You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Running 'make test' after commit 496980f fails with a server-side handshake_failure in unit test 26.b.
This appears to be caused by filtering of the sha256 MACs in HandshakeSettings.validate() for pre-TLS 1.2 versions, which results in the server lacking any valid ciphersuites (hence no shared ciphersuites with client, hence handshake_failure). I suspect Fault.ignoreVersionForCipher is supposed to prevent this, but it only inhibits calls to CipherSuite.filterForVersion which was where filtering occurred previously.
I decided against submitting a pull request because I'm not sure what the preferred solution would be; three that come to mind are either to add fault injection to the HandshakeSettings object, to skip validation altogether if a fault has been injected, or to revert the filtering in validate() since it appears (at first glance) to be redundant.
The text was updated successfully, but these errors were encountered:
FiachAntaw
changed the title
Commit 496980f breaks unit test 26.b
Commit 496980f breaks test 26.b
Aug 13, 2015
Running 'make test' after commit 496980f fails with a server-side handshake_failure in unit test 26.b.
This appears to be caused by filtering of the sha256 MACs in
HandshakeSettings.validate()
for pre-TLS 1.2 versions, which results in the server lacking any valid ciphersuites (hence no shared ciphersuites with client, hence handshake_failure). I suspectFault.ignoreVersionForCipher
is supposed to prevent this, but it only inhibits calls toCipherSuite.filterForVersion
which was where filtering occurred previously.I decided against submitting a pull request because I'm not sure what the preferred solution would be; three that come to mind are either to add fault injection to the HandshakeSettings object, to skip validation altogether if a fault has been injected, or to revert the filtering in validate() since it appears (at first glance) to be redundant.
The text was updated successfully, but these errors were encountered: