coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-13 14:22:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

library: ssl: remove mbedtls_ssl_check_curve

Browse Source 
Its main functionality was to get a TLS ID from 'mbedtls_ecp_group_id' and
then call 'mbedtls_ssl_check_curve_tls_id'. The same can be achieved
with public PK functions and 'mbedtls_ssl_get_tls_id_from_curve_info',
then calling into 'mbedtls_ssl_check_curve_tls_id' as before.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This commit is contained in:
Valerio Setti 2026-07-07 14:18:02 +02:00
parent 8a23cf2f14
commit f9dbbec325
2 changed files with 6 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
library/ssl_misc.h
View File

@ -1502,10 +1502,6 @@ int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md);
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id); int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id);
#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
MBEDTLS_CHECK_RETURN_CRITICAL
int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id);
#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
/** /**
* \brief Return PSA EC info for the specified TLS ID. * \brief Return PSA EC info for the specified TLS ID.

23
library/ssl_tls.c
View File

@ -5793,22 +5793,6 @@ int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_
return -1; return -1;
} }
#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
/*
* Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
*/
int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id)
{
uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id);
if (tls_id == 0) {
return -1;
}
return mbedtls_ssl_check_curve_tls_id(ssl, tls_id);
}
#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
static const struct { static const struct {
uint16_t tls_id; uint16_t tls_id;
mbedtls_ecp_group_id ecp_group_id; mbedtls_ecp_group_id ecp_group_id;
@ -8828,7 +8812,12 @@ int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl,
defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 && if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
PSA_KEY_TYPE_IS_ECC(mbedtls_pk_get_type(&chain->pk))) { PSA_KEY_TYPE_IS_ECC(mbedtls_pk_get_type(&chain->pk))) {
if (mbedtls_ssl_check_curve(ssl, mbedtls_pk_get_ec_group_id(&chain->pk)) != 0) { psa_key_type_t key_type = mbedtls_pk_get_type(&chain->pk);
psa_ecc_family_t ec_family = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type);
size_t bits = mbedtls_pk_get_bitlen(&chain->pk);
int tls_id = mbedtls_ssl_get_tls_id_from_curve_info(ec_family, bits);
if (mbedtls_ssl_check_curve_tls_id(ssl, tls_id) != 0) {
MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (EC key curve)")); MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (EC key curve)"));
ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY; ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
if (ret == 0) { if (ret == 0) {