wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 02:37:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix for client_hello keyshare with multiple entries. Fix for change_cipher_spec after finished.

Browse Source
This commit is contained in:
David Garske
2020-11-10 14:03:25 -08:00
parent ea21ddf540
commit a53b734c83
1 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/sniffer.c
View File

@ -2436,6 +2436,9 @@ static int ProcessKeyShare(KeyShareInfo* info, const byte* input, int len,
{ {
int index = 0; int index = 0;
while (index < len) { while (index < len) {
/* clear info (reset dh_key_bits and curve_id) */
XMEMSET(info, 0, sizeof(KeyShareInfo));
/* Named group and public key */ /* Named group and public key */
info->named_group = (word16)((input[index] << 8) | input[index+1]); info->named_group = (word16)((input[index] << 8) | input[index+1]);
index += OPAQUE16_LEN; index += OPAQUE16_LEN;
@ -2514,15 +2517,15 @@ static int ProcessKeyShare(KeyShareInfo* info, const byte* input, int len,
break; break;
#endif #endif
default: default:
/* unsupported curve */ /* do not throw error here, keep iterating the client key share */
return ECC_PEERKEY_ERROR; break;
} }
if (filter_group == 0 || filter_group == info->named_group) { if (filter_group == 0 || filter_group == info->named_group) {
return 0; return 0;
} }
} }
return -1; return NO_PEER_KEY; /* unsupported key type */
} }
static int ProcessServerKeyShare(SnifferSession* session, const byte* input, int len, static int ProcessServerKeyShare(SnifferSession* session, const byte* input, int len,
@ -5017,6 +5020,11 @@ doMessage:
|| (session->flags.side == WOLFSSL_CLIENT_END && || (session->flags.side == WOLFSSL_CLIENT_END &&
session->flags.clientCipherOn)) { session->flags.clientCipherOn)) {
int ivAdvance = 0; /* TLSv1.1 advance amount */ int ivAdvance = 0; /* TLSv1.1 advance amount */
/* change_cipher_spec is not encrypted */
if (rh.type == change_cipher_spec) {
goto doPart;
}
if (ssl->decrypt.setup != 1) { if (ssl->decrypt.setup != 1) {
SetError(DECRYPT_KEYS_NOT_SETUP, error, session, FATAL_ERROR_STATE); SetError(DECRYPT_KEYS_NOT_SETUP, error, session, FATAL_ERROR_STATE);
return -1; return -1;
@ -5025,6 +5033,7 @@ doMessage:
SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE); SetError(MEMORY_STR, error, session, FATAL_ERROR_STATE);
return -1; return -1;
} }
sslFrame = DecryptMessage(ssl, sslFrame, rhSize, sslFrame = DecryptMessage(ssl, sslFrame, rhSize,
ssl->buffers.outputBuffer.buffer, &errCode, ssl->buffers.outputBuffer.buffer, &errCode,
&ivAdvance, &rh); &ivAdvance, &rh);