session state: TLS1.2 and TLS1.3 state is stored as union

That is, to reduce memory usage as these protocol cannot be used
in parallel.

Relates: #281

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

diff --git a/lib/constate.c b/lib/constate.c
index a1a1d9622195d846230654a1f76156729da80d88..a773d55ecfcfed5d20984b637724ef41c7910e95 100644 (file)
--- a/lib/constate.c
+++ b/lib/constate.c
@@ -252,32 +252,32 @@ _tls13_update_keys(gnutls_session_t session, hs_stage_t stage,
                ret = _tls13_derive_secret(session, APPLICATION_TRAFFIC_UPDATE,
                                           sizeof(APPLICATION_TRAFFIC_UPDATE)-1,
                                           NULL, 0,
-                                          session->key.proto.kshare.temp_secret,
-                                          session->key.proto.kshare.hs_ckey);
+                                          session->key.proto.tls13.temp_secret,
+                                          session->key.proto.tls13.hs_ckey);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               ret = _tls13_expand_secret(session, "key", 3, NULL, 0, session->key.proto.kshare.hs_ckey, key_size, key_block);
+               ret = _tls13_expand_secret(session, "key", 3, NULL, 0, session->key.proto.tls13.hs_ckey, key_size, key_block);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.kshare.hs_ckey, iv_size, iv_block);
+               ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.tls13.hs_ckey, iv_size, iv_block);
                if (ret < 0)
                        return gnutls_assert_val(ret);
        } else {
                ret = _tls13_derive_secret(session, APPLICATION_TRAFFIC_UPDATE,
                                           sizeof(APPLICATION_TRAFFIC_UPDATE)-1,
                                           NULL, 0,
-                                          session->key.proto.kshare.temp_secret,
-                                          session->key.proto.kshare.hs_skey);
+                                          session->key.proto.tls13.temp_secret,
+                                          session->key.proto.tls13.hs_skey);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               ret = _tls13_expand_secret(session, "key", 3, NULL, 0, session->key.proto.kshare.hs_skey, key_size, key_block);
+               ret = _tls13_expand_secret(session, "key", 3, NULL, 0, session->key.proto.tls13.hs_skey, key_size, key_block);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.kshare.hs_skey, iv_size, iv_block);
+               ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.tls13.hs_skey, iv_size, iv_block);
                if (ret < 0)
                        return gnutls_assert_val(ret);
        }
@@ -344,21 +344,21 @@ _tls13_set_keys(gnutls_session_t session, hs_stage_t stage,
        ret = _tls13_derive_secret(session, label, label_size,
                                   session->internals.handshake_hash_buffer.data,
                                   hsk_len,
-                                  session->key.proto.kshare.temp_secret,
-                                  session->key.proto.kshare.hs_ckey);
+                                  session->key.proto.tls13.temp_secret,
+                                  session->key.proto.tls13.hs_ckey);
        if (ret < 0)
                return gnutls_assert_val(ret);
 
        _gnutls_nss_keylog_write(session, keylog_label,
-                                session->key.proto.kshare.hs_ckey,
+                                session->key.proto.tls13.hs_ckey,
                                 session->security_parameters.prf->output_size);
 
        /* client keys */
-       ret = _tls13_expand_secret(session, "key", 3, NULL, 0, session->key.proto.kshare.hs_ckey, key_size, ckey_block);
+       ret = _tls13_expand_secret(session, "key", 3, NULL, 0, session->key.proto.tls13.hs_ckey, key_size, ckey_block);
        if (ret < 0)
                return gnutls_assert_val(ret);
 
-       ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.kshare.hs_ckey, iv_size, civ_block);
+       ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.tls13.hs_ckey, iv_size, civ_block);
        if (ret < 0)
                return gnutls_assert_val(ret);
 
@@ -376,21 +376,21 @@ _tls13_set_keys(gnutls_session_t session, hs_stage_t stage,
        ret = _tls13_derive_secret(session, label, label_size,
                                   session->internals.handshake_hash_buffer.data,
                                   hsk_len,
-                                  session->key.proto.kshare.temp_secret,
-                                  session->key.proto.kshare.hs_skey);
+                                  session->key.proto.tls13.temp_secret,
+                                  session->key.proto.tls13.hs_skey);
 
        if (ret < 0)
                return gnutls_assert_val(ret);
 
