diff options
| author | Matt Caswell <matt@openssl.org> | 2017-11-14 15:14:51 +0000 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2017-11-21 17:46:22 +0000 |
| commit | 281bf2332caa33184ad611f4f96b3f7fd44d1d29 (patch) | |
| tree | 2932e81c9cfd0769f0f056e785e9e6b306863664 /test | |
| parent | 3b5873567d24bf0d8bc2a175848e716e295d6c94 (diff) | |
If a server is not acknowledging SNI then don't reject early_data
SNI needs to be consistent before we accept early_data. However a
server may choose to not acknowledge SNI. In that case we have to
expect that a client may send it anyway. We change the consistency
checks so that not acknowledging is treated more a like a "wild card",
accepting any SNI as being consistent.
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
(Merged from https://github.com/openssl/openssl/pull/4738)
Diffstat (limited to 'test')
| -rw-r--r-- | test/sslapitest.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/test/sslapitest.c b/test/sslapitest.c index 706f277589..5ba5f6e202 100644 --- a/test/sslapitest.c +++ b/test/sslapitest.c @@ -1961,13 +1961,11 @@ static int test_early_data_not_sent(int idx) return testresult; } -static const char *servhostname; - static int hostname_cb(SSL *s, int *al, void *arg) { const char *hostname = SSL_get_servername(s, TLSEXT_NAMETYPE_host_name); - if (hostname != NULL && strcmp(hostname, servhostname) == 0) + if (hostname != NULL && strcmp(hostname, "goodhost") == 0) return SSL_TLSEXT_ERR_OK; return SSL_TLSEXT_ERR_NOACK; @@ -2024,7 +2022,6 @@ static int test_early_data_psk(int idx) &serverssl, &sess, 2))) goto end; - servhostname = "goodhost"; servalpn = "goodalpn"; /* @@ -2069,7 +2066,11 @@ static int test_early_data_psk(int idx) * Set inconsistent SNI (server detected). In this case the connection * will succeed but reject early_data. */ - servhostname = "badhost"; + SSL_SESSION_free(serverpsk); + serverpsk = SSL_SESSION_dup(clientpsk); + if (!TEST_ptr(serverpsk) + || !TEST_true(SSL_SESSION_set1_hostname(serverpsk, "badhost"))) + goto end; edstatus = SSL_EARLY_DATA_REJECTED; readearlyres = SSL_READ_EARLY_DATA_FINISH; /* Fall through */ |