Skip to content

Commit fdcd324

Browse files
effbiaeeffbiae
committed
refactor to MakePSKPreMasterSecret
1 parent 0d588b4 commit fdcd324

File tree

1 file changed

+66
-138
lines changed

1 file changed

+66
-138
lines changed

‎src/internal.c‎

Lines changed: 66 additions & 138 deletions
Original file line numberDiff line numberDiff line change
@@ -33197,6 +33197,55 @@ static void FreeSckeArgs(WOLFSSL* ssl, void* pArgs)
3319733197
args->input = NULL;
3319833198
}
3319933199

33200+
#ifndef NO_PSK
33201+
static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
33202+
{
33203+
int ret = 0;
33204+
/* Use the PSK hint to look up the PSK and add it to the
33205+
* preMasterSecret here. */
33206+
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
33207+
ssl->arrays->client_identity, ssl->arrays->psk_key,
33208+
MAX_PSK_KEY_LEN);
33209+
33210+
if (ssl->arrays->psk_keySz == 0 ||
33211+
(ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN &&
33212+
(int)ssl->arrays->psk_keySz != WC_NO_ERR_TRACE(USE_HW_PSK))) {
33213+
#if defined(WOLFSSL_EXTRA_ALERTS) || defined(WOLFSSL_PSK_IDENTITY_ALERT)
33214+
SendAlert(ssl, alert_fatal, unknown_psk_identity);
33215+
#endif
33216+
ret = 1;
33217+
}
33218+
if (ret == 0)
33219+
/* Pre-shared Key for peer authentication. */
33220+
ssl->options.peerAuthGood = 1;
33221+
return ret;
33222+
}
33223+
#endif
33224+
33225+
#ifndef NO_PSK
33226+
static void MakePSKPreMasterSecret(Arrays* arrays, word16 sz)
33227+
{
33228+
byte* pms = arrays->preMasterSecret;
33229+
33230+
if ((int)arrays->psk_keySz > 0) {
33231+
/* sz + sz 0s + length of key + key */
33232+
c16toa(sz, pms);
33233+
pms += OPAQUE16_LEN;
33234+
33235+
XMEMSET(pms, 0, sz);
33236+
pms += sz;
33237+
33238+
c16toa(arrays->psk_keySz, pms);
33239+
pms += OPAQUE16_LEN;
33240+
33241+
XMEMCPY(pms, arrays->psk_key, arrays->psk_keySz);
33242+
arrays->preMasterSz = sz + arrays->psk_keySz + OPAQUE16_LEN * 2;
33243+
ForceZero(arrays->psk_key, arrays->psk_keySz);
33244+
}
33245+
arrays->psk_keySz = 0; /* no further need */
33246+
}
33247+
#endif /*NO_PSK*/
33248+
3320033249
/* handle generation client_key_exchange (16) */
3320133250
int SendClientKeyExchange(WOLFSSL* ssl)
3320233251
{
@@ -33626,7 +33675,6 @@ int SendClientKeyExchange(WOLFSSL* ssl)
3362633675
#ifndef NO_PSK
3362733676
case psk_kea:
3362833677
{
33629-
byte* pms = ssl->arrays->preMasterSecret;
3363033678
ssl->arrays->psk_keySz = ssl->options.client_psk_cb(ssl,
3363133679
ssl->arrays->server_hint, ssl->arrays->client_identity,
3363233680
MAX_PSK_ID_LEN, ssl->arrays->psk_key, MAX_PSK_KEY_LEN);
@@ -33645,24 +33693,8 @@ int SendClientKeyExchange(WOLFSSL* ssl)
3364533693
XMEMCPY(args->encSecret, ssl->arrays->client_identity,
3364633694
args->encSz);
3364733695
ssl->options.peerAuthGood = 1;
33648-
if ((int)ssl->arrays->psk_keySz > 0) {
33649-
/* CLIENT: Pre-shared Key for peer authentication. */
33650-
33651-
/* make psk pre master secret */
33652-
/* length of key + length 0s + length of key + key */
33653-
c16toa((word16)ssl->arrays->psk_keySz, pms);
33654-
pms += OPAQUE16_LEN;
33655-
XMEMSET(pms, 0, ssl->arrays->psk_keySz);
33656-
pms += ssl->arrays->psk_keySz;
33657-
c16toa((word16)ssl->arrays->psk_keySz, pms);
33658-
pms += OPAQUE16_LEN;
33659-
XMEMCPY(pms, ssl->arrays->psk_key,
33660-
ssl->arrays->psk_keySz);
33661-
ssl->arrays->preMasterSz = (ssl->arrays->psk_keySz * 2)
33662-
+ (2 * OPAQUE16_LEN);
33663-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
33664-
}
33665-
ssl->arrays->psk_keySz = 0; /* No further need */
33696+
MakePSKPreMasterSecret(ssl->arrays,
33697+
(word16)ssl->arrays->psk_keySz);
3366633698
break;
3366733699
}
3366833700
#endif /* !NO_PSK */
@@ -34160,39 +34192,23 @@ int SendClientKeyExchange(WOLFSSL* ssl)
3416034192
#if !defined(NO_DH) && !defined(NO_PSK)
3416134193
case dhe_psk_kea:
3416234194
{
34163-
byte* pms = ssl->arrays->preMasterSecret;
34164-
3416534195
/* validate args */
3416634196
if (args->output == NULL || args->length == 0) {
3416734197
ERROR_OUT(BAD_FUNC_ARG, exit_scke);
3416834198
}
3416934199

