Skip to content

Commit f087b13

Browse files
effbiaeeffbiae
committed
refactor to MakePSKPreMasterSecret
1 parent 67c2d80 commit f087b13

1 file changed

Lines changed: 64 additions & 138 deletions

File tree

‎src/internal.c‎

Lines changed: 64 additions & 138 deletions
Original file line numberDiff line numberDiff line change
@@ -33197,6 +33197,59 @@ static void FreeSckeArgs(WOLFSSL* ssl, void* pArgs)
3319733197
args->input = NULL;
3319833198
}
3319933199

33200+
#ifndef NO_PSK
33201+
static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
33202+
{
33203+
int ret = 0;
33204+
/* Use the PSK hint to look up the PSK and add it to the
33205+
* preMasterSecret here. */
33206+
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
33207+
ssl->arrays->client_identity, ssl->arrays->psk_key,
33208+
MAX_PSK_KEY_LEN);
33209+
33210+
if (ssl->arrays->psk_keySz == 0 ||
33211+
(ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN &&
33212+
(int)ssl->arrays->psk_keySz != WC_NO_ERR_TRACE(USE_HW_PSK))) {
33213+
#if defined(WOLFSSL_EXTRA_ALERTS) || defined(WOLFSSL_PSK_IDENTITY_ALERT)
33214+
SendAlert(ssl, alert_fatal, unknown_psk_identity);
33215+
#endif
33216+
ret = 1;
33217+
}
33218+
if (ret == 0)
33219+
/* Pre-shared Key for peer authentication. */
33220+
ssl->options.peerAuthGood = 1;
33221+
return ret;
33222+
}
33223+
33224+
static void MakePSKPreMasterSecret(Arrays* arrays, byte use_psk_key)
33225+
{
33226+
byte* pms = arrays->preMasterSecret;
33227+
word16 sz;
33228+
33229+
/* sz + (use_psk_key ? sz 0s : sz unaltered) + length of psk + psk */
33230+
if (!use_psk_key) {
33231+
sz = (word16)arrays->preMasterSz;
33232+
c16toa(sz, pms);
33233+
pms += OPAQUE16_LEN + sz;
33234+
}
33235+
if ((int)arrays->psk_keySz > 0) {
33236+
if (use_psk_key) {
33237+
sz = (word16)arrays->psk_keySz;
33238+
c16toa(sz, pms);
33239+
pms += OPAQUE16_LEN;
33240+
XMEMSET(pms, 0, sz);
33241+
pms += sz;
33242+
}
33243+
c16toa(arrays->psk_keySz, pms);
33244+
pms += OPAQUE16_LEN;
33245+
XMEMCPY(pms, arrays->psk_key, arrays->psk_keySz);
33246+
arrays->preMasterSz = sz + arrays->psk_keySz + OPAQUE16_LEN * 2;
33247+
ForceZero(arrays->psk_key, arrays->psk_keySz);
33248+
}
33249+
arrays->psk_keySz = 0; /* no further need */
33250+
}
33251+
#endif /*!NO_PSK*/
33252+
3320033253
/* handle generation client_key_exchange (16) */
3320133254
int SendClientKeyExchange(WOLFSSL* ssl)
3320233255
{
@@ -33626,7 +33679,6 @@ int SendClientKeyExchange(WOLFSSL* ssl)
3362633679
#ifndef NO_PSK
3362733680
case psk_kea:
3362833681
{
33629-
byte* pms = ssl->arrays->preMasterSecret;
3363033682
ssl->arrays->psk_keySz = ssl->options.client_psk_cb(ssl,
3363133683
ssl->arrays->server_hint, ssl->arrays->client_identity,
3363233684
MAX_PSK_ID_LEN, ssl->arrays->psk_key, MAX_PSK_KEY_LEN);
@@ -33645,24 +33697,7 @@ int SendClientKeyExchange(WOLFSSL* ssl)
3364533697
XMEMCPY(args->encSecret, ssl->arrays->client_identity,
3364633698
args->encSz);
3364733699
ssl->options.peerAuthGood = 1;
33648-
if ((int)ssl->arrays->psk_keySz > 0) {
33649-
/* CLIENT: Pre-shared Key for peer authentication. */
33650-
33651-
/* make psk pre master secret */
33652-
/* length of key + length 0s + length of key + key */
33653-
c16toa((word16)ssl->arrays->psk_keySz, pms);
33654-
pms += OPAQUE16_LEN;
33655-
XMEMSET(pms, 0, ssl->arrays->psk_keySz);
33656-
pms += ssl->arrays->psk_keySz;
33657-
c16toa((word16)ssl->arrays->psk_keySz, pms);
33658-
pms += OPAQUE16_LEN;
33659-
XMEMCPY(pms, ssl->arrays->psk_key,
33660-
ssl->arrays->psk_keySz);
33661-
ssl->arrays->preMasterSz = (ssl->arrays->psk_keySz * 2)
33662-
+ (2 * OPAQUE16_LEN);
33663-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
33664-
}
33665-
ssl->arrays->psk_keySz = 0; /* No further need */
33700+
MakePSKPreMasterSecret(ssl->arrays, 1);
3366633701
break;
3366733702
}
3366833703
#endif /* !NO_PSK */
@@ -34160,39 +34195,22 @@ int SendClientKeyExchange(WOLFSSL* ssl)
3416034195
#if !defined(NO_DH) && !defined(NO_PSK)
3416134196
case dhe_psk_kea:
3416234197
{
34163-
byte* pms = ssl->arrays->preMasterSecret;
34164-
3416534198
/* validate args */
3416634199
if (args->output == NULL || args->length == 0) {
3416734200
ERROR_OUT(BAD_FUNC_ARG, exit_scke);
3416834201
}
3416934202

