kris/boringssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Move key_share extension check with ECDHE code.

Browse Source 
Also fix the error code. It's a missing extension, not an unexpected
one.

Change-Id: I48e48c37e27173f6d7ac5e993779948ead3706f2
Reviewed-on: https://boringssl-review.googlesource.com/12683
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
This commit is contained in:
David Benjamin 2016-12-08 18:21:27 -05:00 committed by CQ bot account: commit-bot@chromium.org
parent f1050fd79a
commit db5bd72152
2 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
ssl/test/runner/runner.go
View File

@ -8966,7 +8966,7 @@ func addTLS13HandshakeTests() {
}, },
resumeSession: true, resumeSession: true,
shouldFail: true, shouldFail: true,
expectedError: ":UNEXPECTED_EXTENSION:", expectedError: ":MISSING_KEY_SHARE:",
}) })
testCases = append(testCases, testCase{ testCases = append(testCases, testCase{
@ -8979,7 +8979,7 @@ func addTLS13HandshakeTests() {
}, },
}, },
shouldFail: true, shouldFail: true,
expectedError: ":UNEXPECTED_EXTENSION:", expectedError: ":MISSING_KEY_SHARE:",
}) })
testCases = append(testCases, testCase{ testCases = append(testCases, testCase{

14
ssl/tls13_client.c
View File

@ -214,13 +214,6 @@ static enum ssl_hs_wait_t do_process_server_hello(SSL_HANDSHAKE *hs) {
return ssl_hs_error; return ssl_hs_error;
} }
/* We only support PSK_DHE_KE. */
if (!have_key_share) {
OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_ILLEGAL_PARAMETER);
return ssl_hs_error;
}
alert = SSL_AD_DECODE_ERROR; alert = SSL_AD_DECODE_ERROR;
if (have_pre_shared_key) { if (have_pre_shared_key) {
if (ssl->session == NULL) { if (ssl->session == NULL) {
@ -289,6 +282,13 @@ static enum ssl_hs_wait_t do_process_server_hello(SSL_HANDSHAKE *hs) {
return ssl_hs_error; return ssl_hs_error;
} }
if (!have_key_share) {
/* We do not support psk_ke and thus always require a key share. */
OPENSSL_PUT_ERROR(SSL, SSL_R_MISSING_KEY_SHARE);
ssl3_send_alert(ssl, SSL3_AL_FATAL, SSL_AD_MISSING_EXTENSION);
return ssl_hs_error;
}
/* Resolve ECDHE and incorporate it into the secret. */ /* Resolve ECDHE and incorporate it into the secret. */
uint8_t *dhe_secret; uint8_t *dhe_secret;
size_t dhe_secret_len; size_t dhe_secret_len;