-
Notifications
You must be signed in to change notification settings - Fork 58
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Rfc5746 #181
Rfc5746 #181
Conversation
The client always include the TLS_EMPTY_RENEGOTIATION_INFO_SCSV and the server answers with an empty renegotiation info, if either the TLS_EMPTY_RENEGOTIATION_INFO_SCSV or a empty renegotiation info is contained in the Client_Hello. For now, it's optional in tinydtls, if the other peer supports it. I will create a second PR, which adapts the |
If you find the time, you may test it against OpenSsl 3.1. |
Will do - it will be later today |
Unfortunately, it fails to match a cipher suite and so gives up. Using original test.zip has a pcap and log file of the failure. |
With this fix, things progress, but a bad server_hello (not server_hello_done) is reported by the client which then raises an alert.
See logs |
Seems to be working with this:-
|
2c41e13
to
bcbcfcd
Compare
crypto.c
Outdated
/* FIXME: we use the default SHA256 here, might need to support other | ||
hash functions as well */ | ||
dtls_hash_init(&handshake->hs_state.hs_hash); | ||
if (handshake) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No need for this test as handshake cannot be NULL at this point (line 153).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, "old lines" reintroduced from "old PR" (#147).
Removed.
6c5c5f9
to
84f834a
Compare
With 84f834a libcoap regression tests work for when |
d706c66
to
b557a9f
Compare
7697251
to
384a374
Compare
feb6d1c
to
94dd297
Compare
Supports RFC5746 minimal version without renegotiation. Add detailed documentation about the message length calculations. Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV to DTLS_CH_LENGTH_MAX. Remove eclipse_curves from ServerHello length. Signed-off-by: Achim Kraus <[email protected]>
Signed-off-by: Achim Kraus <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM.
There is a minor detail that might lead to a buffer overrun in dtls_send_client_hello(). I will open a PR for that right after merging this.
Issue #175