mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-01-27 06:35:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Refactor write_certificate_verify

Browse Source 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
This commit is contained in:
Jerry Yu 2022-02-22 10:28:13 +08:00
parent 819f29730a
commit 782720787f
1 changed files with 7 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
library/ssl_tls13_generic.c
View File

@ -1064,7 +1064,7 @@ static int ssl_tls13_write_certificate_verify_body( mbedtls_ssl_context *ssl,
unsigned char signature_type; unsigned char signature_type;
size_t own_key_size; size_t own_key_size;
mbedtls_md_type_t md_alg; mbedtls_md_type_t md_alg;
uint16_t algorithm; uint16_t algorithm = MBEDTLS_TLS1_3_SIG_NONE;
size_t signature_len = 0; size_t signature_len = 0;
const mbedtls_md_info_t *md_info; const mbedtls_md_info_t *md_info;
unsigned char verify_hash[ MBEDTLS_MD_MAX_SIZE ]; unsigned char verify_hash[ MBEDTLS_MD_MAX_SIZE ];
@ -1100,12 +1100,12 @@ static int ssl_tls13_write_certificate_verify_body( mbedtls_ssl_context *ssl,
* } CertificateVerify; * } CertificateVerify;
*/ */
signature_type = mbedtls_ssl_sig_from_pk( own_key ); signature_type = mbedtls_ssl_sig_from_pk( own_key );
/* Determine the size of the key */
own_key_size = mbedtls_pk_get_bitlen( own_key );
switch( signature_type ) switch( signature_type )
{ {
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
case MBEDTLS_SSL_SIG_ECDSA: case MBEDTLS_SSL_SIG_ECDSA:
/* Determine the size of the key */
own_key_size = mbedtls_pk_get_bitlen( own_key );
switch( own_key_size ) switch( own_key_size )
{ {
case 256: case 256:
@ -1125,21 +1125,13 @@ static int ssl_tls13_write_certificate_verify_body( mbedtls_ssl_context *ssl,
( "unknown key size: %" ( "unknown key size: %"
MBEDTLS_PRINTF_SIZET " bits", MBEDTLS_PRINTF_SIZET " bits",
own_key_size ) ); own_key_size ) );
MBEDTLS_SSL_DEBUG_MSG( 1, break;
( "signature algorithm not in "
"received or offered list." ) );
MBEDTLS_SSL_PEND_FATAL_ALERT(
MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
} }
break; break;
#endif /* MBEDTLS_ECDSA_C */ #endif /* MBEDTLS_ECDSA_C */
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
case MBEDTLS_SSL_SIG_RSA: case MBEDTLS_SSL_SIG_RSA:
/* Determine the size of the key */
own_key_size = mbedtls_pk_get_bitlen( own_key );
if( own_key_size <= 2048 && if( own_key_size <= 2048 &&
mbedtls_ssl_sig_alg_is_received( ssl, mbedtls_ssl_sig_alg_is_received( ssl,
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256 ) ) MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256 ) )
@ -1166,12 +1158,7 @@ static int ssl_tls13_write_certificate_verify_body( mbedtls_ssl_context *ssl,
MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown key size: %" MBEDTLS_SSL_DEBUG_MSG( 3, ( "unknown key size: %"
MBEDTLS_PRINTF_SIZET " bits", MBEDTLS_PRINTF_SIZET " bits",
own_key_size ) ); own_key_size ) );
MBEDTLS_SSL_DEBUG_MSG( 1, break;
( "signature algorithm not in received or offered list." ) );
MBEDTLS_SSL_PEND_FATAL_ALERT(
MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
} }
if( mbedtls_rsa_set_padding( mbedtls_pk_rsa( *own_key ), if( mbedtls_rsa_set_padding( mbedtls_pk_rsa( *own_key ),
@ -1189,7 +1176,8 @@ static int ssl_tls13_write_certificate_verify_body( mbedtls_ssl_context *ssl,
return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE ); return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
} }
if( !mbedtls_ssl_sig_alg_is_received( ssl, algorithm ) ) if( algorithm == MBEDTLS_TLS1_3_SIG_NONE ||
! mbedtls_ssl_sig_alg_is_received( ssl, algorithm ) )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, MBEDTLS_SSL_DEBUG_MSG( 1,
( "signature algorithm not in received or offered list." ) ); ( "signature algorithm not in received or offered list." ) );