Skip to content

Commit 385d391

Browse files
julek-wolfssljulek-wolfssl
committed
Enforce empty legacy_session_id in DTLS 1.3 per RFC 9147
- Update DTLS 1.3 to ensure the legacy_session_id field is always empty in ServerHello and HelloRetryRequest messages, following RFC 9147 Section 5.3. - Disable middlebox compatibility mode per RFC 9147 Section 5. - Always check the version when resuming a session Fixes ZD 21376.
1 parent 7efc962 commit 385d391

10 files changed

Lines changed: 170 additions & 62 deletions

File tree

‎src/dtls.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -857,9 +857,9 @@ static int SendStatelessReplyDtls13(const WOLFSSL* ssl, WolfSSL_CH* ch)
857857
nonConstSSL->options.tls1_1 = 1;
858858
nonConstSSL->options.tls1_3 = 1;
859859

860-
XMEMCPY(nonConstSSL->session->sessionID, ch->sessionId.elements,
861-
ch->sessionId.size);
862-
nonConstSSL->session->sessionIDSz = (byte)ch->sessionId.size;
860+
/* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
861+
* legacy_session_id_echo. Don't copy the client's session ID. */
862+
nonConstSSL->session->sessionIDSz = 0;
863863
nonConstSSL->options.cipherSuite0 = cs.cipherSuite0;
864864
nonConstSSL->options.cipherSuite = cs.cipherSuite;
865865
nonConstSSL->extensions = parsedExts;

‎src/ssl_sess.c‎

Lines changed: 5 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1142,10 +1142,8 @@ static int CheckSessionMatch(const WOLFSSL* ssl, const WOLFSSL_SESSION* sess)
11421142
XMEMCMP(ssl->sessionCtx, sess->sessionCtx, sess->sessionCtxSz) != 0))
11431143
return 0;
11441144
#endif
1145-
#if defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET)
11461145
if (IsAtLeastTLSv1_3(ssl->version) != IsAtLeastTLSv1_3(sess->version))
11471146
return 0;
1148-
#endif
11491147
return 1;
11501148
}
11511149

@@ -1553,12 +1551,11 @@ int wolfSSL_SetSession(WOLFSSL* ssl, WOLFSSL_SESSION* session)
15531551
ssl->options.resuming = 1;
15541552
ssl->options.haveEMS = (ssl->session->haveEMS) ? 1 : 0;
15551553

1556-
#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
1557-
defined(HAVE_SESSION_TICKET))
1558-
ssl->version = ssl->session->version;
1559-
if (IsAtLeastTLSv1_3(ssl->version))
1560-
ssl->options.tls1_3 = 1;
1561-
#endif
1554+
if (ssl->session->version.major != 0) {
1555+
ssl->version = ssl->session->version;
1556+
if (IsAtLeastTLSv1_3(ssl->version))
1557+
ssl->options.tls1_3 = 1;
1558+
}
15621559
#if defined(SESSION_CERTS) || !defined(NO_RESUME_SUITE_CHECK) || \
15631560
(defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET))
15641561
ssl->options.cipherSuite0 = ssl->session->cipherSuite0;
@@ -2601,11 +2598,8 @@ int wolfSSL_i2d_SSL_SESSION(WOLFSSL_SESSION* sess, unsigned char** p)
26012598
for (i = 0; i < sess->chain.count; i++)
26022599
size += OPAQUE16_LEN + sess->chain.certs[i].length;
26032600
#endif
2604-
#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
2605-
defined(HAVE_SESSION_TICKET))
26062601
/* Protocol version */
26072602
size += OPAQUE16_LEN;
2608-
#endif
26092603
#if defined(SESSION_CERTS) || !defined(NO_RESUME_SUITE_CHECK) || \
26102604
(defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET))
26112605
/* cipher suite */
@@ -2681,11 +2675,8 @@ int wolfSSL_i2d_SSL_SESSION(WOLFSSL_SESSION* sess, unsigned char** p)
26812675
idx += sess->chain.certs[i].length;
26822676
}
26832677
#endif
2684-
#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
2685-
defined(HAVE_SESSION_TICKET))
26862678
data[idx++] = sess->version.major;
26872679
data[idx++] = sess->version.minor;
2688-
#endif
26892680
#if defined(SESSION_CERTS) || !defined(NO_RESUME_SUITE_CHECK) || \
26902681
(defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET))
26912682
data[idx++] = sess->cipherSuite0;
@@ -2854,16 +2845,13 @@ WOLFSSL_SESSION* wolfSSL_d2i_SSL_SESSION(WOLFSSL_SESSION** sess,
28542845
idx += length;
28552846
}
28562847
#endif
2857-
#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
2858-
defined(HAVE_SESSION_TICKET))
28592848
/* Protocol Version */
28602849
if (i - idx < OPAQUE16_LEN) {
28612850
ret = BUFFER_ERROR;
28622851
goto end;
28632852
}
28642853
s->version.major = data[idx++];
28652854
s->version.minor = data[idx++];
2866-
#endif
28672855
#if defined(SESSION_CERTS) || !defined(NO_RESUME_SUITE_CHECK) || \
28682856
(defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET))
28692857
/* Cipher suite */
@@ -3176,10 +3164,8 @@ static void SESSION_ex_data_cache_update(WOLFSSL_SESSION* session, int idx,
31763164
if (cacheSession && cacheSession->sessionIDSz == ID_LEN &&
31773165
XMEMCMP(id, cacheSession->sessionID, ID_LEN) == 0
31783166
&& session->side == cacheSession->side
3179-
#if defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET)
31803167
&& (IsAtLeastTLSv1_3(session->version) ==
31813168
IsAtLeastTLSv1_3(cacheSession->version))
3182-
#endif
31833169
) {
31843170
if (get) {
31853171
if (getRet) {
@@ -3604,10 +3590,7 @@ void SetupSession(WOLFSSL* ssl)
36043590
#ifndef NO_ASN_TIME
36053591
session->bornOn = LowResTimer();
36063592
#endif
3607-
#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
3608-
defined(HAVE_SESSION_TICKET))
36093593
session->version = ssl->version;
3610-
#endif
36113594
#if defined(SESSION_CERTS) || !defined(NO_RESUME_SUITE_CHECK) || \
36123595
(defined(WOLFSSL_TLS13) && defined(HAVE_SESSION_TICKET))
36133596
session->cipherSuite0 = ssl->options.cipherSuite0;

‎src/tls.c‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12173,7 +12173,6 @@ static int TLSX_PreSharedKey_Parse(WOLFSSL* ssl, const byte* input,
1217312173
}
1217412174
list->chosen = 1;
1217512175

12176-
#ifdef HAVE_SESSION_TICKET
1217712176
if (list->resumption) {
1217812177
/* Check that the session's details are the same as the server's. */
1217912178
if (ssl->options.cipherSuite0 != ssl->session->cipherSuite0 ||
@@ -12184,7 +12183,6 @@ static int TLSX_PreSharedKey_Parse(WOLFSSL* ssl, const byte* input,
1218412183
return PSK_KEY_ERROR;
1218512184
}
1218612185
}
12187-
#endif
1218812186

1218912187
return 0;
1219012188
}

‎src/tls13.c‎

Lines changed: 61 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -4570,8 +4570,8 @@ int SendTls13ClientHello(WOLFSSL* ssl)
45704570
}
45714571
#endif /* WOLFSSL_DTLS */
45724572

4573-
#ifdef HAVE_SESSION_TICKET
45744573
if (ssl->options.resuming &&
4574+
ssl->session->version.major != 0 &&
45754575
(ssl->session->version.major != ssl->version.major ||
45764576
ssl->session->version.minor != ssl->version.minor)) {
45774577
#ifndef WOLFSSL_NO_TLS12
@@ -4590,7 +4590,6 @@ int SendTls13ClientHello(WOLFSSL* ssl)
45904590
return VERSION_ERROR;
45914591
}
45924592
}
4593-
#endif
45944593

