Skip to content

Commit 15e1392

Browse files
author
Watson Ladd
committed
Update to draft-ietf-tls-subcerts-03
1 parent 9a54ca1 commit 15e1392

File tree

3 files changed

+64
-101
lines changed

3 files changed

+64
-101
lines changed

‎handshake_client.go‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -445,9 +445,6 @@ func (hs *clientHandshakeState) processDelegatedCredentialFromServer(serialized
445445
} else if !v {
446446
c.sendAlert(alertIllegalParameter)
447447
return errors.New("delegated credential: signature invalid")
448-
} else if dc.cred.expectedVersion != hs.c.vers {
449-
c.sendAlert(alertIllegalParameter)
450-
return errors.New("delegated credential: protocol version mismatch")
451448
} else if dc.cred.expectedCertVerifyAlgorithm != scheme {
452449
c.sendAlert(alertIllegalParameter)
453450
return errors.New("delegated credential: signature scheme mismatch")

‎subcerts.go‎

Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
package tls
66

77
// Delegated credentials for TLS
8-
// (https://tools.ietf.org/html/draft-ietf-tls-subcerts-02) is an IETF Internet
8+
// (https://tools.ietf.org/html/draft-ietf-tls-subcerts-03) is an IETF Internet
99
// draft and proposed TLS extension. This allows a backend server to delegate
1010
// TLS termination to a trusted frontend. If the client supports this extension,
1111
// then the frontend may use a "delegated credential" as the signing key in the
@@ -14,7 +14,7 @@ package tls
1414
// revoked; in order to mitigate risk in case the frontend is compromised, the
1515
// credential is only valid for a short time (days, hours, or even minutes).
1616
//
17-
// This implements draft 02. This draft doesn't specify an object identifier for
17+
// This implements draft 03. This draft doesn't specify an object identifier for
1818
// the X.509 extension; we use one assigned by Cloudflare. In addition, IANA has
1919
// not assigned an extension ID for this extension; we picked up one that's not
2020
// yet taken.
@@ -43,6 +43,8 @@ const (
4343
dcMaxTTL = time.Duration(dcMaxTTLSeconds * time.Second)
4444
dcMaxPublicKeyLen = 1 << 24 // Bytes
4545
dcMaxSignatureLen = 1 << 16 // Bytes
46+
//Length of the header
47+
paramsLen = 6
4648
)
4749

4850
var errNoDelegationUsage = errors.New("certificate not authorized for delegation")
@@ -87,9 +89,6 @@ type credential struct {
8789
// The signature scheme associated with the delegated credential public key.
8890
expectedCertVerifyAlgorithm SignatureScheme
8991

90-
// The version of TLS in which the credential will be used.
91-
expectedVersion uint16
92-
9392
// The credential public key.
9493
publicKey crypto.PublicKey
9594
}
@@ -131,16 +130,10 @@ func (cred *credential) marshalSubjectPublicKeyInfo() ([]byte, error) {
131130
// marshal encodes a credential in the wire format specified in
132131
// https://tools.ietf.org/html/draft-ietf-tls-subcerts-02.
133132
func (cred *credential) marshal() ([]byte, error) {
134-
// The number of bytes comprising the DC parameters, which includes the
135-
// validity time (4 bytes), the signature scheme of the public key (2 bytes), and
136-
// the protocol version (2 bytes).
137-
paramsLen := 8
138-
139-
// The first 4 bytes are the valid_time, scheme, and version fields.
133+
// The first 4 bytes are the valid_time and scheme fields
140134
serialized := make([]byte, paramsLen+dcPubKeyFieldLen)
141135
binary.BigEndian.PutUint32(serialized, uint32(cred.validTime/time.Second))
142136
binary.BigEndian.PutUint16(serialized[4:], uint16(cred.expectedCertVerifyAlgorithm))
143-
binary.BigEndian.PutUint16(serialized[6:], cred.expectedVersion)
144137

145138
// Encode the public key and assert that the encoding is no longer than 2^16
146139
// bytes (per the spec).
@@ -164,17 +157,13 @@ func (cred *credential) marshal() ([]byte, error) {
164157

165158
// unmarshalCredential decodes a credential and returns it.
166159
func unmarshalCredential(serialized []byte) (*credential, error) {
167-
// The number of bytes comprising the DC parameters.
168-
paramsLen := 8
169-
170160
if len(serialized) < paramsLen+dcPubKeyFieldLen {
171161
return nil, errors.New("credential is too short")
172162
}
173163

