feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

initial serialization of TLS session

Browse Source
This commit is contained in:
Jacob Barthelmeh
2021-05-21 00:19:34 +07:00
parent 943c98a45e
commit 2871fc670f
6 changed files with 552 additions and 276 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
configure.ac
View File

@@ -6013,10 +6013,6 @@ AC_ARG_ENABLE([sessionexport],
if test "$ENABLED_SESSIONEXPORT" = "yes" ||
test "$ENABLED_SESSIONEXPORT" = "nopeer"
then
if test "$ENABLED_DTLS" = "no"
then
AC_MSG_ERROR([Only DTLS supported with session export])
fi
AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SESSION_EXPORT"
if test "$ENABLED_SESSIONEXPORT" = "nopeer"

728
src/internal.c
View File

File diff suppressed because it is too large Load Diff

49
src/ssl.c
View File

@@ -239,6 +239,45 @@ byte tsip_rootCAverified( );
#endif
#ifdef WOLFSSL_SESSION_EXPORT
/**
* Used to import a serialized TLS session. In most cases wolfSSL_get_session
* should be used instead, this function is for exporting the state of the
* connection and when imported a resumption is not needed.
* WARNING: buf contains sensitive information about the state and is best to be
* encrypted before storing if stored.
*
* @param ssl WOLFSSL structure to import the session into
* @param buf serialized session
* @param sz size of buffer 'buf'
* @return the number of bytes read from buffer 'buf'
*/
int wolfSSL_tls_import(WOLFSSL* ssl, const unsigned char* buf, unsigned int sz)
{
if (ssl == NULL || buf == NULL) {
return BAD_FUNC_ARG;
}
return wolfSSL_session_import_internal(ssl, buf, sz, WOLFSSL_EXPORT_TLS);
}
/**
* Used to export a serialized TLS session. In most cases wolfSSL_set_session
* should be used instead, this function is for importing a serialized state of
* the connection.
*
* @param ssl WOLFSSL structure to export the session from
* @param buf output of serialized session
* @param sz size in bytes set in 'buf'
* @return the number of bytes written into buffer 'buf'
*/
int wolfSSL_tls_export(WOLFSSL* ssl, unsigned char* buf, unsigned int* sz)
{
if (ssl == NULL || sz == NULL) {
return BAD_FUNC_ARG;
}
return wolfSSL_session_export_internal(ssl, buf, sz, WOLFSSL_EXPORT_TLS);
}
#ifdef WOLFSSL_DTLS
int wolfSSL_dtls_import(WOLFSSL* ssl, const unsigned char* buf, unsigned int sz)
{
@@ -249,7 +288,7 @@ int wolfSSL_dtls_import(WOLFSSL* ssl, const unsigned char* buf, unsigned int sz)
}
/* sanity checks on buffer and protocol are done in internal function */
return wolfSSL_dtls_import_internal(ssl, buf, sz);
return wolfSSL_session_import_internal(ssl, buf, sz, WOLFSSL_EXPORT_DTLS);
}
@@ -319,7 +358,7 @@ int wolfSSL_dtls_export(WOLFSSL* ssl, unsigned char* buf, unsigned int* sz)
}
/* copy over keys, options, and dtls state struct */
return wolfSSL_dtls_export_internal(ssl, buf, *sz);
return wolfSSL_session_export_internal(ssl, buf, sz, WOLFSSL_EXPORT_DTLS);
}
@@ -363,7 +402,7 @@ int wolfSSL_send_session(WOLFSSL* ssl)
{
int ret;
byte* buf;
word16 bufSz = MAX_EXPORT_BUFFER;
word32 bufSz = MAX_EXPORT_BUFFER;
WOLFSSL_ENTER("wolfSSL_send_session");
@@ -384,7 +423,7 @@ int wolfSSL_send_session(WOLFSSL* ssl)
}
/* copy over keys, options, and dtls state struct */
ret = wolfSSL_dtls_export_internal(ssl, buf, bufSz);
ret = wolfSSL_session_export_internal(ssl, buf, &bufSz, WOLFSSL_EXPORT_DTLS);
if (ret < 0) {
XFREE(buf, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
return ret;
@@ -14247,7 +14286,7 @@ int wolfSSL_DTLS_SetCookieSecret(WOLFSSL* ssl,
}
#endif /* WOLFSSL_ASYNC_CRYPT && HAVE_SECURE_RENEGOTIATION */
#ifdef WOLFSSL_SESSION_EXPORT
#if defined(WOLFSSL_SESSION_EXPORT) && defined(WOLFSSL_DTLS)
if (ssl->dtls_export) {
if ((ssl->error = wolfSSL_send_session(ssl)) != 0) {
WOLFSSL_MSG("Export DTLS session error");

