From 2e6c0e03a87f23f90d2186fdd08225ed6ac4768b Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 7 Jul 2026 14:06:31 +0200 Subject: [PATCH] library: replace mbedtls_ssl_get_tls_id_from_ecp_group_id Instead of retrieving the TLS ID using 'mbedtls_ecp_group_id', which creates a dependency on the (now tf-psa-crypto private) 'ecp.h' header, use PSA info to get the same result. Therefore rename the function as 'mbedtls_ssl_get_tls_id_from_curve_info'. This new function has basically the opposite behavior than 'mbedtls_ssl_get_psa_curve_info_from_tls_id'. Signed-off-by: Valerio Setti --- library/ssl_misc.h | 9 +++++---- library/ssl_tls.c | 8 ++++---- library/ssl_tls12_client.c | 3 +-- library/ssl_tls12_server.c | 3 +-- 4 files changed, 11 insertions(+), 12 deletions(-) diff --git a/library/ssl_misc.h b/library/ssl_misc.h index 9b4af9f4f3..b91b789b7c 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -1536,13 +1536,14 @@ int mbedtls_ssl_get_psa_curve_info_from_tls_id(uint16_t tls_id, int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id); /** - * \brief Return TLS ID for the specified \c mbedtls_ecp_group_id. + * \brief Return TLS ID for the specified curve. * - * \param grp_id The \c mbedtls_ecp_group_id ID to look for - * \return Proper TLS ID if the \c mbedtls_ecp_group_id is supported, + * \param family The \c psa_ecc_family_t for the TLS ID to look for. + * \param bits The bit size for the TLS ID to look for. + * \return Proper TLS ID if the specified EC group is supported, * or 0 otherwise */ -uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id); +uint16_t mbedtls_ssl_get_tls_id_from_curve_info(psa_ecc_family_t family, size_t bits); #if defined(MBEDTLS_DEBUG_C) /** diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 5a8bf2d8a6..6650daf625 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -5876,11 +5876,11 @@ int mbedtls_ssl_is_tls_id_supported(uint16_t tls_id) return 0; } -uint16_t mbedtls_ssl_get_tls_id_from_ecp_group_id(mbedtls_ecp_group_id grp_id) +uint16_t mbedtls_ssl_get_tls_id_from_curve_info(psa_ecc_family_t family, size_t bits) { - for (int i = 0; tls_id_match_table[i].ecp_group_id != MBEDTLS_ECP_DP_NONE; - i++) { - if (tls_id_match_table[i].ecp_group_id == grp_id) { + for (int i = 0; tls_id_match_table[i].tls_id != 0; i++) { + if ((tls_id_match_table[i].psa_family == family) && + (tls_id_match_table[i].bits == bits)) { return tls_id_match_table[i].tls_id; } } diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 8799287a09..c8149087d0 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1934,8 +1934,7 @@ start_processing: MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 3); uint16_t read_tls_id = MBEDTLS_GET_UINT16_BE(p, 1); - uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id( - MBEDTLS_ECP_DP_SECP256R1); + uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_curve_info(PSA_ECC_FAMILY_SECP_R1, 256); if (exp_tls_id == 0) { return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 28688fb94e..6de21b1429 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -2497,8 +2497,7 @@ static int ssl_prepare_server_key_exchange(mbedtls_ssl_context *ssl, * However since we only support secp256r1 for now, we hardcode its * TLS ID here */ - uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id( - MBEDTLS_ECP_DP_SECP256R1); + uint16_t tls_id = mbedtls_ssl_get_tls_id_from_curve_info(PSA_ECC_FAMILY_SECP_R1, 256); if (tls_id == 0) { return MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE; }