yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Remove PSA-only code dealing with non-opaque PSA key

Browse source 
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
This commit is contained in:
Neil Armstrong 2022-05-03 09:57:57 +02:00
parent 501c93220d
commit 61f237afb7
2 changed files with 11 additions and 124 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
library/ssl_tls12_client.c
View file

@ -72,27 +72,6 @@ int mbedtls_ssl_conf_has_static_psk( mbedtls_ssl_config const *conf )
return( 0 ); return( 0 );
} }
#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ) || \
defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) )
static int ssl_conf_has_static_raw_psk( mbedtls_ssl_config const *conf )
{
if( conf->psk_identity == NULL ||
conf->psk_identity_len == 0 )
{
return( 0 );
}
if( conf->psk != NULL && conf->psk_len != 0 )
return( 1 );
return( 0 );
}
#endif /* MBEDTLS_USE_PSA_CRYPTO &&
( MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
MBEDTLS_KEY_EXCHANGE_PSK_ENABLED ) */
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
#if defined(MBEDTLS_SSL_RENEGOTIATION) #if defined(MBEDTLS_SSL_RENEGOTIATION)
@ -3070,39 +3049,9 @@ ecdh_calc_secret:
/* In case of opaque psk skip writting psk to pms. /* In case of opaque psk skip writting psk to pms.
* Opaque key will be handled later. */ * Opaque key will be handled later. */
if( ssl_conf_has_static_raw_psk( ssl->conf ) == 1 )
{
const unsigned char *psk = NULL;
size_t psk_len = 0;
if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
== MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
/*
* This should never happen because the existence of a PSK is always
* checked before calling this function
*/
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* opaque psk<0..2^16-1>; */
if( (size_t)( pms_end - pms ) < ( 2 + psk_len ) )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
/* Write the PSK length as uint16 */
MBEDTLS_PUT_UINT16_BE( psk_len, pms, 0 );
pms += 2;
/* Write the PSK itself */
memcpy( pms, psk, psk_len );
pms += psk_len;
ssl->handshake->pmslen = pms - ssl->handshake->premaster;
}
else
{
MBEDTLS_SSL_DEBUG_MSG( 1, MBEDTLS_SSL_DEBUG_MSG( 1,
( "skip PMS generation for opaque ECDHE-PSK" ) ); ( "skip PMS generation for opaque ECDHE-PSK" ) );
} }
}
else else
#endif /* MBEDTLS_USE_PSA_CRYPTO && #endif /* MBEDTLS_USE_PSA_CRYPTO &&
MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */
@ -3215,15 +3164,13 @@ ecdh_calc_secret:
#if defined(MBEDTLS_USE_PSA_CRYPTO) && \ #if defined(MBEDTLS_USE_PSA_CRYPTO) && \
defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK && if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK)
ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, MBEDTLS_SSL_DEBUG_MSG( 1,
( "skip PMS generation for opaque PSK" ) ); ( "skip PMS generation for opaque PSK" ) );
} }
else else
if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK && if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK)
ssl_conf_has_static_raw_psk( ssl->conf ) == 0 )
{ {
MBEDTLS_SSL_DEBUG_MSG( 1, MBEDTLS_SSL_DEBUG_MSG( 1,
( "skip PMS generation for opaque RSA-PSK" ) ); ( "skip PMS generation for opaque RSA-PSK" ) );

