(state []byte)
| 117 | } |
| 118 | |
| 119 | func (c *Conn) encryptTicket(state []byte) ([]byte, error) { |
| 120 | if len(c.ticketKeys) == 0 { |
| 121 | return nil, errors.New("tls: internal error: session ticket keys unavailable") |
| 122 | } |
| 123 | |
| 124 | encrypted := make([]byte, ticketKeyNameLen+aes.BlockSize+len(state)+sha256.Size) |
| 125 | keyName := encrypted[:ticketKeyNameLen] |
| 126 | iv := encrypted[ticketKeyNameLen : ticketKeyNameLen+aes.BlockSize] |
| 127 | macBytes := encrypted[len(encrypted)-sha256.Size:] |
| 128 | |
| 129 | if _, err := io.ReadFull(c.config.rand(), iv); err != nil { |
| 130 | return nil, err |
| 131 | } |
| 132 | key := c.ticketKeys[0] |
| 133 | copy(keyName, key.keyName[:]) |
| 134 | block, err := aes.NewCipher(key.aesKey[:]) |
| 135 | if err != nil { |
| 136 | return nil, errors.New("tls: failed to create cipher while encrypting ticket: " + err.Error()) |
| 137 | } |
| 138 | cipher.NewCTR(block, iv).XORKeyStream(encrypted[ticketKeyNameLen+aes.BlockSize:], state) |
| 139 | |
| 140 | mac := hmac.New(sha256.New, key.hmacKey[:]) |
| 141 | mac.Write(encrypted[:len(encrypted)-sha256.Size]) |
| 142 | mac.Sum(macBytes[:0]) |
| 143 | |
| 144 | return encrypted, nil |
| 145 | } |
| 146 | |
| 147 | func (c *Conn) decryptTicket(encrypted []byte) (plaintext []byte, usedOldKey bool) { |
| 148 | if len(encrypted) < ticketKeyNameLen+aes.BlockSize+sha256.Size { |
no test coverage detected