feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

change type to short for comparision and up default min size

Browse Source
This commit is contained in:
Jacob Barthelmeh
2016-04-20 15:44:45 -06:00
parent 3129bb22cd
commit 1dac3841ca
6 changed files with 25 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
examples/server/server.c
View File

@@ -278,7 +278,7 @@ THREAD_RETURN CYASSL_THREAD server_test(void* args)
int throughput = 0; int throughput = 0;
int minDhKeyBits = DEFAULT_MIN_DHKEY_BITS; int minDhKeyBits = DEFAULT_MIN_DHKEY_BITS;
int minRsaKeyBits = DEFAULT_MIN_RSAKEY_BITS; int minRsaKeyBits = DEFAULT_MIN_RSAKEY_BITS;
int minEccKeyBits = DEFAULT_MIN_ECCKEY_BITS; short minEccKeyBits = DEFAULT_MIN_ECCKEY_BITS;
int doListen = 1; int doListen = 1;
int crlFlags = 0; int crlFlags = 0;
int ret; int ret;
@@ -652,7 +652,7 @@ THREAD_RETURN CYASSL_THREAD server_test(void* args)
} }
#endif #endif
#ifdef HAVE_ECC #ifdef HAVE_ECC
if (wolfSSL_CTX_SetMinEccKey_Sz(ctx, (word16)minEccKeyBits) != SSL_SUCCESS){ if (wolfSSL_CTX_SetMinEccKey_Sz(ctx, minEccKeyBits) != SSL_SUCCESS){
err_sys("Error setting minimum ECC key size"); err_sys("Error setting minimum ECC key size");
} }
#endif #endif

5
src/internal.c
View File

@@ -5153,8 +5153,9 @@ static int DoCertificate(WOLFSSL* ssl, byte* input, word32* inOutIdx,
#endif /* !NO_RSA */ #endif /* !NO_RSA */
#ifdef HAVE_ECC #ifdef HAVE_ECC
case ECDSAk: case ECDSAk:
if (dCert->pubKeySize < ssl->options.minEccKeySz) { if (ssl->options.minEccKeySz < 0 ||
WOLFSSL_MSG("ECC key in cert chain was too small"); dCert->pubKeySize < (word16)ssl->options.minEccKeySz) {
WOLFSSL_MSG("ECC key size in cert chain error");
ret = ECC_KEY_SIZE_E; ret = ECC_KEY_SIZE_E;
} }
break; break;

23
src/ssl.c
View File

@@ -484,9 +484,9 @@ int wolfSSL_GetObjectSize(void)
#endif #endif
#ifdef HAVE_ECC #ifdef HAVE_ECC
int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX* ctx, word16 keySz) int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX* ctx, short keySz)
{ {
if (ctx == NULL || keySz % 8 != 0) { if (ctx == NULL || keySz < 0 || keySz % 8 != 0) {
WOLFSSL_MSG("Key size must be divisable by 8 or ctx was null"); WOLFSSL_MSG("Key size must be divisable by 8 or ctx was null");
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
} }
@@ -497,9 +497,9 @@ int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX* ctx, word16 keySz)
} }
int wolfSSL_SetMinEccKey_Sz(WOLFSSL* ssl, word16 keySz) int wolfSSL_SetMinEccKey_Sz(WOLFSSL* ssl, short keySz)
{ {
if (ssl == NULL || keySz % 8 != 0) { if (ssl == NULL || keySz < 0 || keySz % 8 != 0) {
WOLFSSL_MSG("Key size must be divisable by 8 or ssl was null"); WOLFSSL_MSG("Key size must be divisable by 8 or ssl was null");
return BAD_FUNC_ARG; return BAD_FUNC_ARG;
} }
@@ -2633,9 +2633,10 @@ int AddCA(WOLFSSL_CERT_MANAGER* cm, DerBuffer** pDer, int type, int verify)
#endif /* !NO_RSA */ #endif /* !NO_RSA */
#ifdef HAVE_ECC #ifdef HAVE_ECC
case ECDSAk: case ECDSAk:
if (cert->pubKeySize < cm->minEccKeySz) { if (cm->minEccKeySz < 0 ||
cert->pubKeySize < (word16)cm->minEccKeySz) {
ret = ECC_KEY_SIZE_E; ret = ECC_KEY_SIZE_E;
WOLFSSL_MSG(" CA ECC key is too small"); WOLFSSL_MSG(" CA ECC key size error");
} }
break; break;
#endif /* HAVE_ECC */ #endif /* HAVE_ECC */
@@ -3670,15 +3671,17 @@ static int ProcessBuffer(WOLFSSL_CTX* ctx, const unsigned char* buff,
#ifdef HAVE_ECC #ifdef HAVE_ECC
case ECDSAk: case ECDSAk:
if (ssl && !ssl->options.verifyNone) { if (ssl && !ssl->options.verifyNone) {
if (cert->pubKeySize < ssl->options.minEccKeySz) { if (ssl->options.minEccKeySz < 0 ||
cert->pubKeySize < (word16)ssl->options.minEccKeySz) {
ret = ECC_KEY_SIZE_E; ret = ECC_KEY_SIZE_E;
WOLFSSL_MSG("Certificate ECC key size too small"); WOLFSSL_MSG("Certificate ECC key size error");
} }
} }
else if (ctx && !ctx->verifyNone) { else if (ctx && !ctx->verifyNone) {
if (cert->pubKeySize < ctx->minEccKeySz) { if (ctx->minEccKeySz < 0 ||
cert->pubKeySize < (word16)ctx->minEccKeySz) {
ret = ECC_KEY_SIZE_E; ret = ECC_KEY_SIZE_E;
WOLFSSL_MSG("Certificate ECC key size too small"); WOLFSSL_MSG("Certificate ECC key size error");
} }
} }
break; break;