45954594
suites = WOLFSSL_SUITES(ssl);
45964595
if (suites == NULL) {
@@ -4644,6 +4643,13 @@ int SendTls13ClientHello(WOLFSSL* ssl)
46444643
ssl->session->sessionIDSz = 0;
46454644
ssl->options.tls13MiddleBoxCompat = 0;
46464645
}
4646+
#endif
4647+
#ifdef WOLFSSL_DTLS13
4648+
if (ssl->options.dtls) {
4649+
/* RFC 9147 Section 5: DTLS implementations do not use the
4650+
* TLS 1.3 "compatibility mode" */
4651+
ssl->options.tls13MiddleBoxCompat = 0;
4652+
}
46474653
#endif
46484654
GetTls13SessionId(ssl, NULL, &sessIdSz);
46494655
args->length += (word16)sessIdSz;
@@ -5587,16 +5593,25 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
55875593
}
55885594
else
55895595
#endif /* WOLFSSL_TLS13_MIDDLEBOX_COMPAT */
5596+
#if defined(WOLFSSL_QUIC) || defined(WOLFSSL_DTLS13)
5597+
if (0
55905598
#ifdef WOLFSSL_QUIC
5591-
if (WOLFSSL_IS_QUIC(ssl)) {
5599+
|| WOLFSSL_IS_QUIC(ssl)
5600+
#endif
5601+
#ifdef WOLFSSL_DTLS13
5602+
|| ssl->options.dtls
5603+
#endif
5604+
) {
5605+
/* RFC 9147 Section 5.3 / RFC 9001 Section 8.4: DTLS 1.3 and QUIC
5606+
* ServerHello must have empty legacy_session_id_echo. */
55925607
if (args->sessIdSz != 0) {
55935608
WOLFSSL_MSG("args->sessIdSz != 0");
55945609
WOLFSSL_ERROR_VERBOSE(INVALID_PARAMETER);
55955610
return INVALID_PARAMETER;
55965611
}
55975612
}
55985613
else
5599-
#endif /* WOLFSSL_QUIC */
5614+
#endif /* WOLFSSL_QUIC || WOLFSSL_DTLS13 */
56005615
if (args->sessIdSz != ssl->session->sessionIDSz || (args->sessIdSz > 0 &&
56015616
XMEMCMP(ssl->session->sessionID, args->sessId, args->sessIdSz) != 0))
56025617
{
@@ -6559,6 +6574,7 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie)
65596574
word16 length;
65606575
int keyShareExt = 0;
65616576
int ret;
6577+
byte sessIdSz;
65626578

65636579
ret = TlsCheckCookie(ssl, cookie->data, (byte)cookie->len);
65646580
if (ret < 0)
@@ -6583,7 +6599,13 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie)
65836599
return ret;
65846600

65856601
/* Reconstruct the HelloRetryMessage for handshake hash. */
6586-
length = HRR_BODY_SZ - ID_LEN + ssl->session->sessionIDSz +
6602+
sessIdSz = ssl->session->sessionIDSz;
6603+
#ifdef WOLFSSL_DTLS13
6604+
/* RFC 9147 Section 5.3: DTLS 1.3 must use empty legacy_session_id. */
6605+
if (ssl->options.dtls)
6606+
sessIdSz = 0;
6607+
#endif
6608+
length = HRR_BODY_SZ - ID_LEN + sessIdSz +
65876609
HRR_COOKIE_HDR_SZ + cookie->len;
65886610
length += HRR_VERSIONS_SZ;
65896611
/* HashSz (1 byte) + Hash (HashSz bytes) + CipherSuite (2 bytes) */
@@ -6610,10 +6632,10 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie)
66106632
XMEMCPY(hrr + hrrIdx, helloRetryRequestRandom, RAN_LEN);
66116633
hrrIdx += RAN_LEN;
66126634

6613-
hrr[hrrIdx++] = ssl->session->sessionIDSz;
6614-
if (ssl->session->sessionIDSz > 0) {
6615-
XMEMCPY(hrr + hrrIdx, ssl->session->sessionID, ssl->session->sessionIDSz);
6616-
hrrIdx += ssl->session->sessionIDSz;
6635+
hrr[hrrIdx++] = sessIdSz;
6636+
if (sessIdSz > 0) {
6637+
XMEMCPY(hrr + hrrIdx, ssl->session->sessionID, sessIdSz);
6638+
hrrIdx += sessIdSz;
66176639
}
66186640

66196641
/* Restore the cipher suite from the cookie. */
@@ -6626,7 +6648,7 @@ static int RestartHandshakeHashWithCookie(WOLFSSL* ssl, Cookie* cookie)
66266648
hrr[hrrIdx++] = 0;
66276649

66286650
/* Extensions' length */
6629-
length -= HRR_BODY_SZ - ID_LEN + ssl->session->sessionIDSz;
6651+
length -= HRR_BODY_SZ - ID_LEN + sessIdSz;
66306652
c16toa(length, hrr + hrrIdx);
66316653
hrrIdx += 2;
66326654

@@ -7051,9 +7073,20 @@ int DoTls13ClientHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
70517073
if (sessIdSz + args->idx > helloSz)
70527074
ERROR_OUT(BUFFER_ERROR, exit_dch);
70537075

7054-
ssl->session->sessionIDSz = sessIdSz;
7055-
if (sessIdSz > 0)
7056-
XMEMCPY(ssl->session->sessionID, input + args->idx, sessIdSz);
7076+
#ifdef WOLFSSL_DTLS13
7077+
/* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
7078+
* legacy_session_id_echo. Don't store the client's value so it
7079+
* won't be echoed in SendTls13ServerHello. */
7080+
if (ssl->options.dtls) {
7081+
ssl->session->sessionIDSz = 0;
7082+
}
7083+
else
7084+
#endif
7085+
{
7086+
ssl->session->sessionIDSz = sessIdSz;
7087+
if (sessIdSz > 0)
7088+
XMEMCPY(ssl->session->sessionID, input + args->idx, sessIdSz);
7089+
}
70577090
args->idx += sessIdSz;
70587091

