eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

TLS 1.3: SRV: Check ticket_flags in kex mode determination

Browse source 
When determining the key exchange mode, ticket_flags
should be checked so that the server won't select the
kex mode that is forbidden from session ticket.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>
This commit is contained in:
Pengyu Lv 2023-01-18 17:02:52 +08:00
parent 9b84ea75de
commit 0b740bc85b
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
library/ssl_tls13_server.c
View file

@ -980,6 +980,16 @@ MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_tls13_check_psk_key_exchange(mbedtls_ssl_context *ssl) static int ssl_tls13_check_psk_key_exchange(mbedtls_ssl_context *ssl)
{ {
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED)
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
if (ssl->handshake->resume) {
if (!mbedtls_ssl_session_get_ticket_flags(
ssl->session_negotiate,
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK)) {
return 0;
}
}
#endif
return mbedtls_ssl_conf_tls13_psk_enabled(ssl) && return mbedtls_ssl_conf_tls13_psk_enabled(ssl) &&
mbedtls_ssl_tls13_psk_enabled(ssl) && mbedtls_ssl_tls13_psk_enabled(ssl) &&
ssl_tls13_client_hello_has_exts_for_psk_key_exchange(ssl); ssl_tls13_client_hello_has_exts_for_psk_key_exchange(ssl);
@ -993,6 +1003,16 @@ MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_tls13_check_psk_ephemeral_key_exchange(mbedtls_ssl_context *ssl) static int ssl_tls13_check_psk_ephemeral_key_exchange(mbedtls_ssl_context *ssl)
{ {
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
if (ssl->handshake->resume) {
if (!mbedtls_ssl_session_get_ticket_flags(
ssl->session_negotiate,
MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL)) {
return 0;
}
}
#endif
return mbedtls_ssl_conf_tls13_psk_ephemeral_enabled(ssl) && return mbedtls_ssl_conf_tls13_psk_ephemeral_enabled(ssl) &&
mbedtls_ssl_tls13_psk_ephemeral_enabled(ssl) && mbedtls_ssl_tls13_psk_ephemeral_enabled(ssl) &&
ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(ssl); ssl_tls13_client_hello_has_exts_for_psk_ephemeral_key_exchange(ssl);