Ech hello retry request #6805
Open
Ech hello retry request #6805
+673
−440
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dgarske
previously approved these changes
Sep 25, 2023
|
AArch64 test failed, possibly from network hiccup? Retest this please Jenkins |
|
Looks like CI is flagging a valgrind test. Please also rebase onto master rather than merge in, seems like github has issues when merging in the master branch as seen here with lots of extra commits showing. |
jpbland1
force-pushed
the
ech-hello-retry
branch
from
10be95d to
73a6424
Compare
to an hrr, fix bad getSize for hrr ech, fix using the wrong transcript hash for hrr ech, add new hrr test for ech to api.c
blows away the ech and it's current hpke context, causing the hrr handling to fail
allocated if an hrr happened
which are not restarted and the inner hsHashes which are restared on HRR. also send empty string with 0 encLen when sending clientHelloInner2. setup works wolfssl->wolfssl but fails to match acceptance for first HRR message when talking to an openssl server, does still work without HRR when talking to cloudflare's server without HRR.
the unmodified hrr and sh in the digest
jpbland1
force-pushed
the
ech-hello-retry
branch
from
0ed604c to
36c89cc
Compare
|
@jpbland1 please resolve merge conflicts. |
jpbland1
assigned JacobBarthelmeh and SparkiDev and unassigned dgarske and JacobBarthelmeh
SparkiDev
requested changes
Mar 10, 2025
| @@ -8435,6 +8435,13 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl) | |||
| } | |||
| FreeSuites(ssl); | |||
| FreeHandshakeHashes(ssl); | |||
| #ifdef HAVE_ECH | |||
| /* try to free the ech hashes in case we errored out */ | |||
| ssl->hsHashes = ssl->hsHashesEch; | |||
There was a problem hiding this comment.
Assigning to be freed seems silly.
Make a function that takes a HsHashes* and frees it.
Either name it FreeHanshakeHashes and change callers or have FreeHanshakeHashes call the new function.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Refactor Hpke to allow multiple uses of a context instead of just one shot mode. Refactor ECH to handle hello retry request with a different ech acceptance scheme and to re-use the hpke context after a hello retry request when sending the second client hello
Fixes #6802
Testing
Tested the regular ECH through unit tests, need to figure out how to trigger an HRR
Checklist