Commit graph

5597 commits

Author SHA1 Message Date
Manuel Pégourié-Gonnard
a4dd783909 Fix some typos in comments 2017-09-07 11:11:39 +02:00
Manuel Pégourié-Gonnard
bb216bd940 Fix MSVC 64-bit warnings
"conversion from size_t to int, possible loss of data"
2017-08-28 13:25:55 +02:00
Manuel Pégourié-Gonnard
196d1338ba Fix uninitialised variable in some configs 2017-08-28 13:14:27 +02:00
Manuel Pégourié-Gonnard
46ba7f3a92 Avoid running useless code in tests
With max_ops set to 0 or a very large value, we would always be doing an extra
full operation for no testing value.
2017-08-28 12:20:39 +02:00
Manuel Pégourié-Gonnard
fd87e354f6 Improve comments on parity trick 2017-08-24 14:21:19 +02:00
Manuel Pégourié-Gonnard
95aedfea33 Remove redundant test on curve type
If rsm != NULL then the curve type has to be Short Weierstrass, as we don't
implement restartable Montgomery now. If and when we do, then it's better to
check for the subcontext only, and not for the curve type.
2017-08-24 13:47:04 +02:00
Manuel Pégourié-Gonnard
11556e2846 Clarify initialization of T in mul_comb()
Exactly one of three ways will be used, so make that clear by using an
if 1 else if 2 else 3 structure.

While at it, don't initialize variables at declaration, just to make extra
sure they're properly initialized afterwards in all code paths.
2017-08-24 13:42:34 +02:00
Manuel Pégourié-Gonnard
0b23f167ba SSL: rework restart state handling
As done by previous commits for ECC and ECDSA:
- use explicit state assignments rather than increment
- always place the state update right before the operation label

This will make it easier to add restart support for other operations later if
desired.

SSL-specific changes:
- remove useless states: when the last restartable operation on a message is
  complete, ssl->state is incremented already, so we don't need any additional
state update: ecrs_state is only meant to complement ssl->state
- rename remaining states consistently as <message>_<operation>
- move some labels closer to the actual operation when possible (no assignment
  to variables used after the label between its previous and current position)
2017-08-24 12:08:33 +02:00
Manuel Pégourié-Gonnard
6348181da9 Explicit state assignments in ecdsa too 2017-08-24 11:16:01 +02:00
Manuel Pégourié-Gonnard
4ed1dab474 ECP: move state changes closer to operations
Systematically assign state just before the next operation that may return,
rather that just after the previous one. This makes things more local. (For
example, previously precompute_comb() has to handle a state reset for
mul_comb_core(), a kind of coupling that's best avoided.)

Note that this change doesn't move the location of state updates relative
to any potential return point, which is all that matters.
2017-08-24 11:02:04 +02:00
Manuel Pégourié-Gonnard
c9efa00871 ECP: Use explicit state assignments
Incrementing the state is error-prone as we can end up doing it too many times
(loops) or not enough (skipped branches), or just make programming mistakes
(eg. the state was incremented twice at the end, so it ended up with a value
not in the enum...)

This is the first step of the rework, the next one will rationalize where the
state assignments are done.
2017-08-24 10:25:06 +02:00
Manuel Pégourié-Gonnard
db4a8eb992 Use ECP_RS_ENTER/LEAVE() macros, as in ECDSA 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard
b948f7dc20 Don't bother to free NULL subcontexts 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard
bfa1972b4f Remove redundant checks, save a few muls
ecp_mul() already checks for this, and this check is not going away, so no
need to do it twice (didn't even result in better error reporting)
2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard
28d162829b Avoid unnecessary xxx_copy() calls
The call would anyway check for pointer equality and return early, but it
doesn't hurt to save a function call, and also this follows more uniformly the
pattern that those two lines go together:

    #if defined(MBEDTLS_ECP_RESTARTBLE)
    if( rs_ctx != NULL && ...
2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard
5bd38b1144 Replace memset() calls with xxx_init() calls
And follow calloc() calls with xxx_init() too
2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard
92cceb29bd Make some names more consistent 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard
ebac5d3797 Fix some whitespace & style issues 2017-08-23 18:20:17 +02:00
Manuel Pégourié-Gonnard
eaf55beead Misc documentation fixes/improvements 2017-08-23 14:40:21 +02:00
Manuel Pégourié-Gonnard
7037e222ea Improve comments and doc for ECP 2017-08-23 14:30:36 +02:00
Manuel Pégourié-Gonnard
daf049144e Rework state saving for verify_chain()
Child was almost redundant as it's already saved in ver_chain, except it was
multiplexed to also indicate whether an operation is in progress. This commit
removes it and introduces an explicit state variable instead.

This state can be useful later if we start returning IN_PROGRESS at other
points than find_parent() (for example when checking CRL).

