eden-emu/mbedtls
20
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #5916 from yuhaoth/pr/tls13-refactor-get-sig-alg-from-pk

Browse source 
Refactor signature algorithm chooser
This commit is contained in:
Ronald Cron 2022-07-04 09:10:08 +02:00 • committed by GitHub
commit 0e39ece23f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 624 additions and 309 deletions
Download patch file Download diff file Expand all files Collapse all files

55
programs/ssl/ssl_client2.c
View file

@ -1534,7 +1534,19 @@ int main( int argc, char *argv[] )
if( *p == ',' )
*p++ = '\0';
if( strcmp( q, "ecdsa_secp256r1_sha256" ) == 0 )
if( strcmp( q, "rsa_pkcs1_sha256" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256;
}
else if( strcmp( q, "rsa_pkcs1_sha384" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384;
}
else if( strcmp( q, "rsa_pkcs1_sha512" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512;
}
else if( strcmp( q, "ecdsa_secp256r1_sha256" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256;
}
@ -1558,22 +1570,39 @@ int main( int argc, char *argv[] )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512;
}
else if( strcmp( q, "rsa_pkcs1_sha256" ) == 0 )
else if( strcmp( q, "ed25519" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256;
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED25519;
}
else if( strcmp( q, "ed448" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED448;
}
else if( strcmp( q, "rsa_pss_pss_sha256" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256;
}
else if( strcmp( q, "rsa_pss_pss_sha384" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384;
}
else if( strcmp( q, "rsa_pss_pss_sha512" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512;
}
else if( strcmp( q, "rsa_pkcs1_sha1" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1;
}
else if( strcmp( q, "ecdsa_sha1" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SHA1;
}
else
{
mbedtls_printf( "unknown signature algorithm %s\n", q );
mbedtls_printf( "supported signature algorithms: " );
mbedtls_printf( "ecdsa_secp256r1_sha256 " );
mbedtls_printf( "ecdsa_secp384r1_sha384 " );
mbedtls_printf( "ecdsa_secp521r1_sha512 " );
mbedtls_printf( "rsa_pss_rsae_sha256 " );
mbedtls_printf( "rsa_pss_rsae_sha384 " );
mbedtls_printf( "rsa_pss_rsae_sha512 " );
mbedtls_printf( "rsa_pkcs1_sha256 " );
mbedtls_printf( "\n" );
ret = -1;
mbedtls_printf( "unknown signature algorithm \"%s\"\n", q );
mbedtls_print_supported_sig_algs();
goto exit;
}
}

55
programs/ssl/ssl_server2.c
View file

@ -2379,7 +2379,19 @@ int main( int argc, char *argv[] )
if( *p == ',' )
*p++ = '\0';
if( strcmp( q, "ecdsa_secp256r1_sha256" ) == 0 )
if( strcmp( q, "rsa_pkcs1_sha256" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256;
}
else if( strcmp( q, "rsa_pkcs1_sha384" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384;
}
else if( strcmp( q, "rsa_pkcs1_sha512" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512;
}
else if( strcmp( q, "ecdsa_secp256r1_sha256" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256;
}
@ -2403,22 +2415,39 @@ int main( int argc, char *argv[] )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512;
}
else if( strcmp( q, "rsa_pkcs1_sha256" ) == 0 )
else if( strcmp( q, "ed25519" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256;
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED25519;
}
else if( strcmp( q, "ed448" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED448;
}
else if( strcmp( q, "rsa_pss_pss_sha256" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256;
}
else if( strcmp( q, "rsa_pss_pss_sha384" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384;
}
else if( strcmp( q, "rsa_pss_pss_sha512" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512;
}
else if( strcmp( q, "rsa_pkcs1_sha1" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1;
}
else if( strcmp( q, "ecdsa_sha1" ) == 0 )
{
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SHA1;
}
else
{
mbedtls_printf( "unknown signature algorithm %s\n", q );
mbedtls_printf( "supported signature algorithms: " );
mbedtls_printf( "ecdsa_secp256r1_sha256 " );
mbedtls_printf( "ecdsa_secp384r1_sha384 " );
mbedtls_printf( "ecdsa_secp521r1_sha512 " );
mbedtls_printf( "rsa_pss_rsae_sha256 " );
mbedtls_printf( "rsa_pss_rsae_sha384 " );
mbedtls_printf( "rsa_pss_rsae_sha512 " );
mbedtls_printf( "rsa_pkcs1_sha256 " );
mbedtls_printf( "\n" );
ret = -1;
mbedtls_printf( "unknown signature algorithm \"%s\"\n", q );
mbedtls_print_supported_sig_algs();
goto exit;
}
}

