From 2aad406b1bc2b2070131234269cbcebdd658fccd Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Thu, 14 Jul 2016 23:15:40 -0400 Subject: [PATCH] Switch application traffic keys at the right time in Go TLS 1.3. The server must switch the outgoing keys early so that client certificate alerts are sent with the right keys. (Also so that half-RTT data may be sent.) Change-Id: Id5482c811aa0b747ab646453b3856a83f23d3f06 Reviewed-on: https://boringssl-review.googlesource.com/8791 Reviewed-by: David Benjamin Commit-Queue: David Benjamin CQ-Verified: CQ bot account: commit-bot@chromium.org --- ssl/test/runner/handshake_server.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go index c9081ac6..f6bf0db5 100644 --- a/ssl/test/runner/handshake_server.go +++ b/ssl/test/runner/handshake_server.go @@ -478,6 +478,10 @@ Curves: masterSecret := hs.finishedHash.extractKey(handshakeSecret, hs.finishedHash.zeroSecret()) trafficSecret := hs.finishedHash.deriveSecret(masterSecret, applicationTrafficLabel) + // Switch to application data keys on write. In particular, any alerts + // from the client certificate are sent over these keys. + c.out.updateKeys(deriveTrafficAEAD(c.vers, hs.suite, trafficSecret, applicationPhase, serverWrite), c.vers) + // If we requested a client certificate, then the client must send a // certificate message, even if it's empty. if config.ClientAuth >= RequestClientCert { @@ -548,8 +552,7 @@ Curves: } hs.writeClientHash(clientFinished.marshal()) - // Switch to application data keys. - c.out.updateKeys(deriveTrafficAEAD(c.vers, hs.suite, trafficSecret, applicationPhase, serverWrite), c.vers) + // Switch to application data keys on read. c.in.updateKeys(deriveTrafficAEAD(c.vers, hs.suite, trafficSecret, applicationPhase, clientWrite), c.vers) // TODO(davidben): Derive and save the resumption master secret for receiving tickets.