mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-02-27 15:40:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Adapt ssl_write_encrypted_pms() to use raw public key

Browse Source 
We must dispatch between the peer's public key stored as part of
the peer's CRT in the current session structure (situation until
now, and future behaviour if MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is
enabled), and the sole public key stored in the handshake structure
(new, if MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is disabled).
This commit is contained in:
Hanno Becker 2019-02-06 16:49:54 +00:00
parent a27475335a
commit c7d7e29b46
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
library/ssl_cli.c
View File

@ -2265,6 +2265,7 @@ static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
int ret; int ret;
size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2; size_t len_bytes = ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2;
unsigned char *p = ssl->handshake->premaster + pms_offset; unsigned char *p = ssl->handshake->premaster + pms_offset;
mbedtls_pk_context * peer_pk;
if( offset + len_bytes > MBEDTLS_SSL_OUT_CONTENT_LEN ) if( offset + len_bytes > MBEDTLS_SSL_OUT_CONTENT_LEN )
{ {
@ -2290,23 +2291,27 @@ static int ssl_write_encrypted_pms( mbedtls_ssl_context *ssl,
ssl->handshake->pmslen = 48; ssl->handshake->pmslen = 48;
#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
peer_pk = &ssl->handshake->peer_pubkey;
#else /* !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
if( ssl->session_negotiate->peer_cert == NULL ) if( ssl->session_negotiate->peer_cert == NULL )
{ {
/* Should never happen */ /* Should never happen */
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
} }
peer_pk = &ssl->session_negotiate->peer_cert->pk;
#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
/* /*
* Now write it out, encrypted * Now write it out, encrypted
*/ */
if( ! mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, if( ! mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_RSA ) )
MBEDTLS_PK_RSA ) )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) ); MBEDTLS_SSL_DEBUG_MSG( 1, ( "certificate key type mismatch" ) );
return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH ); return( MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH );
} }
if( ( ret = mbedtls_pk_encrypt( &ssl->session_negotiate->peer_cert->pk, if( ( ret = mbedtls_pk_encrypt( peer_pk,
p, ssl->handshake->pmslen, p, ssl->handshake->pmslen,
ssl->out_msg + offset + len_bytes, olen, ssl->out_msg + offset + len_bytes, olen,
MBEDTLS_SSL_OUT_CONTENT_LEN - offset - len_bytes, MBEDTLS_SSL_OUT_CONTENT_LEN - offset - len_bytes,