Benjamin Kaduk e776858bce Don't send key_share for PSK-only key exchange ... TLS 1.3 allows for the "psk_ke" and "psk_dhe_ke" key-exchange modes. Only the latter mode introduces a new ephemeral (Diffie-Hellman) key exchange, with the PSK being the only key material used in the former case. It's a compliance requirement of RFC 8446 that the server MUST NOT send a KeyShareEntry when using the "psk_ke" mode, but prior to this commit we would send a key-share based solely on whether the client sent one. This bug goes unnoticed in our internal test suite since openssl communicating with openssl can never negotiate the PSK-only key-exchange mode. However, we should still be compliant with the spec, so check whether the DHE mode was offered and don't send a key-share if it wasn't. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14749)		2021-05-12 09:11:48 -07:00
..
record	Update copyright year	2021-04-22 14:38:44 +01:00
statem	Don't send key_share for PSK-only key exchange	2021-05-12 09:11:48 -07:00
bio_ssl.c
build.info	Drop libimplementations.a	2021-05-07 10:17:23 +02:00
d1_lib.c
d1_msg.c
d1_srtp.c
ktls.c
methods.c
pqueue.c
s3_cbc.c	Remove unused code from the fips module	2021-05-08 20:44:41 +10:00
s3_enc.c
s3_lib.c
s3_msg.c	Avoid sending alerts after shutdown	2021-05-06 17:07:11 +02:00
ssl_asn1.c
ssl_cert_table.h
ssl_cert.c
ssl_ciph.c
ssl_conf.c	Correct ssl_conf logic for "legacy_server_connect"	2021-05-05 08:13:51 -07:00
ssl_err_legacy.c
ssl_err.c	make update	2021-05-12 09:11:48 -07:00
ssl_init.c
ssl_lib.c	Enforce secure renegotiation support by default	2021-05-05 08:13:51 -07:00
ssl_local.h
ssl_mcnf.c
ssl_rsa_legacy.c
ssl_rsa.c
ssl_sess.c
ssl_stat.c
ssl_txt.c
ssl_utst.c
sslerr.h
t1_enc.c
t1_lib.c
t1_trce.c
tls13_enc.c	Add quick one-shot EVP_Q_mac() and deprecation compensation decls for MAC functions	2021-05-08 14:35:03 +02:00
tls_depr.c
tls_srp.c