fix various issues
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 489bfdc..4187dce 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -3298,7 +3298,7 @@
* terminated by \c MBEDTLS_MD_NONE.
*/
void MBEDTLS_DEPRECATED mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
- const int *hashes );
+ const int *hashes );
#endif /* MBEDTLS_DEPRECATED_REMOVED */
/**
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index b0335fe..7ef3ec1 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -1728,7 +1728,7 @@
* Write Signature Algorithm extension
*/
int mbedtls_ssl_write_sig_alg_ext( mbedtls_ssl_context *ssl, unsigned char *buf,
- const unsigned char *end, size_t *out_len);
+ const unsigned char *end, size_t *out_len );
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
@@ -1813,9 +1813,18 @@
MBEDTLS_ECDH_C || MBEDTLS_ECDSA_C ||
MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
/*
- * Return supported sig_algs.
+ * Return supported signature algorithms.
+ *
+ * In future, invocations can be changed to ssl->conf->sig_algs when
+ * mbedtls_ssl_conf_sig_hashes() is deleted.
+ *
+ * ssl->handshake->sig_algs is either a translation of sig_hases to IANA TLS group
+ * identifiers when mbedtls_ssl_conf_sig_hashes() has been used, or a pointer to
+ * ssl->conf->sig_algs when mbedtls_ssl_conf_sig_algs() has been more recently
+ * invoked.
*/
-static inline const void *mbedtls_ssl_get_sig_algs( const mbedtls_ssl_context *ssl )
+static inline const void *mbedtls_ssl_get_sig_algs(
+ const mbedtls_ssl_context *ssl )
{
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
@@ -1826,7 +1835,7 @@
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
((void) ssl);
- return NULL;
+ return( NULL );
}
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 97199e1..5ebbcad 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -2803,10 +2803,10 @@
for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ )
{
/* High byte is hash */
- unsigned char hash = ( *sig_alg >> 8 ) & 0xff;
- unsigned char sig = ( *sig_alg ) & 0xff;
+ unsigned char hash = MBEDTLS_BYTE_1( *sig_alg );
+ unsigned char sig = MBEDTLS_BYTE_0( *sig_alg );
- if( MBEDTLS_SSL_HASH_NONE == hash || mbedtls_ssl_set_calc_verify_md( ssl, hash ) )
+ if( mbedtls_ssl_set_calc_verify_md( ssl, hash ) )
continue;
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_ECDSA_C)
if( sig != MBEDTLS_SSL_SIG_RSA && sig != MBEDTLS_SSL_SIG_ECDSA )
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 91e84b5..a6d6dee 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -3152,8 +3152,9 @@
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
- /* Heap allocate and translate curve_list from internal to IANA group ids */
- if ( mbedtls_ssl_conf_is_tls12_enabled( ssl->conf ) &&
+ /* Heap allocate and translate sig_hashes from internal hash identifiers to
+ signature algorithms IANA identifiers. */
+ if ( mbedtls_ssl_conf_is_tls12_only( ssl->conf ) &&
ssl->conf->sig_hashes != NULL )
{
const int *md;
@@ -6467,30 +6468,18 @@
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
static int ssl_preset_suiteb_hashes[] = {
-#if defined(MBEDTLS_SHA384_C)
- MBEDTLS_MD_SHA384,
-#endif
#if defined(MBEDTLS_SHA256_C)
MBEDTLS_MD_SHA256,
#endif
+#if defined(MBEDTLS_SHA384_C)
+ MBEDTLS_MD_SHA384,
+#endif
MBEDTLS_MD_NONE
};
#endif /* !MBEDTLS_DEPRECATED_REMOVED */
static uint16_t ssl_preset_default_sig_algs[] = {
-#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
-#if defined(MBEDTLS_SHA512_C)
- MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA512 )
-#endif
-#if defined(MBEDTLS_SHA384_C)
- MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
-#endif
-#if defined(MBEDTLS_SHA256_C)
- MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
-#endif
-#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-
/* ECDSA algorithms */
#if defined(MBEDTLS_ECDSA_C)
#if defined(MBEDTLS_SHA256_C) && defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
@@ -6510,12 +6499,10 @@
#endif
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
-
- MBEDTLS_TLS1_3_SIG_NONE
-};
-
-static uint16_t ssl_preset_suiteb_sig_algs[] = {
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+#if defined(MBEDTLS_SHA512_C)
+ MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA512 )
+#endif
#if defined(MBEDTLS_SHA384_C)
MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
#endif
@@ -6523,7 +6510,10 @@
MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
#endif
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
+ MBEDTLS_TLS1_3_SIG_NONE
+};
+static uint16_t ssl_preset_suiteb_sig_algs[] = {
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
/* ECDSA algorithms */
#if defined(MBEDTLS_ECDSA_C)
@@ -6541,7 +6531,14 @@
#endif
MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256,
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
-
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+#if defined(MBEDTLS_SHA384_C)
+ MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA384 )
+#endif
+#if defined(MBEDTLS_SHA256_C)
+ MBEDTLS_SSL_SIG_ALG( MBEDTLS_SSL_HASH_SHA256 )
+#endif
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
MBEDTLS_TLS1_3_SIG_NONE
};
#endif
@@ -6965,7 +6962,7 @@
for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE; sig_alg++ )
{
mbedtls_md_type_t hash = mbedtls_ssl_md_alg_from_hash(
- ( *sig_alg >> 8 ) & 0xff );
+ MBEDTLS_BYTE_1( *sig_alg ) );
if( hash == md )
return( 0 );
}
