mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-21 01:15:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Implement server side of PSK extension construction

Browse Source 
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)
This commit is contained in:
Matt Caswell 2017-01-18 17:22:18 +00:00
parent 1053a6e228
commit 0247086d9a
6 changed files with 32 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/openssl/ssl.h
View File

@ -2315,6 +2315,7 @@ int ERR_load_SSL_strings(void);
# define SSL_F_TLS_CONSTRUCT_STOC_KEY_EXCHANGE 377 # define SSL_F_TLS_CONSTRUCT_STOC_KEY_EXCHANGE 377
# define SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE 456 # define SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE 456
# define SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG 457 # define SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG 457
# define SSL_F_TLS_CONSTRUCT_STOC_PSK 504
# define SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE 458 # define SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE 458
# define SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME 459 # define SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME 459
# define SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET 460 # define SSL_F_TLS_CONSTRUCT_STOC_SESSION_TICKET 460

3
ssl/s3_lib.c
View File

@ -4113,6 +4113,9 @@ int ssl_derive(SSL *s, EVP_PKEY *privkey, EVP_PKEY *pubkey, int gensecret)
rv = tls13_generate_secret(s, ssl_handshake_md(s), NULL, NULL, rv = tls13_generate_secret(s, ssl_handshake_md(s), NULL, NULL,
0, 0,
(unsigned char *)&s->early_secret); (unsigned char *)&s->early_secret);
else
rv = 1;
rv = rv && tls13_generate_handshake_secret(s, pms, pmslen); rv = rv && tls13_generate_handshake_secret(s, pms, pmslen);
} else { } else {
/* Generate master secret and discard premaster */ /* Generate master secret and discard premaster */

1
ssl/ssl_err.c
View File

@ -355,6 +355,7 @@ static ERR_STRING_DATA SSL_str_functs[] = {
"tls_construct_stoc_key_share"}, "tls_construct_stoc_key_share"},
{ERR_FUNC(SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG), {ERR_FUNC(SSL_F_TLS_CONSTRUCT_STOC_NEXT_PROTO_NEG),
"tls_construct_stoc_next_proto_neg"}, "tls_construct_stoc_next_proto_neg"},
{ERR_FUNC(SSL_F_TLS_CONSTRUCT_STOC_PSK), "tls_construct_stoc_psk"},
{ERR_FUNC(SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE), {ERR_FUNC(SSL_F_TLS_CONSTRUCT_STOC_RENEGOTIATE),
"tls_construct_stoc_renegotiate"}, "tls_construct_stoc_renegotiate"},
{ERR_FUNC(SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME), {ERR_FUNC(SSL_F_TLS_CONSTRUCT_STOC_SERVER_NAME),

2
ssl/statem/extensions.c
View File

@ -279,7 +279,7 @@ static const EXTENSION_DEFINITION ext_defs[] = {
TLSEXT_TYPE_psk, TLSEXT_TYPE_psk,
EXT_CLIENT_HELLO | EXT_TLS1_3_SERVER_HELLO | EXT_TLS_IMPLEMENTATION_ONLY EXT_CLIENT_HELLO | EXT_TLS1_3_SERVER_HELLO | EXT_TLS_IMPLEMENTATION_ONLY
| EXT_TLS1_3_ONLY, | EXT_TLS1_3_ONLY,
NULL, tls_parse_ctos_psk, tls_parse_stoc_psk, NULL, NULL, tls_parse_ctos_psk, tls_parse_stoc_psk, tls_construct_stoc_psk,
tls_construct_ctos_psk, NULL tls_construct_ctos_psk, NULL
} }
}; };

29
ssl/statem/extensions_srvr.c
View File

@ -1006,12 +1006,14 @@ int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
size_t encoded_pt_len = 0; size_t encoded_pt_len = 0;
EVP_PKEY *ckey = s->s3->peer_tmp, *skey = NULL; EVP_PKEY *ckey = s->s3->peer_tmp, *skey = NULL;
if (s->hit)
return 1;
if (ckey == NULL) { if (ckey == NULL) {
SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR); /* No key_share received from client, must be resuming. */
return 0; if (!s->hit || !tls13_generate_handshake_secret(s, NULL, 0)) {
*al = SSL_AD_INTERNAL_ERROR;
SSLerr(SSL_F_TLS_CONSTRUCT_STOC_KEY_SHARE, ERR_R_INTERNAL_ERROR);
return 0;
}
return 1;
} }
if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share) if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_key_share)
@ -1079,3 +1081,20 @@ int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, X509 *x,
return 1; return 1;
} }
int tls_construct_stoc_psk(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int *al)
{
if (!s->hit)
return 1;
if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_psk)
|| !WPACKET_start_sub_packet_u16(pkt)
|| !WPACKET_put_bytes_u16(pkt, s->session->ext.tick_identity)
|| !WPACKET_close(pkt)) {
SSLerr(SSL_F_TLS_CONSTRUCT_STOC_PSK, ERR_R_INTERNAL_ERROR);
return 0;
}
return 1;
}

2
ssl/statem/statem_locl.h
View File

@ -247,6 +247,8 @@ int tls_construct_stoc_key_share(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
#define TLSEXT_TYPE_cryptopro_bug 0xfde8 #define TLSEXT_TYPE_cryptopro_bug 0xfde8
int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, X509 *x, int tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt, X509 *x,
size_t chainidx, int *al); size_t chainidx, int *al);
int tls_construct_stoc_psk(SSL *s, WPACKET *pkt, X509 *x, size_t chainidx,
int *al);
/* Client Extension processing */ /* Client Extension processing */
int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, X509 *x, int tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, X509 *x,