eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #6208 from AndrzejKurek/tls-tests-no-md-structured

Browse source 
Remove the dependency on MD from TLS 1.2 tests
This commit is contained in:
Manuel Pégourié-Gonnard 2022-08-30 12:34:37 +02:00 • committed by GitHub
commit bf22a2500b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
16 changed files with 953 additions and 955 deletions
Download patch file Download diff file Expand all files Collapse all files

6
include/mbedtls/check_config.h
View file

@ -743,8 +743,8 @@
#error "MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY defined on non-Aarch64 system" #error "MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY defined on non-Aarch64 system"
#endif #endif
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && ( !defined(MBEDTLS_SHA1_C) && \ #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && !defined(MBEDTLS_USE_PSA_CRYPTO) && \
!defined(MBEDTLS_SHA256_C) && !defined(MBEDTLS_SHA512_C) ) !( defined(MBEDTLS_SHA1_C) || defined(MBEDTLS_SHA256_C) || defined(MBEDTLS_SHA512_C) )
#error "MBEDTLS_SSL_PROTO_TLS1_2 defined, but not all prerequisites" #error "MBEDTLS_SSL_PROTO_TLS1_2 defined, but not all prerequisites"
#endif #endif
@ -793,7 +793,7 @@
#endif #endif
#if defined(MBEDTLS_SSL_TLS_C) && ( !defined(MBEDTLS_CIPHER_C) || \ #if defined(MBEDTLS_SSL_TLS_C) && ( !defined(MBEDTLS_CIPHER_C) || \
!defined(MBEDTLS_MD_C) ) ( !defined(MBEDTLS_MD_C) && !defined(MBEDTLS_USE_PSA_CRYPTO) ) )
#error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites" #error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites"
#endif #endif

7
include/mbedtls/mbedtls_config.h
View file

@ -1493,7 +1493,12 @@
* Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled). * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).
* *
* Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C * Requires: MBEDTLS_SHA1_C or MBEDTLS_SHA256_C or MBEDTLS_SHA512_C
* (Depends on ciphersuites) * (Depends on ciphersuites) when MBEDTLS_USE_PSA_CRYPTO
* is not defined, PSA_WANT_ALG_SHA_1 or PSA_WANT_ALG_SHA_256 or
* PSA_WANT_ALG_SHA_512 when MBEDTLS_USE_PSA_CRYPTO is defined.
*
* \warning If building without MBEDTLS_MD_C, you must call psa_crypto_init()
* before doing any TLS operation.
* *
* Comment this macro to disable support for TLS 1.2 / DTLS 1.2 * Comment this macro to disable support for TLS 1.2 / DTLS 1.2
*/ */

5
library/check_crypto_config.h
View file

@ -88,4 +88,9 @@
#error "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR defined, but not all prerequisites" #error "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR defined, but not all prerequisites"
#endif #endif
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_USE_PSA_CRYPTO) && \
!( defined(PSA_WANT_ALG_SHA_1) || defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA_512) )
#error "MBEDTLS_SSL_PROTO_TLS1_2 defined, but not all prerequisites"
#endif
#endif /* MBEDTLS_CHECK_CRYPTO_CONFIG_H */ #endif /* MBEDTLS_CHECK_CRYPTO_CONFIG_H */

456
library/ssl_ciphersuites.c
View file

File diff suppressed because it is too large Load diff

8
library/ssl_cookie.c
View file

@ -38,21 +38,23 @@
#include "mbedtls/platform_util.h" #include "mbedtls/platform_util.h"
#include "mbedtls/constant_time.h" #include "mbedtls/constant_time.h"
#include "legacy_or_psa.h"
#include <string.h> #include <string.h>
/* /*
* If DTLS is in use, then at least one of SHA-1, SHA-256, SHA-512 is * If DTLS is in use, then at least one of SHA-1, SHA-256, SHA-512 is
* available. Try SHA-256 first, 512 wastes resources * available. Try SHA-256 first, 512 wastes resources
*/ */
#if defined(MBEDTLS_SHA224_C) #if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_LOWLEVEL_OR_PSA)
#define COOKIE_MD MBEDTLS_MD_SHA224 #define COOKIE_MD MBEDTLS_MD_SHA224
#define COOKIE_MD_OUTLEN 32 #define COOKIE_MD_OUTLEN 32
#define COOKIE_HMAC_LEN 28 #define COOKIE_HMAC_LEN 28
#elif defined(MBEDTLS_SHA384_C) #elif defined(MBEDTLS_HAS_ALG_SHA_384_VIA_LOWLEVEL_OR_PSA)
#define COOKIE_MD MBEDTLS_MD_SHA384 #define COOKIE_MD MBEDTLS_MD_SHA384
#define COOKIE_MD_OUTLEN 48 #define COOKIE_MD_OUTLEN 48
#define COOKIE_HMAC_LEN 28 #define COOKIE_HMAC_LEN 28
#elif defined(MBEDTLS_SHA1_C) #elif defined(MBEDTLS_HAS_ALG_SHA_1_VIA_LOWLEVEL_OR_PSA)
#define COOKIE_MD MBEDTLS_MD_SHA1 #define COOKIE_MD MBEDTLS_MD_SHA1
#define COOKIE_MD_OUTLEN 20 #define COOKIE_MD_OUTLEN 20
#define COOKIE_HMAC_LEN 20 #define COOKIE_HMAC_LEN 20

35
library/ssl_misc.h
View file

@ -32,6 +32,7 @@
#include "mbedtls/psa_util.h" #include "mbedtls/psa_util.h"
#include "hash_info.h" #include "hash_info.h"
#endif #endif
#include "legacy_or_psa.h"
#if defined(MBEDTLS_MD5_C) #if defined(MBEDTLS_MD5_C)
#include "mbedtls/md5.h" #include "mbedtls/md5.h"
@ -184,9 +185,9 @@
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC) #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
/* Ciphersuites using HMAC */ /* Ciphersuites using HMAC */
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#define MBEDTLS_SSL_MAC_ADD 48 /* SHA-384 used for HMAC */ #define MBEDTLS_SSL_MAC_ADD 48 /* SHA-384 used for HMAC */
#elif defined(MBEDTLS_SHA256_C) #elif defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#define MBEDTLS_SSL_MAC_ADD 32 /* SHA-256 used for HMAC */ #define MBEDTLS_SSL_MAC_ADD 32 /* SHA-256 used for HMAC */
#else #else
#define MBEDTLS_SSL_MAC_ADD 20 /* SHA-1 used for HMAC */ #define MBEDTLS_SSL_MAC_ADD 20 /* SHA-1 used for HMAC */
@ -783,18 +784,18 @@ struct mbedtls_ssl_handshake_params
/* /*
* Checksum contexts * Checksum contexts
*/ */
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_operation_t fin_sha256_psa; psa_hash_operation_t fin_sha256_psa;
#else #else
mbedtls_sha256_context fin_sha256; mbedtls_sha256_context fin_sha256;
#endif #endif
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_operation_t fin_sha384_psa; psa_hash_operation_t fin_sha384_psa;
#else #else
mbedtls_sha512_context fin_sha512; mbedtls_sha512_context fin_sha384;
#endif #endif
#endif #endif
@ -2104,24 +2105,24 @@ static inline int mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(
switch( sig_alg ) switch( sig_alg )
{ {
#if defined(MBEDTLS_PKCS1_V21) #if defined(MBEDTLS_PKCS1_V21)
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
*md_alg = MBEDTLS_MD_SHA256; *md_alg = MBEDTLS_MD_SHA256;
*pk_type = MBEDTLS_PK_RSASSA_PSS; *pk_type = MBEDTLS_PK_RSASSA_PSS;
break; break;
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
*md_alg = MBEDTLS_MD_SHA384; *md_alg = MBEDTLS_MD_SHA384;
*pk_type = MBEDTLS_PK_RSASSA_PSS; *pk_type = MBEDTLS_PK_RSASSA_PSS;
break; break;
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_SHA512_C) #if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
*md_alg = MBEDTLS_MD_SHA512; *md_alg = MBEDTLS_MD_SHA512;
*pk_type = MBEDTLS_PK_RSASSA_PSS; *pk_type = MBEDTLS_PK_RSASSA_PSS;
break; break;
#endif /* MBEDTLS_SHA512_C */ #endif /* MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#endif /* MBEDTLS_PKCS1_V21 */ #endif /* MBEDTLS_PKCS1_V21 */
default: default:
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
@ -2209,32 +2210,32 @@ static inline int mbedtls_ssl_tls12_sig_alg_is_supported(
switch( hash ) switch( hash )
{ {
#if defined(MBEDTLS_MD5_C) #if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_MD5: case MBEDTLS_SSL_HASH_MD5:
break; break;
#endif #endif
#if defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA1: case MBEDTLS_SSL_HASH_SHA1:
break; break;
#endif #endif
#if defined(MBEDTLS_SHA224_C) #if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA224: case MBEDTLS_SSL_HASH_SHA224:
break; break;
#endif #endif
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA256: case MBEDTLS_SSL_HASH_SHA256:
break; break;
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA384: case MBEDTLS_SSL_HASH_SHA384:
break; break;
#endif #endif
#if defined(MBEDTLS_SHA512_C) #if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA512: case MBEDTLS_SSL_HASH_SHA512:
break; break;
#endif #endif

