commit c3648faaa732dcc111c92f778c831ca7bf91d4b4
author David Benjamin <davidben@google.com> Sat Jul 01 10:50:56 2017 -0400
committer David Benjamin <davidben@google.com> Wed Jul 05 23:50:41 2017 +0000
tree 7500b1c0a2fb8b0898746287dac8e6ec2ee4a152
parent 364af784070a89a44a017778cbf4f8f215e78c07

Add tests for SSL_VERIFY_PEER_IF_NO_OBC and fix TLS 1.3.

Also mirror the structure of the TLS 1.2 and TLS 1.3 code a bit.

Change-Id: I7b34bf30de63fa0bd47a39a90570846fb2314ad5
Reviewed-on: https://boringssl-review.googlesource.com/17539
Reviewed-by: David Benjamin <davidben@google.com>

ssl/tls13_server.c

diff --git a/ssl/tls13_server.c b/ssl/tls13_server.c
index 0a5e1a2..fe2463b 100644
--- a/ssl/tls13_server.c
+++ b/ssl/tls13_server.c
@@ -537,11 +537,14 @@
     goto err;
   }
 
-  /* Determine whether to request a client certificate. */
-  hs->cert_request = !!(ssl->verify_mode & SSL_VERIFY_PEER);
-  /* CertificateRequest may only be sent in non-resumption handshakes. */
-  if (ssl->s3->session_reused) {
-    hs->cert_request = 0;
+  if (!ssl->s3->session_reused) {
+    /* Determine whether to request a client certificate. */
+    hs->cert_request = !!(ssl->verify_mode & SSL_VERIFY_PEER);
+    /* Only request a certificate if Channel ID isn't negotiated. */
+    if ((ssl->verify_mode & SSL_VERIFY_PEER_IF_NO_OBC) &&
+        ssl->s3->tlsext_channel_id_valid) {
+      hs->cert_request = 0;
+    }
   }
 
   /* Send a CertificateRequest, if necessary. */