use go 1.12

Signed-off-by: hongming <talonwan@yunify.com>

vendor/github.com/bifurcation/mint/LICENSE.md

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2016 Richard Barnes
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

vendor/github.com/bifurcation/mint/README.md

@@ -0,0 +1,94 @@
+![A lock with a mint leaf](https://ipv.sx/mint/mint.svg)
+
+mint - A Minimal TLS 1.3 stack
+==============================
+
+[![Build Status](https://circleci.com/gh/bifurcation/mint.svg)](https://circleci.com/gh/bifurcation/mint)
+
+This project is primarily a learning effort for me to understand the [TLS
+1.3](http://tlswg.github.io/tls13-spec/) protocol.  The goal is to arrive at a
+pretty complete implementation of TLS 1.3, with minimal, elegant code that
+demonstrates how things work.  Testing is a priority to ensure correctness, but
+otherwise, the quality of the software engineering might not be at a level where
+it makes sense to integrate this with other libraries.  Backward compatibility
+is not an objective.
+
+We borrow liberally from the [Go TLS
+library](https://golang.org/pkg/crypto/tls/), especially where TLS 1.3 aligns
+with earlier TLS versions.  However, unnecessary parts will be ruthlessly cut
+off.
+
+## DTLS Support
+
+Mint has partial support for DTLS, but that support is not yet complete
+and may still contain serious defects.
+
+
+## Quickstart
+
+Installation is the same as for any other Go package:
+
+```
+go get github.com/bifurcation/mint
+```
+
+The API is pretty much the same as for the TLS module, with `Dial` and `Listen`
+methods wrapping the underlying socket APIs.
+
+```
+conn, err := mint.Dial("tcp", "localhost:4430", &mint.Config{...})
+...
+listener, err := mint.Listen("tcp", "localhost:4430", &mint.Config{...})
+```
+
+Documentation is available on
+[godoc.org](https://godoc.org/github.com/bifurcation/mint)
+
+
+## Interoperability testing
+
+The `mint-client` and `mint-server` executables are included to make it easy to
+do basic interoperability tests with other TLS 1.3 implementations.  The steps
+for testing against NSS are as follows.
+
+```
+# Install mint
+go get github.com/bifurcation/mint
+
+# Environment for NSS (you'll probably want a new directory)
+NSS_ROOT=<whereever you want to put NSS>
+mkdir $NSS_ROOT
+cd $NSS_ROOT
+export USE_64=1
+export ENABLE_TLS_1_3=1
+export HOST=localhost
+export DOMSUF=localhost
+
+# Build NSS
+hg clone https://hg.mozilla.org/projects/nss
+hg clone https://hg.mozilla.org/projects/nspr
+cd nss
+make nss_build_all
+
+export PLATFORM=`cat $NSS_ROOT/dist/latest`
+export DYLD_LIBRARY_PATH=$NSS_ROOT/dist/$PLATFORM/lib
+export LD_LIBRARY_PATH=$NSS_ROOT/dist/$PLATFORM/lib
+
+# Run NSS tests (this creates data for the server to use)
+cd tests/ssl_gtests
+./ssl_gtests.sh
+
+# Test with client=mint server=NSS
+cd $NSS_ROOT
+./dist/$PLATFORM/bin/selfserv -d tests_results/security/$HOST.1/ssl_gtests/ -n rsa -p 4430
+# if you get `NSS_Init failed.`, check the path above, particularly around $HOST
+# ...
+go run $GOPATH/src/github.com/bifurcation/mint/bin/mint-client/main.go
+
+# Test with client=NSS server=mint
+go run $GOPATH/src/github.com/bifurcation/mint/bin/mint-server/main.go
+# ...
+cd $NSS_ROOT
+dist/$PLATFORM/bin/tstclnt -d tests_results/security/$HOST/ssl_gtests/ -V tls1.3:tls1.3 -h 127.0.0.1 -p 4430 -o
+```
+

vendor/github.com/bifurcation/mint/alert.go

@@ -0,0 +1,101 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package mint
+
+import "strconv"
+
+type Alert uint8
+
+const (
+	// alert level
+	AlertLevelWarning = 1
+	AlertLevelError   = 2
+)
+
+const (
+	AlertCloseNotify                 Alert = 0
+	AlertUnexpectedMessage           Alert = 10
+	AlertBadRecordMAC                Alert = 20
+	AlertDecryptionFailed            Alert = 21
+	AlertRecordOverflow              Alert = 22
+	AlertDecompressionFailure        Alert = 30
+	AlertHandshakeFailure            Alert = 40
+	AlertBadCertificate              Alert = 42
+	AlertUnsupportedCertificate      Alert = 43
+	AlertCertificateRevoked          Alert = 44
+	AlertCertificateExpired          Alert = 45
+	AlertCertificateUnknown          Alert = 46
+	AlertIllegalParameter            Alert = 47
+	AlertUnknownCA                   Alert = 48
+	AlertAccessDenied                Alert = 49
+	AlertDecodeError                 Alert = 50
+	AlertDecryptError                Alert = 51
+	AlertProtocolVersion             Alert = 70
+	AlertInsufficientSecurity        Alert = 71
+	AlertInternalError               Alert = 80
+	AlertInappropriateFallback       Alert = 86
+	AlertUserCanceled                Alert = 90
+	AlertNoRenegotiation             Alert = 100
+	AlertMissingExtension            Alert = 109
+	AlertUnsupportedExtension        Alert = 110
+	AlertCertificateUnobtainable     Alert = 111
+	AlertUnrecognizedName            Alert = 112
+	AlertBadCertificateStatsResponse Alert = 113
+	AlertBadCertificateHashValue     Alert = 114
+	AlertUnknownPSKIdentity          Alert = 115
+	AlertNoApplicationProtocol       Alert = 120
+	AlertStatelessRetry              Alert = 253
+	AlertWouldBlock                  Alert = 254
+	AlertNoAlert                     Alert = 255
+)
+
+var alertText = map[Alert]string{
+	AlertCloseNotify:                 "close notify",
+	AlertUnexpectedMessage:           "unexpected message",
+	AlertBadRecordMAC:                "bad record MAC",
+	AlertDecryptionFailed:            "decryption failed",
+	AlertRecordOverflow:              "record overflow",
+	AlertDecompressionFailure:        "decompression failure",
+	AlertHandshakeFailure:            "handshake failure",
+	AlertBadCertificate:              "bad certificate",
+	AlertUnsupportedCertificate:      "unsupported certificate",
+	AlertCertificateRevoked:          "revoked certificate",
+	AlertCertificateExpired:          "expired certificate",
+	AlertCertificateUnknown:          "unknown certificate",
+	AlertIllegalParameter:            "illegal parameter",
+	AlertUnknownCA:                   "unknown certificate authority",
+	AlertAccessDenied:                "access denied",
+	AlertDecodeError:                 "error decoding message",
+	AlertDecryptError:                "error decrypting message",
+	AlertProtocolVersion:             "protocol version not supported",
+	AlertInsufficientSecurity:        "insufficient security level",
+	AlertInternalError:               "internal error",
+	AlertInappropriateFallback:       "inappropriate fallback",
+	AlertUserCanceled:                "user canceled",
+	AlertMissingExtension:            "missing extension",
+	AlertUnsupportedExtension:        "unsupported extension",
+	AlertCertificateUnobtainable:     "certificate unobtainable",
+	AlertUnrecognizedName:            "unrecognized name",
+	AlertBadCertificateStatsResponse: "bad certificate status response",
+	AlertBadCertificateHashValue:     "bad certificate hash value",
+	AlertUnknownPSKIdentity:          "unknown PSK identity",
+	AlertNoApplicationProtocol:       "no application protocol",
+	AlertNoRenegotiation:             "no renegotiation",
+	AlertStatelessRetry:              "stateless retry",
+	AlertWouldBlock:                  "would have blocked",
+	AlertNoAlert:                     "no alert",
+}
+
+func (e Alert) String() string {
+	s, ok := alertText[e]
+	if ok {
+		return s
+	}
+	return "alert(" + strconv.Itoa(int(e)) + ")"
+}
+
+func (e Alert) Error() string {
+	return e.String()
+}

vendor/github.com/bifurcation/mint/common.go

@@ -0,0 +1,266 @@
+package mint
+
+import (
+	"fmt"
+	"strconv"
+)
+
+const (
+	supportedVersion  uint16 = 0x7f16 // draft-22
+	tls12Version      uint16 = 0x0303
+	tls10Version      uint16 = 0x0301
+	dtls12WireVersion uint16 = 0xfefd
+)
+
+var (
+	// Flags for some minor compat issues
+	allowWrongVersionNumber = true
+	allowPKCS1              = true
+)
+
+// enum {...} ContentType;
+type RecordType byte
+
+const (
+	RecordTypeAlert           RecordType = 21
+	RecordTypeHandshake       RecordType = 22
+	RecordTypeApplicationData RecordType = 23
+	RecordTypeAck             RecordType = 25
+)
+
+// enum {...} HandshakeType;
+type HandshakeType byte
+
+const (
+	// Omitted: *_RESERVED
+	HandshakeTypeClientHello         HandshakeType = 1
+	HandshakeTypeServerHello         HandshakeType = 2
+	HandshakeTypeNewSessionTicket    HandshakeType = 4
+	HandshakeTypeEndOfEarlyData      HandshakeType = 5
+	HandshakeTypeHelloRetryRequest   HandshakeType = 6
+	HandshakeTypeEncryptedExtensions HandshakeType = 8
+	HandshakeTypeCertificate         HandshakeType = 11
+	HandshakeTypeCertificateRequest  HandshakeType = 13
+	HandshakeTypeCertificateVerify   HandshakeType = 15
+	HandshakeTypeServerConfiguration HandshakeType = 17
+	HandshakeTypeFinished            HandshakeType = 20
+	HandshakeTypeKeyUpdate           HandshakeType = 24
+	HandshakeTypeMessageHash         HandshakeType = 254
+)
+
+var hrrRandomSentinel = [32]byte{
+	0xcf, 0x21, 0xad, 0x74, 0xe5, 0x9a, 0x61, 0x11,
+	0xbe, 0x1d, 0x8c, 0x02, 0x1e, 0x65, 0xb8, 0x91,
+	0xc2, 0xa2, 0x11, 0x16, 0x7a, 0xbb, 0x8c, 0x5e,
+	0x07, 0x9e, 0x09, 0xe2, 0xc8, 0xa8, 0x33, 0x9c,
+}
+
+// uint8 CipherSuite[2];
+type CipherSuite uint16
+
+const (
+	// XXX: Actually TLS_NULL_WITH_NULL_NULL, but we need a way to label the zero
+	// value for this type so that we can detect when a field is set.
+	CIPHER_SUITE_UNKNOWN         CipherSuite = 0x0000
+	TLS_AES_128_GCM_SHA256       CipherSuite = 0x1301
+	TLS_AES_256_GCM_SHA384       CipherSuite = 0x1302
+	TLS_CHACHA20_POLY1305_SHA256 CipherSuite = 0x1303
+	TLS_AES_128_CCM_SHA256       CipherSuite = 0x1304
+	TLS_AES_256_CCM_8_SHA256     CipherSuite = 0x1305
+)
+
+func (c CipherSuite) String() string {
+	switch c {
+	case CIPHER_SUITE_UNKNOWN:
+		return "unknown"
+	case TLS_AES_128_GCM_SHA256:
+		return "TLS_AES_128_GCM_SHA256"
+	case TLS_AES_256_GCM_SHA384:
+		return "TLS_AES_256_GCM_SHA384"
+	case TLS_CHACHA20_POLY1305_SHA256:
+		return "TLS_CHACHA20_POLY1305_SHA256"
+	case TLS_AES_128_CCM_SHA256:
+		return "TLS_AES_128_CCM_SHA256"
+	case TLS_AES_256_CCM_8_SHA256:
+		return "TLS_AES_256_CCM_8_SHA256"
+	}
+	// cannot use %x here, since it calls String(), leading to infinite recursion
+	return fmt.Sprintf("invalid CipherSuite value: 0x%s", strconv.FormatUint(uint64(c), 16))
+}
+
+// enum {...} SignatureScheme
+type SignatureScheme uint16
+
+const (
+	// RSASSA-PKCS1-v1_5 algorithms
+	RSA_PKCS1_SHA1   SignatureScheme = 0x0201
+	RSA_PKCS1_SHA256 SignatureScheme = 0x0401
+	RSA_PKCS1_SHA384 SignatureScheme = 0x0501
+	RSA_PKCS1_SHA512 SignatureScheme = 0x0601
+	// ECDSA algorithms
+	ECDSA_P256_SHA256 SignatureScheme = 0x0403
+	ECDSA_P384_SHA384 SignatureScheme = 0x0503
+	ECDSA_P521_SHA512 SignatureScheme = 0x0603
+	// RSASSA-PSS algorithms
+	RSA_PSS_SHA256 SignatureScheme = 0x0804
+	RSA_PSS_SHA384 SignatureScheme = 0x0805
+	RSA_PSS_SHA512 SignatureScheme = 0x0806
+	// EdDSA algorithms
+	Ed25519 SignatureScheme = 0x0807
+	Ed448   SignatureScheme = 0x0808
+)
+
+// enum {...} ExtensionType
+type ExtensionType uint16
+
+const (
+	ExtensionTypeServerName          ExtensionType = 0
+	ExtensionTypeSupportedGroups     ExtensionType = 10
+	ExtensionTypeSignatureAlgorithms ExtensionType = 13
+	ExtensionTypeALPN                ExtensionType = 16
+	ExtensionTypeKeyShare            ExtensionType = 40
+	ExtensionTypePreSharedKey        ExtensionType = 41
+	ExtensionTypeEarlyData           ExtensionType = 42
+	ExtensionTypeSupportedVersions   ExtensionType = 43
+	ExtensionTypeCookie              ExtensionType = 44
+	ExtensionTypePSKKeyExchangeModes ExtensionType = 45
+	ExtensionTypeTicketEarlyDataInfo ExtensionType = 46
+)
+
+// enum {...} NamedGroup
+type NamedGroup uint16
+
+const (
+	// Elliptic Curve Groups.
+	P256 NamedGroup = 23
+	P384 NamedGroup = 24
+	P521 NamedGroup = 25
+	// ECDH functions.
+	X25519 NamedGroup = 29
+	X448   NamedGroup = 30
+	// Finite field groups.
+	FFDHE2048 NamedGroup = 256
+	FFDHE3072 NamedGroup = 257
+	FFDHE4096 NamedGroup = 258
+	FFDHE6144 NamedGroup = 259
+	FFDHE8192 NamedGroup = 260
+)
+
+// enum {...} PskKeyExchangeMode;
+type PSKKeyExchangeMode uint8
+
+const (
+	PSKModeKE    PSKKeyExchangeMode = 0
+	PSKModeDHEKE PSKKeyExchangeMode = 1
+)
+
+// enum {
+//     update_not_requested(0), update_requested(1), (255)
+// } KeyUpdateRequest;
+type KeyUpdateRequest uint8
+
+const (
+	KeyUpdateNotRequested KeyUpdateRequest = 0
+	KeyUpdateRequested    KeyUpdateRequest = 1
+)
+
+type State uint8
+
+const (
+	StateInit = 0
+
+	// states valid for the client
+	StateClientStart State = iota
+	StateClientWaitSH
+	StateClientWaitEE
+	StateClientWaitCert
+	StateClientWaitCV
+	StateClientWaitFinished
+	StateClientWaitCertCR
+	StateClientConnected
+	// states valid for the server
+	StateServerStart State = iota
+	StateServerRecvdCH
+	StateServerNegotiated
+	StateServerReadPastEarlyData
+	StateServerWaitEOED
+	StateServerWaitFlight2
+	StateServerWaitCert
+	StateServerWaitCV
+	StateServerWaitFinished
+	StateServerConnected
+)
+
+func (s State) String() string {
+	switch s {
+	case StateClientStart:
+		return "Client START"
+	case StateClientWaitSH:
+		return "Client WAIT_SH"
+	case StateClientWaitEE:
+		return "Client WAIT_EE"
+	case StateClientWaitCert:
+		return "Client WAIT_CERT"
+	case StateClientWaitCV:
+		return "Client WAIT_CV"
+	case StateClientWaitFinished:
+		return "Client WAIT_FINISHED"
+	case StateClientWaitCertCR:
+		return "Client WAIT_CERT_CR"
+	case StateClientConnected:
+		return "Client CONNECTED"
+	case StateServerStart:
+		return "Server START"
+	case StateServerRecvdCH:
+		return "Server RECVD_CH"
+	case StateServerNegotiated:
+		return "Server NEGOTIATED"
+	case StateServerReadPastEarlyData:
+		return "Server READ_PAST_EARLY_DATA"
+	case StateServerWaitEOED:
+		return "Server WAIT_EOED"
+	case StateServerWaitFlight2:
+		return "Server WAIT_FLIGHT2"
+	case StateServerWaitCert:
+		return "Server WAIT_CERT"
+	case StateServerWaitCV:
+		return "Server WAIT_CV"
+	case StateServerWaitFinished:
+		return "Server WAIT_FINISHED"
+	case StateServerConnected:
+		return "Server CONNECTED"
+	default:
+		return fmt.Sprintf("unknown state: %d", s)
+	}
+}
+
+// Epochs for DTLS (also used for key phase labelling)
+type Epoch uint16
+
+const (
+	EpochClear           Epoch = 0
+	EpochEarlyData       Epoch = 1
+	EpochHandshakeData   Epoch = 2
+	EpochApplicationData Epoch = 3
+	EpochUpdate          Epoch = 4
+)
+
+func (e Epoch) label() string {
+	switch e {
+	case EpochClear:
+		return "clear"
+	case EpochEarlyData:
+		return "early data"
+	case EpochHandshakeData:
+		return "handshake"
+	case EpochApplicationData:
+		return "application data"
+	}
+	return "Application data (updated)"
+}
+
+func assert(b bool) {
+	if !b {
+		panic("Assertion failed")
+	}
+}

