Allow setting QUIC transport parameters after parsing the client's
Our server code (unfortunately) conditions its transport parameters
based on the client's transport parameters. Instead of using
hs->config->quic_transport_params to check whether QUIC is in use, this
replaces it with ssl->quic_method.
Change-Id: I6817e9f674a70f4568b0c469c96dfdf1c1c91709
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/40224
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
diff --git a/ssl/ssl_test.cc b/ssl/ssl_test.cc
index c838bf4..2293405 100644
--- a/ssl/ssl_test.cc
+++ b/ssl/ssl_test.cc
@@ -5672,6 +5672,55 @@
EXPECT_EQ(SSL_process_quic_post_handshake(client_.get()), 0);
}
+static void ExpectReceivedTransportParamsEqual(const SSL *ssl,
+ Span<const uint8_t> expected) {
+ const uint8_t *received;
+ size_t received_len;
+ SSL_get_peer_quic_transport_params(ssl, &received, &received_len);
+ ASSERT_EQ(received_len, expected.size());
+ EXPECT_EQ(Bytes(received, received_len), Bytes(expected));
+}
+
+TEST_F(QUICMethodTest, SetTransportParameters) {
+ const SSL_QUIC_METHOD quic_method = DefaultQUICMethod();
+ ASSERT_TRUE(SSL_CTX_set_quic_method(client_ctx_.get(), &quic_method));
+ ASSERT_TRUE(SSL_CTX_set_quic_method(server_ctx_.get(), &quic_method));
+
+ ASSERT_TRUE(CreateClientAndServer());
+ uint8_t kClientParams[] = {1, 2, 3, 4};
+ uint8_t kServerParams[] = {5, 6, 7};
+ ASSERT_TRUE(SSL_set_quic_transport_params(client_.get(), kClientParams,
+ sizeof(kClientParams)));
+ ASSERT_TRUE(SSL_set_quic_transport_params(server_.get(), kServerParams,
+ sizeof(kServerParams)));
+
+ ASSERT_TRUE(CompleteHandshakesForQUIC());
+ ExpectReceivedTransportParamsEqual(client_.get(), kServerParams);
+ ExpectReceivedTransportParamsEqual(server_.get(), kClientParams);
+}
+
+TEST_F(QUICMethodTest, SetTransportParamsInCallback) {
+ const SSL_QUIC_METHOD quic_method = DefaultQUICMethod();
+ ASSERT_TRUE(SSL_CTX_set_quic_method(client_ctx_.get(), &quic_method));
+ ASSERT_TRUE(SSL_CTX_set_quic_method(server_ctx_.get(), &quic_method));
+
+ ASSERT_TRUE(CreateClientAndServer());
+ uint8_t kClientParams[] = {1, 2, 3, 4};
+ static uint8_t kServerParams[] = {5, 6, 7};
+ ASSERT_TRUE(SSL_set_quic_transport_params(client_.get(), kClientParams,
+ sizeof(kClientParams)));
+ SSL_CTX_set_tlsext_servername_callback(
+ server_ctx_.get(), [](SSL *ssl, int *out_alert, void *arg) -> int {
+ EXPECT_TRUE(SSL_set_quic_transport_params(ssl, kServerParams,
+ sizeof(kServerParams)));
+ return SSL_TLSEXT_ERR_OK;
+ });
+
+ ASSERT_TRUE(CompleteHandshakesForQUIC());
+ ExpectReceivedTransportParamsEqual(client_.get(), kServerParams);
+ ExpectReceivedTransportParamsEqual(server_.get(), kClientParams);
+}
+
extern "C" {
int BORINGSSL_enum_c_type_test(void);
}
diff --git a/ssl/t1_lib.cc b/ssl/t1_lib.cc
index 5fdfec2..d04c874 100644
--- a/ssl/t1_lib.cc
+++ b/ssl/t1_lib.cc
@@ -2583,14 +2583,10 @@
uint8_t *out_alert,
CBS *contents) {
SSL *const ssl = hs->ssl;
- if (!contents || hs->config->quic_transport_params.empty()) {
+ if (!contents || !ssl->quic_method) {
return true;
}
- // Ignore the extension before TLS 1.3.
- if (ssl_protocol_version(ssl) < TLS1_3_VERSION) {
- return true;
- }
-
+ assert(ssl_protocol_version(ssl) == TLS1_3_VERSION);
return ssl->s3->peer_quic_transport_params.CopyFrom(*contents);
}
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 6026c48..762caff 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -7146,6 +7146,7 @@
// Client sends params
testCases = append(testCases, testCase{
testType: clientTest,
+ protocol: quic,
name: "QUICTransportParams-Client-" + ver.name,
config: Config{
MinVersion: ver.version,
@@ -7163,6 +7164,7 @@
// Server sends params
testCases = append(testCases, testCase{
testType: serverTest,
+ protocol: quic,
name: "QUICTransportParams-Server-" + ver.name,
config: Config{
MinVersion: ver.version,
