Merge pull request #391 from eclipse-threadx/devv6.5.1.202602_reldev

Merging changes for the v.6.5.1.202602 release

1 files changed, 54 insertions, 1 deletions

diff --git a/nx_secure/src/nx_secure_process_client_key_exchange.c b/nx_secure/src/nx_secure_process_client_key_exchange.c
index 97fd37d6..5e608abc 100644
--- a/nx_secure/src/nx_secure_process_client_key_exchange.c
+++ b/nx_secure/src/nx_secure_process_client_key_exchange.c
@@ -9,6 +9,8 @@
  * SPDX-License-Identifier: MIT
  **************************************************************************/
 
+// Some portions generated by Codex gpt-5.5.
+
 
 /**************************************************************************/
 /**************************************************************************/
@@ -93,6 +95,10 @@ UINT _nx_secure_process_client_key_exchange(const NX_SECURE_TLS_CIPHERSUITE_INFO
 USHORT                              length;
 #endif
 UINT                                status = NX_SECURE_TLS_UNEXPECTED_MESSAGE;
+#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
+UINT                                psk_identity_length;
+UINT                                generate_psk_secret;
+#endif
 #if defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE) || !defined(NX_SECURE_DISABLE_X509)
 const NX_CRYPTO_METHOD             *public_cipher_method;
 #endif
@@ -176,8 +182,37 @@ UINT                                private_key_length;
 
 #ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
         /* Check for PSK ciphersuites and generate the pre-master-secret. */
+        generate_psk_secret = NX_FALSE;
         if (ciphersuite -> nx_secure_tls_public_auth -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK)
         {
+            if (message_length < 2)
+            {
+                return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
+            }
+
+            psk_identity_length = (UINT)((packet_buffer[0] << 8) | packet_buffer[1]);
+            if ((psk_identity_length > NX_SECURE_TLS_MAX_PSK_ID_SIZE) ||
+                ((psk_identity_length + 2u) > message_length))
+            {
+                return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
+            }
+
+            NX_SECURE_MEMCPY(tls_credentials -> nx_secure_tls_remote_psk_id, &packet_buffer[2], psk_identity_length); /* Use case of memcpy is verified. */
+            tls_credentials -> nx_secure_tls_remote_psk_id_size = psk_identity_length;
+            packet_buffer = &packet_buffer[2 + psk_identity_length];
+            message_length -= psk_identity_length + 2u;
+            generate_psk_secret = NX_TRUE;
+
+#if defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) && !defined(NX_SECURE_DISABLE_X509)
+            if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE)
+            {
+                generate_psk_secret = NX_FALSE;
+            }
+#endif
+        }
+
+        if (generate_psk_secret == NX_TRUE)
+        {
             status = _nx_secure_generate_premaster_secret(ciphersuite, protocol_version, tls_key_material, tls_credentials,
                                                           NX_SECURE_TLS_SESSION_TYPE_SERVER, received_remote_credentials,
                                                           public_cipher_metadata, public_cipher_metadata_size, tls_ecc_curves);
@@ -193,6 +228,11 @@ UINT                                private_key_length;
         if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDH ||
             ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE)
         {
+            if (message_length < 1)
+            {
+                return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH);
+            }
+
             length = packet_buffer[0];
 
             if ((UINT)length + 1 > message_length)
@@ -334,6 +374,20 @@ UINT                                private_key_length;
                     return(status);
                 }
             }
+
+#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES
+            if ((ciphersuite -> nx_secure_tls_public_auth -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK) &&
+                (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE))
+            {
+                status = _nx_secure_generate_premaster_secret(ciphersuite, protocol_version, tls_key_material, tls_credentials,
+                                                              NX_SECURE_TLS_SESSION_TYPE_SERVER, received_remote_credentials,
+                                                              public_cipher_metadata, public_cipher_metadata_size, tls_ecc_curves);
+                if (status != NX_SUCCESS)
+                {
+                    return(status);
+                }
+            }
+#endif
         }
         else
 #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE && !NX_SECURE_DISABLE_X509 */
@@ -579,4 +633,3 @@ UINT                                private_key_length;
 
     return(status);
 }
-