Tweak the client side PSK callback
authorMatt Caswell <matt@openssl.org>
Fri, 16 Jun 2017 15:26:25 +0000 (16:26 +0100)
committerMatt Caswell <matt@openssl.org>
Wed, 21 Jun 2017 13:45:35 +0000 (14:45 +0100)
Ensure that we properly distinguish between successful return (PSK
provided), successful return (no PSK provided) and failure.

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/3670)

apps/s_client.c

index df33e0a..71e4c1f 100644 (file)
@@ -203,6 +203,9 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
         if (cipher == NULL) {
             /* Doesn't look like a suitable TLSv1.3 key. Ignore it */
             OPENSSL_free(key);
+            *id = NULL;
+            *idlen = 0;
+            *sess = NULL;
             return 0;
         }
         usesess = SSL_SESSION_new();
@@ -221,13 +224,17 @@ static int psk_use_session_cb(SSL *s, const EVP_MD *md,
     if (cipher == NULL)
         goto err;
 
-    if (md != NULL && SSL_CIPHER_get_handshake_digest(cipher) != md)
-        goto err;
-
-    *sess = usesess;
-
-    *id = (unsigned char *)psk_identity;
-    *idlen = strlen(psk_identity);
+    if (md != NULL && SSL_CIPHER_get_handshake_digest(cipher) != md) {
+        /* PSK not usable, ignore it */
+        *id = NULL;
+        *idlen = 0;
+        *sess = NULL;
+        SSL_SESSION_free(usesess);
+    } else {
+        *sess = usesess;
+        *id = (unsigned char *)psk_identity;
+        *idlen = strlen(psk_identity);
+    }
 
     return 1;