72
library/ssl_tls12_server.c
View file

@ -170,33 +170,6 @@ static int ssl_conf_has_psk_or_cb( mbedtls_ssl_config const *conf )
return( 0 ); return( 0 );
} }
#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
( defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ) || \
defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) )
static int ssl_use_opaque_psk( mbedtls_ssl_context const *ssl )
{
if( ssl->conf->f_psk != NULL )
{
/* If we've used a callback to select the PSK,
* the static configuration is irrelevant. */
if( ! mbedtls_svc_key_id_is_null( ssl->handshake->psk_opaque ) )
return( 1 );
return( 0 );
}
if( ! mbedtls_svc_key_id_is_null( ssl->conf->psk_opaque ) )
return( 1 );
return( 0 );
}
#endif /* MBEDTLS_USE_PSA_CRYPTO &&
( MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED ||
MBEDTLS_KEY_EXCHANGE_PSK_ENABLED ||
MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) */
#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */
static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl, static int ssl_parse_renegotiation_info( mbedtls_ssl_context *ssl,
@ -4010,18 +3983,17 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
} }
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
/* For opaque PSKs, we perform the PSK-to-MS derivation atomatically /* For opaque PSKs, we perform the PSK-to-MS derivation automatically
* and skip the intermediate PMS. */ * and skip the intermediate PMS. */
if( ssl_use_opaque_psk( ssl ) == 1 )
MBEDTLS_SSL_DEBUG_MSG( 1, ( "skip PMS generation for opaque PSK" ) ); MBEDTLS_SSL_DEBUG_MSG( 1, ( "skip PMS generation for opaque PSK" ) );
else #else
#endif /* MBEDTLS_USE_PSA_CRYPTO */
if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
ciphersuite_info->key_exchange ) ) != 0 ) ciphersuite_info->key_exchange ) ) != 0 )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
return( ret ); return( ret );
} }
#endif /* MBEDTLS_USE_PSA_CRYPTO */
} }
else else
#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ #endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
@ -4056,16 +4028,15 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
/* For opaque PSKs, we perform the PSK-to-MS derivation automatically /* For opaque PSKs, we perform the PSK-to-MS derivation automatically
* and skip the intermediate PMS. */ * and skip the intermediate PMS. */
if( ssl_use_opaque_psk( ssl ) == 1 )
MBEDTLS_SSL_DEBUG_MSG( 1, ( "skip PMS generation for opaque RSA-PSK" ) ); MBEDTLS_SSL_DEBUG_MSG( 1, ( "skip PMS generation for opaque RSA-PSK" ) );
else #else
#endif /* MBEDTLS_USE_PSA_CRYPTO */
if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl, if( ( ret = mbedtls_ssl_psk_derive_premaster( ssl,
ciphersuite_info->key_exchange ) ) != 0 ) ciphersuite_info->key_exchange ) ) != 0 )
{ {
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret ); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_psk_derive_premaster", ret );
return( ret ); return( ret );
} }
#endif /* MBEDTLS_USE_PSA_CRYPTO */
} }
else else
#endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */ #endif /* MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED */
@ -4175,40 +4146,9 @@ static int ssl_parse_client_key_exchange( mbedtls_ssl_context *ssl )
MBEDTLS_PUT_UINT16_BE( zlen, psm, 0 ); MBEDTLS_PUT_UINT16_BE( zlen, psm, 0 );
psm += zlen_size + zlen; psm += zlen_size + zlen;
const unsigned char *psk = NULL;
size_t psk_len = 0;
/* In case of opaque psk skip writting psk to pms. /* In case of opaque psk skip writting psk to pms.
* Opaque key will be handled later. */ * Opaque key will be handled later. */
if( ssl_use_opaque_psk( ssl ) == 0 ) MBEDTLS_SSL_DEBUG_MSG( 1, ( "skip PMS generation for opaque ECDHE-PSK" ) );
{
if( mbedtls_ssl_get_psk( ssl, &psk, &psk_len )
== MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED )
/*
* This should never happen because the existence of a PSK is always
* checked before calling this function
*/
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
/* opaque psk<0..2^16-1>; */
if( (size_t)( psm_end - psm ) < ( 2 + psk_len ) )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
/* Write the PSK length as uint16 */
MBEDTLS_PUT_UINT16_BE( psk_len, psm, 0 );
psm += 2;
/* Write the PSK itself */
memcpy( psm, psk, psk_len );
psm += psk_len;
ssl->handshake->pmslen = psm - ssl->handshake->premaster;
}
else
{
MBEDTLS_SSL_DEBUG_MSG( 1,
( "skip PMS generation for opaque ECDHE-PSK" ) );
}
#else /* MBEDTLS_USE_PSA_CRYPTO */ #else /* MBEDTLS_USE_PSA_CRYPTO */
if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 ) if( ( ret = ssl_parse_client_psk_identity( ssl, &p, end ) ) != 0 )
{ {