Split long lines
This commit is contained in:
parent
7e5437a972
commit
0d0cd4b30e
2 changed files with 71 additions and 42 deletions
|
@ -1991,7 +1991,8 @@ static int ssl_parse_server_psk_hint( mbedtls_ssl_context *ssl,
|
||||||
|
|
||||||
if( (*p) + len > end )
|
if( (*p) + len > end )
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message (psk_identity_hint length)" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad server key exchange message "
|
||||||
|
"(psk_identity_hint length)" ) );
|
||||||
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
|
return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -2192,7 +2193,8 @@ static int ssl_get_ecdh_params_from_cert( mbedtls_ssl_context *ssl )
|
||||||
static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
|
static int ssl_parse_server_key_exchange( mbedtls_ssl_context *ssl )
|
||||||
{
|
{
|
||||||
int ret;
|
int ret;
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
unsigned char *p, *end;
|
unsigned char *p, *end;
|
||||||
|
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) );
|
||||||
|
@ -2515,7 +2517,8 @@ exit:
|
||||||
#if ! defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
|
#if ! defined(MBEDTLS_KEY_EXCHANGE__CERT_REQ_ALLOWED__ENABLED)
|
||||||
static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
|
static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
|
||||||
{
|
{
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
|
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
|
||||||
|
|
||||||
|
@ -2536,7 +2539,8 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
|
||||||
unsigned char *buf;
|
unsigned char *buf;
|
||||||
size_t n = 0;
|
size_t n = 0;
|
||||||
size_t cert_type_len = 0, dn_len = 0;
|
size_t cert_type_len = 0, dn_len = 0;
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
|
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate request" ) );
|
||||||
|
|
||||||
|
@ -2626,7 +2630,8 @@ static int ssl_parse_certificate_request( mbedtls_ssl_context *ssl )
|
||||||
|
|
||||||
for( i = 0; i < sig_alg_len; i += 2 )
|
for( i = 0; i < sig_alg_len; i += 2 )
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Signature Algorithm found: %d,%d", sig_alg[i], sig_alg[i + 1] ) );
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "Supported Signature Algorithm found: %d"
|
||||||
|
",%d", sig_alg[i], sig_alg[i + 1] ) );
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
|
@ -2703,7 +2708,8 @@ static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
|
||||||
{
|
{
|
||||||
int ret;
|
int ret;
|
||||||
size_t i, n;
|
size_t i, n;
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
|
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write client key exchange" ) );
|
||||||
|
|
||||||
|
@ -2960,7 +2966,8 @@ static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
|
||||||
!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
|
!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
|
||||||
static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
|
static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
|
||||||
{
|
{
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate verify" ) );
|
||||||
|
@ -2989,7 +2996,8 @@ static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
|
||||||
static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
|
static int ssl_write_certificate_verify( mbedtls_ssl_context *ssl )
|
||||||
{
|
{
|
||||||
int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
|
int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
size_t n = 0, offset = 0;
|
size_t n = 0, offset = 0;
|
||||||
unsigned char hash[48];
|
unsigned char hash[48];
|
||||||
unsigned char *hash_start = hash;
|
unsigned char *hash_start = hash;
|
||||||
|
|
|
@ -234,8 +234,8 @@ static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
|
||||||
|
|
||||||
if( ( sig_cur = mbedtls_ssl_pk_alg_from_sig( p[1] ) ) == MBEDTLS_PK_NONE )
|
if( ( sig_cur = mbedtls_ssl_pk_alg_from_sig( p[1] ) ) == MBEDTLS_PK_NONE )
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: unknown sig alg encoding %d",
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext"
|
||||||
p[1] ) );
|
" unknown sig alg encoding %d", p[1] ) );
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -243,21 +243,22 @@ static int ssl_parse_signature_algorithms_ext( mbedtls_ssl_context *ssl,
|
||||||
md_cur = mbedtls_ssl_md_alg_from_hash( p[0] );
|
md_cur = mbedtls_ssl_md_alg_from_hash( p[0] );
|
||||||
if( md_cur == MBEDTLS_MD_NONE )
|
if( md_cur == MBEDTLS_MD_NONE )
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: unknown hash alg encoding %d",
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
|
||||||
p[0] ) );
|
" unknown hash alg encoding %d", p[0] ) );
|
||||||
continue;
|
continue;
|
||||||
}
|
}
|
||||||
|
|
||||||
if( mbedtls_ssl_check_sig_hash( ssl, md_cur ) == 0 )
|
if( mbedtls_ssl_check_sig_hash( ssl, md_cur ) == 0 )
|
||||||
{
|
{
|
||||||
mbedtls_ssl_sig_hash_set_add( &ssl->handshake->hash_algs, sig_cur, md_cur );
|
mbedtls_ssl_sig_hash_set_add( &ssl->handshake->hash_algs, sig_cur, md_cur );
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: match sig %d and hash %d",
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext:"
|
||||||
|
" match sig %d and hash %d",
|
||||||
sig_cur, md_cur ) );
|
sig_cur, md_cur ) );
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: hash alg %d not supported",
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "client hello v3, signature_algorithm ext: "
|
||||||
md_cur ) );
|
"hash alg %d not supported", md_cur ) );
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -641,7 +642,8 @@ static int ssl_pick_cert( mbedtls_ssl_context *ssl,
|
||||||
const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
|
const mbedtls_ssl_ciphersuite_t * ciphersuite_info )
|
||||||
{
|
{
|
||||||
mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
|
mbedtls_ssl_key_cert *cur, *list, *fallback = NULL;
|
||||||
mbedtls_pk_type_t pk_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
|
