}
2146	y = y[len(m.cipherSuites)*3:]
2147	copy(y, m.sessionId)
2148	y = y[len(m.sessionId):]
2149	copy(y, m.challenge)
2150
2151	m.raw = x
2152
2153	return x
2154}
2155
2156type helloVerifyRequestMsg struct {
2157	raw    []byte
2158	vers   uint16
2159	cookie []byte
2160}
2161
2162func (m *helloVerifyRequestMsg) marshal() []byte {
2163	if m.raw != nil {
2164		return m.raw
2165	}
2166
2167	length := 2 + 1 + len(m.cookie)
2168
2169	x := make([]byte, 4+length)
2170	x[0] = typeHelloVerifyRequest
2171	x[1] = uint8(length >> 16)
2172	x[2] = uint8(length >> 8)
2173	x[3] = uint8(length)
2174	vers := m.vers
2175	x[4] = uint8(vers >> 8)
2176	x[5] = uint8(vers)
2177	x[6] = uint8(len(m.cookie))
2178	copy(x[7:7+len(m.cookie)], m.cookie)
2179
2180	return x
2181}
2182
2183func (m *helloVerifyRequestMsg) unmarshal(data []byte) bool {
2184	if len(data) < 4+2+1 {
2185		return false
2186	}
2187	m.raw = data
2188	m.vers = uint16(data[4])<<8 | uint16(data[5])
2189	cookieLen := int(data[6])
2190	if cookieLen > 32 || len(data) != 7+cookieLen {
2191		return false
2192	}
2193	m.cookie = data[7 : 7+cookieLen]
2194
2195	return true
2196}
2197
2198type channelIDMsg struct {
2199	raw       []byte
2200	channelID []byte
2201}
2202
2203func (m *channelIDMsg) marshal() []byte {
2204	if m.raw != nil {
2205		return m.raw
2206	}
2207
2208	length := 2 + 2 + len(m.channelID)
2209
2210	x := make([]byte, 4+length)
2211	x[0] = typeChannelID
2212	x[1] = uint8(length >> 16)
2213	x[2] = uint8(length >> 8)
2214	x[3] = uint8(length)
2215	x[4] = uint8(extensionChannelID >> 8)
2216	x[5] = uint8(extensionChannelID & 0xff)
2217	x[6] = uint8(len(m.channelID) >> 8)
2218	x[7] = uint8(len(m.channelID) & 0xff)
2219	copy(x[8:], m.channelID)
2220
2221	return x
2222}
2223
2224func (m *channelIDMsg) unmarshal(data []byte) bool {
2225	if len(data) != 4+2+2+128 {
2226		return false
2227	}
2228	m.raw = data
2229	if (uint16(data[4])<<8)|uint16(data[5]) != extensionChannelID {
2230		return false
2231	}
2232	if int(data[6])<<8|int(data[7]) != 128 {
2233		return false
2234	}
2235	m.channelID = data[4+2+2:]
2236
2237	return true
2238}
2239
2240type helloRequestMsg struct {
2241}
2242
2243func (*helloRequestMsg) marshal() []byte {
2244	return []byte{typeHelloRequest, 0, 0, 0}
2245}
2246
2247func (*helloRequestMsg) unmarshal(data []byte) bool {
2248	return len(data) == 4
2249}
2250
2251type keyUpdateMsg struct {
2252	raw              []byte
2253	keyUpdateRequest byte
2254}
2255
2256func (m *keyUpdateMsg) marshal() []byte {
2257	if m.raw != nil {
2258		return m.raw
2259	}
2260
2261	return []byte{typeKeyUpdate, 0, 0, 1, m.keyUpdateRequest}
2262}
2263
2264func (m *keyUpdateMsg) unmarshal(data []byte) bool {
2265	m.raw = data
2266
2267	if len(data) != 5 {
2268		return false
2269	}
2270
2271	length := int(data[1])<<16 | int(data[2])<<8 | int(data[3])
2272	if len(data)-4 != length {
2273		return false
2274	}
2275
2276	m.keyUpdateRequest = data[4]
2277	return m.keyUpdateRequest == keyUpdateNotRequested || m.keyUpdateRequest == keyUpdateRequested
2278}
2279
2280// ssl3NoCertificateMsg is a dummy message to handle SSL 3.0 using a warning
2281// alert in the handshake.
2282type ssl3NoCertificateMsg struct{}
2283
2284func eqUint16s(x, y []uint16) bool {
2285	if len(x) != len(y) {
2286		return false
2287	}
2288	for i, v := range x {
2289		if y[i] != v {
2290			return false
2291		}
2292	}
2293	return true
2294}
2295
2296func eqCurveIDs(x, y []CurveID) bool {
2297	if len(x) != len(y) {
2298		return false
2299	}
2300	for i, v := range x {
2301		if y[i] != v {
2302			return false
2303		}
2304	}
2305	return true
2306}
2307
2308func eqStrings(x, y []string) bool {
2309	if len(x) != len(y) {
2310		return false
2311	}
2312	for i, v := range x {
2313		if y[i] != v {
2314			return false
2315		}
2316	}
2317	return true
2318}
2319
2320func eqByteSlices(x, y [][]byte) bool {
2321	if len(x) != len(y) {
2322		return false
2323	}
2324	for i, v := range x {
2325		if !bytes.Equal(v, y[i]) {
2326			return false
2327		}
2328	}
2329	return true
2330}
2331
2332func eqSignatureAlgorithms(x, y []signatureAlgorithm) bool {
2333	if len(x) != len(y) {
2334		return false
2335	}
2336	for i, v := range x {
2337		v2 := y[i]
2338		if v != v2 {
2339			return false
2340		}
2341	}
2342	return true
2343}
2344
2345func eqKeyShareEntryLists(x, y []keyShareEntry) bool {
2346	if len(x) != len(y) {
2347		return false
2348	}
2349	for i, v := range x {
2350		if y[i].group != v.group || !bytes.Equal(y[i].keyExchange, v.keyExchange) {
2351			return false
2352		}
2353	}
2354	return true
2355
2356}
2357
2358func eqPSKIdentityLists(x, y []pskIdentity) bool {
2359	if len(x) != len(y) {
2360		return false
2361	}
2362	for i, v := range x {
2363		if !bytes.Equal(y[i].ticket, v.ticket) || y[i].obfuscatedTicketAge != v.obfuscatedTicketAge {
2364			return false
2365		}
2366	}
2367	return true
2368
2369}
2370