ssl: Disallow modification of hello.random by export
Make client_random and server_random const in
mbedtls_ssl_export_keys_ext_t, so that the key exporter is discouraged
from modifying the client/server hello.
Update examples and tests use const for hello.random as well, to ensure
that the export callbacks are of the proper type.
Fixes #2759
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 3683f3c..e27bbc6 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -637,8 +637,8 @@
size_t maclen,
size_t keylen,
size_t ivlen,
- unsigned char client_random[32],
- unsigned char server_random[32],
+ const unsigned char client_random[32],
+ const unsigned char server_random[32],
mbedtls_tls_prf_types tls_prf_type )
{
eap_tls_keys *keys = (eap_tls_keys *)p_expkey;
@@ -664,8 +664,8 @@
size_t maclen,
size_t keylen,
size_t ivlen,
- unsigned char client_random[32],
- unsigned char server_random[32],
+ const unsigned char client_random[32],
+ const unsigned char server_random[32],
mbedtls_tls_prf_types tls_prf_type )
{
char nss_keylog_line[ 200 ];