vendor/github.com/bifurcation/mint/conn.go

@@ -0,0 +1,921 @@
+package mint
+
+import (
+	"crypto"
+	"crypto/x509"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"reflect"
+	"sync"
+	"time"
+)
+
+type Certificate struct {
+	Chain      []*x509.Certificate
+	PrivateKey crypto.Signer
+}
+
+type PreSharedKey struct {
+	CipherSuite  CipherSuite
+	IsResumption bool
+	Identity     []byte
+	Key          []byte
+	NextProto    string
+	ReceivedAt   time.Time
+	ExpiresAt    time.Time
+	TicketAgeAdd uint32
+}
+
+type PreSharedKeyCache interface {
+	Get(string) (PreSharedKey, bool)
+	Put(string, PreSharedKey)
+	Size() int
+}
+
+// A CookieHandler can be used to give the application more fine-grained control over Cookies.
+// Generate receives the Conn as an argument, so the CookieHandler can decide when to send the cookie based on that, and offload state to the client by encoding that into the Cookie.
+// When the client echoes the Cookie, Validate is called. The application can then recover the state from the cookie.
+type CookieHandler interface {
+	// Generate a byte string that is sent as a part of a cookie to the client in the HelloRetryRequest
+	// If Generate returns nil, mint will not send a HelloRetryRequest.
+	Generate(*Conn) ([]byte, error)
+	// Validate is called when receiving a ClientHello containing a Cookie.
+	// If validation failed, the handshake is aborted.
+	Validate(*Conn, []byte) bool
+}
+
+type PSKMapCache map[string]PreSharedKey
+
+func (cache PSKMapCache) Get(key string) (psk PreSharedKey, ok bool) {
+	psk, ok = cache[key]
+	return
+}
+
+func (cache *PSKMapCache) Put(key string, psk PreSharedKey) {
+	(*cache)[key] = psk
+}
+
+func (cache PSKMapCache) Size() int {
+	return len(cache)
+}
+
+// Config is the struct used to pass configuration settings to a TLS client or
+// server instance.  The settings for client and server are pretty different,
+// but we just throw them all in here.
+type Config struct {
+	// Client fields
+	ServerName string
+
+	// Server fields
+	SendSessionTickets bool
+	TicketLifetime     uint32
+	TicketLen          int
+	EarlyDataLifetime  uint32
+	AllowEarlyData     bool
+	// Require the client to echo a cookie.
+	RequireCookie bool
+	// A CookieHandler can be used to set and validate a cookie.
+	// The cookie returned by the CookieHandler will be part of the cookie sent on the wire, and encoded using the CookieProtector.
+	// If no CookieHandler is set, mint will always send a cookie.
+	// The CookieHandler can be used to decide on a per-connection basis, if a cookie should be sent.
+	CookieHandler CookieHandler
+	// The CookieProtector is used to encrypt / decrypt cookies.
+	// It should make sure that the Cookie cannot be read and tampered with by the client.
+	// If non-blocking mode is used, and cookies are required, this field has to be set.
+	// In blocking mode, a default cookie protector is used, if this is unused.
+	CookieProtector CookieProtector
+	// The ExtensionHandler is used to add custom extensions.
+	ExtensionHandler  AppExtensionHandler
+	RequireClientAuth bool
+
+	// Time returns the current time as the number of seconds since the epoch.
+	// If Time is nil, TLS uses time.Now.
+	Time func() time.Time
+	// RootCAs defines the set of root certificate authorities
+	// that clients use when verifying server certificates.
+	// If RootCAs is nil, TLS uses the host's root CA set.
+	RootCAs *x509.CertPool
+	// InsecureSkipVerify controls whether a client verifies the
+	// server's certificate chain and host name.
+	// If InsecureSkipVerify is true, TLS accepts any certificate
+	// presented by the server and any host name in that certificate.
+	// In this mode, TLS is susceptible to man-in-the-middle attacks.
+	// This should be used only for testing.
+	InsecureSkipVerify bool
+
+	// Shared fields
+	Certificates []*Certificate
+	// VerifyPeerCertificate, if not nil, is called after normal
+	// certificate verification by either a TLS client or server. It
+	// receives the raw ASN.1 certificates provided by the peer and also
+	// any verified chains that normal processing found. If it returns a
+	// non-nil error, the handshake is aborted and that error results.
+	//
+	// If normal verification fails then the handshake will abort before
+	// considering this callback. If normal verification is disabled by
+	// setting InsecureSkipVerify then this callback will be considered but
+	// the verifiedChains argument will always be nil.
+	VerifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
+
+	CipherSuites     []CipherSuite
+	Groups           []NamedGroup
+	SignatureSchemes []SignatureScheme
+	NextProtos       []string
+	PSKs             PreSharedKeyCache
+	PSKModes         []PSKKeyExchangeMode
+	NonBlocking      bool
+	UseDTLS          bool
+
+	// The same config object can be shared among different connections, so it
+	// needs its own mutex
+	mutex sync.RWMutex
+}
+
+// Clone returns a shallow clone of c. It is safe to clone a Config that is
+// being used concurrently by a TLS client or server.
+func (c *Config) Clone() *Config {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	return &Config{
+		ServerName: c.ServerName,
+
+		SendSessionTickets: c.SendSessionTickets,
+		TicketLifetime:     c.TicketLifetime,
+		TicketLen:          c.TicketLen,
+		EarlyDataLifetime:  c.EarlyDataLifetime,
+		AllowEarlyData:     c.AllowEarlyData,
+		RequireCookie:      c.RequireCookie,
+		CookieHandler:      c.CookieHandler,
+		CookieProtector:    c.CookieProtector,
+		ExtensionHandler:   c.ExtensionHandler,
+		RequireClientAuth:  c.RequireClientAuth,
+		Time:               c.Time,
+		RootCAs:            c.RootCAs,
+		InsecureSkipVerify: c.InsecureSkipVerify,
+
+		Certificates:          c.Certificates,
+		VerifyPeerCertificate: c.VerifyPeerCertificate,
+		CipherSuites:          c.CipherSuites,
+		Groups:                c.Groups,
+		SignatureSchemes:      c.SignatureSchemes,
+		NextProtos:            c.NextProtos,
+		PSKs:                  c.PSKs,
+		PSKModes:              c.PSKModes,
+		NonBlocking:           c.NonBlocking,
+		UseDTLS:               c.UseDTLS,
+	}
+}
+
+func (c *Config) Init(isClient bool) error {
+	c.mutex.Lock()
+	defer c.mutex.Unlock()
+
+	// Set defaults
+	if len(c.CipherSuites) == 0 {
+		c.CipherSuites = defaultSupportedCipherSuites
+	}
+	if len(c.Groups) == 0 {
+		c.Groups = defaultSupportedGroups
+	}
+	if len(c.SignatureSchemes) == 0 {
+		c.SignatureSchemes = defaultSignatureSchemes
+	}
+	if c.TicketLen == 0 {
+		c.TicketLen = defaultTicketLen
+	}
+	if !reflect.ValueOf(c.PSKs).IsValid() {
+		c.PSKs = &PSKMapCache{}
+	}
+	if len(c.PSKModes) == 0 {
+		c.PSKModes = defaultPSKModes
+	}
+	return nil
+}
+
+func (c *Config) ValidForServer() bool {
+	return (reflect.ValueOf(c.PSKs).IsValid() && c.PSKs.Size() > 0) ||
+		(len(c.Certificates) > 0 &&
+			len(c.Certificates[0].Chain) > 0 &&
+			c.Certificates[0].PrivateKey != nil)
+}
+
+func (c *Config) ValidForClient() bool {
+	return len(c.ServerName) > 0
+}
+
+func (c *Config) time() time.Time {
+	t := c.Time
+	if t == nil {
+		t = time.Now
+	}
+	return t()
+}
+
+var (
+	defaultSupportedCipherSuites = []CipherSuite{
+		TLS_AES_128_GCM_SHA256,
+		TLS_AES_256_GCM_SHA384,
+	}
+
+	defaultSupportedGroups = []NamedGroup{
+		P256,
+		P384,
+		FFDHE2048,
+		X25519,
+	}
+
+	defaultSignatureSchemes = []SignatureScheme{
+		RSA_PSS_SHA256,
+		RSA_PSS_SHA384,
+		RSA_PSS_SHA512,
+		ECDSA_P256_SHA256,
+		ECDSA_P384_SHA384,
+		ECDSA_P521_SHA512,
+	}
+
+	defaultTicketLen = 16
+
+	defaultPSKModes = []PSKKeyExchangeMode{
+		PSKModeKE,
+		PSKModeDHEKE,
+	}
+)
+
+type ConnectionState struct {
+	HandshakeState   State
+	CipherSuite      CipherSuiteParams     // cipher suite in use (TLS_RSA_WITH_RC4_128_SHA, ...)
+	PeerCertificates []*x509.Certificate   // certificate chain presented by remote peer
+	VerifiedChains   [][]*x509.Certificate // verified chains built from PeerCertificates
+	NextProto        string                // Selected ALPN proto
+	UsingPSK         bool                  // Are we using PSK.
+	UsingEarlyData   bool                  // Did we negotiate 0-RTT.
+}
+
+// Conn implements the net.Conn interface, as with "crypto/tls"
+// * Read, Write, and Close are provided locally
+// * LocalAddr, RemoteAddr, and Set*Deadline are forwarded to the inner Conn
+type Conn struct {
+	config   *Config
+	conn     net.Conn
+	isClient bool
+
+	state             stateConnected
+	hState            HandshakeState
+	handshakeMutex    sync.Mutex
+	handshakeAlert    Alert
+	handshakeComplete bool
+
+	readBuffer []byte
+	in, out    *RecordLayer
+	hsCtx      *HandshakeContext
+}
+
+func NewConn(conn net.Conn, config *Config, isClient bool) *Conn {
+	c := &Conn{conn: conn, config: config, isClient: isClient, hsCtx: &HandshakeContext{}}
+	if !config.UseDTLS {
+		c.in = NewRecordLayerTLS(c.conn, directionRead)
+		c.out = NewRecordLayerTLS(c.conn, directionWrite)
+		c.hsCtx.hIn = NewHandshakeLayerTLS(c.hsCtx, c.in)
+		c.hsCtx.hOut = NewHandshakeLayerTLS(c.hsCtx, c.out)
+	} else {
+		c.in = NewRecordLayerDTLS(c.conn, directionRead)
+		c.out = NewRecordLayerDTLS(c.conn, directionWrite)
+		c.hsCtx.hIn = NewHandshakeLayerDTLS(c.hsCtx, c.in)
+		c.hsCtx.hOut = NewHandshakeLayerDTLS(c.hsCtx, c.out)
+		c.hsCtx.timeoutMS = initialTimeout
+		c.hsCtx.timers = newTimerSet()
+		c.hsCtx.waitingNextFlight = true
+	}
+	c.in.label = c.label()
+	c.out.label = c.label()
+	c.hsCtx.hIn.nonblocking = c.config.NonBlocking
+	return c
+}
+
+// Read up
+func (c *Conn) consumeRecord() error {
+	pt, err := c.in.ReadRecord()
+	if pt == nil {
+		logf(logTypeIO, "extendBuffer returns error %v", err)
+		return err
+	}
+
+	switch pt.contentType {
+	case RecordTypeHandshake:
+		logf(logTypeHandshake, "Received post-handshake message")
+		// We do not support fragmentation of post-handshake handshake messages.
+		// TODO: Factor this more elegantly; coalesce with handshakeLayer.ReadMessage()
+		start := 0
+		headerLen := handshakeHeaderLenTLS
+		if c.config.UseDTLS {
+			headerLen = handshakeHeaderLenDTLS
+		}
+		for start < len(pt.fragment) {
+			if len(pt.fragment[start:]) < headerLen {
+				return fmt.Errorf("Post-handshake handshake message too short for header")
+			}
+
+			hm := &HandshakeMessage{}
+			hm.msgType = HandshakeType(pt.fragment[start])
+			hmLen := (int(pt.fragment[start+1]) << 16) + (int(pt.fragment[start+2]) << 8) + int(pt.fragment[start+3])
+
+			if len(pt.fragment[start+headerLen:]) < hmLen {
+				return fmt.Errorf("Post-handshake handshake message too short for body")
+			}
+			hm.body = pt.fragment[start+headerLen : start+headerLen+hmLen]
+
+			// XXX: If we want to support more advanced cases, e.g., post-handshake
+			// authentication, we'll need to allow transitions other than
+			// Connected -> Connected
+			state, actions, alert := c.state.ProcessMessage(hm)
+			if alert != AlertNoAlert {
+				logf(logTypeHandshake, "Error in state transition: %v", alert)
+				c.sendAlert(alert)
+				return io.EOF
+			}
+
+			for _, action := range actions {
+				alert = c.takeAction(action)
+				if alert != AlertNoAlert {
+					logf(logTypeHandshake, "Error during handshake actions: %v", alert)
+					c.sendAlert(alert)
+					return io.EOF
+				}
+			}
+
+			var connected bool
+			c.state, connected = state.(stateConnected)
+			if !connected {
+				logf(logTypeHandshake, "Disconnected after state transition: %v", alert)
+				c.sendAlert(alert)
+				return io.EOF
+			}
+
+			start += headerLen + hmLen
+		}
+	case RecordTypeAlert:
+		logf(logTypeIO, "extended buffer (for alert): [%d] %x", len(c.readBuffer), c.readBuffer)
+		if len(pt.fragment) != 2 {
+			c.sendAlert(AlertUnexpectedMessage)
+			return io.EOF
+		}
+		if Alert(pt.fragment[1]) == AlertCloseNotify {
+			return io.EOF
+		}
+
+		switch pt.fragment[0] {
+		case AlertLevelWarning:
+			// drop on the floor
+		case AlertLevelError:
+			return Alert(pt.fragment[1])
+		default:
+			c.sendAlert(AlertUnexpectedMessage)
+			return io.EOF
+		}
+
+	case RecordTypeAck:
+		if !c.hsCtx.hIn.datagram {
+			logf(logTypeHandshake, "Received ACK in TLS mode")
+			return AlertUnexpectedMessage
+		}
+		return c.hsCtx.processAck(pt.fragment)
+
+	case RecordTypeApplicationData:
+		c.readBuffer = append(c.readBuffer, pt.fragment...)
+		logf(logTypeIO, "extended buffer: [%d] %x", len(c.readBuffer), c.readBuffer)
+
+	}
+
+	return err
+}
+
+func readPartial(in *[]byte, buffer []byte) int {
+	logf(logTypeIO, "conn.Read input buffer now has len %d", len((*in)))
+	read := copy(buffer, *in)
+	*in = (*in)[read:]
+
+	logf(logTypeVerbose, "Returning %v", string(buffer))
+	return read
+}
+
+// Read application data up to the size of buffer.  Handshake and alert records
+// are consumed by the Conn object directly.
+func (c *Conn) Read(buffer []byte) (int, error) {
+	if _, connected := c.hState.(stateConnected); !connected {
+		// Clients can't call Read prior to handshake completion.
+		if c.isClient {
+			return 0, errors.New("Read called before the handshake completed")
+		}
+
+		// Neither can servers that don't allow early data.
+		if !c.config.AllowEarlyData {
+			return 0, errors.New("Read called before the handshake completed")
+		}
+
+		// If there's no early data, then return WouldBlock
+		if len(c.hsCtx.earlyData) == 0 {
+			return 0, AlertWouldBlock
+		}
+
+		return readPartial(&c.hsCtx.earlyData, buffer), nil
+	}
+
+	// The handshake is now connected.
+	logf(logTypeHandshake, "conn.Read with buffer = %d", len(buffer))
+	if alert := c.Handshake(); alert != AlertNoAlert {
+		return 0, alert
+	}
+
+	if len(buffer) == 0 {
+		return 0, nil
+	}
+
+	// Run our timers.
+	if c.config.UseDTLS {
+		if err := c.hsCtx.timers.check(time.Now()); err != nil {
+			return 0, AlertInternalError
+		}
+	}
+
+	// Lock the input channel
+	c.in.Lock()
+	defer c.in.Unlock()
+	for len(c.readBuffer) == 0 {
+		err := c.consumeRecord()
+
+		// err can be nil if consumeRecord processed a non app-data
+		// record.
+		if err != nil {
+			if c.config.NonBlocking || err != AlertWouldBlock {
+				logf(logTypeIO, "conn.Read returns err=%v", err)
+				return 0, err
+			}
+		}
+	}
+
+	return readPartial(&c.readBuffer, buffer), nil
+}
+
+// Write application data
+func (c *Conn) Write(buffer []byte) (int, error) {
+	// Lock the output channel
+	c.out.Lock()
+	defer c.out.Unlock()
+
+	if !c.Writable() {
+		return 0, errors.New("Write called before the handshake completed (and early data not in use)")
+	}
+
+	// Send full-size fragments
+	var start int
+	sent := 0
+	for start = 0; len(buffer)-start >= maxFragmentLen; start += maxFragmentLen {
+		err := c.out.WriteRecord(&TLSPlaintext{
+			contentType: RecordTypeApplicationData,
+			fragment:    buffer[start : start+maxFragmentLen],
+		})
+
+		if err != nil {
+			return sent, err
+		}
+		sent += maxFragmentLen
+	}
+
+	// Send a final partial fragment if necessary
+	if start < len(buffer) {
+		err := c.out.WriteRecord(&TLSPlaintext{
+			contentType: RecordTypeApplicationData,
+			fragment:    buffer[start:],
+		})
+
+		if err != nil {
+			return sent, err
+		}
+		sent += len(buffer[start:])
+	}
+	return sent, nil
+}
+
+// sendAlert sends a TLS alert message.
+// c.out.Mutex <= L.
+func (c *Conn) sendAlert(err Alert) error {
+	c.handshakeMutex.Lock()
+	defer c.handshakeMutex.Unlock()
+
+	var level int
+	switch err {
+	case AlertNoRenegotiation, AlertCloseNotify:
+		level = AlertLevelWarning
+	default:
+		level = AlertLevelError
+	}
+
+	buf := []byte{byte(err), byte(level)}
+	c.out.WriteRecord(&TLSPlaintext{
+		contentType: RecordTypeAlert,
+		fragment:    buf,
+	})
+
+	// close_notify and end_of_early_data are not actually errors
+	if level == AlertLevelWarning {
+		return &net.OpError{Op: "local error", Err: err}
+	}
+
+	return c.Close()
+}
+
+// Close closes the connection.
+func (c *Conn) Close() error {
+	// XXX crypto/tls has an interlock with Write here.  Do we need that?
+
+	return c.conn.Close()
+}
+
+// LocalAddr returns the local network address.
+func (c *Conn) LocalAddr() net.Addr {
+	return c.conn.LocalAddr()
+}
+
+// RemoteAddr returns the remote network address.
+func (c *Conn) RemoteAddr() net.Addr {
+	return c.conn.RemoteAddr()
+}
+
+// SetDeadline sets the read and write deadlines associated with the connection.
+// A zero value for t means Read and Write will not time out.
+// After a Write has timed out, the TLS state is corrupt and all future writes will return the same error.
+func (c *Conn) SetDeadline(t time.Time) error {
+	return c.conn.SetDeadline(t)
+}
+
+// SetReadDeadline sets the read deadline on the underlying connection.
+// A zero value for t means Read will not time out.
+func (c *Conn) SetReadDeadline(t time.Time) error {
+	return c.conn.SetReadDeadline(t)
+}
+
+// SetWriteDeadline sets the write deadline on the underlying connection.
+// A zero value for t means Write will not time out.
+// After a Write has timed out, the TLS state is corrupt and all future writes will return the same error.
+func (c *Conn) SetWriteDeadline(t time.Time) error {
+	return c.conn.SetWriteDeadline(t)
+}
+
+func (c *Conn) takeAction(actionGeneric HandshakeAction) Alert {
+	label := "[server]"
+	if c.isClient {
+		label = "[client]"
+	}
+
+	switch action := actionGeneric.(type) {
+	case QueueHandshakeMessage:
+		logf(logTypeHandshake, "%s queuing handshake message type=%v", label, action.Message.msgType)
+		err := c.hsCtx.hOut.QueueMessage(action.Message)
+		if err != nil {
+			logf(logTypeHandshake, "%s Error writing handshake message: %v", label, err)
+			return AlertInternalError
+		}
+
+	case SendQueuedHandshake:
+		_, err := c.hsCtx.hOut.SendQueuedMessages()
+		if err != nil {
+			logf(logTypeHandshake, "%s Error writing handshake message: %v", label, err)
+			return AlertInternalError
+		}
+		if c.config.UseDTLS {
+			c.hsCtx.timers.start(retransmitTimerLabel,
+				c.hsCtx.handshakeRetransmit,
+				c.hsCtx.timeoutMS)
+		}
+	case RekeyIn:
+		logf(logTypeHandshake, "%s Rekeying in to %s: %+v", label, action.epoch.label(), action.KeySet)
+		// Check that we don't have an input data in the handshake frame parser.
+		if len(c.hsCtx.hIn.frame.remainder) > 0 {
+			logf(logTypeHandshake, "%s Rekey with data still in handshake buffers", label)
+			return AlertDecodeError
+		}
+		err := c.in.Rekey(action.epoch, action.KeySet.cipher, action.KeySet.key, action.KeySet.iv)
+		if err != nil {
+			logf(logTypeHandshake, "%s Unable to rekey inbound: %v", label, err)
+			return AlertInternalError
+		}
+
+	case RekeyOut:
+		logf(logTypeHandshake, "%s Rekeying out to %s: %+v", label, action.epoch.label(), action.KeySet)
+		err := c.out.Rekey(action.epoch, action.KeySet.cipher, action.KeySet.key, action.KeySet.iv)
+		if err != nil {
+			logf(logTypeHandshake, "%s Unable to rekey outbound: %v", label, err)
+			return AlertInternalError
+		}
+
+	case ResetOut:
+		logf(logTypeHandshake, "%s Rekeying out to %s seq=%v", label, EpochClear, action.seq)
+		c.out.ResetClear(action.seq)
+
+	case StorePSK:
+		logf(logTypeHandshake, "%s Storing new session ticket with identity [%x]", label, action.PSK.Identity)
+		if c.isClient {
+			// Clients look up PSKs based on server name
+			c.config.PSKs.Put(c.config.ServerName, action.PSK)
+		} else {
+			// Servers look them up based on the identity in the extension
+			c.config.PSKs.Put(hex.EncodeToString(action.PSK.Identity), action.PSK)
+		}
+
+	default:
+		logf(logTypeHandshake, "%s Unknown action type", label)
+		assert(false)
+		return AlertInternalError
+	}
+
+	return AlertNoAlert
+}
+
+func (c *Conn) HandshakeSetup() Alert {
+	var state HandshakeState
+	var actions []HandshakeAction
+	var alert Alert
+
+	if err := c.config.Init(c.isClient); err != nil {
+		logf(logTypeHandshake, "Error initializing config: %v", err)
+		return AlertInternalError
+	}
+
+	opts := ConnectionOptions{
+		ServerName: c.config.ServerName,
+		NextProtos: c.config.NextProtos,
+	}
+
+	if c.isClient {
+		state, actions, alert = clientStateStart{Config: c.config, Opts: opts, hsCtx: c.hsCtx}.Next(nil)
+		if alert != AlertNoAlert {
+			logf(logTypeHandshake, "Error initializing client state: %v", alert)
+			return alert
+		}
+
+		for _, action := range actions {
+			alert = c.takeAction(action)
+			if alert != AlertNoAlert {
+				logf(logTypeHandshake, "Error during handshake actions: %v", alert)
+				return alert
+			}
+		}
+	} else {
+		if c.config.RequireCookie && c.config.CookieProtector == nil {
+			logf(logTypeHandshake, "RequireCookie set, but no CookieProtector provided. Using default cookie protector. Stateless Retry not possible.")
+			if c.config.NonBlocking {
+				logf(logTypeHandshake, "Not possible in non-blocking mode.")
+				return AlertInternalError
+			}
+			var err error
+			c.config.CookieProtector, err = NewDefaultCookieProtector()
+			if err != nil {
+				logf(logTypeHandshake, "Error initializing cookie source: %v", alert)
+				return AlertInternalError
+			}
+		}
+		state = serverStateStart{Config: c.config, conn: c, hsCtx: c.hsCtx}
+	}
+
+	c.hState = state
+	return AlertNoAlert
+}
+
+type handshakeMessageReader interface {
+	ReadMessage() (*HandshakeMessage, Alert)
+}
+
+type handshakeMessageReaderImpl struct {
+	hsCtx *HandshakeContext
+}
+
+var _ handshakeMessageReader = &handshakeMessageReaderImpl{}
+
+func (r *handshakeMessageReaderImpl) ReadMessage() (*HandshakeMessage, Alert) {
+	var hm *HandshakeMessage
+	var err error
+	for {
+		hm, err = r.hsCtx.hIn.ReadMessage()
+		if err == AlertWouldBlock {
+			return nil, AlertWouldBlock
+		}
+		if err != nil {
+			logf(logTypeHandshake, "Error reading message: %v", err)
+			return nil, AlertCloseNotify
+		}
+		if hm != nil {
+			break
+		}
+	}
+
+	return hm, AlertNoAlert
+}
+
+// Handshake causes a TLS handshake on the connection.  The `isClient` member
+// determines whether a client or server handshake is performed.  If a
+// handshake has already been performed, then its result will be returned.
+func (c *Conn) Handshake() Alert {
+	label := "[server]"
+	if c.isClient {
+		label = "[client]"
+	}
+
+	// TODO Lock handshakeMutex
+	// TODO Remove CloseNotify hack
+	if c.handshakeAlert != AlertNoAlert && c.handshakeAlert != AlertCloseNotify {
+		logf(logTypeHandshake, "Pre-existing handshake error: %v", c.handshakeAlert)
+		return c.handshakeAlert
+	}
+	if c.handshakeComplete {
+		return AlertNoAlert
+	}
+
+	if c.hState == nil {
+		logf(logTypeHandshake, "%s First time through handshake (or after stateless retry), setting up", label)
+		alert := c.HandshakeSetup()
+		if alert != AlertNoAlert || (c.isClient && c.config.NonBlocking) {
+			return alert
+		}
+	}
+
+	logf(logTypeHandshake, "(Re-)entering handshake, state=%v", c.hState)
+	state := c.hState
+	_, connected := state.(stateConnected)
+
+	hmr := &handshakeMessageReaderImpl{hsCtx: c.hsCtx}
+	for !connected {
+		var alert Alert
+		var actions []HandshakeAction
+
+		// Advance the state machine
+		state, actions, alert = state.Next(hmr)
+		if alert == AlertWouldBlock {
+			logf(logTypeHandshake, "%s Would block reading message: %s", label, alert)
+			// If we blocked, then run our timers to see if any have expired.
+			if c.hsCtx.hIn.datagram {
+				if err := c.hsCtx.timers.check(time.Now()); err != nil {
+					return AlertInternalError
+				}
+			}
+			return AlertWouldBlock
+		}
+		if alert == AlertCloseNotify {
+			logf(logTypeHandshake, "%s Error reading message: %s", label, alert)
+			c.sendAlert(AlertCloseNotify)
+			return AlertCloseNotify
+		}
+		if alert != AlertNoAlert && alert != AlertStatelessRetry {
+			logf(logTypeHandshake, "Error in state transition: %v", alert)
+			return alert
+		}
+
+		for index, action := range actions {
+			logf(logTypeHandshake, "%s taking next action (%d)", label, index)
+			if alert := c.takeAction(action); alert != AlertNoAlert {
+				logf(logTypeHandshake, "Error during handshake actions: %v", alert)
+				c.sendAlert(alert)
+				return alert
+			}
+		}
+
+		c.hState = state
+		logf(logTypeHandshake, "state is now %s", c.GetHsState())
+		_, connected = state.(stateConnected)
+		if connected {
+			c.state = state.(stateConnected)
+			c.handshakeComplete = true
+
+			if !c.isClient {
+				// Send NewSessionTicket if configured to
+				if c.config.SendSessionTickets {
+					actions, alert := c.state.NewSessionTicket(
+						c.config.TicketLen,
+						c.config.TicketLifetime,
+						c.config.EarlyDataLifetime)
+
+					for _, action := range actions {
+						alert = c.takeAction(action)
+						if alert != AlertNoAlert {
+							logf(logTypeHandshake, "Error during handshake actions: %v", alert)
+							c.sendAlert(alert)
+							return alert
+						}
+					}
+				}
+
+				// If there is early data, move it into the main buffer
+				if c.hsCtx.earlyData != nil {
+					c.readBuffer = c.hsCtx.earlyData
+					c.hsCtx.earlyData = nil
+				}
+
+			} else {
+				assert(c.hsCtx.earlyData == nil)
+			}
+		}
+
+		if c.config.NonBlocking {
+			if alert == AlertStatelessRetry {
+				return AlertStatelessRetry
+			}
+			return AlertNoAlert
+		}
+	}
+
+	return AlertNoAlert
+}
+
+func (c *Conn) SendKeyUpdate(requestUpdate bool) error {
+	if !c.handshakeComplete {
+		return fmt.Errorf("Cannot update keys until after handshake")
+	}
+
+	request := KeyUpdateNotRequested
+	if requestUpdate {
+		request = KeyUpdateRequested
+	}
+
+	// Create the key update and update state
+	actions, alert := c.state.KeyUpdate(request)
+	if alert != AlertNoAlert {
+		c.sendAlert(alert)
+		return fmt.Errorf("Alert while generating key update: %v", alert)
+	}
+
+	// Take actions (send key update and rekey)
+	for _, action := range actions {
+		alert = c.takeAction(action)
+		if alert != AlertNoAlert {
+			c.sendAlert(alert)
+			return fmt.Errorf("Alert during key update actions: %v", alert)
+		}
+	}
+
+	return nil
+}
+
+func (c *Conn) GetHsState() State {
+	if c.hState == nil {
+		return StateInit
+	}
+	return c.hState.State()
+}
+
+func (c *Conn) ComputeExporter(label string, context []byte, keyLength int) ([]byte, error) {
+	_, connected := c.hState.(stateConnected)
+	if !connected {
+		return nil, fmt.Errorf("Cannot compute exporter when state is not connected")
+	}
+
+	if c.state.exporterSecret == nil {
+		return nil, fmt.Errorf("Internal error: no exporter secret")
+	}
+
+	h0 := c.state.cryptoParams.Hash.New().Sum(nil)
+	tmpSecret := deriveSecret(c.state.cryptoParams, c.state.exporterSecret, label, h0)
+
+	hc := c.state.cryptoParams.Hash.New().Sum(context)
+	return HkdfExpandLabel(c.state.cryptoParams.Hash, tmpSecret, "exporter", hc, keyLength), nil
+}
+
+func (c *Conn) ConnectionState() ConnectionState {
+	state := ConnectionState{
+		HandshakeState: c.GetHsState(),
+	}
+
+	if c.handshakeComplete {
+		state.CipherSuite = cipherSuiteMap[c.state.Params.CipherSuite]
+		state.NextProto = c.state.Params.NextProto
+		state.VerifiedChains = c.state.verifiedChains
+		state.PeerCertificates = c.state.peerCertificates
+		state.UsingPSK = c.state.Params.UsingPSK
+		state.UsingEarlyData = c.state.Params.UsingEarlyData
+	}
+
+	return state
+}
+
+func (c *Conn) Writable() bool {
+	// If we're connected, we're writable.
+	if _, connected := c.hState.(stateConnected); connected {
+		return true
+	}
+
+	// If we're a client in 0-RTT, then we're writable.
+	if c.isClient && c.out.cipher.epoch == EpochEarlyData {
+		return true
+	}
+
+	return false
+}
+
+func (c *Conn) label() string {
+	if c.isClient {
+		return "client"
+	}
+	return "server"
+}

vendor/github.com/bifurcation/mint/cookie-protector.go

@@ -0,0 +1,86 @@
+package mint
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"io"
+
+	"golang.org/x/crypto/hkdf"
+)
+
+// CookieProtector is used to create and verify a cookie
+type CookieProtector interface {
+	// NewToken creates a new token
+	NewToken([]byte) ([]byte, error)
+	// DecodeToken decodes a token
+	DecodeToken([]byte) ([]byte, error)
+}
+
+const cookieSecretSize = 32
+const cookieNonceSize = 32
+
+// The DefaultCookieProtector is a simple implementation for the CookieProtector.
+type DefaultCookieProtector struct {
+	secret []byte
+}
+
+var _ CookieProtector = &DefaultCookieProtector{}
+
+// NewDefaultCookieProtector creates a source for source address tokens
+func NewDefaultCookieProtector() (CookieProtector, error) {
+	secret := make([]byte, cookieSecretSize)
+	if _, err := rand.Read(secret); err != nil {
+		return nil, err
+	}
+	return &DefaultCookieProtector{secret: secret}, nil
+}
+
+// NewToken encodes data into a new token.
+func (s *DefaultCookieProtector) NewToken(data []byte) ([]byte, error) {
+	nonce := make([]byte, cookieNonceSize)
+	if _, err := rand.Read(nonce); err != nil {
+		return nil, err
+	}
+	aead, aeadNonce, err := s.createAEAD(nonce)
+	if err != nil {
+		return nil, err
+	}
+	return append(nonce, aead.Seal(nil, aeadNonce, data, nil)...), nil
+}
+
+// DecodeToken decodes a token.
+func (s *DefaultCookieProtector) DecodeToken(p []byte) ([]byte, error) {
+	if len(p) < cookieNonceSize {
+		return nil, fmt.Errorf("Token too short: %d", len(p))
+	}
+	nonce := p[:cookieNonceSize]
+	aead, aeadNonce, err := s.createAEAD(nonce)
+	if err != nil {
+		return nil, err
+	}
+	return aead.Open(nil, aeadNonce, p[cookieNonceSize:], nil)
+}
+
+func (s *DefaultCookieProtector) createAEAD(nonce []byte) (cipher.AEAD, []byte, error) {
+	h := hkdf.New(sha256.New, s.secret, nonce, []byte("mint cookie source"))
+	key := make([]byte, 32) // use a 32 byte key, in order to select AES-256
+	if _, err := io.ReadFull(h, key); err != nil {
+		return nil, nil, err
+	}
+	aeadNonce := make([]byte, 12)
+	if _, err := io.ReadFull(h, aeadNonce); err != nil {
+		return nil, nil, err
+	}
+	c, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, nil, err
+	}
+	aead, err := cipher.NewGCM(c)
+	if err != nil {
+		return nil, nil, err
+	}
+	return aead, aeadNonce, nil
+}

