feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Added build error for insecure build combination of secure renegotiation enabled with extended master secret disabled when session resumption is enabled.

Browse Source
This commit is contained in:
David Garske
2021-06-10 16:40:28 -07:00
parent 624e150c7b
commit 61314f3971
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
wolfssl/wolfcrypt/settings.h
View File

@@ -2464,6 +2464,27 @@ extern void uITRON4_free(void *p) ;
#undef WOLFSSL_DH_EXTRA
#endif
/* Check for insecure build combination:
* secure renegotiation [enabled]
* extended master secret [disabled]
* session resumption [enabled]
*/
#if defined(HAVE_SECURE_RENEGOTIATION) && !defined(HAVE_EXTENDED_MASTER) && \
(defined(HAVE_SESSION_TICKET) || !defined(NO_SESSION_CACHE))
/* secure renegotiation requires extended master secret with resumption */
#ifndef _MSC_VER
#warning Extended master secret must be enabled with secure renegotiation and session resumption
#else
#pragma message("Warning: Extended master secret must be enabled with secure renegotiation and session resumption")
#endif
/* Note: "--enable-renegotiation-indication" ("HAVE_RENEGOTIATION_INDICATION")
* only sends the secure renegotiation extension, but is not actually supported.
* This was added because some TLS peers required it even if not used, so we call
* this "(FAKE Secure Renegotiation)"
*/
#endif
#ifdef __cplusplus
} /* extern "C" */