From: Matt Caswell <matt@openssl.org>
Date: Fri, 16 Jun 2017 15:26:25 +0000 (+0100)
Subject: Tweak the client side PSK callback
X-Git-Tag: OpenSSL_1_1_1-pre1~1236
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dc87d5a92288df394f5a887be5c788a530992185;p=thirdparty%2Fopenssl.git

Tweak the client side PSK callback

Ensure that we properly distinguish between successful return (PSK
provided), successful return (no PSK provided) and failure.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3670)
---

diff --git a/apps/s_client.c b/apps/s_client.c
index df33e0a5961..71e4c1f01fb 100644
--- a/apps/s_client.c
+++ b/apps/s_client.c
@@ -203,6 +203,9 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
         if (cipher == NULL) {
             /* Doesn't look like a suitable TLSv1.3 key. Ignore it */
             OPENSSL_free(key);
+            *id = NULL;
+            *idlen = 0;
+            *sess = NULL;
             return 0;
         }
         usesess = SSL_SESSION_new();
@@ -221,13 +224,17 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
     if (cipher == NULL)
         goto err;
 
-    if (md != NULL && SSL_CIPHER_get_handshake_digest(cipher) != md)
-        goto err;
-
-    *sess = usesess;
-
-    *id = (unsigned char *)psk_identity;
-    *idlen = strlen(psk_identity);
+    if (md != NULL && SSL_CIPHER_get_handshake_digest(cipher) != md) {
+        /* PSK not usable, ignore it */
+        *id = NULL;
+        *idlen = 0;
+        *sess = NULL;
+        SSL_SESSION_free(usesess);
+    } else {
+        *sess = usesess;
+        *id = (unsigned char *)psk_identity;
+        *idlen = strlen(psk_identity);
+    }
 
     return 1;