wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-01 19:54:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

add session ticket key returns for reject and use but create

Browse Source
This commit is contained in:
toddouska
2015-05-15 14:58:16 -07:00
parent f6d12bfc37
commit 2212381925
4 changed files with 39 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
examples/server/server.c
View File

@@ -791,7 +791,7 @@ while (1) { /* allow resume option */
XMEMCPY(key_name, myKey_ctx.name, WOLFSSL_TICKET_NAME_SZ); XMEMCPY(key_name, myKey_ctx.name, WOLFSSL_TICKET_NAME_SZ);
ret = wc_RNG_GenerateBlock(&rng, iv, WOLFSSL_TICKET_IV_SZ); ret = wc_RNG_GenerateBlock(&rng, iv, WOLFSSL_TICKET_IV_SZ);
if (ret != 0) return ret; if (ret != 0) return WOLFSSL_TICKET_RET_REJECT;
/* build aad from key name, iv, and length */ /* build aad from key name, iv, and length */
XMEMCPY(tmp, key_name, WOLFSSL_TICKET_NAME_SZ); XMEMCPY(tmp, key_name, WOLFSSL_TICKET_NAME_SZ);
@@ -805,7 +805,7 @@ while (1) { /* allow resume option */
ticket, inLen, ticket, inLen,
ticket, ticket,
mac); mac);
if (ret != 0) return ret; if (ret != 0) return WOLFSSL_TICKET_RET_REJECT;
*outLen = inLen; /* no padding in this mode */ *outLen = inLen; /* no padding in this mode */
} else { } else {
/* decrypt */ /* decrypt */
@@ -821,11 +821,11 @@ while (1) { /* allow resume option */
ticket, inLen, ticket, inLen,
mac, mac,
ticket); ticket);
if (ret != 0) return ret; if (ret != 0) return WOLFSSL_TICKET_RET_REJECT;
*outLen = inLen; /* no padding in this mode */ *outLen = inLen; /* no padding in this mode */
} }
return 0; return WOLFSSL_TICKET_RET_OK;
} }
#endif #endif

12
src/internal.c
View File

@@ -9337,8 +9337,9 @@ static void PickHashSigAlgo(WOLFSSL* ssl,
#endif #endif
#ifdef HAVE_SESSION_TICKET #ifdef HAVE_SESSION_TICKET
ret = ret || /* server may send blank ticket which may not be expected to indicate
(!ssl->expect_session_ticket && ssl->session.ticketLen > 0); * exisiting one ok but will also be sending a new one */
ret = ret || (ssl->session.ticketLen > 0);
#endif #endif
ret = ret || ret = ret ||
@@ -13746,7 +13747,7 @@ int DoSessionTicket(WOLFSSL* ssl,
ret = ssl->ctx->ticketEncCb(ssl, et->key_name, et->iv, et->mac, 1, ret = ssl->ctx->ticketEncCb(ssl, et->key_name, et->iv, et->mac, 1,
et->enc_ticket, sizeof(InternalTicket), et->enc_ticket, sizeof(InternalTicket),
&encLen); &encLen);
if (ret == 0) { if (ret == WOLFSSL_TICKET_RET_OK) {
if (encLen < (int)sizeof(InternalTicket) || if (encLen < (int)sizeof(InternalTicket) ||
encLen > WOLFSSL_TICKET_ENC_SZ) { encLen > WOLFSSL_TICKET_ENC_SZ) {
WOLFSSL_MSG("Bad user ticket encrypt size"); WOLFSSL_MSG("Bad user ticket encrypt size");
@@ -13790,14 +13791,15 @@ int DoSessionTicket(WOLFSSL* ssl,
ret = ssl->ctx->ticketEncCb(ssl, et->key_name, et->iv, ret = ssl->ctx->ticketEncCb(ssl, et->key_name, et->iv,
et->enc_ticket + inLen, 0, et->enc_ticket + inLen, 0,
et->enc_ticket, inLen, &outLen); et->enc_ticket, inLen, &outLen);
if (ret != 0) return ret; if (ret == WOLFSSL_TICKET_RET_FATAL || ret < 0) return ret;
if (outLen > inLen || outLen < (int)sizeof(InternalTicket)) { if (outLen > inLen || outLen < (int)sizeof(InternalTicket)) {
WOLFSSL_MSG("Bad user ticket decrypt len"); WOLFSSL_MSG("Bad user ticket decrypt len");
return BAD_TICKET_KEY_CB_SZ; return BAD_TICKET_KEY_CB_SZ;
} }
/* get master secret */ /* get master secret */
XMEMCPY(ssl->arrays->masterSecret, it->msecret, SECRET_LEN); if (ret == WOLFSSL_TICKET_RET_OK || ret == WOLFSSL_TICKET_RET_CREATE)
XMEMCPY(ssl->arrays->masterSecret, it->msecret, SECRET_LEN);
return ret; return ret;
} }