174164
// Parse the valid_time, scheme, and version fields.
175165
validTime := time.Duration(binary.BigEndian.Uint32(serialized)) * time.Second
176166
scheme := SignatureScheme(binary.BigEndian.Uint16(serialized[4:]))
177-
version := binary.BigEndian.Uint16(serialized[6:])
178167

179168
// Parse the SubjectPublicKeyInfo.
180169
pk, err := x509.ParsePKIXPublicKey(serialized[paramsLen+dcPubKeyFieldLen:])
@@ -190,7 +179,6 @@ func unmarshalCredential(serialized []byte) (*credential, error) {
190179
raw: serialized,
191180
validTime: validTime,
192181
expectedCertVerifyAlgorithm: scheme,
193-
expectedVersion: version,
194182
publicKey: pk,
195183
}, nil
196184
}
@@ -199,11 +187,10 @@ func unmarshalCredential(serialized []byte) (*credential, error) {
199187
// credential that starts at the beginning of the input slice. It returns an
200188
// error if the input is too short to contain a credential.
201189
func getCredentialLen(serialized []byte) (int, error) {
202-
paramsLen := 8
203190
if len(serialized) < paramsLen+dcPubKeyFieldLen {
204191
return 0, errors.New("credential is too short")
205192
}
206-
// First several bytes are the valid_time, scheme, and version fields.
193+
// First several bytes are the valid_time and scheme fields
207194
serialized = serialized[paramsLen:]
208195

209196
// The next 3 bytes are the length of the serialized public key, which may

‎subcerts_test.go‎

Lines changed: 58 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -17,27 +17,25 @@ import (
1717

1818
// A PEM-encoded "delegation certificate", an X.509 certificate with the
1919
// DelegationUsage extension. The extension is defined in
20-
// specified in https://tools.ietf.org/html/draft-ietf-tls-subcerts-02.
20+
// specified in https://tools.ietf.org/html/draft-ietf-tls-subcerts-03.
2121
const DcCertWithDelegationUsage = `-----BEGIN CERTIFICATE-----
22-
MIIBejCCASGgAwIBAgIQXXtl0v50W2OadoW0QwLUlzAKBggqhkjOPQQDAjAUMRIw
23-
EAYDVQQKEwlBY21lIEluYy4wHhcNMTgwNzMwMjAxMTE5WhcNMTgwODA2MjAxMTE5
22+
MIIBejCCASGgAwIBAgIQFPrGWi6iIFqO9Vm/7VKk6jAKBggqhkjOPQQDAjAUMRIw
23+
EAYDVQQKEwlBY21lIEluYy4wHhcNMTkwODE0MjMwNzEyWhcNMTkwODIxMjMwNzEy
2424
WjAUMRIwEAYDVQQKEwlBY21lIEluYy4wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
25-
AATcQuuaUNJ3kqKGs4DBdJVd7zWzyGANT4uBNGVkZ2cgaDsdFnx99fGibfgoWer8
26-
HLt9Z+S6Hs+8bDPBHNgTR/Lfo1UwUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAww
25+
AASbTU38xZke+7nv0mnFKGSDa4EBkNkTiwig4RgPjlzLVSSJJQna0jhqAju7eeS/
26+
FCegeunOC9RBeeFHcbK3SMOEo1UwUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAww
2727
CgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADAPBgNVHREECDAGhwR/AAABMA0GCSsG
28-
AQQBgtpLLAQAMAoGCCqGSM49BAMCA0cAMEQCIEMdIkwwmzQAJ6RSDT3wcrsySx2B
29-
5Lvx5HGzc43Fgu9eAiAi4sFXnizFBVUL43qXZBq4ARw17o0JW3/7eec1xttQhw==
30-
-----END CERTIFICATE-----
31-
`
28+
AQQBgtpLLAQAMAoGCCqGSM49BAMCA0cAMEQCIGSkHJFqDL/uFchUJV++4SGKxxAf
29+
t1gmce6yX6kKYg+ZAiAGLDwy1tImngiY3OBVpjL49vGfsYJ7vpRkPmApuL55qQ==
30+
-----END CERTIFICATE-----`
3231

