From 7ebe61a5855e95d2228c1245b02087dcdec9194a Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Fri, 10 Feb 2017 13:14:01 -0500 Subject: [PATCH] Fix server-side KeyUpdates. We sized the post-handshake message limit for the older zero-length KeyUpdate and forgot to update it when it got larger. Thanks to Matt Caswell for catching this. Change-Id: I7d2189479e9516fbfb6c195dfa367794d383582c Reviewed-on: https://boringssl-review.googlesource.com/13805 Reviewed-by: Steven Valdez Reviewed-by: David Benjamin Commit-Queue: David Benjamin CQ-Verified: CQ bot account: commit-bot@chromium.org --- ssl/s3_both.c | 2 +- ssl/test/runner/runner.go | 11 ++++++++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/ssl/s3_both.c b/ssl/s3_both.c index 324e9f98..d3f9421b 100644 --- a/ssl/s3_both.c +++ b/ssl/s3_both.c @@ -496,7 +496,7 @@ size_t ssl_max_handshake_message_len(const SSL *ssl) { if (ssl->server) { /* The largest acceptable post-handshake message for a server is a * KeyUpdate. We will never initiate post-handshake auth. */ - return 0; + return 1; } /* Clients must accept NewSessionTicket and CertificateRequest, so allow the diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go index 336aa31f..d6e984a0 100644 --- a/ssl/test/runner/runner.go +++ b/ssl/test/runner/runner.go @@ -2290,7 +2290,16 @@ func addBasicTests() { expectedError: ":WRONG_VERSION_NUMBER:", }, { - name: "KeyUpdate", + name: "KeyUpdate-Client", + config: Config{ + MaxVersion: VersionTLS13, + }, + sendKeyUpdates: 1, + keyUpdateRequest: keyUpdateNotRequested, + }, + { + testType: serverTest, + name: "KeyUpdate-Server", config: Config{ MaxVersion: VersionTLS13, },