tree f73bff8f6234c211b13727b6eed99abf20d67dbd
parent 0226f30467f540a3f62ef48d453f93927da199b6
author Lily Chen <chlily@google.com> 1757453659 -0400
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1757454706 -0700

Require configured groups for key exchange to be unique

There is no reason for the list of supported groups for key exchange to
contain duplicates, because a group is either supported or not, and
specifying it multiple times has no additional effect. Also it is a
syntax error on the wire. Allowing duplicates in the SSL_CTX and
SSL_CONFIG members that track this list would create problems because we
will soon require other inputs (explicitly configured client key shares)
to be a subset of the supported groups. This CL requires the groups
configured via SSL_{,CTX_}set1_{groups,group_ids,groups_list} to be
unique.

Update-Note: The setters for supported groups,
SSL_{,CTX_}set1_{groups,group_ids,groups_list} will now fail if the
provided list of groups contains duplicates.

Change-Id: I67aa3bac811da6239e8f89fe501218a7a60dba11
Bug: 437414371
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/81467
Auto-Submit: Lily Chen <chlily@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Commit-Queue: Lily Chen <chlily@google.com>