wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-29 18:27:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5705 from icing/earlydata-client

Browse Source
This commit is contained in:
Hayden Roche
2022-10-18 07:26:46 -07:00
committed by GitHub
parent a272731d45 9726d1f6eb
commit c5df62e647
6 changed files with 24 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
doc/dox_comments/header_files/ssl.h
View File

@ -13754,15 +13754,16 @@ wolfSSL_accept_TLSv13(WOLFSSL* ssl);
/*!
\ingroup Setup
\brief This function sets the maximum amount of early data that will be
accepted by a TLS v1.3 server using the wolfSSL context.
\brief This function sets the maximum amount of early data that a
TLS v1.3 client or server is willing to exchange using the wolfSSL context.
Call this function to limit the amount of early data to process to mitigate
replay attacks. Early data is protected by keys derived from those of the
connection that the session ticket was sent and therefore will be the same
every time a session ticket is used in resumption.
The value is included in the session ticket for resumption.
A value of zero indicates no early data is to be sent by client using
session tickets.
A server value of zero indicates no early data is to be sent by client using
session tickets. A client value of zero indicates that the client will
not send any early data.
It is recommended that the number of early data bytes be kept as low as
practically possible in the application.
@ -13771,7 +13772,6 @@ wolfSSL_accept_TLSv13(WOLFSSL* ssl);
\param [in] sz the amount of early data to accept in bytes.
\return BAD_FUNC_ARG if ctx is NULL or not using TLS v1.3.
\return SIDE_ERROR if called with a client.
\return 0 if successful.
_Example_
@ -13795,15 +13795,16 @@ int wolfSSL_CTX_set_max_early_data(WOLFSSL_CTX* ctx,
/*!
\ingroup Setup
\brief This function sets the maximum amount of early data that will be
accepted by a TLS v1.3 server using the wolfSSL context.
\brief This function sets the maximum amount of early data that a
TLS v1.3 client or server is willing to exchange.
Call this function to limit the amount of early data to process to mitigate
replay attacks. Early data is protected by keys derived from those of the
connection that the session ticket was sent and therefore will be the same
every time a session ticket is used in resumption.
The value is included in the session ticket for resumption.
A value of zero indicates no early data is to be sent by client using
session tickets.
A server value of zero indicates no early data is to be sent by client using
session tickets. A client value of zero indicates that the client will
not send any early data.
It is recommended that the number of early data bytes be kept as low as
practically possible in the application.
@ -13811,7 +13812,6 @@ int wolfSSL_CTX_set_max_early_data(WOLFSSL_CTX* ctx,
\param [in] sz the amount of early data to accept from client in bytes.
\return BAD_FUNC_ARG if ssl is NULL or not using TLS v1.3.
\return SIDE_ERROR if called with a client.
\return 0 if successful.
_Example_

8
src/quic.c
View File

@ -273,7 +273,6 @@ void wolfSSL_quic_clear(WOLFSSL* ssl)
}
ssl->quic.enc_level_write = wolfssl_encryption_initial;
ssl->quic.enc_level_latest_recvd = wolfssl_encryption_initial;
ssl->quic.early_data_enabled = 0;
while ((qd = ssl->quic.input_head)) {
ssl->quic.input_head = qd->next;
@ -547,10 +546,7 @@ void wolfSSL_set_quic_early_data_enabled(WOLFSSL* ssl, int enabled)
WOLFSSL_MSG("wolfSSL_set_quic_early_data_enabled: handshake started");
}
else {
ssl->quic.early_data_enabled = enabled;
if (ssl->options.side != WOLFSSL_CLIENT_END) {
wolfSSL_set_max_early_data(ssl, enabled ? UINT32_MAX : 0);
}
wolfSSL_set_max_early_data(ssl, enabled ? UINT32_MAX : 0);
}
}
#endif /* WOLFSSL_EARLY_DATA */
@ -578,7 +574,7 @@ int wolfSSL_quic_do_handshake(WOLFSSL* ssl)
* This confuses the QUIC state handling.
*/
#ifdef WOLFSSL_EARLY_DATA
if (ssl->quic.early_data_enabled) {
if (ssl->options.maxEarlyDataSz) {
byte tmpbuffer[256];
int len;

