Skip to content

Commit 9404593

Browse files
h-vnh-vn
committed
GH-442 Expose functions for setting up TLS PSK on the server side. (#443)
- SSL_use_psk_identity_hint - SSL_CTX_use_psk_identity_hint - SSL_set_psk_server_callback - SSL_CTX_set_psk_server_callback - SSL_set_psk_find_session_callback - SSL_CTX_set_psk_find_session_callback - SSL_SESSION_set1_master_key - SSL_SESSION_set_cipher - SSL_SESSION_set_protocol_version - SSL_CIPHER_find The SSL_SESSION_ and SSL_CIPHER family of functions are typically needed with TLSv1.3 specific callback functions set with SSL_set_psk_find_session_callback and SSL_CTX_set_psk_find_session_callback.
1 parent 3fdcaab commit 9404593

File tree

3 files changed

+528
-2
lines changed

3 files changed

+528
-2
lines changed

‎Changes‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ Revision history for Perl extension Net::SSLeay.
3333
- Expose SSL_CTX_set_client_hello_cb for setting a callback
3434
the server calls when it processes a ClientHello. Expose the
3535
following functions that can be called only from the
36-
callback.
36+
callback. None of these are available with LibreSSL.
3737
- SSL_client_hello_isv2
3838
- SSL_client_hello_get0_legacy_version
3939
- SSL_client_hello_get0_random
@@ -44,7 +44,7 @@ Revision history for Perl extension Net::SSLeay.
4444
- SSL_client_hello_get_extension_order
4545
- SSL_client_hello_get0_ext
4646
- Expose constants used by SSL_CTX_set_client_hello_cb related
47-
functions:
47+
functions.
4848
- AD_ prefixed constants naming TLS alert codes for
4949
returning from a ClientHello callback or where alert types
5050
are used
@@ -53,6 +53,18 @@ Revision history for Perl extension Net::SSLeay.
5353
callback
5454
- TLSEXT_TYPE_ prefixed contants for naming TLS extension
5555
types
56+
- Expose functions for setting up TLS PSK on the server
57+
side. Only SSL_CIPHER_find is available with LibreSSL.
58+
- SSL_use_psk_identity_hint
59+
- SSL_CTX_use_psk_identity_hint
60+
- SSL_set_psk_server_callback
61+
- SSL_CTX_set_psk_server_callback
62+
- SSL_set_psk_find_session_callback
63+
- SSL_CTX_set_psk_find_session_callback
64+
- SSL_SESSION_set1_master_key
65+
- SSL_SESSION_set_cipher
66+
- SSL_SESSION_set_protocol_version
67+
- SSL_CIPHER_find
5668

5769
1.93_02 2023-02-22
5870
- Update ppport.h to version 3.68. This eliminates thousands of

‎SSLeay.xs‎

Lines changed: 298 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1109,6 +1109,211 @@ unsigned int ssleay_ctx_set_psk_client_callback_invoke(SSL *ssl, const char *hin
11091109
return psk_len;
11101110
}
11111111