224
library/ssl_tls.c
View file

@ -41,6 +41,7 @@
#include "ssl_client.h" #include "ssl_client.h"
#include "ssl_debug_helpers.h" #include "ssl_debug_helpers.h"
#include "ssl_misc.h" #include "ssl_misc.h"
#include "mbedtls/debug.h" #include "mbedtls/debug.h"
#include "mbedtls/error.h" #include "mbedtls/error.h"
#include "mbedtls/platform_util.h" #include "mbedtls/platform_util.h"
@ -53,6 +54,7 @@
#include "mbedtls/psa_util.h" #include "mbedtls/psa_util.h"
#include "psa/crypto.h" #include "psa/crypto.h"
#endif #endif
#include "legacy_or_psa.h"
#if defined(MBEDTLS_X509_CRT_PARSE_C) #if defined(MBEDTLS_X509_CRT_PARSE_C)
#include "mbedtls/oid.h" #include "mbedtls/oid.h"
@ -418,7 +420,7 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
unsigned endpoint, unsigned endpoint,
const mbedtls_ssl_context *ssl ); const mbedtls_ssl_context *ssl );
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
static int tls_prf_sha256( const unsigned char *secret, size_t slen, static int tls_prf_sha256( const unsigned char *secret, size_t slen,
const char *label, const char *label,
@ -427,9 +429,9 @@ static int tls_prf_sha256( const unsigned char *secret, size_t slen,
static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * ); static void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *,unsigned char*, size_t * );
static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int ); static void ssl_calc_finished_tls_sha256( mbedtls_ssl_context *,unsigned char *, int );
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
static int tls_prf_sha384( const unsigned char *secret, size_t slen, static int tls_prf_sha384( const unsigned char *secret, size_t slen,
const char *label, const char *label,
@ -438,7 +440,7 @@ static int tls_prf_sha384( const unsigned char *secret, size_t slen,
static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * ); static void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *, unsigned char*, size_t * );
static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int ); static void ssl_calc_finished_tls_sha384( mbedtls_ssl_context *, unsigned char *, int );
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session, static size_t ssl_tls12_session_save( const mbedtls_ssl_session *session,
unsigned char *buf, unsigned char *buf,
@ -452,13 +454,13 @@ static int ssl_tls12_session_load( mbedtls_ssl_session *session,
static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t ); static void ssl_update_checksum_start( mbedtls_ssl_context *, const unsigned char *, size_t );
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t ); static void ssl_update_checksum_sha256( mbedtls_ssl_context *, const unsigned char *, size_t );
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t ); static void ssl_update_checksum_sha384( mbedtls_ssl_context *, const unsigned char *, size_t );
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf, int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
const unsigned char *secret, size_t slen, const unsigned char *secret, size_t slen,
@ -471,16 +473,16 @@ int mbedtls_ssl_tls_prf( const mbedtls_tls_prf_types prf,
switch( prf ) switch( prf )
{ {
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_TLS_PRF_SHA384: case MBEDTLS_SSL_TLS_PRF_SHA384:
tls_prf = tls_prf_sha384; tls_prf = tls_prf_sha384;
break; break;
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_TLS_PRF_SHA256: case MBEDTLS_SSL_TLS_PRF_SHA256:
tls_prf = tls_prf_sha256; tls_prf = tls_prf_sha256;
break; break;
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
default: default:
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
@ -517,12 +519,12 @@ void mbedtls_ssl_optimize_checksum( mbedtls_ssl_context *ssl,
{ {
((void) ciphersuite_info); ((void) ciphersuite_info);
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 ) if( ciphersuite_info->mac == MBEDTLS_MD_SHA384 )
ssl->handshake->update_checksum = ssl_update_checksum_sha384; ssl->handshake->update_checksum = ssl_update_checksum_sha384;
else else
#endif #endif
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 ) if( ciphersuite_info->mac != MBEDTLS_MD_SHA384 )
ssl->handshake->update_checksum = ssl_update_checksum_sha256; ssl->handshake->update_checksum = ssl_update_checksum_sha256;
else else
@ -560,7 +562,7 @@ void mbedtls_ssl_add_hs_msg_to_checksum( mbedtls_ssl_context *ssl,
void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl ) void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
{ {
((void) ssl); ((void) ssl);
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_abort( &ssl->handshake->fin_sha256_psa ); psa_hash_abort( &ssl->handshake->fin_sha256_psa );
psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 ); psa_hash_setup( &ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
@ -568,12 +570,12 @@ void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 ); mbedtls_sha256_starts( &ssl->handshake->fin_sha256, 0 );
#endif #endif
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_abort( &ssl->handshake->fin_sha384_psa ); psa_hash_abort( &ssl->handshake->fin_sha384_psa );
psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 ); psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
#else #else
mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 ); mbedtls_sha512_starts( &ssl->handshake->fin_sha384, 1 );
#endif #endif
#endif #endif
} }
@ -581,23 +583,23 @@ void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl )
static void ssl_update_checksum_start( mbedtls_ssl_context *ssl, static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
const unsigned char *buf, size_t len ) const unsigned char *buf, size_t len )
{ {
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len ); psa_hash_update( &ssl->handshake->fin_sha256_psa, buf, len );
#else #else
mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len ); mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
#endif #endif
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len ); psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
#else #else
mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len ); mbedtls_sha512_update( &ssl->handshake->fin_sha384, buf, len );
#endif #endif
#endif #endif
} }
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl, static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
const unsigned char *buf, size_t len ) const unsigned char *buf, size_t len )
{ {
@ -609,14 +611,14 @@ static void ssl_update_checksum_sha256( mbedtls_ssl_context *ssl,
} }
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl, static void ssl_update_checksum_sha384( mbedtls_ssl_context *ssl,
const unsigned char *buf, size_t len ) const unsigned char *buf, size_t len )
{ {
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len ); psa_hash_update( &ssl->handshake->fin_sha384_psa, buf, len );
#else #else
mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len ); mbedtls_sha512_update( &ssl->handshake->fin_sha384, buf, len );
#endif #endif
} }
#endif #endif
@ -625,7 +627,7 @@ static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
{ {
memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) ); memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
handshake->fin_sha256_psa = psa_hash_operation_init(); handshake->fin_sha256_psa = psa_hash_operation_init();
psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 ); psa_hash_setup( &handshake->fin_sha256_psa, PSA_ALG_SHA_256 );
@ -634,13 +636,13 @@ static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
mbedtls_sha256_starts( &handshake->fin_sha256, 0 ); mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
#endif #endif
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
handshake->fin_sha384_psa = psa_hash_operation_init(); handshake->fin_sha384_psa = psa_hash_operation_init();
psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 ); psa_hash_setup( &handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
#else #else
mbedtls_sha512_init( &handshake->fin_sha512 ); mbedtls_sha512_init( &handshake->fin_sha384 );
mbedtls_sha512_starts( &handshake->fin_sha512, 1 ); mbedtls_sha512_starts( &handshake->fin_sha384, 1 );
#endif #endif
#endif #endif
@ -3499,18 +3501,18 @@ void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl )
} }
#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ #endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_abort( &handshake->fin_sha256_psa ); psa_hash_abort( &handshake->fin_sha256_psa );
#else #else
mbedtls_sha256_free( &handshake->fin_sha256 ); mbedtls_sha256_free( &handshake->fin_sha256 );
#endif #endif
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_abort( &handshake->fin_sha384_psa ); psa_hash_abort( &handshake->fin_sha384_psa );
#else #else
mbedtls_sha512_free( &handshake->fin_sha512 ); mbedtls_sha512_free( &handshake->fin_sha384 );
#endif #endif
#endif #endif
@ -4355,45 +4357,45 @@ static int ssl_preset_suiteb_ciphersuites[] = {
*/ */
static uint16_t ssl_preset_default_sig_algs[] = { static uint16_t ssl_preset_default_sig_algs[] = {