3417034203
c16toa((word16)args->length, args->output);
3417134204
args->encSz += args->length + OPAQUE16_LEN;
34172-
c16toa((word16)ssl->arrays->preMasterSz, pms);
34173-
ssl->arrays->preMasterSz += OPAQUE16_LEN;
34174-
pms += ssl->arrays->preMasterSz;
34175-
34176-
/* make psk pre master secret */
34177-
if ((int)ssl->arrays->psk_keySz > 0) {
34178-
/* length of key + length 0s + length of key + key */
34179-
c16toa((word16)ssl->arrays->psk_keySz, pms);
34180-
pms += OPAQUE16_LEN;
34181-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
34182-
ssl->arrays->preMasterSz +=
34183-
ssl->arrays->psk_keySz + OPAQUE16_LEN;
34184-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
34185-
}
34186-
ssl->arrays->psk_keySz = 0; /* No further need */
34205+
34206+
MakePSKPreMasterSecret(ssl->arrays, 0);
3418734207
break;
3418834208
}
3418934209
#endif /* !NO_DH && !NO_PSK */
3419034210
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
3419134211
defined(HAVE_CURVE448)) && !defined(NO_PSK)
3419234212
case ecdhe_psk_kea:
3419334213
{
34194-
byte* pms = ssl->arrays->preMasterSecret;
34195-
3419634214
/* validate args */
3419734215
if (args->output == NULL || args->length > ENCRYPT_LEN) {
3419834216
ERROR_OUT(BAD_FUNC_ARG, exit_scke);
@@ -34204,19 +34222,7 @@ int SendClientKeyExchange(WOLFSSL* ssl)
3420434222

3420534223
/* Create pre master secret is the concatenation of
3420634224
* eccSize + eccSharedKey + pskSize + pskKey */
34207-
c16toa((word16)ssl->arrays->preMasterSz, pms);
34208-
ssl->arrays->preMasterSz += OPAQUE16_LEN;
34209-
pms += ssl->arrays->preMasterSz;
34210-
34211-
if ((int)ssl->arrays->psk_keySz > 0) {
34212-
c16toa((word16)ssl->arrays->psk_keySz, pms);
34213-
pms += OPAQUE16_LEN;
34214-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
34215-
ssl->arrays->preMasterSz += ssl->arrays->psk_keySz + OPAQUE16_LEN;
34216-
34217-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
34218-
}
34219-
ssl->arrays->psk_keySz = 0; /* No further need */
34225+
MakePSKPreMasterSecret(ssl->arrays, 0);
3422034226
break;
3422134227
}
3422234228
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
@@ -40999,7 +41005,6 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
4099941005
#ifndef NO_PSK
4100041006
case psk_kea:
4100141007
{
41002-
byte* pms = ssl->arrays->preMasterSecret;
4100341008
word16 ci_sz;
4100441009

4100541010
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
@@ -41020,42 +41025,10 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
4102041025
XMEMCPY(ssl->arrays->client_identity,
4102141026
input + args->idx, ci_sz);
4102241027
args->idx += ci_sz;
41023-
4102441028
ssl->arrays->client_identity[ci_sz] = '\0'; /* null term */
41025-
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
41026-
ssl->arrays->client_identity, ssl->arrays->psk_key,
41027-
MAX_PSK_KEY_LEN);
41028-
41029-
if (ssl->arrays->psk_keySz == 0 ||
41030-
(ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN &&
41031-
(int)ssl->arrays->psk_keySz != WC_NO_ERR_TRACE(USE_HW_PSK))) {
41032-
#if defined(WOLFSSL_EXTRA_ALERTS) || \
41033-
defined(WOLFSSL_PSK_IDENTITY_ALERT)
41034-
SendAlert(ssl, alert_fatal,
41035-
unknown_psk_identity);
41036-
#endif
41029+
if (AddPSKtoPreMasterSecret(ssl))
4103741030
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
41038-
}
41039-
/* SERVER: Pre-shared Key for peer authentication. */
41040-
ssl->options.peerAuthGood = 1;
41041-
41042-
/* make psk pre master secret */
41043-
if ((int)ssl->arrays->psk_keySz > 0) {
41044-
/* length of key + length 0s + length of key + key */
41045-
c16toa((word16) ssl->arrays->psk_keySz, pms);
41046-
pms += OPAQUE16_LEN;
41047-
41048-
XMEMSET(pms, 0, ssl->arrays->psk_keySz);
41049-
pms += ssl->arrays->psk_keySz;
41050-
41051-
c16toa((word16) ssl->arrays->psk_keySz, pms);
41052-
pms += OPAQUE16_LEN;
41053-
41054-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41055-
ssl->arrays->preMasterSz = (ssl->arrays->psk_keySz * 2) +
41056-
(OPAQUE16_LEN * 2);
41057-
}
41058-
ssl->arrays->psk_keySz = 0; /* no further need */
41031+
MakePSKPreMasterSecret(ssl->arrays, 1);
4105941032
break;
4106041033
}
4106141034
#endif /* !NO_PSK */
@@ -41854,82 +41827,35 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
4185441827
#if !defined(NO_DH) && !defined(NO_PSK)
4185541828
case dhe_psk_kea:
4185641829
{
41857-
byte* pms = ssl->arrays->preMasterSecret;
4185841830
word16 clientSz = (word16)args->sigSz;
4185941831