vendor/github.com/bifurcation/mint/crypto.go

@@ -0,0 +1,667 @@
+package mint
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"fmt"
+	"math/big"
+	"time"
+
+	"golang.org/x/crypto/curve25519"
+
+	// Blank includes to ensure hash support
+	_ "crypto/sha1"
+	_ "crypto/sha256"
+	_ "crypto/sha512"
+)
+
+var prng = rand.Reader
+
+type aeadFactory func(key []byte) (cipher.AEAD, error)
+
+type CipherSuiteParams struct {
+	Suite  CipherSuite
+	Cipher aeadFactory // Cipher factory
+	Hash   crypto.Hash // Hash function
+	KeyLen int         // Key length in octets
+	IvLen  int         // IV length in octets
+}
+
+type signatureAlgorithm uint8
+
+const (
+	signatureAlgorithmUnknown = iota
+	signatureAlgorithmRSA_PKCS1
+	signatureAlgorithmRSA_PSS
+	signatureAlgorithmECDSA
+)
+
+var (
+	hashMap = map[SignatureScheme]crypto.Hash{
+		RSA_PKCS1_SHA1:    crypto.SHA1,
+		RSA_PKCS1_SHA256:  crypto.SHA256,
+		RSA_PKCS1_SHA384:  crypto.SHA384,
+		RSA_PKCS1_SHA512:  crypto.SHA512,
+		ECDSA_P256_SHA256: crypto.SHA256,
+		ECDSA_P384_SHA384: crypto.SHA384,
+		ECDSA_P521_SHA512: crypto.SHA512,
+		RSA_PSS_SHA256:    crypto.SHA256,
+		RSA_PSS_SHA384:    crypto.SHA384,
+		RSA_PSS_SHA512:    crypto.SHA512,
+	}
+
+	sigMap = map[SignatureScheme]signatureAlgorithm{
+		RSA_PKCS1_SHA1:    signatureAlgorithmRSA_PKCS1,
+		RSA_PKCS1_SHA256:  signatureAlgorithmRSA_PKCS1,
+		RSA_PKCS1_SHA384:  signatureAlgorithmRSA_PKCS1,
+		RSA_PKCS1_SHA512:  signatureAlgorithmRSA_PKCS1,
+		ECDSA_P256_SHA256: signatureAlgorithmECDSA,
+		ECDSA_P384_SHA384: signatureAlgorithmECDSA,
+		ECDSA_P521_SHA512: signatureAlgorithmECDSA,
+		RSA_PSS_SHA256:    signatureAlgorithmRSA_PSS,
+		RSA_PSS_SHA384:    signatureAlgorithmRSA_PSS,
+		RSA_PSS_SHA512:    signatureAlgorithmRSA_PSS,
+	}
+
+	curveMap = map[SignatureScheme]NamedGroup{
+		ECDSA_P256_SHA256: P256,
+		ECDSA_P384_SHA384: P384,
+		ECDSA_P521_SHA512: P521,
+	}
+
+	newAESGCM = func(key []byte) (cipher.AEAD, error) {
+		block, err := aes.NewCipher(key)
+		if err != nil {
+			return nil, err
+		}
+
+		// TLS always uses 12-byte nonces
+		return cipher.NewGCMWithNonceSize(block, 12)
+	}
+
+	cipherSuiteMap = map[CipherSuite]CipherSuiteParams{
+		TLS_AES_128_GCM_SHA256: {
+			Suite:  TLS_AES_128_GCM_SHA256,
+			Cipher: newAESGCM,
+			Hash:   crypto.SHA256,
+			KeyLen: 16,
+			IvLen:  12,
+		},
+		TLS_AES_256_GCM_SHA384: {
+			Suite:  TLS_AES_256_GCM_SHA384,
+			Cipher: newAESGCM,
+			Hash:   crypto.SHA384,
+			KeyLen: 32,
+			IvLen:  12,
+		},
+	}
+
+	x509AlgMap = map[SignatureScheme]x509.SignatureAlgorithm{
+		RSA_PKCS1_SHA1:    x509.SHA1WithRSA,
+		RSA_PKCS1_SHA256:  x509.SHA256WithRSA,
+		RSA_PKCS1_SHA384:  x509.SHA384WithRSA,
+		RSA_PKCS1_SHA512:  x509.SHA512WithRSA,
+		ECDSA_P256_SHA256: x509.ECDSAWithSHA256,
+		ECDSA_P384_SHA384: x509.ECDSAWithSHA384,
+		ECDSA_P521_SHA512: x509.ECDSAWithSHA512,
+	}
+
+	defaultRSAKeySize = 2048
+)
+
+func curveFromNamedGroup(group NamedGroup) (crv elliptic.Curve) {
+	switch group {
+	case P256:
+		crv = elliptic.P256()
+	case P384:
+		crv = elliptic.P384()
+	case P521:
+		crv = elliptic.P521()
+	}
+	return
+}
+
+func namedGroupFromECDSAKey(key *ecdsa.PublicKey) (g NamedGroup) {
+	switch key.Curve.Params().Name {
+	case elliptic.P256().Params().Name:
+		g = P256
+	case elliptic.P384().Params().Name:
+		g = P384
+	case elliptic.P521().Params().Name:
+		g = P521
+	}
+	return
+}
+
+func keyExchangeSizeFromNamedGroup(group NamedGroup) (size int) {
+	size = 0
+	switch group {
+	case X25519:
+		size = 32
+	case P256:
+		size = 65
+	case P384:
+		size = 97
+	case P521:
+		size = 133
+	case FFDHE2048:
+		size = 256
+	case FFDHE3072:
+		size = 384
+	case FFDHE4096:
+		size = 512
+	case FFDHE6144:
+		size = 768
+	case FFDHE8192:
+		size = 1024
+	}
+	return
+}
+
+func primeFromNamedGroup(group NamedGroup) (p *big.Int) {
+	switch group {
+	case FFDHE2048:
+		p = finiteFieldPrime2048
+	case FFDHE3072:
+		p = finiteFieldPrime3072
+	case FFDHE4096:
+		p = finiteFieldPrime4096
+	case FFDHE6144:
+		p = finiteFieldPrime6144
+	case FFDHE8192:
+		p = finiteFieldPrime8192
+	}
+	return
+}
+
+func schemeValidForKey(alg SignatureScheme, key crypto.Signer) bool {
+	sigType := sigMap[alg]
+	switch key.(type) {
+	case *rsa.PrivateKey:
+		return sigType == signatureAlgorithmRSA_PKCS1 || sigType == signatureAlgorithmRSA_PSS
+	case *ecdsa.PrivateKey:
+		return sigType == signatureAlgorithmECDSA
+	default:
+		return false
+	}
+}
+
+func ffdheKeyShareFromPrime(p *big.Int) (priv, pub *big.Int, err error) {
+	primeLen := len(p.Bytes())
+	for {
+		// g = 2 for all ffdhe groups
+		priv, err = rand.Int(prng, p)
+		if err != nil {
+			return
+		}
+
+		pub = big.NewInt(0)
+		pub.Exp(big.NewInt(2), priv, p)
+
+		if len(pub.Bytes()) == primeLen {
+			return
+		}
+	}
+}
+
+func newKeyShare(group NamedGroup) (pub []byte, priv []byte, err error) {
+	switch group {
+	case P256, P384, P521:
+		var x, y *big.Int
+		crv := curveFromNamedGroup(group)
+		priv, x, y, err = elliptic.GenerateKey(crv, prng)
+		if err != nil {
+			return
+		}
+
+		pub = elliptic.Marshal(crv, x, y)
+		return
+
+	case FFDHE2048, FFDHE3072, FFDHE4096, FFDHE6144, FFDHE8192:
+		p := primeFromNamedGroup(group)
+		x, X, err2 := ffdheKeyShareFromPrime(p)
+		if err2 != nil {
+			err = err2
+			return
+		}
+
+		priv = x.Bytes()
+		pubBytes := X.Bytes()
+
+		numBytes := keyExchangeSizeFromNamedGroup(group)
+
+		pub = make([]byte, numBytes)
+		copy(pub[numBytes-len(pubBytes):], pubBytes)
+
+		return
+
+	case X25519:
+		var private, public [32]byte
+		_, err = prng.Read(private[:])
+		if err != nil {
+			return
+		}
+
+		curve25519.ScalarBaseMult(&public, &private)
+		priv = private[:]
+		pub = public[:]
+		return
+
+	default:
+		return nil, nil, fmt.Errorf("tls.newkeyshare: Unsupported group %v", group)
+	}
+}
+
+func keyAgreement(group NamedGroup, pub []byte, priv []byte) ([]byte, error) {
+	switch group {
+	case P256, P384, P521:
+		if len(pub) != keyExchangeSizeFromNamedGroup(group) {
+			return nil, fmt.Errorf("tls.keyagreement: Wrong public key size")
+		}
+
+		crv := curveFromNamedGroup(group)
+		pubX, pubY := elliptic.Unmarshal(crv, pub)
+		x, _ := crv.Params().ScalarMult(pubX, pubY, priv)
+		xBytes := x.Bytes()
+
+		numBytes := len(crv.Params().P.Bytes())
+
+		ret := make([]byte, numBytes)
+		copy(ret[numBytes-len(xBytes):], xBytes)
+
+		return ret, nil
+
+	case FFDHE2048, FFDHE3072, FFDHE4096, FFDHE6144, FFDHE8192:
+		numBytes := keyExchangeSizeFromNamedGroup(group)
+		if len(pub) != numBytes {
+			return nil, fmt.Errorf("tls.keyagreement: Wrong public key size")
+		}
+		p := primeFromNamedGroup(group)
+		x := big.NewInt(0).SetBytes(priv)
+		Y := big.NewInt(0).SetBytes(pub)
+		ZBytes := big.NewInt(0).Exp(Y, x, p).Bytes()
+
+		ret := make([]byte, numBytes)
+		copy(ret[numBytes-len(ZBytes):], ZBytes)
+
+		return ret, nil
+
+	case X25519:
+		if len(pub) != keyExchangeSizeFromNamedGroup(group) {
+			return nil, fmt.Errorf("tls.keyagreement: Wrong public key size")
+		}
+
+		var private, public, ret [32]byte
+		copy(private[:], priv)
+		copy(public[:], pub)
+		curve25519.ScalarMult(&ret, &private, &public)
+
+		return ret[:], nil
+
+	default:
+		return nil, fmt.Errorf("tls.keyagreement: Unsupported group %v", group)
+	}
+}
+
+func newSigningKey(sig SignatureScheme) (crypto.Signer, error) {
+	switch sig {
+	case RSA_PKCS1_SHA1, RSA_PKCS1_SHA256,
+		RSA_PKCS1_SHA384, RSA_PKCS1_SHA512,
+		RSA_PSS_SHA256, RSA_PSS_SHA384,
+		RSA_PSS_SHA512:
+		return rsa.GenerateKey(prng, defaultRSAKeySize)
+	case ECDSA_P256_SHA256:
+		return ecdsa.GenerateKey(elliptic.P256(), prng)
+	case ECDSA_P384_SHA384:
+		return ecdsa.GenerateKey(elliptic.P384(), prng)
+	case ECDSA_P521_SHA512:
+		return ecdsa.GenerateKey(elliptic.P521(), prng)
+	default:
+		return nil, fmt.Errorf("tls.newsigningkey: Unsupported signature algorithm [%04x]", sig)
+	}
+}
+
+// XXX(rlb): Copied from crypto/x509
+type ecdsaSignature struct {
+	R, S *big.Int
+}
+
+func sign(alg SignatureScheme, privateKey crypto.Signer, sigInput []byte) ([]byte, error) {
+	var opts crypto.SignerOpts
+
+	hash := hashMap[alg]
+	if hash == crypto.SHA1 {
+		return nil, fmt.Errorf("tls.crypt.sign: Use of SHA-1 is forbidden")
+	}
+
+	sigType := sigMap[alg]
+	var realInput []byte
+	switch key := privateKey.(type) {
+	case *rsa.PrivateKey:
+		switch {
+		case allowPKCS1 && sigType == signatureAlgorithmRSA_PKCS1:
+			logf(logTypeCrypto, "signing with PKCS1, hashSize=[%d]", hash.Size())
+			opts = hash
+		case !allowPKCS1 && sigType == signatureAlgorithmRSA_PKCS1:
+			fallthrough
+		case sigType == signatureAlgorithmRSA_PSS:
+			logf(logTypeCrypto, "signing with PSS, hashSize=[%d]", hash.Size())
+			opts = &rsa.PSSOptions{SaltLength: hash.Size(), Hash: hash}
+		default:
+			return nil, fmt.Errorf("tls.crypto.sign: Unsupported algorithm for RSA key")
+		}
+
+		h := hash.New()
+		h.Write(sigInput)
+		realInput = h.Sum(nil)
+	case *ecdsa.PrivateKey:
+		if sigType != signatureAlgorithmECDSA {
+			return nil, fmt.Errorf("tls.crypto.sign: Unsupported algorithm for ECDSA key")
+		}
+
+		algGroup := curveMap[alg]
+		keyGroup := namedGroupFromECDSAKey(key.Public().(*ecdsa.PublicKey))
+		if algGroup != keyGroup {
+			return nil, fmt.Errorf("tls.crypto.sign: Unsupported hash/curve combination")
+		}
+
+		h := hash.New()
+		h.Write(sigInput)
+		realInput = h.Sum(nil)
+	default:
+		return nil, fmt.Errorf("tls.crypto.sign: Unsupported private key type")
+	}
+
+	sig, err := privateKey.Sign(prng, realInput, opts)
+	logf(logTypeCrypto, "signature: %x", sig)
+	return sig, err
+}
+
+func verify(alg SignatureScheme, publicKey crypto.PublicKey, sigInput []byte, sig []byte) error {
+	hash := hashMap[alg]
+
+	if hash == crypto.SHA1 {
+		return fmt.Errorf("tls.crypt.sign: Use of SHA-1 is forbidden")
+	}
+
+	sigType := sigMap[alg]
+	switch pub := publicKey.(type) {
+	case *rsa.PublicKey:
+		switch {
+		case allowPKCS1 && sigType == signatureAlgorithmRSA_PKCS1:
+			logf(logTypeCrypto, "verifying with PKCS1, hashSize=[%d]", hash.Size())
+
+			h := hash.New()
+			h.Write(sigInput)
+			realInput := h.Sum(nil)
+			return rsa.VerifyPKCS1v15(pub, hash, realInput, sig)
+		case !allowPKCS1 && sigType == signatureAlgorithmRSA_PKCS1:
+			fallthrough
+		case sigType == signatureAlgorithmRSA_PSS:
+			logf(logTypeCrypto, "verifying with PSS, hashSize=[%d]", hash.Size())
+			opts := &rsa.PSSOptions{SaltLength: hash.Size(), Hash: hash}
+
+			h := hash.New()
+			h.Write(sigInput)
+			realInput := h.Sum(nil)
+			return rsa.VerifyPSS(pub, hash, realInput, sig, opts)
+		default:
+			return fmt.Errorf("tls.verify: Unsupported algorithm for RSA key")
+		}
+
+	case *ecdsa.PublicKey:
+		if sigType != signatureAlgorithmECDSA {
+			return fmt.Errorf("tls.verify: Unsupported algorithm for ECDSA key")
+		}
+
+		if curveMap[alg] != namedGroupFromECDSAKey(pub) {
+			return fmt.Errorf("tls.verify: Unsupported curve for ECDSA key")
+		}
+
+		ecdsaSig := new(ecdsaSignature)
+		if rest, err := asn1.Unmarshal(sig, ecdsaSig); err != nil {
+			return err
+		} else if len(rest) != 0 {
+			return fmt.Errorf("tls.verify: trailing data after ECDSA signature")
+		}
+		if ecdsaSig.R.Sign() <= 0 || ecdsaSig.S.Sign() <= 0 {
+			return fmt.Errorf("tls.verify: ECDSA signature contained zero or negative values")
+		}
+
+		h := hash.New()
+		h.Write(sigInput)
+		realInput := h.Sum(nil)
+		if !ecdsa.Verify(pub, realInput, ecdsaSig.R, ecdsaSig.S) {
+			return fmt.Errorf("tls.verify: ECDSA verification failure")
+		}
+		return nil
+	default:
+		return fmt.Errorf("tls.verify: Unsupported key type")
+	}
+}
+
+//                  0
+//                  |
+//                  v
+//    PSK ->  HKDF-Extract = Early Secret
+//                  |
+//                  +-----> Derive-Secret(.,
+//                  |                     "ext binder" |
+//                  |                     "res binder",
+//                  |                     "")
+//                  |                     = binder_key
+//                  |
+//                  +-----> Derive-Secret(., "c e traffic",
+//                  |                     ClientHello)
+//                  |                     = client_early_traffic_secret
+//                  |
+//                  +-----> Derive-Secret(., "e exp master",
+//                  |                     ClientHello)
+//                  |                     = early_exporter_master_secret
+//                  v
+//            Derive-Secret(., "derived", "")
+//                  |
+//                  v
+// (EC)DHE -> HKDF-Extract = Handshake Secret
+//                  |
+//                  +-----> Derive-Secret(., "c hs traffic",
+//                  |                     ClientHello...ServerHello)
+//                  |                     = client_handshake_traffic_secret
+//                  |
+//                  +-----> Derive-Secret(., "s hs traffic",
+//                  |                     ClientHello...ServerHello)
+//                  |                     = server_handshake_traffic_secret
+//                  v
+//            Derive-Secret(., "derived", "")
+//                  |
+//                  v
+//       0 -> HKDF-Extract = Master Secret
+//                  |
+//                  +-----> Derive-Secret(., "c ap traffic",
+//                  |                     ClientHello...server Finished)
+//                  |                     = client_application_traffic_secret_0
+//                  |
+//                  +-----> Derive-Secret(., "s ap traffic",
+//                  |                     ClientHello...server Finished)
+//                  |                     = server_application_traffic_secret_0
+//                  |
+//                  +-----> Derive-Secret(., "exp master",
+//                  |                     ClientHello...server Finished)
+//                  |                     = exporter_master_secret
+//                  |
+//                  +-----> Derive-Secret(., "res master",
+//                                        ClientHello...client Finished)
+//                                        = resumption_master_secret
+
+// From RFC 5869
+// PRK = HMAC-Hash(salt, IKM)
+func HkdfExtract(hash crypto.Hash, saltIn, input []byte) []byte {
+	salt := saltIn
+
+	// if [salt is] not provided, it is set to a string of HashLen zeros
+	if salt == nil {
+		salt = bytes.Repeat([]byte{0}, hash.Size())
+	}
+
+	h := hmac.New(hash.New, salt)
+	h.Write(input)
+	out := h.Sum(nil)
+
+	logf(logTypeCrypto, "HKDF Extract:\n")
+	logf(logTypeCrypto, "Salt [%d]: %x\n", len(salt), salt)
+	logf(logTypeCrypto, "Input [%d]: %x\n", len(input), input)
+	logf(logTypeCrypto, "Output [%d]: %x\n", len(out), out)
+
+	return out
+}
+
+const (
+	labelExternalBinder                 = "ext binder"
+	labelResumptionBinder               = "res binder"
+	labelEarlyTrafficSecret             = "c e traffic"
+	labelEarlyExporterSecret            = "e exp master"
+	labelClientHandshakeTrafficSecret   = "c hs traffic"
+	labelServerHandshakeTrafficSecret   = "s hs traffic"
+	labelClientApplicationTrafficSecret = "c ap traffic"
+	labelServerApplicationTrafficSecret = "s ap traffic"
+	labelExporterSecret                 = "exp master"
+	labelResumptionSecret               = "res master"
+	labelDerived                        = "derived"
+	labelFinished                       = "finished"
+	labelResumption                     = "resumption"
+)
+
+// struct HkdfLabel {
+//    uint16 length;
+//    opaque label<9..255>;
+//    opaque hash_value<0..255>;
+// };
+func hkdfEncodeLabel(labelIn string, hashValue []byte, outLen int) []byte {
+	label := "tls13 " + labelIn
+
+	labelLen := len(label)
+	hashLen := len(hashValue)
+	hkdfLabel := make([]byte, 2+1+labelLen+1+hashLen)
+	hkdfLabel[0] = byte(outLen >> 8)
+	hkdfLabel[1] = byte(outLen)
+	hkdfLabel[2] = byte(labelLen)
+	copy(hkdfLabel[3:3+labelLen], []byte(label))
+	hkdfLabel[3+labelLen] = byte(hashLen)
+	copy(hkdfLabel[3+labelLen+1:], hashValue)
+
+	return hkdfLabel
+}
+
+func HkdfExpand(hash crypto.Hash, prk, info []byte, outLen int) []byte {
+	out := []byte{}
+	T := []byte{}
+	i := byte(1)
+	for len(out) < outLen {
+		block := append(T, info...)
+		block = append(block, i)
+
+		h := hmac.New(hash.New, prk)
+		h.Write(block)
+
+		T = h.Sum(nil)
+		out = append(out, T...)
+		i++
+	}
+	return out[:outLen]
+}
+
+func HkdfExpandLabel(hash crypto.Hash, secret []byte, label string, hashValue []byte, outLen int) []byte {
+	info := hkdfEncodeLabel(label, hashValue, outLen)
+	derived := HkdfExpand(hash, secret, info, outLen)
+
+	logf(logTypeCrypto, "HKDF Expand: label=[tls13 ] + '%s',requested length=%d\n", label, outLen)
+	logf(logTypeCrypto, "PRK [%d]: %x\n", len(secret), secret)
+	logf(logTypeCrypto, "Hash [%d]: %x\n", len(hashValue), hashValue)
+	logf(logTypeCrypto, "Info [%d]: %x\n", len(info), info)
+	logf(logTypeCrypto, "Derived key [%d]: %x\n", len(derived), derived)
+
+	return derived
+}
+
+func deriveSecret(params CipherSuiteParams, secret []byte, label string, messageHash []byte) []byte {
+	return HkdfExpandLabel(params.Hash, secret, label, messageHash, params.Hash.Size())
+}
+
+func computeFinishedData(params CipherSuiteParams, baseKey []byte, input []byte) []byte {
+	macKey := HkdfExpandLabel(params.Hash, baseKey, labelFinished, []byte{}, params.Hash.Size())
+	mac := hmac.New(params.Hash.New, macKey)
+	mac.Write(input)
+	return mac.Sum(nil)
+}
+
+type keySet struct {
+	cipher aeadFactory
+	key    []byte
+	iv     []byte
+}
+
+func makeTrafficKeys(params CipherSuiteParams, secret []byte) keySet {
+	logf(logTypeCrypto, "making traffic keys: secret=%x", secret)
+	return keySet{
+		cipher: params.Cipher,
+		key:    HkdfExpandLabel(params.Hash, secret, "key", []byte{}, params.KeyLen),
+		iv:     HkdfExpandLabel(params.Hash, secret, "iv", []byte{}, params.IvLen),
+	}
+}
+
+func MakeNewSelfSignedCert(name string, alg SignatureScheme) (crypto.Signer, *x509.Certificate, error) {
+	priv, err := newSigningKey(alg)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	cert, err := newSelfSigned(name, alg, priv)
+	if err != nil {
+		return nil, nil, err
+	}
+	return priv, cert, nil
+}
+
+func newSelfSigned(name string, alg SignatureScheme, priv crypto.Signer) (*x509.Certificate, error) {
+	sigAlg, ok := x509AlgMap[alg]
+	if !ok {
+		return nil, fmt.Errorf("tls.selfsigned: Unknown signature algorithm [%04x]", alg)
+	}
+	if len(name) == 0 {
+		return nil, fmt.Errorf("tls.selfsigned: No name provided")
+	}
+
+	serial, err := rand.Int(rand.Reader, big.NewInt(0xA0A0A0A0))
+	if err != nil {
+		return nil, err
+	}
+
+	template := &x509.Certificate{
+		SerialNumber:       serial,
+		NotBefore:          time.Now(),
+		NotAfter:           time.Now().AddDate(0, 0, 1),
+		SignatureAlgorithm: sigAlg,
+		Subject:            pkix.Name{CommonName: name},
+		DNSNames:           []string{name},
+		KeyUsage:           x509.KeyUsageDigitalSignature | x509.KeyUsageKeyAgreement | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:        []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(prng, template, template, priv.Public(), priv)
+	if err != nil {
+		return nil, err
+	}
+
+	// It is safe to ignore the error here because we're parsing known-good data
+	cert, _ := x509.ParseCertificate(der)
+	return cert, nil
+}