14
tests/api.c
View File

@@ -3642,11 +3642,12 @@ static void test_wolfSSL_EVP_CIPHER_CTX(void)
#ifdef HAVE_IO_TESTS_DEPENDENCIES
#ifdef WOLFSSL_SESSION_EXPORT
#ifdef WOLFSSL_DTLS
/* set up function for sending session information */
static int test_export(WOLFSSL* inSsl, byte* buf, word32 sz, void* userCtx)
{
WOLFSSL_CTX* ctx;
WOLFSSL* ssl;
WOLFSSL_CTX* ctx = NULL;
WOLFSSL* ssl = NULL;
AssertNotNull(inSsl);
AssertNotNull(buf);
@@ -3666,6 +3667,7 @@ static int test_export(WOLFSSL* inSsl, byte* buf, word32 sz, void* userCtx)
(void)userCtx;
return WOLFSSL_SUCCESS;
}
#endif
/* returns negative value on fail and positive (including 0) on success */
static int nonblocking_accept_read(void* args, WOLFSSL* ssl, SOCKET_T* sockfd)
@@ -4814,7 +4816,8 @@ done:
/* SNI / ALPN / session export helper functions */
#if defined(HAVE_SNI) || defined(HAVE_ALPN) || defined(WOLFSSL_SESSION_EXPORT)
#if defined(HAVE_SNI) || defined(HAVE_ALPN) ||\
(defined(WOLFSSL_SESSION_EXPORT) && defined(WOLFSSL_DTLS))
static THREAD_RETURN WOLFSSL_THREAD run_wolfssl_server(void* args)
{
@@ -4854,7 +4857,7 @@ static THREAD_RETURN WOLFSSL_THREAD run_wolfssl_server(void* args)
#ifdef WOLFSSL_ENCRYPTED_KEYS
wolfSSL_CTX_set_default_passwd_cb(ctx, PasswordCallBack);
#endif
#ifdef WOLFSSL_SESSION_EXPORT
#if defined(WOLFSSL_SESSION_EXPORT) && defined(WOLFSSL_DTLS)
AssertIntEQ(WOLFSSL_SUCCESS, wolfSSL_CTX_dtls_set_export(ctx, test_export));
#endif
@@ -4929,7 +4932,8 @@ static THREAD_RETURN WOLFSSL_THREAD run_wolfssl_server(void* args)
}
AssertIntEQ(len, wolfSSL_write(ssl, msg, len));
#if defined(WOLFSSL_SESSION_EXPORT) && !defined(HAVE_IO_POOL)
#if defined(WOLFSSL_SESSION_EXPORT) && !defined(HAVE_IO_POOL) && \
defined(WOLFSSL_DTLS)
if (wolfSSL_dtls(ssl)) {
byte* import;
word32 sz;

