lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-01 10:06:53 +03:00
Code Activity

Merge pull request #6194 from xkqian/tls13_add_psk_client_cases

Browse Source 
TLS 1.3: Add PSK client cases
This commit is contained in:
Ronald Cron
2022-09-28 17:08:06 +02:00
committed by GitHub
parent e3358e14b2 a70bd9108a
commit 77c691f099
4 changed files with 1463 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
library/ssl_tls13_client.c
View File

@ -1327,11 +1327,11 @@ static int ssl_tls13_parse_server_pre_shared_key_ext( mbedtls_ssl_context *ssl,
int ret = 0;
size_t selected_identity;
int psk_type;
const unsigned char *psk;
size_t psk_len;
const unsigned char *psk_identity;
size_t psk_identity_len;
int psk_type;
/* Check which PSK we've offered.
*
@ -1667,6 +1667,23 @@ cleanup:
return( ret );
}
#if defined(MBEDTLS_DEBUG_C)
static const char *ssl_tls13_get_kex_mode_str(int mode)
{
switch( mode )
{
case MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK:
return "psk";
case MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL:
return "ephemeral";
case MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL:
return "psk_ephemeral";
default:
return "unknown mode";
}
}
#endif /* MBEDTLS_DEBUG_C */
MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_tls13_postprocess_server_hello( mbedtls_ssl_context *ssl )
{
@ -1687,19 +1704,16 @@ static int ssl_tls13_postprocess_server_hello( mbedtls_ssl_context *ssl )
/* Only the pre_shared_key extension was received */
case MBEDTLS_SSL_EXT_PRE_SHARED_KEY:
handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK;
MBEDTLS_SSL_DEBUG_MSG( 2, ( "key exchange mode: psk" ) );
break;
/* Only the key_share extension was received */
case MBEDTLS_SSL_EXT_KEY_SHARE:
handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL;
MBEDTLS_SSL_DEBUG_MSG( 2, ( "key exchange mode: ephemeral" ) );
break;
/* Both the pre_shared_key and key_share extensions were received */
case ( MBEDTLS_SSL_EXT_PRE_SHARED_KEY | MBEDTLS_SSL_EXT_KEY_SHARE ):
handshake->key_exchange_mode = MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL;
MBEDTLS_SSL_DEBUG_MSG( 2, ( "key exchange mode: psk_ephemeral" ) );
break;
/* Neither pre_shared_key nor key_share extension was received */
@ -1709,6 +1723,19 @@ static int ssl_tls13_postprocess_server_hello( mbedtls_ssl_context *ssl )
goto cleanup;
}
if( !mbedtls_ssl_conf_tls13_check_kex_modes( ssl, handshake->key_exchange_mode ) )
{
ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
MBEDTLS_SSL_DEBUG_MSG( 2,
( "Key exchange mode(%s) is not supported.",
ssl_tls13_get_kex_mode_str( handshake->key_exchange_mode ) ) );
goto cleanup;
}
MBEDTLS_SSL_DEBUG_MSG( 3,
( "Selected key exchange mode: %s",
ssl_tls13_get_kex_mode_str( handshake->key_exchange_mode ) ) );
/* Start the TLS 1.3 key schedule: Set the PSK and derive early secret.
*
* TODO: We don't have to do this in case we offered 0-RTT and the