devs/libstrophe-gh-mirror
2
0
Fork 0
mirror of https://github.com/strophe/libstrophe.git synced 2026-08-04 19:06:22 +00:00
Code Issues 1 Packages Projects Releases Wiki Activity

Check whether the TLS stack supports channel binding.

Browse Source 
Add a runtime check per TLS stack which returns whether channel binding is
supported or not.

This fixes #270

Signed-off-by: Steffen Jaeckel <s@jaeckel.eu>
This commit is contained in:
Steffen Jaeckel
2026-07-29 09:08:41 +02:00
parent 419b616b87
commit 1d13b5d87c
6 changed files with 47 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/auth.c
View File

@@ -602,8 +602,10 @@ static int _make_scram_init_msg(struct scram_user_data *scram)
l = strophe_snprintf(message, message_len, "p=%s,,n=%s,r=%s",
binding_type, node, buf);
} else {
l = strophe_snprintf(message, message_len, "%c,,n=%s,r=%s",
is_secured ? 'y' : 'n', node, buf);
l = strophe_snprintf(
message, message_len, "%c,,n=%s,r=%s",
is_secured && tls_supports_channel_binding(conn->tls) ? 'y' : 'n',
node, buf);
}
if (l < 0 || (size_t)l >= message_len) {
goto err_msg;

1
src/tls.h
View File

@@ -45,6 +45,7 @@ unsigned int tls_id_on_xmppaddr_num(xmpp_conn_t *conn);
xmpp_tlscert_t *tls_peer_cert(xmpp_conn_t *conn);
int tls_set_credentials(tls_t *tls, const char *cafilename);
int tls_supports_channel_binding(tls_t *tls);
int tls_init_channel_binding(tls_t *tls,
const char **binding_prefix,
size_t *binding_prefix_len);

6
src/tls_dummy.c
View File

@@ -75,6 +75,12 @@ int tls_set_credentials(tls_t *tls, const char *cafilename)
return -1;
}
int tls_supports_channel_binding(tls_t *tls)
{
UNUSED(tls);
return 0;
}
int tls_init_channel_binding(tls_t *tls,
const char **binding_prefix,
size_t *binding_prefix_len)

14
src/tls_gnutls.c
View File

@@ -577,6 +577,20 @@ int tls_set_credentials(tls_t *tls, const char *cafilename)
return err == GNUTLS_E_SUCCESS;
}
int tls_supports_channel_binding(tls_t *tls)
{
switch (gnutls_protocol_get_version(tls->session)) {
case GNUTLS_SSL3:
case GNUTLS_TLS1_0:
case GNUTLS_TLS1_1:
case GNUTLS_TLS1_2:
case GNUTLS_TLS1_3:
return 1;
default:
return 0;
}
}
int tls_init_channel_binding(tls_t *tls,
const char **binding_prefix,
size_t *binding_prefix_len)

16
src/tls_openssl.c
View File

@@ -793,6 +793,22 @@ int tls_set_credentials(tls_t *tls, const char *cafilename)
return -1;
}
int tls_supports_channel_binding(tls_t *tls)
{
switch (SSL_version(tls->ssl)) {
case SSL3_VERSION:
case TLS1_VERSION:
case TLS1_1_VERSION:
case TLS1_2_VERSION:
#ifdef TLS1_3_VERSION
case TLS1_3_VERSION:
#endif
return 1;
default:
return 0;
}
}
int tls_init_channel_binding(tls_t *tls,
const char **binding_prefix,
size_t *binding_prefix_len)

6
src/tls_schannel.c
View File

@@ -237,6 +237,12 @@ int tls_set_credentials(tls_t *tls, const char *cafilename)
return -1;
}
int tls_supports_channel_binding(tls_t *tls)
{
UNUSED(tls);
return 0;
}
int tls_init_channel_binding(tls_t *tls,
const char **binding_prefix,
size_t *binding_prefix_len)