lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Remove pkcs1 from certificate_verify

Browse Source 
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
This commit is contained in:
Jerry Yu
2022-06-16 19:07:10 +08:00
parent 08524c55f9
commit 7ab7f2b184
3 changed files with 15 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
library/ssl_misc.h
View File

@ -2028,7 +2028,9 @@ static inline int mbedtls_ssl_tls13_get_pk_type_and_md_alg_from_sig_alg(
#endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */ #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
#if 0 && defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) #if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
defined(MBEDTLS_PKCS1_V15) && \
defined(MBEDTLS_RSA_C)
#if defined(MBEDTLS_SHA256_C) #if defined(MBEDTLS_SHA256_C)
case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256: case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
@ -2051,7 +2053,9 @@ static inline int mbedtls_ssl_tls13_get_pk_type_and_md_alg_from_sig_alg(
break; break;
#endif /* MBEDTLS_SHA512_C */ #endif /* MBEDTLS_SHA512_C */
#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C */ #endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
MBEDTLS_PKCS1_V15 &&
MBEDTLS_RSA_C */
default: default:
return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE ); return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );

6
library/ssl_tls13_generic.c
View File

@ -864,6 +864,12 @@ static int ssl_tls13_get_sig_alg_from_pk( mbedtls_ssl_context *ssl,
*algorithm = MBEDTLS_TLS1_3_SIG_NONE; *algorithm = MBEDTLS_TLS1_3_SIG_NONE;
for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE ; sig_alg++ ) for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE ; sig_alg++ )
{ {
if( *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256 ||
*sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384 ||
*sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512 )
{
continue;
}
if( mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg) && if( mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg) &&
mbedtls_ssl_tls13_sig_alg_is_available_for_pk( mbedtls_ssl_tls13_sig_alg_is_available_for_pk(
ssl, *sig_alg, own_key ) ) ssl, *sig_alg, own_key ) )

4
tests/ssl-opt.sh
View File

@ -1600,7 +1600,7 @@ requires_config_enabled MBEDTLS_SHA512_C # "signature_algorithm ext: 6"
requires_config_enabled MBEDTLS_ECP_DP_CURVE25519_ENABLED requires_config_enabled MBEDTLS_ECP_DP_CURVE25519_ENABLED
run_test "Default" \ run_test "Default" \
"$P_SRV debug_level=3" \ "$P_SRV debug_level=3" \
"$P_CLI" \ "$P_CLI debug_level=4" \
0 \ 0 \
-s "Protocol is TLSv1.2" \ -s "Protocol is TLSv1.2" \
-s "Ciphersuite is TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256" \ -s "Ciphersuite is TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256" \
@ -11483,7 +11483,7 @@ requires_config_enabled MBEDTLS_DEBUG_C
requires_config_enabled MBEDTLS_SSL_SRV_C requires_config_enabled MBEDTLS_SSL_SRV_C
requires_config_enabled MBEDTLS_SSL_CLI_C requires_config_enabled MBEDTLS_SSL_CLI_C
run_test "TLS 1.3: Server side check - mbedtls with sni" \ run_test "TLS 1.3: Server side check - mbedtls with sni" \
"$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=0 \ "$P_SRV debug_level=4 allow_sha1=0 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=0 \
sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \ sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
"$P_CLI debug_level=4 server_name=localhost crt_file=data_files/server5.crt key_file=data_files/server5.key \ "$P_CLI debug_level=4 server_name=localhost crt_file=data_files/server5.crt key_file=data_files/server5.key \
force_version=tls13" \ force_version=tls13" \