42
programs/ssl/ssl_test_common_source.c
View file

@ -263,12 +263,32 @@ int send_cb( void *ctx, unsigned char const *buf, size_t len )
#if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_RSA_C)
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
/*
* When GnuTLS/Openssl server is configured in TLS 1.2 mode with a certificate
* declaring an RSA public key and Mbed TLS is configured in hybrid mode, if
* `rsa_pss_rsae_*` algorithms are before `rsa_pkcs1_*` ones in this list then
* the GnuTLS/Openssl server chooses an `rsa_pss_rsae_*` signature algorithm
* for its signature in the key exchange message. As Mbed TLS 1.2 does not
* support them, the handshake fails.
*/
#define MBEDTLS_SSL_SIG_ALG( hash ) (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA), \
(( hash << 8 ) | MBEDTLS_SSL_SIG_RSA), \
( 0x800 | hash ),
#else
#define MBEDTLS_SSL_SIG_ALG( hash ) (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA), \
(( hash << 8 ) | MBEDTLS_SSL_SIG_RSA),
#endif
#elif defined(MBEDTLS_ECDSA_C)
#define MBEDTLS_SSL_SIG_ALG( hash ) (( hash << 8 ) | MBEDTLS_SSL_SIG_ECDSA),
#elif defined(MBEDTLS_RSA_C)
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
/* See above */
#define MBEDTLS_SSL_SIG_ALG( hash ) (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA), \
( 0x800 | hash ),
#else
#define MBEDTLS_SSL_SIG_ALG( hash ) (( hash << 8 ) | MBEDTLS_SSL_SIG_RSA),
#endif
#else
#define MBEDTLS_SSL_SIG_ALG( hash )
#endif
@ -330,3 +350,25 @@ int x509_crt_verify_info( char *buf, size_t size, const char *prefix,
#endif /* MBEDTLS_X509_REMOVE_INFO */
}
#endif /* MBEDTLS_X509_CRT_PARSE_C */
void mbedtls_print_supported_sig_algs( void )
{
mbedtls_printf( "supported signature algorithms:\n" );
mbedtls_printf("\trsa_pkcs1_sha256 ");
mbedtls_printf("rsa_pkcs1_sha384 ");
mbedtls_printf("rsa_pkcs1_sha512\n");
mbedtls_printf("\tecdsa_secp256r1_sha256 ");
mbedtls_printf("ecdsa_secp384r1_sha384 ");
mbedtls_printf("ecdsa_secp521r1_sha512\n");
mbedtls_printf("\trsa_pss_rsae_sha256 ");
mbedtls_printf("rsa_pss_rsae_sha384 ");
mbedtls_printf("rsa_pss_rsae_sha512\n");
mbedtls_printf("\trsa_pss_pss_sha256 ");
mbedtls_printf("rsa_pss_pss_sha384 ");
mbedtls_printf("rsa_pss_pss_sha512\n");
mbedtls_printf("\ted25519 ");
mbedtls_printf("ed448 ");
mbedtls_printf("rsa_pkcs1_sha1 ");
mbedtls_printf("ecdsa_sha1\n");
mbedtls_printf( "\n" );
}