3417034200
c16toa((word16)args->length, args->output);
3417134201
args->encSz += args->length + OPAQUE16_LEN;
34172-
c16toa((word16)ssl->arrays->preMasterSz, pms);
34173-
ssl->arrays->preMasterSz += OPAQUE16_LEN;
34174-
pms += ssl->arrays->preMasterSz;
34175-
34176-
/* make psk pre master secret */
34177-
if ((int)ssl->arrays->psk_keySz > 0) {
34178-
/* length of key + length 0s + length of key + key */
34179-
c16toa((word16)ssl->arrays->psk_keySz, pms);
34180-
pms += OPAQUE16_LEN;
34181-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
34182-
ssl->arrays->preMasterSz +=
34183-
ssl->arrays->psk_keySz + OPAQUE16_LEN;
34184-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
34185-
}
34186-
ssl->arrays->psk_keySz = 0; /* No further need */
34202+
34203+
MakePSKPreMasterSecret(ssl->arrays,
34204+
(word16)ssl->arrays->preMasterSz);
3418734205
break;
3418834206
}
3418934207
#endif /* !NO_DH && !NO_PSK */
3419034208
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
3419134209
defined(HAVE_CURVE448)) && !defined(NO_PSK)
3419234210
case ecdhe_psk_kea:
3419334211
{
34194-
byte* pms = ssl->arrays->preMasterSecret;
34195-
3419634212
/* validate args */
3419734213
if (args->output == NULL || args->length > ENCRYPT_LEN) {
3419834214
ERROR_OUT(BAD_FUNC_ARG, exit_scke);
@@ -34204,19 +34220,8 @@ int SendClientKeyExchange(WOLFSSL* ssl)
3420434220

