The serialized ALPN length was passed to memcmp() against each configured protocol without checking it against the remaining serialized data, so a malformed context could read past the end of the buffer. Bound it before the comparison, like the adjacent CID fields.
Signed-off-by: Naveed <naveed@bugqore.com>
OAEP is for RSA encryption and therefore is not the correct check when
we want to test for signatures with PSS.
Additionally, we can use RSA PSS when we only have public key support
(not key pairs) so check for PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY (which is
auto-enabled when we have key pairs enabled anyway).
Signed-off-by: David Horstmann <david.horstmann@arm.com>
The intent on these lines was to get 'psa_key_type_t' for which
'mbedtls_pk_get_key_type' should clearly be used, not
'mbedtls_pk_get_type'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
MBEDTLS_ECP_DP_MAX is defined in 'ecp.h' which is a tf-psa-crypto private
header. Instead of relying on that value define a new function named
'mbedtls_ssl_get_supported_tls_id_count' which returns the number of
entries in 'tls_id_match_table'.
Rationale: it does not have too much sense to allocate an array for TLS
IDs which is larger than the list of supported TLS IDs in the current
build.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Its main functionality was to get a TLS ID from 'mbedtls_ecp_group_id' and
then call 'mbedtls_ssl_check_curve_tls_id'. The same can be achieved
with public PK functions and 'mbedtls_ssl_get_tls_id_from_curve_info',
then calling into 'mbedtls_ssl_check_curve_tls_id' as before.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Instead of retrieving the TLS ID using 'mbedtls_ecp_group_id', which
creates a dependency on the (now tf-psa-crypto private) 'ecp.h' header,
use PSA info to get the same result. Therefore rename the function as
'mbedtls_ssl_get_tls_id_from_curve_info'.
This new function has basically the opposite behavior than
'mbedtls_ssl_get_psa_curve_info_from_tls_id'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
All the usages of 'mbedtls_ssl_get_ecp_group_id_from_tls_id' basically
reduce to checking if a specific TLS ID is supported or not. Therefore
the function is replaced with 'mbedtls_ssl_is_tls_id_supported'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
RFC 8446 (TLS 1.3 specification), Section 5.1, states:
Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
...
-Handshake messages MUST NOT span key changes. Implementations
MUST verify that all messages immediately preceding a key change
align with a record boundary; if not, then they MUST terminate the
connection with an "unexpected_message" alert. Because the
ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
messages can immediately precede a key change, implementations
MUST send these messages in alignment with a record boundary.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Following fields were not properly reset when mbedtls_ssl_session_reset
was called:
- badmac_seen
- dtls_srtp_info
- alert_reason
- alert_type
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Add a check on mbedtls_pkcs7_data_or_hash_verify() so that the verification
fails if the MD alg specified in PKCS7 structure or the signature
algorithm specified in the X.509 certificate are not in the list of
secure algorithms (i.e. mbedtls_x509_crt_profile_default).
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Following functions
- x509_profile_check_md_alg
- x509_profile_check_pk_alg
are made non-static and moved to x509_internal.h so that other library
files can used them.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
ssl_preset_default_hashes was removed in
f0cda410a4bca0f45f66bdbf0714cd0eb2ea4718 but the comment in 'x509_crt.c'
wasn't updated.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
