diff options
Diffstat (limited to 'nx_secure/src/nx_secure_process_client_key_exchange.c')
| -rw-r--r-- | nx_secure/src/nx_secure_process_client_key_exchange.c | 55 |
1 files changed, 54 insertions, 1 deletions
diff --git a/nx_secure/src/nx_secure_process_client_key_exchange.c b/nx_secure/src/nx_secure_process_client_key_exchange.c index 97fd37d6..5e608abc 100644 --- a/nx_secure/src/nx_secure_process_client_key_exchange.c +++ b/nx_secure/src/nx_secure_process_client_key_exchange.c @@ -9,6 +9,8 @@ * SPDX-License-Identifier: MIT **************************************************************************/ +// Some portions generated by Codex gpt-5.5. + /**************************************************************************/ /**************************************************************************/ @@ -93,6 +95,10 @@ UINT _nx_secure_process_client_key_exchange(const NX_SECURE_TLS_CIPHERSUITE_INFO USHORT length; #endif UINT status = NX_SECURE_TLS_UNEXPECTED_MESSAGE; +#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES +UINT psk_identity_length; +UINT generate_psk_secret; +#endif #if defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE) || !defined(NX_SECURE_DISABLE_X509) const NX_CRYPTO_METHOD *public_cipher_method; #endif @@ -176,8 +182,37 @@ UINT private_key_length; #ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES /* Check for PSK ciphersuites and generate the pre-master-secret. */ + generate_psk_secret = NX_FALSE; if (ciphersuite -> nx_secure_tls_public_auth -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK) { + if (message_length < 2) + { + return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH); + } + + psk_identity_length = (UINT)((packet_buffer[0] << 8) | packet_buffer[1]); + if ((psk_identity_length > NX_SECURE_TLS_MAX_PSK_ID_SIZE) || + ((psk_identity_length + 2u) > message_length)) + { + return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH); + } + + NX_SECURE_MEMCPY(tls_credentials -> nx_secure_tls_remote_psk_id, &packet_buffer[2], psk_identity_length); /* Use case of memcpy is verified. */ + tls_credentials -> nx_secure_tls_remote_psk_id_size = psk_identity_length; + packet_buffer = &packet_buffer[2 + psk_identity_length]; + message_length -= psk_identity_length + 2u; + generate_psk_secret = NX_TRUE; + +#if defined(NX_SECURE_ENABLE_ECC_CIPHERSUITE) && !defined(NX_SECURE_DISABLE_X509) + if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE) + { + generate_psk_secret = NX_FALSE; + } +#endif + } + + if (generate_psk_secret == NX_TRUE) + { status = _nx_secure_generate_premaster_secret(ciphersuite, protocol_version, tls_key_material, tls_credentials, NX_SECURE_TLS_SESSION_TYPE_SERVER, received_remote_credentials, public_cipher_metadata, public_cipher_metadata_size, tls_ecc_curves); @@ -193,6 +228,11 @@ UINT private_key_length; if (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDH || ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE) { + if (message_length < 1) + { + return(NX_SECURE_TLS_INCORRECT_MESSAGE_LENGTH); + } + length = packet_buffer[0]; if ((UINT)length + 1 > message_length) @@ -334,6 +374,20 @@ UINT private_key_length; return(status); } } + +#ifdef NX_SECURE_ENABLE_PSK_CIPHERSUITES + if ((ciphersuite -> nx_secure_tls_public_auth -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_PSK) && + (ciphersuite -> nx_secure_tls_public_cipher -> nx_crypto_algorithm == NX_CRYPTO_KEY_EXCHANGE_ECDHE)) + { + status = _nx_secure_generate_premaster_secret(ciphersuite, protocol_version, tls_key_material, tls_credentials, + NX_SECURE_TLS_SESSION_TYPE_SERVER, received_remote_credentials, + public_cipher_metadata, public_cipher_metadata_size, tls_ecc_curves); + if (status != NX_SUCCESS) + { + return(status); + } + } +#endif } else #endif /* NX_SECURE_ENABLE_ECC_CIPHERSUITE && !NX_SECURE_DISABLE_X509 */ @@ -579,4 +633,3 @@ UINT private_key_length; return(status); } - |