Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-08-14 15:17:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

library: ssl: remove mbedtls_ssl_check_curve

Browse Source 
Its main functionality was to get a TLS ID from 'mbedtls_ecp_group_id' and
then call 'mbedtls_ssl_check_curve_tls_id'. The same can be achieved
with public PK functions and 'mbedtls_ssl_get_tls_id_from_curve_info',
then calling into 'mbedtls_ssl_check_curve_tls_id' as before.

Signed-off-by: Valerio Setti <[email protected]>
This commit is contained in:
Valerio Setti
2026-07-30 10:52:36 +02:00
parent 2e6c0e03a8
commit 512e6bbc69
2 changed files with 6 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/ssl_misc.h
-4
View File
@@ -1502,10 +1502,6 @@ int mbedtls_ssl_set_calc_verify_md(mbedtls_ssl_context *ssl, int md);
MBEDTLS_CHECK_RETURN_CRITICAL
int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_id);
#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
MBEDTLS_CHECK_RETURN_CRITICAL
int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id);
#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
/**
* \brief Return PSA EC info for the specified TLS ID.
library/ssl_tls.c
+6 -17
View File
@@ -5793,22 +5793,6 @@ int mbedtls_ssl_check_curve_tls_id(const mbedtls_ssl_context *ssl, uint16_t tls_
return -1;
}
#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
/*
* Same as mbedtls_ssl_check_curve_tls_id() but with a mbedtls_ecp_group_id.
*/
int mbedtls_ssl_check_curve(const mbedtls_ssl_context *ssl, mbedtls_ecp_group_id grp_id)
{
uint16_t tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(grp_id);
if (tls_id == 0) {
return -1;
}
return mbedtls_ssl_check_curve_tls_id(ssl, tls_id);
}
#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
static const struct {
uint16_t tls_id;
mbedtls_ecp_group_id ecp_group_id;
@@ -8828,7 +8812,12 @@ int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl,
defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
if (ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2 &&
PSA_KEY_TYPE_IS_ECC(mbedtls_pk_get_type(&chain->pk))) {
if (mbedtls_ssl_check_curve(ssl, mbedtls_pk_get_ec_group_id(&chain->pk)) != 0) {
psa_key_type_t key_type = mbedtls_pk_get_type(&chain->pk);
psa_ecc_family_t ec_family = PSA_KEY_TYPE_ECC_GET_FAMILY(key_type);
size_t bits = mbedtls_pk_get_bitlen(&chain->pk);
int tls_id = mbedtls_ssl_get_tls_id_from_curve_info(ec_family, bits);
if (mbedtls_ssl_check_curve_tls_id(ssl, tls_id) != 0) {
MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate (EC key curve)"));
ssl->session_negotiate->verify_result |= MBEDTLS_X509_BADCERT_BAD_KEY;
if (ret == 0) {