Don't send back EtM extension if not using CBC
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index c884e7c..6d8626c 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -1721,6 +1721,8 @@
size_t *olen )
{
unsigned char *p = buf;
+ const ssl_ciphersuite_t *suite = NULL;
+ const cipher_info_t *cipher = NULL;
if( ssl->session_negotiate->encrypt_then_mac == SSL_EXTENDED_MS_DISABLED ||
ssl->minor_ver == SSL_MINOR_VERSION_0 )
@@ -1729,6 +1731,21 @@
return;
}
+ /*
+ * RFC 7366: "If a server receives an encrypt-then-MAC request extension
+ * from a client and then selects a stream or Authenticated Encryption
+ * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
+ * encrypt-then-MAC response extension back to the client."
+ */
+ if( ( suite = ssl_ciphersuite_from_id(
+ ssl->session_negotiate->ciphersuite ) ) == NULL ||
+ ( cipher = cipher_info_from_type( suite->cipher ) ) == NULL ||
+ cipher->mode != POLARSSL_MODE_CBC )
+ {
+ *olen = 0;
+ return;
+ }
+
SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
*p++ = (unsigned char)( ( TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );