handshake-tls13: derive and store exporter_master_secret

Signed-off-by: Daiki Ueno <dueno@redhat.com>

diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h
index 9e50af67ce6d450b7bb06f1fa6d8ed2960b3480b..bbd777c6b5b56a1fb1028d095ffadc1a25fd076a 100644 (file)
--- a/lib/gnutls_int.h
+++ b/lib/gnutls_int.h
@@ -438,6 +438,7 @@ struct gnutls_key_st {
        unsigned temp_secret_size; /* depends on negotiated PRF size */
        uint8_t hs_ckey[MAX_HASH_SIZE]; /* client_handshake_traffic_secret */
        uint8_t hs_skey[MAX_HASH_SIZE]; /* server_handshake_traffic_secret */
+       uint8_t ap_expkey[MAX_HASH_SIZE]; /* exporter_master_secret */
 
        /* For ECDH KX */
        gnutls_pk_params_st ecdh_params; /* private part */

diff --git a/lib/handshake-tls13.c b/lib/handshake-tls13.c
index 2c03d7bb71e0dc3b620b5260dcec2fcc2307479f..02889dc90d293a6435995b6b350f86be7a49d070 100644 (file)
--- a/lib/handshake-tls13.c
+++ b/lib/handshake-tls13.c
@@ -154,6 +154,14 @@ static int generate_ap_traffic_keys(gnutls_session_t session)
        if (ret < 0)
                return gnutls_assert_val(ret);
 
+       ret = _tls13_derive_secret(session, EXPORTER_MASTER_LABEL, sizeof(EXPORTER_MASTER_LABEL)-1,
+                                  session->internals.handshake_hash_buffer.data,
+                                  session->internals.handshake_hash_buffer_server_finished_len,
+                                  session->key.temp_secret,
+                                  session->key.ap_expkey);
+       if (ret < 0)
+               return gnutls_assert_val(ret);
+
        _gnutls_epoch_bump(session);
        ret = _gnutls_epoch_dup(session);
        if (ret < 0)

diff --git a/lib/handshake.h b/lib/handshake.h
index fb944925e9c0d7ff8132772ea2bad3cf980dbb3d..6c846318398c06ed22e11d7bcdb680dbc21bf017 100644 (file)
--- a/lib/handshake.h
+++ b/lib/handshake.h
@@ -113,13 +113,13 @@ int _gnutls_check_if_cert_hash_is_same(gnutls_session_t session, gnutls_certific
 #define EARLY_TRAFFIC_LABEL "c e traffic"
 #define EXT_BINDER_LABEL "ext binder"
 #define RES_BINDER_LABEL "res binder"
-#define EARLY_EXPORTER_LABEL "e exp master"
+#define EARLY_EXPORTER_MASTER_LABEL "e exp master"
 #define HANDSHAKE_CLIENT_TRAFFIC_LABEL "c hs traffic"
 #define HANDSHAKE_SERVER_TRAFFIC_LABEL "s hs traffic"
 #define DERIVED_LABEL "derived"
 #define APPLICATION_CLIENT_TRAFFIC_LABEL "c ap traffic"
 #define APPLICATION_SERVER_TRAFFIC_LABEL "s ap traffic"
-#define EXPORTER_LABEL "exp master"
+#define EXPORTER_MASTER_LABEL "exp master"
 #define RES_LABEL "res master"
 
 int _gnutls_run_verify_callback(gnutls_session_t session, unsigned int side);