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \ #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256, MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C && #endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA &&
MBEDTLS_ECP_DP_SECP256R1_ENABLED */ MBEDTLS_ECP_DP_SECP256R1_ENABLED */
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \ #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384, MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C && #endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
MBEDTLS_ECP_DP_SECP384R1_ENABLED */ MBEDTLS_ECP_DP_SECP384R1_ENABLED */
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA512_C) && \ #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512, MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512,
#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C && #endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
MBEDTLS_ECP_DP_SECP521R1_ENABLED */ MBEDTLS_ECP_DP_SECP521R1_ENABLED */
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA512_C) #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512, MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512,
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA512_C */ #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384, MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384,
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA384_C */ #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256, MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */ #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA512_C) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512, MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512,
#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */ #endif /* MBEDTLS_RSA_C && MBEDTLS_SHA512_C */
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384, MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384,
#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */ #endif /* MBEDTLS_RSA_C && MBEDTLS_SHA384_C */
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256, MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */ #endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */
@ -4403,7 +4405,7 @@ static uint16_t ssl_preset_default_sig_algs[] = {
/* NOTICE: see above */ /* NOTICE: see above */
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
static uint16_t ssl_tls12_preset_default_sig_algs[] = { static uint16_t ssl_tls12_preset_default_sig_algs[] = {
#if defined(MBEDTLS_SHA512_C) #if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA512 ),
#endif #endif
@ -4413,8 +4415,8 @@ static uint16_t ssl_tls12_preset_default_sig_algs[] = {
#if defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_RSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA512 ),
#endif #endif
#endif /* MBEDTLS_SHA512_C */ #endif /* MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
#endif #endif
@ -4424,8 +4426,8 @@ static uint16_t ssl_tls12_preset_default_sig_algs[] = {
#if defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_RSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
#endif #endif
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
#endif #endif
@ -4435,32 +4437,32 @@ static uint16_t ssl_tls12_preset_default_sig_algs[] = {
#if defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_RSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
#endif #endif
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
MBEDTLS_TLS_SIG_NONE MBEDTLS_TLS_SIG_NONE
}; };
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
/* NOTICE: see above */ /* NOTICE: see above */
static uint16_t ssl_preset_suiteb_sig_algs[] = { static uint16_t ssl_preset_suiteb_sig_algs[] = {
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA256_C) && \ #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256, MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256,
#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA256_C && #endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
MBEDTLS_ECP_DP_SECP256R1_ENABLED */ MBEDTLS_ECP_DP_SECP256R1_ENABLED */
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_SHA384_C) && \ #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA) && \
defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384, MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384,
#endif /* MBEDTLS_ECDSA_C && MBEDTLS_SHA384_C && #endif /* MBEDTLS_ECDSA_C && MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA&&
MBEDTLS_ECP_DP_SECP384R1_ENABLED */ MBEDTLS_ECP_DP_SECP384R1_ENABLED */
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256, MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256,
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_SHA256_C */ #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256, MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
#endif /* MBEDTLS_RSA_C && MBEDTLS_SHA256_C */ #endif /* MBEDTLS_RSA_C && MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
MBEDTLS_TLS_SIG_NONE MBEDTLS_TLS_SIG_NONE
}; };
@ -4468,22 +4470,22 @@ static uint16_t ssl_preset_suiteb_sig_algs[] = {
/* NOTICE: see above */ /* NOTICE: see above */
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = { static uint16_t ssl_tls12_preset_suiteb_sig_algs[] = {
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA256 ),
#endif #endif
#if defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_RSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA256 ),
#endif #endif
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_ECDSA, MBEDTLS_SSL_HASH_SHA384 ),
#endif #endif
#if defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_RSA_C)
MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ), MBEDTLS_SSL_TLS12_SIG_AND_HASH_ALG( MBEDTLS_SSL_SIG_RSA, MBEDTLS_SSL_HASH_SHA384 ),
#endif #endif
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
MBEDTLS_TLS_SIG_NONE MBEDTLS_TLS_SIG_NONE
}; };
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
@ -4834,27 +4836,27 @@ mbedtls_md_type_t mbedtls_ssl_md_alg_from_hash( unsigned char hash )
{ {
switch( hash ) switch( hash )
{ {
#if defined(MBEDTLS_MD5_C) #if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_MD5: case MBEDTLS_SSL_HASH_MD5:
return( MBEDTLS_MD_MD5 ); return( MBEDTLS_MD_MD5 );
#endif #endif
#if defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA1: case MBEDTLS_SSL_HASH_SHA1:
return( MBEDTLS_MD_SHA1 ); return( MBEDTLS_MD_SHA1 );
#endif #endif
#if defined(MBEDTLS_SHA224_C) #if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA224: case MBEDTLS_SSL_HASH_SHA224:
return( MBEDTLS_MD_SHA224 ); return( MBEDTLS_MD_SHA224 );
#endif #endif
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA256: case MBEDTLS_SSL_HASH_SHA256:
return( MBEDTLS_MD_SHA256 ); return( MBEDTLS_MD_SHA256 );
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA384: case MBEDTLS_SSL_HASH_SHA384:
return( MBEDTLS_MD_SHA384 ); return( MBEDTLS_MD_SHA384 );
#endif #endif
#if defined(MBEDTLS_SHA512_C) #if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA512: case MBEDTLS_SSL_HASH_SHA512:
return( MBEDTLS_MD_SHA512 ); return( MBEDTLS_MD_SHA512 );
#endif #endif
@ -4870,27 +4872,27 @@ unsigned char mbedtls_ssl_hash_from_md_alg( int md )
{ {
switch( md ) switch( md )
{ {
#if defined(MBEDTLS_MD5_C) #if defined(MBEDTLS_HAS_ALG_MD5_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_MD5: case MBEDTLS_MD_MD5:
return( MBEDTLS_SSL_HASH_MD5 ); return( MBEDTLS_SSL_HASH_MD5 );
#endif #endif
#if defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA1: case MBEDTLS_MD_SHA1:
return( MBEDTLS_SSL_HASH_SHA1 ); return( MBEDTLS_SSL_HASH_SHA1 );
#endif #endif
#if defined(MBEDTLS_SHA224_C) #if defined(MBEDTLS_HAS_ALG_SHA_224_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA224: case MBEDTLS_MD_SHA224:
return( MBEDTLS_SSL_HASH_SHA224 ); return( MBEDTLS_SSL_HASH_SHA224 );
#endif #endif
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA256: case MBEDTLS_MD_SHA256:
return( MBEDTLS_SSL_HASH_SHA256 ); return( MBEDTLS_SSL_HASH_SHA256 );
#endif #endif
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA384: case MBEDTLS_MD_SHA384:
return( MBEDTLS_SSL_HASH_SHA384 ); return( MBEDTLS_SSL_HASH_SHA384 );
#endif #endif
#if defined(MBEDTLS_SHA512_C) #if defined(MBEDTLS_HAS_ALG_SHA_512_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA512: case MBEDTLS_MD_SHA512:
return( MBEDTLS_SSL_HASH_SHA512 ); return( MBEDTLS_SSL_HASH_SHA512 );
#endif #endif
@ -5026,13 +5028,13 @@ int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
switch( md ) switch( md )
{ {
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA384: case MBEDTLS_MD_SHA384:
hash_operation_to_clone = &ssl->handshake->fin_sha384_psa; hash_operation_to_clone = &ssl->handshake->fin_sha384_psa;
break; break;
#endif #endif
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA256: case MBEDTLS_MD_SHA256:
hash_operation_to_clone = &ssl->handshake->fin_sha256_psa; hash_operation_to_clone = &ssl->handshake->fin_sha256_psa;
break; break;
@ -5055,7 +5057,7 @@ exit:
} }
#else /* MBEDTLS_USE_PSA_CRYPTO */ #else /* MBEDTLS_USE_PSA_CRYPTO */
