devs/libstrophe-gh
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix SCRAM-*-PLUS SASL mechanisms with OpenSSL and TLS < v1.3

Browse Source 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
This commit is contained in:
Steffen Jaeckel
2024-02-21 12:24:59 +01:00
parent 1cf09b1870
commit 40f2452fb0
1 changed files with 25 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/tls_openssl.c
View File

@@ -750,8 +750,9 @@ int tls_init_channel_binding(tls_t *tls,
{
const char *label = NULL;
size_t labellen = 0;
int ssl_version = SSL_version(tls->ssl);
switch (SSL_version(tls->ssl)) {
switch (ssl_version) {
case SSL3_VERSION:
*binding_prefix = "tls-unique";
*binding_prefix_len = strlen("tls-unique");
@@ -774,7 +775,7 @@ int tls_init_channel_binding(tls_t *tls,
break;
#endif
default:
strophe_error(tls->ctx, "tls", "Unsupported TLS Version: %s",
strophe_error(tls->ctx, "tls", "Unsupported TLS/SSL Version: %s",
SSL_get_version(tls->ssl));
return -1;
}
@@ -785,11 +786,28 @@ int tls_init_channel_binding(tls_t *tls,
if (!tls->channel_binding_data)
return -1;
if (SSL_export_keying_material(tls->ssl, tls->channel_binding_data,
tls->channel_binding_size, label, labellen,
NULL, 0, 0) != 1) {
strophe_error(tls->ctx, "tls", "Could not get channel binding data");
return -1;
if (ssl_version <= TLS1_2_VERSION) {
size_t len;
if (SSL_session_reused(tls->ssl)) {
len = SSL_get_peer_finished(tls->ssl, tls->channel_binding_data,
tls->channel_binding_size);
} else {
len = SSL_get_finished(tls->ssl, tls->channel_binding_data,
tls->channel_binding_size);
}
if (len != tls->channel_binding_size) {
strophe_error(tls->ctx, "tls",
"Got channel binding data of wrong size %zu", len);
return -1;
}
} else {
if (SSL_export_keying_material(tls->ssl, tls->channel_binding_data,
tls->channel_binding_size, label,
labellen, NULL, 0, 0) != 1) {
strophe_error(tls->ctx, "tls",
"Could not get channel binding data");
return -1;
}
}
return 0;
}