mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-27 05:21:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

If we have no suitable PSK kex modes then don't attempt to resume

Browse Source 
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2259)
This commit is contained in:
Matt Caswell 2017-01-25 11:56:23 +00:00
parent 1a3392c878
commit 1a9f457c66
5 changed files with 20 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ssl/ssl_locl.h
View File

@ -1933,7 +1933,7 @@ __owur CERT *ssl_cert_dup(CERT *cert);
void ssl_cert_clear_certs(CERT *c); void ssl_cert_clear_certs(CERT *c);
void ssl_cert_free(CERT *c); void ssl_cert_free(CERT *c);
__owur int ssl_get_new_session(SSL *s, int session); __owur int ssl_get_new_session(SSL *s, int session);
__owur int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello); __owur int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello, int *al);
__owur SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket); __owur SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket);
__owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b); __owur int ssl_cipher_id_cmp(const SSL_CIPHER *a, const SSL_CIPHER *b);
DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id); DECLARE_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER, ssl_cipher_id);

16
ssl/ssl_sess.c
View File

@ -458,7 +458,7 @@ int ssl_get_new_session(SSL *s, int session)
* - Both for new and resumed sessions, s->ext.ticket_expected is set to 1 * - Both for new and resumed sessions, s->ext.ticket_expected is set to 1
* if the server should issue a new session ticket (to 0 otherwise). * if the server should issue a new session ticket (to 0 otherwise).
*/ */
int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello) int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello, int *al)
{ {
/* This is used only by servers. */ /* This is used only by servers. */
@ -468,10 +468,10 @@ int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello)
TICKET_RETURN r; TICKET_RETURN r;
if (SSL_IS_TLS13(s)) { if (SSL_IS_TLS13(s)) {
int al; if (!tls_parse_extension(s, TLSEXT_IDX_psk_kex_modes, EXT_CLIENT_HELLO,
hello->pre_proc_exts, NULL, 0, al)
if (!tls_parse_extension(s, TLSEXT_IDX_psk, EXT_CLIENT_HELLO, || !tls_parse_extension(s, TLSEXT_IDX_psk, EXT_CLIENT_HELLO,
hello->pre_proc_exts, NULL, 0, &al)) hello->pre_proc_exts, NULL, 0, al))
return -1; return -1;
ret = s->session; ret = s->session;
@ -637,10 +637,12 @@ int ssl_get_prev_session(SSL *s, CLIENTHELLO_MSG *hello)
s->ext.ticket_expected = 1; s->ext.ticket_expected = 1;
} }
} }
if (fatal) if (fatal) {
*al = SSL_AD_INTERNAL_ERROR;
return -1; return -1;
else } else {
return 0; return 0;
}
} }
int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c) int SSL_CTX_add_session(SSL_CTX *ctx, SSL_SESSION *c)

1
ssl/statem/extensions.c
View File

@ -237,7 +237,6 @@ static const EXTENSION_DEFINITION ext_defs[] = {
NULL, NULL, NULL, tls_construct_ctos_supported_versions, NULL NULL, NULL, NULL, tls_construct_ctos_supported_versions, NULL
}, },
{ {
/* Must be before key_share */
TLSEXT_TYPE_psk_kex_modes, TLSEXT_TYPE_psk_kex_modes,
EXT_CLIENT_HELLO | EXT_TLS_IMPLEMENTATION_ONLY | EXT_TLS1_3_ONLY, EXT_CLIENT_HELLO | EXT_TLS_IMPLEMENTATION_ONLY | EXT_TLS1_3_ONLY,
init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL, init_psk_kex_modes, tls_parse_ctos_psk_kex_modes, NULL, NULL,

8
ssl/statem/extensions_srvr.c
View File

@ -687,6 +687,14 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, X509 *x, size_t chainidx, int *al)
unsigned int id, i; unsigned int id, i;
const EVP_MD *md = NULL; const EVP_MD *md = NULL;
/*
* If we have no PSK kex mode that we recognise then we can't resume so
* ignore this extension
*/
if ((s->ext.psk_kex_mode
& (TLSEXT_KEX_MODE_FLAG_KE | TLSEXT_KEX_MODE_FLAG_KE_DHE)) == 0)
return 1;
if (!PACKET_get_length_prefixed_2(pkt, &identities)) { if (!PACKET_get_length_prefixed_2(pkt, &identities)) {
*al = SSL_AD_DECODE_ERROR; *al = SSL_AD_DECODE_ERROR;
return 0; return 0;

4
ssl/statem/statem_srvr.c
View File

@ -1475,12 +1475,12 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
if (!ssl_get_new_session(s, 1)) if (!ssl_get_new_session(s, 1))
goto err; goto err;
} else { } else {
i = ssl_get_prev_session(s, &clienthello); i = ssl_get_prev_session(s, &clienthello, &al);
if (i == 1) { if (i == 1) {
/* previous session */ /* previous session */
s->hit = 1; s->hit = 1;
} else if (i == -1) { } else if (i == -1) {
goto err; goto f_err;
} else { } else {
/* i == 0 */ /* i == 0 */
if (!ssl_get_new_session(s, 1)) if (!ssl_get_new_session(s, 1))