yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-12-22 20:45:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3999 from AndrzejKurek/baremetal-fi-parse-certificate

Browse source 
[baremetal] Improved fi protection in ssl_parse_certificate
This commit is contained in:
Shelly Liberman 2021-01-24 10:41:43 +02:00 committed by GitHub
parent f1b4a593c7 8fde918b4e
commit ae7bf2c05e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 26 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
library/ssl_tls.c
View file

@ -8099,8 +8099,10 @@ static int ssl_remember_peer_pubkey( mbedtls_ssl_context *ssl,
int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
{
int ret = 0;
int crt_expected;
volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
volatile int ret_verify = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED;
volatile int check_cert_initiated = 0;
volatile int crt_expected = SSL_CERTIFICATE_EXPECTED;
#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET
? ssl->handshake->sni_authmode
@ -8116,8 +8118,14 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
if( crt_expected == SSL_CERTIFICATE_SKIP )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
goto exit;
mbedtls_platform_random_delay();
crt_expected = ssl_parse_certificate_coordinate( ssl, authmode );
if( crt_expected == SSL_CERTIFICATE_SKIP )
{
MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip parse certificate" ) );
ret = 0;
goto exit;
}
}
#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
@ -8178,22 +8186,28 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
ssl->handshake->ecrs_state = ssl_ecrs_crt_verify;
crt_verify:
check_cert_initiated = 1;
if( ssl->handshake->ecrs_enabled)
rs_ctx = &ssl->handshake->ecrs_ctx;
#endif
#if defined(MBEDTLS_SSL_DELAYED_SERVER_CERT_VERIFICATION)
if (mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
if ( mbedtls_ssl_conf_get_endpoint( ssl->conf ) == MBEDTLS_SSL_IS_CLIENT )
{
MBEDTLS_SSL_DEBUG_MSG( 3, ( "delay server certificate verification" ) );
check_cert_initiated = 0;
ret = 0;
}
else
#endif /* MBEDTLS_SSL_DELAYED_SERVER_CERT_VERIFICATION */
{
ret = ssl_parse_certificate_verify( ssl, authmode,
chain, rs_ctx );
if( ret != 0 )
ret_verify = ssl_parse_certificate_verify( ssl, authmode,
chain, rs_ctx );
ret = ret_verify;
if( ret_verify != 0 )
{
goto exit;
}
}
#if !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
@ -8243,6 +8257,10 @@ crt_verify:
exit:
if( check_cert_initiated && ( ret == 0 ) )
{
ret = ret_verify;
}
if( ret == 0 )
{
if( ssl->state == MBEDTLS_SSL_CLIENT_CERTIFICATE )