        _gnutls_nss_keylog_write(session, keylog_label,
-                                session->key.proto.kshare.hs_skey,
+                                session->key.proto.tls13.hs_skey,
                                 session->security_parameters.prf->output_size);
 
-       ret = _tls13_expand_secret(session, "key", 3, NULL, 0, session->key.proto.kshare.hs_skey, key_size, skey_block);
+       ret = _tls13_expand_secret(session, "key", 3, NULL, 0, session->key.proto.tls13.hs_skey, key_size, skey_block);
        if (ret < 0)
                return gnutls_assert_val(ret);
 
-       ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.kshare.hs_skey, iv_size, siv_block);
+       ret = _tls13_expand_secret(session, "iv", 2, NULL, 0, session->key.proto.tls13.hs_skey, iv_size, siv_block);
        if (ret < 0)
                return gnutls_assert_val(ret);
 

diff --git a/lib/ext/key_share.c b/lib/ext/key_share.c
index c7d5d8cc37e265cc5bbea83a067de22b346c02a7..d4cf9b78c8f6cf61199e2e6dd72aa0f27ce2a2d8 100644 (file)
--- a/lib/ext/key_share.c
+++ b/lib/ext/key_share.c
@@ -87,17 +87,17 @@ static int client_gen_key_share(gnutls_session_t session, const gnutls_group_ent
                return gnutls_assert_val(ret);
 
        if (group->pk == GNUTLS_PK_EC) {
-               gnutls_pk_params_release(&session->key.proto.kshare.ecdh_params);
-               gnutls_pk_params_init(&session->key.proto.kshare.ecdh_params);
+               gnutls_pk_params_release(&session->key.kshare.ecdh_params);
+               gnutls_pk_params_init(&session->key.kshare.ecdh_params);
 
                ret = _gnutls_pk_generate_keys(group->pk, group->curve,
-                                               &session->key.proto.kshare.ecdh_params, 1);
+                                               &session->key.kshare.ecdh_params, 1);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
                ret = _gnutls_ecc_ansi_x962_export(group->curve,
-                               session->key.proto.kshare.ecdh_params.params[ECC_X],
-                               session->key.proto.kshare.ecdh_params.params[ECC_Y],
+                               session->key.kshare.ecdh_params.params[ECC_X],
+                               session->key.kshare.ecdh_params.params[ECC_Y],
                                &tmp);
                if (ret < 0)
                        return gnutls_assert_val(ret);
@@ -109,54 +109,54 @@ static int client_gen_key_share(gnutls_session_t session, const gnutls_group_ent
                        goto cleanup;
                }
 
-               session->key.proto.kshare.ecdh_params.algo = group->pk;
-               session->key.proto.kshare.ecdh_params.curve = group->curve;
+               session->key.kshare.ecdh_params.algo = group->pk;
+               session->key.kshare.ecdh_params.curve = group->curve;
 
                ret = 0;
 
        } else if (group->pk == GNUTLS_PK_ECDH_X25519) {
-               gnutls_pk_params_release(&session->key.proto.kshare.ecdhx_params);
-               gnutls_pk_params_init(&session->key.proto.kshare.ecdhx_params);
+               gnutls_pk_params_release(&session->key.kshare.ecdhx_params);
+               gnutls_pk_params_init(&session->key.kshare.ecdhx_params);
 
                ret = _gnutls_pk_generate_keys(group->pk, group->curve,
-                                               &session->key.proto.kshare.ecdhx_params, 1);
+                                               &session->key.kshare.ecdhx_params, 1);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
                ret =
                    _gnutls_buffer_append_data_prefix(extdata, 16,
-                               session->key.proto.kshare.ecdhx_params.raw_pub.data,
-                               session->key.proto.kshare.ecdhx_params.raw_pub.size);
+                               session->key.kshare.ecdhx_params.raw_pub.data,
+                               session->key.kshare.ecdhx_params.raw_pub.size);
                if (ret < 0) {
                        gnutls_assert();
                        goto cleanup;
                }
 
