ARMmbed/mbedtls
1
0
Fork 0
mirror of https://github.com/ARMmbed/mbedtls.git synced 2025-05-10 08:59:05 +08:00
Code Issues Releases Wiki Activity

Address comments base on review

Browse Source 
Change function name to ssl_session_set_hostname()
Remove hostname_len
Change hostname to c_string
Update test cases to multi session tickets

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
This commit is contained in:
Xiaokang Qian 2022-10-10 11:24:08 +00:00
parent bc663a0461
commit 2f9efd3038
6 changed files with 72 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/mbedtls/ssl.h
View File

@ -1202,7 +1202,6 @@ struct mbedtls_ssl_session
uint8_t MBEDTLS_PRIVATE(endpoint); /*!< 0: client, 1: server */ uint8_t MBEDTLS_PRIVATE(endpoint); /*!< 0: client, 1: server */
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
size_t MBEDTLS_PRIVATE(hostname_len); /*!< host_name length */
char *MBEDTLS_PRIVATE(hostname); /*!< host name binded with tickets */ char *MBEDTLS_PRIVATE(hostname); /*!< host name binded with tickets */
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */

54
library/ssl_client.c
View File

@ -713,6 +713,51 @@ static int ssl_generate_random( mbedtls_ssl_context *ssl )
MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len ); MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len );
return( ret ); return( ret );
} }
static int ssl_session_set_hostname( mbedtls_ssl_session *session,
const char *hostname )
{
/* Initialize to suppress unnecessary compiler warning */
size_t hostname_len = 0;
/* Check if new hostname is valid before
* making any change to current one */
if( hostname != NULL )
{
hostname_len = strlen( hostname );
if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
/* Now it's clear that we will overwrite the old hostname,
* so we can free it safely */
if( session->hostname != NULL )
{
mbedtls_platform_zeroize( session->hostname,
strlen( session->hostname ) );
mbedtls_free( session->hostname );
}
/* Passing NULL as hostname shall clear the old one */
if( hostname == NULL )
{
session->hostname = NULL;
}
else
{
session->hostname = mbedtls_calloc( 1, hostname_len + 1 );
if( session->hostname == NULL )
return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
memcpy( session->hostname, hostname, hostname_len );
}
return( 0 );
}
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl ) static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
{ {
@ -876,7 +921,12 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
{ {
if( ssl->hostname != NULL && ssl->session_negotiate->hostname != NULL ) if( ssl->hostname != NULL && ssl->session_negotiate->hostname != NULL )
{ {
if( strcmp( ssl->hostname, ssl->session_negotiate->hostname ) ) size_t hostname_len = strlen( ssl->hostname );
size_t negotiate_hostname_len =
strlen( ssl->session_negotiate->hostname );
if( hostname_len != negotiate_hostname_len || \
strncmp( ssl->hostname, ssl->session_negotiate->hostname,
hostname_len ) )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, MBEDTLS_SSL_DEBUG_MSG( 1,
( "hostname mismatch the session ticket, should not resume " ) ); ( "hostname mismatch the session ticket, should not resume " ) );
@ -892,7 +942,7 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
} }
else else
{ {
mbedtls_ssl_session_set_hostname( ssl->session_negotiate, ssl_session_set_hostname( ssl->session_negotiate,
ssl->hostname ); ssl->hostname );
} }
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && #endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&

5
library/ssl_misc.h
View File

@ -2200,11 +2200,6 @@ static inline int mbedtls_ssl_tls13_sig_alg_is_supported(
} }
return( 1 ); return( 1 );
} }
#if defined(MBEDTLS_X509_CRT_PARSE_C)
int mbedtls_ssl_session_set_hostname( mbedtls_ssl_session *ssl,
const char *hostname );
#endif
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) #if defined(MBEDTLS_SSL_PROTO_TLS1_2)

