eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

accelerated ecdh: re-enable TLS 1.3 key exchanges and fix guards in check_config

Browse source 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This commit is contained in:
Valerio Setti 2023-03-16 15:40:57 +01:00
parent ccf0be28e8
commit 4059aba353
2 changed files with 2 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

4
include/mbedtls/check_config.h
View file

@ -802,14 +802,14 @@
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
#if !( defined(MBEDTLS_ECDH_C) && defined(MBEDTLS_X509_CRT_PARSE_C) && \ #if !( defined(MBEDTLS_PK_HAVE_ECDH) && defined(MBEDTLS_X509_CRT_PARSE_C) && \
( defined(MBEDTLS_PK_HAVE_ECDSA) || defined(MBEDTLS_PKCS1_V21) ) ) ( defined(MBEDTLS_PK_HAVE_ECDSA) || defined(MBEDTLS_PKCS1_V21) ) )
#error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED defined, but not all prerequisites" #error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED defined, but not all prerequisites"
#endif #endif
#endif #endif
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) #if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
#if !( defined(MBEDTLS_ECDH_C) ) #if !( defined(MBEDTLS_PK_HAVE_ECDH) )
#error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED defined, but not all prerequisites" #error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED defined, but not all prerequisites"
#endif #endif
#endif #endif

8
tests/scripts/all.sh
View file

@ -2258,14 +2258,6 @@ config_psa_crypto_config_ecdh_use_psa () {
scripts/config.py unset MBEDTLS_ECDH_C scripts/config.py unset MBEDTLS_ECDH_C
fi fi
scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
# Note: the above two lines should be enough, but currently there's a bug
# that prevents tests from passing TLS 1.3 with only PSK (no ephemeral)
# when TLS 1.2 is also enabled, see #6848.
# So, as a temporary measure disable all of TLS 1.3.
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
# Restartable feature is not yet supported by PSA. Once it will in # Restartable feature is not yet supported by PSA. Once it will in
# the future, the following line could be removed (see issues # the future, the following line could be removed (see issues
# 6061, 6332 and following ones) # 6061, 6332 and following ones)