From 685e486e8b8f70c25f09590c24762ff734f94a51 Mon Sep 17 00:00:00 2001 From: Daniel Kubec Date: Thu, 12 Mar 2015 15:14:20 +0100 Subject: Added support for TLS Keying Material Exporters [RFC-5705] Keying Material Exporter [RFC-5705] allow additional keying material to be derived from existing TLS channel. This exported keying material can then be used for a variety of purposes. [DS: Updated man page to document both upper and lower length boundaries] Signed-off-by: Daniel Kubec Signed-off-by: David Sommerseth Acked-by: Steffan Karger --- src/openvpn/ssl.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/openvpn/ssl.c') diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 529d14d..86eda77 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -2160,8 +2160,12 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi */ if (ks->authenticated && plugin_defined (session->opt->plugins, OPENVPN_PLUGIN_TLS_FINAL)) { + key_state_export_keying_material(&ks->ks_ssl, session); + if (plugin_call (session->opt->plugins, OPENVPN_PLUGIN_TLS_FINAL, NULL, NULL, session->opt->es) != OPENVPN_PLUGIN_FUNC_SUCCESS) ks->authenticated = false; + + setenv_del (session->opt->es, "exported_keying_material"); } /* -- cgit