OID functionality moved to a separate module.
A new OID module has been created that contains the main OID searching
functionality based on type-dependent arrays. A base type is used to
contain the basic values (oid_descriptor_t) and that type is extended to
contain type specific information (like a pk_alg_t).
As a result the rsa sign and verify function prototypes have changed. They
now expect a md_type_t identifier instead of the removed RSA_SIG_XXX
defines.
All OID definitions have been moved to oid.h
All OID matching code is in the OID module.
The RSA PKCS#1 functions cleaned up as a result and adapted to use the
MD layer.
The SSL layer cleanup up as a result and adapted to use the MD layer.
The X509 parser cleaned up and matches OIDs in certificates with new
module and adapted to use the MD layer.
The X509 writer cleaned up and adapted to use the MD layer.
Apps and tests modified accordingly
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index c7c7367..b94ac92 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -1128,7 +1128,7 @@
int ret;
size_t n, rsa_key_len = 0;
unsigned char hash[64];
- int hash_id = 0;
+ md_type_t md_alg = POLARSSL_MD_NONE;
unsigned int hashlen = 0;
const ssl_ciphersuite_t *ciphersuite_info;
@@ -1247,10 +1247,12 @@
sha1_finish( &sha1, hash + 16 );
hashlen = 36;
- hash_id = SIG_RSA_RAW;
+ md_alg = POLARSSL_MD_NONE;
}
else
{
+ md_context_t ctx;
+
/*
* digitally-signed struct {
* opaque client_random[32];
@@ -1258,84 +1260,49 @@
* ServerDHParams params;
* };
*/
-#if defined(POLARSSL_SHA4_C)
- if( ssl->handshake->sig_alg == SSL_HASH_SHA512 )
+ switch( ssl->handshake->sig_alg )
{
- sha4_context sha4;
-
- sha4_starts( &sha4, 0 );
- sha4_update( &sha4, ssl->handshake->randbytes, 64 );
- sha4_update( &sha4, ssl->out_msg + 4, n );
- sha4_finish( &sha4, hash );
-
- hashlen = 64;
- hash_id = SIG_RSA_SHA512;
- }
- else if( ssl->handshake->sig_alg == SSL_HASH_SHA384 )
- {
- sha4_context sha4;
-
- sha4_starts( &sha4, 1 );
- sha4_update( &sha4, ssl->handshake->randbytes, 64 );
- sha4_update( &sha4, ssl->out_msg + 4, n );
- sha4_finish( &sha4, hash );
-
- hashlen = 48;
- hash_id = SIG_RSA_SHA384;
- }
- else
+#if defined(POLARSSL_MD5_C)
+ case SSL_HASH_MD5:
+ md_alg = POLARSSL_MD_MD5;
+ break;
+#endif
+#if defined(POLARSSL_SHA1_C)
+ case SSL_HASH_SHA1:
+ md_alg = POLARSSL_MD_SHA1;
+ break;
#endif
#if defined(POLARSSL_SHA2_C)
- if( ssl->handshake->sig_alg == SSL_HASH_SHA256 )
- {
- sha2_context sha2;
-
- sha2_starts( &sha2, 0 );
- sha2_update( &sha2, ssl->handshake->randbytes, 64 );
- sha2_update( &sha2, ssl->out_msg + 4, n );
- sha2_finish( &sha2, hash );
-
- hashlen = 32;
- hash_id = SIG_RSA_SHA256;
- }
- else if( ssl->handshake->sig_alg == SSL_HASH_SHA224 )
- {
- sha2_context sha2;
-
- sha2_starts( &sha2, 1 );
- sha2_update( &sha2, ssl->handshake->randbytes, 64 );
- sha2_update( &sha2, ssl->out_msg + 4, n );
- sha2_finish( &sha2, hash );
-
- hashlen = 24;
- hash_id = SIG_RSA_SHA224;
- }
- else
+ case SSL_HASH_SHA224:
+ md_alg = POLARSSL_MD_SHA224;
+ break;
+ case SSL_HASH_SHA256:
+ md_alg = POLARSSL_MD_SHA256;
+ break;
#endif
- if( ssl->handshake->sig_alg == SSL_HASH_SHA1 )
- {
- sha1_context sha1;
-
- sha1_starts( &sha1 );
- sha1_update( &sha1, ssl->handshake->randbytes, 64 );
- sha1_update( &sha1, ssl->out_msg + 4, n );
- sha1_finish( &sha1, hash );
-
- hashlen = 20;
- hash_id = SIG_RSA_SHA1;
+#if defined(POLARSSL_SHA4_C)
+ case SSL_HASH_SHA384:
+ md_alg = POLARSSL_MD_SHA384;
+ break;
+ case SSL_HASH_SHA512:
+ md_alg = POLARSSL_MD_SHA512;
+ break;
+#endif
+ default:
+ /* Should never happen */
+ return( -1 );
}
- else if( ssl->handshake->sig_alg == SSL_HASH_MD5 )
+
+ if( ( ret = md_init_ctx( &ctx, md_info_from_type( md_alg ) ) ) != 0 )
{
- md5_context md5;
-
- md5_starts( &md5 );
- md5_update( &md5, ssl->handshake->randbytes, 64 );
- md5_update( &md5, ssl->out_msg + 4, n );
- md5_finish( &md5, hash );
-
- hashlen = 16;
- hash_id = SIG_RSA_MD5;
+ SSL_DEBUG_RET( 1, "md_init_ctx", ret );
+ return( ret );
}
+
+ md_starts( &ctx );
+ md_update( &ctx, ssl->handshake->randbytes, 64 );
+ md_update( &ctx, ssl->out_msg + 4, n );
+ md_finish( &ctx, hash );
}
SSL_DEBUG_BUF( 3, "parameters hash", hash, hashlen );
@@ -1358,7 +1325,7 @@
{
ret = ssl->rsa_sign( ssl->rsa_key, ssl->f_rng, ssl->p_rng,
RSA_PRIVATE,
- hash_id, hashlen, hash,
+ md_alg, hashlen, hash,
ssl->out_msg + 6 + n );
}
@@ -1594,8 +1561,8 @@
int ret;
size_t n = 0, n1, n2;
unsigned char hash[48];
- int hash_id;
- unsigned int hashlen;
+ md_type_t md_alg = POLARSSL_MD_NONE;
+ unsigned int hashlen = 0;
SSL_DEBUG_MSG( 2, ( "=> parse certificate verify" ) );
@@ -1642,22 +1609,16 @@
}
if( ssl->handshake->verify_sig_alg == SSL_HASH_SHA384 )
- {
- hashlen = 48;
- hash_id = SIG_RSA_SHA384;
- }
+ md_alg = POLARSSL_MD_SHA384;
else
- {
- hashlen = 32;
- hash_id = SIG_RSA_SHA256;
- }
+ md_alg = POLARSSL_MD_SHA256;
n += 2;
}
else
{
hashlen = 36;
- hash_id = SIG_RSA_RAW;
+ md_alg = POLARSSL_MD_NONE;
}
n1 = ssl->session_negotiate->peer_cert->rsa.len;
@@ -1670,7 +1631,7 @@
}
ret = rsa_pkcs1_verify( &ssl->session_negotiate->peer_cert->rsa, RSA_PUBLIC,
- hash_id, hashlen, hash, ssl->in_msg + 6 + n );
+ md_alg, hashlen, hash, ssl->in_msg + 6 + n );
if( ret != 0 )
{
SSL_DEBUG_RET( 1, "rsa_pkcs1_verify", ret );