TLS: Pass version to tls_prf() in preparation for new PRFs

Signed-hostap: Jouni Malinen <j@w1.fi>

diff --git a/src/tls/tlsv1_client.c b/src/tls/tlsv1_client.c
index 0ac80ec27c7927d547e3945d61eed98fd96721c9..d546e1a9f75e8fb1628bbf0a58c4042853e13a89 100644 (file)
--- a/src/tls/tlsv1_client.c
+++ b/src/tls/tlsv1_client.c
@@ -67,7 +67,8 @@ int tls_derive_keys(struct tlsv1_client *conn,
                os_memcpy(seed, conn->client_random, TLS_RANDOM_LEN);
                os_memcpy(seed + TLS_RANDOM_LEN, conn->server_random,
                          TLS_RANDOM_LEN);
-               if (tls_prf(pre_master_secret, pre_master_secret_len,
+               if (tls_prf(conn->rl.tls_version,
+                           pre_master_secret, pre_master_secret_len,
                            "master secret", seed, 2 * TLS_RANDOM_LEN,
                            conn->master_secret, TLS_MASTER_SECRET_LEN)) {
                        wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive "
@@ -83,7 +84,8 @@ int tls_derive_keys(struct tlsv1_client *conn,
        key_block_len = 2 * (conn->rl.hash_size + conn->rl.key_material_len);
        if (conn->rl.tls_version == TLS_VERSION_1)
                key_block_len += 2 * conn->rl.iv_size;
-       if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
+       if (tls_prf(conn->rl.tls_version,
+                   conn->master_secret, TLS_MASTER_SECRET_LEN,
                    "key expansion", seed, 2 * TLS_RANDOM_LEN,
                    key_block, key_block_len)) {
                wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive key_block");
@@ -536,7 +538,8 @@ int tlsv1_client_prf(struct tlsv1_client *conn, const char *label,
                          TLS_RANDOM_LEN);
        }
 
-       return tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
+       return tls_prf(conn->rl.tls_version,
+                      conn->master_secret, TLS_MASTER_SECRET_LEN,
                       label, seed, 2 * TLS_RANDOM_LEN, out, out_len);
 }
 

diff --git a/src/tls/tlsv1_client_read.c b/src/tls/tlsv1_client_read.c
index 740aab41404ed19d5083a6cccfb7598230698091..999f76f984c666da75aa23353dfe79639a77d6e8 100644 (file)
--- a/src/tls/tlsv1_client_read.c
+++ b/src/tls/tlsv1_client_read.c
@@ -844,7 +844,8 @@ static int tls_process_server_finished(struct tlsv1_client *conn, u8 ct,
        }
        conn->verify.sha1_server = NULL;
 
-       if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
+       if (tls_prf(conn->rl.tls_version,
+                   conn->master_secret, TLS_MASTER_SECRET_LEN,
                    "server finished", hash, MD5_MAC_LEN + SHA1_MAC_LEN,
                    verify_data, TLS_VERIFY_DATA_LEN)) {
                wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive verify_data");

diff --git a/src/tls/tlsv1_client_write.c b/src/tls/tlsv1_client_write.c
index 9d53dd137e23c75b7af469ccbcbe5727e752acf5..48484c11690f22970a8353ccab607bdc1745aca9 100644 (file)
--- a/src/tls/tlsv1_client_write.c
+++ b/src/tls/tlsv1_client_write.c
@@ -621,7 +621,8 @@ static int tls_write_client_finished(struct tlsv1_client *conn,
        }
        conn->verify.sha1_client = NULL;
 
-       if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
+       if (tls_prf(conn->rl.tls_version,
+                   conn->master_secret, TLS_MASTER_SECRET_LEN,
                    "client finished", hash, MD5_MAC_LEN + SHA1_MAC_LEN,
                    verify_data + 1 + 3, TLS_VERIFY_DATA_LEN)) {
                wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data");

diff --git a/src/tls/tlsv1_common.c b/src/tls/tlsv1_common.c
index 326ff7002b7870e8185f1d04ce94b1c84c1b0f06..a9ffc10312a17a209d4f6504c439e403a0eb899c 100644 (file)
--- a/src/tls/tlsv1_common.c
+++ b/src/tls/tlsv1_common.c
@@ -268,7 +268,7 @@ const char * tls_version_str(u16 ver)
 }
 
