ARMmbed/mbedtls
1
0
Fork 0
mirror of https://github.com/ARMmbed/mbedtls.git synced 2025-05-09 16:41:19 +08:00
Code Issues Releases Wiki Activity

Adress kinds of comments base on review

Browse Source 
Rename function name to mbedtls_ssl_session_set_hostname
Add two extra check cases for server name
Fix some coding styles

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
This commit is contained in:
Xiaokang Qian 2022-10-11 06:20:56 +00:00
parent 2f9efd3038
commit a3b451f950
3 changed files with 80 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
library/ssl_client.c
View File

@ -714,50 +714,6 @@ static int ssl_generate_random( mbedtls_ssl_context *ssl )
return( ret ); return( ret );
} }
static int ssl_session_set_hostname( mbedtls_ssl_session *session,
const char *hostname )
{
/* Initialize to suppress unnecessary compiler warning */
size_t hostname_len = 0;
/* Check if new hostname is valid before
* making any change to current one */
if( hostname != NULL )
{
hostname_len = strlen( hostname );
if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
/* Now it's clear that we will overwrite the old hostname,
* so we can free it safely */
if( session->hostname != NULL )
{
mbedtls_platform_zeroize( session->hostname,
strlen( session->hostname ) );
mbedtls_free( session->hostname );
}
/* Passing NULL as hostname shall clear the old one */
if( hostname == NULL )
{
session->hostname = NULL;
}
else
{
session->hostname = mbedtls_calloc( 1, hostname_len + 1 );
if( session->hostname == NULL )
return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
memcpy( session->hostname, hostname, hostname_len );
}
return( 0 );
}
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl ) static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
{ {
@ -917,34 +873,33 @@ static int ssl_prepare_client_hello( mbedtls_ssl_context *ssl )
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
if( ssl->handshake->resume ) if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
ssl->handshake->resume )
{ {
if( ssl->hostname != NULL && ssl->session_negotiate->hostname != NULL ) int hostname_mismatch = 0;
if( ssl->session_negotiate->hostname != NULL )
{ {
size_t hostname_len = strlen( ssl->hostname ); if( ssl->hostname != NULL )
size_t negotiate_hostname_len = {
strlen( ssl->session_negotiate->hostname ); if( strcmp( ssl->hostname, ssl->session_negotiate->hostname) )
if( hostname_len != negotiate_hostname_len || \ hostname_mismatch = 1;
strncmp( ssl->hostname, ssl->session_negotiate->hostname, }
hostname_len ) ) else
hostname_mismatch = 1;
}
else
hostname_mismatch = ssl->hostname != NULL;
if( hostname_mismatch )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, MBEDTLS_SSL_DEBUG_MSG( 1,
( "hostname mismatch the session ticket, should not resume " ) ); ( "hostname mismatch the session ticket, should not resume " ) );
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
}
else if( ssl->session_negotiate->hostname != NULL )
{
MBEDTLS_SSL_DEBUG_MSG( 1,
( "hostname missed, should not resume " ) );
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
} }
} }
else else
{ mbedtls_ssl_session_set_hostname( ssl->session_negotiate,
ssl_session_set_hostname( ssl->session_negotiate,
ssl->hostname ); ssl->hostname );
}
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && #endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
MBEDTLS_SSL_SERVER_NAME_INDICATION */ MBEDTLS_SSL_SERVER_NAME_INDICATION */

7
library/ssl_misc.h
View File

@ -2200,6 +2200,7 @@ static inline int mbedtls_ssl_tls13_sig_alg_is_supported(
} }
return( 1 ); return( 1 );
} }
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
@ -2493,4 +2494,10 @@ int mbedtls_ssl_tls13_write_binders_of_pre_shared_key_ext(
unsigned char *buf, unsigned char *end ); unsigned char *buf, unsigned char *end );
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
int mbedtls_ssl_session_set_hostname( mbedtls_ssl_session *session,
const char *hostname );
#endif
#endif /* ssl_misc.h */ #endif /* ssl_misc.h */

