mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

delay SetKeys() with SetKeysSide() until last possible moment, needed for scr

Browse Source
This commit is contained in:
toddouska 2014-09-24 11:27:13 -07:00
parent ed1beafdfc
commit 21f46373f3
4 changed files with 66 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
cyassl/internal.h
View File

@ -2236,6 +2236,15 @@ CYASSL_LOCAL const char* const* GetCipherNames(void);
CYASSL_LOCAL int GetCipherNamesSize(void);
enum encrypt_side {
ENCRYPT_SIDE_ONLY = 1,
DECRYPT_SIDE_ONLY,
ENCRYPT_AND_DECRYPT_SIDE
};
CYASSL_LOCAL int SetKeysSide(CYASSL*, enum encrypt_side);
#ifdef __cplusplus
} /* extern "C" */
#endif

7
src/internal.c
View File

@ -6260,6 +6260,10 @@ int ProcessReply(CYASSL* ssl)
ssl->buffers.inputBuffer.idx++;
ssl->keys.encryptionOn = 1;
/* setup decrypt keys for following messages */
if ((ret = SetKeysSide(ssl, DECRYPT_SIDE_ONLY)) != 0)
return ret;
#ifdef CYASSL_DTLS
if (ssl->options.dtls) {
DtlsPoolReset(ssl);
@ -6705,6 +6709,9 @@ int SendFinished(CYASSL* ssl)
word16 epoch = ssl->keys.dtls_epoch;
#endif
/* setup encrypt keys */
if ((ret = SetKeysSide(ssl, ENCRYPT_SIDE_ONLY)) != 0)
return ret;
/* check for available size */
outputSz = sizeof(input) + MAX_MSG_EXTRA;

45
src/keys.c
View File

@ -2264,9 +2264,10 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
}
#endif
keys->sequence_number = 0;
keys->peer_sequence_number = 0;
keys->encryptionOn = 0;
if (enc)
keys->sequence_number = 0;
if (dec)
keys->peer_sequence_number = 0;
(void)side;
(void)heap;
(void)enc;
@ -2278,16 +2279,45 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
}
/* TLS can call too */
int StoreKeys(CYASSL* ssl, const byte* keyData)
/* Set encrypt/decrypt or both sides of key setup */
int SetKeysSide(CYASSL* ssl, enum encrypt_side side)
{
int sz, i = 0;
int devId = NO_CAVIUM_DEVICE;
Ciphers* encrypt = NULL;
Ciphers* decrypt = NULL;
#ifdef HAVE_CAVIUM
devId = ssl->devId;
#endif
switch (side) {
case ENCRYPT_SIDE_ONLY:
encrypt = &ssl->encrypt;
break;
case DECRYPT_SIDE_ONLY:
decrypt = &ssl->decrypt;
break;
case ENCRYPT_AND_DECRYPT_SIDE:
encrypt = &ssl->encrypt;
decrypt = &ssl->decrypt;
break;
default:
return BAD_FUNC_ARG;
}
return SetKeys(encrypt, decrypt, &ssl->keys, &ssl->specs, ssl->options.side,
ssl->heap, devId);
}
/* TLS can call too */
int StoreKeys(CYASSL* ssl, const byte* keyData)
{
int sz, i = 0;
if (ssl->specs.cipher_type != aead) {
sz = ssl->specs.hash_size;
XMEMCPY(ssl->keys.client_write_MAC_secret,&keyData[i], sz);
@ -2313,8 +2343,7 @@ int StoreKeys(CYASSL* ssl, const byte* keyData)
}
#endif
return SetKeys(&ssl->encrypt, &ssl->decrypt, &ssl->keys, &ssl->specs,
ssl->options.side, ssl->heap, devId);
return 0;
}
#ifndef NO_OLD_TLS

15
src/sniffer.c
View File

@ -1106,8 +1106,16 @@ static int ProcessClientKeyExchange(const byte* input, int* sslBytes,
return -1;
}
MakeMasterSecret(session->sslServer);
MakeMasterSecret(session->sslClient);
ret = MakeMasterSecret(session->sslServer);
ret += MakeMasterSecret(session->sslClient);
ret += SetKeysSide(session->sslServer, ENCRYPT_AND_DECRYPT_SIDE);
ret += SetKeysSide(session->sslClient, ENCRYPT_AND_DECRYPT_SIDE);
if (ret != 0) {
SetError(BAD_DERIVE_STR, error, session, FATAL_ERROR_STATE);
return -1;
}
#ifdef SHOW_SECRETS
{
int i;
@ -1278,6 +1286,9 @@ static int ProcessServerHello(const byte* input, int* sslBytes,
ret = DeriveKeys(session->sslServer);
ret += DeriveKeys(session->sslClient);
}
ret += SetKeysSide(session->sslServer, ENCRYPT_AND_DECRYPT_SIDE);
ret += SetKeysSide(session->sslClient, ENCRYPT_AND_DECRYPT_SIDE);
if (ret != 0) {
SetError(BAD_DERIVE_STR, error, session, FATAL_ERROR_STATE);
return -1;