diff options
author | Benjamin Saunders <ben.e.saunders@gmail.com> | 2018-02-25 18:39:11 -0800 |
---|---|---|
committer | Matt Caswell <matt@openssl.org> | 2018-03-12 19:34:13 +0000 |
commit | 3fa2812f32bdb922d47b84ab7b5a98a807d838c0 (patch) | |
tree | ad6cd3c8463be1521456b004cd14811a3b0fc20b /ssl | |
parent | 4718f449a3ecd5efac62b22d0fa9a759a7895dbc (diff) |
Introduce SSL_CTX_set_stateless_cookie_{generate,verify}_cb
These functions are similar to SSL_CTX_set_cookie_{generate,verify}_cb,
but used for the application-controlled portion of TLS1.3 stateless
handshake cookies rather than entire DTLSv1 cookies.
Reviewed-by: Ben Kaduk <kaduk@mit.edu>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5463)
Diffstat (limited to 'ssl')
-rw-r--r-- | ssl/ssl_locl.h | 8 | ||||
-rw-r--r-- | ssl/ssl_sess.c | 18 | ||||
-rw-r--r-- | ssl/statem/extensions_srvr.c | 11 |
3 files changed, 31 insertions, 6 deletions
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h index 9eb58342a8..246605c81e 100644 --- a/ssl/ssl_locl.h +++ b/ssl/ssl_locl.h @@ -820,6 +820,14 @@ struct ssl_ctx_st { int (*app_verify_cookie_cb) (SSL *ssl, const unsigned char *cookie, unsigned int cookie_len); + /* TLS1.3 app-controlled cookie generate callback */ + int (*gen_stateless_cookie_cb) (SSL *ssl, unsigned char *cookie, + size_t *cookie_len); + + /* TLS1.3 verify app-controlled cookie callback */ + int (*verify_stateless_cookie_cb) (SSL *ssl, const unsigned char *cookie, + size_t cookie_len); + CRYPTO_EX_DATA ex_data; const EVP_MD *md5; /* For SSLv3/TLSv1 'ssl3-md5' */ diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c index f78c9cde5f..1873237c70 100644 --- a/ssl/ssl_sess.c +++ b/ssl/ssl_sess.c @@ -1301,4 +1301,22 @@ int SSL_SESSION_get0_ticket_appdata(SSL_SESSION *ss, void **data, size_t *len) return 1; } +void SSL_CTX_set_stateless_cookie_generate_cb( + SSL_CTX *ctx, + int (*cb) (SSL *ssl, + unsigned char *cookie, + size_t *cookie_len)) +{ + ctx->gen_stateless_cookie_cb = cb; +} + +void SSL_CTX_set_stateless_cookie_verify_cb( + SSL_CTX *ctx, + int (*cb) (SSL *ssl, + const unsigned char *cookie, + size_t cookie_len)) +{ + ctx->verify_stateless_cookie_cb = cb; +} + IMPLEMENT_PEM_rw(SSL_SESSION, SSL_SESSION, PEM_STRING_SSL_SESSION, SSL_SESSION) diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c index 74acdb2d21..425cd80efe 100644 --- a/ssl/statem/extensions_srvr.c +++ b/ssl/statem/extensions_srvr.c @@ -729,7 +729,7 @@ int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, unsigned long tm, now; /* Ignore any cookie if we're not set up to verify it */ - if (s->ctx->app_verify_cookie_cb == NULL + if (s->ctx->verify_stateless_cookie_cb == NULL || (s->s3->flags & TLS1_FLAGS_STATELESS) == 0) return 1; @@ -852,7 +852,7 @@ int tls_parse_ctos_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x, } /* Verify the app cookie */ - if (s->ctx->app_verify_cookie_cb(s, PACKET_data(&appcookie), + if (s->ctx->verify_stateless_cookie_cb(s, PACKET_data(&appcookie), PACKET_remaining(&appcookie)) == 0) { SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_F_TLS_PARSE_CTOS_COOKIE, SSL_R_COOKIE_MISMATCH); @@ -1676,8 +1676,7 @@ EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context, { unsigned char *hashval1, *hashval2, *appcookie1, *appcookie2, *cookie; unsigned char *hmac, *hmac2; - size_t startlen, ciphlen, totcookielen, hashlen, hmaclen; - unsigned int appcookielen; + size_t startlen, ciphlen, totcookielen, hashlen, hmaclen, appcookielen; EVP_MD_CTX *hctx; EVP_PKEY *pkey; int ret = EXT_RETURN_FAIL; @@ -1685,7 +1684,7 @@ EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context, if ((s->s3->flags & TLS1_FLAGS_STATELESS) == 0) return EXT_RETURN_NOT_SENT; - if (s->ctx->app_gen_cookie_cb == NULL) { + if (s->ctx->gen_stateless_cookie_cb == NULL) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE, SSL_R_NO_COOKIE_CALLBACK_SET); return EXT_RETURN_FAIL; @@ -1733,7 +1732,7 @@ EXT_RETURN tls_construct_stoc_cookie(SSL *s, WPACKET *pkt, unsigned int context, } /* Generate the application cookie */ - if (s->ctx->app_gen_cookie_cb(s, appcookie1, &appcookielen) == 0) { + if (s->ctx->gen_stateless_cookie_cb(s, appcookie1, &appcookielen) == 0) { SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_F_TLS_CONSTRUCT_STOC_COOKIE, SSL_R_COOKIE_GEN_CALLBACK_FAILURE); return EXT_RETURN_FAIL; |