65
library/ssl_tls.c
View File

@ -300,14 +300,11 @@ int mbedtls_ssl_session_copy( mbedtls_ssl_session *dst,
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \ defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
defined(MBEDTLS_SSL_CLI_C) defined(MBEDTLS_SSL_CLI_C)
if( src->endpoint == MBEDTLS_SSL_IS_CLIENT && src->hostname != NULL ) if( src->endpoint == MBEDTLS_SSL_IS_CLIENT )
{ {
size_t hostname_len = strlen( src->hostname ); dst->hostname = NULL;
dst->hostname = mbedtls_calloc( 1, hostname_len + 1 ); mbedtls_ssl_session_set_hostname( dst,
if( dst->hostname == NULL ) src->hostname );
return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
strncpy( dst->hostname, src->hostname, hostname_len );
} }
#endif #endif
@ -1975,6 +1972,11 @@ static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
size_t *olen ) size_t *olen )
{ {
unsigned char *p = buf; unsigned char *p = buf;
#if defined(MBEDTLS_SSL_CLI_C) && \
defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
size_t hostname_len = ( session->hostname == NULL ) ?
0 : strlen( session->hostname );
#endif
size_t needed = 1 /* endpoint */ size_t needed = 1 /* endpoint */
+ 2 /* ciphersuite */ + 2 /* ciphersuite */
+ 4 /* ticket_age_add */ + 4 /* ticket_age_add */
@ -1993,7 +1995,6 @@ static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
#if defined(MBEDTLS_SSL_CLI_C) #if defined(MBEDTLS_SSL_CLI_C)
if( session->endpoint == MBEDTLS_SSL_IS_CLIENT ) if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
{ {
size_t hostname_len = session->hostname == NULL?0:strlen( session->hostname );
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
needed += 2 /* hostname_len */ needed += 2 /* hostname_len */
+ hostname_len; /* hostname */ + hostname_len; /* hostname */
@ -2028,7 +2029,6 @@ static int ssl_tls13_session_save( const mbedtls_ssl_session *session,
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_CLI_C) #if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && defined(MBEDTLS_SSL_CLI_C)
if( session->endpoint == MBEDTLS_SSL_IS_CLIENT ) if( session->endpoint == MBEDTLS_SSL_IS_CLIENT )
{ {
size_t hostname_len = session->hostname == NULL?0:strlen(session->hostname);
MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 ); MBEDTLS_PUT_UINT16_BE( hostname_len, p, 0 );
p += 2; p += 2;
if ( hostname_len > 0 && if ( hostname_len > 0 &&
@ -2464,7 +2464,6 @@ int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
/* Now it's clear that we will overwrite the old hostname, /* Now it's clear that we will overwrite the old hostname,
* so we can free it safely */ * so we can free it safely */
if( ssl->hostname != NULL ) if( ssl->hostname != NULL )
{ {
mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) ); mbedtls_platform_zeroize( ssl->hostname, strlen( ssl->hostname ) );
@ -2472,7 +2471,6 @@ int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
} }
/* Passing NULL as hostname shall clear the old one */ /* Passing NULL as hostname shall clear the old one */
if( hostname == NULL ) if( hostname == NULL )
{ {
ssl->hostname = NULL; ssl->hostname = NULL;
@ -8863,4 +8861,49 @@ int mbedtls_ssl_write_alpn_ext( mbedtls_ssl_context *ssl,
} }
#endif /* MBEDTLS_SSL_ALPN */ #endif /* MBEDTLS_SSL_ALPN */
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
int mbedtls_ssl_session_set_hostname( mbedtls_ssl_session *session,
const char *hostname )
{
/* Initialize to suppress unnecessary compiler warning */
size_t hostname_len = 0;
/* Check if new hostname is valid before
* making any change to current one */
if( hostname != NULL )
{
hostname_len = strlen( hostname );
if( hostname_len > MBEDTLS_SSL_MAX_HOST_NAME_LEN )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
/* Now it's clear that we will overwrite the old hostname,
* so we can free it safely */
if( session->hostname != NULL )
{
mbedtls_platform_zeroize( session->hostname,
strlen( session->hostname ) );
mbedtls_free( session->hostname );
}
/* Passing NULL as hostname shall clear the old one */
if( hostname == NULL )
{
session->hostname = NULL;
}
else
{
session->hostname = mbedtls_calloc( 1, hostname_len + 1 );
if( session->hostname == NULL )
return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
memcpy( session->hostname, hostname, hostname_len );
}
return( 0 );
}
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 && MBEDTLS_SSL_SERVER_NAME_INDICATION */
#endif /* MBEDTLS_SSL_TLS_C */ #endif /* MBEDTLS_SSL_TLS_C */