1112+
unsigned int ssleay_set_psk_server_callback_invoke(SSL *ssl, const char *identity,
1113+
unsigned char *psk, unsigned int max_psk_len)
1114+
{
1115+
dSP;
1116+
int count = -1;
1117+
unsigned int psk_len = 0;
1118+
SV * cb_func, *psk_sv;
1119+
1120+
PR1("STARTED: ssleay_set_psk_server_callback_invoke\n");
1121+
1122+
cb_func = cb_data_advanced_get(ssl, "ssleay_set_psk_server_callback!!func");
1123+
if(!SvOK(cb_func))
1124+
croak ("Net::SSLeay: ssleay_set_psk_server_callback_invoke called, but not set to point to any perl function.\n");
1125+
1126+
ENTER;
1127+
SAVETMPS;
1128+
1129+
PUSHMARK(SP);
1130+
EXTEND(SP, 3);
1131+
PUSHs(sv_2mortal(newSViv(PTR2IV(ssl))));
1132+
PUSHs(sv_2mortal(newSVpv(identity, 0)));
1133+
PUSHs(sv_2mortal(newSViv(max_psk_len)));
1134+
1135+
PUTBACK;
1136+
1137+
count = call_sv( cb_func, G_SCALAR );
1138+
1139+
SPAGAIN;
1140+
1141+
if (count != 1)
1142+
croak ("Net::SSLeay: ssleay_set_psk_server_callback_invoke perl function did not return 1 value.\n");
1143+
1144+
psk_sv = POPs;
1145+
if (SvOK(psk_sv)) {
1146+
STRLEN new_psk_len;
1147+
char *new_psk = SvPV(psk_sv, new_psk_len);
1148+
1149+
if (!SvPOK(psk_sv))
1150+
croak ("Net::SSLeay: ssleay_set_psk_server_callback_invoke PSK is not a string.\n");
1151+
1152+
if (new_psk_len > max_psk_len)
1153+
croak ("Net::SSLeay: ssleay_set_psk_server_callback_invoke PSK is longer than allowed (%lu > %u).\n", new_psk_len, max_psk_len);
1154+
memcpy(psk, new_psk, new_psk_len);
1155+
psk_len = new_psk_len;
1156+
}
1157+
1158+
PUTBACK;
1159+
FREETMPS;
1160+
LEAVE;
1161+
1162+
return psk_len;
1163+
}
1164+
1165+
unsigned int ssleay_ctx_set_psk_server_callback_invoke(SSL *ssl, const char *identity,
1166+
unsigned char *psk, unsigned int max_psk_len)
1167+
{
1168+
dSP;
1169+
SSL_CTX *ctx;
1170+
int count = -1;
1171+
unsigned int psk_len = 0;
1172+
SV * cb_func, *psk_sv;
1173+
1174+
PR1("STARTED: ssleay_ctx_set_psk_server_callback_invoke\n");
1175+
1176+
ctx = SSL_get_SSL_CTX(ssl);
1177+
cb_func = cb_data_advanced_get(ctx, "ssleay_ctx_set_psk_server_callback!!func");
1178+
if(!SvOK(cb_func))
1179+
croak ("Net::SSLeay: ssleay_ctx_set_psk_server_callback_invoke called, but not set to point to any perl function.\n");
1180+
1181+
ENTER;
1182+
SAVETMPS;
1183+
1184+
PUSHMARK(SP);
1185+
EXTEND(SP, 3);
1186+
PUSHs(sv_2mortal(newSViv(PTR2IV(ssl))));
1187+
PUSHs(sv_2mortal(newSVpv(identity, 0)));
1188+
PUSHs(sv_2mortal(newSViv(max_psk_len)));
1189+
1190+
PUTBACK;
1191+
1192+
count = call_sv( cb_func, G_SCALAR );
1193+
1194+
SPAGAIN;
1195+
1196+
if (count != 1)
1197+
croak ("Net::SSLeay: ssleay_ctx_set_psk_server_callback_invoke perl function did not return 1 value.\n");
1198+
1199+
psk_sv = POPs;
1200+
if (SvOK(psk_sv)) {
1201+
STRLEN new_psk_len;
1202+
char *new_psk = SvPV(psk_sv, new_psk_len);
1203+
1204+
if (!SvPOK(psk_sv))
1205+
croak ("Net::SSLeay: ssleay_ctx_set_psk_server_callback_invoke PSK is not a string.\n");
1206+
1207+
if (new_psk_len > max_psk_len)
1208+
