Automatically allocate opaque PSK key slots in ssl_{client/server}2
Previously, command line arguments `psk_slot` and `psk_list_slot`
could be used to indicate the PSA key slots that the example
applications should use to store the PSK(s) provided.
This commit changes this approach to use the utility function
`mbedtls_psa_get_free_key_slot()` to obtain free key slots from
the PSA Crypto implementation automatically, so that users only
need to pass boolean flags `psk_opaque` and `psk_list_opaque`
on the command line to enable / disable PSA-based opaque PSKs.
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index f4b737f..534a3f3 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -62,6 +62,7 @@
#if defined(MBEDTLS_USE_PSA_CRYPTO)
#include "psa/crypto.h"
+#include "mbedtls/psa_util.h"
#endif
#include <stdio.h>
@@ -123,8 +124,8 @@
#define DFL_ASYNC_PRIVATE_DELAY2 ( -1 )
#define DFL_ASYNC_PRIVATE_ERROR ( 0 )
#define DFL_PSK ""
-#define DFL_PSK_SLOT 0
-#define DFL_PSK_LIST_SLOT 0
+#define DFL_PSK_OPAQUE 0
+#define DFL_PSK_LIST_OPAQUE 0
#define DFL_PSK_IDENTITY "Client_identity"
#define DFL_ECJPAKE_PW NULL
#define DFL_PSK_LIST NULL
@@ -234,20 +235,18 @@
" id1,psk1[,id2,psk2[,...]]\n"
#if defined(MBEDTLS_USE_PSA_CRYPTO)
#define USAGE_PSK_SLOT \
- " psk_slot=%%d default: 0 (don't use key slots)\n" \
- " An empty key slot identifier to be used to hold the static PSK\n" \
- " configured through the psk parameter.\n"\
+ " psk_opaque=%%d default: 0 (don't use opaque static PSK)\n" \
+ " Enable this to store the PSK configured through command line\n" \
+ " parameter `psk` in a PSA-based key slot.\n" \
" Note: Currently only supported in conjunction with\n" \
" the use of min_version to force TLS 1.2 and force_ciphersuite \n" \
" to force a particular PSK-only ciphersuite.\n" \
" Note: This is to test integration of PSA-based opaque PSKs with\n" \
" Mbed TLS only. Production systems are likely to configure Mbed TLS\n" \
" with prepopulated key slots instead of importing raw key material.\n" \
- " psk_list_slot=%%d default: 0 (don't use key slots)\n" \
- " The base of a consecutive list of empty key slot identifiers to be used\n" \
- " to hold the dynamic PSKs configured through the psk_list parameter;\n" \
- " for example, if you specify a list of 3 dynamic PSKs through the psk_list\n"\
- " parameter, then the slots psk_slot, .., psk_slot+3 must be empty.\n" \
+ " psk_list_opaque=%%d default: 0 (don't use opaque dynamic PSKs)\n" \
+ " Enable this to store the list of dynamically chosen PSKs configured\n" \
+ " through the command line parameter `psk_list` in PSA-based key slots.\n" \
" Note: Currently only supported in conjunction with\n" \
" the use of min_version to force TLS 1.2 and force_ciphersuite \n" \
" to force a particular PSK-only ciphersuite.\n" \
@@ -485,8 +484,8 @@
int async_private_delay2; /* number of times f_async_resume needs to be called for key 2, or -1 for no async */
int async_private_error; /* inject error in async private callback */
#if defined(MBEDTLS_USE_PSA_CRYPTO)
- int psk_slot;
- int psk_list_slot;
+ int psk_opaque;
+ int psk_list_opaque;
#endif
const char *psk; /* the pre-shared key */
const char *psk_identity; /* the pre-shared key identity */
@@ -871,11 +870,6 @@
if( unhexify( new->key, key_hex, &new->key_len ) != 0 )
goto error;
-#if defined(MBEDTLS_USE_PSA_CRYPTO)
- if( opt.psk_list_slot != 0 )
- new->slot = opt.psk_list_slot++;
-#endif /* MBEDTLS_USE_PSA_CRYPTO */
-
new->next = cur;
cur = new;
}
@@ -1250,11 +1244,17 @@
status = psa_set_key_policy( slot, &policy );
if( status != PSA_SUCCESS )
+ {
+ fprintf( stderr, "POLICY\n" );
return( status );
+ }
status = psa_import_key( slot, PSA_KEY_TYPE_DERIVE, psk, psk_len );
if( status != PSA_SUCCESS )
+ {
+ fprintf( stderr, "IMPORT\n" );
return( status );
+ }
return( PSA_SUCCESS );
}
@@ -1268,6 +1268,7 @@
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
#if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_algorithm_t alg = 0;
+ psa_key_slot_t psk_slot = 0;
#endif /* MBEDTLS_USE_PSA_CRYPTO */
unsigned char psk[MBEDTLS_PSK_MAX_LEN];
size_t psk_len = 0;
@@ -1432,8 +1433,8 @@
opt.async_private_error = DFL_ASYNC_PRIVATE_ERROR;
