Fail immediately if we have no key shares to send#28283
Fail immediately if we have no key shares to send#28283mattcaswell wants to merge 3 commits intoopenssl:masterfrom
Conversation
If we are configured in such a way that we have no valid key shares to send in the ClientHello we should immediately abort the connection. Fixes openssl#28281
mattcaswell
added
branch: master
|
I think key share is TLS 1.3 only. Are there no possibilities to negotiate TLS 1.2 with what is configured? |
paulidale
added
approval: done
It is.
If the client additionally set a max protocol version of TLSv1.2 to suppress the attempt to send a key share, then a connection could be achieved (and this PR would not prevent that). But attempting to send an empty key share makes no sense to me (this is not something we've ever supported). |
|
I assume the server not supporting TLS 1.3 would also make it work. |
|
But I'm fine with giving an error |
Indeed. But of course we cannot know what the server will do from the client side. So we really should not create a ClientHello with a key share extension that we are not prepared to work with if the server does select TLSv1.3 |
|
24 hours has passed since 'approval: done' was set, but as this PR has been updated in that time the label 'approval: ready to merge' is not being automatically set. Please review the updates and set the label manually. |
mattcaswell
added
approval: ready to merge
|
Pushed to master/3.5. Thanks for the reviews. |
If we are configured in such a way that we have no valid key shares to send in the ClientHello we should immediately abort the connection. Fixes #28281 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from #28283) (cherry picked from commit 47b0f17)
Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from #28283) (cherry picked from commit 9226b3e)
If we are configured in such a way that we have no valid key shares to send in the ClientHello we should immediately abort the connection. Fixes #28281 Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from #28283)
Reviewed-by: Neil Horman <[email protected]> Reviewed-by: Hugo Landau <[email protected]> Reviewed-by: Paul Dale <[email protected]> (Merged from #28283)
6 participants
If we are configured in such a way that we have no valid key shares to
send in the ClientHello we should immediately abort the connection.
Fixes #28281