Reject the ECH extension in TLS 1.2 ServerHello.
The ECH server extension is defined for TLS 1.3 EncryptedExtensions, not
TLS 1.2 ServerHello.
Bug: 275
Change-Id: Ie6e76c238075d70e6a0694ec0192df07da3457d1
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/47910
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/ssl/t1_lib.cc b/ssl/t1_lib.cc
index 44c96e8..3553276 100644
--- a/ssl/t1_lib.cc
+++ b/ssl/t1_lib.cc
@@ -688,10 +688,19 @@
static bool ext_ech_parse_serverhello(SSL_HANDSHAKE *hs, uint8_t *out_alert,
CBS *contents) {
+ SSL *const ssl = hs->ssl;
if (contents == NULL) {
return true;
}
+ // The ECH extension may not be sent in TLS 1.2 ServerHello, only TLS 1.3
+ // EncryptedExtension.
+ if (ssl_protocol_version(ssl) < TLS1_3_VERSION) {
+ *out_alert = SSL_AD_UNSUPPORTED_EXTENSION;
+ OPENSSL_PUT_ERROR(SSL, SSL_R_UNEXPECTED_EXTENSION);
+ return false;
+ }
+
// If the client only sent GREASE, we must check the extension syntactically.
CBS ech_configs;
if (!CBS_get_u16_length_prefixed(contents, &ech_configs) ||