70597092
#ifdef WOLFSSL_TLS13_MIDDLEBOX_COMPAT
@@ -7626,10 +7659,21 @@ int SendTls13ServerHello(WOLFSSL* ssl, byte extMsgType)
76267659
WOLFSSL_BUFFER(ssl->arrays->serverRandom, RAN_LEN);
76277660
#endif
76287661

7629-
output[idx++] = ssl->session->sessionIDSz;
7630-
if (ssl->session->sessionIDSz > 0) {
7631-
XMEMCPY(output + idx, ssl->session->sessionID, ssl->session->sessionIDSz);
7632-
idx += ssl->session->sessionIDSz;
7662+
#ifdef WOLFSSL_DTLS13
7663+
if (ssl->options.dtls) {
7664+
/* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
7665+
* legacy_session_id_echo. */
7666+
output[idx++] = 0;
7667+
}
7668+
else
7669+
#endif
7670+
{
7671+
output[idx++] = ssl->session->sessionIDSz;
7672+
if (ssl->session->sessionIDSz > 0) {
7673+
XMEMCPY(output + idx, ssl->session->sessionID,
7674+
ssl->session->sessionIDSz);
7675+
idx += ssl->session->sessionIDSz;
7676+
}
76337677
}
76347678

76357679
/* Chosen cipher suite */

‎tests/api.c‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4559,12 +4559,12 @@ static WC_INLINE int test_ssl_memio_write_cb(WOLFSSL *ssl, char *data, int sz,
45594559
* "Import from Hex Dump..." option ion and selecting the TCP
45604560
* encapsulation option. */
45614561
char dump_file_name[64];
4562-
WOLFSSL_BIO *dump_file;
4562+
XFILE dump_file;
45634563
sprintf(dump_file_name, "%s/%s.dump", tmpDirName, currentTestName);
4564-
dump_file = wolfSSL_BIO_new_file(dump_file_name, "a");
4565-
if (dump_file != NULL) {
4566-
(void)wolfSSL_BIO_write(dump_file, data, sz);
4567-
wolfSSL_BIO_free(dump_file);
4564+
dump_file = XFOPEN(dump_file_name, "ab");
4565+
if (dump_file != XBADFILE) {
4566+
(void)XFWRITE(data, 1, (size_t)sz, dump_file);
4567+
XFCLOSE(dump_file);
45684568
}
45694569
}
45704570
#endif
@@ -30732,10 +30732,7 @@ static int test_short_session_id_ssl_ready(WOLFSSL* ssl)
3073230732
/* Setup the session to avoid errors */
3073330733
ssl->session->timeout = (word32)-1;
3073430734
ssl->session->side = WOLFSSL_CLIENT_END;
30735-
#if defined(SESSION_CERTS) || (defined(WOLFSSL_TLS13) && \
30736-
defined(HAVE_SESSION_TICKET))
3073730735
ssl->session->version = ssl->version;
30738-
#endif
3073930736
/* Force a short session ID to be sent */
3074030737
ssl->session->sessionIDSz = 4;
3074130738
#ifndef NO_SESSION_CACHE_REF