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl, static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
unsigned char *dst, unsigned char *dst,
@ -5069,7 +5071,7 @@ static int ssl_get_handshake_transcript_sha384( mbedtls_ssl_context *ssl,
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
mbedtls_sha512_init( &sha512 ); mbedtls_sha512_init( &sha512 );
mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 ); mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 ) if( ( ret = mbedtls_sha512_finish( &sha512, dst ) ) != 0 )
{ {
@ -5084,9 +5086,9 @@ exit:
mbedtls_sha512_free( &sha512 ); mbedtls_sha512_free( &sha512 );
return( ret ); return( ret );
} }
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl, static int ssl_get_handshake_transcript_sha256( mbedtls_ssl_context *ssl,
unsigned char *dst, unsigned char *dst,
@ -5115,7 +5117,7 @@ exit:
mbedtls_sha256_free( &sha256 ); mbedtls_sha256_free( &sha256 );
return( ret ); return( ret );
} }
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl, int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
const mbedtls_md_type_t md, const mbedtls_md_type_t md,
@ -5126,15 +5128,15 @@ int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
switch( md ) switch( md )
{ {
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA384: case MBEDTLS_MD_SHA384:
return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) ); return( ssl_get_handshake_transcript_sha384( ssl, dst, dst_len, olen ) );
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_MD_SHA256: case MBEDTLS_MD_SHA256:
return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) ); return( ssl_get_handshake_transcript_sha256( ssl, dst, dst_len, olen ) );
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
default: default:
break; break;
@ -5492,7 +5494,7 @@ exit:
} }
#endif /* MBEDTLS_USE_PSA_CRYPTO */ #endif /* MBEDTLS_USE_PSA_CRYPTO */
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
static int tls_prf_sha256( const unsigned char *secret, size_t slen, static int tls_prf_sha256( const unsigned char *secret, size_t slen,
const char *label, const char *label,
@ -5502,9 +5504,9 @@ static int tls_prf_sha256( const unsigned char *secret, size_t slen,
return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen, return( tls_prf_generic( MBEDTLS_MD_SHA256, secret, slen,
label, random, rlen, dstbuf, dlen ) ); label, random, rlen, dstbuf, dlen ) );
} }
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
static int tls_prf_sha384( const unsigned char *secret, size_t slen, static int tls_prf_sha384( const unsigned char *secret, size_t slen,
const char *label, const char *label,
@ -5514,7 +5516,7 @@ static int tls_prf_sha384( const unsigned char *secret, size_t slen,
return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen, return( tls_prf_generic( MBEDTLS_MD_SHA384, secret, slen,
label, random, rlen, dstbuf, dlen ) ); label, random, rlen, dstbuf, dlen ) );
} }
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
/* /*
* Set appropriate PRF function and other SSL / TLS1.2 functions * Set appropriate PRF function and other SSL / TLS1.2 functions
@ -5529,7 +5531,7 @@ MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake, static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
mbedtls_md_type_t hash ) mbedtls_md_type_t hash )
{ {
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
if( hash == MBEDTLS_MD_SHA384 ) if( hash == MBEDTLS_MD_SHA384 )
{ {
handshake->tls_prf = tls_prf_sha384; handshake->tls_prf = tls_prf_sha384;
@ -5538,7 +5540,7 @@ static int ssl_set_handshake_prfs( mbedtls_ssl_handshake_params *handshake,
} }
else else
#endif #endif
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
{ {
(void) hash; (void) hash;
handshake->tls_prf = tls_prf_sha256; handshake->tls_prf = tls_prf_sha256;
@ -5790,12 +5792,12 @@ int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
{ {
switch( md ) switch( md )
{ {
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA384: case MBEDTLS_SSL_HASH_SHA384:
ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384; ssl->handshake->calc_verify = ssl_calc_verify_tls_sha384;
break; break;
#endif #endif
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
case MBEDTLS_SSL_HASH_SHA256: case MBEDTLS_SSL_HASH_SHA256:
ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256; ssl->handshake->calc_verify = ssl_calc_verify_tls_sha256;
break; break;
@ -5807,7 +5809,7 @@ int mbedtls_ssl_set_calc_verify_md( mbedtls_ssl_context *ssl, int md )
return( 0 ); return( 0 );
} }
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl, void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
unsigned char *hash, unsigned char *hash,
size_t *hlen ) size_t *hlen )
@ -5854,9 +5856,9 @@ void ssl_calc_verify_tls_sha256( const mbedtls_ssl_context *ssl,
#endif /* MBEDTLS_USE_PSA_CRYPTO */ #endif /* MBEDTLS_USE_PSA_CRYPTO */
return; return;
} }
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl, void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
unsigned char *hash, unsigned char *hash,
size_t *hlen ) size_t *hlen )
@ -5891,7 +5893,7 @@ void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc verify sha384" ) );
mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 ); mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
mbedtls_sha512_finish( &sha512, hash ); mbedtls_sha512_finish( &sha512, hash );
*hlen = 48; *hlen = 48;
@ -5903,7 +5905,7 @@ void ssl_calc_verify_tls_sha384( const mbedtls_ssl_context *ssl,
#endif /* MBEDTLS_USE_PSA_CRYPTO */ #endif /* MBEDTLS_USE_PSA_CRYPTO */
return; return;
} }
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if !defined(MBEDTLS_USE_PSA_CRYPTO) && \ #if !defined(MBEDTLS_USE_PSA_CRYPTO) && \
defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
@ -6881,7 +6883,7 @@ exit:
} }
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
static void ssl_calc_finished_tls_sha256( static void ssl_calc_finished_tls_sha256(
mbedtls_ssl_context *ssl, unsigned char *buf, int from ) mbedtls_ssl_context *ssl, unsigned char *buf, int from )
{ {
@ -6955,11 +6957,10 @@ static void ssl_calc_finished_tls_sha256(
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
} }
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
static void ssl_calc_finished_tls_sha384( static void ssl_calc_finished_tls_sha384(
mbedtls_ssl_context *ssl, unsigned char *buf, int from ) mbedtls_ssl_context *ssl, unsigned char *buf, int from )
{ {
@ -7006,7 +7007,7 @@ static void ssl_calc_finished_tls_sha384(
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> calc finished tls sha384" ) );
mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha512 ); mbedtls_sha512_clone( &sha512, &ssl->handshake->fin_sha384 );
/* /*
* TLSv1.2: * TLSv1.2:
@ -7032,7 +7033,7 @@ static void ssl_calc_finished_tls_sha384(
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) ); MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= calc finished" ) );
} }
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA*/
void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl ) void mbedtls_ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl )
{ {
@ -7325,7 +7326,7 @@ exit:
*/ */
static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id ) static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
{ {
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
const mbedtls_ssl_ciphersuite_t * const ciphersuite_info = const mbedtls_ssl_ciphersuite_t * const ciphersuite_info =
mbedtls_ssl_ciphersuite_from_id( ciphersuite_id ); mbedtls_ssl_ciphersuite_from_id( ciphersuite_id );
@ -7341,14 +7342,14 @@ static tls_prf_fn ssl_tls12prf_from_cs( int ciphersuite_id )
static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf ) static mbedtls_tls_prf_types tls_prf_get_type( mbedtls_ssl_tls_prf_cb *tls_prf )
{ {
((void) tls_prf); ((void) tls_prf);
#if defined(MBEDTLS_SHA384_C) #if defined(MBEDTLS_HAS_ALG_SHA_384_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
if( tls_prf == tls_prf_sha384 ) if( tls_prf == tls_prf_sha384 )
{ {
return( MBEDTLS_SSL_TLS_PRF_SHA384 ); return( MBEDTLS_SSL_TLS_PRF_SHA384 );
} }
else else
#endif #endif
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
if( tls_prf == tls_prf_sha256 ) if( tls_prf == tls_prf_sha256 )
{ {
return( MBEDTLS_SSL_TLS_PRF_SHA256 ); return( MBEDTLS_SSL_TLS_PRF_SHA256 );
@ -7829,8 +7830,11 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
} }
if( ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ) || if( ( transform->psa_alg == MBEDTLS_SSL_NULL_CIPHER ) ||
( ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING ) && ( ( transform->psa_alg == PSA_ALG_CBC_NO_PADDING )
( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED ) ) ) #if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
&& ( transform->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED )
#endif
) )
/* mbedtls_ct_hmac() requires the key to be exportable */ /* mbedtls_ct_hmac() requires the key to be exportable */
psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT | psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT |
PSA_KEY_USAGE_VERIFY_HASH ); PSA_KEY_USAGE_VERIFY_HASH );

11
library/ssl_tls12_client.c
View file

@ -53,6 +53,8 @@
#include "mbedtls/platform_util.h" #include "mbedtls/platform_util.h"
#endif #endif
#include "hash_info.h"
#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) #if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
int mbedtls_ssl_conf_has_static_psk( mbedtls_ssl_config const *conf ) int mbedtls_ssl_conf_has_static_psk( mbedtls_ssl_config const *conf )
{ {
@ -2453,14 +2455,13 @@ start_processing:
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
if( pk_alg == MBEDTLS_PK_RSASSA_PSS ) if( pk_alg == MBEDTLS_PK_RSASSA_PSS )
{ {
const mbedtls_md_info_t* md_info;
mbedtls_pk_rsassa_pss_options rsassa_pss_options; mbedtls_pk_rsassa_pss_options rsassa_pss_options;
rsassa_pss_options.mgf1_hash_id = md_alg; rsassa_pss_options.mgf1_hash_id = md_alg;
if( ( md_info = mbedtls_md_info_from_type( md_alg ) ) == NULL ) rsassa_pss_options.expected_salt_len =
{ mbedtls_hash_info_get_size( md_alg );
if( rsassa_pss_options.expected_salt_len == 0 )
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
}
rsassa_pss_options.expected_salt_len = mbedtls_md_get_size( md_info );
ret = mbedtls_pk_verify_ext( pk_alg, &rsassa_pss_options, ret = mbedtls_pk_verify_ext( pk_alg, &rsassa_pss_options,
peer_pk, peer_pk,
md_alg, hash, hashlen, md_alg, hash, hashlen,

2
library/ssl_tls13_generic.c
View file

@ -1410,7 +1410,7 @@ int mbedtls_ssl_reset_transcript_for_hrr( mbedtls_ssl_context *ssl )
psa_hash_abort( &ssl->handshake->fin_sha384_psa ); psa_hash_abort( &ssl->handshake->fin_sha384_psa );
psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 ); psa_hash_setup( &ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384 );
#else #else
mbedtls_sha512_starts( &ssl->handshake->fin_sha512, 1 ); mbedtls_sha512_starts( &ssl->handshake->fin_sha384, 1 );
#endif #endif
#endif /* MBEDTLS_SHA384_C */ #endif /* MBEDTLS_SHA384_C */
} }

3
programs/ssl/ssl_client2.c
View file

@ -1789,6 +1789,7 @@ int main( int argc, char *argv[] )
} }
#if defined(MBEDTLS_X509_CRT_PARSE_C) #if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
/* The default algorithms profile disables SHA-1, but our tests still /* The default algorithms profile disables SHA-1, but our tests still
rely on it heavily. */ rely on it heavily. */
if( opt.allow_sha1 > 0 ) if( opt.allow_sha1 > 0 )
@ -1797,11 +1798,11 @@ int main( int argc, char *argv[] )
mbedtls_ssl_conf_cert_profile( &conf, &crt_profile_for_test ); mbedtls_ssl_conf_cert_profile( &conf, &crt_profile_for_test );
mbedtls_ssl_conf_sig_algs( &conf, ssl_sig_algs_for_test ); mbedtls_ssl_conf_sig_algs( &conf, ssl_sig_algs_for_test );
} }
if( opt.context_crt_cb == 0 ) if( opt.context_crt_cb == 0 )
mbedtls_ssl_conf_verify( &conf, my_verify, NULL ); mbedtls_ssl_conf_verify( &conf, my_verify, NULL );
memset( peer_crt_info, 0, sizeof( peer_crt_info ) ); memset( peer_crt_info, 0, sizeof( peer_crt_info ) );
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
#endif /* MBEDTLS_X509_CRT_PARSE_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)

3
programs/ssl/ssl_context_info.c
View file

@ -645,7 +645,7 @@ void print_deserialized_ssl_session( const uint8_t *ssl, uint32_t len,
{ {
printf( "\tcipher : %s\n", cipher_info->name ); printf( "\tcipher : %s\n", cipher_info->name );
} }
#if defined(MBEDTLS_MD_C)
md_info = mbedtls_md_info_from_type( ciphersuite_info->mac ); md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
if( md_info == NULL ) if( md_info == NULL )
{ {
@ -655,6 +655,7 @@ void print_deserialized_ssl_session( const uint8_t *ssl, uint32_t len,
{ {
printf( "\tMessage-Digest : %s\n", mbedtls_md_get_name( md_info ) ); printf( "\tMessage-Digest : %s\n", mbedtls_md_get_name( md_info ) );
} }
#endif /* MBEDTLS_MD_C */
} }
CHECK_SSL_END( 1 ); CHECK_SSL_END( 1 );

2
programs/ssl/ssl_server2.c
View file

@ -2753,6 +2753,7 @@ int main( int argc, char *argv[] )
} }
#if defined(MBEDTLS_X509_CRT_PARSE_C) #if defined(MBEDTLS_X509_CRT_PARSE_C)
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
/* The default algorithms profile disables SHA-1, but our tests still /* The default algorithms profile disables SHA-1, but our tests still
rely on it heavily. Hence we allow it here. A real-world server rely on it heavily. Hence we allow it here. A real-world server
should use the default profile unless there is a good reason not to. */ should use the default profile unless there is a good reason not to. */
@ -2762,6 +2763,7 @@ int main( int argc, char *argv[] )
mbedtls_ssl_conf_cert_profile( &conf, &crt_profile_for_test ); mbedtls_ssl_conf_cert_profile( &conf, &crt_profile_for_test );
mbedtls_ssl_conf_sig_algs( &conf, ssl_sig_algs_for_test ); mbedtls_ssl_conf_sig_algs( &conf, ssl_sig_algs_for_test );
} }
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
#endif /* MBEDTLS_X509_CRT_PARSE_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */
if( opt.auth_mode != DFL_AUTH_MODE ) if( opt.auth_mode != DFL_AUTH_MODE )