mbedtls_pk_type_t pk_alg =
|
||||||
|
mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
|
||||||
uint32_t flags;
|
uint32_t flags;
|
||||||
|
|
||||||
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
|
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
|
||||||
|
@ -1271,7 +1273,8 @@ read_record_header:
|
||||||
return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
|
return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO );
|
||||||
}
|
}
|
||||||
|
|
||||||
if( ( ret = mbedtls_ssl_fetch_input( ssl, mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
|
if( ( ret = mbedtls_ssl_fetch_input( ssl,
|
||||||
|
mbedtls_ssl_hdr_len( ssl ) + msg_len ) ) != 0 )
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
|
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_fetch_input", ret );
|
||||||
return( ret );
|
return( ret );
|
||||||
|
@ -1821,7 +1824,8 @@ read_record_header:
|
||||||
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
||||||
if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
|
if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV during renegotiation" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 1, ( "received RENEGOTIATION SCSV "
|
||||||
|
"during renegotiation" ) );
|
||||||
|
|
||||||
if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
|
if( ( ret = mbedtls_ssl_send_fatal_handshake_failure( ssl ) ) != 0 )
|
||||||
return( ret );
|
return( ret );
|
||||||
|
@ -1951,8 +1955,8 @@ have_ciphersuite:
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 3, ( "no hash algorithm for signature algorithm %d - should not happen",
|
MBEDTLS_SSL_DEBUG_MSG( 3, ( "no hash algorithm for signature algorithm "
|
||||||
sig_alg ) );
|
"%d - should not happen", sig_alg ) );
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
@ -2562,7 +2566,8 @@ static int ssl_write_server_hello( mbedtls_ssl_context *ssl )
|
||||||
!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
|
!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
|
||||||
static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
|
static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
|
||||||
{
|
{
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
|
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
|
||||||
|
|
||||||
|
@ -2584,7 +2589,8 @@ static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
|
||||||
static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
|
static int ssl_write_certificate_request( mbedtls_ssl_context *ssl )
|
||||||
{
|
{
|
||||||
int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
|
int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
size_t dn_size, total_dn_size; /* excluding length bytes */
|
size_t dn_size, total_dn_size; /* excluding length bytes */
|
||||||
size_t ct_len, sa_len; /* including length bytes */
|
size_t ct_len, sa_len; /* including length bytes */
|
||||||
unsigned char *buf, *p;
|
unsigned char *buf, *p;
|
||||||
|
@ -2799,7 +2805,8 @@ static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
|
||||||
}
|
}
|
||||||
#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED */
|
#endif /* MBEDTLS_KEY_EXCHANGE__SOME__ECDH_ENABLED */
|
||||||
|
|
||||||
/* Key exchanges not involving ephemeral keys don't use ServerKeyExchange, so end here. */
|
/* Key exchanges not involving ephemeral keys don't use
|
||||||
|
* ServerKeyExchange, so end here. */
|
||||||
#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
|
#if defined(MBEDTLS_KEY_EXCHANGE__SOME_NON_PFS__ENABLED)
|
||||||
if( mbedtls_ssl_ciphersuite_no_pfs( ciphersuite_info ) )
|
if( mbedtls_ssl_ciphersuite_no_pfs( ciphersuite_info ) )
|
||||||
{
|
{
|
||||||
|
@ -2809,22 +2816,30 @@ static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
|
||||||
}
|
}
|
||||||
#endif /* MBEDTLS_KEY_EXCHANGE__NON_PFS__ENABLED */
|
#endif /* MBEDTLS_KEY_EXCHANGE__NON_PFS__ENABLED */
|
||||||
|
|
||||||
|
/*
|
||||||
|
*
|
||||||
|
* Part 2: Provide key exchange parameters for chosen ciphersuite.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
|
||||||
|
/*
|
||||||
|
* - ECJPAKE key exchanges
|
||||||
|
*/
|
||||||
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
|
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
|
||||||
if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
|
if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECJPAKE )
|
||||||
{
|
{
|
||||||
size_t jlen;
|
|
||||||
const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
|
const unsigned char *end = ssl->out_msg + MBEDTLS_SSL_MAX_CONTENT_LEN;
|
||||||
|
|
||||||
ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
|
ret = mbedtls_ecjpake_write_round_two( &ssl->handshake->ecjpake_ctx,
|
||||||
p, end - p, &jlen, ssl->conf->f_rng, ssl->conf->p_rng );
|
p, end - p, &len, ssl->conf->f_rng, ssl->conf->p_rng );
|
||||||
if( ret != 0 )
|
if( ret != 0 )
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
|
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecjpake_write_round_two", ret );
|
||||||
return( ret );
|
return( ret );
|
||||||
}
|
}
|
||||||
|
|
||||||
p += jlen;
|
p += len;
|
||||||
n += jlen;
|
n += len;
|
||||||
}
|
}
|
||||||
#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
|
#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
|
||||||
|
|
||||||
|
@ -2882,8 +2897,10 @@ static int ssl_write_server_key_exchange( mbedtls_ssl_context *ssl )
|
||||||
return( ret );
|
return( ret );
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#if defined(MBEDTLS_KEY_EXCHANGE__WITH_SERVER_SIGNATURE__ENABLED)
|
||||||
dig_signed = p;
|
dig_signed = p;
|
||||||
dig_signed_len = len;
|
dig_signed_len = len;
|
||||||
|
#endif
|
||||||
|
|
||||||
p += len;
|
p += len;
|
||||||
n += len;
|
n += len;
|
||||||
|
@ -2964,27 +2981,30 @@ curve_matching_done:
|
||||||
unsigned char hash[64];
|
unsigned char hash[64];
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Choose hash algorithm:
|
* 3.1: Choose hash algorithm:
|
||||||
* - For TLS 1.2, obey signature-hash-algorithm extension to choose appropriate hash.
