lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-05 19:35:48 +03:00
Code Activity

Add cleanup in functions for secure reason

Browse Source 
Signed-off-by: XiaokangQian <xiaokang.qian@arm.com>
This commit is contained in:
XiaokangQian
2021-10-28 08:03:38 +00:00
parent f26f6ade0c
commit 61bdbbc18b
2 changed files with 27 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
library/ssl_tls13_generic.c
View File

@@ -952,7 +952,7 @@ static int ssl_tls13_finished_in_postprocess_cli( mbedtls_ssl_context *ssl )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, MBEDTLS_SSL_DEBUG_RET( 1,
"mbedtls_ssl_tls13_key_schedule_stage_application", ret ); "mbedtls_ssl_tls13_key_schedule_stage_application", ret );
return( ret ); goto cleanup;
} }
ret = mbedtls_ssl_tls1_3_generate_application_keys( ret = mbedtls_ssl_tls1_3_generate_application_keys(
@@ -961,13 +961,16 @@ static int ssl_tls13_finished_in_postprocess_cli( mbedtls_ssl_context *ssl )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, MBEDTLS_SSL_DEBUG_RET( 1,
"mbedtls_ssl_tls1_3_generate_application_keys", ret ); "mbedtls_ssl_tls1_3_generate_application_keys", ret );
return( ret ); goto cleanup;
} }
transform_application = transform_application =
mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) ); mbedtls_calloc( 1, sizeof( mbedtls_ssl_transform ) );
if( transform_application == NULL ) if( transform_application == NULL )
return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); {
ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
goto cleanup;
}
ret = mbedtls_ssl_tls13_populate_transform( ret = mbedtls_ssl_tls13_populate_transform(
transform_application, transform_application,
@@ -978,13 +981,24 @@ static int ssl_tls13_finished_in_postprocess_cli( mbedtls_ssl_context *ssl )
if( ret != 0 ) if( ret != 0 )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_populate_transform", ret );
return( ret ); goto cleanup;
} }
ssl->transform_application = transform_application; ssl->transform_application = transform_application;
mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_END_OF_EARLY_DATA ); mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_END_OF_EARLY_DATA );
return( 0 );
cleanup:
mbedtls_platform_zeroize( &traffic_keys, sizeof(mbedtls_ssl_key_set) );
if( ret != 0)
{
mbedtls_free( transform_application );
MBEDTLS_SSL_PEND_FATAL_ALERT(
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE,
MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
}
return( ret );
} }
static int ssl_tls13_finished_in_postprocess( mbedtls_ssl_context* ssl ) static int ssl_tls13_finished_in_postprocess( mbedtls_ssl_context* ssl )

20
library/ssl_tls13_keys.c
View File

@@ -567,7 +567,7 @@ int mbedtls_ssl_tls1_3_derive_resumption_master_secret(
int mbedtls_ssl_tls13_key_schedule_stage_application( int mbedtls_ssl_tls13_key_schedule_stage_application(
mbedtls_ssl_context *ssl ) mbedtls_ssl_context *ssl )
{ {
int ret = 0; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
mbedtls_md_type_t const md_type = ssl->handshake->ciphersuite_info->mac; mbedtls_md_type_t const md_type = ssl->handshake->ciphersuite_info->mac;
#if defined(MBEDTLS_DEBUG_C) #if defined(MBEDTLS_DEBUG_C)
mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type ); mbedtls_md_info_t const * const md_info = mbedtls_md_info_from_type( md_type );
@@ -671,7 +671,7 @@ int mbedtls_ssl_tls1_3_calculate_expected_finished( mbedtls_ssl_context* ssl,
if( ret != 0 ) if( ret != 0 )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_handshake_transcript", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_get_handshake_transcript", ret );
return( ret ); goto exit;
} }
MBEDTLS_SSL_DEBUG_BUF( 4, "handshake hash", transcript, transcript_len ); MBEDTLS_SSL_DEBUG_BUF( 4, "handshake hash", transcript, transcript_len );
@@ -682,12 +682,16 @@ int mbedtls_ssl_tls1_3_calculate_expected_finished( mbedtls_ssl_context* ssl,
ret = ssl_tls1_3_calc_finished_core( md_type, base_key, transcript, dst ); ret = ssl_tls1_3_calc_finished_core( md_type, base_key, transcript, dst );
if( ret != 0 ) if( ret != 0 )
return( ret ); goto exit;
*actual_len = md_size; *actual_len = md_size;
MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, md_size ); MBEDTLS_SSL_DEBUG_BUF( 3, "verify_data for finished message", dst, md_size );
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls1_3_calculate_expected_finished" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= mbedtls_ssl_tls1_3_calculate_expected_finished" ) );
return( 0 );
exit:
mbedtls_platform_zeroize( transcript, sizeof( transcript) );
return( ret );
} }
int mbedtls_ssl_tls1_3_create_psk_binder( mbedtls_ssl_context *ssl, int mbedtls_ssl_tls1_3_create_psk_binder( mbedtls_ssl_context *ssl,
@@ -1199,14 +1203,6 @@ int mbedtls_ssl_tls1_3_generate_application_keys(
cleanup: cleanup:
mbedtls_platform_zeroize( transcript, sizeof(transcript) ); mbedtls_platform_zeroize( transcript, sizeof(transcript) );
mbedtls_platform_zeroize( traffic_keys->client_write_key,
sizeof(traffic_keys->client_write_key) );
mbedtls_platform_zeroize( traffic_keys->server_write_key,
sizeof(traffic_keys->server_write_key) );
mbedtls_platform_zeroize( traffic_keys->client_write_iv,
sizeof(traffic_keys->client_write_iv) );
mbedtls_platform_zeroize( traffic_keys->server_write_iv,
sizeof(traffic_keys->server_write_iv) );
return( ret ); return( ret );
} }