wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 10:47:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2309 from SparkiDev/fallback_scsv

Browse Source 
Fallback SCSV (Signaling Cipher Suite Value) support on Server only
This commit is contained in:
toddouska
2019-07-01 08:55:02 -07:00
committed by GitHub
parent 08bd5000f1 a3e4a2fd6e
commit 4500f2d773
4 changed files with 29 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
configure.ac
View File

@ -2844,6 +2844,18 @@ then
AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SECURE_RENEGOTIATION -DHAVE_SERVER_RENEGOTIATION_INFO" AM_CFLAGS="$AM_CFLAGS -DHAVE_TLS_EXTENSIONS -DHAVE_SECURE_RENEGOTIATION -DHAVE_SERVER_RENEGOTIATION_INFO"
fi fi
# Fallback SCSV
AC_ARG_ENABLE([fallback-scsv],
[AS_HELP_STRING([--enable-fallback-scsv],[Enable Fallback SCSV (default: disabled)])],
[ ENABLED_FALLBACK_SCSV=$enableval ],
[ ENABLED_FALLBACK_SCSV=no ]
)
if test "x$ENABLED_FALLBACK_SCSV" = "xyes"
then
AM_CFLAGS="$AM_CFLAGS -DHAVE_FALLBACK_SCSV"
fi
# Supported Elliptic Curves Extensions # Supported Elliptic Curves Extensions
AC_ARG_ENABLE([supportedcurves], AC_ARG_ENABLE([supportedcurves],
[AS_HELP_STRING([--enable-supportedcurves],[Enable Supported Elliptic Curves (default: enabled)])], [AS_HELP_STRING([--enable-supportedcurves],[Enable Supported Elliptic Curves (default: enabled)])],
@ -4961,6 +4973,7 @@ echo " * Session Ticket: $ENABLED_SESSION_TICKET"
echo " * Extended Master Secret: $ENABLED_EXTENDED_MASTER" echo " * Extended Master Secret: $ENABLED_EXTENDED_MASTER"
echo " * Renegotiation Indication: $ENABLED_RENEGOTIATION_INDICATION" echo " * Renegotiation Indication: $ENABLED_RENEGOTIATION_INDICATION"
echo " * Secure Renegotiation: $ENABLED_SECURE_RENEGOTIATION" echo " * Secure Renegotiation: $ENABLED_SECURE_RENEGOTIATION"
echo " * Fallback SCSV: $ENABLED_FALLBACK_SCSV"
echo " * All TLS Extensions: $ENABLED_TLSX" echo " * All TLS Extensions: $ENABLED_TLSX"
echo " * PKCS#7 $ENABLED_PKCS7" echo " * PKCS#7 $ENABLED_PKCS7"
echo " * wolfSSH $ENABLED_WOLFSSH" echo " * wolfSSH $ENABLED_WOLFSSH"

14
src/internal.c
View File

@ -23116,7 +23116,8 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
return ret; return ret;
} }
#ifdef HAVE_SERVER_RENEGOTIATION_INFO #if defined(HAVE_SERVER_RENEGOTIATION_INFO) || defined(HAVE_FALLBACK_SCSV) || \
defined(OPENSSL_ALL)
/* search suites for specific one, idx on success, negative on error */ /* search suites for specific one, idx on success, negative on error */
#ifndef WOLFSSL_TLS13 #ifndef WOLFSSL_TLS13
@ -23904,6 +23905,17 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
} }
} }
#endif /* HAVE_SERVER_RENEGOTIATION_INFO */ #endif /* HAVE_SERVER_RENEGOTIATION_INFO */
#if defined(HAVE_FALLBACK_SCSV) || defined(OPENSSL_ALL)
/* check for TLS_FALLBACK_SCSV suite */
if (FindSuite(&clSuites, TLS_FALLBACK_SCSV, 0) >= 0) {
WOLFSSL_MSG("Found Fallback SCSV");
if (ssl->ctx->method->version.minor > pv.minor) {
WOLFSSL_MSG("Client trying to connect with lesser version");
SendAlert(ssl, alert_fatal, inappropriate_fallback);
return VERSION_ERROR;
}
}
#endif
#ifdef WOLFSSL_DTLS #ifdef WOLFSSL_DTLS
if (IsDtlsNotSctpMode(ssl)) { if (IsDtlsNotSctpMode(ssl)) {

2
wolfssl/internal.h
View File

@ -1066,6 +1066,8 @@ enum {
TLS_AES_128_CCM_SHA256 = 0x04, TLS_AES_128_CCM_SHA256 = 0x04,
TLS_AES_128_CCM_8_SHA256 = 0x05, TLS_AES_128_CCM_8_SHA256 = 0x05,
/* Fallback SCSV (Signaling Cipher Suite Value) */
TLS_FALLBACK_SCSV = 0x56,
/* Renegotiation Indication Extension Special Suite */ /* Renegotiation Indication Extension Special Suite */
TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0xff TLS_EMPTY_RENEGOTIATION_INFO_SCSV = 0xff
}; };

1
wolfssl/ssl.h
View File

@ -401,6 +401,7 @@ enum AlertDescription {
#else #else
protocol_version = 70, protocol_version = 70,
#endif #endif
inappropriate_fallback = 86,
no_renegotiation = 100, no_renegotiation = 100,
unsupported_extension = 110, /**< RFC 5246, section 7.2.2 */ unsupported_extension = 110, /**< RFC 5246, section 7.2.2 */
unrecognized_name = 112, /**< RFC 6066, section 3 */ unrecognized_name = 112, /**< RFC 6066, section 3 */