Skip to content

Commit d66898e

Browse files
gilles-peskine-armgilles-peskine-arm
authored
Merge pull request #10333 from valeriosetti/issue10266
[development] Migrate from mbedtls_pk_can_do_ext to mbedtls_pk_can_do_psa (2/2)
2 parents e6240f1 + e2aed3a commit d66898e

File tree

6 files changed

+17
-16
lines changed

6 files changed

+17
-16
lines changed

‎library/ssl_ciphersuites.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -924,7 +924,7 @@ psa_algorithm_t mbedtls_ssl_get_ciphersuite_sig_pk_psa_alg(const mbedtls_ssl_cip
924924
mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) info->mac));
925925

926926
case MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA:
927-
return PSA_ALG_ECDSA(mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) info->mac));
927+
return MBEDTLS_PK_ALG_ECDSA(mbedtls_md_psa_alg_from_type((mbedtls_md_type_t) info->mac));
928928

929929
default:
930930
return PSA_ALG_NONE;

‎library/ssl_tls.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8147,14 +8147,14 @@ unsigned int mbedtls_ssl_tls12_get_preferred_hash_for_sig_alg(
81478147
mbedtls_md_psa_alg_from_type(md_alg);
81488148

81498149
if (sig_alg_received == MBEDTLS_SSL_SIG_ECDSA &&
8150-
!mbedtls_pk_can_do_ext(ssl->handshake->key_cert->key,
8151-
PSA_ALG_ECDSA(psa_hash_alg),
8150+
!mbedtls_pk_can_do_psa(ssl->handshake->key_cert->key,
8151+
MBEDTLS_PK_ALG_ECDSA(psa_hash_alg),
81528152
PSA_KEY_USAGE_SIGN_HASH)) {
81538153
continue;
81548154
}
81558155

81568156
if (sig_alg_received == MBEDTLS_SSL_SIG_RSA &&
8157-
!mbedtls_pk_can_do_ext(ssl->handshake->key_cert->key,
8157+
!mbedtls_pk_can_do_psa(ssl->handshake->key_cert->key,
81588158
PSA_ALG_RSA_PKCS1V15_SIGN(
81598159
psa_hash_alg),
81608160
PSA_KEY_USAGE_SIGN_HASH)) {

‎library/ssl_tls12_server.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -693,11 +693,12 @@ static int ssl_pick_cert(mbedtls_ssl_context *ssl,
693693
int key_type_matches = 0;
694694
#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
695695
key_type_matches = ((ssl->conf->f_async_sign_start != NULL ||
696-
mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage)) &&
697-
mbedtls_pk_can_do_ext(&cur->cert->pk, pk_alg, pk_usage));
696+
mbedtls_pk_can_do_psa(cur->key, pk_alg, pk_usage)) &&
697+
mbedtls_pk_can_do_psa(&cur->cert->pk, pk_alg,
698+
PSA_KEY_USAGE_VERIFY_HASH));
698699
#else
699700
key_type_matches = (
700-
mbedtls_pk_can_do_ext(cur->key, pk_alg, pk_usage));
701+
mbedtls_pk_can_do_psa(cur->key, pk_alg, pk_usage));
701702
#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
702703
if (!key_type_matches) {
703704
MBEDTLS_SSL_DEBUG_MSG(3, ("certificate mismatch: key type"));

‎library/ssl_tls13_server.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1076,11 +1076,11 @@ static psa_algorithm_t ssl_tls13_iana_sig_alg_to_psa_alg(uint16_t sig_alg)
10761076
{
10771077
switch (sig_alg) {
10781078
case MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256:
1079-
return PSA_ALG_ECDSA(PSA_ALG_SHA_256);
1079+
return MBEDTLS_PK_ALG_ECDSA(PSA_ALG_SHA_256);
10801080
case MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384:
1081-
return PSA_ALG_ECDSA(PSA_ALG_SHA_384);
1081+
return MBEDTLS_PK_ALG_ECDSA(PSA_ALG_SHA_384);
10821082
case MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512:
1083-
return PSA_ALG_ECDSA(PSA_ALG_SHA_512);
1083+
return MBEDTLS_PK_ALG_ECDSA(PSA_ALG_SHA_512);
10841084
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
10851085
return PSA_ALG_RSA_PSS(PSA_ALG_SHA_256);
10861086
case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
@@ -1160,8 +1160,8 @@ static int ssl_tls13_pick_key_cert(mbedtls_ssl_context *ssl)
11601160
if (mbedtls_ssl_tls13_check_sig_alg_cert_key_match(
11611161
*sig_alg, &key_cert->cert->pk)
11621162
&& psa_alg != PSA_ALG_NONE &&
1163-
mbedtls_pk_can_do_ext(&key_cert->cert->pk, psa_alg,
1164-
PSA_KEY_USAGE_SIGN_HASH) == 1
1163+
mbedtls_pk_can_do_psa(&key_cert->cert->pk, psa_alg,
1164+
PSA_KEY_USAGE_VERIFY_HASH) == 1
11651165
) {
11661166
ssl->handshake->key_cert = key_cert;
11671167
MBEDTLS_SSL_DEBUG_MSG(3,

