From 713013fa80e0ca75043e33de057035fb47fe5380 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Mon, 17 Jan 2022 18:16:35 +0800 Subject: [PATCH] fix various issues Signed-off-by: Jerry Yu --- include/mbedtls/ssl.h | 2 +- library/ssl_misc.h | 17 ++++++++++++---- library/ssl_srv.c | 6 +++--- library/ssl_tls.c | 45 ++++++++++++++++++++----------------------- 4 files changed, 38 insertions(+), 32 deletions(-) diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index 489bfdcebd..4187dce117 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -3298,7 +3298,7 @@ void mbedtls_ssl_conf_groups( mbedtls_ssl_config *conf, * terminated by \c MBEDTLS_MD_NONE. */ void MBEDTLS_DEPRECATED mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf, - const int *hashes ); + const int *hashes ); #endif /* MBEDTLS_DEPRECATED_REMOVED */ /** diff --git a/library/ssl_misc.h b/library/ssl_misc.h index b0335fe74e..7ef3ec1255 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1728,7 +1728,7 @@ void mbedtls_ssl_tls13_add_hs_msg_to_checksum( mbedtls_ssl_context *ssl, * Write Signature Algorithm extension */ int mbedtls_ssl_write_sig_alg_ext( mbedtls_ssl_context *ssl, unsigned char *buf, - const unsigned char *end, size_t *out_len); + const unsigned char *end, size_t *out_len ); #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ @@ -1813,9 +1813,18 @@ int mbedtls_ssl_write_supported_groups_ext( mbedtls_ssl_context *ssl, MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C || MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ /* - * Return supported sig_algs. + * Return supported signature algorithms. + * + * In future, invocations can be changed to ssl->conf->sig_algs when + * mbedtls_ssl_conf_sig_hashes() is deleted. + * + * ssl->handshake->sig_algs is either a translation of sig_hases to IANA TLS group + * identifiers when mbedtls_ssl_conf_sig_hashes() has been used, or a pointer to + * ssl->conf->sig_algs when mbedtls_ssl_conf_sig_algs() has been more recently + * invoked. */ -static inline const void *mbedtls_ssl_get_sig_algs( const mbedtls_ssl_context *ssl ) +static inline const void *mbedtls_ssl_get_sig_algs( + const mbedtls_ssl_context *ssl ) { #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) #if !defined(MBEDTLS_DEPRECATED_REMOVED) @@ -1826,7 +1835,7 @@ static inline const void *mbedtls_ssl_get_sig_algs( const mbedtls_ssl_context *s #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ ((void) ssl); - return NULL; + return( NULL ); } #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ diff --git a/library/ssl_srv.c b/library/ssl_srv.c index 97199e1f52..5ebbcada6f 100644 --- a/library/ssl_srv.c +++ b/library/ssl_srv.c @@ -2803,10 +2803,10 @@ static int ssl_write_certificate_request( mbedtls_ssl_context *ssl ) for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ ) { /* High byte is hash */ - unsigned char hash = ( *sig_alg >> 8 ) & 0xff; - unsigned char sig = ( *sig_alg ) & 0xff; + unsigned char hash = MBEDTLS_BYTE_1( *sig_alg ); + unsigned char sig = MBEDTLS_BYTE_0( *sig_alg ); - if( MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md( ssl, hash ) ) + if( mbedtls_ssl_set_calc_verify_md( ssl, hash ) ) continue; #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_ECDSA_C) if( sig != MBEDTLS_SSL_SIG_RSA && sig != MBEDTLS_SSL_SIG_ECDSA ) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 91e84b57ec..a6d6deefcb 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -3152,8 +3152,9 @@ static int ssl_handshake_init( mbedtls_ssl_context *ssl ) #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) #if !defined(MBEDTLS_DEPRECATED_REMOVED) - /* Heap allocate and translate curve_list from internal to IANA group ids */ - if ( mbedtls_ssl_conf_is_tls12_enabled( ssl->conf ) && + /* Heap allocate and translate sig_hashes from internal hash identifiers to + signature algorithms IANA identifiers. */ + if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) && ssl->conf->sig_hashes != NULL ) { const int *md; @@ -6467,30 +6468,18 @@ static int ssl_preset_suiteb_ciphersuites[] = { #if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) #if !defined(MBEDTLS_DEPRECATED_REMOVED) static int ssl_preset_suiteb_hashes[] = { -#if defined(MBEDTLS_SHA384_C) - MBEDTLS_MD_SHA384, -#endif #if defined(MBEDTLS_SHA256_C) MBEDTLS_MD_SHA256, +#endif +#if defined(MBEDTLS_SHA384_C) + MBEDTLS_MD_SHA384, #endif MBEDTLS_MD_NONE }; #endif /* !MBEDTLS_DEPRECATED_REMOVED */ static uint16_t ssl_preset_default_sig_algs[] = { -#if defined(MBEDTLS_SSL_PROTO_TLS1_2) -#if defined(MBEDTLS_SHA512_C) - MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA512 ) -#endif -#if defined(MBEDTLS_SHA384_C) - MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 ) -#endif -#if defined(MBEDTLS_SHA256_C) - MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 ) -#endif -#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ #if defined(MBEDTLS_SSL_PROTO_TLS1_3) - /* ECDSA algorithms */ #if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) @@ -6510,12 +6499,10 @@ static uint16_t ssl_preset_default_sig_algs[] = { #endif MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256, #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ - - MBEDTLS_TLS1_3_SIG_NONE -}; - -static uint16_t ssl_preset_suiteb_sig_algs[] = { #if defined(MBEDTLS_SSL_PROTO_TLS1_2) +#if defined(MBEDTLS_SHA512_C) + MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA512 ) +#endif #if defined(MBEDTLS_SHA384_C) MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 ) #endif @@ -6523,7 +6510,10 @@ static uint16_t ssl_preset_suiteb_sig_algs[] = { MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 ) #endif #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ + MBEDTLS_TLS1_3_SIG_NONE +}; +static uint16_t ssl_preset_suiteb_sig_algs[] = { #if defined(MBEDTLS_SSL_PROTO_TLS1_3) /* ECDSA algorithms */ #if defined(MBEDTLS_ECDSA_C) @@ -6541,7 +6531,14 @@ static uint16_t ssl_preset_suiteb_sig_algs[] = { #endif MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256, #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ - +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) +#if defined(MBEDTLS_SHA384_C) + MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 ) +#endif +#if defined(MBEDTLS_SHA256_C) + MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 ) +#endif +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ MBEDTLS_TLS1_3_SIG_NONE }; #endif @@ -6965,7 +6962,7 @@ int mbedtls_ssl_check_sig_hash( const mbedtls_ssl_context *ssl, for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ ) { mbedtls_md_type_t hash = mbedtls_ssl_md_alg_from_hash( - ( *sig_alg >> 8 ) & 0xff ); + MBEDTLS_BYTE_1( *sig_alg ) ); if( hash == md ) return( 0 ); }