Make EnableAllCiphers client-only and rename.
EnableAllCiphers is problematic since some (version, cipher)
combinations aren't even defined and crash. Instead, use the
SendCipherSuite bug to mask the true cipher (which is becomes arbitrary)
for failure tests. The shim should fail long before we get further.
This lets us remove a number of weird checks in the TLS 1.3 code.
This also fixes the UnknownCipher tests which weren't actually testing
anything. EnableAllCiphers is now AdvertiseAllConfiguredCiphers and
does not filter out garbage values.
Change-Id: I7102fa893146bb0d096739e768c5a7aa339e51a8
Reviewed-on: https://boringssl-review.googlesource.com/11481
Reviewed-by: Steven Valdez <svaldez@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go
index c88181e..a09dc27 100644
--- a/ssl/test/runner/handshake_server.go
+++ b/ssl/test/runner/handshake_server.go
@@ -486,12 +486,7 @@
// Resolve PSK and compute the early secret.
var psk []byte
- // The only way for hs.suite to be a PSK suite yet for there to be
- // no sessionState is if config.Bugs.EnableAllCiphers is true and
- // the test runner forced us to negotiated a PSK suite. It doesn't
- // really matter what we do here so long as we continue the
- // handshake and let the client error out.
- if hs.suite.flags&suitePSK != 0 && hs.sessionState != nil {
+ if hs.suite.flags&suitePSK != 0 {
psk = deriveResumptionPSK(hs.suite, hs.sessionState.masterSecret)
hs.finishedHash.setResumptionContext(deriveResumptionContext(hs.suite, hs.sessionState.masterSecret))
} else {
@@ -743,9 +738,7 @@
c.writeRecord(recordTypeHandshake, certVerify.marshal())
} else {
// Pick up certificates from the session instead.
- // hs.sessionState may be nil if config.Bugs.EnableAllCiphers is
- // true.
- if hs.sessionState != nil && len(hs.sessionState.certificates) > 0 {
+ if len(hs.sessionState.certificates) > 0 {
if _, err := hs.processCertsFromClient(hs.sessionState.certificates); err != nil {
return err
}
@@ -1728,25 +1721,23 @@
}
// Don't select a ciphersuite which we can't
// support for this client.
- if !c.config.Bugs.EnableAllCiphers {
- if (candidate.flags&suitePSK != 0) && !pskOk {
- continue
- }
- if (candidate.flags&suiteECDHE != 0) && !ellipticOk {
- continue
- }
- if (candidate.flags&suiteECDSA != 0) != ecdsaOk {
- continue
- }
- if version < VersionTLS12 && candidate.flags&suiteTLS12 != 0 {
- continue
- }
- if version >= VersionTLS13 && candidate.flags&suiteTLS13 == 0 {
- continue
- }
- if c.isDTLS && candidate.flags&suiteNoDTLS != 0 {
- continue
- }
+ if (candidate.flags&suitePSK != 0) && !pskOk {
+ continue
+ }
+ if (candidate.flags&suiteECDHE != 0) && !ellipticOk {
+ continue
+ }
+ if (candidate.flags&suiteECDSA != 0) != ecdsaOk {
+ continue
+ }
+ if version < VersionTLS12 && candidate.flags&suiteTLS12 != 0 {
+ continue
+ }
+ if version >= VersionTLS13 && candidate.flags&suiteTLS13 == 0 {
+ continue
+ }
+ if c.isDTLS && candidate.flags&suiteNoDTLS != 0 {
+ continue
}
return candidate
}