Skip to content

Commit f61bfd7

Browse files
julek-wolfssljulek-wolfssl
committed
Check KeyShare after HRR
1 parent b42e9a9 commit f61bfd7

File tree

7 files changed

+113
-2
lines changed

7 files changed

+113
-2
lines changed

‎src/tls.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9979,6 +9979,20 @@ int TLSX_KeyShare_Parse_ClientHello(const WOLFSSL* ssl,
99799979
offset += ret;
99809980
}
99819981

9982+
if (ssl->hrr_keyshare_group != 0) {
9983+
/*
9984+
* https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.8
9985+
* when sending the new ClientHello, the client MUST
9986+
* replace the original "key_share" extension with one containing only a
9987+
* new KeyShareEntry for the group indicated in the selected_group field
9988+
* of the triggering HelloRetryRequest
9989+
*/
9990+
if (seenGroupsCnt != 1 || seenGroups[0] != ssl->hrr_keyshare_group) {
9991+
WOLFSSL_ERROR_VERBOSE(BAD_KEY_SHARE_DATA);
9992+
return BAD_KEY_SHARE_DATA;
9993+
}
9994+
}
9995+
99829996
return 0;
99839997
}
99849998

‎src/tls13.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7475,6 +7475,15 @@ int SendTls13ServerHello(WOLFSSL* ssl, byte extMsgType)
74757475
if (ret != 0)
74767476
return ret;
74777477

7478+
if (extMsgType == hello_retry_request) {
7479+
TLSX* ksExt = TLSX_Find(ssl->extensions, TLSX_KEY_SHARE);
7480+
if (ksExt != NULL) {
7481+
KeyShareEntry* kse = (KeyShareEntry*)ksExt->data;
7482+
if (kse != NULL)
7483+
ssl->hrr_keyshare_group = kse->group;
7484+
}
7485+
}
7486+
74787487
#ifdef WOLFSSL_SEND_HRR_COOKIE
74797488
if (ssl->options.sendCookie && extMsgType == hello_retry_request) {
74807489
/* Reset the hashes from here. We will be able to restart the hashes

‎tests/api.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -268,7 +268,7 @@
268268
#endif
269269

270270
#ifdef WOLFSSL_DUMP_MEMIO_STREAM
271-
const char* currentTestName;
271+
const char* currentTestName = NULL;
272272
char tmpDirName[16];
273273
int tmpDirNameSet = 0;
274274
#endif

‎tests/api/test_tls13.c‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2572,3 +2572,83 @@ int test_tls13_duplicate_extension(void)
25722572
}
25732573

