1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
/***************************************************************************
* Copyright (c) 2024 Microsoft Corporation
* Copyright (c) 2025-present Eclipse ThreadX Contributors
*
* This program and the accompanying materials are made available under the
* terms of the MIT License which is available at
* https://opensource.org/licenses/MIT.
*
* SPDX-License-Identifier: MIT
**************************************************************************/
/**************************************************************************/
/**************************************************************************/
/** */
/** NetX Secure Component */
/** */
/** Transport Layer Security (TLS) */
/** */
/**************************************************************************/
/**************************************************************************/
#define NX_SECURE_SOURCE_CODE
#include "nx_secure_tls.h"
/**************************************************************************/
/* */
/* FUNCTION RELEASE */
/* */
/* _nx_secure_tls_psk_find PORTABLE C */
/* 6.4.3 */
/* AUTHOR */
/* */
/* Timothy Stapko, Microsoft Corporation */
/* */
/* DESCRIPTION */
/* */
/* This function finds a pre-shared key (PSK) in a TLS session for use */
/* with a PSK ciphersuite. The PSK is found using an "identity hint" */
/* that should match a field in the PSK structure in the TLS session. */
/* */
/* INPUT */
/* */
/* tls_credentials TLS credentials */
/* psk_data Pointer to PSK data */
/* psk_length Length of PSK data */
/* psk_identity_hint PSK identity hint data */
/* identity_length Length of identity data */
/* psk_store_index Index of found PSK in store */
/* */
/* OUTPUT */
/* */
/* status Completion status */
/* */
/* CALLS */
/* */
/* tx_mutex_get Get protection mutex */
/* tx_mutex_put Put protection mutex */
/* */
/* CALLED BY */
/* */
/* _nx_secure_generate_premaster_secret Generate the shared secret */
/* used to generate keys later */
/* */
/**************************************************************************/
#if defined(NX_SECURE_ENABLE_PSK_CIPHERSUITES) || defined(NX_SECURE_ENABLE_ECJPAKE_CIPHERSUITE)
UINT _nx_secure_tls_psk_find(NX_SECURE_TLS_CREDENTIALS *tls_credentials, UCHAR **psk_data, UINT *psk_length,
UCHAR *psk_identity_hint, UINT identity_length, UINT *psk_store_index)
{
UINT psk_list_size;
UINT compare_val;
UINT i;
/* Get the protection. */
tx_mutex_get(&_nx_secure_tls_protection, TX_WAIT_FOREVER);
psk_list_size = tls_credentials -> nx_secure_tls_psk_count;
if ((psk_identity_hint[0] == 0) && (psk_list_size > 0))
{
/* No hint from server. Return the first associated PSK. */
*psk_data = tls_credentials -> nx_secure_tls_psk_store[0].nx_secure_tls_psk_data;
*psk_length = tls_credentials -> nx_secure_tls_psk_store[0].nx_secure_tls_psk_data_size;
if(psk_store_index != NX_NULL)
{
*psk_store_index = 0;
}
/* Release the protection. */
tx_mutex_put(&_nx_secure_tls_protection);
return(NX_SUCCESS);
}
/* Loop through all PSKs, looking for a matching identity string. */
for (i = 0; i < psk_list_size; ++i)
{
/* Save off the PSK and its length. */
compare_val = (UINT)NX_SECURE_MEMCMP(tls_credentials -> nx_secure_tls_psk_store[i].nx_secure_tls_psk_id_hint, psk_identity_hint, identity_length);
/* See if the identity matched, and the length is the same (without the length, we could have a
matching prefix which could be a possible attack vector... */
if (compare_val == 0 && identity_length == tls_credentials -> nx_secure_tls_psk_store[i].nx_secure_tls_psk_id_hint_size)
{
/* Found a matching identity, return the associated PSK. */
*psk_data = tls_credentials -> nx_secure_tls_psk_store[i].nx_secure_tls_psk_data;
*psk_length = tls_credentials -> nx_secure_tls_psk_store[i].nx_secure_tls_psk_data_size;
if(psk_store_index != NX_NULL)
{
*psk_store_index = i;
}
/* Release the protection. */
tx_mutex_put(&_nx_secure_tls_protection);
return(NX_SUCCESS);
}
}
/* Release the protection. */
tx_mutex_put(&_nx_secure_tls_protection);
return(NX_SECURE_TLS_NO_MATCHING_PSK);
}
#endif
|
