lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-28 00:21:48 +03:00
Code Activity

Add support for change of CID to ssl_client2 / ssl_server2

Browse Source 
And add tests for various CID configuration changes during
renegotiation to ssl-opt.sh.
This commit is contained in:
Hanno Becker
2019-05-03 17:30:59 +01:00
parent 2749a67d1f
commit b42ec0df02
3 changed files with 341 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files

169
programs/ssl/ssl_server2.c
View File

@ -147,6 +147,8 @@ int main( void )
#define DFL_SHA1 -1
#define DFL_CID_ENABLED 0
#define DFL_CID_VALUE ""
#define DFL_CID_ENABLED_RENEGO -1
#define DFL_CID_VALUE_RENEGO NULL
#define DFL_AUTH_MODE -1
#define DFL_CERT_REQ_CA_LIST MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED
#define DFL_MFL_CODE MBEDTLS_SSL_MAX_FRAG_LEN_NONE
@ -238,8 +240,12 @@ int main( void )
#define USAGE_CID \
" cid=%%d Disable (0) or enable (1) the use of the DTLS Connection ID extension.\n" \
" default: 0 (disabled)\n" \
" cid_renego=%%d Disable (0) or enable (1) the use of the DTLS Connection ID extension during renegotiation.\n" \
" default: same as 'cid'\n" \
" cid_val=%%s The CID to use for incoming messages (in hex, without 0x).\n" \
" default: \"\"\n"
" default: \"\"\n" \
" cid_val_renego=%%s The CID to use for incoming messages (in hex, without 0x) after renegotiation.\n" \
" default: same as 'cid_val'\n"
#else /* MBEDTLS_SSL_CID */
#define USAGE_CID ""
#endif /* MBEDTLS_SSL_CID */
@ -586,7 +592,11 @@ struct options
int badmac_limit; /* Limit of records with bad MAC */
int eap_tls; /* derive EAP-TLS keying material? */
int cid_enabled; /* whether to use the CID extension or not */
int cid_enabled_renego; /* whether to use the CID extension or not
* during renegotiation */
const char *cid_val; /* the CID to use for incoming messages */
const char *cid_val_renego; /* the CID to use for incoming messages
* after renegotiation */
} opt;
int query_config( const char *config );
@ -1434,6 +1444,56 @@ static psa_status_t psa_setup_psk_key_slot( psa_key_handle_t slot,
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */
#if defined(MBEDTLS_SSL_CID)
int report_cid_usage( mbedtls_ssl_context *ssl,
const char *additional_description )
{
int ret;
unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ];
size_t peer_cid_len;
int cid_negotiated;
if( opt.transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM )
return( 0 );
/* Check if the use of a CID has been negotiated */
ret = mbedtls_ssl_get_peer_cid( ssl, &cid_negotiated,
peer_cid, &peer_cid_len );
if( ret != 0 )
{
mbedtls_printf( " failed\n ! mbedtls_ssl_get_peer_cid returned -0x%x\n\n",
-ret );
return( ret );
}
if( cid_negotiated == MBEDTLS_SSL_CID_DISABLED )
{
if( opt.cid_enabled == MBEDTLS_SSL_CID_ENABLED )
{
mbedtls_printf( "(%s) Use of Connection ID was not offered by client.\n",
additional_description );
}
}
else
{
size_t idx=0;
mbedtls_printf( "(%s) Use of Connection ID has been negotiated.\n",
additional_description );
mbedtls_printf( "(%s) Peer CID (length %u Bytes): ",
additional_description,
(unsigned) peer_cid_len );
while( idx < peer_cid_len )
{
mbedtls_printf( "%02x ", peer_cid[ idx ] );
idx++;
}
mbedtls_printf( "\n" );
}
return( 0 );
}
#endif /* MBEDTLS_SSL_CID */
int main( int argc, char *argv[] )
{
int ret = 0, len, written, frags, exchanges_left;
@ -1505,7 +1565,9 @@ int main( int argc, char *argv[] )
#if defined(MBEDTLS_SSL_CID)
unsigned char cid[MBEDTLS_SSL_CID_IN_LEN_MAX];
unsigned char cid_renego[MBEDTLS_SSL_CID_IN_LEN_MAX];
size_t cid_len = 0;
size_t cid_renego_len = 0;
#endif
int i;
@ -1606,7 +1668,9 @@ int main( int argc, char *argv[] )
opt.response_size = DFL_RESPONSE_SIZE;
opt.nbio = DFL_NBIO;