3420534221
/* Create pre master secret is the concatenation of
3420634222
* eccSize + eccSharedKey + pskSize + pskKey */
34207-
c16toa((word16)ssl->arrays->preMasterSz, pms);
34208-
ssl->arrays->preMasterSz += OPAQUE16_LEN;
34209-
pms += ssl->arrays->preMasterSz;
34210-
34211-
if ((int)ssl->arrays->psk_keySz > 0) {
34212-
c16toa((word16)ssl->arrays->psk_keySz, pms);
34213-
pms += OPAQUE16_LEN;
34214-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
34215-
ssl->arrays->preMasterSz += ssl->arrays->psk_keySz + OPAQUE16_LEN;
34216-
34217-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
34218-
}
34219-
ssl->arrays->psk_keySz = 0; /* No further need */
34223+
MakePSKPreMasterSecret(ssl->arrays,
34224+
(word16)ssl->arrays->preMasterSz);
3422034225
break;
3422134226
}
3422234227
#endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) && !NO_PSK */
@@ -40999,7 +41004,6 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
4099941004
#ifndef NO_PSK
4100041005
case psk_kea:
4100141006
{
41002-
byte* pms = ssl->arrays->preMasterSecret;
4100341007
word16 ci_sz;
4100441008

4100541009
if ((args->idx - args->begin) + OPAQUE16_LEN > size) {
@@ -41020,42 +41024,11 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
4102041024
XMEMCPY(ssl->arrays->client_identity,
4102141025
input + args->idx, ci_sz);
4102241026
args->idx += ci_sz;
41023-
4102441027
ssl->arrays->client_identity[ci_sz] = '\0'; /* null term */
41025-
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
41026-
ssl->arrays->client_identity, ssl->arrays->psk_key,
41027-
MAX_PSK_KEY_LEN);
41028-
41029-
if (ssl->arrays->psk_keySz == 0 ||
41030-
(ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN &&
41031-
(int)ssl->arrays->psk_keySz != WC_NO_ERR_TRACE(USE_HW_PSK))) {
41032-
#if defined(WOLFSSL_EXTRA_ALERTS) || \
41033-
defined(WOLFSSL_PSK_IDENTITY_ALERT)
41034-
SendAlert(ssl, alert_fatal,
41035-
unknown_psk_identity);
41036-
#endif
41028+
if (AddPSKtoPreMasterSecret(ssl))
4103741029
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
41038-
}
41039-
/* SERVER: Pre-shared Key for peer authentication. */
41040-
ssl->options.peerAuthGood = 1;
41041-
41042-
/* make psk pre master secret */
41043-
if ((int)ssl->arrays->psk_keySz > 0) {
41044-
/* length of key + length 0s + length of key + key */
41045-
c16toa((word16) ssl->arrays->psk_keySz, pms);
41046-
pms += OPAQUE16_LEN;
41047-
41048-
XMEMSET(pms, 0, ssl->arrays->psk_keySz);
41049-
pms += ssl->arrays->psk_keySz;
41050-
41051-
c16toa((word16) ssl->arrays->psk_keySz, pms);
41052-
pms += OPAQUE16_LEN;
41053-
41054-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41055-
ssl->arrays->preMasterSz = (ssl->arrays->psk_keySz * 2) +
41056-
(OPAQUE16_LEN * 2);
41057-
}
41058-
ssl->arrays->psk_keySz = 0; /* no further need */
41030+
MakePSKPreMasterSecret(ssl->arrays,
41031+
(word16)ssl->arrays->psk_keySz);
4105941032
break;
4106041033
}
4106141034
#endif /* !NO_PSK */
@@ -41854,82 +41827,37 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
4185441827
#if !defined(NO_DH) && !defined(NO_PSK)
4185541828
case dhe_psk_kea:
4185641829
{
41857-
byte* pms = ssl->arrays->preMasterSecret;
4185841830
word16 clientSz = (word16)args->sigSz;
4185941831

4186041832
args->idx += clientSz;
41861-
c16toa((word16)ssl->arrays->preMasterSz, pms);
41862-
ssl->arrays->preMasterSz += OPAQUE16_LEN;
41863-
pms += ssl->arrays->preMasterSz;
4186441833

