eden-emu/mbedtls
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enable support for psa opaque ECDHE-PSK key exchange on the server side

Browse source 
Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
This commit is contained in:
Przemek Stekiel 2022-04-14 08:33:29 +02:00
parent 19b80f8151
commit 14d11b0877
2 changed files with 31 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

50
library/ssl_tls12_server.c
View file

@ -4112,10 +4112,6 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
psa_status_t destruction_status = PSA_ERROR_CORRUPTION_DETECTED;
uint8_t ecpoint_len;
/* Opaque PSKs are currently only supported for PSK-only. */
if( ssl_use_opaque_psk( ssl ) == 1 )
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
mbedtls_ssl_handshake_params *handshake = ssl->handshake;
if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
@ -4188,28 +4184,38 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
const unsigned char *psk = NULL;
size_t psk_len = 0;
if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
== MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
/*
* This should never happen because the existence of a PSK is always
* checked before calling this function
*/
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* In case of opaque psk skip writting psk to pms.
* Opaque key will be handled later. */
if( ssl_use_opaque_psk( ssl ) == 0 )
{
if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
== MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
/*
* This should never happen because the existence of a PSK is always
* checked before calling this function
*/
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* opaque psk<0..2^16-1>; */
if( (size_t)( psm_end - psm ) < ( 2 + psk_len ) )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
/* opaque psk<0..2^16-1>; */
if( (size_t)( psm_end - psm ) < ( 2 + psk_len ) )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
/* Write the PSK length as uint16 */
MBEDTLS_PUT_UINT16_BE( psk_len, psm, 0 );
psm += 2;
/* Write the PSK length as uint16 */
MBEDTLS_PUT_UINT16_BE( psk_len, psm, 0 );
psm += 2;
/* Write the PSK itself */
memcpy( psm, psk, psk_len );
psm += psk_len;
/* Write the PSK itself */
memcpy( psm, psk, psk_len );
psm += psk_len;
ssl->handshake->pmslen = psm - ssl->handshake->premaster;
#else
ssl->handshake->pmslen = psm - ssl->handshake->premaster;
}
else
{
MBEDTLS_SSL_DEBUG_MSG( 1,
( "skip PMS generation for opaque ECDHE-PSK" ) );
}
#else /* MBEDTLS_USE_PSA_CRYPTO */
if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, ( "ssl_parse_client_psk_identity" ), ret );