crypto/tls: Large session tickets in Go 1.21 can cause Windows Schannel clients to be unable to connect

[printfn]

What version of Go are you using (go version)?

$ go version
go version go1.21.3 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/user/.cache/go-build'
GOENV='/home/user/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/user/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/user/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.3'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/home/user/golang-tls-session-ticket-bug/go.mod'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2373417620=/tmp/go-build -gno-record-gcc-switches'

What did you do?

See https://github.com/printfn/golang-tls-session-ticket-bug for a minimal example and reproduction steps.

In Go 1.21, client TLS certificates are included in session tickets by default. When the client cert chain is very long (or the certificate is otherwise very large), the session ticket grows as well, eventually preventing Windows Schannel clients from being able to connect.

Changing the WrapTicket implementation to return a shorter session ticket (e.g. return []byte{0}, nil) works around the issue.

This bug happens on the current latest version of Windows 11 (22H2, build 22621.2428). It worked fine on Go 1.20 and earlier, but is broken as of Go 1.21.0. It's worth noting that the Golang TLS client is still able to connect.

[dr2chase]

@golang/security

[arn-aud]

Same issue encountered on Apache HTTP Server when used as a mTLS reverse proxy with old versions of OpenSSL (1.0.x and 1.1.1k or older).

[printfn]

I did a bit more testing on this and found that a custom WrapSession implementation that returns a ticket of size 16371 works on Windows, while 16372 bytes or more fail.

For example:

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"math/big"
	"net"
	"net/http"
	"time"
)

func generateCert() ([]tls.Certificate, error) {
	rootKey, err := rsa.GenerateKey(rand.Reader, 4096)
	if err != nil {
		return nil, fmt.Errorf("failed to generate rsa key: %v", err)
	}
	serial, err := rand.Int(rand.Reader, big.NewInt(1<<62))
	if err != nil {
		return nil, fmt.Errorf("failed to generate serial: %v", err)
	}
	rootTemplate := &x509.Certificate{
		SerialNumber: serial,
		NotBefore:    time.Now().Add(-time.Hour),
		NotAfter:     time.Now().Add(time.Hour * 24 * 365 * 10),
		KeyUsage:     x509.KeyUsageContentCommitment | x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
		ExtKeyUsage: []x509.ExtKeyUsage{
			x509.ExtKeyUsageClientAuth,
			x509.ExtKeyUsageServerAuth,
		},
		BasicConstraintsValid: true,
		IPAddresses:           []net.IP{net.IPv4(127, 0, 0, 1)},
	}
	rootDER, err := x509.CreateCertificate(rand.Reader, rootTemplate, rootTemplate, &rootKey.PublicKey, rootKey)
	if err != nil {
		return nil, fmt.Errorf("failed to create certificate: %v", err)
	}
	return []tls.Certificate{
		{
			Certificate: [][]byte{rootDER},
			PrivateKey:  rootKey,
		},
	}, nil
}

func main() {
	tlsCertificates, err := generateCert()
	if err != nil {
		panic(err)
	}
	server := http.Server{
		Addr: "127.0.0.1:8081",
		TLSConfig: &tls.Config{
			Certificates: tlsCertificates,
		},
		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Write([]byte("success"))
		}),
	}
	server.TLSConfig.WrapSession = func(cs tls.ConnectionState, ss *tls.SessionState) ([]byte, error) {
		// it works for <=16371 bytes
		return make([]byte, 16372), nil
	}
	server.TLSConfig.UnwrapSession = func(identity []byte, cs tls.ConnectionState) (*tls.SessionState, error) {
		return nil, fmt.Errorf("UnwrapSession not implemented")
	}
	fmt.Printf("listening...\n")
	server.ListenAndServeTLS("", "")
}

Run this program, then open Microsoft Edge and try loading https://127.0.0.1:8081/.

To fix this issue in Golang, the standard library would need to ensure that session tickets never exceed 16371 bytes.

[seankhliao]

cc @golang/windows