wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-02 20:24:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add session ticket timeout check in DoSessionTicket

Browse Source
This commit is contained in:
TakayukiMatsuo
2021-05-31 18:14:33 +09:00
parent 15931fa199
commit 5f7477980c
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/internal.c
View File

@@ -28054,7 +28054,6 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
{ {
int ret = 0; int ret = 0;
WOLFSSL_SESSION* session; WOLFSSL_SESSION* session;
(void)bogusID; (void)bogusID;
session = GetSession(ssl, ssl->arrays->masterSecret, 1); session = GetSession(ssl, ssl->arrays->masterSecret, 1);
@@ -28070,7 +28069,20 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
if (!session) { if (!session) {
WOLFSSL_MSG("Session lookup for resume failed"); WOLFSSL_MSG("Session lookup for resume failed");
ssl->options.resuming = 0; ssl->options.resuming = 0;
return ret;
} }
#if defined(HAVE_SESSION_TICKET) || !defined(NO_PSK)
#ifdef WOLFSSL_TLS13
word32 born;
/* check if the ticket is valid */
ato32((const byte*)&(session->ticketSeen), &born);
if (LowResTimer() > born + ssl->timeout) {
WOLFSSL_MSG("Expired session ticket, fall back to full handshake.");
ssl->options.resuming = 0;
}
#endif /* WOLFSSL_TLS13 */
#endif /* HAVE_SESSION_TICKET || !NO_PSK */
else if (session->haveEMS != ssl->options.haveEMS) { else if (session->haveEMS != ssl->options.haveEMS) {
/* RFC 7627, 5.3, server-side */ /* RFC 7627, 5.3, server-side */
/* if old sess didn't have EMS, but new does, full handshake */ /* if old sess didn't have EMS, but new does, full handshake */
@@ -29485,6 +29497,9 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
/* Copy the haveExtendedMasterSecret property from the ticket to /* Copy the haveExtendedMasterSecret property from the ticket to
* the saved session, so the property may be checked later. */ * the saved session, so the property may be checked later. */
ssl->session.haveEMS = it.haveEMS; ssl->session.haveEMS = it.haveEMS;
#ifdef WOLFSSL_TLS13
ssl->session.ticketSeen = it.timestamp;
#endif
#ifndef NO_RESUME_SUITE_CHECK #ifndef NO_RESUME_SUITE_CHECK
ssl->session.cipherSuite0 = it.suite[0]; ssl->session.cipherSuite0 = it.suite[0];
ssl->session.cipherSuite = it.suite[1]; ssl->session.cipherSuite = it.suite[1];