4186041832
args->idx += clientSz;
41861-
c16toa((word16)ssl->arrays->preMasterSz, pms);
41862-
ssl->arrays->preMasterSz += OPAQUE16_LEN;
41863-
pms += ssl->arrays->preMasterSz;
4186441833

4186541834
/* Use the PSK hint to look up the PSK and add it to the
4186641835
* preMasterSecret here. */
41867-
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
41868-
ssl->arrays->client_identity, ssl->arrays->psk_key,
41869-
MAX_PSK_KEY_LEN);
41870-
41871-
if (ssl->arrays->psk_keySz == 0 ||
41872-
(ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN &&
41873-
(int)ssl->arrays->psk_keySz != WC_NO_ERR_TRACE(USE_HW_PSK))) {
41874-
#if defined(WOLFSSL_EXTRA_ALERTS) || \
41875-
defined(WOLFSSL_PSK_IDENTITY_ALERT)
41876-
SendAlert(ssl, alert_fatal,
41877-
unknown_psk_identity);
41878-
#endif
41836+
if (AddPSKtoPreMasterSecret(ssl))
4187941837
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
41880-
}
41881-
/* SERVER: Pre-shared Key for peer authentication. */
41882-
ssl->options.peerAuthGood = 1;
41883-
41884-
if ((int)ssl->arrays->psk_keySz > 0) {
41885-
c16toa((word16) ssl->arrays->psk_keySz, pms);
41886-
pms += OPAQUE16_LEN;
41887-
41888-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41889-
ssl->arrays->preMasterSz += ssl->arrays->psk_keySz + OPAQUE16_LEN;
41890-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41891-
}
41892-
ssl->arrays->psk_keySz = 0; /* no further need */
41838+
MakePSKPreMasterSecret(ssl->arrays, 0);
4189341839
break;
4189441840
}
4189541841
#endif /* !NO_DH && !NO_PSK */
4189641842
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
4189741843
defined(HAVE_CURVE448)) && !defined(NO_PSK)
4189841844
case ecdhe_psk_kea:
4189941845
{
41900-
byte* pms = ssl->arrays->preMasterSecret;
4190141846
word16 clientSz = (word16)args->sigSz;
4190241847

4190341848
/* skip past the imported peer key */
4190441849
args->idx += args->length;
4190541850

4190641851
/* Add preMasterSecret */
41907-
c16toa(clientSz, pms);
41908-
ssl->arrays->preMasterSz = OPAQUE16_LEN + clientSz;
41909-
pms += ssl->arrays->preMasterSz;
41852+
ssl->arrays->preMasterSz = clientSz;
4191041853

4191141854
/* Use the PSK hint to look up the PSK and add it to the
4191241855
* preMasterSecret here. */
41913-
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
41914-
ssl->arrays->client_identity, ssl->arrays->psk_key,
41915-
MAX_PSK_KEY_LEN);
41916-
41917-
if (ssl->arrays->psk_keySz == 0 ||
41918-
(ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN &&
41919-
(int)ssl->arrays->psk_keySz != WC_NO_ERR_TRACE(USE_HW_PSK))) {
41856+
if (AddPSKtoPreMasterSecret(ssl))
4192041857
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
41921-
}
41922-
/* SERVER: Pre-shared Key for peer authentication. */
41923-
ssl->options.peerAuthGood = 1;
41924-
if ((int)ssl->arrays->psk_keySz > 0) {
41925-
c16toa((word16) ssl->arrays->psk_keySz, pms);
41926-
pms += OPAQUE16_LEN;
41927-
41928-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41929-
ssl->arrays->preMasterSz += ssl->arrays->psk_keySz + OPAQUE16_LEN;
41930-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41931-
}
41932-
ssl->arrays->psk_keySz = 0; /* no further need */
41858+
MakePSKPreMasterSecret(ssl->arrays, 0);
4193341859
break;
4193441860
}
4193541861
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */

0 commit comments

Comments
 (0)