espressif/mbedtls
1
0
Fork 0
mirror of https://github.com/espressif/mbedtls.git synced 2025-05-09 19:31:18 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix various issues

Browse Source 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
This commit is contained in:
Jerry Yu 2022-06-24 10:10:47 +08:00
parent 9bb3ee436b
commit a1255e6b8c
4 changed files with 19 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
library/ssl_misc.h
View File

@ -1980,7 +1980,6 @@ static inline int mbedtls_ssl_tls13_get_pk_type_and_md_alg_from_sig_alg(
switch( sig_alg ) switch( sig_alg )
{ {
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_SHA256_C)
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
*md_alg = MBEDTLS_MD_SHA256; *md_alg = MBEDTLS_MD_SHA256;
@ -1999,7 +1998,6 @@ static inline int mbedtls_ssl_tls13_get_pk_type_and_md_alg_from_sig_alg(
*pk_type = MBEDTLS_PK_RSASSA_PSS; *pk_type = MBEDTLS_PK_RSASSA_PSS;
break; break;
#endif /* MBEDTLS_SHA512_C */ #endif /* MBEDTLS_SHA512_C */
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
default: default:
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
@ -2008,7 +2006,7 @@ static inline int mbedtls_ssl_tls13_get_pk_type_and_md_alg_from_sig_alg(
} }
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
static inline int mbedtls_ssl_tls13_sig_alg_is_supported_for_certificate( static inline int mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(
const uint16_t sig_alg ) const uint16_t sig_alg )
{ {
switch( sig_alg ) switch( sig_alg )
@ -2069,7 +2067,7 @@ static inline int mbedtls_ssl_tls13_sig_alg_is_supported(
#endif /* MBEDTLS_SHA512_C */ #endif /* MBEDTLS_SHA512_C */
#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C */ #endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C */
default: default:
return( mbedtls_ssl_tls13_sig_alg_is_supported_for_certificate( return( mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(
sig_alg ) ); sig_alg ) );
} }
return( 1 ); return( 1 );

13
library/ssl_tls.c
View File

@ -4095,13 +4095,12 @@ static int ssl_preset_suiteb_ciphersuites[] = {
* - ssl_tls12_present* is for TLS 1.2 use only. * - ssl_tls12_present* is for TLS 1.2 use only.
* - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes. * - ssl_preset_* is for TLS 1.3 only or hybrid TLS 1.3/1.2 handshakes.
* *
* `rsa_pss_rsae_*` MUST BE PUT ARTER `rsa_pkcs1_*` before below compitable fixed * When GnuTLS/Openssl server is configured in TLS 1.2 mode with a certificate
* The compitable issue is When * declaring an RSA public key and Mbed TLS is configured in hybrid mode, if
* - GnuTLS/OpenSSL is configured as tls12 server with rsa key * `rsa_pss_rsae_*` algorithms are before `rsa_pkcs1_*` ones in this list then
* - `mebedTLS` is configured as hybrid mode. * the GnuTLS/Openssl server chooses an `rsa_pss_rsae_*` signature algorithm
* - The order is `rsa_pss_rsae_*`, `rsa_pkcs1_*`. * for its signature in the key exchange message and as Mbed TLS 1.2 does not
* GnuTLS/OpenSSL will return `rsa_pss_rsae_*` which are not supported by * support them, the handshake fails.
* TLS 1.2 in mbedTLS.
*/ */
static uint16_t ssl_preset_default_sig_algs[] = { static uint16_t ssl_preset_default_sig_algs[] = {

9
library/ssl_tls13_generic.c
View File

@ -898,17 +898,17 @@ int mbedtls_ssl_tls13_check_sig_alg_cert_key_match(
#if defined(MBEDTLS_PKCS1_V21) #if defined(MBEDTLS_PKCS1_V21)
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_SHA256_C)
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
return( key_size <= 2048 ); return( key_size <= 3072 );
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_SHA256_C */
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_SHA384_C)
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
return( key_size <= 3072 ); return( key_size <= 7680 );
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_SHA384_C */
#if defined(MBEDTLS_SHA512_C) #if defined(MBEDTLS_SHA512_C)
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
return( key_size <= 4096 ); return( 1 );
#endif /* MBEDTLS_SHA512_C */ #endif /* MBEDTLS_SHA512_C */
#endif /* MBEDTLS_PKCS1_V21 */ #endif /* MBEDTLS_PKCS1_V21 */
@ -935,7 +935,8 @@ static int ssl_tls13_select_sig_alg_for_certificate_verify(
*algorithm = MBEDTLS_TLS1_3_SIG_NONE; *algorithm = MBEDTLS_TLS1_3_SIG_NONE;
for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE ; sig_alg++ ) for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE ; sig_alg++ )
{ {
if( mbedtls_ssl_tls13_sig_alg_is_supported_for_certificate( *sig_alg ) && if( mbedtls_ssl_tls13_sig_alg_for_cert_verify_is_supported(
*sig_alg ) &&
mbedtls_ssl_tls13_check_sig_alg_cert_key_match( mbedtls_ssl_tls13_check_sig_alg_cert_key_match(
*sig_alg, own_key ) ) *sig_alg, own_key ) )
{ {

13
programs/ssl/ssl_test_common_source.c
View File

@ -265,13 +265,12 @@ int send_cb( void *ctx, unsigned char const *buf, size_t len )
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_RSA_C)
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
/* /*
* `rsa_pss_rsae_*` MUST BE PUT ARTER `rsa_pkcs1_*` before below compitable fixed * When GnuTLS/Openssl server is configured in TLS 1.2 mode with a certificate
* The compitable issue is When * declaring an RSA public key and Mbed TLS is configured in hybrid mode, if
* - GnuTLS/OpenSSL is configured as tls12 server with rsa key * `rsa_pss_rsae_*` algorithms are before `rsa_pkcs1_*` ones in this list then
* - `mebedTLS` is configured as hybrid mode. * the GnuTLS/Openssl server chooses an `rsa_pss_rsae_*` signature algorithm
* - The order is `rsa_pss_rsae_*`, `rsa_pkcs1_*`. * for its signature in the key exchange message and as Mbed TLS 1.2 does not
* GnuTLS/OpenSSL will return `rsa_pss_rsae_*` which are not supported by * support them, the handshake fails.
* TLS 1.2 in mbedTLS.
*/ */
#define MBEDTLS_SSL_SIG_ALG( hash ) (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA), \ #define MBEDTLS_SSL_SIG_ALG( hash ) (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA), \
(( hash << 8 ) | MBEDTLS_SSL_SIG_RSA), \ (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA), \