32
library/ssl_tls.c
View File

@ -302,12 +302,12 @@ int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
defined(MBEDTLS_SSL_CLI_C) defined(MBEDTLS_SSL_CLI_C)
if( src->endpoint == MBEDTLS_SSL_IS_CLIENT && src->hostname != NULL ) if( src->endpoint == MBEDTLS_SSL_IS_CLIENT && src->hostname != NULL )
{ {
dst->hostname = mbedtls_calloc( 1, src->hostname_len + 1 ); size_t hostname_len = strlen( src->hostname );
dst->hostname = mbedtls_calloc( 1, hostname_len + 1 );
if( dst->hostname == NULL ) if( dst->hostname == NULL )
return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
strcpy( dst->hostname, src->hostname ); strncpy( dst->hostname, src->hostname, hostname_len );
dst->hostname_len = src->hostname_len;
} }
#endif #endif
@ -1993,9 +1993,10 @@ static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
#if defined(MBEDTLS_SSL_CLI_C) #if defined(MBEDTLS_SSL_CLI_C)
if( session->endpoint == MBEDTLS_SSL_IS_CLIENT ) if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
{ {
size_t hostname_len = session->hostname == NULL?0:strlen( session->hostname );
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
needed += 2 /* hostname_len */ needed += 2 /* hostname_len */
+ session->hostname_len; /* hostname */ + hostname_len; /* hostname */
#endif #endif
needed += 4 /* ticket_lifetime */ needed += 4 /* ticket_lifetime */
@ -2027,14 +2028,15 @@ static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_CLI_C) #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_CLI_C)
if( session->endpoint == MBEDTLS_SSL_IS_CLIENT ) if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
{ {
MBEDTLS_PUT_UINT16_BE( session->hostname_len, p, 0 ); size_t hostname_len = session->hostname == NULL?0:strlen(session->hostname);
MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 );
p += 2; p += 2;
if ( session->hostname_len > 0 && if ( hostname_len > 0 &&
session->hostname != NULL ) session->hostname != NULL )
{ {
/* save host name */ /* save host name */
memcpy( p, session->hostname, session->hostname_len ); memcpy( p, session->hostname, hostname_len );
p += session->hostname_len; p += hostname_len;
} }
} }
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION && MBEDTLS_SSL_CLI_C */ #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION && MBEDTLS_SSL_CLI_C */
@ -2100,22 +2102,22 @@ static int ssl_tls13_session_load( mbedtls_ssl_session *session,
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_CLI_C) #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_CLI_C)
if( session->endpoint == MBEDTLS_SSL_IS_CLIENT ) if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
{ {
size_t hostname_len;
/* load host name */ /* load host name */
if( end - p < 2 ) if( end - p < 2 )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
session->hostname_len = MBEDTLS_GET_UINT16_BE( p, 0); hostname_len = MBEDTLS_GET_UINT16_BE( p, 0);
p += 2; p += 2;
if( end - p < ( long int )session->hostname_len ) if( end - p < ( long int )hostname_len )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
if( session->hostname_len > 0 ) if( hostname_len > 0 )
{ {
session->hostname = mbedtls_calloc( 1, session->hostname_len + 1 ); session->hostname = mbedtls_calloc( 1, hostname_len + 1 );
if( session->hostname == NULL ) if( session->hostname == NULL )
return( MBEDTLS_ERR_SSL_ALLOC_FAILED ); return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
memcpy( session->hostname, p, session->hostname_len ); memcpy( session->hostname, p, hostname_len );
session->hostname[session->hostname_len] = '\0'; p += hostname_len;
p += session->hostname_len;
} }
} }
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION && MBEDTLS_SSL_CLI_C */ #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION && MBEDTLS_SSL_CLI_C */

47
library/ssl_tls13_generic.c
View File

@ -1485,51 +1485,4 @@ int mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange(
} }
#endif /* MBEDTLS_ECDH_C */ #endif /* MBEDTLS_ECDH_C */
#if defined(MBEDTLS_X509_CRT_PARSE_C)
int mbedtls_ssl_session_set_hostname( mbedtls_ssl_session *ssl,
const char *hostname )
{
/* Initialize to suppress unnecessary compiler warning */
size_t hostname_len = 0;
/* Check if new hostname is valid before
* making any change to current one */
if( hostname != NULL )
{
hostname_len = strlen( hostname );
if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
/* Now it's clear that we will overwrite the old hostname,
* so we can free it safely */
if( ssl->hostname != NULL )
{
mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
mbedtls_free( ssl->hostname );
}
/* Passing NULL as hostname shall clear the old one */
if( hostname == NULL )
{
ssl->hostname = NULL;
}
else
{
ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
if( ssl->hostname == NULL )
return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
memcpy( ssl->hostname, hostname, hostname_len );
ssl->hostname[hostname_len] = '\0';
ssl->hostname_len = hostname_len;
}
return( 0 );
}
#endif /* MBEDTLS_X509_CRT_PARSE_C */
#endif /* MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_PROTO_TLS1_3 */ #endif /* MBEDTLS_SSL_TLS_C && MBEDTLS_SSL_PROTO_TLS1_3 */

4
tests/ssl-opt.sh
View File

@ -12879,7 +12879,7 @@ requires_config_enabled MBEDTLS_SSL_SRV_C
requires_config_enabled MBEDTLS_SSL_CLI_C requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_DEBUG_C requires_config_enabled MBEDTLS_DEBUG_C
run_test "TLS 1.3: NewSessionTicket: servername check, m->m" \ run_test "TLS 1.3: NewSessionTicket: servername check, m->m" \
"$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=1 \ "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=4 \
sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
"$P_CLI debug_level=4 server_name=localhost reco_mode=1 reconnect=1" \ "$P_CLI debug_level=4 server_name=localhost reco_mode=1 reconnect=1" \
0 \ 0 \
@ -12901,7 +12901,7 @@ requires_config_enabled MBEDTLS_SSL_SRV_C
requires_config_enabled MBEDTLS_SSL_CLI_C requires_config_enabled MBEDTLS_SSL_CLI_C
requires_config_enabled MBEDTLS_DEBUG_C requires_config_enabled MBEDTLS_DEBUG_C
run_test "TLS 1.3: NewSessionTicket: servername negative check, m->m" \ run_test "TLS 1.3: NewSessionTicket: servername negative check, m->m" \
"$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=1 \ "$P_SRV debug_level=4 crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=4 \
sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
"$P_CLI debug_level=4 server_name=localhost rec_server_name=remote reco_mode=1 reconnect=1" \ "$P_CLI debug_level=4 server_name=localhost rec_server_name=remote reco_mode=1 reconnect=1" \
1 \ 1 \