coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Move sig_algs parsing to ssl_test_lib.c and add TLS 1.2 hex pairs

Browse Source 
Unify the duplicated sig_algs option parsing from ssl_client2.c and
ssl_server2.c into parse_sig_algs() in ssl_test_lib.c, next to
parse_groups(). Move mbedtls_print_supported_sig_algs() there as well
(it only exists for the parse-error path) and drop its static copy
from ssl_test_common_source.c.

In addition to TLS 1.3 signature scheme names, parse_sig_algs() now
accepts a TLS 1.2 SignatureAndHashAlgorithm pair as 4 hex digits
(e.g. "0401" for SHA-256 with RSA). Documented in USAGE_SIG_ALGS.

Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
This commit is contained in:
v1rtu3x 2026-10-06 12:45:48 +03:00
parent 77eacf4c93
commit d0af7c1f3b
5 changed files with 157 additions and 143 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
programs/ssl/ssl_client2.c
View File

@ -258,7 +258,8 @@ int main(void)
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
#define USAGE_SIG_ALGS \
" sig_algs=a,b,c,d default: \"default\" (library default)\n" \
" example: \"ecdsa_secp256r1_sha256,ecdsa_secp384r1_sha384\"\n"
" example: \"ecdsa_secp256r1_sha256,ecdsa_secp384r1_sha384\"\n" \
" or a TLS 1.2 (hash,sig) pair as 4 hex digits (e.g. \"0401\")\n"
#else
#define USAGE_SIG_ALGS ""
#endif
@ -1561,73 +1562,18 @@ usage:
}
}
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
if (opt.sig_algs != NULL) {
p = (char *) opt.sig_algs;
i = 0;
/* Leave room for a final MBEDTLS_TLS1_3_SIG_NONE in signature algorithm list (sig_alg_list). */
while (i < SIG_ALG_LIST_SIZE - 1 && *p != '\0') {
q = p;
/* Terminate the current string */
while (*p != ',' && *p != '\0') {
p++;
}
if (*p == ',') {
*p++ = '\0';
}
if (strcmp(q, "rsa_pkcs1_sha256") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256;
} else if (strcmp(q, "rsa_pkcs1_sha384") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384;
} else if (strcmp(q, "rsa_pkcs1_sha512") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512;
} else if (strcmp(q, "ecdsa_secp256r1_sha256") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256;
} else if (strcmp(q, "ecdsa_secp384r1_sha384") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384;
} else if (strcmp(q, "ecdsa_secp521r1_sha512") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512;
} else if (strcmp(q, "rsa_pss_rsae_sha256") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256;
} else if (strcmp(q, "rsa_pss_rsae_sha384") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384;
} else if (strcmp(q, "rsa_pss_rsae_sha512") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512;
} else if (strcmp(q, "ed25519") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED25519;
} else if (strcmp(q, "ed448") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED448;
} else if (strcmp(q, "rsa_pss_pss_sha256") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256;
} else if (strcmp(q, "rsa_pss_pss_sha384") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384;
} else if (strcmp(q, "rsa_pss_pss_sha512") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512;
} else if (strcmp(q, "rsa_pkcs1_sha1") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1;
} else if (strcmp(q, "ecdsa_sha1") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SHA1;
} else {
ret = -1;
mbedtls_printf("unknown signature algorithm \"%s\"\n", q);
mbedtls_print_supported_sig_algs();
goto exit;
}
}
if (i == (SIG_ALG_LIST_SIZE - 1) && *p != '\0') {
mbedtls_printf("signature algorithm list too long, maximum %d",
SIG_ALG_LIST_SIZE - 1);
ret = parse_sig_algs(opt.sig_algs, sig_alg_list, SIG_ALG_LIST_SIZE);
if (ret != 0) {
goto exit;
}
sig_alg_list[i] = MBEDTLS_TLS1_3_SIG_NONE;
}
#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
#if defined(MBEDTLS_SSL_ALPN)
if (opt.alpn_string != NULL) {
p = (char *) opt.alpn_string;