25
src/tls.c
View File

@@ -1844,15 +1844,32 @@ static int TLSX_SessionTicket_Parse(WOLFSSL* ssl, byte* input, word16 length,
if (ret == SSL_SUCCESS) { if (ret == SSL_SUCCESS) {
ret = 0; ret = 0;
TLSX_SetResponse(ssl, SESSION_TICKET); /* send blank ticket */ TLSX_SetResponse(ssl, SESSION_TICKET); /* send blank ticket */
ssl->options.createTicket = 1; /* will send ticket msg */ ssl->options.createTicket = 1; /* will send ticket msg */
ssl->options.useTicket = 1; ssl->options.useTicket = 1;
} }
} else { } else {
/* got actual ticket from client */ /* got actual ticket from client */
ret = DoClientTicket(ssl, input, length); ret = DoClientTicket(ssl, input, length);
if (ret == 0) { /* use ticket to resume */ if (ret == WOLFSSL_TICKET_RET_OK) { /* use ticket to resume */
WOLFSSL_MSG("Using exisitng client ticket");
ssl->options.useTicket = 1; ssl->options.useTicket = 1;
ssl->options.resuming = 1; ssl->options.resuming = 1;
} else if (ret == WOLFSSL_TICKET_RET_CREATE) {
WOLFSSL_MSG("Using existing client ticket, creating new one");
ret = TLSX_UseSessionTicket(&ssl->extensions, NULL);
if (ret == SSL_SUCCESS) {
ret = 0;
TLSX_SetResponse(ssl, SESSION_TICKET);
/* send blank ticket */
ssl->options.createTicket = 1; /* will send ticket msg */
ssl->options.useTicket = 1;
ssl->options.resuming = 1;
}
} else if (ret == WOLFSSL_TICKET_RET_REJECT) {
WOLFSSL_MSG("Process client ticket rejected, not using");
ret = 0; /* not fatal */
} else if (ret == WOLFSSL_TICKET_RET_FATAL || ret < 0) {
WOLFSSL_MSG("Process client ticket fatal error, not using");
} }
} }
} }

7
wolfssl/ssl.h
View File

@@ -1376,6 +1376,13 @@ WOLFSSL_API int wolfSSL_set_SessionTicket_cb(WOLFSSL*,
#define WOLFSSL_TICKET_IV_SZ 16 #define WOLFSSL_TICKET_IV_SZ 16
#define WOLFSSL_TICKET_MAC_SZ 32 #define WOLFSSL_TICKET_MAC_SZ 32
enum TicketEncRet {
WOLFSSL_TICKET_RET_FATAL = -1, /* fatal error, don't use ticket */
WOLFSSL_TICKET_RET_OK = 0, /* ok, use ticket */
WOLFSSL_TICKET_RET_REJECT, /* don't use ticket, but not fatal */
WOLFSSL_TICKET_RET_CREATE /* existing ticket ok and create new one */
};
typedef int (*SessionTicketEncCb)(WOLFSSL*, typedef int (*SessionTicketEncCb)(WOLFSSL*,
unsigned char key_name[WOLFSSL_TICKET_NAME_SZ], unsigned char key_name[WOLFSSL_TICKET_NAME_SZ],
unsigned char iv[WOLFSSL_TICKET_IV_SZ], unsigned char iv[WOLFSSL_TICKET_IV_SZ],