Note that the state goes none -> find_parent and stays there until the context
is free(), as it's only on the first call that nothing was in progress.
2017-08-23 12:32:19 +02:00
Manuel Pégourié-Gonnard
a968843429 Improve some comments in verify_chain() 2017-08-23 11:37:22 +02:00
Manuel Pégourié-Gonnard
3627a8b2f6 Clarify state handling in find_parent(_in)() 2017-08-23 11:20:48 +02:00
Manuel Pégourié-Gonnard
83e923ba2b Better initialisation of ver_chain
Use dedicated function for consistency, and initialise flags to -1 as this is
the safe value.
2017-08-23 10:55:41 +02:00
Manuel Pégourié-Gonnard
8b7b96bbd3 Fix typo 2017-08-23 10:02:51 +02:00
Manuel Pégourié-Gonnard
d55f776cb7 Skip context allocation if restart disabled 2017-08-18 17:40:15 +02:00
Manuel Pégourié-Gonnard
aaa9814879 Uniformize ifdefs to ECDSA_C+ECP_RESTARTABLE
Some parts were already implicitly using this as the two ifdefs were nested,
and some others didn't, which resulted in compile errors in some configs. This
fixes those errors and saves a bit of code+RAM that was previously wasted when
ECP_RESTARTABLE was defined but ECDSA_C wasn't
2017-08-18 17:30:37 +02:00
Manuel Pégourié-Gonnard
fe6877034d Keep PK layer context in the PK layer
Previously we kept the ecdsa context created by the PK layer for ECDSA
operations on ECKEY in the ecdsa_restart_ctx structure, which was wrong, and
caused by the fact that we didn't have a proper handling of restart
sub-contexts in the PK layer.
2017-08-18 17:04:07 +02:00
Manuel Pégourié-Gonnard
0bbc66cc76 Dynamically allocate/free restart subcontext in PK 2017-08-18 16:22:06 +02:00
Manuel Pégourié-Gonnard
15d7df2ba8 Introduce mbedtls_pk_restart_ctx and use it
The fact that you needed to pass a pointer to mbedtls_ecdsa_restart_ctx (or
that you needed to know the key type of the PK context) was a breach of
abstraction.

Change the API (and callers) now, and the implementation will be changed in
the next commit.
2017-08-17 15:16:11 +02:00
Manuel Pégourié-Gonnard
98a6778d47 Better document some function arguments 2017-08-17 10:52:20 +02:00
Manuel Pégourié-Gonnard
b889d3e5fb Clarify & uniformise test comments 2017-08-17 10:25:18 +02:00
Manuel Pégourié-Gonnard
5faafa76cf Update X.509 test certs' Readme 2017-08-17 10:13:00 +02:00
Manuel Pégourié-Gonnard
c9e16a97da Disable restartable ECC by default 2017-08-15 14:30:59 +02:00
Manuel Pégourié-Gonnard
9897cc933d Update ChangeLog 2017-08-15 14:30:43 +02:00
Manuel Pégourié-Gonnard
3bf49c4552 Enable restart for certificate verify 2017-08-15 14:12:47 +02:00
Manuel Pégourié-Gonnard
fed37ed039 Extract some code to separate function
Goals include:
- reducing the number of local variables in the main function (so that we
  don't have to worry about saving/restoring them)
- reducing the number exit points in the main function, making it easier to
  update ssl->state only right before we return
2017-08-15 13:35:42 +02:00
Manuel Pégourié-Gonnard
39eda87382 Make more auto variables const
That way we know we don't have to worry about saving and restoring their
value.
2017-08-15 13:00:33 +02:00
Manuel Pégourié-Gonnard
6b7301c872 Change restart context type.
No need to have both x509 and ecdsa, as the former contains the later.
2017-08-15 12:08:45 +02:00
Manuel Pégourié-Gonnard
d27d1a5a82 Clean up existing SSL restartable ECC code
- more consistent naming with ecrs prefix for everything
- always check it enabled before touching the rest
- rm duplicated code in parse_server_hello()
2017-08-15 11:49:08 +02:00
Manuel Pégourié-Gonnard
8b59049407 Make verify() actually restartable 2017-08-15 10:45:09 +02:00
Manuel Pégourié-Gonnard
c11e4baa63 Rework type for verify chain
- create container with length + table
- make types public (will be needed in restart context)
2017-08-15 10:44:13 +02:00
Manuel Pégourié-Gonnard
18547b5db6 Refactor find_parent() to merge two call sites 2017-08-15 10:44:13 +02:00
Manuel Pégourié-Gonnard
a4a5d1dbe6 Adapt function signatures to rs_ctx + ret 2017-08-15 10:44:13 +02:00
Manuel Pégourié-Gonnard
be4ff42fe4 Call crt_check_signature from one place only 2017-08-15 10:44:13 +02:00
Manuel Pégourié-Gonnard
d19a41d9aa Add tests for verify_restartable()
For selection of test cases, see comments added in the commit.

It makes the most sense to test with chains using ECC only, so for the chain
of length 2 we use server10 -> int-ca3 -> int-ca2 and trust int-ca2 directly.

Note: server10.crt was created by copying server10_int3_int-ca2.crt and
manually truncating it to remove the intermediates. That base can now be used
to create derived certs (without or with a chain) in a programmatic way.
2017-08-15 10:44:08 +02:00
Manuel Pégourié-Gonnard
bc3f44ae9c Introduce mbedtls_x509_crt_verify_restartable() 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard
21b7719fb2 Add ChangeLog entry for current progress 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard
32033da127 Test some more handshake flows 2017-08-09 11:44:53 +02:00
Manuel Pégourié-Gonnard
23e416261c ECDH: not restartable unless explicitly enabled
This is mainly for the benefit of SSL modules, which only supports restart in
a limited number of cases. In the other cases (ECDHE_PSK) it would currently
return ERR_ECP_IN_PROGRESS and the user would thus call ssl_handshake() again,
but the SSL code wouldn't handle state properly and things would go wrong in
possibly unexpected ways.  This is undesirable, so it should be possible for
the SSL module to choose if ECDHE should behave the old or the new way.

Not that it also brings ECDHE more in line with the other modules which
already have that choice available (by passing a NULL or valid restart
context).
2017-08-09 11:44:53 +02:00