Check the second ClientHello's PSK binder on resumption.
We perform all our negotiation based on the first ClientHello (for
consistency with what |select_certificate_cb| observed), which is in the
transcript, so we can ignore most of the second one.
However, we ought to check the second PSK binder. That covers the client
key share, which we do consume. In particular, we'll want to check if it
we ever send half-RTT data on these connections (we do not currently do
this). It is also a tricky computation, so we enforce the peer handled
it correctly.
Tested that both Chrome and Firefox continue to interop with this check,
when configuring uncommon curve preferences that trigger HRR. (Normally
neither browser sees HRRs against BoringSSL servers.)
Update-Note: This does enforce some client behavior that we hadn't been
enforcing previously. However, it only figures into TLS 1.3 (not many
implementations yet), and only clients which hit HelloRetryRequest
(rare), so this should be low risk.
Change-Id: I42126585ec0685d009542094192e674cbd22520d
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/37124
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
diff --git a/ssl/internal.h b/ssl/internal.h
index b355c7f..580cf6e 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -596,9 +596,11 @@
// is released.
bool UpdateForHelloRetryRequest();
- // CopyHashContext copies the hash context into |ctx| and returns true on
- // success.
- bool CopyHashContext(EVP_MD_CTX *ctx);
+ // CopyToHashContext initializes |ctx| with |digest| and the data thus far in
+ // the transcript. It returns true on success and false on failure. If the
+ // handshake buffer is still present, |digest| may be any supported digest.
+ // Otherwise, |digest| must match the transcript hash.
+ bool CopyToHashContext(EVP_MD_CTX *ctx, const EVP_MD *digest);
Span<const uint8_t> buffer() {
return MakeConstSpan(reinterpret_cast<const uint8_t *>(buffer_->data),
@@ -1309,7 +1311,7 @@
// tls13_write_psk_binder calculates the PSK binder value and replaces the last
// bytes of |msg| with the resulting value. It returns true on success, and
// false on failure.
-bool tls13_write_psk_binder(SSL_HANDSHAKE *hs, uint8_t *msg, size_t len);
+bool tls13_write_psk_binder(SSL_HANDSHAKE *hs, Span<uint8_t> msg);
// tls13_verify_psk_binder verifies that the handshake transcript, truncated up
// to the binders has a valid signature using the value of |session|'s
@@ -1738,7 +1740,8 @@
CBS *contents);
bool ssl_ext_pre_shared_key_parse_clienthello(
SSL_HANDSHAKE *hs, CBS *out_ticket, CBS *out_binders,
- uint32_t *out_obfuscated_ticket_age, uint8_t *out_alert, CBS *contents);
+ uint32_t *out_obfuscated_ticket_age, uint8_t *out_alert,
+ const SSL_CLIENT_HELLO *client_hello, CBS *contents);
bool ssl_ext_pre_shared_key_add_serverhello(SSL_HANDSHAKE *hs, CBB *out);
// ssl_is_sct_list_valid does a shallow parse of the SCT list in |contents| and
