From 05bf89da34b4dbdc2cbfe83a82287d52d9d5033d Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 25 Jan 2022 17:50:25 +0100 Subject: [PATCH 1/2] Clarify key types message from ssl_client2 and ssl_server2 If no key is loaded in a slot, say "none", not "invalid PK". When listing two key types, use punctuation that's visibly a sequence separator (","). Signed-off-by: Gilles Peskine --- programs/ssl/ssl_client2.c | 3 ++- programs/ssl/ssl_server2.c | 4 +++- tests/ssl-opt.sh | 4 ++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c index 57f7d8f67..68dcf6bcd 100644 --- a/programs/ssl/ssl_client2.c +++ b/programs/ssl/ssl_client2.c @@ -1703,7 +1703,8 @@ int main( int argc, char *argv[] ) } #endif /* MBEDTLS_USE_PSA_CRYPTO */ - mbedtls_printf( " ok (key type: %s)\n", mbedtls_pk_get_name( &pkey ) ); + mbedtls_printf( " ok (key type: %s)\n", + strlen( opt.key_file ) ? mbedtls_pk_get_name( &pkey ) : "none" ); #endif /* MBEDTLS_X509_CRT_PARSE_C */ /* diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index 7cbdaf62c..632a26c1e 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -2515,7 +2515,9 @@ int main( int argc, char *argv[] ) } #endif /* MBEDTLS_USE_PSA_CRYPTO */ - mbedtls_printf( " ok (key types: %s - %s)\n", mbedtls_pk_get_name( &pkey ), mbedtls_pk_get_name( &pkey2 ) ); + mbedtls_printf( " ok (key types: %s, %s)\n", + key_cert_init2 ? mbedtls_pk_get_name( &pkey ) : "none", + key_cert_init2 ? mbedtls_pk_get_name( &pkey2 ) : "none" ); #endif /* MBEDTLS_X509_CRT_PARSE_C */ #if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_FS_IO) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 691c0e7d5..4d2679b93 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -1556,7 +1556,7 @@ run_test "Opaque key for server authentication" \ 0 \ -c "Verifying peer X.509 certificate... ok" \ -c "Ciphersuite is TLS-ECDHE-ECDSA" \ - -s "key types: Opaque - invalid PK" \ + -s "key types: Opaque, none" \ -s "Ciphersuite is TLS-ECDHE-ECDSA" \ -S "error" \ -C "error" @@ -1575,7 +1575,7 @@ run_test "Opaque key for client/server authentication" \ -c "key type: Opaque" \ -c "Verifying peer X.509 certificate... ok" \ -c "Ciphersuite is TLS-ECDHE-ECDSA" \ - -s "key types: Opaque - invalid PK" \ + -s "key types: Opaque, none" \ -s "Verifying peer X.509 certificate... ok" \ -s "Ciphersuite is TLS-ECDHE-ECDSA" \ -S "error" \ From cc50f1be43763028e90240ff88ee5dc046ca37fb Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 31 Jan 2022 22:53:30 +0100 Subject: [PATCH 2/2] Fix copypasta Signed-off-by: Gilles Peskine --- programs/ssl/ssl_server2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index 632a26c1e..9c6c35e3e 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -2516,7 +2516,7 @@ int main( int argc, char *argv[] ) #endif /* MBEDTLS_USE_PSA_CRYPTO */ mbedtls_printf( " ok (key types: %s, %s)\n", - key_cert_init2 ? mbedtls_pk_get_name( &pkey ) : "none", + key_cert_init ? mbedtls_pk_get_name( &pkey ) : "none", key_cert_init2 ? mbedtls_pk_get_name( &pkey2 ) : "none" ); #endif /* MBEDTLS_X509_CRT_PARSE_C */