From 3fa2812f32bdb922d47b84ab7b5a98a807d838c0 Mon Sep 17 00:00:00 2001 From: Benjamin Saunders Date: Sun, 25 Feb 2018 18:39:11 -0800 Subject: Introduce SSL_CTX_set_stateless_cookie_{generate,verify}_cb These functions are similar to SSL_CTX_set_cookie_{generate,verify}_cb, but used for the application-controlled portion of TLS1.3 stateless handshake cookies rather than entire DTLSv1 cookies. Reviewed-by: Ben Kaduk Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/5463) --- apps/s_apps.h | 5 +++++ apps/s_cb.c | 16 ++++++++++++++++ apps/s_server.c | 4 ++++ 3 files changed, 25 insertions(+) (limited to 'apps') diff --git a/apps/s_apps.h b/apps/s_apps.h index 614aab8036..1ca8ff95c7 100644 --- a/apps/s_apps.h +++ b/apps/s_apps.h @@ -58,6 +58,11 @@ int generate_cookie_callback(SSL *ssl, unsigned char *cookie, int verify_cookie_callback(SSL *ssl, const unsigned char *cookie, unsigned int cookie_len); +int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie, + size_t *cookie_len); +int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie, + size_t cookie_len); + typedef struct ssl_excert_st SSL_EXCERT; void ssl_ctx_set_excert(SSL_CTX *ctx, SSL_EXCERT *exc); diff --git a/apps/s_cb.c b/apps/s_cb.c index 412442db23..820491a037 100644 --- a/apps/s_cb.c +++ b/apps/s_cb.c @@ -755,6 +755,22 @@ int verify_cookie_callback(SSL *ssl, const unsigned char *cookie, return 0; } + +int generate_stateless_cookie_callback(SSL *ssl, unsigned char *cookie, + size_t *cookie_len) +{ + unsigned int temp; + int res = generate_cookie_callback(ssl, cookie, &temp); + *cookie_len = temp; + return res; +} + +int verify_stateless_cookie_callback(SSL *ssl, const unsigned char *cookie, + size_t cookie_len) +{ + return verify_cookie_callback(ssl, cookie, cookie_len); +} + #endif /* diff --git a/apps/s_server.c b/apps/s_server.c index bc1d1e5608..d21631e8e6 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -2038,6 +2038,10 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_set_cookie_generate_cb(ctx, generate_cookie_callback); SSL_CTX_set_cookie_verify_cb(ctx, verify_cookie_callback); + /* Set TLS1.3 cookie generation and verification callbacks */ + SSL_CTX_set_stateless_cookie_generate_cb(ctx, generate_stateless_cookie_callback); + SSL_CTX_set_stateless_cookie_verify_cb(ctx, verify_stateless_cookie_callback); + if (ctx2 != NULL) { SSL_CTX_set_verify(ctx2, s_server_verify, verify_callback); if (!SSL_CTX_set_session_id_context(ctx2, -- cgit v1.2.3