3332
// The PEM-encoded "delegation key", the secret key associated with the
3433
// delegation certificate. This is a key for ECDSA with P256 and SHA256.
3534
const DcKeyWithDelegationUsage = `-----BEGIN EC PRIVATE KEY-----
36-
MHcCAQEEIAS/pGktmxK1hlt3gF4N2nkMrJnoZihvOO63nnNcxXQroAoGCCqGSM49
37-
AwEHoUQDQgAE3ELrmlDSd5KihrOAwXSVXe81s8hgDU+LgTRlZGdnIGg7HRZ8ffXx
38-
om34KFnq/By7fWfkuh7PvGwzwRzYE0fy3w==
39-
-----END EC PRIVATE KEY-----
40-
`
35+
MHcCAQEEIMKB8JN8diRY5LTAfPxaLbdfV2SacUIq9TE110dPwXgjoAoGCCqGSM49
36+
AwEHoUQDQgAEm01N/MWZHvu579JpxShkg2uBAZDZE4sIoOEYD45cy1UkiSUJ2tI4
37+
agI7u3nkvxQnoHrpzgvUQXnhR3Gyt0jDhA==
38+
-----END EC PRIVATE KEY-----`
4139

4240
// A certificate without the DelegationUsage extension.
4341
const DcCertWithoutDelegationUsage = `-----BEGIN CERTIFICATE-----
@@ -71,51 +69,50 @@ type dcTestDC struct {
7169