opt.psk = DFL_PSK;
#if defined(MBEDTLS_USE_PSA_CRYPTO)
- opt.psk_slot = DFL_PSK_SLOT;
- opt.psk_list_slot = DFL_PSK_LIST_SLOT;
+ opt.psk_opaque = DFL_PSK_OPAQUE;
+ opt.psk_list_opaque = DFL_PSK_LIST_OPAQUE;
#endif
opt.psk_identity = DFL_PSK_IDENTITY;
opt.psk_list = DFL_PSK_LIST;
@@ -1564,10 +1565,10 @@
else if( strcmp( p, "psk" ) == 0 )
opt.psk = q;
#if defined(MBEDTLS_USE_PSA_CRYPTO)
- else if( strcmp( p, "psk_slot" ) == 0 )
- opt.psk_slot = atoi( q );
- else if( strcmp( p, "psk_list_slot" ) == 0 )
- opt.psk_list_slot = atoi( q );
+ else if( strcmp( p, "psk_opaque" ) == 0 )
+ opt.psk_opaque = atoi( q );
+ else if( strcmp( p, "psk_list_opaque" ) == 0 )
+ opt.psk_list_opaque = atoi( q );
#endif
else if( strcmp( p, "psk_identity" ) == 0 )
opt.psk_identity = q;
@@ -1879,11 +1880,11 @@
}
#if defined(MBEDTLS_USE_PSA_CRYPTO)
- if( opt.psk_slot != 0 )
+ if( opt.psk_opaque != 0 )
{
if( strlen( opt.psk ) == 0 )
{
- mbedtls_printf( "psk_slot set but no psk to be imported specified.\n" );
+ mbedtls_printf( "psk_opaque set but no psk to be imported specified.\n" );
ret = 2;
goto usage;
}
@@ -1896,7 +1897,7 @@
}
}
- if( opt.psk_list_slot != 0 )
+ if( opt.psk_list_opaque != 0 )
{
if( opt.psk_list == NULL )
{
@@ -1965,7 +1966,7 @@
}
#if defined(MBEDTLS_USE_PSA_CRYPTO)
- if( opt.psk_slot != 0 || opt.psk_list_slot != 0 )
+ if( opt.psk_opaque != 0 || opt.psk_list_opaque != 0 )
{
/* Ensure that the chosen ciphersuite is PSK-only; we must know
* the ciphersuite in advance to set the correct policy for the
@@ -2664,20 +2665,27 @@
if( strlen( opt.psk ) != 0 && strlen( opt.psk_identity ) != 0 )
{
#if defined(MBEDTLS_USE_PSA_CRYPTO)
- if( opt.psk_slot != 0 )
+ if( opt.psk_opaque != 0 )
{
- /* The algorithm has already been determined earlier. */
- status = psa_setup_psk_key_slot( opt.psk_slot, alg,
- psk, psk_len );
+ status = mbedtls_psa_get_free_key_slot( &psk_slot );
if( status != PSA_SUCCESS )
{
+ fprintf( stderr, "ALLOC FAIL\n" );
ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
goto exit;
}
- if( ( ret = mbedtls_ssl_conf_psk_opaque( &conf, opt.psk_slot,
- (const unsigned char *) opt.psk_identity,
- strlen( opt.psk_identity ) ) ) != 0 )
+ /* The algorithm has already been determined earlier. */
+ status = psa_setup_psk_key_slot( psk_slot, alg, psk, psk_len );
+ if( status != PSA_SUCCESS )
+ {
+ fprintf( stderr, "SETUP FAIL\n" );
+ ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
+ goto exit;
+ }
+ if( ( ret = mbedtls_ssl_conf_psk_opaque( &conf, psk_slot,
+ (const unsigned char *) opt.psk_identity,
+ strlen( opt.psk_identity ) ) ) != 0 )
{
mbedtls_printf( " failed\n ! mbedtls_ssl_conf_psk_opaque returned %d\n\n",
ret );
@@ -2698,24 +2706,30 @@
if( opt.psk_list != NULL )
{
#if defined(MBEDTLS_USE_PSA_CRYPTO)
- if( opt.psk_list_slot != 0 )
+ if( opt.psk_list_opaque != 0 )
{
psk_entry *cur_psk;
for( cur_psk = psk_info; cur_psk != NULL; cur_psk = cur_psk->next )
{
- fprintf( stderr, "REGISTER KEY SLOT %d\n", (int) cur_psk->slot );
+ status = mbedtls_psa_get_free_key_slot( &cur_psk->slot );
+ if( status != PSA_SUCCESS )
+ {
+ ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
+ goto exit;
+ }
+
status = psa_setup_psk_key_slot( cur_psk->slot, alg,
cur_psk->key,
cur_psk->key_len );
if( status != PSA_SUCCESS )
{
- fprintf( stderr, "REGISTER KEY SLOT\n" );
ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
goto exit;
}
}
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */
+
mbedtls_ssl_conf_psk_cb( &conf, psk_callback, psk_info );
}
#endif
@@ -3355,17 +3369,17 @@
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) && \
defined(MBEDTLS_USE_PSA_CRYPTO)
- if( opt.psk_slot != 0 )
+ if( opt.psk_opaque != 0 )
{
/* This is ok even if the slot hasn't been
* initialized (we might have jumed here
* immediately because of bad cmd line params,
* for example). */
- status = psa_destroy_key( opt.psk_slot );
+ status = psa_destroy_key( psk_slot );
if( status != PSA_SUCCESS )
{
mbedtls_printf( "Failed to destroy key slot %u - error was %d",
- (unsigned) opt.psk_slot, (int) status );
+ (unsigned) psk_slot, (int) status );
}
}
#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED &&