Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 09:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

add missing call to EVP_KDF_CTX_set_params

Browse source
This commit is contained in:
Florian Wilkens 2021-11-05 15:57:43 +01:00
parent fe4e06e8ca
commit cc9e38f58b
1 changed files with 14 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

19
src/analyzer/protocol/ssl/SSL.cc
View file

@ -168,7 +168,7 @@ bool SSL_Analyzer::TLS12_PRF(const std::string& secret, const std::string& label
#if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3) #if defined(OPENSSL_VERSION_MAJOR) && (OPENSSL_VERSION_MAJOR >= 3)
// alloc context + params // alloc context + params
EVP_KDF *kdf = EVP_KDF_fetch(NULL, "TLS1-PRF", NULL); EVP_KDF *kdf = EVP_KDF_fetch(NULL, "TLS1-PRF", NULL);
EVP_KDF_CTX *pctx = EVP_KDF_CTX_new(kdf); EVP_KDF_CTX *kctx = EVP_KDF_CTX_new(kdf);
OSSL_PARAM params[4], *p = params; OSSL_PARAM params[4], *p = params;
EVP_KDF_free(kdf); EVP_KDF_free(kdf);
#else /* OSSL 3 */ #else /* OSSL 3 */
@ -193,14 +193,23 @@ bool SSL_Analyzer::TLS12_PRF(const std::string& secret, const std::string& label
*p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, (void*)seed.data(), seed.size()); *p++ = OSSL_PARAM_construct_octet_string(OSSL_KDF_PARAM_SEED, (void*)seed.data(), seed.size());
*p = OSSL_PARAM_construct_end(); *p = OSSL_PARAM_construct_end();
// set OSSL params
if (EVP_KDF_CTX_set_params(kctx, params) <= 0)
goto abort;
// derive key material // derive key material
bool result = EVP_KDF_derive(pctx, out, out_len, params) <= 0; if (EVP_KDF_derive(kctx, out, out_len, NULL) <= 0)
EVP_KDF_CTX_free(pctx); goto abort;
return result;
EVP_KDF_CTX_free(kctx);
return true;
abort:
EVP_KDF_CTX_free(kctx);
return false;
#else /* OSSL 3 */ #else /* OSSL 3 */
if (EVP_PKEY_derive_init(pctx) <= 0) if (EVP_PKEY_derive_init(pctx) <= 0)
goto abort; /* Error */ goto abort; /* Error */
// setup OSSL_PARAM array: digest, secret, seed // setup PKEY params: digest, secret, seed
// FIXME: sha384 should not be hardcoded // FIXME: sha384 should not be hardcoded
if (EVP_PKEY_CTX_set_tls1_prf_md(pctx, EVP_sha384()) <= 0) if (EVP_PKEY_CTX_set_tls1_prf_md(pctx, EVP_sha384()) <= 0)
goto abort; /* Error */ goto abort; /* Error */