src: request tls-exporter only when unique master secrets are used

This is to comply with RFC9266 4.2.

Signed-off-by: Daiki Ueno <ueno@gnu.org>

diff --git a/src/common.c b/src/common.c
index 827157424b7bf28aa2edca8efd8b53faf8d8792e..6d2056f95ebe4c7dd68e25627049d23048e1f616 100644 (file)
--- a/src/common.c
+++ b/src/common.c
@@ -442,6 +442,51 @@ static void print_ecdh_info(gnutls_session_t session, const char *str, int print
 
 }
 
+struct channel_binding_request {
+       gnutls_channel_binding_t type;
+       const char *name;
+};
+
+static void print_channel_bindings(gnutls_session_t session, int print)
+{
+       static const struct channel_binding_request requests[] = {
+               { GNUTLS_CB_TLS_UNIQUE, "tls-unique" },
+               { GNUTLS_CB_TLS_SERVER_END_POINT, "tls-server-end-point" },
+               { GNUTLS_CB_TLS_EXPORTER, "tls-exporter" }
+       };
+       size_t i;
+
+       if (!print) {
+               return;
+       }
+
+       log_msg(stdout, "- Channel bindings\n");
+       for (i = 0; i < sizeof(requests) / sizeof(requests[0]); i++) {
+               gnutls_datum_t cb;
+               int rc;
+
+               rc = gnutls_session_channel_binding(session,
+                                                   requests[i].type,
+                                                   &cb);
+               if (rc == GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE) {
+                       log_msg(stdout, " - '%s': not available\n",
+                               requests[i].name);
+               } else if (rc < 0) {
+                       fprintf(stderr, " - '%s': error: %s\n",
+                               requests[i].name, gnutls_strerror(rc));
+               } else {
+                       size_t j;
+
+                       log_msg(stdout, " - '%s': ",
+                               requests[i].name);
+                       for (j = 0; j < cb.size; j++)
+                               log_msg(stdout, "%02x", cb.data[j]);
+                       log_msg(stdout, "\n");
+                       gnutls_free(cb.data);
+               }
+       }
+}
+
 int print_info(gnutls_session_t session, int verbose, int flags)
 {
        const char *tmp;
@@ -599,25 +644,7 @@ int print_info(gnutls_session_t session, int verbose, int flags)
                log_msg(stdout, "- Application protocol: %.*s\n", p.size, p.data);
 #endif
 
-       if (verbose) {
-               gnutls_datum_t cb;
-
-               rc = gnutls_session_channel_binding(session,
-                                                   GNUTLS_CB_TLS_EXPORTER,
-                                                   &cb);
-               if (rc)
-                       fprintf(stderr, "Channel binding error: %s\n",
-                               gnutls_strerror(rc));
-               else {
-                       size_t i;
-
-                       log_msg(stdout, "- Channel binding 'tls-exporter': ");
-                       for (i = 0; i < cb.size; i++)
-                               log_msg(stdout, "%02x", cb.data[i]);
-                       log_msg(stdout, "\n");
-                       gnutls_free(cb.data);
-               }
-       }
+       print_channel_bindings(session, verbose);
 
        fflush(stdout);