8
wolfssl/internal.h
View File

@@ -1068,7 +1068,7 @@ enum Misc {
#ifdef WOLFSSL_MAX_STRENGTH #ifdef WOLFSSL_MAX_STRENGTH
#define WOLFSSL_MIN_ECC_BITS 256 #define WOLFSSL_MIN_ECC_BITS 256
#else #else
#define WOLFSSL_MIN_ECC_BITS 160 #define WOLFSSL_MIN_ECC_BITS 224
#endif #endif
#endif /* WOLFSSL_MIN_ECC_BITS */ #endif /* WOLFSSL_MIN_ECC_BITS */
#if (WOLFSSL_MIN_ECC_BITS % 8) #if (WOLFSSL_MIN_ECC_BITS % 8)
@@ -1519,7 +1519,7 @@ struct WOLFSSL_CERT_MANAGER {
word16 minRsaKeySz; /* minimum allowed RSA key size */ word16 minRsaKeySz; /* minimum allowed RSA key size */
#endif #endif
#ifdef HAVE_ECC #ifdef HAVE_ECC
word16 minEccKeySz; /* minimum allowed ECC key size */ short minEccKeySz; /* minimum allowed ECC key size */
#endif #endif
}; };
@@ -1921,7 +1921,7 @@ struct WOLFSSL_CTX {
word16 minRsaKeySz; /* minimum RSA key size */ word16 minRsaKeySz; /* minimum RSA key size */
#endif #endif
#ifdef HAVE_ECC #ifdef HAVE_ECC
word16 minEccKeySz; /* minimum ECC key size */ short minEccKeySz; /* minimum ECC key size */
#endif #endif
CallbackIORecv CBIORecv; CallbackIORecv CBIORecv;
CallbackIOSend CBIOSend; CallbackIOSend CBIOSend;
@@ -2391,7 +2391,7 @@ typedef struct Options {
word16 minRsaKeySz; /* minimum RSA key size */ word16 minRsaKeySz; /* minimum RSA key size */
#endif #endif
#ifdef HAVE_ECC #ifdef HAVE_ECC
word16 minEccKeySz; /* minimum ECC key size */ short minEccKeySz; /* minimum ECC key size */
#endif #endif
} Options; } Options;

4
wolfssl/ssl.h
View File

@@ -944,8 +944,8 @@ WOLFSSL_API int wolfSSL_SetMinRsaKey_Sz(WOLFSSL*, unsigned short);
#endif /* NO_RSA */ #endif /* NO_RSA */
#ifdef HAVE_ECC #ifdef HAVE_ECC
WOLFSSL_API int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX*, unsigned short); WOLFSSL_API int wolfSSL_CTX_SetMinEccKey_Sz(WOLFSSL_CTX*, short);
WOLFSSL_API int wolfSSL_SetMinEccKey_Sz(WOLFSSL*, unsigned short); WOLFSSL_API int wolfSSL_SetMinEccKey_Sz(WOLFSSL*, short);
#endif /* NO_RSA */ #endif /* NO_RSA */
WOLFSSL_API int wolfSSL_SetTmpEC_DHE_Sz(WOLFSSL*, unsigned short); WOLFSSL_API int wolfSSL_SetTmpEC_DHE_Sz(WOLFSSL*, unsigned short);

2
wolfssl/test.h
View File

@@ -239,7 +239,7 @@
#if !defined(NO_FILESYSTEM) && defined(WOLFSSL_MAX_STRENGTH) #if !defined(NO_FILESYSTEM) && defined(WOLFSSL_MAX_STRENGTH)
#define DEFAULT_MIN_ECCKEY_BITS 256 #define DEFAULT_MIN_ECCKEY_BITS 256
#else #else
#define DEFAULT_MIN_ECCKEY_BITS 112 /* secp112r1 smallest in wolfSSL */ #define DEFAULT_MIN_ECCKEY_BITS 224
#endif #endif
/* all certs relative to wolfSSL home directory now */ /* all certs relative to wolfSSL home directory now */