‎programs/ssl/ssl_test_lib.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ int key_opaque_set_alg_usage(const char *alg1, const char *alg2,
242242
*psa_algs[i] = PSA_ALG_RSA_PSS(PSA_ALG_SHA_512);
243243
*usage |= PSA_KEY_USAGE_SIGN_HASH;
244244
} else if (strcmp(algs[i], "ecdsa-sign") == 0) {
245-
*psa_algs[i] = PSA_ALG_ECDSA(PSA_ALG_ANY_HASH);
245+
*psa_algs[i] = MBEDTLS_PK_ALG_ECDSA(PSA_ALG_ANY_HASH);
246246
*usage |= PSA_KEY_USAGE_SIGN_HASH;
247247
} else if (strcmp(algs[i], "ecdh") == 0) {
248248
*psa_algs[i] = PSA_ALG_ECDH;
@@ -253,7 +253,7 @@ int key_opaque_set_alg_usage(const char *alg1, const char *alg2,
253253
}
254254
} else {
255255
if (key_type == MBEDTLS_PK_ECKEY) {
256-
*psa_alg1 = PSA_ALG_ECDSA(PSA_ALG_ANY_HASH);
256+
*psa_alg1 = MBEDTLS_PK_ALG_ECDSA(PSA_ALG_ANY_HASH);
257257
*psa_alg2 = PSA_ALG_ECDH;
258258
*usage = PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_DERIVE;
259259
} else if (key_type == MBEDTLS_PK_RSA) {

‎tests/suites/test_suite_ssl.data‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -457,11 +457,11 @@ handshake_ciphersuite_select:"TLS-ECDHE-ECDSA-WITH-AES-256-CCM":MBEDTLS_PK_ECDSA
457457

458458
Handshake, select ECDHE-ECDSA-WITH-AES-256-CCM, opaque, PSA_ALG_ANY_HASH
459459
depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
460-
handshake_ciphersuite_select:"TLS-ECDHE-ECDSA-WITH-AES-256-CCM":MBEDTLS_PK_ECDSA:"":PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_ALG_NONE:PSA_KEY_USAGE_SIGN_HASH:0:MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM
460+
handshake_ciphersuite_select:"TLS-ECDHE-ECDSA-WITH-AES-256-CCM":MBEDTLS_PK_ECDSA:"":MBEDTLS_PK_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_ALG_NONE:PSA_KEY_USAGE_SIGN_HASH:0:MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM
461461

462462
Handshake, select ECDHE-ECDSA-WITH-AES-256-CCM, opaque, PSA_ALG_SHA_256
463463
depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
464-
handshake_ciphersuite_select:"TLS-ECDHE-ECDSA-WITH-AES-256-CCM":MBEDTLS_PK_ECDSA:"":PSA_ALG_ECDSA(PSA_ALG_SHA_256):PSA_ALG_NONE:PSA_KEY_USAGE_SIGN_HASH:0:MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM
464+
handshake_ciphersuite_select:"TLS-ECDHE-ECDSA-WITH-AES-256-CCM":MBEDTLS_PK_ECDSA:"":MBEDTLS_PK_ALG_ECDSA(PSA_ALG_SHA_256):PSA_ALG_NONE:PSA_KEY_USAGE_SIGN_HASH:0:MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CCM
465465

466466
Handshake, select ECDHE-ECDSA-WITH-AES-256-CCM, opaque, bad alg
467467
depends_on:PSA_WANT_ALG_SHA_256:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_CCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH

0 commit comments

Comments
 (0)