vendor/github.com/bifurcation/mint/dtls.go

@@ -0,0 +1,222 @@
+package mint
+
+import (
+	"fmt"
+	"github.com/bifurcation/mint/syntax"
+	"time"
+)
+
+const (
+	initialMtu     = 1200
+	initialTimeout = 100
+)
+
+// labels for timers
+const (
+	retransmitTimerLabel = "handshake retransmit"
+	ackTimerLabel        = "ack timer"
+)
+
+type SentHandshakeFragment struct {
+	seq        uint32
+	offset     int
+	fragLength int
+	record     uint64
+	acked      bool
+}
+
+type DtlsAck struct {
+	RecordNumbers []uint64 `tls:"head=2"`
+}
+
+func wireVersion(h *HandshakeLayer) uint16 {
+	if h.datagram {
+		return dtls12WireVersion
+	}
+	return tls12Version
+}
+
+func dtlsConvertVersion(version uint16) uint16 {
+	if version == tls12Version {
+		return dtls12WireVersion
+	}
+	if version == tls10Version {
+		return 0xfeff
+	}
+	panic(fmt.Sprintf("Internal error, unexpected version=%d", version))
+}
+
+// TODO(ekr@rtfm.com): Move these to state-machine.go
+func (h *HandshakeContext) handshakeRetransmit() error {
+	if _, err := h.hOut.SendQueuedMessages(); err != nil {
+		return err
+	}
+
+	h.timers.start(retransmitTimerLabel,
+		h.handshakeRetransmit,
+		h.timeoutMS)
+
+	// TODO(ekr@rtfm.com): Back off timer
+	return nil
+}
+
+func (h *HandshakeContext) sendAck() error {
+	toack := h.hIn.recvdRecords
+
+	count := (initialMtu - 2) / 8 // TODO(ekr@rtfm.com): Current MTU
+	if len(toack) > count {
+		toack = toack[:count]
+	}
+	logf(logTypeHandshake, "Sending ACK: [%x]", toack)
+
+	ack := &DtlsAck{toack}
+	body, err := syntax.Marshal(&ack)
+	if err != nil {
+		return err
+	}
+	err = h.hOut.conn.WriteRecord(&TLSPlaintext{
+		contentType: RecordTypeAck,
+		fragment:    body,
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func (h *HandshakeContext) processAck(data []byte) error {
+	// Cancel the retransmit timer because we will be resending
+	// and possibly re-arming later.
+	h.timers.cancel(retransmitTimerLabel)
+
+	ack := &DtlsAck{}
+	read, err := syntax.Unmarshal(data, &ack)
+	if err != nil {
+		return err
+	}
+	if len(data) != read {
+		return fmt.Errorf("Invalid encoding: Extra data not consumed")
+	}
+	logf(logTypeHandshake, "ACK: [%x]", ack.RecordNumbers)
+
+	for _, r := range ack.RecordNumbers {
+		for _, m := range h.sentFragments {
+			if r == m.record {
+				logf(logTypeHandshake, "Marking %v %v(%v) as acked",
+					m.seq, m.offset, m.fragLength)
+				m.acked = true
+			}
+		}
+	}
+
+	count, err := h.hOut.SendQueuedMessages()
+	if err != nil {
+		return err
+	}
+
+	if count == 0 {
+		logf(logTypeHandshake, "All messages ACKed")
+		h.hOut.ClearQueuedMessages()
+		return nil
+	}
+
+	// Reset the timer
+	h.timers.start(retransmitTimerLabel,
+		h.handshakeRetransmit,
+		h.timeoutMS)
+
+	return nil
+}
+
+func (c *Conn) GetDTLSTimeout() (bool, time.Duration) {
+	return c.hsCtx.timers.remaining()
+}
+
+func (h *HandshakeContext) receivedHandshakeMessage() {
+	logf(logTypeHandshake, "%p Received handshake, waiting for start of flight = %v", h, h.waitingNextFlight)
+	// This just enables tests.
+	if h.hIn == nil {
+		return
+	}
+
+	if !h.hIn.datagram {
+		return
+	}
+
+	if h.waitingNextFlight {
+		logf(logTypeHandshake, "Received the start of the flight")
+
+		// Clear the outgoing DTLS queue and terminate the retransmit timer
+		h.hOut.ClearQueuedMessages()
+		h.timers.cancel(retransmitTimerLabel)
+
+		// OK, we're not waiting any more.
+		h.waitingNextFlight = false
+	}
+
+	// Now pre-emptively arm the ACK timer if it's not armed already.
+	// We'll automatically dis-arm it at the end of the handshake.
+	if h.timers.getTimer(ackTimerLabel) == nil {
+		h.timers.start(ackTimerLabel, h.sendAck, h.timeoutMS/4)
+	}
+}
+
+func (h *HandshakeContext) receivedEndOfFlight() {
+	logf(logTypeHandshake, "%p Received the end of the flight", h)
+	if !h.hIn.datagram {
+		return
+	}
+
+	// Empty incoming queue
+	h.hIn.queued = nil
+
+	// Note that we are waiting for the next flight.
+	h.waitingNextFlight = true
+
+	// Clear the ACK queue.
+	h.hIn.recvdRecords = nil
+
+	// Disarm the ACK timer
+	h.timers.cancel(ackTimerLabel)
+}
+
+func (h *HandshakeContext) receivedFinalFlight() {
+	logf(logTypeHandshake, "%p Received final flight", h)
+	if !h.hIn.datagram {
+		return
+	}
+
+	// Disarm the ACK timer
+	h.timers.cancel(ackTimerLabel)
+
+	// But send an ACK immediately.
+	h.sendAck()
+}
+
+func (h *HandshakeContext) fragmentAcked(seq uint32, offset int, fraglen int) bool {
+	logf(logTypeHandshake, "Looking to see if fragment %v %v(%v) was acked", seq, offset, fraglen)
+	for _, f := range h.sentFragments {
+		if !f.acked {
+			continue
+		}
+
+		if f.seq != seq {
+			continue
+		}
+
+		if f.offset > offset {
+			continue
+		}
+
+		// At this point, we know that the stored fragment starts
+		// at or before what we want to send, so check where the end
+		// is.
+		if f.offset+f.fragLength < offset+fraglen {
+			continue
+		}
+
+		return true
+	}
+
+	return false
+}

vendor/github.com/bifurcation/mint/extensions.go

@@ -0,0 +1,626 @@
+package mint
+
+import (
+	"bytes"
+	"fmt"
+	"github.com/bifurcation/mint/syntax"
+)
+
+type ExtensionBody interface {
+	Type() ExtensionType
+	Marshal() ([]byte, error)
+	Unmarshal(data []byte) (int, error)
+}
+
+// struct {
+//     ExtensionType extension_type;
+//     opaque extension_data<0..2^16-1>;
+// } Extension;
+type Extension struct {
+	ExtensionType ExtensionType
+	ExtensionData []byte `tls:"head=2"`
+}
+
+func (ext Extension) Marshal() ([]byte, error) {
+	return syntax.Marshal(ext)
+}
+
+func (ext *Extension) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, ext)
+}
+
+type ExtensionList []Extension
+
+type extensionListInner struct {
+	List []Extension `tls:"head=2"`
+}
+
+func (el ExtensionList) Marshal() ([]byte, error) {
+	return syntax.Marshal(extensionListInner{el})
+}
+
+func (el *ExtensionList) Unmarshal(data []byte) (int, error) {
+	var list extensionListInner
+	read, err := syntax.Unmarshal(data, &list)
+	if err != nil {
+		return 0, err
+	}
+
+	*el = list.List
+	return read, nil
+}
+
+func (el *ExtensionList) Add(src ExtensionBody) error {
+	data, err := src.Marshal()
+	if err != nil {
+		return err
+	}
+
+	if el == nil {
+		el = new(ExtensionList)
+	}
+
+	// If one already exists with this type, replace it
+	for i := range *el {
+		if (*el)[i].ExtensionType == src.Type() {
+			(*el)[i].ExtensionData = data
+			return nil
+		}
+	}
+
+	// Otherwise append
+	*el = append(*el, Extension{
+		ExtensionType: src.Type(),
+		ExtensionData: data,
+	})
+	return nil
+}
+
+func (el ExtensionList) Parse(dsts []ExtensionBody) (map[ExtensionType]bool, error) {
+	found := make(map[ExtensionType]bool)
+
+	for _, dst := range dsts {
+		for _, ext := range el {
+			if ext.ExtensionType == dst.Type() {
+				if found[dst.Type()] {
+					return nil, fmt.Errorf("Duplicate extension of type [%v]", dst.Type())
+				}
+
+				err := safeUnmarshal(dst, ext.ExtensionData)
+				if err != nil {
+					return nil, err
+				}
+
+				found[dst.Type()] = true
+			}
+		}
+	}
+
+	return found, nil
+}
+
+func (el ExtensionList) Find(dst ExtensionBody) (bool, error) {
+	for _, ext := range el {
+		if ext.ExtensionType == dst.Type() {
+			err := safeUnmarshal(dst, ext.ExtensionData)
+			if err != nil {
+				return true, err
+			}
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// struct {
+//     NameType name_type;
+//     select (name_type) {
+//         case host_name: HostName;
+//     } name;
+// } ServerName;
+//
+// enum {
+//     host_name(0), (255)
+// } NameType;
+//
+// opaque HostName<1..2^16-1>;
+//
+// struct {
+//     ServerName server_name_list<1..2^16-1>
+// } ServerNameList;
+//
+// But we only care about the case where there's a single DNS hostname.  We
+// will never create anything else, and throw if we receive something else
+//
+//      2         1          2
+// | listLen | NameType | nameLen | name |
+type ServerNameExtension string
+
+type serverNameInner struct {
+	NameType uint8
+	HostName []byte `tls:"head=2,min=1"`
+}
+
+type serverNameListInner struct {
+	ServerNameList []serverNameInner `tls:"head=2,min=1"`
+}
+
+func (sni ServerNameExtension) Type() ExtensionType {
+	return ExtensionTypeServerName
+}
+
+func (sni ServerNameExtension) Marshal() ([]byte, error) {
+	list := serverNameListInner{
+		ServerNameList: []serverNameInner{{
+			NameType: 0x00, // host_name
+			HostName: []byte(sni),
+		}},
+	}
+
+	return syntax.Marshal(list)
+}
+
+func (sni *ServerNameExtension) Unmarshal(data []byte) (int, error) {
+	var list serverNameListInner
+	read, err := syntax.Unmarshal(data, &list)
+	if err != nil {
+		return 0, err
+	}
+
+	// Syntax requires at least one entry
+	// Entries beyond the first are ignored
+	if nameType := list.ServerNameList[0].NameType; nameType != 0x00 {
+		return 0, fmt.Errorf("tls.servername: Unsupported name type [%x]", nameType)
+	}
+
+	*sni = ServerNameExtension(list.ServerNameList[0].HostName)
+	return read, nil
+}
+
+// struct {
+//     NamedGroup group;
+//     opaque key_exchange<1..2^16-1>;
+// } KeyShareEntry;
+//
+// struct {
+//     select (Handshake.msg_type) {
+//         case client_hello:
+//             KeyShareEntry client_shares<0..2^16-1>;
+//
+//         case hello_retry_request:
+//             NamedGroup selected_group;
+//
+//         case server_hello:
+//             KeyShareEntry server_share;
+//     };
+// } KeyShare;
+type KeyShareEntry struct {
+	Group       NamedGroup
+	KeyExchange []byte `tls:"head=2,min=1"`
+}
+
+func (kse KeyShareEntry) SizeValid() bool {
+	return len(kse.KeyExchange) == keyExchangeSizeFromNamedGroup(kse.Group)
+}
+
+type KeyShareExtension struct {
+	HandshakeType HandshakeType
+	SelectedGroup NamedGroup
+	Shares        []KeyShareEntry
+}
+
+type KeyShareClientHelloInner struct {
+	ClientShares []KeyShareEntry `tls:"head=2,min=0"`
+}
+type KeyShareHelloRetryInner struct {
+	SelectedGroup NamedGroup
+}
+type KeyShareServerHelloInner struct {
+	ServerShare KeyShareEntry
+}
+
+func (ks KeyShareExtension) Type() ExtensionType {
+	return ExtensionTypeKeyShare
+}
+
+func (ks KeyShareExtension) Marshal() ([]byte, error) {
+	switch ks.HandshakeType {
+	case HandshakeTypeClientHello:
+		for _, share := range ks.Shares {
+			if !share.SizeValid() {
+				return nil, fmt.Errorf("tls.keyshare: Key share has wrong size for group")
+			}
+		}
+		return syntax.Marshal(KeyShareClientHelloInner{ks.Shares})
+
+	case HandshakeTypeHelloRetryRequest:
+		if len(ks.Shares) > 0 {
+			return nil, fmt.Errorf("tls.keyshare: Key shares not allowed for HelloRetryRequest")
+		}
+
+		return syntax.Marshal(KeyShareHelloRetryInner{ks.SelectedGroup})
+
+	case HandshakeTypeServerHello:
+		if len(ks.Shares) != 1 {
+			return nil, fmt.Errorf("tls.keyshare: Server must send exactly one key share")
+		}
+
+		if !ks.Shares[0].SizeValid() {
+			return nil, fmt.Errorf("tls.keyshare: Key share has wrong size for group")
+		}
+
+		return syntax.Marshal(KeyShareServerHelloInner{ks.Shares[0]})
+
+	default:
+		return nil, fmt.Errorf("tls.keyshare: Handshake type not allowed")
+	}
+}
+
+func (ks *KeyShareExtension) Unmarshal(data []byte) (int, error) {
+	switch ks.HandshakeType {
+	case HandshakeTypeClientHello:
+		var inner KeyShareClientHelloInner
+		read, err := syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+
+		for _, share := range inner.ClientShares {
+			if !share.SizeValid() {
+				return 0, fmt.Errorf("tls.keyshare: Key share has wrong size for group")
+			}
+		}
+
+		ks.Shares = inner.ClientShares
+		return read, nil
+
+	case HandshakeTypeHelloRetryRequest:
+		var inner KeyShareHelloRetryInner
+		read, err := syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+
+		ks.SelectedGroup = inner.SelectedGroup
+		return read, nil
+
+	case HandshakeTypeServerHello:
+		var inner KeyShareServerHelloInner
+		read, err := syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+
+		if !inner.ServerShare.SizeValid() {
+			return 0, fmt.Errorf("tls.keyshare: Key share has wrong size for group")
+		}
+
+		ks.Shares = []KeyShareEntry{inner.ServerShare}
+		return read, nil
+
+	default:
+		return 0, fmt.Errorf("tls.keyshare: Handshake type not allowed")
+	}
+}
+
+// struct {
+//     NamedGroup named_group_list<2..2^16-1>;
+// } NamedGroupList;
+type SupportedGroupsExtension struct {
+	Groups []NamedGroup `tls:"head=2,min=2"`
+}
+
+func (sg SupportedGroupsExtension) Type() ExtensionType {
+	return ExtensionTypeSupportedGroups
+}
+
+func (sg SupportedGroupsExtension) Marshal() ([]byte, error) {
+	return syntax.Marshal(sg)
+}
+
+func (sg *SupportedGroupsExtension) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, sg)
+}
+
+// struct {
+//   SignatureScheme supported_signature_algorithms<2..2^16-2>;
+// } SignatureSchemeList
+type SignatureAlgorithmsExtension struct {
+	Algorithms []SignatureScheme `tls:"head=2,min=2"`
+}
+
+func (sa SignatureAlgorithmsExtension) Type() ExtensionType {
+	return ExtensionTypeSignatureAlgorithms
+}
+
+func (sa SignatureAlgorithmsExtension) Marshal() ([]byte, error) {
+	return syntax.Marshal(sa)
+}
+
+func (sa *SignatureAlgorithmsExtension) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, sa)
+}
+
+// struct {
+//     opaque identity<1..2^16-1>;
+//     uint32 obfuscated_ticket_age;
+// } PskIdentity;
+//
+// opaque PskBinderEntry<32..255>;
+//
+// struct {
+//     select (Handshake.msg_type) {
+//         case client_hello:
+//             PskIdentity identities<7..2^16-1>;
+//             PskBinderEntry binders<33..2^16-1>;
+//
+//         case server_hello:
+//             uint16 selected_identity;
+//     };
+//
+// } PreSharedKeyExtension;
+type PSKIdentity struct {
+	Identity            []byte `tls:"head=2,min=1"`
+	ObfuscatedTicketAge uint32
+}
+
+type PSKBinderEntry struct {
+	Binder []byte `tls:"head=1,min=32"`
+}
+
+type PreSharedKeyExtension struct {
+	HandshakeType    HandshakeType
+	Identities       []PSKIdentity
+	Binders          []PSKBinderEntry
+	SelectedIdentity uint16
+}
+
+type preSharedKeyClientInner struct {
+	Identities []PSKIdentity    `tls:"head=2,min=7"`
+	Binders    []PSKBinderEntry `tls:"head=2,min=33"`
+}
+
+type preSharedKeyServerInner struct {
+	SelectedIdentity uint16
+}
+
+func (psk PreSharedKeyExtension) Type() ExtensionType {
+	return ExtensionTypePreSharedKey
+}
+
+func (psk PreSharedKeyExtension) Marshal() ([]byte, error) {
+	switch psk.HandshakeType {
+	case HandshakeTypeClientHello:
+		return syntax.Marshal(preSharedKeyClientInner{
+			Identities: psk.Identities,
+			Binders:    psk.Binders,
+		})
+
+	case HandshakeTypeServerHello:
+		if len(psk.Identities) > 0 || len(psk.Binders) > 0 {
+			return nil, fmt.Errorf("tls.presharedkey: Server can only provide an index")
+		}
+		return syntax.Marshal(preSharedKeyServerInner{psk.SelectedIdentity})
+
+	default:
+		return nil, fmt.Errorf("tls.presharedkey: Handshake type not supported")
+	}
+}
+
+func (psk *PreSharedKeyExtension) Unmarshal(data []byte) (int, error) {
+	switch psk.HandshakeType {
+	case HandshakeTypeClientHello:
+		var inner preSharedKeyClientInner
+		read, err := syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+
+		if len(inner.Identities) != len(inner.Binders) {
+			return 0, fmt.Errorf("Lengths of identities and binders not equal")
+		}
+
+		psk.Identities = inner.Identities
+		psk.Binders = inner.Binders
+		return read, nil
+
+	case HandshakeTypeServerHello:
+		var inner preSharedKeyServerInner
+		read, err := syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+
+		psk.SelectedIdentity = inner.SelectedIdentity
+		return read, nil
+
+	default:
+		return 0, fmt.Errorf("tls.presharedkey: Handshake type not supported")
+	}
+}
+
+func (psk PreSharedKeyExtension) HasIdentity(id []byte) ([]byte, bool) {
+	for i, localID := range psk.Identities {
+		if bytes.Equal(localID.Identity, id) {
+			return psk.Binders[i].Binder, true
+		}
+	}
+	return nil, false
+}
+
+// enum { psk_ke(0), psk_dhe_ke(1), (255) } PskKeyExchangeMode;
+//
+// struct {
+//     PskKeyExchangeMode ke_modes<1..255>;
+// } PskKeyExchangeModes;
+type PSKKeyExchangeModesExtension struct {
+	KEModes []PSKKeyExchangeMode `tls:"head=1,min=1"`
+}
+
+func (pkem PSKKeyExchangeModesExtension) Type() ExtensionType {
+	return ExtensionTypePSKKeyExchangeModes
+}
+
+func (pkem PSKKeyExchangeModesExtension) Marshal() ([]byte, error) {
+	return syntax.Marshal(pkem)
+}
+
+func (pkem *PSKKeyExchangeModesExtension) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, pkem)
+}
+
+// struct {
+// } EarlyDataIndication;
+
+type EarlyDataExtension struct{}
+
+func (ed EarlyDataExtension) Type() ExtensionType {
+	return ExtensionTypeEarlyData
+}
+
+func (ed EarlyDataExtension) Marshal() ([]byte, error) {
+	return []byte{}, nil
+}
+
+func (ed *EarlyDataExtension) Unmarshal(data []byte) (int, error) {
+	return 0, nil
+}
+
+// struct {
+//     uint32 max_early_data_size;
+// } TicketEarlyDataInfo;
+
+type TicketEarlyDataInfoExtension struct {
+	MaxEarlyDataSize uint32
+}
+
+func (tedi TicketEarlyDataInfoExtension) Type() ExtensionType {
+	return ExtensionTypeTicketEarlyDataInfo
+}
+
+func (tedi TicketEarlyDataInfoExtension) Marshal() ([]byte, error) {
+	return syntax.Marshal(tedi)
+}
+
+func (tedi *TicketEarlyDataInfoExtension) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, tedi)
+}
+
+// opaque ProtocolName<1..2^8-1>;
+//
+// struct {
+//     ProtocolName protocol_name_list<2..2^16-1>
+// } ProtocolNameList;
+type ALPNExtension struct {
+	Protocols []string
+}
+
+type protocolNameInner struct {
+	Name []byte `tls:"head=1,min=1"`
+}
+
+type alpnExtensionInner struct {
+	Protocols []protocolNameInner `tls:"head=2,min=2"`
+}
+
+func (alpn ALPNExtension) Type() ExtensionType {
+	return ExtensionTypeALPN
+}
+
+func (alpn ALPNExtension) Marshal() ([]byte, error) {
+	protocols := make([]protocolNameInner, len(alpn.Protocols))
+	for i, protocol := range alpn.Protocols {
+		protocols[i] = protocolNameInner{[]byte(protocol)}
+	}
+	return syntax.Marshal(alpnExtensionInner{protocols})
+}
+
+func (alpn *ALPNExtension) Unmarshal(data []byte) (int, error) {
+	var inner alpnExtensionInner
+	read, err := syntax.Unmarshal(data, &inner)
+
+	if err != nil {
+		return 0, err
+	}
+
+	alpn.Protocols = make([]string, len(inner.Protocols))
+	for i, protocol := range inner.Protocols {
+		alpn.Protocols[i] = string(protocol.Name)
+	}
+	return read, nil
+}
+
+// struct {
+//     ProtocolVersion versions<2..254>;
+// } SupportedVersions;
+type SupportedVersionsExtension struct {
+	HandshakeType HandshakeType
+	Versions      []uint16
+}
+
+type SupportedVersionsClientHelloInner struct {
+	Versions []uint16 `tls:"head=1,min=2,max=254"`
+}
+
+type SupportedVersionsServerHelloInner struct {
+	Version uint16
+}
+
+func (sv SupportedVersionsExtension) Type() ExtensionType {
+	return ExtensionTypeSupportedVersions
+}
+
+func (sv SupportedVersionsExtension) Marshal() ([]byte, error) {
+	switch sv.HandshakeType {
+	case HandshakeTypeClientHello:
+		return syntax.Marshal(SupportedVersionsClientHelloInner{sv.Versions})
+	case HandshakeTypeServerHello, HandshakeTypeHelloRetryRequest:
+		return syntax.Marshal(SupportedVersionsServerHelloInner{sv.Versions[0]})
+	default:
+		return nil, fmt.Errorf("tls.supported_versions: Handshake type not allowed")
+	}
+}
+
+func (sv *SupportedVersionsExtension) Unmarshal(data []byte) (int, error) {
+	switch sv.HandshakeType {
+	case HandshakeTypeClientHello:
+		var inner SupportedVersionsClientHelloInner
+		read, err := syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+		sv.Versions = inner.Versions
+		return read, nil
+
+	case HandshakeTypeServerHello, HandshakeTypeHelloRetryRequest:
+		var inner SupportedVersionsServerHelloInner
+		read, err := syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+		sv.Versions = []uint16{inner.Version}
+		return read, nil
+
+	default:
+		return 0, fmt.Errorf("tls.supported_versions: Handshake type not allowed")
+	}
+}
+
+// struct {
+//     opaque cookie<1..2^16-1>;
+// } Cookie;
+type CookieExtension struct {
+	Cookie []byte `tls:"head=2,min=1"`
+}
+
+func (c CookieExtension) Type() ExtensionType {
+	return ExtensionTypeCookie
+}
+
+func (c CookieExtension) Marshal() ([]byte, error) {
+	return syntax.Marshal(c)
+}
+
+func (c *CookieExtension) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, c)
+}

vendor/github.com/bifurcation/mint/ffdhe.go

@@ -0,0 +1,147 @@
+package mint
+
+import (
+	"encoding/hex"
+	"math/big"
+)
+
+var (
+	finiteFieldPrime2048hex = "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" +
+		"D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" +
+		"7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" +
+		"2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" +
+		"984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" +
+		"30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" +
+		"B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" +
+		"0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" +
+		"9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" +
+		"3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" +
+		"886B423861285C97FFFFFFFFFFFFFFFF"
+	finiteFieldPrime2048bytes, _ = hex.DecodeString(finiteFieldPrime2048hex)
+	finiteFieldPrime2048         = big.NewInt(0).SetBytes(finiteFieldPrime2048bytes)
+
+	finiteFieldPrime3072hex = "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" +
+		"D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" +
+		"7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" +
+		"2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" +
+		"984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" +
+		"30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" +
+		"B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" +
+		"0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" +
+		"9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" +
+		"3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" +
+		"886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C0238" +
+		"61B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91C" +
+		"AEFE130985139270B4130C93BC437944F4FD4452E2D74DD3" +
+		"64F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0D" +
+		"ABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF" +
+		"3C1B20EE3FD59D7C25E41D2B66C62E37FFFFFFFFFFFFFFFF"
+	finiteFieldPrime3072bytes, _ = hex.DecodeString(finiteFieldPrime3072hex)
+	finiteFieldPrime3072         = big.NewInt(0).SetBytes(finiteFieldPrime3072bytes)
+
+	finiteFieldPrime4096hex = "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" +
+		"D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" +
+		"7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" +
+		"2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" +
+		"984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" +
+		"30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" +
+		"B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" +
+		"0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" +
+		"9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" +
+		"3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" +
+		"886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C0238" +
+		"61B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91C" +
+		"AEFE130985139270B4130C93BC437944F4FD4452E2D74DD3" +
+		"64F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0D" +
+		"ABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF" +
+		"3C1B20EE3FD59D7C25E41D2B669E1EF16E6F52C3164DF4FB" +
+		"7930E9E4E58857B6AC7D5F42D69F6D187763CF1D55034004" +
+		"87F55BA57E31CC7A7135C886EFB4318AED6A1E012D9E6832" +
+		"A907600A918130C46DC778F971AD0038092999A333CB8B7A" +
+		"1A1DB93D7140003C2A4ECEA9F98D0ACC0A8291CDCEC97DCF" +
+		"8EC9B55A7F88A46B4DB5A851F44182E1C68A007E5E655F6A" +
+		"FFFFFFFFFFFFFFFF"
+	finiteFieldPrime4096bytes, _ = hex.DecodeString(finiteFieldPrime4096hex)
+	finiteFieldPrime4096         = big.NewInt(0).SetBytes(finiteFieldPrime4096bytes)
+
+	finiteFieldPrime6144hex = "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" +
+		"D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" +
+		"7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" +
+		"2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" +
+		"984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" +
+		"30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" +
+		"B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" +
+		"0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" +
+		"9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" +
+		"3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" +
+		"886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C0238" +
+		"61B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91C" +
+		"AEFE130985139270B4130C93BC437944F4FD4452E2D74DD3" +
+		"64F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0D" +
+		"ABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF" +
+		"3C1B20EE3FD59D7C25E41D2B669E1EF16E6F52C3164DF4FB" +
+		"7930E9E4E58857B6AC7D5F42D69F6D187763CF1D55034004" +
+		"87F55BA57E31CC7A7135C886EFB4318AED6A1E012D9E6832" +
+		"A907600A918130C46DC778F971AD0038092999A333CB8B7A" +
+		"1A1DB93D7140003C2A4ECEA9F98D0ACC0A8291CDCEC97DCF" +
+		"8EC9B55A7F88A46B4DB5A851F44182E1C68A007E5E0DD902" +
+		"0BFD64B645036C7A4E677D2C38532A3A23BA4442CAF53EA6" +
+		"3BB454329B7624C8917BDD64B1C0FD4CB38E8C334C701C3A" +
+		"CDAD0657FCCFEC719B1F5C3E4E46041F388147FB4CFDB477" +
+		"A52471F7A9A96910B855322EDB6340D8A00EF092350511E3" +
+		"0ABEC1FFF9E3A26E7FB29F8C183023C3587E38DA0077D9B4" +
+		"763E4E4B94B2BBC194C6651E77CAF992EEAAC0232A281BF6" +
+		"B3A739C1226116820AE8DB5847A67CBEF9C9091B462D538C" +
+		"D72B03746AE77F5E62292C311562A846505DC82DB854338A" +
+		"E49F5235C95B91178CCF2DD5CACEF403EC9D1810C6272B04" +
+		"5B3B71F9DC6B80D63FDD4A8E9ADB1E6962A69526D43161C1" +
+		"A41D570D7938DAD4A40E329CD0E40E65FFFFFFFFFFFFFFFF"
+	finiteFieldPrime6144bytes, _ = hex.DecodeString(finiteFieldPrime6144hex)
+	finiteFieldPrime6144         = big.NewInt(0).SetBytes(finiteFieldPrime6144bytes)
+
+	finiteFieldPrime8192hex = "FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1" +
+		"D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF9" +
+		"7D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD6561" +
+		"2433F51F5F066ED0856365553DED1AF3B557135E7F57C935" +
+		"984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE735" +
+		"30ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FB" +
+		"B96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB19" +
+		"0B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F61" +
+		"9172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD73" +
+		"3BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA" +
+		"886B4238611FCFDCDE355B3B6519035BBC34F4DEF99C0238" +
+		"61B46FC9D6E6C9077AD91D2691F7F7EE598CB0FAC186D91C" +
+		"AEFE130985139270B4130C93BC437944F4FD4452E2D74DD3" +
+		"64F2E21E71F54BFF5CAE82AB9C9DF69EE86D2BC522363A0D" +
+		"ABC521979B0DEADA1DBF9A42D5C4484E0ABCD06BFA53DDEF" +
+		"3C1B20EE3FD59D7C25E41D2B669E1EF16E6F52C3164DF4FB" +
+		"7930E9E4E58857B6AC7D5F42D69F6D187763CF1D55034004" +
+		"87F55BA57E31CC7A7135C886EFB4318AED6A1E012D9E6832" +
+		"A907600A918130C46DC778F971AD0038092999A333CB8B7A" +
+		"1A1DB93D7140003C2A4ECEA9F98D0ACC0A8291CDCEC97DCF" +
+		"8EC9B55A7F88A46B4DB5A851F44182E1C68A007E5E0DD902" +
+		"0BFD64B645036C7A4E677D2C38532A3A23BA4442CAF53EA6" +
+		"3BB454329B7624C8917BDD64B1C0FD4CB38E8C334C701C3A" +
+		"CDAD0657FCCFEC719B1F5C3E4E46041F388147FB4CFDB477" +
+		"A52471F7A9A96910B855322EDB6340D8A00EF092350511E3" +
+		"0ABEC1FFF9E3A26E7FB29F8C183023C3587E38DA0077D9B4" +
+		"763E4E4B94B2BBC194C6651E77CAF992EEAAC0232A281BF6" +
+		"B3A739C1226116820AE8DB5847A67CBEF9C9091B462D538C" +
+		"D72B03746AE77F5E62292C311562A846505DC82DB854338A" +
+		"E49F5235C95B91178CCF2DD5CACEF403EC9D1810C6272B04" +
+		"5B3B71F9DC6B80D63FDD4A8E9ADB1E6962A69526D43161C1" +
+		"A41D570D7938DAD4A40E329CCFF46AAA36AD004CF600C838" +
+		"1E425A31D951AE64FDB23FCEC9509D43687FEB69EDD1CC5E" +
+		"0B8CC3BDF64B10EF86B63142A3AB8829555B2F747C932665" +
+		"CB2C0F1CC01BD70229388839D2AF05E454504AC78B758282" +
+		"2846C0BA35C35F5C59160CC046FD8251541FC68C9C86B022" +
+		"BB7099876A460E7451A8A93109703FEE1C217E6C3826E52C" +
+		"51AA691E0E423CFC99E9E31650C1217B624816CDAD9A95F9" +
+		"D5B8019488D9C0A0A1FE3075A577E23183F81D4A3F2FA457" +
+		"1EFC8CE0BA8A4FE8B6855DFE72B0A66EDED2FBABFBE58A30" +
+		"FAFABE1C5D71A87E2F741EF8C1FE86FEA6BBFDE530677F0D" +
+		"97D11D49F7A8443D0822E506A9F4614E011E2A94838FF88C" +
+		"D68C8BB7C5C6424CFFFFFFFFFFFFFFFF"
+	finiteFieldPrime8192bytes, _ = hex.DecodeString(finiteFieldPrime8192hex)
+	finiteFieldPrime8192         = big.NewInt(0).SetBytes(finiteFieldPrime8192bytes)
+)

