denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls-peer: Derive application traffic keys after server finished message

Browse Source 
The inbound key is used right away, the outbound key only after the
client finished message has been sent.
This commit is contained in:
Pascal Knecht
2021-02-12 14:35:23 +01:00
committed by Tobias Brunner
parent d41d8b0039
commit 2d933f318b
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_peer.c
+2 -2
View File
@@ -1710,14 +1710,14 @@ METHOD(tls_handshake_t, build, status_t,
case STATE_HELLO_DONE:
case STATE_CIPHERSPEC_CHANGED_OUT:
case STATE_FINISHED_RECEIVED:
return send_finished(this, type, writer);
case STATE_FINISHED_SENT:
if (!this->crypto->derive_app_keys(this->crypto))
{
this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
return NEED_MORE;
}
this->crypto->change_cipher(this->crypto, TRUE);
return send_finished(this, type, writer);
case STATE_FINISHED_SENT:
this->crypto->change_cipher(this->crypto, FALSE);
this->state = STATE_FINISHED_SENT_KEY_SWITCHED;
return INVALID_STATE;