7270
// Use with maxVersion == VersionTLS13.
7371
const DcTestDataTLS13PEM = `-----BEGIN DC TEST DATA-----
74-
MIIIQzCCAUMTCXRsczEzcDI1NgICAwQCAgQDBIGyAAk6gAQDAwQAAFswWTATBgcq
75-
hkjOPQIBBggqhkjOPQMBBwNCAAQpQtUm8AWOzCN+aGUVsoKH9lZWNqkQCBGhpVtT
76-
u3ye6ACcwgNf81AYQ1ROb3EbWrnbvq9ap4a5QJ8AcrhZ9u0dBAMASDBGAiEA7LHb
77-
Fh+RDi9RTRjlP0+b2eP+4CDtuK0qKSjf4kFbJ9ICIQDB/XIXkLV6qLW70MhFWCUi
78-
2eqyhwtvTuMyATEJnyHKvwR5MHcCAQEEILHC94EWZnuVJqrbq3U+BnEU8BQPGfk6
79-
pkB7mD8wqhl/oAoGCCqGSM49AwEHoUQDQgAEKULVJvAFjswjfmhlFbKCh/ZWVjap
80-
EAgRoaVbU7t8nugAnMIDX/NQGENUTm9xG1q5276vWqeGuUCfAHK4WfbtHTCCAesT
81-
CXRsczEzcDUyMQICAwQCAgYDBIHzAAk6gAYDAwQAAJ4wgZswEAYHKoZIzj0CAQYF
82-
K4EEACMDgYYABAHgWg5NSn/t/BBxU9uWVBwIz3NWfq2xo1eQMsJY1ui9ILtmFsLn
83-
QF1jbGrjlBZoh2sbHPFPl7yMOSYyVBFryhTaiQG7x11/Xs9fNC6AUm/6wROLMHTr
84-
qCkiqCjIKVtBaM8FCAfPLoJHzPUu/h79Q0IdBlVhl4nEa4cWVW34cECfT+YdjgQD
85-
AEYwRAIge+tF+cai/jfZtzUaVTcVuZfdIcGpRy4CfI2tKLipDCQCIAVigOh2jOFh
86-
QWbX4h4Vz3ULoIuM+3wsFad0S0oH1v9HBIHfMIHcAgEBBEIAzNpPpiTsrv+0a3oA
87-
CaGGr83/2Z632tygYjEOs919YrLR1Xe83hf5AvJLUz6u3RRlQdqwyPGQ1wm8baQ6
88-
E0Pf6j+gBwYFK4EEACOhgYkDgYYABAHgWg5NSn/t/BBxU9uWVBwIz3NWfq2xo1eQ
89-
MsJY1ui9ILtmFsLnQF1jbGrjlBZoh2sbHPFPl7yMOSYyVBFryhTaiQG7x11/Xs9f
90-
NC6AUm/6wROLMHTrqCkiqCjIKVtBaM8FCAfPLoJHzPUu/h79Q0IdBlVhl4nEa4cW
91-
VW34cECfT+YdjjCCAUITB2JhZHZlcnMCAwD/AAICBAMEgbIACTqABAP/AAAAWzBZ
92-
MBMGByqGSM49AgEGCCqGSM49AwEHA0IABCPo5FSmarRgC/15bymE+3s4TXyQH9Oh
93-
nlcKbAR70jqWLr9jbyjT7dy09sr5B6cVlw8AU2TeojdRUNG7y4nKnLsEAwBIMEYC
94-
IQDZiMm7SoNMMvvrlxOF0OMSt1/hMOras702RDI2wvT92gIhAKgCmYucgBUIqMJd
95-
d6g2FcY9UZnPzvnSuX9uBm38RMLMBHkwdwIBAQQgnx2Os1Z5kbZo61ItkpwJ0khL
96-
7zgzLcc1X4unR3R56q+gCgYIKoZIzj0DAQehRANCAAQj6ORUpmq0YAv9eW8phPt7
97-
OE18kB/ToZ5XCmwEe9I6li6/Y28o0+3ctPbK+QenFZcPAFNk3qI3UVDRu8uJypy7
98-
MIIBPxMGYmFka2V5AgIDBAICBAMEgbEACTqABAMDBAAAWzBZMBMGByqGSM49AgEG
99-
CCqGSM49AwEHA0IABGGXD4Td3D7im9y0S1wGoFgL4afAiklkSlQcNus2XfGUJS4c
100-
io+gm4NBMcXby6LpN4lg5/0+K0i448WrIdd2eBYEAwBHMEUCIBMirxmjL9Yeigpl
101-
aeqHncrT4V2u+sYBqa+dUUCXDTaqAiEAuR2geInXmNRtGWVltZh1pnohvwloPVvu
102-
XK5qUb9g6/gEeTB3AgEBBCDk7f6Fto9m6vEDYiZapi2Hm8ranfS0AOgfnDfsRQa5
103-
PKAKBggqhkjOPQMBB6FEA0IABFmA7YsXewnCF0R5eHLBwn4RsF1F5IwB8ZLpL2v4
104-
GBD6YHmZDPBZ2/SZ3LxLGgT5yiO1/5y2ujDXsQ9X78ucHn8wggE+EwZiYWRzaWcC
105-
AgMEAgIEAwSBsAAJOoAEAwMEAABbMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
106-
W2eqjqibupKlU/BwVWwfNE1qUdxqhF3cen0aKl8in24PcEi3AH1Y/zubsjoKah/q
107-
YUfcmgAvhvsSFqohWzMa5gQDAEYwRAIgT4Tm7648J1OuTrn+HAJXVfzoXbcL/QUx
108-
YxVDcpxytkoCIDulABj6w3EoQLoq8b1V781oPHKkUR7+L/SUPj/DxKQ2BHkwdwIB
109-
AQQgIAwscB81XCsAujU+tr75y7yMFfSLtFkPAzn3/GiXpoWgCgYIKoZIzj0DAQeh
110-
RANCAARbZ6qOqJu6kqVT8HBVbB80TWpR3GqEXdx6fRoqXyKfbg9wSLcAfVj/O5uy
111-
OgpqH+phR9yaAC+G+xIWqiFbMxrmMIIBPhMFdGxzMTICAgMDAgIEAwSBsQAJOoAE
112-
AwMDAABbMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnsChIIFXdvdOTFnf3cyv
113-
MsHKpSy68X+SbepvhPg+MBrn+ly9mb+hWPp2j0UJKiXwQmMf4vicNOYyjreml8Hf
114-
VQQDAEcwRQIhANfDJ57MDLZqtye+uolguWx39vhfkvB9svEjYZwWTcoKAiALBgkH
115-
OoRxcalH9qbE2p6LHLszqYyYW312aTHHYF0/6QR5MHcCAQEEILFX1gHwKwJwAQI+
116-
GNisTdlwN0clslAccLogW0ON0gAZoAoGCCqGSM49AwEHoUQDQgAEnsChIIFXdvdO
117-
TFnf3cyvMsHKpSy68X+SbepvhPg+MBrn+ly9mb+hWPp2j0UJKiXwQmMf4vicNOYy