‎tests/api/test_dtls.c‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2609,3 +2609,90 @@ int test_dtls13_min_rtx_interval(void)
26092609
#endif
26102610
return EXPECT_RESULT();
26112611
}
2612+
2613+
/* RFC 9147 Section 5.3: DTLS 1.3 ServerHello must have empty
2614+
* legacy_session_id_echo, even if the ClientHello had a non-empty
2615+
* legacy_session_id. */
2616+
int test_dtls13_no_session_id_echo(void)
2617+
{
2618+
EXPECT_DECLS;
2619+
#if defined(HAVE_MANUAL_MEMIO_TESTS_DEPENDENCIES) && defined(WOLFSSL_DTLS13) && \
2620+
defined(HAVE_SESSION_TICKET)
2621+
struct test_memio_ctx test_ctx;
2622+
WOLFSSL_CTX *ctx_c = NULL, *ctx_s = NULL;
2623+
WOLFSSL *ssl_c = NULL, *ssl_s = NULL;
2624+
WOLFSSL_SESSION *sess = NULL;
2625+
char readBuf[1];
2626+
/* Use traditional groups to avoid HRR from PQ key share mismatch */
2627+
int groups[] = {
2628+
WOLFSSL_ECC_SECP256R1,
2629+
WOLFSSL_ECC_SECP384R1,
2630+
};
2631+
2632+
/* First connection: complete a DTLS 1.3 handshake to get a session */
2633+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2634+
ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
2635+
wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method), 0);
2636+
ExpectIntEQ(wolfSSL_set_groups(ssl_c, groups, 2), WOLFSSL_SUCCESS);
2637+
ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
2638+
2639+
/* Read to process any NewSessionTicket */
2640+
ExpectIntEQ(wolfSSL_read(ssl_c, readBuf, sizeof(readBuf)), -1);
2641+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), WOLFSSL_ERROR_WANT_READ);
2642+
2643+
ExpectNotNull(sess = wolfSSL_get1_session(ssl_c));
2644+
2645+
/* Ensure the session has a non-empty session ID so the ClientHello
2646+
* will have a populated legacy_session_id field (which is legal per
2647+
* RFC 9147). */
2648+
if (sess->sessionIDSz == 0) {
2649+
sess->sessionIDSz = ID_LEN;
2650+
XMEMSET(sess->sessionID, 0x42, ID_LEN);
2651+
}
2652+
2653+
wolfSSL_free(ssl_c); ssl_c = NULL;
2654+
wolfSSL_free(ssl_s); ssl_s = NULL;
2655+
wolfSSL_CTX_free(ctx_c); ctx_c = NULL;
2656+
wolfSSL_CTX_free(ctx_s); ctx_s = NULL;
2657+
2658+
/* Second connection: set the session on the client so the ClientHello
2659+
* contains a non-empty legacy_session_id. Verify the server does NOT
2660+
* echo it in the ServerHello. */
2661+
XMEMSET(&test_ctx, 0, sizeof(test_ctx));
2662+
ExpectIntEQ(test_memio_setup(&test_ctx, &ctx_c, &ctx_s, &ssl_c, &ssl_s,
2663+
wolfDTLSv1_3_client_method, wolfDTLSv1_3_server_method), 0);
2664+
ExpectIntEQ(wolfSSL_set_session(ssl_c, sess), WOLFSSL_SUCCESS);
2665+
/* Use traditional groups to avoid HRR from key share mismatch */
2666+
ExpectIntEQ(wolfSSL_set_groups(ssl_c, groups, 2), WOLFSSL_SUCCESS);
2667+
/* Disable HRR cookie so the server directly sends a ServerHello */
2668+
ExpectIntEQ(wolfSSL_disable_hrr_cookie(ssl_s), WOLFSSL_SUCCESS);
2669+
2670+
/* Client sends ClientHello (with non-empty legacy_session_id) */
2671+
ExpectIntEQ(wolfSSL_negotiate(ssl_c), -1);
2672+
ExpectIntEQ(wolfSSL_get_error(ssl_c, -1), WOLFSSL_ERROR_WANT_READ);
2673+
2674+
/* Server processes ClientHello and sends ServerHello + flight */
2675+
ExpectIntEQ(wolfSSL_negotiate(ssl_s), -1);
2676+
ExpectIntEQ(wolfSSL_get_error(ssl_s, -1), WOLFSSL_ERROR_WANT_READ);
2677+
2678+
/* Verify the ServerHello on the wire.
2679+
* Layout: DTLS Record Header (13) + DTLS Handshake Header (12) +
2680+
* ProtocolVersion (2) + Random (32) = offset 59 for
2681+
* legacy_session_id_echo length byte. */
2682+
ExpectIntGE(test_ctx.c_len, 60);
2683+
ExpectIntEQ(test_ctx.c_buff[0], handshake);
2684+
ExpectIntEQ(test_ctx.c_buff[DTLS_RECORD_HEADER_SZ], server_hello);
2685+
ExpectIntEQ(test_ctx.c_buff[DTLS_RECORD_HEADER_SZ +
2686+
DTLS_HANDSHAKE_HEADER_SZ + OPAQUE16_LEN + RAN_LEN], 0);
2687+
2688+
/* Complete the handshake */
2689+
ExpectIntEQ(test_memio_do_handshake(ssl_c, ssl_s, 10, NULL), 0);
2690+
2691+
wolfSSL_SESSION_free(sess);
2692+
wolfSSL_free(ssl_c);
2693+
wolfSSL_free(ssl_s);
2694+
wolfSSL_CTX_free(ctx_c);
2695+
wolfSSL_CTX_free(ctx_s);
2696+
#endif
2697+
return EXPECT_RESULT();
2698+
}

0 commit comments

Comments
 (0)