Prevent both early data and custom extensions from being accepted.
This loosens the earlier restriction to match Channel ID. Both may be
configured and offered, but the server is obligated to select only one
of them. This aligns with the current tokbind + 0-RTT draft where the
combination is signaled by a separate extension.
Bug: 183
Change-Id: I786102a679999705d399f0091f76da236be091c2
Reviewed-on: https://boringssl-review.googlesource.com/19124
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: Steven Valdez <svaldez@google.com>
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 7e64fe5..2ae697c 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -8980,22 +8980,6 @@
flags: []string{flag},
})
- // 0-RTT is not currently supported with Custom Extensions.
- testCases = append(testCases, testCase{
- testType: testType,
- name: "CustomExtensions-" + suffix + "-EarlyData",
- config: Config{
- MaxVersion: VersionTLS13,
- Bugs: ProtocolBugs{
- CustomExtension: expectedContents,
- ExpectedCustomExtension: &expectedContents,
- },
- },
- shouldFail: true,
- expectedError: ":CUSTOM_EXTENSION_ERROR:",
- flags: []string{flag, "-enable-early-data"},
- })
-
// If the parse callback fails, the handshake should also fail.
testCases = append(testCases, testCase{
testType: testType,
@@ -9090,6 +9074,121 @@
})
}
+ // If the client sends both early data and custom extension, the handshake
+ // should succeed as long as both the extensions aren't returned by the
+ // server.
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "CustomExtensions-Client-EarlyData-None",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ ExpectedCustomExtension: &expectedContents,
+ AlwaysRejectEarlyData: true,
+ },
+ },
+ resumeSession: true,
+ flags: []string{
+ "-enable-client-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ "-expect-reject-early-data",
+ },
+ })
+
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "CustomExtensions-Client-EarlyData-EarlyDataAccepted",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ ExpectedCustomExtension: &expectedContents,
+ },
+ },
+ resumeSession: true,
+ flags: []string{
+ "-enable-client-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ "-expect-accept-early-data",
+ },
+ })
+
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "CustomExtensions-Client-EarlyData-CustomExtensionAccepted",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ AlwaysRejectEarlyData: true,
+ CustomExtension: expectedContents,
+ ExpectedCustomExtension: &expectedContents,
+ },
+ },
+ resumeSession: true,
+ flags: []string{
+ "-enable-client-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ "-expect-reject-early-data",
+ },
+ })
+
+ testCases = append(testCases, testCase{
+ testType: clientTest,
+ name: "CustomExtensions-Client-EarlyDataAndCustomExtensions",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ CustomExtension: expectedContents,
+ ExpectedCustomExtension: &expectedContents,
+ },
+ },
+ resumeConfig: &Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ CustomExtension: expectedContents,
+ ExpectedCustomExtension: &expectedContents,
+ SendEarlyDataExtension: true,
+ },
+ },
+ resumeSession: true,
+ shouldFail: true,
+ expectedError: ":UNEXPECTED_EXTENSION_ON_EARLY_DATA:",
+ flags: []string{
+ "-enable-client-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ },
+ })
+
+ // If the server receives both early data and custom extension, only the
+ // custom extension should be accepted.
+ testCases = append(testCases, testCase{
+ testType: serverTest,
+ name: "CustomExtensions-Server-EarlyDataAccepted",
+ config: Config{
+ MaxVersion: VersionTLS13,
+ MaxEarlyDataSize: 16384,
+ Bugs: ProtocolBugs{
+ CustomExtension: expectedContents,
+ ExpectedCustomExtension: &expectedContents,
+ ExpectEarlyDataAccepted: false,
+ },
+ },
+ resumeSession: true,
+ flags: []string{
+ "-enable-server-custom-extension",
+ "-enable-early-data",
+ "-expect-early-data-info",
+ },
+ })
+
// The custom extension add callback should not be called if the client
// doesn't send the extension.
testCases = append(testCases, testCase{
@@ -11661,7 +11760,7 @@
resumeSession: true,
expectChannelID: true,
shouldFail: true,
- expectedError: ":CHANNEL_ID_ON_EARLY_DATA:",
+ expectedError: ":UNEXPECTED_EXTENSION_ON_EARLY_DATA:",
flags: []string{
"-enable-early-data",
"-expect-early-data-info",