commit 66b0d617184104c491525b36518b90c0f3c67bcf
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Fri Jun 17 10:49:29 2022 +0200
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Mon Jun 20 21:12:29 2022 +0200
tree 25aa7077a67b359472ad77077d1b82269aa5c0a1
parent 19a567ba431a9b4c39b091583d8f8e46f4d67328

Add comments when can_do() is safe to use

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 5331865..06c30f6 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -6280,7 +6280,9 @@
     {
         const mbedtls_pk_context *pk = &chain->pk;
 
-        /* If certificate uses an EC key, make sure the curve is OK */
+        /* If certificate uses an EC key, make sure the curve is OK.
+         * This is a public key, so it can't be opaque, so can_do() is a good
+         * enough check to ensure pk_ec() is safe to use here. */
         if( mbedtls_pk_can_do( pk, MBEDTLS_PK_ECKEY ) &&
             mbedtls_ssl_check_curve( ssl, mbedtls_pk_ec( *pk )->grp.id ) != 0 )
         {

library/ssl_tls12_client.c

diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c
index f516efa..3d0e3a7 100644
--- a/library/ssl_tls12_client.c
+++ b/library/ssl_tls12_client.c
@@ -2089,6 +2089,8 @@
     peer_pk = &ssl->session_negotiate->peer_cert->pk;
 #endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */
 
+    /* This is a public key, so it can't be opaque, so can_do() is a good
+     * enough check to ensure pk_ec() is safe to use below. */
     if( ! mbedtls_pk_can_do( peer_pk, MBEDTLS_PK_ECKEY ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "server key not ECDH capable" ) );