mirrors/wolfssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #614 from toddouska/scr-verify

Browse Source 
add SCR client and server verify data check
This commit is contained in:
John Safranek 2016-11-04 10:11:05 -07:00 committed by GitHub
commit c271806936
2 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
examples/client/client.c
View File

@ -1520,8 +1520,10 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
}
else if (input < 0) {
int readErr = wolfSSL_get_error(ssl, 0);
if (readErr != SSL_ERROR_WANT_READ)
if (readErr != SSL_ERROR_WANT_READ) {
printf("wolfSSL_read error %d!\n", readErr);
err_sys("wolfSSL_read failed");
}
}
#ifndef NO_SESSION_CACHE
@ -1687,8 +1689,10 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
}
} else if (input < 0) {
int readErr = wolfSSL_get_error(ssl, 0);
if (readErr != SSL_ERROR_WANT_READ)
if (readErr != SSL_ERROR_WANT_READ) {
printf("wolfSSL_read error %d!\n", readErr);
err_sys("wolfSSL_read failed");
}
}
/* try to send session break */

21
src/tls.c
View File

@ -3163,16 +3163,29 @@ static int TLSX_SecureRenegotiation_Parse(WOLFSSL* ssl, byte* input,
ret = 0;
}
}
else if (*input == 2 * TLS_FINISHED_SZ) {
/* TODO compare client_verify_data and server_verify_data */
ret = 0;
else if (*input == 2 * TLS_FINISHED_SZ &&
length == 2 * TLS_FINISHED_SZ + OPAQUE8_LEN) {
input++; /* get past size */
/* validate client and server verify data */
if (XMEMCMP(input,
ssl->secure_renegotiation->client_verify_data,
TLS_FINISHED_SZ) == 0 &&
XMEMCMP(input + TLS_FINISHED_SZ,
ssl->secure_renegotiation->server_verify_data,
TLS_FINISHED_SZ) == 0) {
WOLFSSL_MSG("SCR client and server verify data match");
ret = 0; /* verified */
} else {
/* already in error state */
WOLFSSL_MSG("SCR client and server verify data Failure");
}
}
#endif
}
}
if (ret != 0) {
/* TODO: turn on fatal error at ssl level too */
SendAlert(ssl, alert_fatal, handshake_failure);
}