mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-01-26 12:35:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Rearrange the session resumption code

Browse Source 
Previously, the transforms were populated before extension
parsing, which resulted in the client rejecting a server
hello that contained a connection ID.
Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
This commit is contained in:
Andrzej Kurek 2022-06-14 07:12:33 -04:00
parent 271c3052fb
commit 7cf872557a
2 changed files with 36 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
library/ssl_tls12_client.c
View File

@ -1409,16 +1409,6 @@ static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
else
{
ssl->state = MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC;
if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
mbedtls_ssl_send_alert_message(
ssl,
MBEDTLS_SSL_ALERT_LEVEL_FATAL,
MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
return( ret );
}
}
MBEDTLS_SSL_DEBUG_MSG( 3, ( "%s session has been resumed",
@ -1654,6 +1644,19 @@ static int ssl_parse_server_hello( mbedtls_ssl_context *ssl )
}
}
if( ssl->state == MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
{
if( ( ret = mbedtls_ssl_derive_keys( ssl ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_derive_keys", ret );
mbedtls_ssl_send_alert_message(
ssl,
MBEDTLS_SSL_ALERT_LEVEL_FATAL,
MBEDTLS_SSL_ALERT_MSG_INTERNAL_ERROR );
return( ret );
}
}
/*
* Renegotiation security checks
*/

23
tests/ssl-opt.sh
View File

@ -3650,6 +3650,29 @@ run_test "Session resume using cache: openssl server" \
-C "parse new session ticket" \
-c "a session has been resumed"
# Tests for Session resume and extensions
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
requires_config_enabled MBEDTLS_SSL_DTLS_CONNECTION_ID
run_test "Session resume and connection ID" \
"$P_SRV debug_level=3 cid=1 cid_val=dead dtls=1 tickets=0" \
"$P_CLI debug_level=3 cid=1 cid_val=beef dtls=1 tickets=0 reconnect=1" \
0 \
-c "Enable use of CID extension." \
-s "Enable use of CID extension." \
-c "client hello, adding CID extension" \
-s "found CID extension" \
-s "Use of CID extension negotiated" \
-s "server hello, adding CID extension" \
-c "found CID extension" \
-c "Use of CID extension negotiated" \
-s "Copy CIDs into SSL transform" \
-c "Copy CIDs into SSL transform" \
-c "Peer CID (length 2 Bytes): de ad" \
-s "Peer CID (length 2 Bytes): be ef" \
-s "Use of Connection ID has been negotiated" \
-c "Use of Connection ID has been negotiated"
# Tests for Session Resume based on session-ID and cache, DTLS
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2