lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Add named group IANA value check

Browse Source 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
This commit is contained in:
Jerry Yu
2022-01-11 17:13:16 +08:00
parent f46b016058
commit 3ad14ac9e9
3 changed files with 67 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/mbedtls/ssl.h
View File

@ -191,7 +191,6 @@
/* Elliptic Curve Groups (ECDHE) */ /* Elliptic Curve Groups (ECDHE) */
#define MBEDTLS_SSL_IANA_TLS_GROUP_NONE 0 #define MBEDTLS_SSL_IANA_TLS_GROUP_NONE 0
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECT163K1 0x0001 /* RFC 4492 */
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1 0x0012 #define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1 0x0012
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1 0x0013 #define MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1 0x0013
#define MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1 0x0014 #define MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1 0x0014

55
library/ssl_misc.h
View File

@ -1489,6 +1489,7 @@ static inline int mbedtls_ssl_conf_is_tls13_only( const mbedtls_ssl_config *conf
} }
return( 0 ); return( 0 );
} }
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
@ -1503,8 +1504,43 @@ static inline int mbedtls_ssl_conf_is_tls12_only( const mbedtls_ssl_config *conf
} }
return( 0 ); return( 0 );
} }
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
static inline int mbedtls_ssl_conf_is_tls13_enabled( const mbedtls_ssl_config *conf )
{
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
if( conf->min_major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
conf->max_major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
conf->min_minor_ver <= MBEDTLS_SSL_MINOR_VERSION_4 &&
conf->max_minor_ver >= MBEDTLS_SSL_MINOR_VERSION_4 )
{
return( 1 );
}
return( 0 );
#else
((void) conf);
return( 0 );
#endif
}
static inline int mbedtls_ssl_conf_is_tls12_enabled( const mbedtls_ssl_config *conf )
{
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
if( conf->min_major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
conf->max_major_ver == MBEDTLS_SSL_MAJOR_VERSION_3 &&
conf->min_minor_ver <= MBEDTLS_SSL_MINOR_VERSION_3 &&
conf->max_minor_ver >= MBEDTLS_SSL_MINOR_VERSION_3 )
{
return( 1 );
}
return( 0 );
#else
((void) conf);
return( 0 );
#endif
}
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3) #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && defined(MBEDTLS_SSL_PROTO_TLS1_3)
static inline int mbedtls_ssl_conf_is_hybrid_tls12_tls13( const mbedtls_ssl_config *conf ) static inline int mbedtls_ssl_conf_is_hybrid_tls12_tls13( const mbedtls_ssl_config *conf )
{ {
@ -1729,13 +1765,24 @@ static inline const void *mbedtls_ssl_get_groups( const mbedtls_ssl_context *ssl
/* /*
* Helper functions for NamedGroup. * Helper functions for NamedGroup.
*/ */
static inline int mbedtls_ssl_named_group_is_ecdhe( uint16_t named_group ) static inline int mbedtls_ssl_tls12_named_group_is_ecdhe( uint16_t named_group )
{ {
/* /*
* RFC 4492 section 5.1.1 * RFC 8422 section 5.1.1
*/ */
return( named_group >= MBEDTLS_SSL_IANA_TLS_GROUP_SECT163K1 && return( named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP192K1 ||
named_group < MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048 ); named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP192R1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP224K1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP224R1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X25519 ||
named_group == MBEDTLS_SSL_IANA_TLS_GROUP_X448 );
} }
static inline int mbedtls_ssl_tls13_named_group_is_ecdhe( uint16_t named_group ) static inline int mbedtls_ssl_tls13_named_group_is_ecdhe( uint16_t named_group )

29
library/ssl_tls.c
View File

@ -7221,10 +7221,7 @@ int mbedtls_ssl_get_handshake_transcript( mbedtls_ssl_context *ssl,
* NamedCurve named_curve_list<2..2^16-1> * NamedCurve named_curve_list<2..2^16-1>
* } NamedCurveList; * } NamedCurveList;
* *
* RFC8422 and RFC8446 share simillar structure and same extension id. The function * RFC8422 and RFC8446 share simillar structure and same extension id.
* only check if the curve/group is supported by library. It does not need check
* the IANA values. ECP module should check if the group/curve is deprecated or
* supported.
* *
* DHE groups hasn't been supported yet. * DHE groups hasn't been supported yet.
*/ */
@ -7260,16 +7257,22 @@ int mbedtls_ssl_write_supported_groups_ext( mbedtls_ssl_context *ssl,
MBEDTLS_SSL_DEBUG_MSG( 1, ("got supported group(%04x)",*group_list)); MBEDTLS_SSL_DEBUG_MSG( 1, ("got supported group(%04x)",*group_list));
#if defined(MBEDTLS_ECP_C) #if defined(MBEDTLS_ECP_C)
const mbedtls_ecp_curve_info *curve_info; if( ( mbedtls_ssl_conf_is_tls13_enabled(ssl->conf) &&
curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list ); mbedtls_ssl_tls13_named_group_is_ecdhe( *group_list ) ) ||
if( curve_info != NULL ) ( mbedtls_ssl_conf_is_tls12_enabled(ssl->conf) &&
mbedtls_ssl_tls12_named_group_is_ecdhe( *group_list ) ) )
{ {
MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 ); const mbedtls_ecp_curve_info *curve_info;
MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 ); curve_info = mbedtls_ecp_curve_info_from_tls_id( *group_list );
p += 2; if( curve_info != NULL )
MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )", {
curve_info->name, *group_list ) ); MBEDTLS_SSL_CHK_BUF_PTR( p, end, 2 );
continue; MBEDTLS_PUT_UINT16_BE( *group_list, p, 0 );
p += 2;
MBEDTLS_SSL_DEBUG_MSG( 3, ( "NamedGroup: %s ( %x )",
curve_info->name, *group_list ) );
continue;
}
} }
#endif /* MBEDTLS_ECP_C */ #endif /* MBEDTLS_ECP_C */
/* Add DHE groups here */ /* Add DHE groups here */