denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libtls: Implement TLS 1.3 handshake on client-side

Browse Source 
The code is a minimal handshake with the HelloRetryRequest message
implementation missing.
Can be tested with an OpenSSL server running TLS 1.3. The server must
be at least version 1.1.1 (September 2018).

Co-authored-by: ryru <[email protected]>
This commit is contained in:
bytinbit
2021-02-12 11:45:44 +01:00
committed by Tobias Brunner
co-authored by ryru
parent 02d7405512
commit 7a2b02667c
11 changed files with 1398 additions and 283 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls_protection.c
+13 -16
View File
@@ -73,23 +73,19 @@ METHOD(tls_protection_t, process, status_t,
return NEED_MORE;
}
if (this->aead_in)
if (this-> version < TLS_1_3 ||
type == TLS_APPLICATION_DATA)
{
if (!this->aead_in->decrypt(this->aead_in, this->version,
&type, this->seq_in, &data))
if (this->aead_in)
{
DBG1(DBG_TLS, "TLS record decryption failed");
this->alert->add(this->alert, TLS_FATAL, TLS_BAD_RECORD_MAC);
return NEED_MORE;
if (!this->aead_in->decrypt(this->aead_in, this->version,
&type, this->seq_in, &data))
{
DBG1(DBG_TLS, "TLS record decryption failed");
this->alert->add(this->alert, TLS_FATAL, TLS_BAD_RECORD_MAC);
return NEED_MORE;
}
}
}
if (type == TLS_CHANGE_CIPHER_SPEC)
{
this->seq_in = 0;
}
else
{
this->seq_in++;
}
return this->compression->process(this->compression, type, data);
@@ -103,9 +99,8 @@ METHOD(tls_protection_t, build, status_t,
status = this->compression->build(this->compression, type, data);
if (status == NEED_MORE)
{
if (*type == TLS_CHANGE_CIPHER_SPEC)
if (this-> version < TLS_1_3 && *type == TLS_CHANGE_CIPHER_SPEC)
{
this->seq_out = 0;
return status;
}
if (this->aead_out)
@@ -129,10 +124,12 @@ METHOD(tls_protection_t, set_cipher, void,
if (inbound)
{
this->aead_in = aead;
this->seq_in = 0;
}
else
{
this->aead_out = aead;
this->seq_out = 0;
}
}