From 9a1c170d6309bb814ba8d720503069337f628b32 Mon Sep 17 00:00:00 2001 From: EasySec Date: Thu, 12 Mar 2020 14:38:38 +0100 Subject: [PATCH] s_server: warn about NO PSK identity hint in TLSv1.3 There is NO PSK identity hint in TLSv1.3 so output a warning message when inconsistent PSK / TLS options are mixed. Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/11322) --- apps/s_server.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/apps/s_server.c b/apps/s_server.c index 4016270d54..0be414f890 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -2093,10 +2093,16 @@ int s_server_main(int argc, char *argv[]) SSL_CTX_set_psk_server_callback(ctx, psk_server_cb); } - if (!SSL_CTX_use_psk_identity_hint(ctx, psk_identity_hint)) { - BIO_printf(bio_err, "error setting PSK identity hint to context\n"); - ERR_print_errors(bio_err); - goto end; + if (psk_identity_hint != NULL) { + if (min_version == TLS1_3_VERSION) { + BIO_printf(bio_s_out, "PSK warning: there is NO identity hint in TLSv1.3\n"); + } else { + if (!SSL_CTX_use_psk_identity_hint(ctx, psk_identity_hint)) { + BIO_printf(bio_err, "error setting PSK identity hint to context\n"); + ERR_print_errors(bio_err); + goto end; + } + } } #endif if (psksessf != NULL) { -- 2.25.1