lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-28 00:21:48 +03:00
Code Activity

Merge pull request #5674 from superna9999/5668-abstract-tls-mode-cleanup

Browse Source 
Cipher cleanup: abstract TLS mode
This commit is contained in:
Gilles Peskine
2022-04-28 12:33:38 +02:00
committed by GitHub
parent ad47487e25 2230e6c06d
commit 8855e36030
5 changed files with 244 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
library/ssl_tls12_server.c
View File

@ -1973,20 +1973,13 @@ static void ssl_write_cid_ext( mbedtls_ssl_context *ssl,
}
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
unsigned char *buf,
size_t *olen )
{
unsigned char *p = buf;
const mbedtls_ssl_ciphersuite_t *suite = NULL;
#if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_key_type_t key_type;
psa_algorithm_t alg;
size_t key_bits;
#else
const mbedtls_cipher_info_t *cipher = NULL;
#endif /* MBEDTLS_USE_PSA_CRYPTO */
/*
* RFC 7366: "If a server receives an encrypt-then-MAC request extension
@ -1994,18 +1987,19 @@ static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
* with Associated Data (AEAD) ciphersuite, it MUST NOT send an
* encrypt-then-MAC response extension back to the client."
*/
if( ( suite = mbedtls_ssl_ciphersuite_from_id(
ssl->session_negotiate->ciphersuite ) ) == NULL ||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
( mbedtls_ssl_cipher_to_psa( suite->cipher, 0, &alg,
&key_type, &key_bits ) != PSA_SUCCESS ) ||
alg != PSA_ALG_CBC_NO_PADDING )
#else
( cipher = mbedtls_cipher_info_from_type( suite->cipher ) ) == NULL ||
cipher->mode != MBEDTLS_MODE_CBC )
#endif /* MBEDTLS_USE_PSA_CRYPTO */
{
suite = mbedtls_ssl_ciphersuite_from_id(
ssl->session_negotiate->ciphersuite );
if( suite == NULL )
ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED;
else
{
mbedtls_ssl_mode_t ssl_mode =
mbedtls_ssl_get_mode_from_ciphersuite(
ssl->session_negotiate->encrypt_then_mac,
suite );
if( ssl_mode != MBEDTLS_SSL_MODE_CBC_ETM )
ssl->session_negotiate->encrypt_then_mac = MBEDTLS_SSL_ETM_DISABLED;
}
if( ssl->session_negotiate->encrypt_then_mac == MBEDTLS_SSL_ETM_DISABLED )
@ -2024,7 +2018,7 @@ static void ssl_write_encrypt_then_mac_ext( mbedtls_ssl_context *ssl,
*olen = 4;
}
#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */
#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
static void ssl_write_extended_ms_ext( mbedtls_ssl_context *ssl,
@ -2593,7 +2587,7 @@ static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
ext_len += olen;
#endif
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
ssl_write_encrypt_then_mac_ext( ssl, p + 2 + ext_len, &olen );
ext_len += olen;
#endif