Skip to content

Commit aa668c4

Browse files
julek-wolfssljulek-wolfssl
committed
Check KeyShare after HRR
1 parent 5512c2d commit aa668c4

File tree

7 files changed

+111
-2
lines changed

7 files changed

+111
-2
lines changed

‎src/tls.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9979,6 +9979,20 @@ int TLSX_KeyShare_Parse_ClientHello(const WOLFSSL* ssl,
99799979
offset += ret;
99809980
}
99819981

9982+
if (ssl->hrr_keyshare_group != 0) {
9983+
/*
9984+
* https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.8
9985+
* when sending the new ClientHello, the client MUST
9986+
* replace the original "key_share" extension with one containing only a
9987+
* new KeyShareEntry for the group indicated in the selected_group field
9988+
* of the triggering HelloRetryRequest
9989+
*/
9990+
if (seenGroupsCnt != 1 || seenGroups[0] != ssl->hrr_keyshare_group) {
9991+
WOLFSSL_ERROR_VERBOSE(BAD_KEY_SHARE_DATA);
9992+
return BAD_KEY_SHARE_DATA;
9993+
}
9994+
}
9995+
99829996
return 0;
99839997
}
99849998

‎src/tls13.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7475,6 +7475,15 @@ int SendTls13ServerHello(WOLFSSL* ssl, byte extMsgType)
74757475
if (ret != 0)
74767476
return ret;
74777477

7478+
if (extMsgType == hello_retry_request) {
7479+
TLSX* ksExt = TLSX_Find(ssl->extensions, TLSX_KEY_SHARE);
7480+
if (ksExt != NULL) {
7481+
KeyShareEntry* kse = (KeyShareEntry*)ksExt->data;
7482+
if (kse != NULL)
7483+
ssl->hrr_keyshare_group = kse->group;
7484+
}
7485+
}
7486+
74787487
#ifdef WOLFSSL_SEND_HRR_COOKIE
74797488
if (ssl->options.sendCookie && extMsgType == hello_retry_request) {
74807489
/* Reset the hashes from here. We will be able to restart the hashes

‎tests/api.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -268,7 +268,7 @@
268268
#endif
269269

270270
#ifdef WOLFSSL_DUMP_MEMIO_STREAM
271-
const char* currentTestName;
271+
const char* currentTestName = NULL;
272272
char tmpDirName[16];
273273
int tmpDirNameSet = 0;
274274
#endif

