WolfSSL
/
wolfssl
mirror of https://github.com/wolfSSL/wolfssl.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #4903 from julek-wolfssl/psk-resuming-certs 

OpenSSL considers PSK resuming
pull/4911/head
Sean Parkinson 2022-03-02 08:57:40 +10:00 committed by GitHub
parent b21036947c 5aef687414
commit d1ba82d5e5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/tls13.c
View File

@ -3958,6 +3958,10 @@ static int FindPsk(WOLFSSL* ssl, PreSharedKey* psk, byte* suite, int* err)
/* Derive the early secret using the PSK. */
ret = DeriveEarlySecret(ssl);
}
if ((ret == 0) && found) {
/* PSK negotiation has succeeded */
ssl->options.isPSK = 1;
}
}
*err = ret;
@ -6912,6 +6916,13 @@ int DoTls13Finished(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
/* verify the client sent certificate if required */
if (ssl->options.side == WOLFSSL_SERVER_END && !ssl->options.resuming &&
(ssl->options.mutualAuth || ssl->options.failNoCert)) {
#ifdef OPENSSL_COMPATIBLE_DEFAULTS
if (ssl->options.isPSK) {
WOLFSSL_MSG("TLS v1.3 client used PSK but cert required. Allowing "
"for OpenSSL compatibility");
}
else
#endif
if (!ssl->options.havePeerCert || !ssl->options.havePeerVerify) {
ret = NO_PEER_CERT; /* NO_PEER_VERIFY */
WOLFSSL_MSG("TLS v1.3 client did not present peer cert");

1
wolfssl/internal.h
View File

@ -3636,6 +3636,7 @@ typedef struct Options {
word16 failNoCertxPSK:1; /* fail for no cert except with PSK */
word16 downgrade:1; /* allow downgrade of versions */
word16 resuming:1;
word16 isPSK:1;
word16 haveSessionId:1; /* server may not send */
word16 tls:1; /* using TLS ? */
word16 tls1_1:1; /* using TLSv1.1+ ? */