opt.cid_enabled = DFL_CID_ENABLED;
opt.cid_enabled_renego = DFL_CID_ENABLED_RENEGO;
opt.cid_val = DFL_CID_VALUE;
opt.cid_val_renego = DFL_CID_VALUE_RENEGO;
opt.read_timeout = DFL_READ_TIMEOUT;
opt.ca_file = DFL_CA_FILE;
opt.ca_path = DFL_CA_PATH;
@ -1760,10 +1824,20 @@ int main( int argc, char *argv[] )
if( opt.cid_enabled != 0 && opt.cid_enabled != 1 )
goto usage;
}
else if( strcmp( p, "cid_renego" ) == 0 )
{
opt.cid_enabled_renego = atoi( q );
if( opt.cid_enabled_renego != 0 && opt.cid_enabled_renego != 1 )
goto usage;
}
else if( strcmp( p, "cid_val" ) == 0 )
{
opt.cid_val = q;
}
else if( strcmp( p, "cid_val_renego" ) == 0 )
{
opt.cid_val_renego = q;
}
#endif /* MBEDTLS_SSL_CID */
else if( strcmp( p, "psk" ) == 0 )
opt.psk = q;
@ -2248,22 +2322,26 @@ int main( int argc, char *argv[] )
}
}
#if defined(MBEDTLS_SSL_CID)
if( strlen( opt.cid_val ) )
{
cid_len = strlen( opt.cid_val ) / 2;
if( cid_len > sizeof( cid ) )
{
mbedtls_printf( "CID too long\n" );
goto exit;
}
if( unhexify( cid, opt.cid_val, &cid_len ) != 0 )
{
mbedtls_printf( "CID not valid hex\n" );
goto exit;
}
}
#if defined(MBEDTLS_SSL_CID)
if( unhexify( cid, opt.cid_val, &cid_len ) != 0 )
{
mbedtls_printf( "CID not valid hex\n" );
goto exit;
}
/* Keep CID settings for renegotiation unless
* specified otherwise. */
if( opt.cid_enabled_renego == DFL_CID_ENABLED_RENEGO )
opt.cid_enabled_renego = opt.cid_enabled;
if( opt.cid_val_renego == DFL_CID_VALUE_RENEGO )
opt.cid_val_renego = opt.cid_val;
if( unhexify( cid_renego, opt.cid_val_renego, &cid_renego_len ) != 0 )
{
mbedtls_printf( "CID not valid hex\n" );
goto exit;
}
#endif /* MBEDTLS_SSL_CID */
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
@ -2638,9 +2716,21 @@ int main( int argc, char *argv[] )
#endif
#if defined(MBEDTLS_SSL_CID)
if( opt.cid_enabled == 1 )
if( opt.cid_enabled == 1 || opt.cid_enabled_renego == 1 )
{
ret = mbedtls_ssl_conf_cid_len( &conf, cid_len );
if( opt.cid_enabled == 1 &&
opt.cid_enabled_renego == 1 &&
cid_len != cid_renego_len )
{
mbedtls_printf( "CID length must not change during renegotiation\n" );
goto usage;
}
if( opt.cid_enabled == 1 )
ret = mbedtls_ssl_conf_cid_len( &conf, cid_len );
else
ret = mbedtls_ssl_conf_cid_len( &conf, cid_renego_len );
if( ret != 0 )
{
mbedtls_printf( " failed\n ! mbedtls_ssl_conf_cid_len returned %d\n\n",
@ -3317,42 +3407,19 @@ handshake:
#endif
#if defined(MBEDTLS_SSL_CID)
ret = report_cid_usage( &ssl, "initial handshake" );
if( ret != 0 )
goto exit;
if( opt.transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
unsigned char peer_cid[ MBEDTLS_SSL_CID_OUT_LEN_MAX ];
size_t peer_cid_len;
int cid_negotiated;
/* Check if the use of a CID has been negotiated */
ret = mbedtls_ssl_get_peer_cid( &ssl, &cid_negotiated,
peer_cid, &peer_cid_len );
if( ret != 0 )
if( ( ret = mbedtls_ssl_set_cid( &ssl, opt.cid_enabled_renego,
cid_renego, cid_renego_len ) ) != 0 )
{
mbedtls_printf( " failed\n ! mbedtls_ssl_get_peer_cid returned -0x%x\n\n",
-ret );
mbedtls_printf( " failed\n ! mbedtls_ssl_set_cid returned %d\n\n",
ret );
goto exit;
}
if( cid_negotiated == MBEDTLS_SSL_CID_DISABLED )
{
if( opt.cid_enabled == MBEDTLS_SSL_CID_ENABLED )
{
mbedtls_printf( "Use of Connection ID was not offered by the client.\n" );
}
}
else
{
size_t idx=0;
mbedtls_printf( "Use of Connection ID has been negotiated.\n" );
mbedtls_printf( "Peer CID (length %u Bytes): ",
(unsigned) peer_cid_len );
while( idx < peer_cid_len )
{
mbedtls_printf( "%02x ", peer_cid[ idx ] );
idx++;
}
mbedtls_printf( "\n" );
}
}
#endif /* MBEDTLS_SSL_CID */
@ -3566,6 +3633,10 @@ data_exchange:
}
#endif /* MBEDTLS_SSL_RENEGOTIATION */
ret = report_cid_usage( &ssl, "after renegotiation" );
if( ret != 0 )
goto exit;
/*
* 7. Write the 200 Response
*/