-               session->key.proto.kshare.ecdhx_params.algo = group->pk;
-               session->key.proto.kshare.ecdhx_params.curve = group->curve;
+               session->key.kshare.ecdhx_params.algo = group->pk;
+               session->key.kshare.ecdhx_params.curve = group->curve;
 
                ret = 0;
 
        } else if (group->pk == GNUTLS_PK_DH) {
                /* we need to initialize the group parameters first */
-               gnutls_pk_params_release(&session->key.proto.kshare.dh_params);
-               gnutls_pk_params_init(&session->key.proto.kshare.dh_params);
+               gnutls_pk_params_release(&session->key.kshare.dh_params);
+               gnutls_pk_params_init(&session->key.kshare.dh_params);
 
-               ret = _gnutls_mpi_init_scan_nz(&session->key.proto.kshare.dh_params.params[DH_G],
+               ret = _gnutls_mpi_init_scan_nz(&session->key.kshare.dh_params.params[DH_G],
                        group->generator->data, group->generator->size);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               ret = _gnutls_mpi_init_scan_nz(&session->key.proto.kshare.dh_params.params[DH_P],
+               ret = _gnutls_mpi_init_scan_nz(&session->key.kshare.dh_params.params[DH_P],
                        group->prime->data, group->prime->size);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               session->key.proto.kshare.dh_params.algo = group->pk;
-               session->key.proto.kshare.dh_params.qbits = *group->q_bits;
-               session->key.proto.kshare.dh_params.params_nr = 3; /* empty q */
+               session->key.kshare.dh_params.algo = group->pk;
+               session->key.kshare.dh_params.qbits = *group->q_bits;
+               session->key.kshare.dh_params.params_nr = 3; /* empty q */
 
-               ret = _gnutls_pk_generate_keys(group->pk, 0, &session->key.proto.kshare.dh_params, 1);
+               ret = _gnutls_pk_generate_keys(group->pk, 0, &session->key.kshare.dh_params, 1);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
@@ -165,7 +165,7 @@ static int client_gen_key_share(gnutls_session_t session, const gnutls_group_ent
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               ret = _gnutls_buffer_append_fixed_mpi(extdata, session->key.proto.kshare.dh_params.params[DH_Y],
+               ret = _gnutls_buffer_append_fixed_mpi(extdata, session->key.kshare.dh_params.params[DH_Y],
                                group->prime->size);
                if (ret < 0)
                        return gnutls_assert_val(ret);
@@ -202,8 +202,8 @@ static int server_gen_key_share(gnutls_session_t session, const gnutls_group_ent
 
        if (group->pk == GNUTLS_PK_EC) {
                ret = _gnutls_ecc_ansi_x962_export(group->curve,
-                               session->key.proto.kshare.ecdh_params.params[ECC_X],
-                               session->key.proto.kshare.ecdh_params.params[ECC_Y],
+                               session->key.kshare.ecdh_params.params[ECC_X],
+                               session->key.kshare.ecdh_params.params[ECC_Y],
                                &tmp);
                if (ret < 0)
                        return gnutls_assert_val(ret);
@@ -220,8 +220,8 @@ static int server_gen_key_share(gnutls_session_t session, const gnutls_group_ent
        } else if (group->pk == GNUTLS_PK_ECDH_X25519) {
                ret =
                    _gnutls_buffer_append_data_prefix(extdata, 16,
-                               session->key.proto.kshare.ecdhx_params.raw_pub.data,
-                               session->key.proto.kshare.ecdhx_params.raw_pub.size);
+                               session->key.kshare.ecdhx_params.raw_pub.data,
+                               session->key.kshare.ecdhx_params.raw_pub.size);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
@@ -233,7 +233,7 @@ static int server_gen_key_share(gnutls_session_t session, const gnutls_group_ent
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               ret = _gnutls_buffer_append_fixed_mpi(extdata, session->key.proto.kshare.dh_params.params[DH_Y],
+               ret = _gnutls_buffer_append_fixed_mpi(extdata, session->key.kshare.dh_params.params[DH_Y],
                                group->prime->size);
                if (ret < 0)
                        return gnutls_assert_val(ret);
@@ -258,8 +258,8 @@ server_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
        if (group->pk == GNUTLS_PK_EC) {
                gnutls_pk_params_st pub;
 
