From 0c8ec3983e638365d98bf9384139b80c25ed14d5 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 17 Mar 2023 17:07:50 +0100 Subject: [PATCH] ssl_tls: fix proper guards for accelerated ECDH Signed-off-by: Valerio Setti --- library/ssl_misc.h | 8 ++++---- library/ssl_tls.c | 2 +- library/ssl_tls13_client.c | 12 ++++++------ library/ssl_tls13_generic.c | 2 +- library/ssl_tls13_keys.c | 4 ++-- library/ssl_tls13_server.c | 20 ++++++++++---------- 6 files changed, 24 insertions(+), 24 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index fe21627c4b..16bc44c799 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -2215,7 +2215,7 @@ static inline int mbedtls_ssl_named_group_is_offered( static inline int mbedtls_ssl_named_group_is_supported(uint16_t named_group) { -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group)) { if (mbedtls_ssl_get_ecp_group_id_from_tls_id(named_group) != MBEDTLS_ECP_DP_NONE) { @@ -2224,7 +2224,7 @@ static inline int mbedtls_ssl_named_group_is_supported(uint16_t named_group) } #else ((void) named_group); -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ return 0; } @@ -2617,14 +2617,14 @@ mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite( const mbedtls_ssl_ciphersuite_t *suite); #endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */ -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) MBEDTLS_CHECK_RETURN_CRITICAL int mbedtls_ssl_tls13_read_public_ecdhe_share(mbedtls_ssl_context *ssl, const unsigned char *buf, size_t buf_len); -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ static inline int mbedtls_ssl_tls13_cipher_suite_is_offered( mbedtls_ssl_context *ssl, int cipher_suite) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index a9c7005a39..cf46c2b85b 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -4224,7 +4224,7 @@ void mbedtls_ssl_handshake_free(mbedtls_ssl_context *ssl) if (handshake->ecdh_psa_privkey_is_external == 0) { psa_destroy_key(handshake->ecdh_psa_privkey); } -#endif /* MBEDTLS_ECDH_C && MBEDTLS_USE_PSA_CRYPTO */ +#endif /* MBEDTLS_PK_CAN_ECDH && MBEDTLS_USE_PSA_CRYPTO */ #if defined(MBEDTLS_SSL_PROTO_TLS1_3) mbedtls_ssl_transform_free(handshake->transform_handshake); diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index 6aae51b8ba..dac1a1e048 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -200,7 +200,7 @@ static int ssl_tls13_reset_key_share(mbedtls_ssl_context *ssl) ssl->handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; return 0; } else -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ if (0 /* other KEMs? */) { /* Do something */ } @@ -237,7 +237,7 @@ static int ssl_tls13_get_default_group_id(mbedtls_ssl_context *ssl, #else ((void) ssl); ((void) group_id); -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ /* * Add DHE named groups here. @@ -326,7 +326,7 @@ static int ssl_tls13_write_key_share_ext(mbedtls_ssl_context *ssl, /* Write key_exchange_length */ MBEDTLS_PUT_UINT16_BE(key_exchange_len, group, 2); } else -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ if (0 /* other KEMs? */) { /* Do something */ } else { @@ -375,7 +375,7 @@ static int ssl_tls13_parse_hrr_key_share_ext(mbedtls_ssl_context *ssl, const unsigned char *buf, const unsigned char *end) { -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) const unsigned char *p = buf; int selected_group; int found = 0; @@ -480,7 +480,7 @@ static int ssl_tls13_parse_key_share_ext(mbedtls_ssl_context *ssl, return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(group)) { if (mbedtls_ssl_get_psa_curve_info_from_tls_id(group, NULL, NULL) == PSA_ERROR_NOT_SUPPORTED) { @@ -496,7 +496,7 @@ static int ssl_tls13_parse_key_share_ext(mbedtls_ssl_context *ssl, return ret; } } else -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ if (0 /* other KEMs? */) { /* Do something */ } else { diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c index a1356e381f..1572bcd68f 100644 --- a/library/ssl_tls13_generic.c +++ b/library/ssl_tls13_generic.c @@ -1510,7 +1510,7 @@ int mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange( return 0; } -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ /* RFC 8446 section 4.2 * diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 6edce50bc8..ff5627a331 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -1463,7 +1463,7 @@ static int ssl_tls13_key_schedule_stage_handshake(mbedtls_ssl_context *ssl) */ if (mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(ssl)) { if (mbedtls_ssl_tls13_named_group_is_ecdhe(handshake->offered_group_id)) { -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) /* Compute ECDH shared secret. */ psa_status_t status = PSA_ERROR_GENERIC_ERROR; psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; @@ -1499,7 +1499,7 @@ static int ssl_tls13_key_schedule_stage_handshake(mbedtls_ssl_context *ssl) } handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT; -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ } else { MBEDTLS_SSL_DEBUG_MSG(1, ("Group not supported.")); return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c index bccf9abecc..04158f11fa 100644 --- a/library/ssl_tls13_server.c +++ b/library/ssl_tls13_server.c @@ -762,7 +762,7 @@ static int ssl_tls13_parse_supported_versions_ext(mbedtls_ssl_context *ssl, return 0; } -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) /* * * From RFC 8446: @@ -818,11 +818,11 @@ static int ssl_tls13_parse_supported_groups_ext(mbedtls_ssl_context *ssl, return 0; } -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ #define SSL_TLS1_3_PARSE_KEY_SHARES_EXT_NO_MATCH 1 -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) /* * ssl_tls13_parse_key_shares_ext() verifies whether the information in the * extension is correct and stores the first acceptable key share and its associated group. @@ -923,7 +923,7 @@ static int ssl_tls13_parse_key_shares_ext(mbedtls_ssl_context *ssl, } return 0; } -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ MBEDTLS_CHECK_RETURN_CRITICAL static int ssl_tls13_client_hello_has_exts(mbedtls_ssl_context *ssl, @@ -1462,7 +1462,7 @@ static int ssl_tls13_parse_client_hello(mbedtls_ssl_context *ssl, break; #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) case MBEDTLS_TLS_EXT_SUPPORTED_GROUPS: MBEDTLS_SSL_DEBUG_MSG(3, ("found supported group extension")); @@ -1481,9 +1481,9 @@ static int ssl_tls13_parse_client_hello(mbedtls_ssl_context *ssl, } break; -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) case MBEDTLS_TLS_EXT_KEY_SHARE: MBEDTLS_SSL_DEBUG_MSG(3, ("found key share extension")); @@ -1508,7 +1508,7 @@ static int ssl_tls13_parse_client_hello(mbedtls_ssl_context *ssl, } break; -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ case MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS: MBEDTLS_SSL_DEBUG_MSG(3, ("found supported versions extension")); @@ -1826,7 +1826,7 @@ static int ssl_tls13_generate_and_write_key_share(mbedtls_ssl_context *ssl, *out_len = 0; -#if defined(MBEDTLS_ECDH_C) +#if defined(MBEDTLS_PK_CAN_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group)) { ret = mbedtls_ssl_tls13_generate_and_write_ecdh_key_exchange( ssl, named_group, buf, end, out_len); @@ -1837,7 +1837,7 @@ static int ssl_tls13_generate_and_write_key_share(mbedtls_ssl_context *ssl, return ret; } } else -#endif /* MBEDTLS_ECDH_C */ +#endif /* MBEDTLS_PK_CAN_ECDH */ if (0 /* Other kinds of KEMs */) { } else { ((void) ssl);