118-
jreml8HfVQ==
72+
MIIIMjCCAT4TCXRsczEzcDI1NgIBAAICBAMEga4ACTqABAMAAFswWTATBgcqhkjO
73+
PQIBBggqhkjOPQMBBwNCAARoIvU3S5yHjyybBI2IveIiVBc3e54A8ZH+1jqY8Hb/
74+
WNb2F14sma98hV1vAkER5fyHo0wGXEXnHhHOPr94JMmjBAMARjBEAiAYIMKdvZLv
75+
OeAcvrC4HNh2sF6os0epRddYs5Au9Ns8/gIgD37mV05uZZQEFFNY/HTiXIHr3bVo
76+
2o6W7of/S8auImEEeTB3AgEBBCAdJKnmTy0uJ94OfqqwiP8SK+txtLTzfZXDzRZq
77+
xqIDQKAKBggqhkjOPQMBB6FEA0IABGgi9TdLnIePLJsEjYi94iJUFzd7ngDxkf7W
78+
Opjwdv9Y1vYXXiyZr3yFXW8CQRHl/IejTAZcReceEc4+v3gkyaMwggHqEwl0bHMx
79+
M3A1MjECAQACAgYDBIHzAAk6gAYDAACeMIGbMBAGByqGSM49AgEGBSuBBAAjA4GG
80+
AAQBUOERJaEuXuo1PuTjD8UYRB1ejFPA23nHeQ0pKoeSP1BNyqvr6wkmdn4ExQv4
81+
X+1mFTLs7HUDO4gBH30emIV7d/kBNWESc3v9OL1PC8Sjr+kI5nbGyzsbql6t0bJW
82+
lVdmeiYjmnXPU30yug75TOIRvsyNqgic2DRldo9KRm3V+L3mQ/EEAwBIMEYCIQCO
83+
t69tMQQpTDiaZ+NI1vB16XTvmhrpL1I/GYncXVbwbgIhAIrcyzVfEn/EN2HurO0d
84+
vv27lqr8RKMU59kbeiuZpXMEBIHfMIHcAgEBBEIBXgdFPTMiEMpvLnlzCtHti+D3
85+
PAhcu06SVXzjhbx/ZqXf5JLQr+Enr6MoDOu9MvFwgZmzddmdM8VhLBPaezw5qyag
86+
BwYFK4EEACOhgYkDgYYABAFQ4REloS5e6jU+5OMPxRhEHV6MU8Dbecd5DSkqh5I/
87+
UE3Kq+vrCSZ2fgTFC/hf7WYVMuzsdQM7iAEffR6YhXt3+QE1YRJze/04vU8LxKOv
88+
6QjmdsbLOxuqXq3RslaVV2Z6JiOadc9TfTK6DvlM4hG+zI2qCJzYNGV2j0pGbdX4
89+
veZD8TCCAT4TB2JhZHZlcnMCAQACAgQDBIGwAAk6gAQDAABbMFkwEwYHKoZIzj0C
90+
AQYIKoZIzj0DAQcDQgAEkf+UUjbXeJnxu2ydPpWr+Q7G18Vm4+UGAb/iXISByuvr
91+
t5gF4xvQ4Oh9Y8mBmxOK/F4vMZi6WahhpiUrDtE1VgQDAEgwRgIhALFuPFW/+PvT
92+
YvdvvneblPHvVsTdFbvpta5HGU5K0P9bAiEA0U7isCfu/hC2Ol5YTLNbLqWTRdyY
93+
jaNSNaY3KzpnrvsEeTB3AgEBBCBQyoD/xEDEpoOOn71qi3mnCuo2cb0tNNahmNMv
94+
SDBe46AKBggqhkjOPQMBB6FEA0IABJH/lFI213iZ8btsnT6Vq/kOxtfFZuPlBgG/
95+
4lyEgcrr67eYBeMb0ODofWPJgZsTivxeLzGYulmoYaYlKw7RNVYwggE9EwZiYWRr
96+
ZXkCAQACAgQDBIGwAAk6gAQDAABbMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE
97+
Sxw+G0UjzK6KaLbP0+G25MTIn0yc+48vI9dE2lCXHGSnZPthBbaPt9TyH3Y82+At
98+
CvzLcabtk+GJEiRVwX+AZgQDAEgwRgIhAJhD7B0xXdDEQ0b0RA+Zm1y6AvhomDfQ
99+
aa7a7B6/XOuvAiEAopsDD/183Oc88JXP4mHi4i+BrmQw8k2iKYwvXXMHo80EeTB3
100+
AgEBBCBMkEkhni0WJwg5a1CoMkNt9cfjR48kb+k6D7nR+gM72KAKBggqhkjOPQMB
101+
B6FEA0IABBIb8g9OzrBF1uPhyqUkCPepBitUhoYRhwkYNGjo5VgpUciaY+okj677
102+
86gAq2cublqJGNY/BoLT7J+oaAyWDgkwggE9EwZiYWRzaWcCAQACAgQDBIGwAAk6
103+
gAQDAABbMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgNRJcPmQs9cT5IseZgSc
104+
JBiIOfIXXQITt5PmhudqZGN3zdU7/XEnDLrMeyqGxO68gz5rc6HzJ2EuvmZY3/Y0
105+
8QQDAEgwRgIhAIEwLj/Hgcyjd/Rdh3Q3Xx7EIGw59+++5IrPhh49yN2vAiEA+H0Z
106+
2sEeaOXnDtZFvbWtaHB+Qus0w/ETcqCnDV9Um1gEeTB3AgEBBCBapn38CKpxVbsM
107+
+PewO0WzuHboEEpyHJUqB2TVP0H05aAKBggqhkjOPQMBB6FEA0IABIDUSXD5kLPX
108+
E+SLHmYEnCQYiDnyF10CE7eT5obnamRjd83VO/1xJwy6zHsqhsTuvIM+a3Oh8ydh
109+
Lr5mWN/2NPEwggE6EwV0bHMxMgIBAAICBAMEga4ACTqABAMAAFswWTATBgcqhkjO
110+
PQIBBggqhkjOPQMBBwNCAAS75oEKssSWOjZ0/PNuC8nYaDrLrCSDSyXR88EB/wc9
111+
vYu+TEjl5+j0Fl04QzK50ybs1myAVBE6JyLvq9GNzbgUBAMARjBEAiBXEyWnP3in
112+
It75z3OHr5j/N2JkolwgEf9KGnAjb0os7QIgbTzb38tVNCGaDMTA5rn4qKoiL3aq
113+
RWI+Gc1oc7Tt6ywEeTB3AgEBBCDDvm3rZqSrm9Pe/85Xrbt+Qg+oKo9S51H9L4yO
114+
7wDp+qAKBggqhkjOPQMBB6FEA0IABLvmgQqyxJY6NnT8824LydhoOsusJINLJdHz
115+
wQH/Bz29i75MSOXn6PQWXThDMrnTJuzWbIBUETonIu+r0Y3NuBQ=
119116
-----END DC TEST DATA-----`
120117

