It allows weak hash algorithms to be used in PKCS7. It's only added in the
LTS branch for backward compatibility, but it's disabled by default because
that's the safest choice.
This commit also updates test data in order to test the new build symbol.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Newly added tests for RIPEMD160 and MD5 still require SHA-256 for the
certificate being used. SHA-1 is instead useless in this case.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Some newly added tests had duplicate numbers with what was already there.
This commit fixes the duplication problem.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Add a check on mbedtls_pkcs7_data_or_hash_verify() so that the verification
fails if the MD alg specified in PKCS7 structure or the signature
algorithm specified in the X.509 certificate are not in the list of
secure algorithms (i.e. mbedtls_x509_crt_profile_default).
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Following functions
- x509_profile_check_md_alg
- x509_profile_check_pk_alg
are made non-static and moved to x509_internal.h so that other library
files can used them.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
ssl_preset_default_hashes was removed in
f0cda410a4bca0f45f66bdbf0714cd0eb2ea4718 but the comment in 'x509_crt.c'
wasn't updated.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
(cherry picked from commit 377aa4eff16cd0aa5e7440a41de59847e3a789a0)
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit 10afc1ed5c8e9c47caf1ad8ee6241fd99e43f945)
Backport note: resolved the redundant-test removal conflict by deleting the temporary reset test while keeping the 3.6 pkcs7_verify dependency expression.
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
(cherry picked from commit a798b5804ef8571bcfd6609019758014325162c4)
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit 84966c1bda07dd01e38786b2caa9b7453a5adb95)
Backport note: resolved PKCS7 test conflicts by retaining the 3.6 dependency names (MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C) for the added regression cases.
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit 67e696b430716f95ed714f2c1404681697251438)
Backport note: resolved the PKCS7 test-suite conflict by keeping the 3.6 pkcs7_verify dependency expression while adding the reuse regression test.
Let the caller handle returning on error. This is less surprising, and it's
more flexible in case the caller needs to perform some cleanup (which is
currently not the case).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
