wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2025-07-30 02:37:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

Peer review fixes. Fix issues with Tls13HKDFExpandKeyLabel. Fix crypto callback line lengths.

Browse Source
This commit is contained in:
David Garske
2023-12-22 14:16:59 -08:00
parent 0d212d8055
commit d9ac8b5422
2 changed files with 32 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
src/tls13.c
View File

@ -241,7 +241,6 @@ static int Tls13HKDFExpandLabel(WOLFSSL* ssl, byte* okm, word32 okmLen,
return ret; return ret;
} }
#if !defined(HAVE_FIPS) || !defined(wc_Tls13_HKDF_Expand_Label)
/* Same as above, but pass in the side we are expanding for. /* Same as above, but pass in the side we are expanding for.
* *
* side The side (WOLFSSL_CLIENT_END or WOLFSSL_SERVER_END). * side The side (WOLFSSL_CLIENT_END or WOLFSSL_SERVER_END).
@ -253,8 +252,9 @@ static int Tls13HKDFExpandKeyLabel(WOLFSSL* ssl, byte* okm, word32 okmLen,
const byte* info, word32 infoLen, const byte* info, word32 infoLen,
int digest, int side) int digest, int side)
{ {
int ret;
#if defined(HAVE_PK_CALLBACKS) #if defined(HAVE_PK_CALLBACKS)
int ret = NOT_COMPILED_IN; ret = NOT_COMPILED_IN;
if (ssl->ctx && ssl->ctx->HKDFExpandLabelCb) { if (ssl->ctx && ssl->ctx->HKDFExpandLabelCb) {
ret = ssl->ctx->HKDFExpandLabelCb(okm, okmLen, prk, prkLen, ret = ssl->ctx->HKDFExpandLabelCb(okm, okmLen, prk, prkLen,
protocol, protocolLen, protocol, protocolLen,
@ -262,33 +262,38 @@ static int Tls13HKDFExpandKeyLabel(WOLFSSL* ssl, byte* okm, word32 okmLen,
info, infoLen, info, infoLen,
digest, side); digest, side);
} }
if (ret != NOT_COMPILED_IN) if (ret != NOT_COMPILED_IN)
return ret; return ret;
#endif #endif
/* hash buffer may not be fully initialized, but the sending length won't /* Hash buffer may not be fully initialized, but the sending length won't
* extend beyond the initialized span. * extend beyond the initialized span. */
*/
PRAGMA_GCC_DIAG_PUSH PRAGMA_GCC_DIAG_PUSH
PRAGMA_GCC("GCC diagnostic ignored \"-Wmaybe-uninitialized\"") PRAGMA_GCC("GCC diagnostic ignored \"-Wmaybe-uninitialized\"")
(void)ssl;
(void)side;
#if !defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3)) #if !defined(HAVE_FIPS) || (defined(FIPS_VERSION_GE) && FIPS_VERSION_GE(5,3))
return wc_Tls13_HKDF_Expand_Label_ex(okm, okmLen, prk, prkLen, ret = wc_Tls13_HKDF_Expand_Label_ex(okm, okmLen, prk, prkLen,
protocol, protocolLen, protocol, protocolLen,
label, labelLen, label, labelLen,
info, infoLen, digest, info, infoLen, digest,
ssl->heap, ssl->devId); ssl->heap, ssl->devId);
#elif defined(HAVE_FIPS) && defined(wc_Tls13_HKDF_Expand_Label)
ret = wc_Tls13_HKDF_Expand_Label_fips(okm, okmLen, prk, prkLen,
protocol, protocolLen,
label, labelLen,
info, infoLen, digest);
#else #else
return wc_Tls13_HKDF_Expand_Label(okm, okmLen, prk, prkLen, ret = wc_Tls13_HKDF_Expand_Label(okm, okmLen, prk, prkLen,
protocol, protocolLen, protocol, protocolLen,
label, labelLen, label, labelLen,
info, infoLen, digest); info, infoLen, digest);
#endif #endif
PRAGMA_GCC_DIAG_POP PRAGMA_GCC_DIAG_POP
(void)ssl;
(void)side;
return ret;
} }
#endif /* !HAVE_FIPS || !wc_Tls13_HKDF_Expand_Label */
/* Derive a key from a message. /* Derive a key from a message.
* *
@ -493,26 +498,16 @@ int Tls13DeriveKey(WOLFSSL* ssl, byte* output, int outputLen,
/* hash buffer may not be fully initialized, but the sending length won't /* hash buffer may not be fully initialized, but the sending length won't
* extend beyond the initialized span. * extend beyond the initialized span.
*/ */
PRAGMA_GCC_DIAG_PUSH
PRAGMA_GCC("GCC diagnostic ignored \"-Wmaybe-uninitialized\"")
PRIVATE_KEY_UNLOCK(); PRIVATE_KEY_UNLOCK();
#if defined(HAVE_FIPS) && defined(wc_Tls13_HKDF_Expand_Label)
(void)side;
ret = wc_Tls13_HKDF_Expand_Label_fips(output, outputLen, secret, hashSz,
protocol, protocolLen, label, labelLen,
hash, hashOutSz, digestAlg);
#else
ret = Tls13HKDFExpandKeyLabel(ssl, output, outputLen, secret, hashSz, ret = Tls13HKDFExpandKeyLabel(ssl, output, outputLen, secret, hashSz,
protocol, protocolLen, label, labelLen, protocol, protocolLen, label, labelLen,
hash, hashOutSz, digestAlg, side); hash, hashOutSz, digestAlg, side);
#endif
PRIVATE_KEY_LOCK(); PRIVATE_KEY_LOCK();
#ifdef WOLFSSL_CHECK_MEM_ZERO #ifdef WOLFSSL_CHECK_MEM_ZERO
wc_MemZero_Add("TLS 1.3 derived key", output, outputLen); wc_MemZero_Add("TLS 1.3 derived key", output, outputLen);
#endif #endif
return ret; return ret;
PRAGMA_GCC_DIAG_POP
} }
/* Convert TLS mac ID to a hash algorithm ID /* Convert TLS mac ID to a hash algorithm ID

