diff options
| author | David Benjamin <davidben@google.com> | 2016-07-15 06:15:40 +0300 |
|---|---|---|
| committer | CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> | 2016-07-15 14:10:01 +0300 |
| commit | 2aad406b1bc2b2070131234269cbcebdd658fccd (patch) | |
| tree | 4676b04e09500db9343285724c5f3e246e90eddf | |
| parent | 90bf7104dec7b12ae6a5621c3ee508f75fca6976 (diff) | |
Switch application traffic keys at the right time in Go TLS 1.3.
The server must switch the outgoing keys early so that client
certificate alerts are sent with the right keys. (Also so that half-RTT
data may be sent.)
Change-Id: Id5482c811aa0b747ab646453b3856a83f23d3f06
Reviewed-on: https://boringssl-review.googlesource.com/8791
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
| -rw-r--r-- | ssl/test/runner/handshake_server.go | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go index c9081ac6..f6bf0db5 100644 --- a/ssl/test/runner/handshake_server.go +++ b/ssl/test/runner/handshake_server.go @@ -478,6 +478,10 @@ Curves: masterSecret := hs.finishedHash.extractKey(handshakeSecret, hs.finishedHash.zeroSecret()) trafficSecret := hs.finishedHash.deriveSecret(masterSecret, applicationTrafficLabel) + // Switch to application data keys on write. In particular, any alerts + // from the client certificate are sent over these keys. + c.out.updateKeys(deriveTrafficAEAD(c.vers, hs.suite, trafficSecret, applicationPhase, serverWrite), c.vers) + // If we requested a client certificate, then the client must send a // certificate message, even if it's empty. if config.ClientAuth >= RequestClientCert { @@ -548,8 +552,7 @@ Curves: } hs.writeClientHash(clientFinished.marshal()) - // Switch to application data keys. - c.out.updateKeys(deriveTrafficAEAD(c.vers, hs.suite, trafficSecret, applicationPhase, serverWrite), c.vers) + // Switch to application data keys on read. c.in.updateKeys(deriveTrafficAEAD(c.vers, hs.suite, trafficSecret, applicationPhase, clientWrite), c.vers) // TODO(davidben): Derive and save the resumption master secret for receiving tickets. |