23
tests/scripts/all.sh
View file

@ -1874,29 +1874,6 @@ component_test_psa_crypto_config_accel_hash_use_psa () {
scripts/config.py unset MBEDTLS_PKCS12_C scripts/config.py unset MBEDTLS_PKCS12_C
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC
scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_DETERMINISTIC_ECDSA scripts/config.py -f include/psa/crypto_config.h unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
# TLS currently depends on MD_C
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
scripts/config.py unset MBEDTLS_SSL_CLI_C
scripts/config.py unset MBEDTLS_SSL_DTLS_ANTI_REPLAY
scripts/config.py unset MBEDTLS_SSL_SERVER_NAME_INDICATION
scripts/config.py unset MBEDTLS_SSL_SRV_C
scripts/config.py unset MBEDTLS_SSL_TLS_C
# TLS 1.2 currently depends on SHA1_C || SHA256_C || SHA512_C
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_2
scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
scripts/config.py unset MBEDTLS_SSL_EXTENDED_MASTER_SECRET
scripts/config.py unset MBEDTLS_SSL_PROTO_DTLS
scripts/config.py unset MBEDTLS_SSL_DTLS_ANTI_REPLAY
scripts/config.py unset MBEDTLS_SSL_DTLS_HELLO_VERIFY
scripts/config.py unset MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
# DTLS cookies currently depend on SHA1_C || SHA224_C || SHA384_C
scripts/config.py unset MBEDTLS_SSL_COOKIE_C
# TLS 1.3 currently depends on SHA256_C || SHA384_C # TLS 1.3 currently depends on SHA256_C || SHA384_C
# but is already disabled in the default config # but is already disabled in the default config

40
tests/src/certs.c
View file

@ -21,6 +21,10 @@
#include <test/certs.h> #include <test/certs.h>
#include "mbedtls/build_info.h"
#include "legacy_or_psa.h"
/* /*
* Test CA Certificates * Test CA Certificates
* *
@ -1563,13 +1567,13 @@ const size_t mbedtls_test_cli_crt_ec_len =
* Dispatch between SHA-1 and SHA-256 * Dispatch between SHA-1 and SHA-256
*/ */
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
#define TEST_CA_CRT_RSA TEST_CA_CRT_RSA_SHA256 #define TEST_CA_CRT_RSA TEST_CA_CRT_RSA_SHA256
#define TEST_SRV_CRT_RSA TEST_SRV_CRT_RSA_SHA256 #define TEST_SRV_CRT_RSA TEST_SRV_CRT_RSA_SHA256
#else #else
#define TEST_CA_CRT_RSA TEST_CA_CRT_RSA_SHA1 #define TEST_CA_CRT_RSA TEST_CA_CRT_RSA_SHA1
#define TEST_SRV_CRT_RSA TEST_SRV_CRT_RSA_SHA1 #define TEST_SRV_CRT_RSA TEST_SRV_CRT_RSA_SHA1
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
const char mbedtls_test_ca_crt_rsa[] = TEST_CA_CRT_RSA; const char mbedtls_test_ca_crt_rsa[] = TEST_CA_CRT_RSA;
const char mbedtls_test_srv_crt_rsa[] = TEST_SRV_CRT_RSA; const char mbedtls_test_srv_crt_rsa[] = TEST_SRV_CRT_RSA;
@ -1668,10 +1672,10 @@ const size_t mbedtls_test_cli_crt_len =
/* List of CAs in PEM or DER, depending on config */ /* List of CAs in PEM or DER, depending on config */
const char * mbedtls_test_cas[] = { const char * mbedtls_test_cas[] = {
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
mbedtls_test_ca_crt_rsa_sha1, mbedtls_test_ca_crt_rsa_sha1,
#endif #endif
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
mbedtls_test_ca_crt_rsa_sha256, mbedtls_test_ca_crt_rsa_sha256,
#endif #endif
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
@ -1680,10 +1684,10 @@ const char * mbedtls_test_cas[] = {
NULL NULL
}; };
const size_t mbedtls_test_cas_len[] = { const size_t mbedtls_test_cas_len[] = {
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
sizeof( mbedtls_test_ca_crt_rsa_sha1 ), sizeof( mbedtls_test_ca_crt_rsa_sha1 ),
#endif #endif
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
sizeof( mbedtls_test_ca_crt_rsa_sha256 ), sizeof( mbedtls_test_ca_crt_rsa_sha256 ),
#endif #endif
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
@ -1695,12 +1699,12 @@ const size_t mbedtls_test_cas_len[] = {
/* List of all available CA certificates in DER format */ /* List of all available CA certificates in DER format */
const unsigned char * mbedtls_test_cas_der[] = { const unsigned char * mbedtls_test_cas_der[] = {
#if defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_RSA_C)
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
mbedtls_test_ca_crt_rsa_sha256_der, mbedtls_test_ca_crt_rsa_sha256_der,
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
mbedtls_test_ca_crt_rsa_sha1_der, mbedtls_test_ca_crt_rsa_sha1_der,
#endif /* MBEDTLS_SHA1_C */ #endif /* MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#endif /* MBEDTLS_RSA_C */ #endif /* MBEDTLS_RSA_C */
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
mbedtls_test_ca_crt_ec_der, mbedtls_test_ca_crt_ec_der,
@ -1710,12 +1714,12 @@ const unsigned char * mbedtls_test_cas_der[] = {
const size_t mbedtls_test_cas_der_len[] = { const size_t mbedtls_test_cas_der_len[] = {
#if defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_RSA_C)
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
sizeof( mbedtls_test_ca_crt_rsa_sha256_der ), sizeof( mbedtls_test_ca_crt_rsa_sha256_der ),
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
sizeof( mbedtls_test_ca_crt_rsa_sha1_der ), sizeof( mbedtls_test_ca_crt_rsa_sha1_der ),
#endif /* MBEDTLS_SHA1_C */ #endif /* MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#endif /* MBEDTLS_RSA_C */ #endif /* MBEDTLS_RSA_C */
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
sizeof( mbedtls_test_ca_crt_ec_der ), sizeof( mbedtls_test_ca_crt_ec_der ),
@ -1727,12 +1731,12 @@ const size_t mbedtls_test_cas_der_len[] = {
#if defined(MBEDTLS_PEM_PARSE_C) #if defined(MBEDTLS_PEM_PARSE_C)
const char mbedtls_test_cas_pem[] = const char mbedtls_test_cas_pem[] =
#if defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_RSA_C)
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
TEST_CA_CRT_RSA_SHA256_PEM TEST_CA_CRT_RSA_SHA256_PEM
#endif /* MBEDTLS_SHA256_C */ #endif /* MBEDTLS_HAS_ALG_SHA_256_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#if defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA)
TEST_CA_CRT_RSA_SHA1_PEM TEST_CA_CRT_RSA_SHA1_PEM
#endif /* MBEDTLS_SHA1_C */ #endif /* MBEDTLS_HAS_ALG_SHA_1_VIA_MD_OR_PSA_BASED_ON_USE_PSA */
#endif /* MBEDTLS_RSA_C */ #endif /* MBEDTLS_RSA_C */
#if defined(MBEDTLS_ECDSA_C) #if defined(MBEDTLS_ECDSA_C)
TEST_CA_CRT_EC_PEM TEST_CA_CRT_EC_PEM

