diff options
| author | Adam Langley <alangley@gmail.com> | 2015-06-02 20:50:35 +0300 |
|---|---|---|
| committer | Adam Langley <agl@google.com> | 2015-06-04 01:05:50 +0300 |
| commit | ba5934b77f0058dc963b075e0ec1f401a24c0b2b (patch) | |
| tree | 4dd68f3f018cffaec9ab135345a9f4c7e10e20c3 /crypto/err | |
| parent | b0eef0aee9a9c52005a7a8421f0d1b2dc9f6b99e (diff) | |
Tighten up EMS resumption behaviour.
The client and server both have to decide on behaviour when resuming a
session where the EMS state of the session doesn't match the EMS state
as exchanged in the handshake.
Original handshake
| No Yes
------+--------------------------------------------------------------
|
R | Server: ok [1] Server: abort [3]
e No | Client: ok [2] Client: abort [4]
s |
u |
m |
e |
Yes | Server: don't resume No problem
| Client: abort; server
| shouldn't have resumed
[1] Servers want to accept legacy clients. The draft[5] says that
resumptions SHOULD be rejected so that Triple-Handshake can't be done,
but we'll rather enforce that EMS was used when using tls-unique etc.
[2] The draft[5] says that even the initial handshake should be aborted
if the server doesn't support EMS, but we need to be able to talk to the
world.
[3] This is a very weird case where a client has regressed without
flushing the session cache. Hopefully we can be strict and reject these.
[4] This can happen when a server-farm shares a session cache but
frontends are not all updated at once. If Chrome is strict here then
hopefully we can prevent any servers from existing that will try to
resume an EMS session that they don't understand. OpenSSL appears to be
ok here: https://www.ietf.org/mail-archive/web/tls/current/msg16570.html
[5] https://tools.ietf.org/html/draft-ietf-tls-session-hash-05#section-5.2
BUG=492200
Change-Id: Ie1225a3960d49117b05eefa5a36263d8e556e467
Reviewed-on: https://boringssl-review.googlesource.com/4981
Reviewed-by: Adam Langley <agl@google.com>
Diffstat (limited to 'crypto/err')
| -rw-r--r-- | crypto/err/ssl.errordata | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/crypto/err/ssl.errordata b/crypto/err/ssl.errordata index 630227b7..4ae0a518 100644 --- a/crypto/err/ssl.errordata +++ b/crypto/err/ssl.errordata @@ -224,6 +224,7 @@ SSL,reason,145,DIGEST_CHECK_FAILED SSL,reason,146,DTLS_MESSAGE_TOO_BIG SSL,reason,147,ECC_CERT_NOT_FOR_SIGNING SSL,reason,148,EMPTY_SRTP_PROTECTION_PROFILE_LIST +SSL,reason,276,EMS_STATE_INCONSISTENT SSL,reason,149,ENCRYPTED_LENGTH_TOO_LONG SSL,reason,150,ERROR_IN_RECEIVED_CIPHER_LIST SSL,reason,151,EVP_DIGESTSIGNFINAL_FAILED @@ -294,6 +295,8 @@ SSL,reason,212,RENEGOTIATE_EXT_TOO_LONG SSL,reason,213,RENEGOTIATION_ENCODING_ERR SSL,reason,214,RENEGOTIATION_MISMATCH SSL,reason,215,REQUIRED_CIPHER_MISSING +SSL,reason,275,RESUMED_EMS_SESSION_WITHOUT_EMS_EXTENSION +SSL,reason,277,RESUMED_NON_EMS_SESSION_WITH_EMS_EXTENSION SSL,reason,216,SCSV_RECEIVED_WHEN_RENEGOTIATING SSL,reason,217,SERVERHELLO_TLSEXT SSL,reason,218,SESSION_ID_CONTEXT_UNINITIALIZED |