4186541834
/* Use the PSK hint to look up the PSK and add it to the
4186641835
* preMasterSecret here. */
41867-
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
41868-
ssl->arrays->client_identity, ssl->arrays->psk_key,
41869-
MAX_PSK_KEY_LEN);
41870-
41871-
if (ssl->arrays->psk_keySz == 0 ||
41872-
(ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN &&
41873-
(int)ssl->arrays->psk_keySz != WC_NO_ERR_TRACE(USE_HW_PSK))) {
41874-
#if defined(WOLFSSL_EXTRA_ALERTS) || \
41875-
defined(WOLFSSL_PSK_IDENTITY_ALERT)
41876-
SendAlert(ssl, alert_fatal,
41877-
unknown_psk_identity);
41878-
#endif
41836+
if (AddPSKtoPreMasterSecret(ssl))
4187941837
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
41880-
}
41881-
/* SERVER: Pre-shared Key for peer authentication. */
41882-
ssl->options.peerAuthGood = 1;
41883-
41884-
if ((int)ssl->arrays->psk_keySz > 0) {
41885-
c16toa((word16) ssl->arrays->psk_keySz, pms);
41886-
pms += OPAQUE16_LEN;
41887-
41888-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41889-
ssl->arrays->preMasterSz += ssl->arrays->psk_keySz + OPAQUE16_LEN;
41890-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41891-
}
41892-
ssl->arrays->psk_keySz = 0; /* no further need */
41838+
MakePSKPreMasterSecret(ssl->arrays,
41839+
(word16)ssl->arrays->preMasterSz);
4189341840
break;
4189441841
}
4189541842
#endif /* !NO_DH && !NO_PSK */
4189641843
#if (defined(HAVE_ECC) || defined(HAVE_CURVE25519) || \
4189741844
defined(HAVE_CURVE448)) && !defined(NO_PSK)
4189841845
case ecdhe_psk_kea:
4189941846
{
41900-
byte* pms = ssl->arrays->preMasterSecret;
4190141847
word16 clientSz = (word16)args->sigSz;
4190241848

4190341849
/* skip past the imported peer key */
4190441850
args->idx += args->length;
4190541851

4190641852
/* Add preMasterSecret */
41907-
c16toa(clientSz, pms);
41908-
ssl->arrays->preMasterSz = OPAQUE16_LEN + clientSz;
41909-
pms += ssl->arrays->preMasterSz;
41853+
ssl->arrays->preMasterSz = clientSz;
4191041854

4191141855
/* Use the PSK hint to look up the PSK and add it to the
4191241856
* preMasterSecret here. */
41913-
ssl->arrays->psk_keySz = ssl->options.server_psk_cb(ssl,
41914-
ssl->arrays->client_identity, ssl->arrays->psk_key,
41915-
MAX_PSK_KEY_LEN);
41916-
41917-
if (ssl->arrays->psk_keySz == 0 ||
41918-
(ssl->arrays->psk_keySz > MAX_PSK_KEY_LEN &&
41919-
(int)ssl->arrays->psk_keySz != WC_NO_ERR_TRACE(USE_HW_PSK))) {
41857+
if (AddPSKtoPreMasterSecret(ssl))
4192041858
ERROR_OUT(PSK_KEY_ERROR, exit_dcke);
41921-
}
41922-
/* SERVER: Pre-shared Key for peer authentication. */
41923-
ssl->options.peerAuthGood = 1;
41924-
if ((int)ssl->arrays->psk_keySz > 0) {
41925-
c16toa((word16) ssl->arrays->psk_keySz, pms);
41926-
pms += OPAQUE16_LEN;
41927-
41928-
XMEMCPY(pms, ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41929-
ssl->arrays->preMasterSz += ssl->arrays->psk_keySz + OPAQUE16_LEN;
41930-
ForceZero(ssl->arrays->psk_key, ssl->arrays->psk_keySz);
41931-
}
41932-
ssl->arrays->psk_keySz = 0; /* no further need */
41859+
MakePSKPreMasterSecret(ssl->arrays,
41860+
(word16)ssl->arrays->preMasterSz);
4193341861
break;
4193441862
}
4193541863
#endif /* (HAVE_ECC || CURVE25519 || CURVE448) && !NO_PSK */

0 commit comments

Comments
 (0)