‎tests/api/test_tls13.c‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2483,3 +2483,81 @@ int test_tls13_ks_missing(void)
24832483
#endif
24842484
return EXPECT_RESULT();
24852485
}
2486+
2487+
int test_key_share_mismatch(void)
2488+
{
2489+
EXPECT_DECLS;
2490+
#if defined(WOLFSSL_TLS13) && defined(HAVE_SUPPORTED_CURVES) && defined(HAVE_ECC)
2491+
/* Taken from payload in https://github.com/wolfSSL/wolfssl/issues/9362 */
2492+
const byte ch1_bin[] = {
2493+
0x16, 0x03, 0x03, 0x00, 0x96, 0x01, 0x00, 0x00, 0x92, 0x03, 0x03, 0x01,
2494+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2495+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2496+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x20, 0x03, 0x03, 0x03, 0x03,
2497+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
2498+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
2499+
0x03, 0x03, 0x03, 0x03, 0x00, 0x02, 0x13, 0x01, 0x01, 0x00, 0x00, 0x47,
2500+
0x00, 0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x18, 0x00, 0x17, 0x00, 0x1d,
2501+
0x00, 0x0d, 0x00, 0x06, 0x00, 0x04, 0x04, 0x01, 0x08, 0x04, 0x00, 0x33,
2502+
0x00, 0x26, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20, 0x07, 0xaa, 0xff, 0x3e,
2503+
0x9f, 0xc1, 0x67, 0x27, 0x55, 0x44, 0xf4, 0xc3, 0xa6, 0xa1, 0x7c, 0xd8,
2504+
0x37, 0xf2, 0xec, 0x6e, 0x78, 0xcd, 0x8a, 0x57, 0xb1, 0xe3, 0xdf, 0xb3,
2505+
0xcc, 0x03, 0x5a, 0x76, 0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04
2506+
};
2507+
const byte ch2_bin[] = {
2508+
0x16, 0x03, 0x03, 0x00, 0xb7, 0x01, 0x00, 0x00, 0xb3, 0x03, 0x03, 0x01,
2509+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2510+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2511+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x20, 0x03, 0x03, 0x03, 0x03,
2512+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
2513+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
2514+
0x03, 0x03, 0x03, 0x03, 0x00, 0x02, 0x13, 0x01, 0x01, 0x00, 0x00, 0x68,
2515+
0x00, 0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x18, 0x00, 0x17, 0x00, 0x1d,
2516+
0x00, 0x0d, 0x00, 0x06, 0x00, 0x04, 0x04, 0x01, 0x08, 0x04, 0x00, 0x33,
2517+
0x00, 0x47, 0x00, 0x45, 0x00, 0x17, 0x00, 0x41, 0x04, 0x0c, 0x90, 0x1d,
2518+
0x42, 0x3c, 0x83, 0x1c, 0xa8, 0x5e, 0x27, 0xc7, 0x3c, 0x26, 0x3b, 0xa1,
2519+
0x32, 0x72, 0x1b, 0xb9, 0xd7, 0xa8, 0x4c, 0x4f, 0x03, 0x80, 0xb2, 0xa6,
2520+
0x75, 0x6f, 0xd6, 0x01, 0x33, 0x1c, 0x88, 0x70, 0x23, 0x4d, 0xec, 0x87,
2521+
0x85, 0x04, 0xc1, 0x74, 0x14, 0x4f, 0xa4, 0xb1, 0x4b, 0x66, 0xa6, 0x51,
2522+
0x69, 0x16, 0x06, 0xd8, 0x17, 0x3e, 0x55, 0xbd, 0x37, 0xe3, 0x81, 0x56,
2523+
0x9e, 0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04
2524+
};
2525+
WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL;
2526+
WOLFSSL *ssl_c = NULL, *ssl_s = NULL;
2527+
struct test_memio_ctx test_ctx;
2528+
int client_group[] = {WOLFSSL_ECC_SECP521R1};
2529+
int server_group[] = {WOLFSSL_ECC_SECP384R1, WOLFSSL_ECC_SECP256R1};
2530+
2531+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2532+
ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
2533+
wolfTLSv1_3_client_method, wolfTLSv1_3_server_method), 0);
2534+
ExpectIntEQ(wolfSSL_set_groups(ssl_c,
2535+
client_group, XELEM_CNT(client_group)), WOLFSSL_SUCCESS);
2536+
ExpectIntEQ(wolfSSL_set_groups(ssl_s,
2537+
server_group, XELEM_CNT(server_group)), WOLFSSL_SUCCESS);
2538+
ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), -1);
2539+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), BAD_KEY_SHARE_DATA);
2540+
2541+
wolfSSL_free(ssl_s);
2542+
ssl_s = NULL;
2543+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2544+
ExpectIntEQ(test_memio_setup(&test_ctx, NULL, &ctx_s, NULL, &ssl_s,
2545+
NULL, wolfTLSv1_3_server_method), 0);
2546+
ExpectIntEQ(wolfSSL_set_groups(ssl_s,
2547+
server_group, XELEM_CNT(server_group)), WOLFSSL_SUCCESS);
2548+
ExpectIntEQ(test_memio_inject_message(&test_ctx, 0, (const char*)ch1_bin,
2549+
sizeof(ch1_bin)), 0);
2550+
ExpectIntEQ(wolfSSL_accept(ssl_s), -1);
2551+
ExpectIntEQ(wolfSSL_get_error(ssl_s, -1), WOLFSSL_ERROR_WANT_READ);
2552+
ExpectIntEQ(test_memio_inject_message(&test_ctx, 0, (const char*)ch2_bin,
2553+
sizeof(ch2_bin)), 0);
2554+
ExpectIntEQ(wolfSSL_accept(ssl_s), -1);
2555+
ExpectIntEQ(wolfSSL_get_error(ssl_s, -1), BAD_KEY_SHARE_DATA);
2556+
2557+
wolfSSL_free(ssl_c);
2558+
wolfSSL_free(ssl_s);
2559+
wolfSSL_CTX_free(ctx_c);
2560+
wolfSSL_CTX_free(ctx_s);
2561+
#endif
2562+
return EXPECT_RESULT();
2563+
}

‎tests/api/test_tls13.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ int test_tls13_rpk_handshake(void);
3131
int test_tls13_pq_groups(void);
3232
int test_tls13_early_data(void);
3333
int test_tls13_same_ch(void);
34+
int test_key_share_mismatch(void);
3435
int test_tls13_hrr_different_cs(void);
3536
int test_tls13_sg_missing(void);
3637
int test_tls13_ks_missing(void);
@@ -45,6 +46,7 @@ int test_tls13_ks_missing(void);
4546
TEST_DECL_GROUP("tls13", test_tls13_same_ch), \
4647
TEST_DECL_GROUP("tls13", test_tls13_hrr_different_cs), \
4748
TEST_DECL_GROUP("tls13", test_tls13_sg_missing), \
48-
TEST_DECL_GROUP("tls13", test_tls13_ks_missing)
49+
TEST_DECL_GROUP("tls13", test_tls13_ks_missing), \
50+
TEST_DECL_GROUP("tls13", test_key_share_mismatch)
4951

5052
#endif /* WOLFCRYPT_TEST_TLS13_H */

‎tests/utils.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@
2727
#ifndef TESTS_UTILS_H
2828
#define TESTS_UTILS_H
2929

30+
#ifdef WOLFSSL_DUMP_MEMIO_STREAM
31+
extern char tmpDirName[16];
32+
extern const char* currentTestName;
33+
#endif
34+
3035
#if !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
3136
(!defined(NO_RSA) || defined(HAVE_RPK)) && \
3237
!defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \

‎wolfssl/internal.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6150,6 +6150,7 @@ struct WOLFSSL {
61506150
void* session_ticket_ctx;
61516151
byte expect_session_ticket;
61526152
#endif
6153+
word16 hrr_keyshare_group;
61536154
#endif /* HAVE_TLS_EXTENSIONS */
61546155
#ifdef HAVE_OCSP
61556156
void* ocspIOCtx;

0 commit comments

Comments
 (0)