[tls] Poison initial key derivation function master secret

A freshly initialised key derivation function master secret has the
"keyed" flag clear and so cannot accidentally be used to establish a
full TLS connection.

As an additional layer of defence in depth, poison the initial key
derivation master secret so that a predictable all-zero secret can
never be used accidentally in future.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/net/tls.c b/src/net/tls.c
index f0cad9ff09e31edb24b46d907562bfcd99accc5f..9c2f4cdf69296c549f12145ee3f59538a4ed79f7 100644 (file)
--- a/src/net/tls.c
+++ b/src/net/tls.c
@@ -549,6 +549,9 @@ static int tls_set_digest ( struct tls_connection *tls,
        /* Initialise handshake context */
        digest_init ( digest, key->handshake );
 
+       /* Poison key derivation function master secret */
+       tls_ephemeral_label ( tls, "kdf poison", key->kdf, kdfsize );
+
        /* Sanity checks */
        assert ( ! key->keyed );
        assert ( ! key->bound );