ARMmbed/mbedtls
1
0
Fork 0
mirror of https://github.com/ARMmbed/mbedtls.git synced 2025-05-10 08:59:05 +08:00
Code Issues Releases Wiki Activity

Use mbedtls_get_mode_from_ciphersuite() in server-side ssl_write_encrypt_then_mac_ext()

Browse Source 
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
This commit is contained in:
Neil Armstrong 2022-04-01 10:36:09 +02:00
parent 4bf4c8675f
commit fe635e42c9
1 changed files with 12 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
library/ssl_tls12_server.c
View File

@ -1978,13 +1978,6 @@ static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
{ {
unsigned char *p = buf; unsigned char *p = buf;
const mbedtls_ssl_ciphersuite_t *suite = NULL; const mbedtls_ssl_ciphersuite_t *suite = NULL;
#if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_key_type_t key_type;
psa_algorithm_t alg;
size_t key_bits;
#else
const mbedtls_cipher_info_t *cipher = NULL;
#endif /* MBEDTLS_USE_PSA_CRYPTO */
/* /*
* RFC 7366: "If a server receives an encrypt-then-MAC request extension * RFC 7366: "If a server receives an encrypt-then-MAC request extension
@ -1992,17 +1985,18 @@ static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
* with Associated Data (AEAD) ciphersuite, it MUST NOT send an * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
* encrypt-then-MAC response extension back to the client." * encrypt-then-MAC response extension back to the client."
*/ */
if( ( suite = mbedtls_ssl_ciphersuite_from_id( suite = mbedtls_ssl_ciphersuite_from_id(
ssl->session_negotiate->ciphersuite ) ) == NULL || ssl->session_negotiate->ciphersuite );
#if defined(MBEDTLS_USE_PSA_CRYPTO) if( suite == NULL )
( mbedtls_ssl_cipher_to_psa( suite->cipher, 0, &alg, ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED;
&key_type, &key_bits ) != PSA_SUCCESS ) || else
alg != PSA_ALG_CBC_NO_PADDING )
#else
( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
cipher->mode != MBEDTLS_MODE_CBC )
#endif /* MBEDTLS_USE_PSA_CRYPTO */
{ {
mbedtls_ssl_mode_t ssl_mode =
mbedtls_get_mode_from_ciphersuite(
ssl->session_negotiate->encrypt_then_mac,
suite );
if( ssl_mode != MBEDTLS_SSL_MODE_CBC_ETM )
ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED; ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED;
} }