 
-int tls_prf(const u8 *secret, size_t secret_len, const char *label,
+int tls_prf(u16 ver, const u8 *secret, size_t secret_len, const char *label,
            const u8 *seed, size_t seed_len, u8 *out, size_t outlen)
 {
        return tls_prf_sha1_md5(secret, secret_len, label, seed, seed_len, out,

diff --git a/src/tls/tlsv1_common.h b/src/tls/tlsv1_common.h
index d13dacdbf9266bcc1541c006f9d2435e016d46b6..855a407888992dab7824220946625b969b018000 100644 (file)
--- a/src/tls/tlsv1_common.h
+++ b/src/tls/tlsv1_common.h
@@ -220,7 +220,7 @@ void tls_verify_hash_add(struct tls_verify_hash *verify, const u8 *buf,
 void tls_verify_hash_free(struct tls_verify_hash *verify);
 int tls_version_ok(u16 ver);
 const char * tls_version_str(u16 ver);
-int tls_prf(const u8 *secret, size_t secret_len, const char *label,
+int tls_prf(u16 ver, const u8 *secret, size_t secret_len, const char *label,
            const u8 *seed, size_t seed_len, u8 *out, size_t outlen);
 
 #endif /* TLSV1_COMMON_H */

diff --git a/src/tls/tlsv1_server.c b/src/tls/tlsv1_server.c
index 3661c16f2d83b4b10f974c9074b292f003580c79..a5605ba46b72f633a1aa4c1437bb1a06490a024c 100644 (file)
--- a/src/tls/tlsv1_server.c
+++ b/src/tls/tlsv1_server.c
@@ -49,7 +49,8 @@ int tlsv1_server_derive_keys(struct tlsv1_server *conn,
                os_memcpy(seed, conn->client_random, TLS_RANDOM_LEN);
                os_memcpy(seed + TLS_RANDOM_LEN, conn->server_random,
                          TLS_RANDOM_LEN);
-               if (tls_prf(pre_master_secret, pre_master_secret_len,
+               if (tls_prf(conn->rl.tls_version,
+                           pre_master_secret, pre_master_secret_len,
                            "master secret", seed, 2 * TLS_RANDOM_LEN,
                            conn->master_secret, TLS_MASTER_SECRET_LEN)) {
                        wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive "
@@ -64,7 +65,8 @@ int tlsv1_server_derive_keys(struct tlsv1_server *conn,
        os_memcpy(seed + TLS_RANDOM_LEN, conn->client_random, TLS_RANDOM_LEN);
        key_block_len = 2 * (conn->rl.hash_size + conn->rl.key_material_len +
                             conn->rl.iv_size);
-       if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
+       if (tls_prf(conn->rl.tls_version,
+                   conn->master_secret, TLS_MASTER_SECRET_LEN,
                    "key expansion", seed, 2 * TLS_RANDOM_LEN,
                    key_block, key_block_len)) {
                wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive key_block");
@@ -449,7 +451,8 @@ int tlsv1_server_prf(struct tlsv1_server *conn, const char *label,
                          TLS_RANDOM_LEN);
        }
 
-       return tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
+       return tls_prf(conn->rl.tls_version,
+                      conn->master_secret, TLS_MASTER_SECRET_LEN,
                       label, seed, 2 * TLS_RANDOM_LEN, out, out_len);
 }
 

diff --git a/src/tls/tlsv1_server_read.c b/src/tls/tlsv1_server_read.c
index 192b71e483b58d54cc0df383870019e84ae191cc..19daa516cbf444981494890f239e6d2a5ddecc74 100644 (file)
--- a/src/tls/tlsv1_server_read.c
+++ b/src/tls/tlsv1_server_read.c
@@ -1063,7 +1063,8 @@ static int tls_process_client_finished(struct tlsv1_server *conn, u8 ct,
        }
        conn->verify.sha1_client = NULL;
 
-       if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
+       if (tls_prf(conn->rl.tls_version,
+                   conn->master_secret, TLS_MASTER_SECRET_LEN,
                    "client finished", hash, MD5_MAC_LEN + SHA1_MAC_LEN,
                    verify_data, TLS_VERIFY_DATA_LEN)) {
                wpa_printf(MSG_DEBUG, "TLSv1: Failed to derive verify_data");

diff --git a/src/tls/tlsv1_server_write.c b/src/tls/tlsv1_server_write.c
index 63d70a2df4ac07e031710e3999ab5b956b97c213..1a603fd1213bb4703cebe0157cf56ddc3c92adc6 100644 (file)
--- a/src/tls/tlsv1_server_write.c
+++ b/src/tls/tlsv1_server_write.c
@@ -609,7 +609,8 @@ static int tls_write_server_finished(struct tlsv1_server *conn,
        }
        conn->verify.sha1_server = NULL;
 
-       if (tls_prf(conn->master_secret, TLS_MASTER_SECRET_LEN,
+       if (tls_prf(conn->rl.tls_version,
+                   conn->master_secret, TLS_MASTER_SECRET_LEN,
                    "server finished", hash, MD5_MAC_LEN + SHA1_MAC_LEN,
                    verify_data + 1 + 3, TLS_VERIFY_DATA_LEN)) {
                wpa_printf(MSG_DEBUG, "TLSv1: Failed to generate verify_data");