974
tests/suites/test_suite_ssl.data
View file

File diff suppressed because it is too large Load diff

109
tests/suites/test_suite_ssl.function
View file

@ -1,8 +1,6 @@
/* BEGIN_HEADER */ /* BEGIN_HEADER */
#include <mbedtls/ssl.h> #include <mbedtls/ssl.h>
#include <ssl_misc.h> #include <ssl_misc.h>
#include <mbedtls/ctr_drbg.h>
#include <mbedtls/entropy.h>
#include <mbedtls/timing.h> #include <mbedtls/timing.h>
#include <mbedtls/debug.h> #include <mbedtls/debug.h>
#include <ssl_tls13_keys.h> #include <ssl_tls13_keys.h>
@ -13,10 +11,10 @@
#include "mbedtls/ssl_cache.h" #include "mbedtls/ssl_cache.h"
#endif #endif
#include <psa/crypto.h> #include <legacy_or_psa.h>
#include "hash_info.h"
#include <constant_time_internal.h> #include <constant_time_internal.h>
#include <test/constant_flow.h> #include <test/constant_flow.h>
enum enum
@ -33,6 +31,18 @@ typedef struct log_pattern
size_t counter; size_t counter;
} log_pattern; } log_pattern;
#if defined(MBEDTLS_X509_CRT_PARSE_C)
static int rng_seed = 0xBEEF;
static int rng_get( void *p_rng, unsigned char *output, size_t output_len )
{
(void) p_rng;
for( size_t i = 0; i < output_len; i++ )
output[i] = rand();
return 0;
}
#endif
/* /*
* This function can be passed to mbedtls to receive output logs from it. In * This function can be passed to mbedtls to receive output logs from it. In
* this case, it will count the instances of a log_pattern in the received * this case, it will count the instances of a log_pattern in the received
@ -93,6 +103,10 @@ typedef struct handshake_test_options
void init_handshake_options( handshake_test_options *opts ) void init_handshake_options( handshake_test_options *opts )
{ {
#if defined(MBEDTLS_X509_CRT_PARSE_C)
srand( rng_seed );
rng_seed += 0xD0;
#endif
opts->cipher = ""; opts->cipher = "";
opts->client_min_version = MBEDTLS_SSL_VERSION_UNKNOWN; opts->client_min_version = MBEDTLS_SSL_VERSION_UNKNOWN;
opts->client_max_version = MBEDTLS_SSL_VERSION_UNKNOWN; opts->client_max_version = MBEDTLS_SSL_VERSION_UNKNOWN;
@ -776,9 +790,7 @@ int mbedtls_mock_tcp_recv_msg( void *ctx, unsigned char *buf, size_t buf_len )
return msg_len; return msg_len;
} }
#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ #if defined(MBEDTLS_X509_CRT_PARSE_C)
defined(MBEDTLS_ENTROPY_C) && \
defined(MBEDTLS_CTR_DRBG_C)
/* /*
* Structure with endpoint's certificates for SSL communication tests. * Structure with endpoint's certificates for SSL communication tests.
@ -798,8 +810,6 @@ typedef struct mbedtls_endpoint
const char *name; const char *name;
mbedtls_ssl_context ssl; mbedtls_ssl_context ssl;
mbedtls_ssl_config conf; mbedtls_ssl_config conf;
mbedtls_ctr_drbg_context ctr_drbg;
mbedtls_entropy_context entropy;
mbedtls_mock_socket socket; mbedtls_mock_socket socket;
mbedtls_endpoint_certificate cert; mbedtls_endpoint_certificate cert;
} mbedtls_endpoint; } mbedtls_endpoint;
@ -981,11 +991,7 @@ int mbedtls_endpoint_init( mbedtls_endpoint *ep, int endpoint_type,
mbedtls_ssl_init( &( ep->ssl ) ); mbedtls_ssl_init( &( ep->ssl ) );
mbedtls_ssl_config_init( &( ep->conf ) ); mbedtls_ssl_config_init( &( ep->conf ) );
mbedtls_ctr_drbg_init( &( ep->ctr_drbg ) ); mbedtls_ssl_conf_rng( &( ep->conf ), rng_get, NULL );
mbedtls_ssl_conf_rng( &( ep->conf ),
mbedtls_ctr_drbg_random,
&( ep->ctr_drbg ) );
mbedtls_entropy_init( &( ep->entropy ) );
TEST_ASSERT( mbedtls_ssl_conf_get_user_data_p( &ep->conf ) == NULL ); TEST_ASSERT( mbedtls_ssl_conf_get_user_data_p( &ep->conf ) == NULL );
TEST_EQUAL( mbedtls_ssl_conf_get_user_data_n( &ep->conf ), 0 ); TEST_EQUAL( mbedtls_ssl_conf_get_user_data_n( &ep->conf ), 0 );
@ -1009,11 +1015,6 @@ int mbedtls_endpoint_init( mbedtls_endpoint *ep, int endpoint_type,
mbedtls_mock_socket_init( &( ep->socket ) ); mbedtls_mock_socket_init( &( ep->socket ) );
} }
ret = mbedtls_ctr_drbg_seed( &( ep->ctr_drbg ), mbedtls_entropy_func,
&( ep->entropy ), (const unsigned char *) ( ep->name ),
strlen( ep->name ) );
TEST_ASSERT( ret == 0 );
/* Non-blocking callbacks without timeout */ /* Non-blocking callbacks without timeout */
if( dtls_context != NULL ) if( dtls_context != NULL )
{ {
@ -1103,8 +1104,6 @@ void mbedtls_endpoint_free( mbedtls_endpoint *ep,
mbedtls_ssl_free( &( ep->ssl ) ); mbedtls_ssl_free( &( ep->ssl ) );
mbedtls_ssl_config_free( &( ep->conf ) ); mbedtls_ssl_config_free( &( ep->conf ) );
mbedtls_ctr_drbg_free( &( ep->ctr_drbg ) );
mbedtls_entropy_free( &( ep->entropy ) );
if( context != NULL ) if( context != NULL )
{ {
@ -1164,7 +1163,7 @@ int mbedtls_move_handshake_to_state( mbedtls_ssl_context *ssl,
return ( max_steps >= 0 ) ? ret : -1; return ( max_steps >= 0 ) ? ret : -1;
} }
#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */
/* /*
* Write application data. Increase write counter if necessary. * Write application data. Increase write counter if necessary.
@ -1444,16 +1443,12 @@ static int build_transforms( mbedtls_ssl_transform *t_in,
if( cipher_info->mode == MBEDTLS_MODE_CBC || if( cipher_info->mode == MBEDTLS_MODE_CBC ||
cipher_info->mode == MBEDTLS_MODE_STREAM ) cipher_info->mode == MBEDTLS_MODE_STREAM )
{ {
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if !defined(MBEDTLS_USE_PSA_CRYPTO)
maclen = mbedtls_hash_info_get_size( hash_id ); mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type( hash_id );
#else
mbedtls_md_info_t const *md_info;
/* Pick hash */
md_info = mbedtls_md_info_from_type( hash_id );
CHK( md_info != NULL ); CHK( md_info != NULL );
maclen = mbedtls_md_get_size( md_info ); #endif
#endif /* MBEDTLS_USE_PSA_CRYPTO */ maclen = mbedtls_hash_info_get_size( hash_id );
CHK( maclen != 0 );
/* Pick hash keys */ /* Pick hash keys */
CHK( ( md0 = mbedtls_calloc( 1, maclen ) ) != NULL ); CHK( ( md0 = mbedtls_calloc( 1, maclen ) ) != NULL );
CHK( ( md1 = mbedtls_calloc( 1, maclen ) ) != NULL ); CHK( ( md1 = mbedtls_calloc( 1, maclen ) ) != NULL );
@ -2019,9 +2014,7 @@ int exchange_data( mbedtls_ssl_context *ssl_1,
ssl_2, 256, 1 ); ssl_2, 256, 1 );
} }
#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ #if defined(MBEDTLS_X509_CRT_PARSE_C)
defined(MBEDTLS_ENTROPY_C) && \
defined(MBEDTLS_CTR_DRBG_C)
static int check_ssl_version( mbedtls_ssl_protocol_version expected_negotiated_version, static int check_ssl_version( mbedtls_ssl_protocol_version expected_negotiated_version,
const mbedtls_ssl_context *ssl ) const mbedtls_ssl_context *ssl )
{ {
@ -2058,12 +2051,10 @@ static int check_ssl_version( mbedtls_ssl_protocol_version expected_negotiated_v
exit: exit:
return( 0 ); return( 0 );
} }
#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */
#if defined(MBEDTLS_X509_CRT_PARSE_C) && \ #if defined(MBEDTLS_X509_CRT_PARSE_C)
defined(MBEDTLS_ENTROPY_C) && \
defined(MBEDTLS_CTR_DRBG_C)
void perform_handshake( handshake_test_options *options ) void perform_handshake( handshake_test_options *options )
{ {
/* forced_ciphersuite needs to last until the end of the handshake */ /* forced_ciphersuite needs to last until the end of the handshake */
@ -2459,7 +2450,7 @@ exit:
#endif #endif
USE_PSA_DONE( ); USE_PSA_DONE( );
} }
#endif /* MBEDTLS_X509_CRT_PARSE_C && MBEDTLS_ENTROPY_C && MBEDTLS_CTR_DRBG_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */
#if defined(MBEDTLS_TEST_HOOKS) #if defined(MBEDTLS_TEST_HOOKS)
/* /*
@ -4027,10 +4018,12 @@ void ssl_decrypt_non_etm_cbc( int cipher_type, int hash_id, int trunc_hmac,
