From: Matt Caswell <matt@openssl.org>
Date: Wed, 7 Feb 2018 10:55:02 +0000 (+0000)
Subject: Fix clienthellotest with TLSv1.3
X-Git-Tag: OpenSSL_1_1_1-pre1~36
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=0f41dc0e9e9e6a8c2a43fa6af5fdf5359283e2ba;p=oweals%2Fopenssl.git

Fix clienthellotest with TLSv1.3

If TLSv1.3 is enabled and combined with other options that extend the
size of the ClientHello, then the clienthello test can sometimes fail
because the ClientHello has grown too large. Part of the purpose of the
test is to check that the padding extension works properly. This requires
the ClientHello size to be kept within certain bounds.

By restricting the number of ciphersuites sent we can reduce the size of
the ClientHello.

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5266)
---

diff --git a/test/clienthellotest.c b/test/clienthellotest.c
index 88e0a1c66a..f3e9588e51 100644
--- a/test/clienthellotest.c
+++ b/test/clienthellotest.c
@@ -87,6 +87,15 @@ static int test_client_hello(int currtest)
         break;
 
     case TEST_ADD_PADDING_AND_PSK:
+        /*
+         * In this case we're doing TLSv1.3 and we're sending a PSK so the
+         * ClientHello is already going to be quite long. To avoid getting one
+         * that is too long for this test we use a restricted ciphersuite list
+         */
+        if (!TEST_true(SSL_CTX_set_cipher_list(ctx,
+                                               "TLS13-AES-128-GCM-SHA256")))
+            goto end;
+         /* Fall through */
     case TEST_ADD_PADDING:
     case TEST_PADDING_NOT_NEEDED:
         SSL_CTX_set_options(ctx, SSL_OP_TLSEXT_PADDING);