Added differentiation between missing secret and missing seed

This was previously mistakenly handled as a single error code.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Stephen Henson <steve@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3989)

diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index 3bd1e4c62de50aa3a6c7d979a60d8cd79af522eb..58eb3219c6d1f117ef8ff174616477a8535e8a0a 100644 (file)
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt
@@ -1968,6 +1968,7 @@ KDF_R_INVALID_DIGEST:100:invalid digest
 KDF_R_MISSING_KEY:104:missing key
 KDF_R_MISSING_MESSAGE_DIGEST:105:missing message digest
 KDF_R_MISSING_PARAMETER:101:missing parameter
+KDF_R_MISSING_SECRET:107:missing secret
 KDF_R_MISSING_SEED:106:missing seed
 KDF_R_UNKNOWN_PARAMETER_TYPE:103:unknown parameter type
 KDF_R_VALUE_MISSING:102:value missing

diff --git a/crypto/kdf/kdf_err.c b/crypto/kdf/kdf_err.c
index 3b185c8ee55b7f8d21fc1b9d9e6ce8f9243b7c42..8d2727217da7aa862d07c9c8783a5fe4662d0f35 100644 (file)
--- a/crypto/kdf/kdf_err.c
+++ b/crypto/kdf/kdf_err.c
@@ -29,6 +29,7 @@ static const ERR_STRING_DATA KDF_str_reasons[] = {
     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_MISSING_MESSAGE_DIGEST),
     "missing message digest"},
     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_MISSING_PARAMETER), "missing parameter"},
+    {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_MISSING_SECRET), "missing secret"},
     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_MISSING_SEED), "missing seed"},
     {ERR_PACK(ERR_LIB_KDF, 0, KDF_R_UNKNOWN_PARAMETER_TYPE),
     "unknown parameter type"},

diff --git a/crypto/kdf/tls1_prf.c b/crypto/kdf/tls1_prf.c
index f5e106346131d45b1ee1adc2cd0d62548dd101ad..063ea0390aeaf86faba3a41cdb3f3793dc060664 100644 (file)
--- a/crypto/kdf/tls1_prf.c
+++ b/crypto/kdf/tls1_prf.c
@@ -128,7 +128,11 @@ static int pkey_tls1_prf_derive(EVP_PKEY_CTX *ctx, unsigned char *key,
         KDFerr(KDF_F_PKEY_TLS1_PRF_DERIVE, KDF_R_MISSING_MESSAGE_DIGEST);
         return 0;
     }
-    if (kctx->sec == NULL || kctx->seedlen == 0) {
+    if (kctx->sec == NULL) {
+        KDFerr(KDF_F_PKEY_TLS1_PRF_DERIVE, KDF_R_MISSING_SECRET);
+        return 0;
+    }
+    if (kctx->seedlen == 0) {
         KDFerr(KDF_F_PKEY_TLS1_PRF_DERIVE, KDF_R_MISSING_SEED);
         return 0;
     }

diff --git a/include/openssl/kdferr.h b/include/openssl/kdferr.h
index 67bd3a36228bee0a60e29e084a007e268148170c..c01b735c24bc1f054867818660ff0447d5cc3da5 100644 (file)
--- a/include/openssl/kdferr.h
+++ b/include/openssl/kdferr.h
@@ -34,6 +34,7 @@ int ERR_load_KDF_strings(void);
 # define KDF_R_MISSING_KEY                                104
 # define KDF_R_MISSING_MESSAGE_DIGEST                     105
 # define KDF_R_MISSING_PARAMETER                          101
+# define KDF_R_MISSING_SECRET                             107
 # define KDF_R_MISSING_SEED                               106
 # define KDF_R_UNKNOWN_PARAMETER_TYPE                     103
 # define KDF_R_VALUE_MISSING                              102