size_t plaintext_len, block_size, i; size_t plaintext_len, block_size, i;
unsigned char padlen; /* excluding the padding_length byte */ unsigned char padlen; /* excluding the padding_length byte */
unsigned char add_data[13]; unsigned char add_data[13];
unsigned char mac[MBEDTLS_MD_MAX_SIZE];
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
size_t sign_mac_length = 0; size_t sign_mac_length = 0;
unsigned char mac[PSA_HASH_MAX_SIZE];
#else
unsigned char mac[MBEDTLS_MD_MAX_SIZE];
#endif #endif
int exp_ret; int exp_ret;
int ret; int ret;
@ -4124,7 +4117,7 @@ void ssl_decrypt_non_etm_cbc( int cipher_type, int hash_id, int trunc_hmac,
rec.buf + rec.data_offset, rec.buf + rec.data_offset,
rec.data_len ) ); rec.data_len ) );
TEST_EQUAL( PSA_SUCCESS, psa_mac_sign_finish( &operation, TEST_EQUAL( PSA_SUCCESS, psa_mac_sign_finish( &operation,
mac, MBEDTLS_MD_MAX_SIZE, mac, sizeof(mac),
&sign_mac_length ) ); &sign_mac_length ) );
#else #else
TEST_EQUAL( 0, mbedtls_md_hmac_update( &t0.md_ctx_enc, add_data, 13 ) ); TEST_EQUAL( 0, mbedtls_md_hmac_update( &t0.md_ctx_enc, add_data, 13 ) );
@ -5090,7 +5083,7 @@ void ssl_session_serialize_version_check( int corrupt_major,
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_ENTROPY_C:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15*/
void mbedtls_endpoint_sanity( int endpoint_type ) void mbedtls_endpoint_sanity( int endpoint_type )
{ {
enum { BUFFSIZE = 1024 }; enum { BUFFSIZE = 1024 };
@ -5117,7 +5110,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_PKCS1_V15 */
void move_handshake_to_state(int endpoint_type, int state, int need_pass) void move_handshake_to_state(int endpoint_type, int state, int need_pass)
{ {
enum { BUFFSIZE = 1024 }; enum { BUFFSIZE = 1024 };
@ -5171,7 +5164,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */
void handshake_version( int dtls, int client_min_version, int client_max_version, void handshake_version( int dtls, int client_min_version, int client_max_version,
int server_min_version, int server_max_version, int server_min_version, int server_max_version,
int expected_negotiated_version ) int expected_negotiated_version )
@ -5196,7 +5189,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2 */
void handshake_psk_cipher( char* cipher, int pk_alg, data_t *psk_str, int dtls ) void handshake_psk_cipher( char* cipher, int pk_alg, data_t *psk_str, int dtls )
{ {
handshake_test_options options; handshake_test_options options;
@ -5217,7 +5210,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2 */
void handshake_cipher( char* cipher, int pk_alg, int dtls ) void handshake_cipher( char* cipher, int pk_alg, int dtls )
{ {
test_handshake_psk_cipher( cipher, pk_alg, NULL, dtls ); test_handshake_psk_cipher( cipher, pk_alg, NULL, dtls );
@ -5227,7 +5220,7 @@ void handshake_cipher( char* cipher, int pk_alg, int dtls )
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2 */
void handshake_ciphersuite_select( char* cipher, int pk_alg, data_t *psk_str, void handshake_ciphersuite_select( char* cipher, int pk_alg, data_t *psk_str,
int psa_alg, int psa_alg2, int psa_usage, int psa_alg, int psa_alg2, int psa_usage,
int expected_handshake_result, int expected_handshake_result,
@ -5254,7 +5247,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */
void app_data( int mfl, int cli_msg_len, int srv_msg_len, void app_data( int mfl, int cli_msg_len, int srv_msg_len,
int expected_cli_fragments, int expected_cli_fragments,
int expected_srv_fragments, int dtls ) int expected_srv_fragments, int dtls )
@ -5282,7 +5275,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */
void app_data_tls( int mfl, int cli_msg_len, int srv_msg_len, void app_data_tls( int mfl, int cli_msg_len, int srv_msg_len,
int expected_cli_fragments, int expected_cli_fragments,
int expected_srv_fragments ) int expected_srv_fragments )
@ -5294,7 +5287,7 @@ void app_data_tls( int mfl, int cli_msg_len, int srv_msg_len,
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS */
void app_data_dtls( int mfl, int cli_msg_len, int srv_msg_len, void app_data_dtls( int mfl, int cli_msg_len, int srv_msg_len,
int expected_cli_fragments, int expected_cli_fragments,
int expected_srv_fragments ) int expected_srv_fragments )
@ -5306,7 +5299,7 @@ void app_data_dtls( int mfl, int cli_msg_len, int srv_msg_len,
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_CONTEXT_SERIALIZATION:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_CONTEXT_SERIALIZATION */
void handshake_serialization( ) void handshake_serialization( )
{ {
handshake_test_options options; handshake_test_options options;
@ -5322,7 +5315,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:MBEDTLS_CIPHER_MODE_CBC:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:MBEDTLS_CIPHER_MODE_CBC */
void handshake_fragmentation( int mfl, int expected_srv_hs_fragmentation, int expected_cli_hs_fragmentation) void handshake_fragmentation( int mfl, int expected_srv_hs_fragmentation, int expected_cli_hs_fragmentation)
{ {
handshake_test_options options; handshake_test_options options;
@ -5361,7 +5354,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION */
void renegotiation( int legacy_renegotiation ) void renegotiation( int legacy_renegotiation )
{ {
handshake_test_options options; handshake_test_options options;
@ -5380,7 +5373,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */
void resize_buffers( int mfl, int renegotiation, int legacy_renegotiation, void resize_buffers( int mfl, int renegotiation, int legacy_renegotiation,
int serialize, int dtls, char *cipher ) int serialize, int dtls, char *cipher )
{ {
@ -5404,7 +5397,7 @@ exit:
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_CONTEXT_SERIALIZATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_CONTEXT_SERIALIZATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SSL_PROTO_DTLS */
void resize_buffers_serialize_mfl( int mfl ) void resize_buffers_serialize_mfl( int mfl )
{ {
test_resize_buffers( mfl, 0, MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION, 1, 1, test_resize_buffers( mfl, 0, MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION, 1, 1,
@ -5415,7 +5408,7 @@ void resize_buffers_serialize_mfl( int mfl )
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED */
void resize_buffers_renegotiate_mfl( int mfl, int legacy_renegotiation, void resize_buffers_renegotiate_mfl( int mfl, int legacy_renegotiation,
char *cipher ) char *cipher )
{ {
@ -5816,7 +5809,7 @@ void conf_group()
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_CACHE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_DEBUG_C:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_CACHE_C:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_DEBUG_C:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_PKCS1_V15 */
void force_bad_session_id_len( ) void force_bad_session_id_len( )
{ {
enum { BUFFSIZE = 1024 }; enum { BUFFSIZE = 1024 };
@ -6001,7 +5994,7 @@ void cid_sanity( )
} }
/* END_CASE */ /* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C:MBEDTLS_ECDSA_C */ /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ECP_C:MBEDTLS_ECDSA_C */
void raw_key_agreement_fail( int bad_server_ecdhe_key ) void raw_key_agreement_fail( int bad_server_ecdhe_key )
{ {
enum { BUFFSIZE = 17000 }; enum { BUFFSIZE = 17000 };