68
programs/ssl/ssl_server2.c
View File

@ -446,7 +446,8 @@ int main(void)
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
#define USAGE_SIG_ALGS \
" sig_algs=a,b,c,d default: \"default\" (library default)\n" \
" example: \"ecdsa_secp256r1_sha256,ecdsa_secp384r1_sha384\"\n"
" example: \"ecdsa_secp256r1_sha256,ecdsa_secp384r1_sha384\"\n" \
" or a TLS 1.2 (hash,sig) pair as 4 hex digits (e.g. \"0401\")\n"
#else
#define USAGE_SIG_ALGS ""
#endif
@ -2435,71 +2436,16 @@ usage:
}
}
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
if (opt.sig_algs != NULL) {
p = (char *) opt.sig_algs;
i = 0;
/* Leave room for a final MBEDTLS_TLS1_3_SIG_NONE in signature algorithm list (sig_alg_list). */
while (i < SIG_ALG_LIST_SIZE - 1 && *p != '\0') {
q = p;
/* Terminate the current string */
while (*p != ',' && *p != '\0') {
p++;
}
if (*p == ',') {
*p++ = '\0';
}
if (strcmp(q, "rsa_pkcs1_sha256") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256;
} else if (strcmp(q, "rsa_pkcs1_sha384") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384;
} else if (strcmp(q, "rsa_pkcs1_sha512") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512;
} else if (strcmp(q, "ecdsa_secp256r1_sha256") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256;
} else if (strcmp(q, "ecdsa_secp384r1_sha384") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384;
} else if (strcmp(q, "ecdsa_secp521r1_sha512") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512;
} else if (strcmp(q, "rsa_pss_rsae_sha256") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256;
} else if (strcmp(q, "rsa_pss_rsae_sha384") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384;
} else if (strcmp(q, "rsa_pss_rsae_sha512") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512;
} else if (strcmp(q, "ed25519") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED25519;
} else if (strcmp(q, "ed448") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED448;
} else if (strcmp(q, "rsa_pss_pss_sha256") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256;
} else if (strcmp(q, "rsa_pss_pss_sha384") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384;
} else if (strcmp(q, "rsa_pss_pss_sha512") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512;
} else if (strcmp(q, "rsa_pkcs1_sha1") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1;
} else if (strcmp(q, "ecdsa_sha1") == 0) {
sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SHA1;
} else {
ret = -1;
mbedtls_printf("unknown signature algorithm \"%s\"\n", q);
mbedtls_print_supported_sig_algs();
goto exit;
}
}
if (i == (SIG_ALG_LIST_SIZE - 1) && *p != '\0') {
mbedtls_printf("signature algorithm list too long, maximum %d",
SIG_ALG_LIST_SIZE - 1);
ret = parse_sig_algs(opt.sig_algs, sig_alg_list, SIG_ALG_LIST_SIZE);
if (ret != 0) {
goto exit;
}
sig_alg_list[i] = MBEDTLS_TLS1_3_SIG_NONE;
}
#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
#endif
#if defined(MBEDTLS_SSL_ALPN)

21
programs/ssl/ssl_test_common_source.c
View File

@ -351,25 +351,4 @@ static int x509_crt_verify_info(char *buf, size_t size, const char *prefix,
#endif /* MBEDTLS_X509_REMOVE_INFO */
}
static void mbedtls_print_supported_sig_algs(void)
{
mbedtls_printf("supported signature algorithms:\n");
mbedtls_printf("\trsa_pkcs1_sha256 ");
mbedtls_printf("rsa_pkcs1_sha384 ");
mbedtls_printf("rsa_pkcs1_sha512\n");
mbedtls_printf("\tecdsa_secp256r1_sha256 ");
mbedtls_printf("ecdsa_secp384r1_sha384 ");
mbedtls_printf("ecdsa_secp521r1_sha512\n");
mbedtls_printf("\trsa_pss_rsae_sha256 ");
mbedtls_printf("rsa_pss_rsae_sha384 ");
mbedtls_printf("rsa_pss_rsae_sha512\n");
mbedtls_printf("\trsa_pss_pss_sha256 ");
mbedtls_printf("rsa_pss_pss_sha384 ");
mbedtls_printf("rsa_pss_pss_sha512\n");
mbedtls_printf("\ted25519 ");
mbedtls_printf("ed448 ");
mbedtls_printf("rsa_pkcs1_sha1 ");
mbedtls_printf("ecdsa_sha1\n");
mbedtls_printf("\n");
}
#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */

123
programs/ssl/ssl_test_lib.c
View File

@ -495,4 +495,127 @@ int parse_groups(const char *groups, uint16_t *group_list, size_t group_list_len
return 0;
}
void mbedtls_print_supported_sig_algs(void)
{
mbedtls_printf("supported signature algorithms:\n");
mbedtls_printf("\trsa_pkcs1_sha256 ");
mbedtls_printf("rsa_pkcs1_sha384 ");
mbedtls_printf("rsa_pkcs1_sha512\n");
mbedtls_printf("\tecdsa_secp256r1_sha256 ");
mbedtls_printf("ecdsa_secp384r1_sha384 ");
mbedtls_printf("ecdsa_secp521r1_sha512\n");
mbedtls_printf("\trsa_pss_rsae_sha256 ");
mbedtls_printf("rsa_pss_rsae_sha384 ");
mbedtls_printf("rsa_pss_rsae_sha512\n");
mbedtls_printf("\trsa_pss_pss_sha256 ");
mbedtls_printf("rsa_pss_pss_sha384 ");
mbedtls_printf("rsa_pss_pss_sha512\n");
mbedtls_printf("\ted25519 ");
mbedtls_printf("ed448 ");
mbedtls_printf("rsa_pkcs1_sha1 ");
mbedtls_printf("ecdsa_sha1\n");
mbedtls_printf("\n");
}
static int sig_alg_hex_digit(char c)
{
if (c >= '0' && c <= '9') {
return c - '0';
}
if (c >= 'a' && c <= 'f') {
return c - 'a' + 10;
}
if (c >= 'A' && c <= 'F') {
return c - 'A' + 10;
}
return -1;
}
int parse_sig_algs(const char *sig_algs, uint16_t *sig_alg_list,
size_t sig_alg_list_len)
{
typedef struct {
const char *name;
uint16_t id;
} sig_alg_name_t;
static const sig_alg_name_t sig_alg_names[] = {
{ "rsa_pkcs1_sha256", MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256 },
{ "rsa_pkcs1_sha384", MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384 },
{ "rsa_pkcs1_sha512", MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512 },
{ "ecdsa_secp256r1_sha256", MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256 },
{ "ecdsa_secp384r1_sha384", MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384 },
{ "ecdsa_secp521r1_sha512", MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512 },
{ "rsa_pss_rsae_sha256", MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256 },
{ "rsa_pss_rsae_sha384", MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384 },
{ "rsa_pss_rsae_sha512", MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512 },
{ "ed25519", MBEDTLS_TLS1_3_SIG_ED25519 },
{ "ed448", MBEDTLS_TLS1_3_SIG_ED448 },
{ "rsa_pss_pss_sha256", MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256 },
{ "rsa_pss_pss_sha384", MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384 },
{ "rsa_pss_pss_sha512", MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512 },
{ "rsa_pkcs1_sha1", MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1 },
{ "ecdsa_sha1", MBEDTLS_TLS1_3_SIG_ECDSA_SHA1 },
};
const char *p = sig_algs;
size_t i = 0;
/* Leave room for a final MBEDTLS_TLS1_3_SIG_NONE in sig_alg_list. */
while (i < sig_alg_list_len - 1 && *p != '\0') {
size_t name_len = strcspn(p, ",");
uint16_t sig_alg = 0;
size_t j;
int found = 0;
if (name_len == 4) {
/* A TLS 1.2 (hash, signature) pair given as 4 hex digits. */
int d0 = sig_alg_hex_digit(p[0]);
int d1 = sig_alg_hex_digit(p[1]);
int d2 = sig_alg_hex_digit(p[2]);
int d3 = sig_alg_hex_digit(p[3]);
if (d0 >= 0 && d1 >= 0 && d2 >= 0 && d3 >= 0) {
sig_alg = (uint16_t) ((d0 << 12) | (d1 << 8) |
(d2 << 4) | d3);
found = 1;
}
}
if (!found) {
for (j = 0; j < ARRAY_LENGTH(sig_alg_names); j++) {
if (strlen(sig_alg_names[j].name) == name_len &&
strncmp(p, sig_alg_names[j].name, name_len) == 0) {
sig_alg = sig_alg_names[j].id;
found = 1;
break;
}
}
}
if (!found) {
mbedtls_printf("unknown signature algorithm \"%.*s\"\n",
(int) name_len, p);
mbedtls_print_supported_sig_algs();
return -1;
}
sig_alg_list[i++] = sig_alg;
p += name_len;
if (*p == ',') {
p++;
}
}
if (i == sig_alg_list_len - 1 && *p != '\0') {
mbedtls_printf("signature algorithm list too long, maximum %u",
(unsigned int) (sig_alg_list_len - 1));
return -1;
}
sig_alg_list[i] = MBEDTLS_TLS1_3_SIG_NONE;
return 0;
}
#endif /* !defined(MBEDTLS_SSL_TEST_IMPOSSIBLE) */

20
programs/ssl/ssl_test_lib.h
View File

@ -268,5 +268,25 @@ void test_hooks_free(void);
/* Helper functions for FFDH groups. */
int parse_groups(const char *groups, uint16_t *group_list, size_t group_list_len);
/** Parse command-line option: sig_algs
*
* \param sig_algs Comma-separated list of signature algorithms.
* Each element is either a TLS 1.3 signature
* algorithm name (e.g. "rsa_pkcs1_sha256"), or a
* TLS 1.2 (hash, signature) pair given as 4 hex
* digits (e.g. "0401" for SHA-256 with RSA).
* \param sig_alg_list Array to fill with the parsed list.
* \param sig_alg_list_len Length of \p sig_alg_list. Room is left for a
* terminating MBEDTLS_TLS1_3_SIG_NONE.
*
* \return \c 0 on success.
* \return \c -1 on parse error.
*/
int parse_sig_algs(const char *sig_algs, uint16_t *sig_alg_list,
size_t sig_alg_list_len);
void mbedtls_print_supported_sig_algs(void);
#endif /* MBEDTLS_SSL_TEST_IMPOSSIBLE conditions: else */
#endif /* MBEDTLS_PROGRAMS_SSL_SSL_TEST_LIB_H */