25742574

2575+
2576+
int test_key_share_mismatch(void)
2577+
{
2578+
EXPECT_DECLS;
2579+
#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_TLS13) && \
2580+
defined(HAVE_SUPPORTED_CURVES) && defined(HAVE_ECC) && \
2581+
defined(BUILD_TLS_AES_128_GCM_SHA256)
2582+
/* Taken from payload in https://github.com/wolfSSL/wolfssl/issues/9362 */
2583+
const byte ch1_bin[] = {
2584+
0x16, 0x03, 0x03, 0x00, 0x96, 0x01, 0x00, 0x00, 0x92, 0x03, 0x03, 0x01,
2585+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2586+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2587+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x20, 0x03, 0x03, 0x03, 0x03,
2588+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
2589+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
2590+
0x03, 0x03, 0x03, 0x03, 0x00, 0x02, 0x13, 0x01, 0x01, 0x00, 0x00, 0x47,
2591+
0x00, 0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x18, 0x00, 0x17, 0x00, 0x1d,
2592+
0x00, 0x0d, 0x00, 0x06, 0x00, 0x04, 0x04, 0x01, 0x08, 0x04, 0x00, 0x33,
2593+
0x00, 0x26, 0x00, 0x24, 0x00, 0x1d, 0x00, 0x20, 0x07, 0xaa, 0xff, 0x3e,
2594+
0x9f, 0xc1, 0x67, 0x27, 0x55, 0x44, 0xf4, 0xc3, 0xa6, 0xa1, 0x7c, 0xd8,
2595+
0x37, 0xf2, 0xec, 0x6e, 0x78, 0xcd, 0x8a, 0x57, 0xb1, 0xe3, 0xdf, 0xb3,
2596+
0xcc, 0x03, 0x5a, 0x76, 0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04
2597+
};
2598+
const byte ch2_bin[] = {
2599+
0x16, 0x03, 0x03, 0x00, 0xb7, 0x01, 0x00, 0x00, 0xb3, 0x03, 0x03, 0x01,
2600+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2601+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
2602+
0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x20, 0x03, 0x03, 0x03, 0x03,
2603+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
2604+
0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03,
2605+
0x03, 0x03, 0x03, 0x03, 0x00, 0x02, 0x13, 0x01, 0x01, 0x00, 0x00, 0x68,
2606+
0x00, 0x0a, 0x00, 0x08, 0x00, 0x06, 0x00, 0x18, 0x00, 0x17, 0x00, 0x1d,
2607+
0x00, 0x0d, 0x00, 0x06, 0x00, 0x04, 0x04, 0x01, 0x08, 0x04, 0x00, 0x33,
2608+
0x00, 0x47, 0x00, 0x45, 0x00, 0x17, 0x00, 0x41, 0x04, 0x0c, 0x90, 0x1d,
2609+
0x42, 0x3c, 0x83, 0x1c, 0xa8, 0x5e, 0x27, 0xc7, 0x3c, 0x26, 0x3b, 0xa1,
2610+
0x32, 0x72, 0x1b, 0xb9, 0xd7, 0xa8, 0x4c, 0x4f, 0x03, 0x80, 0xb2, 0xa6,
2611+
0x75, 0x6f, 0xd6, 0x01, 0x33, 0x1c, 0x88, 0x70, 0x23, 0x4d, 0xec, 0x87,
2612+
0x85, 0x04, 0xc1, 0x74, 0x14, 0x4f, 0xa4, 0xb1, 0x4b, 0x66, 0xa6, 0x51,
2613+
0x69, 0x16, 0x06, 0xd8, 0x17, 0x3e, 0x55, 0xbd, 0x37, 0xe3, 0x81, 0x56,
2614+
0x9e, 0x00, 0x2b, 0x00, 0x03, 0x02, 0x03, 0x04
2615+
};
2616+
WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL;
2617+
WOLFSSL *ssl_c = NULL, *ssl_s = NULL;
2618+
struct test_memio_ctx test_ctx;
2619+
int client_group[] = {WOLFSSL_ECC_SECP521R1};
2620+
int server_group[] = {WOLFSSL_ECC_SECP384R1, WOLFSSL_ECC_SECP256R1};
2621+
2622+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2623+
ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
2624+
wolfTLSv1_3_client_method, wolfTLSv1_3_server_method), 0);
2625+
ExpectIntEQ(wolfSSL_set_groups(ssl_c,
2626+
client_group, XELEM_CNT(client_group)), WOLFSSL_SUCCESS);
2627+
ExpectIntEQ(wolfSSL_set_groups(ssl_s,
2628+
server_group, XELEM_CNT(server_group)), WOLFSSL_SUCCESS);
2629+
ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), -1);
2630+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), BAD_KEY_SHARE_DATA);
2631+
2632+
wolfSSL_free(ssl_s);
2633+
ssl_s = NULL;
2634+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2635+
ExpectIntEQ(test_memio_setup(&test_ctx, NULL, &ctx_s, NULL, &ssl_s,
2636+
NULL, wolfTLSv1_3_server_method), 0);
2637+
ExpectIntEQ(wolfSSL_set_groups(ssl_s,
2638+
server_group, XELEM_CNT(server_group)), WOLFSSL_SUCCESS);
2639+
ExpectIntEQ(test_memio_inject_message(&test_ctx, 0, (const char*)ch1_bin,
2640+
sizeof(ch1_bin)), 0);
2641+
ExpectIntEQ(wolfSSL_accept(ssl_s), -1);
2642+
ExpectIntEQ(wolfSSL_get_error(ssl_s, -1), WOLFSSL_ERROR_WANT_READ);
2643+
ExpectIntEQ(test_memio_inject_message(&test_ctx, 0, (const char*)ch2_bin,
2644+
sizeof(ch2_bin)), 0);
2645+
ExpectIntEQ(wolfSSL_accept(ssl_s), -1);
2646+
ExpectIntEQ(wolfSSL_get_error(ssl_s, -1), BAD_KEY_SHARE_DATA);
2647+
2648+
wolfSSL_free(ssl_c);
2649+
wolfSSL_free(ssl_s);
2650+
wolfSSL_CTX_free(ctx_c);
2651+
wolfSSL_CTX_free(ctx_s);
2652+
#endif
2653+
return EXPECT_RESULT();
2654+
}

‎tests/api/test_tls13.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ int test_tls13_rpk_handshake(void);
3131
int test_tls13_pq_groups(void);
3232
int test_tls13_early_data(void);
3333
int test_tls13_same_ch(void);
34+
int test_key_share_mismatch(void);
3435
int test_tls13_hrr_different_cs(void);
3536
int test_tls13_sg_missing(void);
3637
int test_tls13_ks_missing(void);
@@ -47,6 +48,7 @@ int test_tls13_duplicate_extension(void);
4748
TEST_DECL_GROUP("tls13", test_tls13_hrr_different_cs), \
4849
TEST_DECL_GROUP("tls13", test_tls13_sg_missing), \
4950
TEST_DECL_GROUP("tls13", test_tls13_ks_missing), \
50-
TEST_DECL_GROUP("tls13", test_tls13_duplicate_extension)
51+
TEST_DECL_GROUP("tls13", test_tls13_duplicate_extension), \
52+
TEST_DECL_GROUP("tls13", test_key_share_mismatch)
5153

5254
#endif /* WOLFCRYPT_TEST_TLS13_H */

‎tests/utils.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@
2727
#ifndef TESTS_UTILS_H
2828
#define TESTS_UTILS_H
2929

30+
#ifdef WOLFSSL_DUMP_MEMIO_STREAM
31+
extern char tmpDirName[16];
32+
extern const char* currentTestName;
33+
#endif
34+
3035
#if !defined(NO_FILESYSTEM) && !defined(NO_CERTS) && \
3136
(!defined(NO_RSA) || defined(HAVE_RPK)) && \
3237
!defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \

‎wolfssl/internal.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6150,6 +6150,7 @@ struct WOLFSSL {
61506150
void* session_ticket_ctx;
61516151
byte expect_session_ticket;
61526152
#endif
6153+
word16 hrr_keyshare_group;
61536154
#endif /* HAVE_TLS_EXTENSIONS */
61546155
#ifdef HAVE_OCSP
61556156
void* ocspIOCtx;

0 commit comments

Comments
 (0)