wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-01-30 07:32:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

TLS Session Ticket: Option to disable for TLS 1.2 and below

Browse Source 
Customer may want session ticket supported with TLS 1.3 but not TLS 1.2
and below.
This commit is contained in:
Sean Parkinson
2021-01-22 11:27:23 +10:00
parent 4b47bf7b4e
commit a84f1c813a
8 changed files with 151 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/internal.c
View File

@@ -904,6 +904,7 @@ static int dtls_export_new(WOLFSSL* ssl, byte* exp, word32 len, byte ver)
#ifdef HAVE_SESSION_TICKET
exp[idx++] = options->createTicket;
exp[idx++] = options->useTicket;
exp[idx++] = options->noTicketTls12;
#ifdef WOLFSSL_TLS13
if (ver > DTLS_EXPORT_VERSION_3) {
exp[idx++] = options->noTicketTls13;
@@ -1069,6 +1070,7 @@ static int dtls_export_load(WOLFSSL* ssl, const byte* exp, word32 len, byte ver)
#ifdef HAVE_SESSION_TICKET
options->createTicket = exp[idx++]; /* Server to create new Ticket */
options->useTicket = exp[idx++]; /* Use Ticket not session cache */
options->noTicketTls12 = exp[idx++]; /* Server won't create new Ticket */
#ifdef WOLFSSL_TLS13
if (ver > DTLS_EXPORT_VERSION_3) {
options->noTicketTls13 = exp[idx++];/* Server won't create new Ticket */
@@ -5946,6 +5948,7 @@ int InitSSL(WOLFSSL* ssl, WOLFSSL_CTX* ctx, int writeDup)
#endif
#ifdef HAVE_SESSION_TICKET
ssl->options.noTicketTls12 = ctx->noTicketTls12;
ssl->session.ticket = ssl->session.staticTicket;
#endif

35
src/ssl.c
View File

@@ -2788,8 +2788,30 @@ long wolfSSL_SSL_get_secure_renegotiation_support(WOLFSSL* ssl)
#endif /* HAVE_SECURE_RENEGOTIATION */
#if defined(HAVE_SESSION_TICKET)
/* Session Ticket */
#if !defined(NO_WOLFSSL_SERVER) && defined(HAVE_SESSION_TICKET)
#if !defined(NO_WOLFSSL_SERVER)
int wolfSSL_CTX_NoTicketTLSv12(WOLFSSL_CTX* ctx)
{
if (ctx == NULL)
return BAD_FUNC_ARG;
ctx->noTicketTls12 = 1;
return WOLFSSL_SUCCESS;
}
int wolfSSL_NoTicketTLSv12(WOLFSSL* ssl)
{
if (ssl == NULL)
return BAD_FUNC_ARG;
ssl->options.noTicketTls12 = 1;
return WOLFSSL_SUCCESS;
}
/* WOLFSSL_SUCCESS on ok */
int wolfSSL_CTX_set_TicketEncCb(WOLFSSL_CTX* ctx, SessionTicketEncCb cb)
{
@@ -2823,10 +2845,9 @@ int wolfSSL_CTX_set_TicketEncCtx(WOLFSSL_CTX* ctx, void* userCtx)
return WOLFSSL_SUCCESS;
}
#endif /* !defined(NO_WOLFSSL_CLIENT) && defined(HAVE_SESSION_TICKET) */
#endif /* !NO_WOLFSSL_SERVER */
/* Session Ticket */
#if !defined(NO_WOLFSSL_CLIENT) && defined(HAVE_SESSION_TICKET)
#if !defined(NO_WOLFSSL_CLIENT)
int wolfSSL_UseSessionTicket(WOLFSSL* ssl)
{
if (ssl == NULL)
@@ -2907,7 +2928,9 @@ WOLFSSL_API int wolfSSL_set_SessionTicket_cb(WOLFSSL* ssl,
return WOLFSSL_SUCCESS;
}
#endif
#endif /* !NO_WOLFSSL_CLIENT */
#endif /* HAVE_SESSION_TICKET */
#ifdef HAVE_EXTENDED_MASTER
@@ -12805,7 +12828,7 @@ int wolfSSL_DTLS_SetCookieSecret(WOLFSSL* ssl,
case ACCEPT_SECOND_REPLY_DONE :
#ifdef HAVE_SESSION_TICKET
if (ssl->options.createTicket) {
if (ssl->options.createTicket && !ssl->options.noTicketTls12) {
if ( (ssl->error = SendTicket(ssl)) != 0) {
WOLFSSL_ERROR(ssl->error);
return WOLFSSL_FATAL_ERROR;

2
src/tls.c
View File

@@ -5068,6 +5068,8 @@ static int TLSX_SessionTicket_Parse(WOLFSSL* ssl, byte* input, word16 length,
WOLFSSL_MSG("Process client ticket rejected, TLS 1.3 no support");
ssl->options.rejectTicket = 1;
ret = 0; /* not fatal */
} else if (ssl->options.noTicketTls12) {
/* ignore ticket request */
} else if (length == 0) {
/* blank ticket */
ret = TLSX_UseSessionTicket(&ssl->extensions, NULL, ssl->heap);