wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-08-03 04:34:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Don't allocate Suites object on renegotiation

Browse Source
This commit is contained in:
Juliusz Sosinowicz
2023-01-04 15:00:27 +01:00
committed by David Garske
parent 2f63fdc6ce
commit a58e83847e
2 changed files with 38 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
src/internal.c
View File

@@ -26067,8 +26067,14 @@ static int HashSkeData(WOLFSSL* ssl, enum wc_HashType hashType,
#endif #endif
length = VERSION_SZ + RAN_LEN length = VERSION_SZ + RAN_LEN
+ idSz + ENUM_LEN + idSz + ENUM_LEN
+ suites->suiteSz + SUITE_LEN + SUITE_LEN
+ COMP_LEN + ENUM_LEN; + COMP_LEN + ENUM_LEN;
#ifndef NO_FORCE_SCR_SAME_SUITE
if (IsSCR(ssl))
length += SUITE_LEN;
else
#endif
length += suites->suiteSz;
#ifdef HAVE_TLS_EXTENSIONS #ifdef HAVE_TLS_EXTENSIONS
/* auto populate extensions supported unless user defined */ /* auto populate extensions supported unless user defined */
@@ -26163,11 +26169,23 @@ static int HashSkeData(WOLFSSL* ssl, enum wc_HashType hashType,
} }
} }
#endif #endif
#ifndef NO_FORCE_SCR_SAME_SUITE
if (IsSCR(ssl)) {
c16toa(SUITE_LEN, output + idx);
idx += OPAQUE16_LEN;
output[idx++] = ssl->options.cipherSuite0;
output[idx++] = ssl->options.cipherSuite;
}
else
#endif
{
/* then cipher suites */ /* then cipher suites */
c16toa(suites->suiteSz, output + idx); c16toa(suites->suiteSz, output + idx);
idx += OPAQUE16_LEN; idx += OPAQUE16_LEN;
XMEMCPY(output + idx, &suites->suites, suites->suiteSz); XMEMCPY(output + idx, &suites->suites, suites->suiteSz);
idx += suites->suiteSz; idx += suites->suiteSz;
}
/* last, compression */ /* last, compression */
output[idx++] = COMP_LEN; output[idx++] = COMP_LEN;
@@ -26597,9 +26615,9 @@ static int HashSkeData(WOLFSSL* ssl, enum wc_HashType hashType,
cs0 = input[i++]; cs0 = input[i++];
cs1 = input[i++]; cs1 = input[i++];
#ifdef HAVE_SECURE_RENEGOTIATION #ifndef WOLFSSL_NO_STRICT_CIPHER_SUITE
if (ssl->secure_renegotiation && ssl->secure_renegotiation->enabled && #if defined(HAVE_SECURE_RENEGOTIATION) && !defined(NO_FORCE_SCR_SAME_SUITE)
ssl->options.handShakeDone) { if (IsSCR(ssl)) {
if (ssl->options.cipherSuite0 != cs0 || if (ssl->options.cipherSuite0 != cs0 ||
ssl->options.cipherSuite != cs1) { ssl->options.cipherSuite != cs1) {
WOLFSSL_MSG("Server changed cipher suite during scr"); WOLFSSL_MSG("Server changed cipher suite during scr");
@@ -26607,19 +26625,8 @@ static int HashSkeData(WOLFSSL* ssl, enum wc_HashType hashType,
return MATCH_SUITE_ERROR; return MATCH_SUITE_ERROR;
} }
} }
else
#endif #endif
ssl->options.cipherSuite0 = cs0;
ssl->options.cipherSuite = cs1;
#ifdef WOLFSSL_DEBUG_TLS
WOLFSSL_MSG("Chosen cipher suite:");
WOLFSSL_MSG(GetCipherNameInternal(ssl->options.cipherSuite0,
ssl->options.cipherSuite));
#endif
compression = input[i++];
#ifndef WOLFSSL_NO_STRICT_CIPHER_SUITE
{ {
word32 idx, found = 0; word32 idx, found = 0;
const Suites* suites = WOLFSSL_SUITES(ssl); const Suites* suites = WOLFSSL_SUITES(ssl);
@@ -26639,6 +26646,16 @@ static int HashSkeData(WOLFSSL* ssl, enum wc_HashType hashType,
} }
#endif /* !WOLFSSL_NO_STRICT_CIPHER_SUITE */ #endif /* !WOLFSSL_NO_STRICT_CIPHER_SUITE */
ssl->options.cipherSuite0 = cs0;
ssl->options.cipherSuite = cs1;
#ifdef WOLFSSL_DEBUG_TLS
WOLFSSL_MSG("Chosen cipher suite:");
WOLFSSL_MSG(GetCipherNameInternal(ssl->options.cipherSuite0,
ssl->options.cipherSuite));
#endif
compression = input[i++];
if (compression != NO_COMPRESSION && !ssl->options.usingCompression) { if (compression != NO_COMPRESSION && !ssl->options.usingCompression) {
WOLFSSL_MSG("Server forcing compression w/o support"); WOLFSSL_MSG("Server forcing compression w/o support");
WOLFSSL_ERROR_VERBOSE(COMPRESSION_ERROR); WOLFSSL_ERROR_VERBOSE(COMPRESSION_ERROR);

10
src/ssl.c
View File

@@ -3249,16 +3249,6 @@ static int _Rehandshake(WOLFSSL* ssl)
} }
} }
#ifndef NO_FORCE_SCR_SAME_SUITE
/* force same suite */
ret = AllocateSuites(ssl);
if (ret != 0)
return ret;
ssl->suites->suiteSz = SUITE_LEN;
ssl->suites->suites[0] = ssl->options.cipherSuite0;
ssl->suites->suites[1] = ssl->options.cipherSuite;
#endif
/* reset handshake states */ /* reset handshake states */
ssl->options.sendVerify = 0; ssl->options.sendVerify = 0;
ssl->options.serverState = NULL_STATE; ssl->options.serverState = NULL_STATE;