-               gnutls_pk_params_release(&session->key.proto.kshare.ecdh_params);
-               gnutls_pk_params_init(&session->key.proto.kshare.ecdh_params);
+               gnutls_pk_params_release(&session->key.kshare.ecdh_params);
+               gnutls_pk_params_init(&session->key.kshare.ecdh_params);
 
                curve = _gnutls_ecc_curve_get_params(group->curve);
 
@@ -269,7 +269,7 @@ server_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                        return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
 
                /* generate our key */
-               ret = _gnutls_pk_generate_keys(curve->pk, curve->id, &session->key.proto.kshare.ecdh_params, 1);
+               ret = _gnutls_pk_generate_keys(curve->pk, curve->id, &session->key.kshare.ecdh_params, 1);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
@@ -285,7 +285,7 @@ server_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                pub.params_nr = 2;
 
                /* generate shared */
-               ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key, &session->key.proto.kshare.ecdh_params, &pub);
+               ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key, &session->key.kshare.ecdh_params, &pub);
                gnutls_pk_params_release(&pub);
                if (ret < 0) {
                        return gnutls_assert_val(ret);
@@ -296,8 +296,8 @@ server_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
        } else if (group->pk == GNUTLS_PK_ECDH_X25519) {
                gnutls_pk_params_st pub;
 
-               gnutls_pk_params_release(&session->key.proto.kshare.ecdhx_params);
-               gnutls_pk_params_init(&session->key.proto.kshare.ecdhx_params);
+               gnutls_pk_params_release(&session->key.kshare.ecdhx_params);
+               gnutls_pk_params_init(&session->key.kshare.ecdhx_params);
 
                curve = _gnutls_ecc_curve_get_params(group->curve);
 
@@ -305,7 +305,7 @@ server_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                        return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
 
                /* generate our key */
-               ret = _gnutls_pk_generate_keys(curve->pk, curve->id, &session->key.proto.kshare.ecdhx_params, 1);
+               ret = _gnutls_pk_generate_keys(curve->pk, curve->id, &session->key.kshare.ecdhx_params, 1);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
@@ -321,7 +321,7 @@ server_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                /* We don't mask the MSB in the final byte as required
                 * by RFC7748. This will be done internally by nettle 3.3 or later.
                 */
-               ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key, &session->key.proto.kshare.ecdhx_params, &pub);
+               ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key, &session->key.kshare.ecdhx_params, &pub);
                if (ret < 0) {
                        return gnutls_assert_val(ret);
                }
@@ -332,29 +332,29 @@ server_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                gnutls_pk_params_st pub;
 
                /* we need to initialize the group parameters first */
-               gnutls_pk_params_release(&session->key.proto.kshare.dh_params);
-               gnutls_pk_params_init(&session->key.proto.kshare.dh_params);
+               gnutls_pk_params_release(&session->key.kshare.dh_params);
+               gnutls_pk_params_init(&session->key.kshare.dh_params);
 
                if (data_size != group->prime->size)
                        return gnutls_assert_val(GNUTLS_E_RECEIVED_ILLEGAL_PARAMETER);
 
                /* set group params */
-               ret = _gnutls_mpi_init_scan_nz(&session->key.proto.kshare.dh_params.params[DH_G],
+               ret = _gnutls_mpi_init_scan_nz(&session->key.kshare.dh_params.params[DH_G],
                        group->generator->data, group->generator->size);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               ret = _gnutls_mpi_init_scan_nz(&session->key.proto.kshare.dh_params.params[DH_P],
+               ret = _gnutls_mpi_init_scan_nz(&session->key.kshare.dh_params.params[DH_P],
                        group->prime->data, group->prime->size);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
-               session->key.proto.kshare.dh_params.algo = GNUTLS_PK_DH;
-               session->key.proto.kshare.dh_params.qbits = *group->q_bits;
-               session->key.proto.kshare.dh_params.params_nr = 3; /* empty q */
+               session->key.kshare.dh_params.algo = GNUTLS_PK_DH;
+               session->key.kshare.dh_params.qbits = *group->q_bits;
+               session->key.kshare.dh_params.params_nr = 3; /* empty q */
 