|
* A: For TLS 1.2, obey signature-hash-algorithm extension
|
||||||
* - For SSL3, TLS1.0, TLS1.1 and ECDHE_ECDSA, use SHA1 (RFC 4492, Sec. 5.4)
|
* to choose appropriate hash.
|
||||||
* - Otherwise, use MD5 + SHA1 (RFC 4346, Sec. 7.4.3)
|
* B: For SSL3, TLS1.0, TLS1.1 and ECDHE_ECDSA, use SHA1
|
||||||
|
* (RFC 4492, Sec. 5.4)
|
||||||
|
* C: Otherwise, use MD5 + SHA1 (RFC 4346, Sec. 7.4.3)
|
||||||
*/
|
*/
|
||||||
|
|
||||||
mbedtls_md_type_t md_alg;
|
mbedtls_md_type_t md_alg;
|
||||||
|
|
||||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||||
mbedtls_pk_type_t sig_alg = mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
|
mbedtls_pk_type_t sig_alg =
|
||||||
|
mbedtls_ssl_get_ciphersuite_sig_pk_alg( ciphersuite_info );
|
||||||
if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
|
if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3 )
|
||||||
{
|
{
|
||||||
/* For TLS 1.2, obey signature-hash-algorithm extension
|
/* A: For TLS 1.2, obey signature-hash-algorithm extension
|
||||||
* (RFC 5246, Sec. 7.4.1.4.1). */
|
* (RFC 5246, Sec. 7.4.1.4.1). */
|
||||||
|
|
||||||
if( sig_alg == MBEDTLS_PK_NONE ||
|
if( sig_alg == MBEDTLS_PK_NONE ||
|
||||||
( md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs, sig_alg ) ) == MBEDTLS_MD_NONE )
|
( md_alg = mbedtls_ssl_sig_hash_set_find( &ssl->handshake->hash_algs,
|
||||||
|
sig_alg ) ) == MBEDTLS_MD_NONE )
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
|
||||||
/* (... because we choose a cipher suite
|
/* (... because we choose a cipher suite
|
||||||
* only if there is a matching hash.) */
|
* only if there is a matching hash.) */
|
||||||
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
|
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -3127,8 +3147,7 @@ curve_matching_done:
|
||||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
||||||
|
|
||||||
if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
|
if( ( ret = mbedtls_pk_sign( mbedtls_ssl_own_key( ssl ), md_alg, hash, hashlen,
|
||||||
p + 2 , &signature_len,
|
p + 2 , &signature_len, ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
|
||||||
ssl->conf->f_rng, ssl->conf->p_rng ) ) != 0 )
|
|
||||||
{
|
{
|
||||||
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
|
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_sign", ret );
|
||||||
return( ret );
|
return( ret );
|
||||||
|
@ -3658,7 +3677,8 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
|
||||||
!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
|
!defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
|
||||||
static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
|
static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
|
||||||
{
|
{
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
|
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
|
||||||
|
|
||||||
|
@ -3688,7 +3708,8 @@ static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl )
|
||||||
mbedtls_pk_type_t pk_alg;
|
mbedtls_pk_type_t pk_alg;
|
||||||
#endif
|
#endif
|
||||||
mbedtls_md_type_t md_alg;
|
mbedtls_md_type_t md_alg;
|
||||||
const mbedtls_ssl_ciphersuite_t *ciphersuite_info = ssl->transform_negotiate->ciphersuite_info;
|
const mbedtls_ssl_ciphersuite_t *ciphersuite_info =
|
||||||
|
ssl->transform_negotiate->ciphersuite_info;
|
||||||
|
|
||||||
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
|
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue