summaryrefslogtreecommitdiff
path: root/nx_secure/src/nx_secure_generate_premaster_secret.c
diff options
context:
space:
mode:
authorFrédéric Desbiens <[email protected]>2026-06-08 10:03:52 +0200
committerGitHub <[email protected]>2026-06-08 10:03:52 +0200
commit1a0e9e43a03e37ddecfb6b49e9b078d6e1803d05 (patch)
treec60ec41b4ff4fd2d7566c505cbdd423ceddd65f3 /nx_secure/src/nx_secure_generate_premaster_secret.c
parent8b6e03ac30ab688bec02c69d42f2304b7f72a202 (diff)
parent4d88828b06d164a5b7e82152395a92254abcd6e4 (diff)
Merge pull request #391 from eclipse-threadx/devv6.5.1.202602_reldev
Merging changes for the v.6.5.1.202602 release
Diffstat (limited to 'nx_secure/src/nx_secure_generate_premaster_secret.c')
-rw-r--r--nx_secure/src/nx_secure_generate_premaster_secret.c180
1 files changed, 172 insertions, 8 deletions
diff --git a/nx_secure/src/nx_secure_generate_premaster_secret.c b/nx_secure/src/nx_secure_generate_premaster_secret.c
index dea98428..63f35692 100644
--- a/nx_secure/src/nx_secure_generate_premaster_secret.c
+++ b/nx_secure/src/nx_secure_generate_premaster_secret.c
@@ -9,6 +9,8 @@
* SPDX-License-Identifier: MIT
**************************************************************************/
+// Some portions generated by Codex gpt-5.5.
+
/**************************************************************************/
/**************************************************************************/
@@ -24,6 +26,141 @@
#include "nx_secure_tls.h"
+#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
+/**************************************************************************/
+/* */
+/* FUNCTION RELEASE */
+/* */
+/* _nx_secure_tls_psk_identity_lookup PORTABLE C */
+/* 6.x */
+/* AUTHOR */
+/* */
+/* Eclipse ThreadX Contributors */
+/* */
+/* DESCRIPTION */
+/* */
+/* This function searches the PSK store for an entry matching a peer */
+/* PSK identity. */
+/* */
+/* INPUT */
+/* */
+/* tls_credentials TLS credentials */
+/* psk_data Destination for PSK data */
+/* psk_length Destination for PSK length */
+/* psk_identity PSK identity data */
+/* identity_length PSK identity length */
+/* */
+/* OUTPUT */
+/* */
+/* status Completion status */
+/* */
+/* CALLS */
+/* */
+/* tx_mutex_get Get TLS protection */
+/* tx_mutex_put Release TLS protection */
+/* */
+/* CALLED BY */
+/* */
+/* _nx_secure_generate_premaster_secret Generate pre-master secret */
+/* */
+/**************************************************************************/
+static UINT _nx_secure_tls_psk_identity_lookup(NX_SECURE_TLS_CREDENTIALS *tls_credentials, UCHAR **psk_data, UINT *psk_length,
+ UCHAR *psk_identity, UINT identity_length)
+{
+UINT psk_list_size;
+UINT i;
+
+ /* Get the protection. */
+ tx_mutex_get(&_nx_secure_tls_protection, TX_WAIT_FOREVER);
+
+ psk_list_size = tls_credentials -> nx_secure_tls_psk_count;
+
+ /* Loop through all PSKs, looking for a matching identity string. */
+ for (i = 0; i < psk_list_size; ++i)
+ {
+ if (identity_length == tls_credentials -> nx_secure_tls_psk_store[i].nx_secure_tls_psk_id_size)
+ {
+ if (NX_SECURE_MEMCMP(tls_credentials -> nx_secure_tls_psk_store[i].nx_secure_tls_psk_id,
+ psk_identity, identity_length) == 0)
+ {
+ *psk_data = tls_credentials -> nx_secure_tls_psk_store[i].nx_secure_tls_psk_data;
+ *psk_length = tls_credentials -> nx_secure_tls_psk_store[i].nx_secure_tls_psk_data_size;
+
+ /* Release the protection. */
+ tx_mutex_put(&_nx_secure_tls_protection);
+
+ return(NX_SUCCESS);
+ }
+ }
+ }
+
+ /* Release the protection. */
+ tx_mutex_put(&_nx_secure_tls_protection);
+
+ return(NX_SECURE_TLS_NO_MATCHING_PSK);
+}
+
+/**************************************************************************/
+/* */
+/* FUNCTION RELEASE */
+/* */
+/* _nx_secure_tls_client_psk_save PORTABLE C */
+/* 6.x */
+/* AUTHOR */
+/* */
+/* Eclipse ThreadX Contributors */
+/* */
+/* DESCRIPTION */
+/* */
+/* This function saves the PSK store entry selected by the server */
+/* identity hint so the client sends the matching identity in */
+/* ClientKeyExchange. */
+/* */
+/* INPUT */
+/* */
+/* tls_credentials TLS credentials */
+/* psk_store_index Selected PSK store index */
+/* */
+/* OUTPUT */
+/* */
+/* status Completion status */
+/* */
+/* CALLS */
+/* */
+/* tx_mutex_get Get TLS protection */
+/* tx_mutex_put Release TLS protection */
+/* */
+/* CALLED BY */
+/* */
+/* _nx_secure_generate_premaster_secret Generate pre-master secret */
+/* */
+/**************************************************************************/
+static UINT _nx_secure_tls_client_psk_save(NX_SECURE_TLS_CREDENTIALS *tls_credentials, UINT psk_store_index)
+{
+UINT status;
+
+ /* Get the protection. */
+ tx_mutex_get(&_nx_secure_tls_protection, TX_WAIT_FOREVER);
+
+ if (psk_store_index < tls_credentials -> nx_secure_tls_psk_count)
+ {
+ NX_SECURE_MEMCPY(&tls_credentials -> nx_secure_tls_client_psk,
+ &tls_credentials -> nx_secure_tls_psk_store[psk_store_index],
+ sizeof(NX_SECURE_TLS_PSK_STORE)); /* Use case of memcpy is verified. */
+ status = NX_SUCCESS;
+ }
+ else
+ {
+ status = NX_SECURE_TLS_NO_MATCHING_PSK;
+ }
+
+ /* Release the protection. */
+ tx_mutex_put(&_nx_secure_tls_protection);
+
+ return(status);
+}
+#endif
+
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
@@ -80,6 +217,7 @@ UINT status = NX_SECURE_TLS_SUCCESS;
UCHAR *psk_data;
UINT psk_length;
UINT index;
+UINT psk_store_index;
#endif
#if defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) && !defined(NX_SECURE_DISABLE_X509)
NX_SECURE_X509_CERT *server_certificate;
@@ -125,9 +263,24 @@ UINT pre_master_secret_size;
containing the length of the PSK (in octets), and the PSK itself.
*/
- /* Client has to search for the PSK based on the identity hint. */
- status = _nx_secure_tls_psk_find(tls_credentials, &psk_data, &psk_length, tls_credentials -> nx_secure_tls_remote_psk_id,
- tls_credentials -> nx_secure_tls_remote_psk_id_size, NX_NULL);
+ if (session_type == NX_SECURE_TLS_SESSION_TYPE_SERVER)
+ {
+ /* Server searches for the PSK based on the identity requested by the client. */
+ status = _nx_secure_tls_psk_identity_lookup(tls_credentials, &psk_data, &psk_length,
+ tls_credentials -> nx_secure_tls_remote_psk_id,
+ tls_credentials -> nx_secure_tls_remote_psk_id_size);
+ }
+ else
+ {
+ /* Client has to search for the PSK based on the identity hint. */
+ status = _nx_secure_tls_psk_find(tls_credentials, &psk_data, &psk_length,
+ tls_credentials -> nx_secure_tls_remote_psk_id,
+ tls_credentials -> nx_secure_tls_remote_psk_id_size, &psk_store_index);
+ if (status == NX_SUCCESS)
+ {
+ status = _nx_secure_tls_client_psk_save(tls_credentials, psk_store_index);
+ }
+ }
if (status != NX_SUCCESS)
{
@@ -280,20 +433,32 @@ UINT pre_master_secret_size;
/* Now, using the identity as a key, find the PSK in our PSK store. */
if (session_type == NX_SECURE_TLS_SESSION_TYPE_SERVER)
{
- /* Server just uses its PSK. */
- psk_data = tls_credentials -> nx_secure_tls_psk_store[0].nx_secure_tls_psk_data;
- psk_length = tls_credentials -> nx_secure_tls_psk_store[0].nx_secure_tls_psk_data_size;
+ /* Server searches for the PSK based on the identity requested by the client. */
+ status = _nx_secure_tls_psk_identity_lookup(tls_credentials, &psk_data, &psk_length,
+ tls_credentials -> nx_secure_tls_remote_psk_id,
+ tls_credentials -> nx_secure_tls_remote_psk_id_size);
+
+ if (status != NX_SUCCESS)
+ {
+ return(status);
+ }
}
else
{
/* Client has to search for the PSK based on the identity hint. */
status = _nx_secure_tls_psk_find(tls_credentials, &psk_data, &psk_length, tls_credentials -> nx_secure_tls_remote_psk_id,
- tls_credentials -> nx_secure_tls_remote_psk_id_size, NX_NULL);
+ tls_credentials -> nx_secure_tls_remote_psk_id_size, &psk_store_index);
if (status != NX_SUCCESS)
{
return(status);
}
+
+ status = _nx_secure_tls_client_psk_save(tls_credentials, psk_store_index);
+ if (status != NX_SUCCESS)
+ {
+ return(status);
+ }
}
/* From RFC 4279:
@@ -369,4 +534,3 @@ UINT pre_master_secret_size;
return(status);
}
-
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-16 20:09:58 +0000