lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-28 00:21:48 +03:00
Code Activity

Add injection of dummy's ChangeCipherSpec for middlebox compatibility

Browse Source 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
This commit is contained in:
Ronald Cron
2021-11-24 16:25:31 +01:00
parent fdb0e3f381
commit 49ad6197ca
4 changed files with 125 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
library/ssl_tls13_client.c
View File

@ -723,8 +723,18 @@ static int ssl_tls13_write_client_hello_body( mbedtls_ssl_context *ssl,
* ( also known as ossification ). Otherwise, it MUST be set as a zero-length
* vector ( i.e., a zero-valued single byte length field ).
*/
#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
MBEDTLS_SSL_CHK_BUF_PTR( p, end, ssl->session_negotiate->id_len + 1 );
*p++ = (unsigned char)ssl->session_negotiate->id_len;
memcpy( p, ssl->session_negotiate->id, ssl->session_negotiate->id_len );
p += ssl->session_negotiate->id_len;
MBEDTLS_SSL_DEBUG_BUF( 3, "session id", ssl->session_negotiate->id,
ssl->session_negotiate->id_len );
#else
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 1 );
*p++ = 0; /* session id length set to zero */
#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
/* Write cipher_suites */
ret = ssl_tls13_write_client_hello_cipher_suites( ssl, p, end, &output_len );
@ -843,6 +853,24 @@ static int ssl_tls13_prepare_client_hello( mbedtls_ssl_context *ssl )
return( ret );
}
#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
/*
* Create a session identifier for the purpose of middlebox compatibility
* only if one has not been created already.
*/
if( ssl->session_negotiate->id_len == 0 )
{
/* Creating a session id with 32 byte length */
if( ( ret = ssl->conf->f_rng( ssl->conf->p_rng,
ssl->session_negotiate->id, 32 ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "creating session id failed", ret );
return( ret );
}
ssl->session_negotiate->id_len = 32;
}
#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
return( 0 );
}
@ -1611,8 +1639,14 @@ static int ssl_tls13_process_server_finished( mbedtls_ssl_context *ssl )
if( ret != 0 )
return( ret );
mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake );
#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
mbedtls_ssl_handshake_set_state(
ssl,
MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED );
#else
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_CLIENT_FINISHED );
#endif
return( 0 );
}
@ -1623,6 +1657,8 @@ static int ssl_tls13_write_client_finished( mbedtls_ssl_context *ssl )
{
int ret;
mbedtls_ssl_set_outbound_transform( ssl, ssl->handshake->transform_handshake );
ret = mbedtls_ssl_tls13_write_finished_message( ssl );
if( ret != 0 )
return( ret );
@ -1713,6 +1749,15 @@ int mbedtls_ssl_tls13_handshake_client_step( mbedtls_ssl_context *ssl )
ret = ssl_tls13_handshake_wrapup( ssl );
break;
/*
* Injection of dummy-CCS's for middlebox compatibility
*/
#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED:
ret = mbedtls_ssl_tls13_write_change_cipher_spec( ssl );
break;
#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */
default:
MBEDTLS_SSL_DEBUG_MSG( 1, ( "invalid state %d", ssl->state ) );
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );