Mimic more common ServerHellos

- Update vendored github.com/Psiphon-Labs/tls-tris

github.com/Psiphon-Labs/tls-tris commit message:

Mimic more common ServerHellos

- Reorder extensions

- Add ec_points_format extension when ClientHello includes ec_points_format:
  https://github.com/golang/go/commit/02a5502ab8d862309aaec3c5ec293b57b913d01d

vendor/github.com/Psiphon-Labs/tls-tris/handshake_messages.go

@@ -1325,6 +1325,10 @@ type serverHelloMsg struct {
 
 	// RFC7627
 	extendedMSSupported bool
+
+	// [Psiphon]
+	// https://github.com/golang/go/commit/02a5502ab8d862309aaec3c5ec293b57b913d01d
+	supportedPoints []uint8
 }
 
 func (m *serverHelloMsg) equal(i interface{}) bool {
@@ -1359,7 +1363,10 @@ func (m *serverHelloMsg) equal(i interface{}) bool {
 		bytes.Equal(m.keyShare.data, m1.keyShare.data) &&
 		m.psk == m1.psk &&
 		m.pskIdentity == m1.pskIdentity &&
-		m.extendedMSSupported == m1.extendedMSSupported
+		m.extendedMSSupported == m1.extendedMSSupported &&
+
+		// [Psiphon]
+		bytes.Equal(m.supportedPoints, m1.supportedPoints)
 }
 
 func (m *serverHelloMsg) marshal() []byte {
@@ -1422,6 +1429,12 @@ func (m *serverHelloMsg) marshal() []byte {
 		numExtensions++
 	}
 
+	// [Psiphon]
+	if len(m.supportedPoints) > 0 {
+		extensionsLength += 1 + len(m.supportedPoints)
+		numExtensions++
+	}
+
 	if numExtensions > 0 {
 		extensionsLength += 4 * numExtensions
 		length += 2 + extensionsLength
@@ -1454,13 +1467,48 @@ func (m *serverHelloMsg) marshal() []byte {
 		z[1] = byte(extensionsLength)
 		z = z[2:]
 	}
-	if m.vers >= VersionTLS13 {
-		z[0] = byte(extensionSupportedVersions >> 8)
-		z[1] = byte(extensionSupportedVersions)
-		z[3] = 2
-		z[4] = uint8(m.vers >> 8)
-		z[5] = uint8(m.vers)
-		z = z[6:]
+
+	// [Psiphon]
+	// Reorder extensions to match OpenSSL order:
+	// https://github.com/openssl/openssl/blob/2a5385511051d33be8d2b20d7669d8b1862fe510/ssl/statem/extensions.c#L119
+
+	if m.secureRenegotiationSupported {
+		z[0] = byte(extensionRenegotiationInfo >> 8)
+		z[1] = byte(extensionRenegotiationInfo & 0xff)
+		z[2] = 0
+		z[3] = byte(len(m.secureRenegotiation) + 1)
+		z[4] = byte(len(m.secureRenegotiation))
+		z = z[5:]
+		copy(z, m.secureRenegotiation)
+		z = z[len(m.secureRenegotiation):]
+	}
+
+	// [Psiphon]
+	// https://github.com/golang/go/commit/02a5502ab8d862309aaec3c5ec293b57b913d01d
+	if len(m.supportedPoints) > 0 {
+		// http://tools.ietf.org/html/rfc4492#section-5.5.2
+		z[0] = byte(extensionSupportedPoints >> 8)
+		z[1] = byte(extensionSupportedPoints)
+		l := 1 + len(m.supportedPoints)
+		z[2] = byte(l >> 8)
+		z[3] = byte(l)
+		l--
+		z[4] = byte(l)
+		z = z[5:]
+		for _, pointFormat := range m.supportedPoints {
+			z[0] = pointFormat
+			z = z[1:]
+		}
+	}
+	if m.ticketSupported {
+		z[0] = byte(extensionSessionTicket >> 8)
+		z[1] = byte(extensionSessionTicket)
+		z = z[4:]
+	}
+	if m.ocspStapling {
+		z[0] = byte(extensionStatusRequest >> 8)
+		z[1] = byte(extensionStatusRequest)
+		z = z[4:]
 	}
 	if m.nextProtoNeg {
 		z[0] = byte(extensionNextProtoNeg >> 8)
@@ -1479,26 +1527,6 @@ func (m *serverHelloMsg) marshal() []byte {
 			z = z[1+l:]
 		}
 	}
-	if m.ocspStapling {
-		z[0] = byte(extensionStatusRequest >> 8)
-		z[1] = byte(extensionStatusRequest)
-		z = z[4:]
-	}
-	if m.ticketSupported {
-		z[0] = byte(extensionSessionTicket >> 8)
-		z[1] = byte(extensionSessionTicket)
-		z = z[4:]
-	}
-	if m.secureRenegotiationSupported {
-		z[0] = byte(extensionRenegotiationInfo >> 8)
-		z[1] = byte(extensionRenegotiationInfo & 0xff)
-		z[2] = 0
-		z[3] = byte(len(m.secureRenegotiation) + 1)
-		z[4] = byte(len(m.secureRenegotiation))
-		z = z[5:]
-		copy(z, m.secureRenegotiation)
-		z = z[len(m.secureRenegotiation):]
-	}
 	if alpnLen := len(m.alpnProtocol); alpnLen > 0 {
 		z[0] = byte(extensionALPN >> 8)
 		z[1] = byte(extensionALPN & 0xff)
@@ -1530,6 +1558,18 @@ func (m *serverHelloMsg) marshal() []byte {
 			z = z[len(sct)+2:]
 		}
 	}
+	if m.extendedMSSupported {
+		binary.BigEndian.PutUint16(z, extensionEMS)
+		z = z[4:]
+	}
+	if m.vers >= VersionTLS13 {
+		z[0] = byte(extensionSupportedVersions >> 8)
+		z[1] = byte(extensionSupportedVersions)
+		z[3] = 2
+		z[4] = uint8(m.vers >> 8)
+		z[5] = uint8(m.vers)
+		z = z[6:]
+	}
 	if m.keyShare.group != 0 {
 		z[0] = uint8(extensionKeyShare >> 8)
 		z[1] = uint8(extensionKeyShare)
@@ -1553,10 +1593,6 @@ func (m *serverHelloMsg) marshal() []byte {
 		z[5] = byte(m.pskIdentity)
 		z = z[6:]
 	}
-	if m.extendedMSSupported {
-		binary.BigEndian.PutUint16(z, extensionEMS)
-		z = z[4:]
-	}
 
