testing

Author: johubertj

tls/extensions/s2n_server_key_share.c

@@ -262,6 +262,7 @@ static int s2n_server_key_share_recv_pq(struct s2n_connection *conn,
 {
     POSIX_ENSURE_REF(conn);
     POSIX_ENSURE_REF(extension);
+    POSIX_ENSURE(s2n_pq_is_enabled, S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
 
     struct s2n_kem_group_params *server_params = &conn->kex_params.server_kem_group_params;
     struct s2n_kem_group_params *client_params = &conn->kex_params.client_kem_group_params;
@@ -287,6 +288,8 @@ static int s2n_server_key_share_recv_pq(struct s2n_connection *conn,
         POSIX_GUARD(s2n_connection_get_kem_preferences(conn, &kem_pref));
         POSIX_ENSURE_REF(kem_pref);
 
+        POSIX_ENSURE(sn_kem_preferences_includes_tls13_kem_group(kem_pref, named_group_iana), S2N_ERR_ECDHE_UNSUPPORTED_CURVE);
+
         for (size_t i = 0; i < kem_pref->tls13_kem_group_count; i++) {
             if (named_group_iana == kem_pref->tls13_kem_groups[i]->iana_id
                     && s2n_kem_group_is_available(kem_pref->tls13_kem_groups[i])) {