mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: disable ExportKeyingMaterial without EMS

Browse source 
Fixes #43922

Change-Id: Idaad7daa6784807ae3a5e4d944e88e13d01fd0b2
Reviewed-on: https://go-review.googlesource.com/c/go/+/544155
Reviewed-by: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
Filippo Valsorda 2023-11-21 16:37:07 +01:00 • committed by Gopher Robot
parent ae820c6a3c
commit 2dbfad5cbe
3 changed files with 27 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

13
conn.go
View file

@ -15,6 +15,7 @@ import (
"errors"
"fmt"
"hash"
"internal/godebug"
"io"
"net"
"sync"
@ -1599,6 +1600,8 @@ func (c *Conn) ConnectionState() ConnectionState {
return c.connectionStateLocked()
}
var ekmgodebug = godebug.New("tlsunsafeekm")
func (c *Conn) connectionStateLocked() ConnectionState {
var state ConnectionState
state.HandshakeComplete = c.isHandshakeComplete.Load()
@ -1620,7 +1623,15 @@ func (c *Conn) connectionStateLocked() ConnectionState {
}
}
if c.config.Renegotiation != RenegotiateNever {
state.ekm = noExportedKeyingMaterial
state.ekm = noEKMBecauseRenegotiation
} else if c.vers != VersionTLS13 && !c.extMasterSecret {
state.ekm = func(label string, context []byte, length int) ([]byte, error) {
if ekmgodebug.Value() == "1" {
ekmgodebug.IncNonDefault()
return c.ekm(label, context, length)
}
return noEKMBecauseNoEMS(label, context, length)
}
} else {
state.ekm = c.ekm
}