vendor/github.com/bifurcation/mint/frame-reader.go

@@ -0,0 +1,98 @@
+// Read a generic "framed" packet consisting of a header and a
+// This is used for both TLS Records and TLS Handshake Messages
+package mint
+
+type framing interface {
+	headerLen() int
+	defaultReadLen() int
+	frameLen(hdr []byte) (int, error)
+}
+
+const (
+	kFrameReaderHdr  = 0
+	kFrameReaderBody = 1
+)
+
+type frameNextAction func(f *frameReader) error
+
+type frameReader struct {
+	details     framing
+	state       uint8
+	header      []byte
+	body        []byte
+	working     []byte
+	writeOffset int
+	remainder   []byte
+}
+
+func newFrameReader(d framing) *frameReader {
+	hdr := make([]byte, d.headerLen())
+	return &frameReader{
+		d,
+		kFrameReaderHdr,
+		hdr,
+		nil,
+		hdr,
+		0,
+		nil,
+	}
+}
+
+func dup(a []byte) []byte {
+	r := make([]byte, len(a))
+	copy(r, a)
+	return r
+}
+
+func (f *frameReader) needed() int {
+	tmp := (len(f.working) - f.writeOffset) - len(f.remainder)
+	if tmp < 0 {
+		return 0
+	}
+	return tmp
+}
+
+func (f *frameReader) addChunk(in []byte) {
+	// Append to the buffer.
+	logf(logTypeFrameReader, "Appending %v", len(in))
+	f.remainder = append(f.remainder, in...)
+}
+
+func (f *frameReader) process() (hdr []byte, body []byte, err error) {
+	for f.needed() == 0 {
+		logf(logTypeFrameReader, "%v bytes needed for next block", len(f.working)-f.writeOffset)
+		// Fill out our working block
+		copied := copy(f.working[f.writeOffset:], f.remainder)
+		f.remainder = f.remainder[copied:]
+		f.writeOffset += copied
+		if f.writeOffset < len(f.working) {
+			logf(logTypeVerbose, "Read would have blocked 1")
+			return nil, nil, AlertWouldBlock
+		}
+		// Reset the write offset, because we are now full.
+		f.writeOffset = 0
+
+		// We have read a full frame
+		if f.state == kFrameReaderBody {
+			logf(logTypeFrameReader, "Returning frame hdr=%#x len=%d buffered=%d", f.header, len(f.body), len(f.remainder))
+			f.state = kFrameReaderHdr
+			f.working = f.header
+			return dup(f.header), dup(f.body), nil
+		}
+
+		// We have read the header
+		bodyLen, err := f.details.frameLen(f.header)
+		if err != nil {
+			return nil, nil, err
+		}
+		logf(logTypeFrameReader, "Processed header, body len = %v", bodyLen)
+
+		f.body = make([]byte, bodyLen)
+		f.working = f.body
+		f.writeOffset = 0
+		f.state = kFrameReaderBody
+	}
+
+	logf(logTypeVerbose, "Read would have blocked 2")
+	return nil, nil, AlertWouldBlock
+}

vendor/github.com/bifurcation/mint/handshake-layer.go

@@ -0,0 +1,551 @@
+package mint
+
+import (
+	"fmt"
+	"io"
+	"net"
+)
+
+const (
+	handshakeHeaderLenTLS  = 4       // handshake message header length
+	handshakeHeaderLenDTLS = 12      // handshake message header length
+	maxHandshakeMessageLen = 1 << 24 // max handshake message length
+)
+
+// struct {
+//     HandshakeType msg_type;    /* handshake type */
+//     uint24 length;             /* bytes in message */
+//     select (HandshakeType) {
+//       ...
+//     } body;
+// } Handshake;
+//
+// We do the select{...} part in a different layer, so we treat the
+// actual message body as opaque:
+//
+// struct {
+//     HandshakeType msg_type;
+//     opaque msg<0..2^24-1>
+// } Handshake;
+//
+type HandshakeMessage struct {
+	msgType  HandshakeType
+	seq      uint32
+	body     []byte
+	datagram bool
+	offset   uint32 // Used for DTLS
+	length   uint32
+	cipher   *cipherState
+}
+
+// Note: This could be done with the `syntax` module, using the simplified
+// syntax as discussed above.  However, since this is so simple, there's not
+// much benefit to doing so.
+// When datagram is set, we marshal this as a whole DTLS record.
+func (hm *HandshakeMessage) Marshal() []byte {
+	if hm == nil {
+		return []byte{}
+	}
+
+	fragLen := len(hm.body)
+	var data []byte
+
+	if hm.datagram {
+		data = make([]byte, handshakeHeaderLenDTLS+fragLen)
+	} else {
+		data = make([]byte, handshakeHeaderLenTLS+fragLen)
+	}
+	tmp := data
+	tmp = encodeUint(uint64(hm.msgType), 1, tmp)
+	tmp = encodeUint(uint64(hm.length), 3, tmp)
+	if hm.datagram {
+		tmp = encodeUint(uint64(hm.seq), 2, tmp)
+		tmp = encodeUint(uint64(hm.offset), 3, tmp)
+		tmp = encodeUint(uint64(fragLen), 3, tmp)
+	}
+	copy(tmp, hm.body)
+	return data
+}
+
+func (hm HandshakeMessage) ToBody() (HandshakeMessageBody, error) {
+	logf(logTypeHandshake, "HandshakeMessage.toBody [%d] [%x]", hm.msgType, hm.body)
+
+	var body HandshakeMessageBody
+	switch hm.msgType {
+	case HandshakeTypeClientHello:
+		body = new(ClientHelloBody)
+	case HandshakeTypeServerHello:
+		body = new(ServerHelloBody)
+	case HandshakeTypeEncryptedExtensions:
+		body = new(EncryptedExtensionsBody)
+	case HandshakeTypeCertificate:
+		body = new(CertificateBody)
+	case HandshakeTypeCertificateRequest:
+		body = new(CertificateRequestBody)
+	case HandshakeTypeCertificateVerify:
+		body = new(CertificateVerifyBody)
+	case HandshakeTypeFinished:
+		body = &FinishedBody{VerifyDataLen: len(hm.body)}
+	case HandshakeTypeNewSessionTicket:
+		body = new(NewSessionTicketBody)
+	case HandshakeTypeKeyUpdate:
+		body = new(KeyUpdateBody)
+	case HandshakeTypeEndOfEarlyData:
+		body = new(EndOfEarlyDataBody)
+	default:
+		return body, fmt.Errorf("tls.handshakemessage: Unsupported body type")
+	}
+
+	err := safeUnmarshal(body, hm.body)
+	return body, err
+}
+
+func (h *HandshakeLayer) HandshakeMessageFromBody(body HandshakeMessageBody) (*HandshakeMessage, error) {
+	data, err := body.Marshal()
+	if err != nil {
+		return nil, err
+	}
+
+	m := &HandshakeMessage{
+		msgType:  body.Type(),
+		body:     data,
+		seq:      h.msgSeq,
+		datagram: h.datagram,
+		length:   uint32(len(data)),
+	}
+	h.msgSeq++
+	return m, nil
+}
+
+type HandshakeLayer struct {
+	ctx            *HandshakeContext   // The handshake we are attached to
+	nonblocking    bool                // Should we operate in nonblocking mode
+	conn           *RecordLayer        // Used for reading/writing records
+	frame          *frameReader        // The buffered frame reader
+	datagram       bool                // Is this DTLS?
+	msgSeq         uint32              // The DTLS message sequence number
+	queued         []*HandshakeMessage // In/out queue
+	sent           []*HandshakeMessage // Sent messages for DTLS
+	recvdRecords   []uint64            // Records we have received.
+	maxFragmentLen int
+}
+
+type handshakeLayerFrameDetails struct {
+	datagram bool
+}
+
+func (d handshakeLayerFrameDetails) headerLen() int {
+	if d.datagram {
+		return handshakeHeaderLenDTLS
+	}
+	return handshakeHeaderLenTLS
+}
+
+func (d handshakeLayerFrameDetails) defaultReadLen() int {
+	return d.headerLen() + maxFragmentLen
+}
+
+func (d handshakeLayerFrameDetails) frameLen(hdr []byte) (int, error) {
+	logf(logTypeIO, "Header=%x", hdr)
+	// The length of this fragment (as opposed to the message)
+	// is always the last three bytes for both TLS and DTLS
+	val, _ := decodeUint(hdr[len(hdr)-3:], 3)
+	return int(val), nil
+}
+
+func NewHandshakeLayerTLS(c *HandshakeContext, r *RecordLayer) *HandshakeLayer {
+	h := HandshakeLayer{}
+	h.ctx = c
+	h.conn = r
+	h.datagram = false
+	h.frame = newFrameReader(&handshakeLayerFrameDetails{false})
+	h.maxFragmentLen = maxFragmentLen
+	return &h
+}
+
+func NewHandshakeLayerDTLS(c *HandshakeContext, r *RecordLayer) *HandshakeLayer {
+	h := HandshakeLayer{}
+	h.ctx = c
+	h.conn = r
+	h.datagram = true
+	h.frame = newFrameReader(&handshakeLayerFrameDetails{true})
+	h.maxFragmentLen = initialMtu // Not quite right
+	return &h
+}
+
+func (h *HandshakeLayer) readRecord() error {
+	logf(logTypeVerbose, "Trying to read record")
+	pt, err := h.conn.readRecordAnyEpoch()
+	if err != nil {
+		return err
+	}
+
+	switch pt.contentType {
+	case RecordTypeHandshake, RecordTypeAlert, RecordTypeAck:
+	default:
+		return fmt.Errorf("tls.handshakelayer: Unexpected record type %d", pt.contentType)
+	}
+
+	if pt.contentType == RecordTypeAck {
+		if !h.datagram {
+			return fmt.Errorf("tls.handshakelayer: can't have ACK with TLS")
+		}
+		logf(logTypeIO, "read ACK")
+		return h.ctx.processAck(pt.fragment)
+	}
+
+	if pt.contentType == RecordTypeAlert {
+		logf(logTypeIO, "read alert %v", pt.fragment[1])
+		if len(pt.fragment) < 2 {
+			h.sendAlert(AlertUnexpectedMessage)
+			return io.EOF
+		}
+		return Alert(pt.fragment[1])
+	}
+
+	assert(h.ctx.hIn.conn != nil)
+	if pt.epoch != h.ctx.hIn.conn.cipher.epoch {
+		// This is out of order but we're dropping it.
+		// TODO(ekr@rtfm.com): If server, need to retransmit Finished.
+		if pt.epoch == EpochClear || pt.epoch == EpochHandshakeData {
+			return nil
+		}
+
+		// Anything else shouldn't happen.
+		return AlertIllegalParameter
+	}
+
+	h.recvdRecords = append(h.recvdRecords, pt.seq)
+	h.frame.addChunk(pt.fragment)
+
+	return nil
+}
+
+// sendAlert sends a TLS alert message.
+func (h *HandshakeLayer) sendAlert(err Alert) error {
+	tmp := make([]byte, 2)
+	tmp[0] = AlertLevelError
+	tmp[1] = byte(err)
+	h.conn.WriteRecord(&TLSPlaintext{
+		contentType: RecordTypeAlert,
+		fragment:    tmp},
+	)
+
+	// closeNotify is a special case in that it isn't an error:
+	if err != AlertCloseNotify {
+		return &net.OpError{Op: "local error", Err: err}
+	}
+	return nil
+}
+
+func (h *HandshakeLayer) noteMessageDelivered(seq uint32) {
+	h.msgSeq = seq + 1
+	var i int
+	var m *HandshakeMessage
+	for i, m = range h.queued {
+		if m.seq > seq {
+			break
+		}
+	}
+	h.queued = h.queued[i:]
+}
+
+func (h *HandshakeLayer) newFragmentReceived(hm *HandshakeMessage) (*HandshakeMessage, error) {
+	if hm.seq < h.msgSeq {
+		return nil, nil
+	}
+
+	// TODO(ekr@rtfm.com): Send an ACK immediately if we got something
+	// out of order.
+	h.ctx.receivedHandshakeMessage()
+
+	if hm.seq == h.msgSeq && hm.offset == 0 && hm.length == uint32(len(hm.body)) {
+		// TODO(ekr@rtfm.com): Check the length?
+		// This is complete.
+		h.noteMessageDelivered(hm.seq)
+		return hm, nil
+	}
+
+	// Now insert sorted.
+	var i int
+	for i = 0; i < len(h.queued); i++ {
+		f := h.queued[i]
+		if hm.seq < f.seq {
+			break
+		}
+		if hm.offset < f.offset {
+			break
+		}
+	}
+	tmp := make([]*HandshakeMessage, 0, len(h.queued)+1)
+	tmp = append(tmp, h.queued[:i]...)
+	tmp = append(tmp, hm)
+	tmp = append(tmp, h.queued[i:]...)
+	h.queued = tmp
+
+	return h.checkMessageAvailable()
+}
+
+func (h *HandshakeLayer) checkMessageAvailable() (*HandshakeMessage, error) {
+	if len(h.queued) == 0 {
+		return nil, nil
+	}
+
+	hm := h.queued[0]
+	if hm.seq != h.msgSeq {
+		return nil, nil
+	}
+
+	if hm.seq == h.msgSeq && hm.offset == 0 && hm.length == uint32(len(hm.body)) {
+		// TODO(ekr@rtfm.com): Check the length?
+		// This is complete.
+		h.noteMessageDelivered(hm.seq)
+		return hm, nil
+	}
+
+	// OK, this at least might complete the message.
+	end := uint32(0)
+	buf := make([]byte, hm.length)
+
+	for _, f := range h.queued {
+		// Out of fragments
+		if f.seq > hm.seq {
+			break
+		}
+
+		if f.length != uint32(len(buf)) {
+			return nil, fmt.Errorf("Mismatched DTLS length")
+		}
+
+		if f.offset > end {
+			break
+		}
+
+		if f.offset+uint32(len(f.body)) > end {
+			// OK, this is adding something we don't know about
+			copy(buf[f.offset:], f.body)
+			end = f.offset + uint32(len(f.body))
+			if end == hm.length {
+				h2 := *hm
+				h2.offset = 0
+				h2.body = buf
+				h.noteMessageDelivered(hm.seq)
+				return &h2, nil
+			}
+		}
+
+	}
+
+	return nil, nil
+}
+
+func (h *HandshakeLayer) ReadMessage() (*HandshakeMessage, error) {
+	var hdr, body []byte
+	var err error
+
+	hm, err := h.checkMessageAvailable()
+	if err != nil {
+		return nil, err
+	}
+	if hm != nil {
+		return hm, nil
+	}
+	for {
+		logf(logTypeVerbose, "ReadMessage() buffered=%v", len(h.frame.remainder))
+		if h.frame.needed() > 0 {
+			logf(logTypeVerbose, "Trying to read a new record")
+			err = h.readRecord()
+
+			if err != nil && (h.nonblocking || err != AlertWouldBlock) {
+				return nil, err
+			}
+		}
+
+		hdr, body, err = h.frame.process()
+		if err == nil {
+			break
+		}
+		if err != nil && (h.nonblocking || err != AlertWouldBlock) {
+			return nil, err
+		}
+	}
+
+	logf(logTypeHandshake, "read handshake message")
+
+	hm = &HandshakeMessage{}
+	hm.msgType = HandshakeType(hdr[0])
+	hm.datagram = h.datagram
+	hm.body = make([]byte, len(body))
+	copy(hm.body, body)
+	logf(logTypeHandshake, "Read message with type: %v", hm.msgType)
+	if h.datagram {
+		tmp, hdr := decodeUint(hdr[1:], 3)
+		hm.length = uint32(tmp)
+		tmp, hdr = decodeUint(hdr, 2)
+		hm.seq = uint32(tmp)
+		tmp, hdr = decodeUint(hdr, 3)
+		hm.offset = uint32(tmp)
+
+		return h.newFragmentReceived(hm)
+	}
+
+	hm.length = uint32(len(body))
+	return hm, nil
+}
+
+func (h *HandshakeLayer) QueueMessage(hm *HandshakeMessage) error {
+	hm.cipher = h.conn.cipher
+	h.queued = append(h.queued, hm)
+	return nil
+}
+
+func (h *HandshakeLayer) SendQueuedMessages() (int, error) {
+	logf(logTypeHandshake, "Sending outgoing messages")
+	count, err := h.WriteMessages(h.queued)
+	if !h.datagram {
+		h.ClearQueuedMessages()
+	}
+	return count, err
+}
+
+func (h *HandshakeLayer) ClearQueuedMessages() {
+	logf(logTypeHandshake, "Clearing outgoing hs message queue")
+	h.queued = nil
+}
+
+func (h *HandshakeLayer) writeFragment(hm *HandshakeMessage, start int, room int) (bool, int, error) {
+	var buf []byte
+
+	// Figure out if we're going to want the full header or just
+	// the body
+	hdrlen := 0
+	if hm.datagram {
+		hdrlen = handshakeHeaderLenDTLS
+	} else if start == 0 {
+		hdrlen = handshakeHeaderLenTLS
+	}
+
+	// Compute the amount of body we can fit in
+	room -= hdrlen
+	if room == 0 {
+		// This works because we are doing one record per
+		// message
+		panic("Too short max fragment len")
+	}
+	bodylen := len(hm.body) - start
+	if bodylen > room {
+		bodylen = room
+	}
+	body := hm.body[start : start+bodylen]
+
+	// Now see if this chunk has been ACKed. This doesn't produce ideal
+	// retransmission but is simple.
+	if h.ctx.fragmentAcked(hm.seq, start, bodylen) {
+		logf(logTypeHandshake, "Fragment %v %v(%v) already acked. Skipping", hm.seq, start, bodylen)
+		return false, start + bodylen, nil
+	}
+
+	// Encode the data.
+	if hdrlen > 0 {
+		hm2 := *hm
+		hm2.offset = uint32(start)
+		hm2.body = body
+		buf = hm2.Marshal()
+		hm = &hm2
+	} else {
+		buf = body
+	}
+
+	if h.datagram {
+		// Remember that we sent this.
+		h.ctx.sentFragments = append(h.ctx.sentFragments, &SentHandshakeFragment{
+			hm.seq,
+			start,
+			len(body),
+			h.conn.cipher.combineSeq(true),
+			false,
+		})
+	}
+	return true, start + bodylen, h.conn.writeRecordWithPadding(
+		&TLSPlaintext{
+			contentType: RecordTypeHandshake,
+			fragment:    buf,
+		},
+		hm.cipher, 0)
+}
+
+func (h *HandshakeLayer) WriteMessage(hm *HandshakeMessage) (int, error) {
+	start := int(0)
+
+	if len(hm.body) > maxHandshakeMessageLen {
+		return 0, fmt.Errorf("Tried to write a handshake message that's too long")
+	}
+
+	written := 0
+	wrote := false
+
+	// Always make one pass through to allow EOED (which is empty).
+	for {
+		var err error
+		wrote, start, err = h.writeFragment(hm, start, h.maxFragmentLen)
+		if err != nil {
+			return 0, err
+		}
+		if wrote {
+			written++
+		}
+		if start >= len(hm.body) {
+			break
+		}
+	}
+
+	return written, nil
+}
+
+func (h *HandshakeLayer) WriteMessages(hms []*HandshakeMessage) (int, error) {
+	written := 0
+	for _, hm := range hms {
+		logf(logTypeHandshake, "WriteMessage [%d] %x", hm.msgType, hm.body)
+
+		wrote, err := h.WriteMessage(hm)
+		if err != nil {
+			return 0, err
+		}
+		written += wrote
+	}
+	return written, nil
+}
+
+func encodeUint(v uint64, size int, out []byte) []byte {
+	for i := size - 1; i >= 0; i-- {
+		out[i] = byte(v & 0xff)
+		v >>= 8
+	}
+	return out[size:]
+}
+
+func decodeUint(in []byte, size int) (uint64, []byte) {
+	val := uint64(0)
+
+	for i := 0; i < size; i++ {
+		val <<= 8
+		val += uint64(in[i])
+	}
+	return val, in[size:]
+}
+
+type marshalledPDU interface {
+	Marshal() ([]byte, error)
+	Unmarshal(data []byte) (int, error)
+}
+
+func safeUnmarshal(pdu marshalledPDU, data []byte) error {
+	read, err := pdu.Unmarshal(data)
+	if err != nil {
+		return err
+	}
+	if len(data) != read {
+		return fmt.Errorf("Invalid encoding: Extra data not consumed")
+	}
+	return nil
+}

