From b2c005e7b20e01acc2da14e739407b6b231d63ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=8F=A4=E5=A4=A7=E7=BE=8A?= Date: Mon, 10 Feb 2025 12:49:15 +0800 Subject: [PATCH] [release-branch.go1.24] crypto/tls: fix ECH compatibility MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previously, the code only checked supportedVersions[0] for TLS 1.3 However, Chromium-based browsers may list TLS 1.3 at different positions, causing ECH failures. This fix: Iterates through supportedVersions to accept connections as long as TLS 1.3 is present. Improves ECH compatibility, ensuring Chrome, Edge, and other browsers work properly. Fixes #73118 Change-Id: I32f4219fb6654d5cc22c7f33497c6142c0acb4f2 Reviewed-on: https://go-review.googlesource.com/c/go/+/648015 LUCI-TryBot-Result: Go LUCI Reviewed-by: Roland Shoemaker Reviewed-by: David Chase Reviewed-by: Daniel McCarney (cherry picked from commit cd2f347c61bd9f41e977d74dc2dd3a1f36b65800) Reviewed-on: https://go-review.googlesource.com/c/go/+/661936 Reviewed-by: Carlos Amedee Reviewed-by: 古大羊 --- src/crypto/tls/ech.go | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) diff --git a/src/crypto/tls/ech.go b/src/crypto/tls/ech.go index d9795b4ee2..8f8ed6850b 100644 --- a/src/crypto/tls/ech.go +++ b/src/crypto/tls/ech.go @@ -381,8 +381,28 @@ func decodeInnerClientHello(outer *clientHelloMsg, encoded []byte) (*clientHello return nil, errInvalidECHExt } - if len(inner.supportedVersions) != 1 || (len(inner.supportedVersions) >= 1 && inner.supportedVersions[0] != VersionTLS13) { - return nil, errors.New("tls: client sent encrypted_client_hello extension and offered incompatible versions") + hasTLS13 := false + for _, v := range inner.supportedVersions { + // Skip GREASE values (values of the form 0x?A0A). + // GREASE (Generate Random Extensions And Sustain Extensibility) is a mechanism used by + // browsers like Chrome to ensure TLS implementations correctly ignore unknown values. + // GREASE values follow a specific pattern: 0x?A0A, where ? can be any hex digit. + // These values should be ignored when processing supported TLS versions. + if v&0x0F0F == 0x0A0A && v&0xff == v>>8 { + continue + } + + // Ensure at least TLS 1.3 is offered. + if v == VersionTLS13 { + hasTLS13 = true + } else if v < VersionTLS13 { + // Reject if any non-GREASE value is below TLS 1.3, as ECH requires TLS 1.3+. + return nil, errors.New("tls: client sent encrypted_client_hello extension with unsupported versions") + } + } + + if !hasTLS13 { + return nil, errors.New("tls: client sent encrypted_client_hello extension but did not offer TLS 1.3") } return inner, nil