wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-29 18:27:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

ssl: add new wolfSSL_disable_hrr_cookie() API to disable hrr cookie

Browse Source 
Add a way to disable hrr cookie so it can be enabled by default for DTLS
connections.
This commit is contained in:
Marco Oliverio
2022-08-26 12:21:37 +02:00
parent db6d69143e
commit edd723cc84
3 changed files with 56 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
doc/dox_comments/header_files/ssl.h
View File

@ -13052,10 +13052,13 @@ int wolfSSL_connect(WOLFSSL* ssl);
\ingroup Setup
\brief This function is called on the server side to indicate that a
HelloRetryRequest message must contain a Cookie.
The Cookie holds a hash of the current transcript so that another server
process can handle the ClientHello in reply.
The secret is used when generting the integrity check on the Cookie data.
HelloRetryRequest message must contain a Cookie and, in case of using
protocol DTLS v1.3, that the handshake will always include a cookie
exchange. Please note that when using protocol DTLS v1.3, the cookie
exchange is enabled by default. The Cookie holds a hash of the current
transcript so that another server process can handle the ClientHello in
reply. The secret is used when generting the integrity check on the Cookie
data.
\param [in,out] ssl a pointer to a WOLFSSL structure, created using wolfSSL_new().
\param [in] secret a pointer to a buffer holding the secret.
@ -13082,10 +13085,31 @@ int wolfSSL_connect(WOLFSSL* ssl);
\endcode
\sa wolfSSL_new
\sa wolfSSL_disable_hrr_cookie
*/
int wolfSSL_send_hrr_cookie(WOLFSSL* ssl,
const unsigned char* secret, unsigned int secretSz);
/*!
\ingroup Setup
\brief This function is called on the server side to indicate that a
HelloRetryRequest message must NOT contain a Cookie and that, if using
protocol DTLS v1.3, a cookie exchange will not be included in the
handshake. Please note that not doing a cookie exchange when using protocol
DTLS v1.3 can make the server susceptible to DoS/Amplification attacks.
\param [in,out] ssl a pointer to a WOLFSSL structure, created using wolfSSL_new().
\return WOLFSSL_SUCCESS if successful
\return BAD_FUNC_ARG if ssl is NULL or not using TLS v1.3
\return SIDE_ERROR if invoked on client
\sa wolfSSL_send_hrr_cookie
*/
int wolfSSL_disable_hrr_cookie(WOLFSSL* ssl);
/*!
\ingroup Setup

28
src/tls13.c
View File

@ -10628,7 +10628,33 @@ int wolfSSL_send_hrr_cookie(WOLFSSL* ssl, const unsigned char* secret,
return ret;
}
#endif
int wolfSSL_disable_hrr_cookie(WOLFSSL* ssl)
{
if (ssl == NULL || !IsAtLeastTLSv1_3(ssl->version))
return BAD_FUNC_ARG;
#ifdef NO_WOLFSSL_SERVER
return SIDE_ERROR
#else
if (ssl->options.side == WOLFSSL_CLIENT_END)
return SIDE_ERROR;
if (ssl->buffers.tls13CookieSecret.buffer != NULL) {
ForceZero(ssl->buffers.tls13CookieSecret.buffer,
ssl->buffers.tls13CookieSecret.length);
XFREE(ssl->buffers.tls13CookieSecret.buffer, ssl->heap,
DYNAMIC_TYPE_COOKIE_PWD);
ssl->buffers.tls13CookieSecret.buffer = NULL;
ssl->buffers.tls13CookieSecret.length = 0;
}
ssl->options.sendCookie = 0;
return WOLFSSL_SUCCESS;
#endif /* NO_WOLFSSL_SERVER */
}
#endif /* defined(WOLFSSL_SEND_HRR_COOKIE) */
#ifdef HAVE_SUPPORTED_CURVES
/* Create a key share entry from group.

1
wolfssl/ssl.h
View File

@ -1144,6 +1144,7 @@ WOLFSSL_API int wolfSSL_mutual_auth(WOLFSSL* ssl, int req);
#ifdef WOLFSSL_TLS13
WOLFSSL_API int wolfSSL_send_hrr_cookie(WOLFSSL* ssl,
const unsigned char* secret, unsigned int secretSz);
WOLFSSL_API int wolfSSL_disable_hrr_cookie(WOLFSSL * ssl);
WOLFSSL_API int wolfSSL_CTX_no_ticket_TLSv13(WOLFSSL_CTX* ctx);
WOLFSSL_API int wolfSSL_no_ticket_TLSv13(WOLFSSL* ssl);
WOLFSSL_API int wolfSSL_CTX_no_dhe_psk(WOLFSSL_CTX* ctx);