                /* generate our keys */
-               ret = _gnutls_pk_generate_keys(group->pk, 0, &session->key.proto.kshare.dh_params, 1);
+               ret = _gnutls_pk_generate_keys(group->pk, 0, &session->key.kshare.dh_params, 1);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
@@ -369,7 +369,7 @@ server_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                pub.algo = group->pk;
 
                /* generate shared key */
-               ret = _gnutls_pk_derive_tls13(GNUTLS_PK_DH, &session->key.key, &session->key.proto.kshare.dh_params, &pub);
+               ret = _gnutls_pk_derive_tls13(GNUTLS_PK_DH, &session->key.key, &session->key.kshare.dh_params, &pub);
                _gnutls_mpi_release(&pub.params[DH_Y]);
                if (ret < 0)
                        return gnutls_assert_val(ret);
@@ -415,7 +415,7 @@ client_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                pub.params_nr = 2;
 
                /* generate shared key */
-               ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key, &session->key.proto.kshare.ecdh_params, &pub);
+               ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key, &session->key.kshare.ecdh_params, &pub);
                gnutls_pk_params_release(&pub);
                if (ret < 0) {
                        return gnutls_assert_val(ret);
@@ -443,7 +443,7 @@ client_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                /* We don't mask the MSB in the final byte as required
                 * by RFC7748. This will be done internally by nettle 3.3 or later.
                 */
-               ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key, &session->key.proto.kshare.ecdhx_params, &pub);
+               ret = _gnutls_pk_derive_tls13(curve->pk, &session->key.key, &session->key.kshare.ecdhx_params, &pub);
                if (ret < 0) {
                        return gnutls_assert_val(ret);
                }
@@ -467,7 +467,7 @@ client_use_key_share(gnutls_session_t session, const gnutls_group_entry_st *grou
                pub.algo = group->pk;
 
                /* generate shared key */
-               ret = _gnutls_pk_derive_tls13(GNUTLS_PK_DH, &session->key.key, &session->key.proto.kshare.dh_params, &pub);
+               ret = _gnutls_pk_derive_tls13(GNUTLS_PK_DH, &session->key.key, &session->key.kshare.dh_params, &pub);
                _gnutls_mpi_release(&pub.params[DH_Y]);
                if (ret < 0)
                        return gnutls_assert_val(ret);

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 648168c4c77e90ba4818fe42c716b9593ef77a17..d8de3a5903e73a0eee11651efc1bfe0e5bc13fc6 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -441,13 +441,16 @@ typedef struct auth_cred_st {
 } auth_cred_st;
 
 struct gnutls_key_st {
-       struct {
-               /* TLS 1.3 key share exchange */
+       struct { /* These are kept outside the TLS1.3 union as they are
+                 * negotiated via extension, even before protocol is negotiated */
+               gnutls_pk_params_st ecdh_params;
+               gnutls_pk_params_st ecdhx_params;
+               gnutls_pk_params_st dh_params;
+       } kshare;
+
+       /* The union contents depend on the negotiated protocol */
+       union {
                struct {
-                       gnutls_pk_params_st ecdh_params;
-                       gnutls_pk_params_st ecdhx_params;
-                       gnutls_pk_params_st dh_params;
-
                        /* the current (depending on state) secret, can be
                         * early_secret, client_early_traffic_secret, ... */
                        uint8_t temp_secret[MAX_HASH_SIZE];
@@ -455,10 +458,9 @@ struct gnutls_key_st {
                        uint8_t hs_ckey[MAX_HASH_SIZE]; /* client_handshake_traffic_secret */
                        uint8_t hs_skey[MAX_HASH_SIZE]; /* server_handshake_traffic_secret */
                        uint8_t ap_expkey[MAX_HASH_SIZE]; /* exporter_master_secret */
-               } kshare; /* tls1.3 */
+               } tls13; /* tls1.3 */
 
