From 25829c8f38474259d03456d170937c19b74c576a Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 13:56:52 +0200 Subject: [PATCH] library: replace mbedtls_ssl_get_ecp_group_id_from_tls_id All the usages of 'mbedtls_ssl_get_ecp_group_id_from_tls_id' basically reduce to checking if a specific TLS ID is supported or not. Therefore the function is replaced with 'mbedtls_ssl_is_tls_id_supported'. Signed-off-by: Valerio Setti --- library/ssl_client.c | 6 ++---- library/ssl_misc.h | 12 +++++------- library/ssl_tls.c | 6 +++--- library/ssl_tls12_server.c | 23 +++++++++++++++++------ 4 files changed, 27 insertions(+), 20 deletions(-) diff --git a/library/ssl_client.c b/library/ssl_client.c index 354fe9b72b..976e95fa6a 100644 --- a/library/ssl_client.c +++ b/library/ssl_client.c @@ -255,8 +255,7 @@ static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl, if (flags & SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_3_FLAG) { #if defined(PSA_WANT_ALG_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list) && - mbedtls_ssl_get_psa_curve_info_from_tls_id( - *group_list, NULL, NULL) == PSA_SUCCESS) { + (mbedtls_ssl_is_tls_id_supported(*group_list))) { propose_group = 1; } #endif @@ -271,8 +270,7 @@ static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl, #if defined(MBEDTLS_SSL_TLS1_2_SOME_ECC) if ((flags & SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_2_FLAG) && mbedtls_ssl_tls12_named_group_is_ecdhe(*group_list) && - (mbedtls_ssl_get_ecp_group_id_from_tls_id(*group_list) != - MBEDTLS_ECP_DP_NONE)) { + (mbedtls_ssl_is_tls_id_supported(*group_list))) { propose_group = 1; } #endif /* MBEDTLS_SSL_TLS1_2_SOME_ECC */ diff --git a/library/ssl_misc.h b/library/ssl_misc.h index f0ca823f33..9b4af9f4f3 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1528,13 +1528,12 @@ int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, size_t *bits); /** - * \brief Return \c mbedtls_ecp_group_id for the specified TLS ID. + * \brief Tell if a TLS group ID is supported or not. * - * \param tls_id The TLS ID to look for - * \return Proper \c mbedtls_ecp_group_id if the TLS ID is supported, - * or MBEDTLS_ECP_DP_NONE otherwise + * \param tls_id The TLS ID to look for. + * \return 1 if specified TLS ID is supported, 0 otherwise. */ -mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id); +int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id); /** * \brief Return TLS ID for the specified \c mbedtls_ecp_group_id. @@ -2249,8 +2248,7 @@ static inline int mbedtls_ssl_named_group_is_supported(uint16_t named_group) { #if defined(PSA_WANT_ALG_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(named_group)) { - if (mbedtls_ssl_get_ecp_group_id_from_tls_id(named_group) != - MBEDTLS_ECP_DP_NONE) { + if (mbedtls_ssl_is_tls_id_supported(named_group)) { return 1; } } diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 0195576213..5a8bf2d8a6 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5865,15 +5865,15 @@ int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, return PSA_ERROR_NOT_SUPPORTED; } -mbedtls_ecp_group_id mbedtls_ssl_get_ecp_group_id_from_tls_id(uint16_t tls_id) +int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id) { for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) { if (tls_id_match_table[i].tls_id == tls_id) { - return tls_id_match_table[i].ecp_group_id; + return 1; } } - return MBEDTLS_ECP_DP_NONE; + return 0; } uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id) diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 2a825e07b1..28688fb94e 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -219,8 +219,7 @@ static int ssl_parse_supported_groups_ext(mbedtls_ssl_context *ssl, while (list_size > 0 && our_size > 1) { uint16_t curr_tls_id = MBEDTLS_GET_UINT16_BE(p, 0); - if (mbedtls_ssl_get_ecp_group_id_from_tls_id(curr_tls_id) != - MBEDTLS_ECP_DP_NONE) { + if (mbedtls_ssl_is_tls_id_supported(curr_tls_id)) { *curves_tls_id++ = curr_tls_id; our_size--; } @@ -630,12 +629,24 @@ static int ssl_check_key_curve(mbedtls_pk_context *pk, uint16_t *curves_tls_id) { uint16_t *curr_tls_id = curves_tls_id; - mbedtls_ecp_group_id grp_id = mbedtls_pk_get_ec_group_id(pk); - mbedtls_ecp_group_id curr_grp_id; + psa_key_type_t key_type = mbedtls_pk_get_type(pk); + size_t key_bits = mbedtls_pk_get_bitlen(pk); + psa_key_type_t curr_key_type; + size_t curr_key_bits; + psa_status_t status; while (*curr_tls_id != 0) { - curr_grp_id = mbedtls_ssl_get_ecp_group_id_from_tls_id(*curr_tls_id); - if (curr_grp_id == grp_id) { + status = mbedtls_ssl_get_psa_curve_info_from_tls_id(*curr_tls_id, + &curr_key_type, &curr_key_bits); + if (status != PSA_SUCCESS) { + /* This TLS group ID is not supported. Move to the next one. */ + curr_tls_id++; + continue; + } + /* Check if EC family type and key bits for the current TLS group ID are the + * same as the ones in the provided PK context. */ + if ((PSA_KEY_TYPE_ECC_GET_FAMILY(key_type) == PSA_KEY_TYPE_ECC_GET_FAMILY(curr_key_type)) && + (key_bits == curr_key_bits)) { return 0; } curr_tls_id++;