24
wolfcrypt/src/cryptocb.c
View File

@ -181,27 +181,35 @@ WOLFSSL_API void wc_CryptoCb_InfoString(wc_CryptoInfo* info)
else else
#endif #endif
{ {
printf("Crypto CB: %s %s (%d)\n", GetAlgoTypeStr(info->algo_type), printf("Crypto CB: %s %s (%d)\n",
GetAlgoTypeStr(info->algo_type),
GetPkTypeStr(info->pk.type), info->pk.type); GetPkTypeStr(info->pk.type), info->pk.type);
} }
} }
else if (info->algo_type == WC_ALGO_TYPE_CIPHER) { else if (info->algo_type == WC_ALGO_TYPE_CIPHER) {
printf("Crypto CB: %s %s (%d) (%p ctx)\n", GetAlgoTypeStr(info->algo_type), printf("Crypto CB: %s %s (%d) (%p ctx)\n",
GetCipherTypeStr(info->cipher.type), info->cipher.type, info->cipher.ctx); GetAlgoTypeStr(info->algo_type),
GetCipherTypeStr(info->cipher.type),
info->cipher.type, info->cipher.ctx);
} }
else if (info->algo_type == WC_ALGO_TYPE_HASH) { else if (info->algo_type == WC_ALGO_TYPE_HASH) {
printf("Crypto CB: %s %s (%d) (%p ctx) %s\n", GetAlgoTypeStr(info->algo_type), printf("Crypto CB: %s %s (%d) (%p ctx) %s\n",
GetHashTypeStr(info->hash.type), info->hash.type, info->hash.ctx, GetAlgoTypeStr(info->algo_type),
GetHashTypeStr(info->hash.type),
info->hash.type, info->hash.ctx,
(info->hash.in != NULL) ? "Update" : "Final"); (info->hash.in != NULL) ? "Update" : "Final");
} }
else if (info->algo_type == WC_ALGO_TYPE_HMAC) { else if (info->algo_type == WC_ALGO_TYPE_HMAC) {
printf("Crypto CB: %s %s (%d) (%p ctx) %s\n", GetAlgoTypeStr(info->algo_type), printf("Crypto CB: %s %s (%d) (%p ctx) %s\n",
GetHashTypeStr(info->hmac.macType), info->hmac.macType, info->hmac.hmac, GetAlgoTypeStr(info->algo_type),
GetHashTypeStr(info->hmac.macType),
info->hmac.macType, info->hmac.hmac,
(info->hmac.in != NULL) ? "Update" : "Final"); (info->hmac.in != NULL) ? "Update" : "Final");
} }
#ifdef WOLF_CRYPTO_CB_CMD #ifdef WOLF_CRYPTO_CB_CMD
else if (info->algo_type == WC_ALGO_TYPE_NONE) { else if (info->algo_type == WC_ALGO_TYPE_NONE) {
printf("Crypto CB: %s %s (%d)\n", GetAlgoTypeStr(info->algo_type), printf("Crypto CB: %s %s (%d)\n",
GetAlgoTypeStr(info->algo_type),
GetCryptoCbCmdTypeStr(info->cmd.type), info->cmd.type); GetCryptoCbCmdTypeStr(info->cmd.type), info->cmd.type);
} }
#endif #endif