                /* Folow the SSL3.0 and TLS1.2 key exchanges */
-
                struct {
                        /* For ECDH KX */
                        struct {

diff --git a/lib/handshake-tls13.c b/lib/handshake-tls13.c
index f39aff24d84435ef0dc55e5736024f3d163600d9..721f334eca938091c4cbdecfd33d571aa59f7969 100644 (file)
--- a/lib/handshake-tls13.c
+++ b/lib/handshake-tls13.c
@@ -157,8 +157,8 @@ static int generate_ap_traffic_keys(gnutls_session_t session)
        uint8_t zero[MAX_HASH_SIZE];
 
        ret = _tls13_derive_secret(session, DERIVED_LABEL, sizeof(DERIVED_LABEL)-1,
-                                  NULL, 0, session->key.proto.kshare.temp_secret,
-                                  session->key.proto.kshare.temp_secret);
+                                  NULL, 0, session->key.proto.tls13.temp_secret,
+                                  session->key.proto.tls13.temp_secret);
        if (ret < 0)
                return gnutls_assert_val(ret);
 
@@ -170,13 +170,13 @@ static int generate_ap_traffic_keys(gnutls_session_t session)
        ret = _tls13_derive_secret(session, EXPORTER_MASTER_LABEL, sizeof(EXPORTER_MASTER_LABEL)-1,
                                   session->internals.handshake_hash_buffer.data,
                                   session->internals.handshake_hash_buffer_server_finished_len,
-                                  session->key.proto.kshare.temp_secret,
-                                  session->key.proto.kshare.ap_expkey);
+                                  session->key.proto.tls13.temp_secret,
+                                  session->key.proto.tls13.ap_expkey);
        if (ret < 0)
                return gnutls_assert_val(ret);
 
        _gnutls_nss_keylog_write(session, "EXPORTER_SECRET",
-                                session->key.proto.kshare.ap_expkey,
+                                session->key.proto.tls13.ap_expkey,
                                 session->security_parameters.prf->output_size);
 
        _gnutls_epoch_bump(session);
@@ -195,7 +195,7 @@ static int generate_hs_traffic_keys(gnutls_session_t session)
 {
        int ret;
 
-       if (unlikely(session->key.key.size == 0 || session->key.proto.kshare.temp_secret_size == 0))
+       if (unlikely(session->key.key.size == 0 || session->key.proto.tls13.temp_secret_size == 0))
                return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
 
        ret = _tls13_update_secret(session, session->key.key.data, session->key.key.size);

diff --git a/lib/handshake.c b/lib/handshake.c
index 9b7c776cb8224f65edf33412fa2f22fb14202b4d..179fcb8009b8c495dbb468b3804642af839bc169 100644 (file)
--- a/lib/handshake.c
+++ b/lib/handshake.c
@@ -1714,8 +1714,8 @@ read_server_hello(gnutls_session_t session,
                        return gnutls_assert_val(ret);
 
                ret = _tls13_derive_secret(session, DERIVED_LABEL, sizeof(DERIVED_LABEL)-1,
-                                          NULL, 0, session->key.proto.kshare.temp_secret,
-                                          session->key.proto.kshare.temp_secret);
+                                          NULL, 0, session->key.proto.tls13.temp_secret,
+                                          session->key.proto.tls13.temp_secret);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 
@@ -2076,8 +2076,8 @@ int _gnutls_send_server_hello(gnutls_session_t session, int again)
 
                if (vers->tls13_sem) {
                        ret = _tls13_derive_secret(session, DERIVED_LABEL, sizeof(DERIVED_LABEL)-1,
-                                                  NULL, 0, session->key.proto.kshare.temp_secret,
-                                                  session->key.proto.kshare.temp_secret);
+                                                  NULL, 0, session->key.proto.tls13.temp_secret,
+                                                  session->key.proto.tls13.temp_secret);
                        if (ret < 0) {
                                gnutls_assert();
                                goto fail;

