Allow CECPQ1 cipher suites to do False Start.
Since they include an ECDHE exchange in them, they are equally-well
suited to False Start.
Change-Id: I75d31493a614a78ccbf337574c359271831d654d
Reviewed-on: https://boringssl-review.googlesource.com/8732
Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 19fdf1c..e0cba62 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -2528,7 +2528,8 @@
SSL_version(ssl) == TLS1_2_VERSION &&
(ssl->s3->alpn_selected || ssl->s3->next_proto_neg_seen) &&
cipher != NULL &&
- cipher->algorithm_mkey == SSL_kECDHE &&
+ (cipher->algorithm_mkey == SSL_kECDHE ||
+ cipher->algorithm_mkey == SSL_kCECPQ1) &&
cipher->algorithm_mac == SSL_AEAD;
}
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 01f8a46..60127da 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -3231,6 +3231,25 @@
shimWritesFirst: true,
})
+ tests = append(tests, testCase{
+ name: "FalseStart-CECPQ1",
+ config: Config{
+ MaxVersion: VersionTLS12,
+ CipherSuites: []uint16{TLS_CECPQ1_RSA_WITH_AES_256_GCM_SHA384},
+ NextProtos: []string{"foo"},
+ Bugs: ProtocolBugs{
+ ExpectFalseStart: true,
+ },
+ },
+ flags: []string{
+ "-false-start",
+ "-cipher", "DEFAULT:kCECPQ1",
+ "-select-next-proto", "foo",
+ },
+ shimWritesFirst: true,
+ resumeSession: true,
+ })
+
// Server parses a V2ClientHello.
tests = append(tests, testCase{
testType: serverTest,