croak ("Net::SSLeay: ssleay_ctx_set_psk_server_callback_invoke PSK is longer than allowed (%lu > %u).\n", new_psk_len, max_psk_len);
1209+
memcpy(psk, new_psk, new_psk_len);
1210+
psk_len = new_psk_len;
1211+
}
1212+
1213+
PUTBACK;
1214+
FREETMPS;
1215+
LEAVE;
1216+
1217+
return psk_len;
1218+
}
1219+
1220+
#if OPENSSL_VERSION_NUMBER >= 0x10101001L
1221+
1222+
/* TLS 1.3 has its own callbacks */
1223+
int ssleay_set_psk_find_session_callback_invoke(SSL *ssl, const unsigned char *identity,
1224+
size_t identity_len,
1225+
SSL_SESSION **sess)
1226+
{
1227+
dSP;
1228+
int count = -1, ret;
1229+
SV * cb_func, *sess_sv;
1230+
1231+
PR1("STARTED: ssleay_psk_find_session_callback_callback_invoke\n");
1232+
1233+
cb_func = cb_data_advanced_get(ssl, "ssleay_set_psk_find_session_callback!!func");
1234+
if(!SvOK(cb_func))
1235+
croak ("Net::SSLeay: ssleay_psk_find_session_callback_callback_invoke called, but not set to point to any perl function.\n");
1236+
1237+
ENTER;
1238+
SAVETMPS;
1239+
1240+
PUSHMARK(SP);
1241+
EXTEND(SP, 2);
1242+
PUSHs(sv_2mortal(newSViv(PTR2IV(ssl))));
1243+
PUSHs(sv_2mortal(newSVpvn((const char *)identity, identity_len)));
1244+
1245+
PUTBACK;
1246+
1247+
count = call_sv( cb_func, G_LIST );
1248+
1249+
SPAGAIN;
1250+
1251+
if (count != 2)
1252+
croak ("Net::SSLeay: ssleay_psk_find_session_callback_callback_invoke perl function did not return 2 values.\n");
1253+
1254+
*sess = NULL;
1255+
sess_sv = POPs;
1256+
if (SvOK(sess_sv))
1257+
*sess = INT2PTR(SSL_SESSION *, SvIV(sess_sv));
1258+
1259+
ret = POPi;
1260+
1261+
PUTBACK;
1262+
FREETMPS;
1263+
LEAVE;
1264+
1265+
return ret;
1266+
}
1267+
1268+
int ssleay_ctx_set_psk_find_session_callback_invoke(SSL *ssl, const unsigned char *identity,
1269+
size_t identity_len,
1270+
SSL_SESSION **sess)
1271+
{
1272+
dSP;
1273+
SSL_CTX *ctx;
1274+
int count = -1, ret;
1275+
SV * cb_func, *sess_sv;
1276+
1277+
ctx = SSL_get_SSL_CTX(ssl);
1278+
1279+
PR1("STARTED: ssleay_ctx_psk_find_session_callback_callback_invoke\n");
1280+
1281+
cb_func = cb_data_advanced_get(ctx, "ssleay_ctx_set_psk_find_session_callback!!func");
1282+
if(!SvOK(cb_func))
1283+
croak ("Net::SSLeay: ssleay_ctx_psk_find_session_callback_callback_invoke called, but not set to point to any perl function.\n");
1284+
1285+
ENTER;
1286+
SAVETMPS;
1287+
1288+
PUSHMARK(SP);
1289+
EXTEND(SP, 2);
1290+
PUSHs(sv_2mortal(newSViv(PTR2IV(ssl))));
1291+
PUSHs(sv_2mortal(newSVpvn((const char *)identity, identity_len)));
1292+
1293+
PUTBACK;
1294+
1295+
count = call_sv( cb_func, G_LIST );
1296+
1297+
SPAGAIN;
1298+
1299+
if (count != 2)
1300+
croak ("Net::SSLeay: ssleay_ctx_psk_find_session_callback_callback_invoke perl function did not return 2 values.\n");
1301+
1302+
*sess = NULL;
1303+
sess_sv = POPs;
1304+
if (SvOK(sess_sv))
1305+
*sess = INT2PTR(SSL_SESSION *, SvIV(sess_sv));
1306+
1307+
ret = POPi;
1308+
1309+
PUTBACK;
1310+
FREETMPS;
1311+
LEAVE;
1312+
1313+
return ret;
1314+
}
1315+
1316+
#endif
11121317
#endif
11131318