diff --git a/lib/prf.c b/lib/prf.c
index bbd021d317a79d32949f654bf560d3af3b9036df..b7e926febfccab97282d909bec15d0f9c297fc84 100644 (file)
--- a/lib/prf.c
+++ b/lib/prf.c
@@ -149,7 +149,7 @@ gnutls_prf_rfc5705(gnutls_session_t session,
                }
 
                ret = _tls13_derive_secret(session, label, label_size, NULL, 0,
-                                          session->key.proto.kshare.ap_expkey, secret);
+                                          session->key.proto.tls13.ap_expkey, secret);
                if (ret < 0)
                        return gnutls_assert_val(ret);
 

diff --git a/lib/secrets.c b/lib/secrets.c
index 08c6e556863e586f84559d7362cf61eb49d01aaf..73402f9e604b152daa33b81648da957487e2f353 100644 (file)
--- a/lib/secrets.c
+++ b/lib/secrets.c
@@ -34,11 +34,11 @@ int _tls13_init_secret(gnutls_session_t session, const uint8_t *psk, size_t psk_
 {
        char buf[128];
 
-       session->key.proto.kshare.temp_secret_size = session->security_parameters.prf->output_size;
+       session->key.proto.tls13.temp_secret_size = session->security_parameters.prf->output_size;
 
        /* when no PSK, use the zero-value */
        if (psk == NULL) {
-               psk_size = session->key.proto.kshare.temp_secret_size;
+               psk_size = session->key.proto.tls13.temp_secret_size;
                if (unlikely(psk_size >= sizeof(buf)))
                        return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
 
@@ -49,16 +49,16 @@ int _tls13_init_secret(gnutls_session_t session, const uint8_t *psk, size_t psk_
        return gnutls_hmac_fast(session->security_parameters.prf->id,
                                "", 0,
                                psk, psk_size,
-                               session->key.proto.kshare.temp_secret);
+                               session->key.proto.tls13.temp_secret);
 }
 
 /* HKDF-Extract(Prev-Secret, key) */
 int _tls13_update_secret(gnutls_session_t session, const uint8_t *key, size_t key_size)
 {
        return gnutls_hmac_fast(session->security_parameters.prf->id,
-                               session->key.proto.kshare.temp_secret, session->key.proto.kshare.temp_secret_size,
+                               session->key.proto.tls13.temp_secret, session->key.proto.tls13.temp_secret_size,
                                key, key_size,
-                               session->key.proto.kshare.temp_secret);
+                               session->key.proto.tls13.temp_secret);
 }
 
 /* Derive-Secret(Secret, Label, Messages) */

diff --git a/lib/state.c b/lib/state.c
index 79353b5c879f4e613a0691f12db43f8ffec0500c..708f7649c7faa999eaa850cda009a98d29010f2b 100644 (file)
--- a/lib/state.c
+++ b/lib/state.c
@@ -169,33 +169,45 @@ gnutls_compression_get(gnutls_session_t session)
 
 static void deinit_keys(gnutls_session_t session)
 {
-       gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
-       gnutls_pk_params_release(&session->key.proto.tls12.dh.params);
+       const version_entry_st *vers = get_version(session);
 
-       gnutls_pk_params_release(&session->key.proto.kshare.ecdhx_params);
-       gnutls_pk_params_release(&session->key.proto.kshare.ecdh_params);
-       gnutls_pk_params_release(&session->key.proto.kshare.dh_params);
-
-       zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.x);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.y);
-       _gnutls_free_temp_key_datum(&session->key.proto.tls12.ecdh.raw);
-
-       zrelease_temp_mpi_key(&session->key.proto.tls12.dh.client_Y);
-
-       /* SRP */
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_p);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_g);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_key);
+       if (vers == NULL)
+               return;
 