 	m.raw = x
 
@@ -1595,6 +1631,9 @@ func (m *serverHelloMsg) unmarshal(data []byte) alert {
 	m.pskIdentity = 0
 	m.extendedMSSupported = false
 
+	// [Psiphon]
+	m.supportedPoints = nil
+
 	if len(data) == 0 {
 		// ServerHello is optionally followed by extension data
 		return alertSuccess
@@ -1737,6 +1776,19 @@ func (m *serverHelloMsg) unmarshal(data []byte) alert {
 			m.pskIdentity = uint16(data[0])<<8 | uint16(data[1])
 		case extensionEMS:
 			m.extendedMSSupported = true
+
+		// [Psiphon]
+		case extensionSupportedPoints:
+			// http://tools.ietf.org/html/rfc4492#section-5.5.2
+			if length < 1 {
+				return alertDecodeError
+			}
+			l := int(data[0])
+			if length != l+1 {
+				return alertDecodeError
+			}
+			m.supportedPoints = make([]uint8, l)
+			copy(m.supportedPoints, data[1:])
 		}
 		data = data[length:]
 	}

vendor/github.com/Psiphon-Labs/tls-tris/handshake_server.go

@@ -211,6 +211,9 @@ Curves:
 		}
 	}
 
+	// [Psiphon]
+	hasSupportedPoints := false
+
 	// If present, the supported points extension must include uncompressed.
 	// Can be absent. This behavior mirrors BoringSSL.
 	if hs.clientHello.supportedPoints != nil {
@@ -225,6 +228,7 @@ Curves:
 			c.sendAlert(alertHandshakeFailure)
 			return false, errors.New("tls: client does not support uncompressed points")
 		}
+		hasSupportedPoints = true
 	}
 
 	foundCompression := false
@@ -274,6 +278,17 @@ Curves:
 		}
 	}
 
+	// [Psiphon]
+	// https://github.com/golang/go/commit/02a5502ab8d862309aaec3c5ec293b57b913d01d
+	if hasSupportedPoints && c.vers < VersionTLS13 {
+		// Although omitting the ec_point_formats extension is permitted, some
+		// old OpenSSL versions will refuse to handshake if not present.
+		//
+		// Per RFC 4492, section 5.1.2, implementations MUST support the
+		// uncompressed point format. See golang.org/issue/31943.
+		hs.hello.supportedPoints = []uint8{pointFormatUncompressed}
+	}
+
 	if len(hs.clientHello.serverName) > 0 {
 		c.serverName = hs.clientHello.serverName
 	}

vendor/vendor.json

@@ -63,10 +63,10 @@
 			"revisionTime": "2019-12-04T18:36:04Z"
 		},
 		{
-			"checksumSHA1": "GkQMbmKt3ls0vmJ33GdcxOqikXA=",
+			"checksumSHA1": "+lsQUKG+zIU9IxrQf5pJBSRE79Q=",
 			"path": "github.com/Psiphon-Labs/tls-tris",
-			"revision": "e98b032bc3ced03cc324827b86c8bb3802401d3d",
-			"revisionTime": "2019-12-05T15:29:33Z"
+			"revision": "78f52e6d62437fc594a15aafbd8c583d5eb48d46",
+			"revisionTime": "2019-12-06T19:09:01Z"
 		},
 		{
 			"checksumSHA1": "30PBqj9BW03KCVqASvLg3bR+xYc=",