121118
// Parses the input PEM block containing the test DCs.
@@ -131,29 +128,12 @@ func dcLoadTestData(in []byte, out *[]dcTestDC) error {
131128
return errors.New("failed to unmarshal DC test ASN.1 data")
132129
}
133130

134-
// Check that the test data is for the right version. This should be
135-
// maxVersion, defined in common.go.
131+
// Check we can parse the DCs
136132
for _, test := range *out {
137-
dc, err := unmarshalDelegatedCredential(test.DC)
133+
_, err := unmarshalDelegatedCredential(test.DC)
138134
if err != nil {
139135
return err
140136
}
141-
142-
// Sanity check that test version matches the version encoded by the DC.
143-
testVersion := uint16(test.Version)
144-
if dc.cred.expectedVersion != testVersion {
145-
return fmt.Errorf(
146-
"test version doesn't match credential version: got: 0x0%04x; want: 0x%04x",
147-
testVersion, dc.cred.expectedVersion)
148-
}
149-
150-
// With the exception of "badvers" and "tsl12", all test DCs should have
151-
// the expected verison.
152-
if test.Name != "badvers" && test.Name != "tls12" && testVersion != maxVersion {
153-
return fmt.Errorf(
154-
"encountered test with wrong version: got: 0x0%04x; want: 0x%04x",
155-
test.Version, maxVersion)
156-
}
157137
}
158138
return nil
159139
}
@@ -310,7 +290,6 @@ var dcTesters = []struct {
310290
{true, true, false, VersionTLS13, VersionTLS13, 0, "badkey", false, false, "bad key"},
311291
{true, true, true, VersionTLS13, VersionTLS13, 0, "badsig", true, true, "bad key, skip verify"},
312292
{true, true, false, VersionTLS13, VersionTLS13, dcMaxTTL, "tls13", false, false, "expired dc"},
313-
{true, true, false, VersionTLS13, VersionTLS13, 0, "badvers", false, false, "dc wrong version"},
314293
{true, true, false, VersionTLS12, VersionTLS12, 0, "tls12", true, false, "tls12"},
315294
}
316295

0 commit comments

Comments
 (0)