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.u);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.a);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.x);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.A);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.B);
-       zrelease_temp_mpi_key(&session->key.proto.tls12.srp.b);
+       gnutls_pk_params_release(&session->key.kshare.ecdhx_params);
+       gnutls_pk_params_release(&session->key.kshare.ecdh_params);
+       gnutls_pk_params_release(&session->key.kshare.dh_params);
+
+       if (!vers->tls13_sem) {
+               gnutls_pk_params_release(&session->key.proto.tls12.ecdh.params);
+               gnutls_pk_params_release(&session->key.proto.tls12.dh.params);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.x);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.ecdh.y);
+               _gnutls_free_temp_key_datum(&session->key.proto.tls12.ecdh.raw);
+
+               zrelease_temp_mpi_key(&session->key.proto.tls12.dh.client_Y);
+
+               /* SRP */
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_p);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_g);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.srp_key);
+
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.u);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.a);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.x);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.A);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.B);
+               zrelease_temp_mpi_key(&session->key.proto.tls12.srp.b);
+       } else {
+               gnutls_memset(session->key.proto.tls13.temp_secret, 0,
+                             sizeof(session->key.proto.tls13.temp_secret));
+               gnutls_memset(session->key.proto.tls13.hs_ckey, 0,
+                             sizeof(session->key.proto.tls13.hs_ckey));
+               gnutls_memset(session->key.proto.tls13.hs_skey, 0,
+                             sizeof(session->key.proto.tls13.hs_skey));
+       }
 
        _gnutls_free_temp_key_datum(&session->key.key);
-       _gnutls_free_temp_key_datum(&session->key.key);
 }
 
 /* An internal version of _gnutls_handshake_internal_state_clear(),
@@ -435,6 +447,9 @@ void gnutls_deinit(gnutls_session_t session)
        /* we rely on priorities' internal reference counting */
        gnutls_priority_deinit(session->internals.priorities);
 
+       /* overwrite any temp TLS1.3 keys */
+       gnutls_memset(&session->key.proto, 0, sizeof(session->key.proto));
+
        gnutls_free(session);
 }
 

diff --git a/lib/tls13/finished.c b/lib/tls13/finished.c
index a203b36881312db8c351edaa7b8d161848b2270e..9286f328f656e186fde9f0db187f007da15b7d89 100644 (file)
--- a/lib/tls13/finished.c
+++ b/lib/tls13/finished.c
@@ -39,9 +39,9 @@ int _gnutls13_recv_finished(gnutls_session_t session)
        unsigned hash_size = session->security_parameters.prf->output_size;
 
        if (session->security_parameters.entity == GNUTLS_CLIENT)
-               base_key = session->key.proto.kshare.hs_skey;
+               base_key = session->key.proto.tls13.hs_skey;
        else
-               base_key = session->key.proto.kshare.hs_ckey;
+               base_key = session->key.proto.tls13.hs_ckey;
 
        ret = _tls13_expand_secret(session, "finished", 8, NULL, 0, base_key,
                        hash_size, fkey);
@@ -105,9 +105,9 @@ int _gnutls13_send_finished(gnutls_session_t session, unsigned again)
 
        if (again == 0) {
                if (session->security_parameters.entity == GNUTLS_CLIENT)
-                       base_key = session->key.proto.kshare.hs_ckey;
+                       base_key = session->key.proto.tls13.hs_ckey;
                else
-                       base_key = session->key.proto.kshare.hs_skey;
+                       base_key = session->key.proto.tls13.hs_skey;
 
                ret = _tls13_expand_secret(session, "finished", 8, NULL, 0, base_key,
                                           hash_size, fkey);

diff --git a/lib/tls13/key_update.c b/lib/tls13/key_update.c
index e1e6ca3abbe67e8d378d2bb4e2816c9df4214fbe..9b62e4c81737324bcf0a9c060bef71ee40405ff3 100644 (file)
--- a/lib/tls13/key_update.c
+++ b/lib/tls13/key_update.c
@@ -34,8 +34,8 @@ static int update_keys(gnutls_session_t session, hs_stage_t stage)
 {
        int ret;
 
-       ret = _tls13_update_secret(session, session->key.proto.kshare.temp_secret,
-                                  session->key.proto.kshare.temp_secret_size);
+       ret = _tls13_update_secret(session, session->key.proto.tls13.temp_secret,
+                                  session->key.proto.tls13.temp_secret_size);
        if (ret < 0)
                return gnutls_assert_val(ret);