kris/th5
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tris: tolerate NSS sending obfuscated_ticket_age as seconds

Browse Source
This commit is contained in:
Filippo Valsorda 2016-12-05 17:41:00 -05:00 committed by Peter Wu
parent faefac5f1a
commit 1bc19494f8
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
13.go
View File

@ -437,7 +437,11 @@ func (hs *serverHandshakeState) checkPSK() (earlySecret []byte, ok bool) {
clientAge := time.Duration(hs.clientHello.psks[i].obfTicketAge-s.ageAdd) * time.Millisecond clientAge := time.Duration(hs.clientHello.psks[i].obfTicketAge-s.ageAdd) * time.Millisecond
serverAge := time.Since(time.Unix(int64(s.createdAt), 0)) serverAge := time.Since(time.Unix(int64(s.createdAt), 0))
if clientAge-serverAge > ticketAgeSkewAllowance || clientAge-serverAge < -ticketAgeSkewAllowance { if clientAge-serverAge > ticketAgeSkewAllowance || clientAge-serverAge < -ticketAgeSkewAllowance {
continue // XXX: NSS is off spec and sends obfuscated_ticket_age as seconds
clientAge = time.Duration(hs.clientHello.psks[i].obfTicketAge-s.ageAdd) * time.Second
if clientAge-serverAge > ticketAgeSkewAllowance || clientAge-serverAge < -ticketAgeSkewAllowance {
continue
}
} }
// This enforces the stricter 0-RTT requirements on all ticket uses. // This enforces the stricter 0-RTT requirements on all ticket uses.