11141319
#if (OPENSSL_VERSION_NUMBER >= 0x10001000L && !defined(OPENSSL_NO_NEXTPROTONEG)) || (OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(OPENSSL_NO_TLSEXT))
@@ -5435,6 +5640,13 @@ SSL_CIPHER_get_bits(c, ...)
54355640
const char *
54365641
SSL_CIPHER_get_version(const SSL_CIPHER *cipher)
54375642

5643+
#if (OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined(LIBRESSL_VERSION_NUMBER)) || (LIBRESSL_VERSION_NUMBER >= 0x3040000fL) /* LibreSSL >= 3.4.0 */
5644+
5645+
const SSL_CIPHER *
5646+
SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr)
5647+
5648+
#endif
5649+
54385650
#ifndef OPENSSL_NO_COMP
54395651

54405652
int
@@ -6801,6 +7013,27 @@ SSL_SESSION_set_master_key(s,key)
68017013

68027014
#endif
68037015

7016+
#if (OPENSSL_VERSION_NUMBER >= 0x10101001L && !defined(LIBRESSL_VERSION_NUMBER))
7017+
7018+
int
7019+
SSL_SESSION_set1_master_key(SSL_SESSION *sess, in)
7020+
PREINIT:
7021+
STRLEN len;
7022+
INPUT:
7023+
const unsigned char *in = (unsigned char*)SvPV(ST(1), len);
7024+
CODE:
7025+
RETVAL = SSL_SESSION_set1_master_key(sess, in, len);
7026+
OUTPUT:
7027+
RETVAL
7028+
7029+
int
7030+
SSL_SESSION_set_cipher(SSL_SESSION *s, const SSL_CIPHER *cipher)
7031+
7032+
int
7033+
SSL_SESSION_set_protocol_version(SSL_SESSION *s, int version)
7034+
7035+
#endif
7036+
68047037
#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)) || (LIBRESSL_VERSION_NUMBER >= 0x2070000fL)
68057038

68067039
void
@@ -6988,6 +7221,71 @@ SSL_CTX_set_psk_client_callback(ctx,callback=&PL_sv_undef)
69887221
SSL_CTX_set_psk_client_callback(ctx, ssleay_ctx_set_psk_client_callback_invoke);
69897222
}
69907223

7224+
int
7225+
SSL_use_psk_identity_hint(SSL *ssl, const char *hint)
7226+
7227+
int
7228+
SSL_CTX_use_psk_identity_hint(SSL_CTX *ctx, const char *hint)
7229+
7230+
void
7231+
SSL_set_psk_server_callback(ssl,cb=&PL_sv_undef)
7232+
SSL * ssl
7233+
SV * cb
7234+
CODE:
7235+
if (cb==NULL || !SvOK(cb)) {
7236+
SSL_set_psk_server_callback(ssl, NULL);
7237+
cb_data_advanced_put(ssl, "ssleay_set_psk_server_callback!!func", NULL);
7238+
}
7239+
else {
7240+
cb_data_advanced_put(ssl, "ssleay_set_psk_server_callback!!func", newSVsv(cb));
7241+
SSL_set_psk_server_callback(ssl, ssleay_set_psk_server_callback_invoke);
7242+
}
7243+
7244+
void
7245+
SSL_CTX_set_psk_server_callback(ctx,cb=&PL_sv_undef)
7246+
SSL_CTX * ctx
7247+
SV * cb
7248+
CODE:
7249+
if (cb==NULL || !SvOK(cb)) {
7250+
SSL_CTX_set_psk_server_callback(ctx, NULL);
7251+
cb_data_advanced_put(ctx, "ssleay_ctx_set_psk_server_callback!!func", NULL);
7252+
}
7253+
else {
7254+
cb_data_advanced_put(ctx, "ssleay_ctx_set_psk_server_callback!!func", newSVsv(cb));
7255+
SSL_CTX_set_psk_server_callback(ctx, ssleay_ctx_set_psk_server_callback_invoke);
7256+
}
7257+
7258+
#if OPENSSL_VERSION_NUMBER >= 0x10101001L
7259+
7260+
void
7261+
SSL_set_psk_find_session_callback(s,cb=&PL_sv_undef)
7262+
SSL * s
7263+
SV * cb
7264+
CODE:
7265+
if (cb==NULL || !SvOK(cb)) {
7266+
SSL_set_psk_find_session_callback(s, NULL);
7267+
cb_data_advanced_put(s, "ssleay_set_psk_find_session_callback!!func", NULL);
7268+
}
7269+
else {
7270+
cb_data_advanced_put(s, "ssleay_set_psk_find_session_callback!!func", newSVsv(cb));
7271+
SSL_set_psk_find_session_callback(s, ssleay_set_psk_find_session_callback_invoke);
7272+
}
7273+
7274+
void
7275+
SSL_CTX_set_psk_find_session_callback(ctx,cb=&PL_sv_undef)
7276+
SSL_CTX * ctx
7277+
SV * cb
7278+
CODE:
7279+
if (cb==NULL || !SvOK(cb)) {
7280+
SSL_CTX_set_psk_find_session_callback(ctx, NULL);
7281+
cb_data_advanced_put(ctx, "ssleay_ctx_set_psk_find_session_callback!!func", NULL);
7282+
}
7283+
else {
7284+
cb_data_advanced_put(ctx, "ssleay_ctx_set_psk_find_session_callback!!func", newSVsv(cb));
7285+
SSL_CTX_set_psk_find_session_callback(ctx, ssleay_ctx_set_psk_find_session_callback_invoke);
7286+
}
7287+
7288+
#endif
69917289
#endif
69927290

69937291
#ifdef NET_SSLEAY_CAN_TICKET_KEY_CB

0 commit comments

Comments
 (0)