vendor/github.com/bifurcation/mint/handshake-messages.go

@@ -0,0 +1,481 @@
+package mint
+
+import (
+	"bytes"
+	"crypto"
+	"crypto/x509"
+	"encoding/binary"
+	"fmt"
+
+	"github.com/bifurcation/mint/syntax"
+)
+
+type HandshakeMessageBody interface {
+	Type() HandshakeType
+	Marshal() ([]byte, error)
+	Unmarshal(data []byte) (int, error)
+}
+
+// struct {
+//     ProtocolVersion legacy_version = 0x0303; /* TLS v1.2 */
+//     Random random;
+//     opaque legacy_session_id<0..32>;
+//     CipherSuite cipher_suites<2..2^16-2>;
+//     opaque legacy_compression_methods<1..2^8-1>;
+//     Extension extensions<0..2^16-1>;
+// } ClientHello;
+type ClientHelloBody struct {
+	LegacyVersion   uint16
+	Random          [32]byte
+	LegacySessionID []byte
+	CipherSuites    []CipherSuite
+	Extensions      ExtensionList
+}
+
+type clientHelloBodyInnerTLS struct {
+	LegacyVersion            uint16
+	Random                   [32]byte
+	LegacySessionID          []byte        `tls:"head=1,max=32"`
+	CipherSuites             []CipherSuite `tls:"head=2,min=2"`
+	LegacyCompressionMethods []byte        `tls:"head=1,min=1"`
+	Extensions               []Extension   `tls:"head=2"`
+}
+
+type clientHelloBodyInnerDTLS struct {
+	LegacyVersion            uint16
+	Random                   [32]byte
+	LegacySessionID          []byte `tls:"head=1,max=32"`
+	EmptyCookie              uint8
+	CipherSuites             []CipherSuite `tls:"head=2,min=2"`
+	LegacyCompressionMethods []byte        `tls:"head=1,min=1"`
+	Extensions               []Extension   `tls:"head=2"`
+}
+
+func (ch ClientHelloBody) Type() HandshakeType {
+	return HandshakeTypeClientHello
+}
+
+func (ch ClientHelloBody) Marshal() ([]byte, error) {
+	if ch.LegacyVersion == tls12Version {
+		return syntax.Marshal(clientHelloBodyInnerTLS{
+			LegacyVersion:            ch.LegacyVersion,
+			Random:                   ch.Random,
+			LegacySessionID:          []byte{},
+			CipherSuites:             ch.CipherSuites,
+			LegacyCompressionMethods: []byte{0},
+			Extensions:               ch.Extensions,
+		})
+	} else {
+		return syntax.Marshal(clientHelloBodyInnerDTLS{
+			LegacyVersion:            ch.LegacyVersion,
+			Random:                   ch.Random,
+			LegacySessionID:          []byte{},
+			CipherSuites:             ch.CipherSuites,
+			LegacyCompressionMethods: []byte{0},
+			Extensions:               ch.Extensions,
+		})
+	}
+
+}
+
+func (ch *ClientHelloBody) Unmarshal(data []byte) (int, error) {
+	var read int
+	var err error
+
+	// Note that this might be 0, in which case we do TLS. That
+	// makes the tests easier.
+	if ch.LegacyVersion != dtls12WireVersion {
+		var inner clientHelloBodyInnerTLS
+		read, err = syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+
+		if len(inner.LegacyCompressionMethods) != 1 || inner.LegacyCompressionMethods[0] != 0 {
+			return 0, fmt.Errorf("tls.clienthello: Invalid compression method")
+		}
+
+		ch.LegacyVersion = inner.LegacyVersion
+		ch.Random = inner.Random
+		ch.LegacySessionID = inner.LegacySessionID
+		ch.CipherSuites = inner.CipherSuites
+		ch.Extensions = inner.Extensions
+	} else {
+		var inner clientHelloBodyInnerDTLS
+		read, err = syntax.Unmarshal(data, &inner)
+		if err != nil {
+			return 0, err
+		}
+
+		if inner.EmptyCookie != 0 {
+			return 0, fmt.Errorf("tls.clienthello: Invalid cookie")
+		}
+
+		if len(inner.LegacyCompressionMethods) != 1 || inner.LegacyCompressionMethods[0] != 0 {
+			return 0, fmt.Errorf("tls.clienthello: Invalid compression method")
+		}
+
+		ch.LegacyVersion = inner.LegacyVersion
+		ch.Random = inner.Random
+		ch.LegacySessionID = inner.LegacySessionID
+		ch.CipherSuites = inner.CipherSuites
+		ch.Extensions = inner.Extensions
+	}
+	return read, nil
+}
+
+// TODO: File a spec bug to clarify this
+func (ch ClientHelloBody) Truncated() ([]byte, error) {
+	if len(ch.Extensions) == 0 {
+		return nil, fmt.Errorf("tls.clienthello.truncate: No extensions")
+	}
+
+	pskExt := ch.Extensions[len(ch.Extensions)-1]
+	if pskExt.ExtensionType != ExtensionTypePreSharedKey {
+		return nil, fmt.Errorf("tls.clienthello.truncate: Last extension is not PSK")
+	}
+
+	body, err := ch.Marshal()
+	if err != nil {
+		return nil, err
+	}
+	chm := &HandshakeMessage{
+		msgType: ch.Type(),
+		body:    body,
+		length:  uint32(len(body)),
+	}
+	chData := chm.Marshal()
+
+	psk := PreSharedKeyExtension{
+		HandshakeType: HandshakeTypeClientHello,
+	}
+	_, err = psk.Unmarshal(pskExt.ExtensionData)
+	if err != nil {
+		return nil, err
+	}
+
+	// Marshal just the binders so that we know how much to truncate
+	binders := struct {
+		Binders []PSKBinderEntry `tls:"head=2,min=33"`
+	}{Binders: psk.Binders}
+	binderData, _ := syntax.Marshal(binders)
+	binderLen := len(binderData)
+
+	chLen := len(chData)
+	return chData[:chLen-binderLen], nil
+}
+
+// struct {
+//     ProtocolVersion legacy_version = 0x0303;    /* TLS v1.2 */
+//     Random random;
+//     opaque legacy_session_id_echo<0..32>;
+//     CipherSuite cipher_suite;
+//     uint8 legacy_compression_method = 0;
+//     Extension extensions<6..2^16-1>;
+// } ServerHello;
+type ServerHelloBody struct {
+	Version                 uint16
+	Random                  [32]byte
+	LegacySessionID         []byte `tls:"head=1,max=32"`
+	CipherSuite             CipherSuite
+	LegacyCompressionMethod uint8
+	Extensions              ExtensionList `tls:"head=2"`
+}
+
+func (sh ServerHelloBody) Type() HandshakeType {
+	return HandshakeTypeServerHello
+}
+
+func (sh ServerHelloBody) Marshal() ([]byte, error) {
+	return syntax.Marshal(sh)
+}
+
+func (sh *ServerHelloBody) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, sh)
+}
+
+// struct {
+//     opaque verify_data[verify_data_length];
+// } Finished;
+//
+// verifyDataLen is not a field in the TLS struct, but we add it here so
+// that calling code can tell us how much data to expect when we marshal /
+// unmarshal.  (We could add this to the marshal/unmarshal methods, but let's
+// try to keep the signature consistent for now.)
+//
+// For similar reasons, we don't use the `syntax` module here, because this
+// struct doesn't map well to standard TLS presentation language concepts.
+//
+// TODO: File a spec bug
+type FinishedBody struct {
+	VerifyDataLen int
+	VerifyData    []byte
+}
+
+func (fin FinishedBody) Type() HandshakeType {
+	return HandshakeTypeFinished
+}
+
+func (fin FinishedBody) Marshal() ([]byte, error) {
+	if len(fin.VerifyData) != fin.VerifyDataLen {
+		return nil, fmt.Errorf("tls.finished: data length mismatch")
+	}
+
+	body := make([]byte, len(fin.VerifyData))
+	copy(body, fin.VerifyData)
+	return body, nil
+}
+
+func (fin *FinishedBody) Unmarshal(data []byte) (int, error) {
+	if len(data) < fin.VerifyDataLen {
+		return 0, fmt.Errorf("tls.finished: Malformed finished; too short")
+	}
+
+	fin.VerifyData = make([]byte, fin.VerifyDataLen)
+	copy(fin.VerifyData, data[:fin.VerifyDataLen])
+	return fin.VerifyDataLen, nil
+}
+
+// struct {
+//     Extension extensions<0..2^16-1>;
+// } EncryptedExtensions;
+//
+// Marshal() and Unmarshal() are handled by ExtensionList
+type EncryptedExtensionsBody struct {
+	Extensions ExtensionList `tls:"head=2"`
+}
+
+func (ee EncryptedExtensionsBody) Type() HandshakeType {
+	return HandshakeTypeEncryptedExtensions
+}
+
+func (ee EncryptedExtensionsBody) Marshal() ([]byte, error) {
+	return syntax.Marshal(ee)
+}
+
+func (ee *EncryptedExtensionsBody) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, ee)
+}
+
+// opaque ASN1Cert<1..2^24-1>;
+//
+// struct {
+//     ASN1Cert cert_data;
+//     Extension extensions<0..2^16-1>
+// } CertificateEntry;
+//
+// struct {
+//     opaque certificate_request_context<0..2^8-1>;
+//     CertificateEntry certificate_list<0..2^24-1>;
+// } Certificate;
+type CertificateEntry struct {
+	CertData   *x509.Certificate
+	Extensions ExtensionList
+}
+
+type CertificateBody struct {
+	CertificateRequestContext []byte
+	CertificateList           []CertificateEntry
+}
+
+type certificateEntryInner struct {
+	CertData   []byte        `tls:"head=3,min=1"`
+	Extensions ExtensionList `tls:"head=2"`
+}
+
+type certificateBodyInner struct {
+	CertificateRequestContext []byte                  `tls:"head=1"`
+	CertificateList           []certificateEntryInner `tls:"head=3"`
+}
+
+func (c CertificateBody) Type() HandshakeType {
+	return HandshakeTypeCertificate
+}
+
+func (c CertificateBody) Marshal() ([]byte, error) {
+	inner := certificateBodyInner{
+		CertificateRequestContext: c.CertificateRequestContext,
+		CertificateList:           make([]certificateEntryInner, len(c.CertificateList)),
+	}
+
+	for i, entry := range c.CertificateList {
+		inner.CertificateList[i] = certificateEntryInner{
+			CertData:   entry.CertData.Raw,
+			Extensions: entry.Extensions,
+		}
+	}
+
+	return syntax.Marshal(inner)
+}
+
+func (c *CertificateBody) Unmarshal(data []byte) (int, error) {
+	inner := certificateBodyInner{}
+	read, err := syntax.Unmarshal(data, &inner)
+	if err != nil {
+		return read, err
+	}
+
+	c.CertificateRequestContext = inner.CertificateRequestContext
+	c.CertificateList = make([]CertificateEntry, len(inner.CertificateList))
+
+	for i, entry := range inner.CertificateList {
+		c.CertificateList[i].CertData, err = x509.ParseCertificate(entry.CertData)
+		if err != nil {
+			return 0, fmt.Errorf("tls:certificate: Certificate failed to parse: %v", err)
+		}
+
+		c.CertificateList[i].Extensions = entry.Extensions
+	}
+
+	return read, nil
+}
+
+// struct {
+//     SignatureScheme algorithm;
+//     opaque signature<0..2^16-1>;
+// } CertificateVerify;
+type CertificateVerifyBody struct {
+	Algorithm SignatureScheme
+	Signature []byte `tls:"head=2"`
+}
+
+func (cv CertificateVerifyBody) Type() HandshakeType {
+	return HandshakeTypeCertificateVerify
+}
+
+func (cv CertificateVerifyBody) Marshal() ([]byte, error) {
+	return syntax.Marshal(cv)
+}
+
+func (cv *CertificateVerifyBody) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, cv)
+}
+
+func (cv *CertificateVerifyBody) EncodeSignatureInput(data []byte) []byte {
+	// TODO: Change context for client auth
+	// TODO: Put this in a const
+	const context = "TLS 1.3, server CertificateVerify"
+	sigInput := bytes.Repeat([]byte{0x20}, 64)
+	sigInput = append(sigInput, []byte(context)...)
+	sigInput = append(sigInput, []byte{0}...)
+	sigInput = append(sigInput, data...)
+	return sigInput
+}
+
+func (cv *CertificateVerifyBody) Sign(privateKey crypto.Signer, handshakeHash []byte) (err error) {
+	sigInput := cv.EncodeSignatureInput(handshakeHash)
+	cv.Signature, err = sign(cv.Algorithm, privateKey, sigInput)
+	logf(logTypeHandshake, "Signed: alg=[%04x] sigInput=[%x], sig=[%x]", cv.Algorithm, sigInput, cv.Signature)
+	return
+}
+
+func (cv *CertificateVerifyBody) Verify(publicKey crypto.PublicKey, handshakeHash []byte) error {
+	sigInput := cv.EncodeSignatureInput(handshakeHash)
+	logf(logTypeHandshake, "About to verify: alg=[%04x] sigInput=[%x], sig=[%x]", cv.Algorithm, sigInput, cv.Signature)
+	return verify(cv.Algorithm, publicKey, sigInput, cv.Signature)
+}
+
+// struct {
+//     opaque certificate_request_context<0..2^8-1>;
+//     Extension extensions<2..2^16-1>;
+// } CertificateRequest;
+type CertificateRequestBody struct {
+	CertificateRequestContext []byte        `tls:"head=1"`
+	Extensions                ExtensionList `tls:"head=2"`
+}
+
+func (cr CertificateRequestBody) Type() HandshakeType {
+	return HandshakeTypeCertificateRequest
+}
+
+func (cr CertificateRequestBody) Marshal() ([]byte, error) {
+	return syntax.Marshal(cr)
+}
+
+func (cr *CertificateRequestBody) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, cr)
+}
+
+// struct {
+//     uint32 ticket_lifetime;
+//     uint32 ticket_age_add;
+//		 opaque ticket_nonce<1..255>;
+//     opaque ticket<1..2^16-1>;
+//     Extension extensions<0..2^16-2>;
+// } NewSessionTicket;
+type NewSessionTicketBody struct {
+	TicketLifetime uint32
+	TicketAgeAdd   uint32
+	TicketNonce    []byte        `tls:"head=1,min=1"`
+	Ticket         []byte        `tls:"head=2,min=1"`
+	Extensions     ExtensionList `tls:"head=2"`
+}
+
+const ticketNonceLen = 16
+
+func NewSessionTicket(ticketLen int, ticketLifetime uint32) (*NewSessionTicketBody, error) {
+	buf := make([]byte, 4+ticketNonceLen+ticketLen)
+	_, err := prng.Read(buf)
+	if err != nil {
+		return nil, err
+	}
+
+	tkt := &NewSessionTicketBody{
+		TicketLifetime: ticketLifetime,
+		TicketAgeAdd:   binary.BigEndian.Uint32(buf[:4]),
+		TicketNonce:    buf[4 : 4+ticketNonceLen],
+		Ticket:         buf[4+ticketNonceLen:],
+	}
+
+	return tkt, err
+}
+
+func (tkt NewSessionTicketBody) Type() HandshakeType {
+	return HandshakeTypeNewSessionTicket
+}
+
+func (tkt NewSessionTicketBody) Marshal() ([]byte, error) {
+	return syntax.Marshal(tkt)
+}
+
+func (tkt *NewSessionTicketBody) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, tkt)
+}
+
+// enum {
+//     update_not_requested(0), update_requested(1), (255)
+// } KeyUpdateRequest;
+//
+// struct {
+//     KeyUpdateRequest request_update;
+// } KeyUpdate;
+type KeyUpdateBody struct {
+	KeyUpdateRequest KeyUpdateRequest
+}
+
+func (ku KeyUpdateBody) Type() HandshakeType {
+	return HandshakeTypeKeyUpdate
+}
+
+func (ku KeyUpdateBody) Marshal() ([]byte, error) {
+	return syntax.Marshal(ku)
+}
+
+func (ku *KeyUpdateBody) Unmarshal(data []byte) (int, error) {
+	return syntax.Unmarshal(data, ku)
+}
+
+// struct {} EndOfEarlyData;
+type EndOfEarlyDataBody struct{}
+
+func (eoed EndOfEarlyDataBody) Type() HandshakeType {
+	return HandshakeTypeEndOfEarlyData
+}
+
+func (eoed EndOfEarlyDataBody) Marshal() ([]byte, error) {
+	return []byte{}, nil
+}
+
+func (eoed *EndOfEarlyDataBody) Unmarshal(data []byte) (int, error) {
+	return 0, nil
+}

vendor/github.com/bifurcation/mint/log.go

@@ -0,0 +1,55 @@
+package mint
+
+import (
+	"fmt"
+	"log"
+	"os"
+	"strings"
+)
+
+// We use this environment variable to control logging.  It should be a
+// comma-separated list of log tags (see below) or "*" to enable all logging.
+const logConfigVar = "MINT_LOG"
+
+// Pre-defined log types
+const (
+	logTypeCrypto      = "crypto"
+	logTypeHandshake   = "handshake"
+	logTypeNegotiation = "negotiation"
+	logTypeIO          = "io"
+	logTypeFrameReader = "frame"
+	logTypeVerbose     = "verbose"
+)
+
+var (
+	logFunction = log.Printf
+	logAll      = false
+	logSettings = map[string]bool{}
+)
+
+func init() {
+	parseLogEnv(os.Environ())
+}
+
+func parseLogEnv(env []string) {
+	for _, stmt := range env {
+		if strings.HasPrefix(stmt, logConfigVar+"=") {
+			val := stmt[len(logConfigVar)+1:]
+
+			if val == "*" {
+				logAll = true
+			} else {
+				for _, t := range strings.Split(val, ",") {
+					logSettings[t] = true
+				}
+			}
+		}
+	}
+}
+
+func logf(tag string, format string, args ...interface{}) {
+	if logAll || logSettings[tag] {
+		fullFormat := fmt.Sprintf("[%s] %s", tag, format)
+		logFunction(fullFormat, args...)
+	}
+}

vendor/github.com/bifurcation/mint/negotiation.go

@@ -0,0 +1,218 @@
+package mint
+
+import (
+	"bytes"
+	"encoding/hex"
+	"fmt"
+	"time"
+)
+
+func VersionNegotiation(offered, supported []uint16) (bool, uint16) {
+	for _, offeredVersion := range offered {
+		for _, supportedVersion := range supported {
+			logf(logTypeHandshake, "[server] version offered by client [%04x] <> [%04x]", offeredVersion, supportedVersion)
+			if offeredVersion == supportedVersion {
+				// XXX: Should probably be highest supported version, but for now, we
+				// only support one version, so it doesn't really matter.
+				return true, offeredVersion
+			}
+		}
+	}
+
+	return false, 0
+}
+
+func DHNegotiation(keyShares []KeyShareEntry, groups []NamedGroup) (bool, NamedGroup, []byte, []byte) {
+	for _, share := range keyShares {
+		for _, group := range groups {
+			if group != share.Group {
+				continue
+			}
+
+			pub, priv, err := newKeyShare(share.Group)
+			if err != nil {
+				// If we encounter an error, just keep looking
+				continue
+			}
+
+			dhSecret, err := keyAgreement(share.Group, share.KeyExchange, priv)
+			if err != nil {
+				// If we encounter an error, just keep looking
+				continue
+			}
+
+			return true, group, pub, dhSecret
+		}
+	}
+
+	return false, 0, nil, nil
+}
+
+const (
+	ticketAgeTolerance uint32 = 5 * 1000 // five seconds in milliseconds
+)
+
+func PSKNegotiation(identities []PSKIdentity, binders []PSKBinderEntry, context []byte, psks PreSharedKeyCache) (bool, int, *PreSharedKey, CipherSuiteParams, error) {
+	logf(logTypeNegotiation, "Negotiating PSK offered=[%d] supported=[%d]", len(identities), psks.Size())
+	for i, id := range identities {
+		identityHex := hex.EncodeToString(id.Identity)
+
+		psk, ok := psks.Get(identityHex)
+		if !ok {
+			logf(logTypeNegotiation, "No PSK for identity %x", identityHex)
+			continue
+		}
+
+		// For resumption, make sure the ticket age is correct
+		if psk.IsResumption {
+			extTicketAge := id.ObfuscatedTicketAge - psk.TicketAgeAdd
+			knownTicketAge := uint32(time.Since(psk.ReceivedAt) / time.Millisecond)
+			ticketAgeDelta := knownTicketAge - extTicketAge
+			if knownTicketAge < extTicketAge {
+				ticketAgeDelta = extTicketAge - knownTicketAge
+			}
+			if ticketAgeDelta > ticketAgeTolerance {
+				logf(logTypeNegotiation, "WARNING potential replay [%x]", psk.Identity)
+				logf(logTypeNegotiation, "Ticket age exceeds tolerance |%d - %d| = [%d] > [%d]",
+					extTicketAge, knownTicketAge, ticketAgeDelta, ticketAgeTolerance)
+				return false, 0, nil, CipherSuiteParams{}, fmt.Errorf("WARNING Potential replay for identity %x", psk.Identity)
+			}
+		}
+
+		params, ok := cipherSuiteMap[psk.CipherSuite]
+		if !ok {
+			err := fmt.Errorf("tls.cryptoinit: Unsupported ciphersuite from PSK [%04x]", psk.CipherSuite)
+			return false, 0, nil, CipherSuiteParams{}, err
+		}
+
+		// Compute binder
+		binderLabel := labelExternalBinder
+		if psk.IsResumption {
+			binderLabel = labelResumptionBinder
+		}
+
+		h0 := params.Hash.New().Sum(nil)
+		zero := bytes.Repeat([]byte{0}, params.Hash.Size())
+		earlySecret := HkdfExtract(params.Hash, zero, psk.Key)
+		binderKey := deriveSecret(params, earlySecret, binderLabel, h0)
+
+		// context = ClientHello[truncated]
+		// context = ClientHello1 + HelloRetryRequest + ClientHello2[truncated]
+		ctxHash := params.Hash.New()
+		ctxHash.Write(context)
+
+		binder := computeFinishedData(params, binderKey, ctxHash.Sum(nil))
+		if !bytes.Equal(binder, binders[i].Binder) {
+			logf(logTypeNegotiation, "Binder check failed for identity %x; [%x] != [%x]", psk.Identity, binder, binders[i].Binder)
+			return false, 0, nil, CipherSuiteParams{}, fmt.Errorf("Binder check failed identity %x", psk.Identity)
+		}
+
+		logf(logTypeNegotiation, "Using PSK with identity %x", psk.Identity)
+		return true, i, &psk, params, nil
+	}
+
+	logf(logTypeNegotiation, "Failed to find a usable PSK")
+	return false, 0, nil, CipherSuiteParams{}, nil
+}
+
+func PSKModeNegotiation(canDoDH, canDoPSK bool, modes []PSKKeyExchangeMode) (bool, bool) {
+	logf(logTypeNegotiation, "Negotiating PSK modes [%v] [%v] [%+v]", canDoDH, canDoPSK, modes)
+	dhAllowed := false
+	dhRequired := true
+	for _, mode := range modes {
+		dhAllowed = dhAllowed || (mode == PSKModeDHEKE)
+		dhRequired = dhRequired && (mode == PSKModeDHEKE)
+	}
+
+	// Use PSK if we can meet DH requirement and modes were provided
+	usingPSK := canDoPSK && (!dhRequired || canDoDH) && (len(modes) > 0)
+
+	// Use DH if allowed
+	usingDH := canDoDH && (dhAllowed || !usingPSK)
+
+	logf(logTypeNegotiation, "Results of PSK mode negotiation: usingDH=[%v] usingPSK=[%v]", usingDH, usingPSK)
+	return usingDH, usingPSK
+}
+
+func CertificateSelection(serverName *string, signatureSchemes []SignatureScheme, certs []*Certificate) (*Certificate, SignatureScheme, error) {
+	// Select for server name if provided
+	candidates := certs
+	if serverName != nil {
+		candidatesByName := []*Certificate{}
+		for _, cert := range certs {
+			for _, name := range cert.Chain[0].DNSNames {
+				if len(*serverName) > 0 && name == *serverName {
+					candidatesByName = append(candidatesByName, cert)
+				}
+			}
+		}
+
+		if len(candidatesByName) == 0 {
+			return nil, 0, fmt.Errorf("No certificates available for server name: %s", *serverName)
+		}
+
+		candidates = candidatesByName
+	}
+
+	// Select for signature scheme
+	for _, cert := range candidates {
+		for _, scheme := range signatureSchemes {
+			if !schemeValidForKey(scheme, cert.PrivateKey) {
+				continue
+			}
+
+			return cert, scheme, nil
+		}
+	}
+
+	return nil, 0, fmt.Errorf("No certificates compatible with signature schemes")
+}
+
+func EarlyDataNegotiation(usingPSK, gotEarlyData, allowEarlyData bool) (using bool, rejected bool) {
+	using = gotEarlyData && usingPSK && allowEarlyData
+	rejected = gotEarlyData && !using
+	logf(logTypeNegotiation, "Early data negotiation (%v, %v, %v) => %v, %v", usingPSK, gotEarlyData, allowEarlyData, using, rejected)
+	return
+}
+
+func CipherSuiteNegotiation(psk *PreSharedKey, offered, supported []CipherSuite) (CipherSuite, error) {
+	for _, s1 := range offered {
+		if psk != nil {
+			if s1 == psk.CipherSuite {
+				return s1, nil
+			}
+			continue
+		}
+
+		for _, s2 := range supported {
+			if s1 == s2 {
+				return s1, nil
+			}
+		}
+	}
+
+	return 0, fmt.Errorf("No overlap between offered and supproted ciphersuites (psk? [%v])", psk != nil)
+}
+
+func ALPNNegotiation(psk *PreSharedKey, offered, supported []string) (string, error) {
+	for _, p1 := range offered {
+		if psk != nil {
+			if p1 != psk.NextProto {
+				continue
+			}
+		}
+
+		for _, p2 := range supported {
+			if p1 == p2 {
+				return p1, nil
+			}
+		}
+	}
+
+	// If the client offers ALPN on resumption, it must match the earlier one
+	var err error
+	if psk != nil && psk.IsResumption && (len(offered) > 0) {
+		err = fmt.Errorf("ALPN for PSK not provided")
+	}
+	return "", err
+}

