diff options
| author | Daniel McCarney <daniel@binaryparadox.net> | 2025-02-26 14:13:15 -0500 |
|---|---|---|
| committer | Daniel McCarney <daniel@binaryparadox.net> | 2025-03-10 14:20:33 -0700 |
| commit | 4635ad047a426f43a4b70cd11ce52b062d0da34f (patch) | |
| tree | 72e4d4633608f85c28cfb4b1e7fda38df4069bc6 /src/crypto/tls/bogo_config.json | |
| parent | 5b4209fedb10086e845cabdb02d2990a6090841b (diff) | |
| download | go-4635ad047a426f43a4b70cd11ce52b062d0da34f.tar.xz | |
crypto/tls: align cert decode alert w/ BSSL
For malformed client/server certificates in a TLS handshake send
a decode_error alert, matching BoringSSL behaviour.
Previously crypto/tls used a bad_certificate alert for this purpose.
The TLS specification is imprecise enough to allow this to be considered
a spec. justified choice, but since all other places in the protocol
encourage using decode_error for structurally malformed messages we may
as well do the same here and get some extra cross-impl consistency for
free.
This also allows un-ignoring the BoGo
GarbageCertificate-[Client|Server]-[TLS12|TLS13] tests.
Updates #72006
Change-Id: Ide45ba1602816e71c3289a60e77587266c3b9036
Reviewed-on: https://go-review.googlesource.com/c/go/+/652995
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Diffstat (limited to 'src/crypto/tls/bogo_config.json')
| -rw-r--r-- | src/crypto/tls/bogo_config.json | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/src/crypto/tls/bogo_config.json b/src/crypto/tls/bogo_config.json index 1521594034..6a9a6dfcc5 100644 --- a/src/crypto/tls/bogo_config.json +++ b/src/crypto/tls/bogo_config.json @@ -54,7 +54,6 @@ "KyberKeyShareIncludedSecond": "we always send the Kyber key share first", "KyberKeyShareIncludedThird": "we always send the Kyber key share first", "GREASE-Server-TLS13": "We don't send GREASE extensions", - "GarbageCertificate*": "TODO ask davidben, alertDecode vs alertBadCertificate", "SendBogusAlertType": "sending wrong alert type", "EchoTLS13CompatibilitySessionID": "TODO reject compat session ID", "*Client-P-224*": "no P-224 support", |