30
wolfssl/internal.h
View File

@@ -1323,23 +1323,29 @@ enum Misc {
DTLS_POOL_SZ = 255,/* allowed number of list items in TX pool */
DTLS_EXPORT_PRO = 165,/* wolfSSL protocol for serialized session */
DTLS_EXPORT_STATE_PRO = 166,/* wolfSSL protocol for serialized state */
DTLS_EXPORT_VERSION = 4, /* wolfSSL version for serialized session */
TLS_EXPORT_PRO = 167,/* wolfSSL protocol for serialized TLS */
DTLS_EXPORT_OPT_SZ = 61, /* amount of bytes used from Options */
DTLS_EXPORT_VERSION_3 = 3, /* wolfSSL version before TLS 1.3 addition */
DTLS_EXPORT_OPT_SZ_3 = 60, /* amount of bytes used from Options */
DTLS_EXPORT_KEY_SZ = 325 + (DTLS_SEQ_SZ * 2),
/* max amount of bytes used from Keys */
DTLS_EXPORT_MIN_KEY_SZ = 85 + (DTLS_SEQ_SZ * 2),
/* min amount of bytes used from Keys */
DTLS_EXPORT_SPC_SZ = 16, /* amount of bytes used from CipherSpecs */
DTLS_EXPORT_LEN = 2, /* 2 bytes for length and protocol */
WOLFSSL_EXPORT_TLS = 1,
WOLFSSL_EXPORT_DTLS = 0,
WOLFSSL_EXPORT_SPC_SZ = 16, /* amount of bytes used from CipherSpecs */
WOLFSSL_EXPORT_LEN = 2, /* 2 bytes for length and protocol */
WOLFSSL_EXPORT_VERSION = 4, /* wolfSSL version for serialized session */
/* older export versions supported */
WOLFSSL_EXPORT_VERSION_3 = 3, /* wolfSSL version before TLS 1.3 addition */
DTLS_EXPORT_IP = 46, /* max ip size IPv4 mapped IPv6 */
DTLS_MTU_ADDITIONAL_READ_BUFFER = WOLFSSL_DTLS_MTU_ADDITIONAL_READ_BUFFER,
/* Additional bytes to read so that
* we can work with a peer that has
* a slightly different MTU than us. */
MAX_EXPORT_BUFFER = 514, /* max size of buffer for exporting */
MAX_EXPORT_STATE_BUFFER = (DTLS_EXPORT_MIN_KEY_SZ) + (3 * DTLS_EXPORT_LEN),
MAX_EXPORT_STATE_BUFFER = (DTLS_EXPORT_MIN_KEY_SZ) + (3 * WOLFSSL_EXPORT_LEN),
/* max size of buffer for exporting state */
FINISHED_LABEL_SZ = 15, /* TLS finished label size */
TLS_FINISHED_SZ = 12, /* TLS has a shorter size */
@@ -1654,17 +1660,19 @@ WOLFSSL_LOCAL ProtocolVersion MakeTLSv1_3(void);
WOLFSSL_LOCAL ProtocolVersion MakeDTLSv1(void);
WOLFSSL_LOCAL ProtocolVersion MakeDTLSv1_2(void);
#ifdef WOLFSSL_SESSION_EXPORT
WOLFSSL_LOCAL int wolfSSL_dtls_import_internal(WOLFSSL* ssl, const byte* buf,
word32 sz);
WOLFSSL_LOCAL int wolfSSL_dtls_export_internal(WOLFSSL* ssl, byte* buf,
word32 sz);
#endif
#ifdef WOLFSSL_SESSION_EXPORT
WOLFSSL_LOCAL int wolfSSL_session_export_internal(WOLFSSL* ssl, byte* buf,
word32* sz, int isTLS);
WOLFSSL_LOCAL int wolfSSL_session_import_internal(WOLFSSL* ssl, const byte* buf,
word32 sz, int isTLS);
#ifdef WOLFSSL_DTLS
WOLFSSL_LOCAL int wolfSSL_dtls_export_state_internal(WOLFSSL* ssl,
byte* buf, word32 sz);
WOLFSSL_LOCAL int wolfSSL_dtls_import_state_internal(WOLFSSL* ssl,
const byte* buf, word32 sz);
WOLFSSL_LOCAL int wolfSSL_send_session(WOLFSSL* ssl);
#endif
#endif
#endif
struct WOLFSSL_BY_DIR_HASH {

3
wolfssl/ssl.h
View File

@@ -878,6 +878,9 @@ WOLFSSL_ABI WOLFSSL_API WOLFSSL_METHOD *wolfTLSv1_2_client_method(void);
#endif
#ifdef WOLFSSL_SESSION_EXPORT
int wolfSSL_tls_import(WOLFSSL* ssl, const unsigned char* buf, unsigned int sz);
int wolfSSL_tls_export(WOLFSSL* ssl, unsigned char* buf, unsigned int* sz);
#ifdef WOLFSSL_DTLS
#ifndef WOLFSSL_DTLS_EXPORT_TYPES