vendor/github.com/bifurcation/mint/record-layer.go

@@ -0,0 +1,458 @@
+package mint
+
+import (
+	"crypto/cipher"
+	"fmt"
+	"io"
+	"sync"
+)
+
+const (
+	sequenceNumberLen   = 8       // sequence number length
+	recordHeaderLenTLS  = 5       // record header length (TLS)
+	recordHeaderLenDTLS = 13      // record header length (DTLS)
+	maxFragmentLen      = 1 << 14 // max number of bytes in a record
+)
+
+type DecryptError string
+
+func (err DecryptError) Error() string {
+	return string(err)
+}
+
+type direction uint8
+
+const (
+	directionWrite = direction(1)
+	directionRead  = direction(2)
+)
+
+// struct {
+//     ContentType type;
+//     ProtocolVersion record_version [0301 for CH, 0303 for others]
+//     uint16 length;
+//     opaque fragment[TLSPlaintext.length];
+// } TLSPlaintext;
+type TLSPlaintext struct {
+	// Omitted: record_version (static)
+	// Omitted: length         (computed from fragment)
+	contentType RecordType
+	epoch       Epoch
+	seq         uint64
+	fragment    []byte
+}
+
+type cipherState struct {
+	epoch    Epoch       // DTLS epoch
+	ivLength int         // Length of the seq and nonce fields
+	seq      uint64      // Zero-padded sequence number
+	iv       []byte      // Buffer for the IV
+	cipher   cipher.AEAD // AEAD cipher
+}
+
+type RecordLayer struct {
+	sync.Mutex
+	label        string
+	direction    direction
+	version      uint16        // The current version number
+	conn         io.ReadWriter // The underlying connection
+	frame        *frameReader  // The buffered frame reader
+	nextData     []byte        // The next record to send
+	cachedRecord *TLSPlaintext // Last record read, cached to enable "peek"
+	cachedError  error         // Error on the last record read
+
+	cipher      *cipherState
+	readCiphers map[Epoch]*cipherState
+
+	datagram bool
+}
+
+type recordLayerFrameDetails struct {
+	datagram bool
+}
+
+func (d recordLayerFrameDetails) headerLen() int {
+	if d.datagram {
+		return recordHeaderLenDTLS
+	}
+	return recordHeaderLenTLS
+}
+
+func (d recordLayerFrameDetails) defaultReadLen() int {
+	return d.headerLen() + maxFragmentLen
+}
+
+func (d recordLayerFrameDetails) frameLen(hdr []byte) (int, error) {
+	return (int(hdr[d.headerLen()-2]) << 8) | int(hdr[d.headerLen()-1]), nil
+}
+
+func newCipherStateNull() *cipherState {
+	return &cipherState{EpochClear, 0, 0, nil, nil}
+}
+
+func newCipherStateAead(epoch Epoch, factory aeadFactory, key []byte, iv []byte) (*cipherState, error) {
+	cipher, err := factory(key)
+	if err != nil {
+		return nil, err
+	}
+
+	return &cipherState{epoch, len(iv), 0, iv, cipher}, nil
+}
+
+func NewRecordLayerTLS(conn io.ReadWriter, dir direction) *RecordLayer {
+	r := RecordLayer{}
+	r.label = ""
+	r.direction = dir
+	r.conn = conn
+	r.frame = newFrameReader(recordLayerFrameDetails{false})
+	r.cipher = newCipherStateNull()
+	r.version = tls10Version
+	return &r
+}
+
+func NewRecordLayerDTLS(conn io.ReadWriter, dir direction) *RecordLayer {
+	r := RecordLayer{}
+	r.label = ""
+	r.direction = dir
+	r.conn = conn
+	r.frame = newFrameReader(recordLayerFrameDetails{true})
+	r.cipher = newCipherStateNull()
+	r.readCiphers = make(map[Epoch]*cipherState, 0)
+	r.readCiphers[0] = r.cipher
+	r.datagram = true
+	return &r
+}
+
+func (r *RecordLayer) SetVersion(v uint16) {
+	r.version = v
+}
+
+func (r *RecordLayer) ResetClear(seq uint64) {
+	r.cipher = newCipherStateNull()
+	r.cipher.seq = seq
+}
+
+func (r *RecordLayer) Rekey(epoch Epoch, factory aeadFactory, key []byte, iv []byte) error {
+	cipher, err := newCipherStateAead(epoch, factory, key, iv)
+	if err != nil {
+		return err
+	}
+	r.cipher = cipher
+	if r.datagram && r.direction == directionRead {
+		r.readCiphers[epoch] = cipher
+	}
+	return nil
+}
+
+// TODO(ekr@rtfm.com): This is never used, which is a bug.
+func (r *RecordLayer) DiscardReadKey(epoch Epoch) {
+	if !r.datagram {
+		return
+	}
+
+	_, ok := r.readCiphers[epoch]
+	assert(ok)
+	delete(r.readCiphers, epoch)
+}
+
+func (c *cipherState) combineSeq(datagram bool) uint64 {
+	seq := c.seq
+	if datagram {
+		seq |= uint64(c.epoch) << 48
+	}
+	return seq
+}
+
+func (c *cipherState) computeNonce(seq uint64) []byte {
+	nonce := make([]byte, len(c.iv))
+	copy(nonce, c.iv)
+
+	s := seq
+
+	offset := len(c.iv)
+	for i := 0; i < 8; i++ {
+		nonce[(offset-i)-1] ^= byte(s & 0xff)
+		s >>= 8
+	}
+	logf(logTypeCrypto, "Computing nonce for sequence # %x -> %x", seq, nonce)
+
+	return nonce
+}
+
+func (c *cipherState) incrementSequenceNumber() {
+	if c.seq >= (1<<48 - 1) {
+		// Not allowed to let sequence number wrap.
+		// Instead, must renegotiate before it does.
+		// Not likely enough to bother. This is the
+		// DTLS limit.
+		panic("TLS: sequence number wraparound")
+	}
+	c.seq++
+}
+
+func (c *cipherState) overhead() int {
+	if c.cipher == nil {
+		return 0
+	}
+	return c.cipher.Overhead()
+}
+
+func (r *RecordLayer) encrypt(cipher *cipherState, seq uint64, pt *TLSPlaintext, padLen int) *TLSPlaintext {
+	assert(r.direction == directionWrite)
+	logf(logTypeIO, "%s Encrypt seq=[%x]", r.label, seq)
+	// Expand the fragment to hold contentType, padding, and overhead
+	originalLen := len(pt.fragment)
+	plaintextLen := originalLen + 1 + padLen
+	ciphertextLen := plaintextLen + cipher.overhead()
+
+	// Assemble the revised plaintext
+	out := &TLSPlaintext{
+
+		contentType: RecordTypeApplicationData,
+		fragment:    make([]byte, ciphertextLen),
+	}
+	copy(out.fragment, pt.fragment)
+	out.fragment[originalLen] = byte(pt.contentType)
+	for i := 1; i <= padLen; i++ {
+		out.fragment[originalLen+i] = 0
+	}
+
+	// Encrypt the fragment
+	payload := out.fragment[:plaintextLen]
+	cipher.cipher.Seal(payload[:0], cipher.computeNonce(seq), payload, nil)
+	return out
+}
+
+func (r *RecordLayer) decrypt(pt *TLSPlaintext, seq uint64) (*TLSPlaintext, int, error) {
+	assert(r.direction == directionRead)
+	logf(logTypeIO, "%s Decrypt seq=[%x]", r.label, seq)
+	if len(pt.fragment) < r.cipher.overhead() {
+		msg := fmt.Sprintf("tls.record.decrypt: Record too short [%d] < [%d]", len(pt.fragment), r.cipher.overhead())
+		return nil, 0, DecryptError(msg)
+	}
+
+	decryptLen := len(pt.fragment) - r.cipher.overhead()
+	out := &TLSPlaintext{
+		contentType: pt.contentType,
+		fragment:    make([]byte, decryptLen),
+	}
+
+	// Decrypt
+	_, err := r.cipher.cipher.Open(out.fragment[:0], r.cipher.computeNonce(seq), pt.fragment, nil)
+	if err != nil {
+		logf(logTypeIO, "%s AEAD decryption failure [%x]", r.label, pt)
+		return nil, 0, DecryptError("tls.record.decrypt: AEAD decrypt failed")
+	}
+
+	// Find the padding boundary
+	padLen := 0
+	for ; padLen < decryptLen+1 && out.fragment[decryptLen-padLen-1] == 0; padLen++ {
+	}
+
+	// Transfer the content type
+	newLen := decryptLen - padLen - 1
+	out.contentType = RecordType(out.fragment[newLen])
+
+	// Truncate the message to remove contentType, padding, overhead
+	out.fragment = out.fragment[:newLen]
+	out.seq = seq
+	return out, padLen, nil
+}
+
+func (r *RecordLayer) PeekRecordType(block bool) (RecordType, error) {
+	var pt *TLSPlaintext
+	var err error
+
+	for {
+		pt, err = r.nextRecord(false)
+		if err == nil {
+			break
+		}
+		if !block || err != AlertWouldBlock {
+			return 0, err
+		}
+	}
+	return pt.contentType, nil
+}
+
+func (r *RecordLayer) ReadRecord() (*TLSPlaintext, error) {
+	pt, err := r.nextRecord(false)
+
+	// Consume the cached record if there was one
+	r.cachedRecord = nil
+	r.cachedError = nil
+
+	return pt, err
+}
+
+func (r *RecordLayer) readRecordAnyEpoch() (*TLSPlaintext, error) {
+	pt, err := r.nextRecord(true)
+
+	// Consume the cached record if there was one
+	r.cachedRecord = nil
+	r.cachedError = nil
+
+	return pt, err
+}
+
+func (r *RecordLayer) nextRecord(allowOldEpoch bool) (*TLSPlaintext, error) {
+	cipher := r.cipher
+	if r.cachedRecord != nil {
+		logf(logTypeIO, "%s Returning cached record", r.label)
+		return r.cachedRecord, r.cachedError
+	}
+
+	// Loop until one of three things happens:
+	//
+	// 1. We get a frame
+	// 2. We try to read off the socket and get nothing, in which case
+	//    returnAlertWouldBlock
+	// 3. We get an error.
+	var err error
+	err = AlertWouldBlock
+	var header, body []byte
+
+	for err != nil {
+		if r.frame.needed() > 0 {
+			buf := make([]byte, r.frame.details.headerLen()+maxFragmentLen)
+			n, err := r.conn.Read(buf)
+			if err != nil {
+				logf(logTypeIO, "%s Error reading, %v", r.label, err)
+				return nil, err
+			}
+
+			if n == 0 {
+				return nil, AlertWouldBlock
+			}
+
+			logf(logTypeIO, "%s Read %v bytes", r.label, n)
+
+			buf = buf[:n]
+			r.frame.addChunk(buf)
+		}
+
+		header, body, err = r.frame.process()
+		// Loop around onAlertWouldBlock to see if some
+		// data is now available.
+		if err != nil && err != AlertWouldBlock {
+			return nil, err
+		}
+	}
+
+	pt := &TLSPlaintext{}
+	// Validate content type
+	switch RecordType(header[0]) {
+	default:
+		return nil, fmt.Errorf("tls.record: Unknown content type %02x", header[0])
+	case RecordTypeAlert, RecordTypeHandshake, RecordTypeApplicationData, RecordTypeAck:
+		pt.contentType = RecordType(header[0])
+	}
+
+	// Validate version
+	if !allowWrongVersionNumber && (header[1] != 0x03 || header[2] != 0x01) {
+		return nil, fmt.Errorf("tls.record: Invalid version %02x%02x", header[1], header[2])
+	}
+
+	// Validate size < max
+	size := (int(header[len(header)-2]) << 8) + int(header[len(header)-1])
+
+	if size > maxFragmentLen+256 {
+		return nil, fmt.Errorf("tls.record: Ciphertext size too big")
+	}
+
+	pt.fragment = make([]byte, size)
+	copy(pt.fragment, body)
+
+	// TODO(ekr@rtfm.com): Enforce that for epoch > 0, the content type is app data.
+
+	// Attempt to decrypt fragment
+	seq := cipher.seq
+	if r.datagram {
+		// TODO(ekr@rtfm.com): Handle duplicates.
+		seq, _ = decodeUint(header[3:11], 8)
+		epoch := Epoch(seq >> 48)
+
+		// Look up the cipher suite from the epoch
+		c, ok := r.readCiphers[epoch]
+		if !ok {
+			logf(logTypeIO, "%s Message from unknown epoch: [%v]", r.label, epoch)
+			return nil, AlertWouldBlock
+		}
+
+		if epoch != cipher.epoch {
+			logf(logTypeIO, "%s Message from non-current epoch: [%v != %v] out-of-epoch reads=%v", r.label, epoch,
+				cipher.epoch, allowOldEpoch)
+			if !allowOldEpoch {
+				return nil, AlertWouldBlock
+			}
+			cipher = c
+		}
+	}
+
+	if cipher.cipher != nil {
+		logf(logTypeIO, "%s RecordLayer.ReadRecord epoch=[%s] seq=[%x] [%d] ciphertext=[%x]", r.label, cipher.epoch.label(), seq, pt.contentType, pt.fragment)
+		pt, _, err = r.decrypt(pt, seq)
+		if err != nil {
+			logf(logTypeIO, "%s Decryption failed", r.label)
+			return nil, err
+		}
+	}
+	pt.epoch = cipher.epoch
+
+	// Check that plaintext length is not too long
+	if len(pt.fragment) > maxFragmentLen {
+		return nil, fmt.Errorf("tls.record: Plaintext size too big")
+	}
+
+	logf(logTypeIO, "%s RecordLayer.ReadRecord [%d] [%x]", r.label, pt.contentType, pt.fragment)
+
+	r.cachedRecord = pt
+	cipher.incrementSequenceNumber()
+	return pt, nil
+}
+
+func (r *RecordLayer) WriteRecord(pt *TLSPlaintext) error {
+	return r.writeRecordWithPadding(pt, r.cipher, 0)
+}
+
+func (r *RecordLayer) WriteRecordWithPadding(pt *TLSPlaintext, padLen int) error {
+	return r.writeRecordWithPadding(pt, r.cipher, padLen)
+}
+
+func (r *RecordLayer) writeRecordWithPadding(pt *TLSPlaintext, cipher *cipherState, padLen int) error {
+	seq := cipher.combineSeq(r.datagram)
+	if cipher.cipher != nil {
+		logf(logTypeIO, "%s RecordLayer.WriteRecord epoch=[%s] seq=[%x] [%d] plaintext=[%x]", r.label, cipher.epoch.label(), cipher.seq, pt.contentType, pt.fragment)
+		pt = r.encrypt(cipher, seq, pt, padLen)
+	} else if padLen > 0 {
+		return fmt.Errorf("tls.record: Padding can only be done on encrypted records")
+	}
+
+	if len(pt.fragment) > maxFragmentLen {
+		return fmt.Errorf("tls.record: Record size too big")
+	}
+
+	length := len(pt.fragment)
+	var header []byte
+
+	if !r.datagram {
+		header = []byte{byte(pt.contentType),
+			byte(r.version >> 8), byte(r.version & 0xff),
+			byte(length >> 8), byte(length)}
+	} else {
+		header = make([]byte, 13)
+		version := dtlsConvertVersion(r.version)
+		copy(header, []byte{byte(pt.contentType),
+			byte(version >> 8), byte(version & 0xff),
+		})
+		encodeUint(seq, 8, header[3:])
+		encodeUint(uint64(length), 2, header[11:])
+	}
+	record := append(header, pt.fragment...)
+
+	logf(logTypeIO, "%s RecordLayer.WriteRecord epoch=[%s] seq=[%x] [%d] ciphertext=[%x]", r.label, cipher.epoch.label(), cipher.seq, pt.contentType, pt.fragment)
+
+	cipher.incrementSequenceNumber()
+	_, err := r.conn.Write(record)
+	return err
+}

vendor/github.com/bifurcation/mint/state-machine.go

@@ -0,0 +1,247 @@
+package mint
+
+import (
+	"crypto/x509"
+	"time"
+)
+
+// Marker interface for actions that an implementation should take based on
+// state transitions.
+type HandshakeAction interface{}
+
+type QueueHandshakeMessage struct {
+	Message *HandshakeMessage
+}
+
+type SendQueuedHandshake struct{}
+
+type SendEarlyData struct{}
+
+type RekeyIn struct {
+	epoch  Epoch
+	KeySet keySet
+}
+
+type RekeyOut struct {
+	epoch  Epoch
+	KeySet keySet
+}
+
+type ResetOut struct {
+	seq uint64
+}
+
+type StorePSK struct {
+	PSK PreSharedKey
+}
+
+type HandshakeState interface {
+	Next(handshakeMessageReader) (HandshakeState, []HandshakeAction, Alert)
+	State() State
+}
+
+type AppExtensionHandler interface {
+	Send(hs HandshakeType, el *ExtensionList) error
+	Receive(hs HandshakeType, el *ExtensionList) error
+}
+
+// ConnectionOptions objects represent per-connection settings for a client
+// initiating a connection
+type ConnectionOptions struct {
+	ServerName string
+	NextProtos []string
+}
+
+// ConnectionParameters objects represent the parameters negotiated for a
+// connection.
+type ConnectionParameters struct {
+	UsingPSK               bool
+	UsingDH                bool
+	ClientSendingEarlyData bool
+	UsingEarlyData         bool
+	RejectedEarlyData      bool
+	UsingClientAuth        bool
+
+	CipherSuite CipherSuite
+	ServerName  string
+	NextProto   string
+}
+
+// Working state for the handshake.
+type HandshakeContext struct {
+	timeoutMS         uint32
+	timers            *timerSet
+	recvdRecords      []uint64
+	sentFragments     []*SentHandshakeFragment
+	hIn, hOut         *HandshakeLayer
+	waitingNextFlight bool
+	earlyData         []byte
+}
+
+func (hc *HandshakeContext) SetVersion(version uint16) {
+	if hc.hIn.conn != nil {
+		hc.hIn.conn.SetVersion(version)
+	}
+	if hc.hOut.conn != nil {
+		hc.hOut.conn.SetVersion(version)
+	}
+}
+
+// stateConnected is symmetric between client and server
+type stateConnected struct {
+	Params              ConnectionParameters
+	hsCtx               *HandshakeContext
+	isClient            bool
+	cryptoParams        CipherSuiteParams
+	resumptionSecret    []byte
+	clientTrafficSecret []byte
+	serverTrafficSecret []byte
+	exporterSecret      []byte
+	peerCertificates    []*x509.Certificate
+	verifiedChains      [][]*x509.Certificate
+}
+
+var _ HandshakeState = &stateConnected{}
+
+func (state stateConnected) State() State {
+	if state.isClient {
+		return StateClientConnected
+	}
+	return StateServerConnected
+}
+
+func (state *stateConnected) KeyUpdate(request KeyUpdateRequest) ([]HandshakeAction, Alert) {
+	var trafficKeys keySet
+	if state.isClient {
+		state.clientTrafficSecret = HkdfExpandLabel(state.cryptoParams.Hash, state.clientTrafficSecret,
+			labelClientApplicationTrafficSecret, []byte{}, state.cryptoParams.Hash.Size())
+		trafficKeys = makeTrafficKeys(state.cryptoParams, state.clientTrafficSecret)
+	} else {
+		state.serverTrafficSecret = HkdfExpandLabel(state.cryptoParams.Hash, state.serverTrafficSecret,
+			labelServerApplicationTrafficSecret, []byte{}, state.cryptoParams.Hash.Size())
+		trafficKeys = makeTrafficKeys(state.cryptoParams, state.serverTrafficSecret)
+	}
+
+	kum, err := state.hsCtx.hOut.HandshakeMessageFromBody(&KeyUpdateBody{KeyUpdateRequest: request})
+	if err != nil {
+		logf(logTypeHandshake, "[StateConnected] Error marshaling key update message: %v", err)
+		return nil, AlertInternalError
+	}
+
+	toSend := []HandshakeAction{
+		QueueHandshakeMessage{kum},
+		SendQueuedHandshake{},
+		RekeyOut{epoch: EpochUpdate, KeySet: trafficKeys},
+	}
+	return toSend, AlertNoAlert
+}
+
+func (state *stateConnected) NewSessionTicket(length int, lifetime, earlyDataLifetime uint32) ([]HandshakeAction, Alert) {
+	tkt, err := NewSessionTicket(length, lifetime)
+	if err != nil {
+		logf(logTypeHandshake, "[StateConnected] Error generating NewSessionTicket: %v", err)
+		return nil, AlertInternalError
+	}
+
+	err = tkt.Extensions.Add(&TicketEarlyDataInfoExtension{earlyDataLifetime})
+	if err != nil {
+		logf(logTypeHandshake, "[StateConnected] Error adding extension to NewSessionTicket: %v", err)
+		return nil, AlertInternalError
+	}
+
+	resumptionKey := HkdfExpandLabel(state.cryptoParams.Hash, state.resumptionSecret,
+		labelResumption, tkt.TicketNonce, state.cryptoParams.Hash.Size())
+
+	newPSK := PreSharedKey{
+		CipherSuite:  state.cryptoParams.Suite,
+		IsResumption: true,
+		Identity:     tkt.Ticket,
+		Key:          resumptionKey,
+		NextProto:    state.Params.NextProto,
+		ReceivedAt:   time.Now(),
+		ExpiresAt:    time.Now().Add(time.Duration(tkt.TicketLifetime) * time.Second),
+		TicketAgeAdd: tkt.TicketAgeAdd,
+	}
+
+	tktm, err := state.hsCtx.hOut.HandshakeMessageFromBody(tkt)
+	if err != nil {
+		logf(logTypeHandshake, "[StateConnected] Error marshaling NewSessionTicket: %v", err)
+		return nil, AlertInternalError
+	}
+
+	toSend := []HandshakeAction{
+		StorePSK{newPSK},
+		QueueHandshakeMessage{tktm},
+		SendQueuedHandshake{},
+	}
+	return toSend, AlertNoAlert
+}
+
+// Next does nothing for this state.
+func (state stateConnected) Next(hr handshakeMessageReader) (HandshakeState, []HandshakeAction, Alert) {
+	return state, nil, AlertNoAlert
+}
+
+func (state stateConnected) ProcessMessage(hm *HandshakeMessage) (HandshakeState, []HandshakeAction, Alert) {
+	if hm == nil {
+		logf(logTypeHandshake, "[StateConnected] Unexpected message")
+		return nil, nil, AlertUnexpectedMessage
+	}
+
+	bodyGeneric, err := hm.ToBody()
+	if err != nil {
+		logf(logTypeHandshake, "[StateConnected] Error decoding message: %v", err)
+		return nil, nil, AlertDecodeError
+	}
+
+	switch body := bodyGeneric.(type) {
+	case *KeyUpdateBody:
+		var trafficKeys keySet
+		if !state.isClient {
+			state.clientTrafficSecret = HkdfExpandLabel(state.cryptoParams.Hash, state.clientTrafficSecret,
+				labelClientApplicationTrafficSecret, []byte{}, state.cryptoParams.Hash.Size())
+			trafficKeys = makeTrafficKeys(state.cryptoParams, state.clientTrafficSecret)
+		} else {
+			state.serverTrafficSecret = HkdfExpandLabel(state.cryptoParams.Hash, state.serverTrafficSecret,
+				labelServerApplicationTrafficSecret, []byte{}, state.cryptoParams.Hash.Size())
+			trafficKeys = makeTrafficKeys(state.cryptoParams, state.serverTrafficSecret)
+		}
+
+		toSend := []HandshakeAction{RekeyIn{epoch: EpochUpdate, KeySet: trafficKeys}}
+
+		// If requested, roll outbound keys and send a KeyUpdate
+		if body.KeyUpdateRequest == KeyUpdateRequested {
+			logf(logTypeHandshake, "Received key update, update requested", body.KeyUpdateRequest)
+			moreToSend, alert := state.KeyUpdate(KeyUpdateNotRequested)
+			if alert != AlertNoAlert {
+				return nil, nil, alert
+			}
+			toSend = append(toSend, moreToSend...)
+		}
+		return state, toSend, AlertNoAlert
+	case *NewSessionTicketBody:
+		// XXX: Allow NewSessionTicket in both directions?
+		if !state.isClient {
+			return nil, nil, AlertUnexpectedMessage
+		}
+
+		resumptionKey := HkdfExpandLabel(state.cryptoParams.Hash, state.resumptionSecret,
+			labelResumption, body.TicketNonce, state.cryptoParams.Hash.Size())
+		psk := PreSharedKey{
+			CipherSuite:  state.cryptoParams.Suite,
+			IsResumption: true,
+			Identity:     body.Ticket,
+			Key:          resumptionKey,
+			NextProto:    state.Params.NextProto,
+			ReceivedAt:   time.Now(),
+			ExpiresAt:    time.Now().Add(time.Duration(body.TicketLifetime) * time.Second),
+			TicketAgeAdd: body.TicketAgeAdd,
+		}
+
+		toSend := []HandshakeAction{StorePSK{psk}}
+		return state, toSend, AlertNoAlert
+	}
+
+	logf(logTypeHandshake, "[StateConnected] Unexpected message type %v", hm.msgType)
+	return nil, nil, AlertUnexpectedMessage
+}

vendor/github.com/bifurcation/mint/syntax/README.md

@@ -0,0 +1,84 @@
+TLS Syntax
+==========
+
+TLS defines [its own syntax](https://tlswg.github.io/tls13-spec/#rfc.section.3)
+for describing structures used in that protocol.  To facilitate experimentation
+with TLS in Go, this module maps that syntax to the Go structure syntax, taking
+advantage of Go's type annotations to encode non-type information carried in the
+TLS presentation format.
+
+For example, in the TLS specification, a ClientHello message has the following
+structure:
+
+~~~~~
+uint16 ProtocolVersion;
+opaque Random[32];
+uint8 CipherSuite[2];
+enum { ... (65535)} ExtensionType;
+
+struct {
+    ExtensionType extension_type;
+    opaque extension_data<0..2^16-1>;
+} Extension;
+
+struct {
+    ProtocolVersion legacy_version = 0x0303;    /* TLS v1.2 */
+    Random random;
+    opaque legacy_session_id<0..32>;
+    CipherSuite cipher_suites<2..2^16-2>;
+    opaque legacy_compression_methods<1..2^8-1>;
+    Extension extensions<0..2^16-1>;
+} ClientHello;
+~~~~~
+
+This maps to the following Go type definitions:
+
+~~~~~
+type protocolVersion uint16
+type random [32]byte
+type cipherSuite uint16 // or [2]byte
+type extensionType uint16
+
+type extension struct {
+  ExtensionType extensionType
+  ExtensionData []byte `tls:"head=2"`
+}
+
+type clientHello struct {
+	LegacyVersion            protocolVersion
+	Random                   random
+	LegacySessionID          []byte        `tls:"head=1,max=32"`
+	CipherSuites             []cipherSuite `tls:"head=2,min=2"`
+	LegacyCompressionMethods []byte        `tls:"head=1,min=1"`
+	Extensions               []extension   `tls:"head=2"`
+}
+~~~~~
+
+Then you can just declare, marshal, and unmarshal structs just like you would
+with, say JSON.
+
+The available annotations right now are all related to vectors:
+
+* `head`: The number of bytes of length to use as a "header"
+* `min`: The minimum length of the vector, in bytes
+* `max`: The maximum length of the vector, in bytes
+
+## Not supported
+
+* The `select()` syntax for creating alternate version of the same struct (see,
+  e.g., the KeyShare extension)
+
+* The backreference syntax for array lengths or select parameters, as in `opaque
+  fragment[TLSPlaintext.length]`.  Note, however, that in cases where the length
+  immediately preceds the array, these can be reframed as vectors with
+  appropriate sizes.
+
+
+QUIC Extensions Syntax
+======================
+syntax also supports some minor extensions to allow implementing QUIC.
+
+* The `varint` annotation describes a QUIC-style varint
+* `head=none` means no header, i.e., the bytes are encoded directly on the wire.
+  On reading, the decoder will consume all available data.
+* `head=varint` means to encode the header as a varint

