mirrors/utls
1
0
Fork 0
mirror of https://github.com/refraction-networking/utls.git synced 2025-04-03 20:17:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: enforce ALPN overlap when negotiated on both sides

Browse source 
During the TLS handshake if the server doesn't support any of the
application protocols requested by the client, send the
no_application_protocol alert and abort the handshake on the server
side. This enforces the requirements of RFC 7301.

Change-Id: Iced2bb5c6efc607497de1c40ee3de9c2b393fa5d
Reviewed-on: https://go-review.googlesource.com/c/go/+/289209
Trust: Roland Shoemaker <roland@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
Roland Shoemaker 2021-02-02 12:58:30 -08:00
parent 9c1e414b7a
commit 7d3285645e
9 changed files with 295 additions and 179 deletions
Download patch file Download diff file Expand all files Collapse all files

20
handshake_server_test.go
View file

@ -920,13 +920,27 @@ func TestHandshakeServerALPNNoMatch(t *testing.T) {
name: "ALPN-NoMatch",
// Note that this needs OpenSSL 1.0.2 because that is the first
// version that supports the -alpn flag.
command: []string{"openssl", "s_client", "-alpn", "proto2,proto1", "-cipher", "ECDHE-RSA-CHACHA20-POLY1305", "-ciphersuites", "TLS_CHACHA20_POLY1305_SHA256"},
config: config,
expectHandshakeErrorIncluding: "client requested unsupported application protocol",
}
runServerTestTLS12(t, test)
runServerTestTLS13(t, test)
}
func TestHandshakeServerALPNNotConfigured(t *testing.T) {
config := testConfig.Clone()
config.NextProtos = nil
test := &serverTest{
name: "ALPN-NotConfigured",
// Note that this needs OpenSSL 1.0.2 because that is the first
// version that supports the -alpn flag.
command: []string{"openssl", "s_client", "-alpn", "proto2,proto1", "-cipher", "ECDHE-RSA-CHACHA20-POLY1305", "-ciphersuites", "TLS_CHACHA20_POLY1305_SHA256"},
config: config,
validate: func(state ConnectionState) error {
// Rather than reject the connection, Go doesn't select
// a protocol when there is no overlap.
if state.NegotiatedProtocol != "" {
return fmt.Errorf("Got protocol %q, wanted ''", state.NegotiatedProtocol)
return fmt.Errorf("Got protocol %q, wanted nothing", state.NegotiatedProtocol)
}
return nil
},