From c9d6fdd6f79c1725215347ad8409b1e60eaccf0c Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Fri, 6 Jul 2018 09:16:51 +0100 Subject: [PATCH] Don't fail if the PSK identity doesn't match In 1.1.0 s_server if the PSK identity doesn't match what we have then a warning is printed and we continue the connection anyway. In 1.1.1, if TLSv1.3 is used and the identity doesn't match then we abort the connection. We should really be consistent with the old behaviour. Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/6659) --- apps/s_server.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/apps/s_server.c b/apps/s_server.c index 4e8a9e27bc..94c18266f7 100644 --- a/apps/s_server.c +++ b/apps/s_server.c @@ -192,8 +192,11 @@ static int psk_find_session_cb(SSL *ssl, const unsigned char *identity, const SSL_CIPHER *cipher = NULL; if (strlen(psk_identity) != identity_len - || memcmp(psk_identity, identity, identity_len) != 0) - return 0; + || memcmp(psk_identity, identity, identity_len) != 0) { + BIO_printf(bio_s_out, + "PSK warning: client identity not what we expected" + " (got '%s' expected '%s')\n", identity, psk_identity); + } if (psksess != NULL) { SSL_SESSION_up_ref(psksess); -- 2.25.1