vendor/github.com/bifurcation/mint/syntax/decode.go

@@ -0,0 +1,344 @@
+package syntax
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"runtime"
+)
+
+func Unmarshal(data []byte, v interface{}) (int, error) {
+	// Check for well-formedness.
+	// Avoids filling out half a data structure
+	// before discovering a JSON syntax error.
+	d := decodeState{}
+	d.Write(data)
+	return d.unmarshal(v)
+}
+
+// Unmarshaler is the interface implemented by types that can
+// unmarshal a TLS description of themselves.  Note that unlike the
+// JSON unmarshaler interface, it is not known a priori how much of
+// the input data will be consumed.  So the Unmarshaler must state
+// how much of the input data it consumed.
+type Unmarshaler interface {
+	UnmarshalTLS([]byte) (int, error)
+}
+
+// These are the options that can be specified in the struct tag.  Right now,
+// all of them apply to variable-length vectors and nothing else
+type decOpts struct {
+	head   uint // length of length in bytes
+	min    uint // minimum size in bytes
+	max    uint // maximum size in bytes
+	varint bool // whether to decode as a varint
+}
+
+type decodeState struct {
+	bytes.Buffer
+}
+
+func (d *decodeState) unmarshal(v interface{}) (read int, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if _, ok := r.(runtime.Error); ok {
+				panic(r)
+			}
+			if s, ok := r.(string); ok {
+				panic(s)
+			}
+			err = r.(error)
+		}
+	}()
+
+	rv := reflect.ValueOf(v)
+	if rv.Kind() != reflect.Ptr || rv.IsNil() {
+		return 0, fmt.Errorf("Invalid unmarshal target (non-pointer or nil)")
+	}
+
+	read = d.value(rv)
+	return read, nil
+}
+
+func (e *decodeState) value(v reflect.Value) int {
+	return valueDecoder(v)(e, v, decOpts{})
+}
+
+type decoderFunc func(e *decodeState, v reflect.Value, opts decOpts) int
+
+func valueDecoder(v reflect.Value) decoderFunc {
+	return typeDecoder(v.Type().Elem())
+}
+
+func typeDecoder(t reflect.Type) decoderFunc {
+	// Note: Omits the caching / wait-group things that encoding/json uses
+	return newTypeDecoder(t)
+}
+
+var (
+	unmarshalerType = reflect.TypeOf(new(Unmarshaler)).Elem()
+)
+
+func newTypeDecoder(t reflect.Type) decoderFunc {
+	if t.Kind() != reflect.Ptr && reflect.PtrTo(t).Implements(unmarshalerType) {
+		return unmarshalerDecoder
+	}
+
+	switch t.Kind() {
+	case reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return uintDecoder
+	case reflect.Array:
+		return newArrayDecoder(t)
+	case reflect.Slice:
+		return newSliceDecoder(t)
+	case reflect.Struct:
+		return newStructDecoder(t)
+	case reflect.Ptr:
+		return newPointerDecoder(t)
+	default:
+		panic(fmt.Errorf("Unsupported type (%s)", t))
+	}
+}
+
+///// Specific decoders below
+
+func unmarshalerDecoder(d *decodeState, v reflect.Value, opts decOpts) int {
+	um, ok := v.Interface().(Unmarshaler)
+	if !ok {
+		panic(fmt.Errorf("Non-Unmarshaler passed to unmarshalerEncoder"))
+	}
+
+	read, err := um.UnmarshalTLS(d.Bytes())
+	if err != nil {
+		panic(err)
+	}
+
+	if read > d.Len() {
+		panic(fmt.Errorf("Invalid return value from UnmarshalTLS"))
+	}
+
+	d.Next(read)
+	return read
+}
+
+//////////
+
+func uintDecoder(d *decodeState, v reflect.Value, opts decOpts) int {
+	if opts.varint {
+		return varintDecoder(d, v, opts)
+	}
+
+	uintLen := int(v.Elem().Type().Size())
+	buf := d.Next(uintLen)
+	if len(buf) != uintLen {
+		panic(fmt.Errorf("Insufficient data to read uint"))
+	}
+
+	return setUintFromBuffer(v, buf)
+}
+
+func varintDecoder(d *decodeState, v reflect.Value, opts decOpts) int {
+	l, val := readVarint(d)
+
+	uintLen := int(v.Elem().Type().Size())
+	if uintLen < l {
+		panic(fmt.Errorf("Uint too small to fit varint: %d < %d", uintLen, l))
+	}
+
+	v.Elem().SetUint(val)
+
+	return l
+}
+
+func readVarint(d *decodeState) (int, uint64) {
+	// Read the first octet and decide the size of the presented varint
+	first := d.Next(1)
+	if len(first) != 1 {
+		panic(fmt.Errorf("Insufficient data to read varint length"))
+	}
+
+	twoBits := uint(first[0] >> 6)
+	varintLen := 1 << twoBits
+
+	rest := d.Next(varintLen - 1)
+	if len(rest) != varintLen-1 {
+		panic(fmt.Errorf("Insufficient data to read varint"))
+	}
+
+	buf := append(first, rest...)
+	buf[0] &= 0x3f
+
+	return len(buf), decodeUintFromBuffer(buf)
+}
+
+func decodeUintFromBuffer(buf []byte) uint64 {
+	val := uint64(0)
+	for _, b := range buf {
+		val = (val << 8) + uint64(b)
+	}
+
+	return val
+}
+
+func setUintFromBuffer(v reflect.Value, buf []byte) int {
+	v.Elem().SetUint(decodeUintFromBuffer(buf))
+	return len(buf)
+}
+
+//////////
+
+type arrayDecoder struct {
+	elemDec decoderFunc
+}
+
+func (ad *arrayDecoder) decode(d *decodeState, v reflect.Value, opts decOpts) int {
+	n := v.Elem().Type().Len()
+	read := 0
+	for i := 0; i < n; i += 1 {
+		read += ad.elemDec(d, v.Elem().Index(i).Addr(), opts)
+	}
+	return read
+}
+
+func newArrayDecoder(t reflect.Type) decoderFunc {
+	dec := &arrayDecoder{typeDecoder(t.Elem())}
+	return dec.decode
+}
+
+//////////
+
+type sliceDecoder struct {
+	elementType reflect.Type
+	elementDec  decoderFunc
+}
+
+func (sd *sliceDecoder) decode(d *decodeState, v reflect.Value, opts decOpts) int {
+	var length uint64
+	var read int
+	var data []byte
+
+	if opts.head == 0 {
+		panic(fmt.Errorf("Cannot decode a slice without a header length"))
+	}
+
+	// If the caller indicated there is no header, then read everything from the buffer
+	if opts.head == headValueNoHead {
+		for {
+			chunk := d.Next(1024)
+			data = append(data, chunk...)
+			if len(chunk) != 1024 {
+				break
+			}
+		}
+		length = uint64(len(data))
+		if opts.max > 0 && length > uint64(opts.max) {
+			panic(fmt.Errorf("Length of vector exceeds declared max"))
+		}
+		if length < uint64(opts.min) {
+			panic(fmt.Errorf("Length of vector below declared min"))
+		}
+	} else {
+		if opts.head != headValueVarint {
+			lengthBytes := d.Next(int(opts.head))
+			if len(lengthBytes) != int(opts.head) {
+				panic(fmt.Errorf("Not enough data to read header"))
+			}
+			read = len(lengthBytes)
+			length = decodeUintFromBuffer(lengthBytes)
+		} else {
+			read, length = readVarint(d)
+		}
+		if opts.max > 0 && length > uint64(opts.max) {
+			panic(fmt.Errorf("Length of vector exceeds declared max"))
+		}
+		if length < uint64(opts.min) {
+			panic(fmt.Errorf("Length of vector below declared min"))
+		}
+
+		data = d.Next(int(length))
+		if len(data) != int(length) {
+			panic(fmt.Errorf("Available data less than declared length [%d < %d]", len(data), length))
+		}
+	}
+
+	elemBuf := &decodeState{}
+	elemBuf.Write(data)
+	elems := []reflect.Value{}
+	for elemBuf.Len() > 0 {
+		elem := reflect.New(sd.elementType)
+		read += sd.elementDec(elemBuf, elem, opts)
+		elems = append(elems, elem)
+	}
+
+	v.Elem().Set(reflect.MakeSlice(v.Elem().Type(), len(elems), len(elems)))
+	for i := 0; i < len(elems); i += 1 {
+		v.Elem().Index(i).Set(elems[i].Elem())
+	}
+	return read
+}
+
+func newSliceDecoder(t reflect.Type) decoderFunc {
+	dec := &sliceDecoder{
+		elementType: t.Elem(),
+		elementDec:  typeDecoder(t.Elem()),
+	}
+	return dec.decode
+}
+
+//////////
+
+type structDecoder struct {
+	fieldOpts []decOpts
+	fieldDecs []decoderFunc
+}
+
+func (sd *structDecoder) decode(d *decodeState, v reflect.Value, opts decOpts) int {
+	read := 0
+	for i := range sd.fieldDecs {
+		read += sd.fieldDecs[i](d, v.Elem().Field(i).Addr(), sd.fieldOpts[i])
+	}
+	return read
+}
+
+func newStructDecoder(t reflect.Type) decoderFunc {
+	n := t.NumField()
+	sd := structDecoder{
+		fieldOpts: make([]decOpts, n),
+		fieldDecs: make([]decoderFunc, n),
+	}
+
+	for i := 0; i < n; i += 1 {
+		f := t.Field(i)
+
+		tag := f.Tag.Get("tls")
+		tagOpts := parseTag(tag)
+
+		sd.fieldOpts[i] = decOpts{
+			head:   tagOpts["head"],
+			max:    tagOpts["max"],
+			min:    tagOpts["min"],
+			varint: tagOpts[varintOption] > 0,
+		}
+
+		sd.fieldDecs[i] = typeDecoder(f.Type)
+	}
+
+	return sd.decode
+}
+
+//////////
+
+type pointerDecoder struct {
+	base decoderFunc
+}
+
+func (pd *pointerDecoder) decode(d *decodeState, v reflect.Value, opts decOpts) int {
+	v.Elem().Set(reflect.New(v.Elem().Type().Elem()))
+	return pd.base(d, v.Elem(), opts)
+}
+
+func newPointerDecoder(t reflect.Type) decoderFunc {
+	baseDecoder := typeDecoder(t.Elem())
+	pd := pointerDecoder{base: baseDecoder}
+	return pd.decode
+}

vendor/github.com/bifurcation/mint/syntax/encode.go

@@ -0,0 +1,276 @@
+package syntax
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"runtime"
+)
+
+func Marshal(v interface{}) ([]byte, error) {
+	e := &encodeState{}
+	err := e.marshal(v, encOpts{})
+	if err != nil {
+		return nil, err
+	}
+	return e.Bytes(), nil
+}
+
+// Marshaler is the interface implemented by types that
+// have a defined TLS encoding.
+type Marshaler interface {
+	MarshalTLS() ([]byte, error)
+}
+
+// These are the options that can be specified in the struct tag.  Right now,
+// all of them apply to variable-length vectors and nothing else
+type encOpts struct {
+	head   uint // length of length in bytes
+	min    uint // minimum size in bytes
+	max    uint // maximum size in bytes
+	varint bool // whether to encode as a varint
+}
+
+type encodeState struct {
+	bytes.Buffer
+}
+
+func (e *encodeState) marshal(v interface{}, opts encOpts) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if _, ok := r.(runtime.Error); ok {
+				panic(r)
+			}
+			if s, ok := r.(string); ok {
+				panic(s)
+			}
+			err = r.(error)
+		}
+	}()
+	e.reflectValue(reflect.ValueOf(v), opts)
+	return nil
+}
+
+func (e *encodeState) reflectValue(v reflect.Value, opts encOpts) {
+	valueEncoder(v)(e, v, opts)
+}
+
+type encoderFunc func(e *encodeState, v reflect.Value, opts encOpts)
+
+func valueEncoder(v reflect.Value) encoderFunc {
+	if !v.IsValid() {
+		panic(fmt.Errorf("Cannot encode an invalid value"))
+	}
+	return typeEncoder(v.Type())
+}
+
+func typeEncoder(t reflect.Type) encoderFunc {
+	// Note: Omits the caching / wait-group things that encoding/json uses
+	return newTypeEncoder(t)
+}
+
+var (
+	marshalerType = reflect.TypeOf(new(Marshaler)).Elem()
+)
+
+func newTypeEncoder(t reflect.Type) encoderFunc {
+	if t.Implements(marshalerType) {
+		return marshalerEncoder
+	}
+
+	switch t.Kind() {
+	case reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return uintEncoder
+	case reflect.Array:
+		return newArrayEncoder(t)
+	case reflect.Slice:
+		return newSliceEncoder(t)
+	case reflect.Struct:
+		return newStructEncoder(t)
+	case reflect.Ptr:
+		return newPointerEncoder(t)
+	default:
+		panic(fmt.Errorf("Unsupported type (%s)", t))
+	}
+}
+
+///// Specific encoders below
+
+func marshalerEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.Kind() == reflect.Ptr && v.IsNil() {
+		panic(fmt.Errorf("Cannot encode nil pointer"))
+	}
+
+	m, ok := v.Interface().(Marshaler)
+	if !ok {
+		panic(fmt.Errorf("Non-Marshaler passed to marshalerEncoder"))
+	}
+
+	b, err := m.MarshalTLS()
+	if err == nil {
+		_, err = e.Write(b)
+	}
+
+	if err != nil {
+		panic(err)
+	}
+}
+
+//////////
+
+func uintEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	if opts.varint {
+		varintEncoder(e, v, opts)
+		return
+	}
+
+	writeUint(e, v.Uint(), int(v.Type().Size()))
+}
+
+func varintEncoder(e *encodeState, v reflect.Value, opts encOpts) {
+	writeVarint(e, v.Uint())
+}
+
+func writeVarint(e *encodeState, u uint64) {
+	if (u >> 62) > 0 {
+		panic(fmt.Errorf("uint value is too big for varint"))
+	}
+
+	var varintLen int
+	for _, len := range []uint{1, 2, 4, 8} {
+		if u < (uint64(1) << (8*len - 2)) {
+			varintLen = int(len)
+			break
+		}
+	}
+
+	twoBits := map[int]uint64{1: 0x00, 2: 0x01, 4: 0x02, 8: 0x03}[varintLen]
+	shift := uint(8*varintLen - 2)
+	writeUint(e, u|(twoBits<<shift), varintLen)
+}
+
+func writeUint(e *encodeState, u uint64, len int) {
+	data := make([]byte, len)
+	for i := 0; i < len; i += 1 {
+		data[i] = byte(u >> uint(8*(len-i-1)))
+	}
+	e.Write(data)
+}
+
+//////////
+
+type arrayEncoder struct {
+	elemEnc encoderFunc
+}
+
+func (ae *arrayEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	n := v.Len()
+	for i := 0; i < n; i += 1 {
+		ae.elemEnc(e, v.Index(i), opts)
+	}
+}
+
+func newArrayEncoder(t reflect.Type) encoderFunc {
+	enc := &arrayEncoder{typeEncoder(t.Elem())}
+	return enc.encode
+}
+
+//////////
+
+type sliceEncoder struct {
+	ae *arrayEncoder
+}
+
+func (se *sliceEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	arrayState := &encodeState{}
+	se.ae.encode(arrayState, v, opts)
+
+	n := uint(arrayState.Len())
+	if opts.head == 0 {
+		panic(fmt.Errorf("Cannot encode a slice without a header length"))
+	}
+
+	if opts.max > 0 && n > opts.max {
+		panic(fmt.Errorf("Encoded length more than max [%d > %d]", n, opts.max))
+	}
+	if n < opts.min {
+		panic(fmt.Errorf("Encoded length less than min [%d < %d]", n, opts.min))
+	}
+
+	switch opts.head {
+	case headValueNoHead:
+		// None.
+	case headValueVarint:
+		writeVarint(e, uint64(n))
+	default:
+		if n>>(8*opts.head) > 0 {
+			panic(fmt.Errorf("Encoded length too long for header length [%d, %d]", n, opts.head))
+		}
+
+		writeUint(e, uint64(n), int(opts.head))
+	}
+
+	e.Write(arrayState.Bytes())
+}
+
+func newSliceEncoder(t reflect.Type) encoderFunc {
+	enc := &sliceEncoder{&arrayEncoder{typeEncoder(t.Elem())}}
+	return enc.encode
+}
+
+//////////
+
+type structEncoder struct {
+	fieldOpts []encOpts
+	fieldEncs []encoderFunc
+}
+
+func (se *structEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	for i := range se.fieldEncs {
+		se.fieldEncs[i](e, v.Field(i), se.fieldOpts[i])
+	}
+}
+
+func newStructEncoder(t reflect.Type) encoderFunc {
+	n := t.NumField()
+	se := structEncoder{
+		fieldOpts: make([]encOpts, n),
+		fieldEncs: make([]encoderFunc, n),
+	}
+
+	for i := 0; i < n; i += 1 {
+		f := t.Field(i)
+		tag := f.Tag.Get("tls")
+		tagOpts := parseTag(tag)
+
+		se.fieldOpts[i] = encOpts{
+			head:   tagOpts["head"],
+			max:    tagOpts["max"],
+			min:    tagOpts["min"],
+			varint: tagOpts[varintOption] > 0,
+		}
+		se.fieldEncs[i] = typeEncoder(f.Type)
+	}
+
+	return se.encode
+}
+
+//////////
+
+type pointerEncoder struct {
+	base encoderFunc
+}
+
+func (pe pointerEncoder) encode(e *encodeState, v reflect.Value, opts encOpts) {
+	if v.IsNil() {
+		panic(fmt.Errorf("Cannot marshal a struct containing a nil pointer"))
+	}
+
+	pe.base(e, v.Elem(), opts)
+}
+
+func newPointerEncoder(t reflect.Type) encoderFunc {
+	baseEncoder := typeEncoder(t.Elem())
+	pe := pointerEncoder{base: baseEncoder}
+	return pe.encode
+}

vendor/github.com/bifurcation/mint/syntax/tags.go

@@ -0,0 +1,50 @@
+package syntax
+
+import (
+	"strconv"
+	"strings"
+)
+
+// `tls:"head=2,min=2,max=255,varint"`
+
+type tagOptions map[string]uint
+
+var (
+	varintOption = "varint"
+
+	headOptionNone   = "none"
+	headOptionVarint = "varint"
+	headValueNoHead  = uint(255)
+	headValueVarint  = uint(254)
+)
+
+// parseTag parses a struct field's "tls" tag as a comma-separated list of
+// name=value pairs, where the values MUST be unsigned integers, or in
+// the special case of head, "none" or "varint"
+func parseTag(tag string) tagOptions {
+	opts := tagOptions{}
+	for _, token := range strings.Split(tag, ",") {
+		if token == varintOption {
+			opts[varintOption] = 1
+			continue
+		}
+
+		parts := strings.Split(token, "=")
+		if len(parts[0]) == 0 {
+			continue
+		}
+
+		if len(parts) == 1 {
+			continue
+		}
+
+		if parts[0] == "head" && parts[1] == headOptionNone {
+			opts[parts[0]] = headValueNoHead
+		} else if parts[0] == "head" && parts[1] == headOptionVarint {
+			opts[parts[0]] = headValueVarint
+		} else if val, err := strconv.Atoi(parts[1]); err == nil && val >= 0 {
+			opts[parts[0]] = uint(val)
+		}
+	}
+	return opts
+}

vendor/github.com/bifurcation/mint/timer.go

@@ -0,0 +1,122 @@
+package mint
+
+import (
+	"time"
+)
+
+// This is a simple timer implementation. Timers are stored in a sorted
+// list.
+// TODO(ekr@rtfm.com): Add a way to uncouple these from the system
+// clock.
+type timerCb func() error
+
+type timer struct {
+	label    string
+	cb       timerCb
+	deadline time.Time
+	duration uint32
+}
+
+type timerSet struct {
+	ts []*timer
+}
+
+func newTimerSet() *timerSet {
+	return &timerSet{}
+}
+
+func (ts *timerSet) start(label string, cb timerCb, delayMs uint32) *timer {
+	now := time.Now()
+	t := timer{
+		label,
+		cb,
+		now.Add(time.Millisecond * time.Duration(delayMs)),
+		delayMs,
+	}
+	logf(logTypeHandshake, "Timer %s set [%v -> %v]", t.label, now, t.deadline)
+
+	var i int
+	ntimers := len(ts.ts)
+	for i = 0; i < ntimers; i++ {
+		if t.deadline.Before(ts.ts[i].deadline) {
+			break
+		}
+	}
+
+	tmp := make([]*timer, 0, ntimers+1)
+	tmp = append(tmp, ts.ts[:i]...)
+	tmp = append(tmp, &t)
+	tmp = append(tmp, ts.ts[i:]...)
+	ts.ts = tmp
+
+	return &t
+}
+
+// TODO(ekr@rtfm.com): optimize this now that the list is sorted.
+// We should be able to do just one list manipulation, as long
+// as we're careful about how we handle inserts during callbacks.
+func (ts *timerSet) check(now time.Time) error {
+	for i, t := range ts.ts {
+		if now.After(t.deadline) {
+			ts.ts = append(ts.ts[:i], ts.ts[:i+1]...)
+			if t.cb != nil {
+				logf(logTypeHandshake, "Timer %s expired [%v > %v]", t.label, now, t.deadline)
+				cb := t.cb
+				t.cb = nil
+				err := cb()
+				if err != nil {
+					return err
+				}
+			}
+		} else {
+			break
+		}
+	}
+	return nil
+}
+
+// Returns the next time any of the timers would fire.
+func (ts *timerSet) remaining() (bool, time.Duration) {
+	for _, t := range ts.ts {
+		if t.cb != nil {
+			return true, time.Until(t.deadline)
+		}
+	}
+
+	return false, time.Duration(0)
+}
+
+func (ts *timerSet) cancel(label string) {
+	for _, t := range ts.ts {
+		if t.label == label {
+			t.cancel()
+		}
+	}
+}
+
+func (ts *timerSet) getTimer(label string) *timer {
+	for _, t := range ts.ts {
+		if t.label == label && t.cb != nil {
+			return t
+		}
+	}
+	return nil
+}
+
+func (ts *timerSet) getAllTimers() []string {
+	var ret []string
+
+	for _, t := range ts.ts {
+		if t.cb != nil {
+			ret = append(ret, t.label)
+		}
+	}
+
+	return ret
+}
+
+func (t *timer) cancel() {
+	logf(logTypeHandshake, "Timer %s cancelled", t.label)
+	t.cb = nil
+	t.label = ""
+}

vendor/github.com/bifurcation/mint/tls.go

@@ -0,0 +1,179 @@
+package mint
+
+// XXX(rlb): This file is borrowed pretty much wholesale from crypto/tls
+
+import (
+	"errors"
+	"net"
+	"strings"
+	"time"
+)
+
+// Server returns a new TLS server side connection
+// using conn as the underlying transport.
+// The configuration config must be non-nil and must include
+// at least one certificate or else set GetCertificate.
+func Server(conn net.Conn, config *Config) *Conn {
+	return NewConn(conn, config, false)
+}
+
+// Client returns a new TLS client side connection
+// using conn as the underlying transport.
+// The config cannot be nil: users must set either ServerName or
+// InsecureSkipVerify in the config.
+func Client(conn net.Conn, config *Config) *Conn {
+	return NewConn(conn, config, true)
+}
+
+// A listener implements a network listener (net.Listener) for TLS connections.
+type Listener struct {
+	net.Listener
+	config *Config
+}
+
+// Accept waits for and returns the next incoming TLS connection.
+// The returned connection c is a *tls.Conn.
+func (l *Listener) Accept() (c net.Conn, err error) {
+	c, err = l.Listener.Accept()
+	if err != nil {
+		return
+	}
+	server := Server(c, l.config)
+	err = server.Handshake()
+	if err == AlertNoAlert {
+		err = nil
+	}
+	c = server
+	return
+}
+
+// NewListener creates a Listener which accepts connections from an inner
+// Listener and wraps each connection with Server.
+// The configuration config must be non-nil and must include
+// at least one certificate or else set GetCertificate.
+func NewListener(inner net.Listener, config *Config) (net.Listener, error) {
+	if config != nil && config.NonBlocking {
+		return nil, errors.New("listening not possible in non-blocking mode")
+	}
+	l := new(Listener)
+	l.Listener = inner
+	l.config = config
+	return l, nil
+}
+
+// Listen creates a TLS listener accepting connections on the
+// given network address using net.Listen.
+// The configuration config must be non-nil and must include
+// at least one certificate or else set GetCertificate.
+func Listen(network, laddr string, config *Config) (net.Listener, error) {
+	if config == nil || !config.ValidForServer() {
+		return nil, errors.New("tls: neither Certificates nor GetCertificate set in Config")
+	}
+	l, err := net.Listen(network, laddr)
+	if err != nil {
+		return nil, err
+	}
+	return NewListener(l, config)
+}
+
+type TimeoutError struct{}
+
+func (TimeoutError) Error() string   { return "tls: DialWithDialer timed out" }
+func (TimeoutError) Timeout() bool   { return true }
+func (TimeoutError) Temporary() bool { return true }
+
+// DialWithDialer connects to the given network address using dialer.Dial and
+// then initiates a TLS handshake, returning the resulting TLS connection. Any
+// timeout or deadline given in the dialer apply to connection and TLS
+// handshake as a whole.
+//
+// DialWithDialer interprets a nil configuration as equivalent to the zero
+// configuration; see the documentation of Config for the defaults.
+func DialWithDialer(dialer *net.Dialer, network, addr string, config *Config) (*Conn, error) {
+	if config != nil && config.NonBlocking {
+		return nil, errors.New("dialing not possible in non-blocking mode")
+	}
+
+	// We want the Timeout and Deadline values from dialer to cover the
+	// whole process: TCP connection and TLS handshake. This means that we
+	// also need to start our own timers now.
+	timeout := dialer.Timeout
+
+	if !dialer.Deadline.IsZero() {
+		deadlineTimeout := dialer.Deadline.Sub(time.Now())
+		if timeout == 0 || deadlineTimeout < timeout {
+			timeout = deadlineTimeout
+		}
+	}
+
+	var errChannel chan error
+
+	if timeout != 0 {
+		errChannel = make(chan error, 2)
+		time.AfterFunc(timeout, func() {
+			errChannel <- TimeoutError{}
+		})
+	}
+
+	rawConn, err := dialer.Dial(network, addr)
+	if err != nil {
+		return nil, err
+	}
+
+	colonPos := strings.LastIndex(addr, ":")
+	if colonPos == -1 {
+		colonPos = len(addr)
+	}
+	hostname := addr[:colonPos]
+
+	if config == nil {
+		config = &Config{}
+	} else {
+		config = config.Clone()
+	}
+
+	// If no ServerName is set, infer the ServerName
+	// from the hostname we're connecting to.
+	if config.ServerName == "" {
+		config.ServerName = hostname
+
+	}
+
+	// Set up DTLS as needed.
+	config.UseDTLS = (network == "udp")
+
+	conn := Client(rawConn, config)
+
+	if timeout == 0 {
+		err = conn.Handshake()
+		if err == AlertNoAlert {
+			err = nil
+		}
+	} else {
+		go func() {
+			errChannel <- conn.Handshake()
+		}()
+
+		err = <-errChannel
+		if err == AlertNoAlert {
+			err = nil
+		}
+	}
+
+	if err != nil {
+		rawConn.Close()
+		return nil, err
+	}
+
+	return conn, nil
+}
+
+// Dial connects to the given network address using net.Dial
+// and then initiates a TLS handshake, returning the resulting
+// TLS connection.
+// Dial interprets a nil configuration as equivalent to
+// the zero configuration; see the documentation of Config
+// for the defaults.
+func Dial(network, addr string, config *Config) (*Conn, error) {
+	return DialWithDialer(new(net.Dialer), network, addr, config)
+}