search

quictls / openssl

TLS/SSL and crypto library with QUIC APIs
https://quictls.github.io/openssl
Apache License 2.0
371 stars 50 forks source link

quictls server should treat reception of a non-empty legacy_session_id in ClientHello as error #29

Closed tatsuhiro-t closed 2 years ago

tatsuhiro-t commented 3 years ago

It looks like quictls server accepts non-empty legacy_session_id in ClientHello. Meanwhile, https://tools.ietf.org/html/draft-ietf-quic-tls-34#section-8.4 says that:

A server SHOULD treat the receipt of a TLS ClientHello with a non-empty legacy_session_id field as a connection error of type PROTOCOL_VIOLATION.

Here is how boringssl handle this: https://github.com/google/boringssl/blob/7a1986c463548627b83ed58d9f9db65bddbce6a5/ssl/tls13_server.cc#L198

tmshort commented 3 years ago

Feel free to make a PR!