wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-31 19:24:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reverted an earlier change to the renegotiation resumption. Still need

Browse Source 
to check the cert subject hash.
This commit is contained in:
John Safranek
2019-02-26 14:26:09 -08:00
parent 57d8e070f9
commit 65c72ddfe1
3 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/internal.c
View File

@@ -9562,6 +9562,30 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
#endif
}
}
#ifdef HAVE_SECURE_RENEGOTIATION
if (args->fatal == 0 && ssl->secure_renegotiation
&& ssl->secure_renegotiation->enabled) {
if (IsEncryptionOn(ssl, 0)) {
/* compare against previous time */
if (XMEMCMP(args->dCert->subjectHash,
ssl->secure_renegotiation->subject_hash,
KEYID_SIZE) != 0) {
WOLFSSL_MSG(
"Peer sent different cert during scr, fatal");
args->fatal = 1;
ret = SCR_DIFFERENT_CERT_E;
}
}
/* cache peer's hash */
if (args->fatal == 0) {
XMEMCPY(ssl->secure_renegotiation->subject_hash,
args->dCert->subjectHash, KEYID_SIZE);
}
}
#endif /* HAVE_SECURE_RENEGOTIATION */
} /* if (count > 0) */
/* Check for error */

2
wolfssl/error-ssl.h
View File

@@ -119,7 +119,7 @@ enum wolfSSL_ErrorCodes {
SECURE_RENEGOTIATION_E = -388, /* Invalid Renegotiation Info */
SESSION_TICKET_LEN_E = -389, /* Session Ticket too large */
SESSION_TICKET_EXPECT_E = -390, /* Session Ticket missing */
SCR_DIFFERENT_CERT_E = -391, /* SCR Different cert error */
SESSION_SECRET_CB_E = -392, /* Session secret Cb fcn failure */
NO_CHANGE_CIPHER_E = -393, /* Finished before change cipher */
SANITY_MSG_E = -394, /* Sanity check on msg order error */

1
wolfssl/internal.h
View File

@@ -2286,6 +2286,7 @@ typedef struct SecureRenegotiation {
enum key_cache_state cache_status; /* track key cache state */
byte client_verify_data[TLS_FINISHED_SZ]; /* cached */
byte server_verify_data[TLS_FINISHED_SZ]; /* cached */
byte subject_hash[KEYID_SIZE]; /* peer cert hash */
Keys tmp_keys; /* can't overwrite real keys yet */
} SecureRenegotiation;