16
src/tls13.c
View File

@ -12265,22 +12265,22 @@ int wolfSSL_CTX_set_max_early_data(WOLFSSL_CTX* ctx, unsigned int sz)
#endif
}
/* Sets the maximum amount of early data that can be seen by server when using
* session tickets for resumption.
* A value of zero indicates no early data is to be sent by client using session
* tickets.
/* Sets the maximum amount of early data that a client or server would like
* to exchange. Servers will advertise this value in session tickets sent
* to a client.
* A value of zero indicates no early data will be sent by a client, or
* no early data is accepted by a server (and announced as such in send out
* session tickets).
*
* ssl The SSL/TLS object.
* sz Maximum size of the early data.
* returns BAD_FUNC_ARG when ssl is NULL, or not using TLS v1.3,
* SIDE_ERROR when not a server and 0 on success.
* and 0 on success.
*/
int wolfSSL_set_max_early_data(WOLFSSL* ssl, unsigned int sz)
{
if (ssl == NULL || !IsAtLeastTLSv1_3(ssl->version))
return BAD_FUNC_ARG;
if (ssl->options.side == WOLFSSL_CLIENT_END)
return SIDE_ERROR;
ssl->options.maxEarlyDataSz = sz;
#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_ERROR_CODE_OPENSSL)
@ -12324,8 +12324,6 @@ int wolfSSL_get_max_early_data(WOLFSSL* ssl)
{
if (ssl == NULL || !IsAtLeastTLSv1_3(ssl->version))
return BAD_FUNC_ARG;
if (ssl->options.side == WOLFSSL_CLIENT_END)
return SIDE_ERROR;
return ssl->options.maxEarlyDataSz;
}

8
tests/api.c
View File

@ -51290,11 +51290,11 @@ static int test_tls13_apis(void)
#endif
#ifndef NO_WOLFSSL_CLIENT
#ifndef OPENSSL_EXTRA
AssertIntEQ(wolfSSL_set_max_early_data(clientSsl, 0), SIDE_ERROR);
AssertIntEQ(wolfSSL_get_max_early_data(clientSsl), SIDE_ERROR);
AssertIntEQ(wolfSSL_set_max_early_data(clientSsl, 17), 0);
AssertIntEQ(wolfSSL_get_max_early_data(clientSsl), 17);
#else
AssertIntEQ(SSL_set_max_early_data(clientSsl, 0), SIDE_ERROR);
AssertIntEQ(SSL_get_max_early_data(clientSsl), SIDE_ERROR);
AssertIntEQ(SSL_set_max_early_data(clientSsl, 17), WOLFSSL_SUCCESS);
AssertIntEQ(SSL_get_max_early_data(clientSsl), 17);
#endif
#endif
#ifndef NO_WOLFSSL_SERVER

1
wolfcrypt/test/test.c
View File

@ -399,6 +399,7 @@ typedef struct testVector {
#endif
PRAGMA_GCC("GCC diagnostic ignored \"-Wunused-function\"")
PRAGMA_CLANG("clang diagnostic ignored \"-Wunused-function\"")
WOLFSSL_TEST_SUBROUTINE int error_test(void);
WOLFSSL_TEST_SUBROUTINE int base64_test(void);

1
wolfssl/internal.h
View File

@ -5235,7 +5235,6 @@ struct WOLFSSL {
WOLFSSL_ENCRYPTION_LEVEL enc_level_write;
WOLFSSL_ENCRYPTION_LEVEL enc_level_write_next;
int transport_version;
int early_data_enabled;
const QuicTransportParam* transport_local;
const QuicTransportParam* transport_peer;
const QuicTransportParam* transport_peer_draft;