lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-30 22:43:08 +03:00
Code Activity

Add dummy ticket support

Browse Source 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
This commit is contained in:
Jerry Yu
2022-09-15 18:32:34 +08:00
parent b300e3c5be
commit 25ab654781
4 changed files with 339 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

119
programs/ssl/ssl_server2.c
View File

@ -120,6 +120,7 @@ int main( void )
#define DFL_MFL_CODE MBEDTLS_SSL_MAX_FRAG_LEN_NONE
#define DFL_TRUNC_HMAC -1
#define DFL_TICKETS MBEDTLS_SSL_SESSION_TICKETS_ENABLED
#define DFL_DUMMY_TICKET 0
#define DFL_TICKET_ROTATE 0
#define DFL_TICKET_TIMEOUT 86400
#define DFL_TICKET_AEAD MBEDTLS_CIPHER_AES_256_GCM
@ -638,6 +639,7 @@ struct options
unsigned char mfl_code; /* code for maximum fragment length */
int trunc_hmac; /* accept truncated hmac? */
int tickets; /* enable / disable session tickets */
int dummy_ticket; /* enable / disable dummy ticket generator */
int ticket_rotate; /* session ticket rotate (code coverage) */
int ticket_timeout; /* session ticket lifetime */
int ticket_aead; /* session ticket protection */
@ -1351,6 +1353,79 @@ int report_cid_usage( mbedtls_ssl_context *ssl,
}
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
defined(MBEDTLS_SSL_SESSION_TICKETS) && \
defined(MBEDTLS_HAVE_TIME)
/* Functions for session ticket tests
*
*/
int dummy_ticket_write( void *p_ticket, const mbedtls_ssl_session *session,
unsigned char *start, const unsigned char *end,
size_t *tlen, uint32_t *ticket_lifetime )
{
int ret;
unsigned char *p = start;
size_t clear_len;
((void) p_ticket);
if( end - p < 4 )
{
return( MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL );
}
*((uint32_t *)p) = 7 * 24 * 3600;
*ticket_lifetime = 7 * 24 * 3600;
p += 4;
/* Dump session state */
if( ( ret = mbedtls_ssl_session_save( session, p, end - p,
&clear_len ) ) != 0 )
{
return( ret );
}
*tlen = 4 + clear_len;
return( 0 );
}
int dummy_ticket_parse( void *p_ticket, mbedtls_ssl_session *session,
unsigned char *buf, size_t len )
{
int ret;
((void) p_ticket);
if( ( ret = mbedtls_ssl_session_load( session, buf + 4, len - 4 ) ) != 0 )
return( ret );
switch( opt.dummy_ticket % 7 )
{
case 1:
return( MBEDTLS_ERR_SSL_INVALID_MAC );
case 2:
return( MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED );
case 3:
session->start = mbedtls_time( NULL ) + 10;
break;
case 4:
session->start = mbedtls_time( NULL ) - 10 - 7 * 24 * 3600;
break;
case 5:
session->start = mbedtls_time( NULL ) - 10;
break;
case 6:
session->start = mbedtls_time( NULL );
session->ticket_age_add -= 1000;
break;
default:
break;
}
return( ret );
}
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
MBEDTLS_SSL_SESSION_TICKETS &&
MBEDTLS_HAVE_TIME */
int main( int argc, char *argv[] )
{
int ret = 0, len, written, frags, exchanges_left;
@ -1607,6 +1682,7 @@ int main( int argc, char *argv[] )
opt.mfl_code = DFL_MFL_CODE;
opt.trunc_hmac = DFL_TRUNC_HMAC;
opt.tickets = DFL_TICKETS;
opt.dummy_ticket = DFL_DUMMY_TICKET;
opt.ticket_rotate = DFL_TICKET_ROTATE;
opt.ticket_timeout = DFL_TICKET_TIMEOUT;
opt.ticket_aead = DFL_TICKET_AEAD;
@ -2002,6 +2078,12 @@ int main( int argc, char *argv[] )
if( opt.tickets < 0 )
goto usage;
}
else if( strcmp( p, "dummy_ticket" ) == 0 )
{
opt.dummy_ticket = atoi( q );
if( opt.dummy_ticket < 0 )
goto usage;
}
else if( strcmp( p, "ticket_rotate" ) == 0 )
{
opt.ticket_rotate = atoi( q );
@ -2919,19 +3001,36 @@ int main( int argc, char *argv[] )
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
if( opt.tickets != MBEDTLS_SSL_SESSION_TICKETS_DISABLED )
{
if( ( ret = mbedtls_ssl_ticket_setup( &ticket_ctx,
rng_get, &rng,
opt.ticket_aead,
opt.ticket_timeout ) ) != 0 )
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
defined(MBEDTLS_SSL_SESSION_TICKETS) && \
defined(MBEDTLS_HAVE_TIME)
if( opt.dummy_ticket )
{
mbedtls_printf( " failed\n ! mbedtls_ssl_ticket_setup returned %d\n\n", ret );
goto exit;
mbedtls_ssl_conf_session_tickets_cb( &conf,
dummy_ticket_write,
dummy_ticket_parse,
NULL );
}
else
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
MBEDTLS_SSL_SESSION_TICKETS &&
MBEDTLS_HAVE_TIME */
{
if( ( ret = mbedtls_ssl_ticket_setup( &ticket_ctx,
rng_get, &rng,
opt.ticket_aead,
opt.ticket_timeout ) ) != 0 )
{
mbedtls_printf( " failed\n ! mbedtls_ssl_ticket_setup returned %d\n\n", ret );
goto exit;
}
mbedtls_ssl_conf_session_tickets_cb( &conf,
mbedtls_ssl_ticket_write,
mbedtls_ssl_ticket_parse,
&ticket_ctx );
}
mbedtls_ssl_conf_session_tickets_cb( &conf,
mbedtls_ssl_ticket_write,
mbedtls_ssl_ticket_parse,
&ticket_ctx );
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
mbedtls_ssl_conf_new_session_tickets( &conf, opt.tickets );
#endif