Update for draft -22 and client support #2
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Required for test case RSA-PSS-Default-Sign which is currently the only test that fails with tls-tris.
Tested with the initial tls-tris client support branch which includes
basic RSASSA-PSS support. Coverage changed from ... to ...:
0/3509/3692/3692/4136
0/2784/3195/3195/4136
See cloudflare/tls-tris#46, current implementations may send one byte too much since they do not include the content type in the calculation.
The spec only says that the "opaque_type" field is always set to 23 (application_data), but that is not a MUST check. cloudflare/tls-tris#47
Problem was in the TLS 1.3 client implementation of tls-tris, fixed in: "crypto/tls: prevent handshake messages crossing key boundaries"
Fixed in tls-tris: "crypto/tls: accept 2^14+1 TLSInnerPlaintext"
Normally this environment variable is not set, but when it is, it allows inspection of the IPC with Wireshark.
PSS test is disabled because its implementation is not accepted yet (https://go-review.googlesource.com/c/go/+/79738). Do not check for UnknownUnencryptedExtension-Client-TLS13, the client currently does not check for extensions that it did not advertise.
This test checks for a handshake failure when the server sends supported_versions, but draft 22 will start using this extension. Do not bother checking for it.
Current bogo tests for draft18, patch that to use draft22. Patch from https://boringssl-review.googlesource.com/c/boringssl/+/23704/2 Upstream commit e1068b76bd1d7f6ea06c90faa523ad8d562ec11b ("Test RSA premaster unpad better.") added another version-specific test, disable that since no protection is implemented.
FiloSottile
approved these changes
Dec 16, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Main changes:
This branch is used by the current master branch in tris.