commit 7ab7f2b1845e91112a1e44c3e65967704450cf38
author Jerry Yu <jerry.h.yu@arm.com> Thu Jun 16 19:07:10 2022 +0800
committer Jerry Yu <jerry.h.yu@arm.com> Wed Jun 29 16:13:44 2022 +0800
tree 4f00aafead31f52145cfb9d9549ae84f047892df
parent 08524c55f97c40b24f9ec81acd6d62789b270a54

Remove pkcs1 from certificate_verify

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>

library/ssl_misc.h

diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index bea84c3..3b01db1 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -2028,7 +2028,9 @@
 
 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
 
-#if 0 && defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C)
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
+    defined(MBEDTLS_PKCS1_V15) && \
+    defined(MBEDTLS_RSA_C)
 
 #if defined(MBEDTLS_SHA256_C)
         case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256:
@@ -2051,7 +2053,9 @@
             break;
 #endif /* MBEDTLS_SHA512_C */
 
-#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C */
+#endif /* MBEDTLS_SSL_PROTO_TLS1_2 &&
+          MBEDTLS_PKCS1_V15 &&
+          MBEDTLS_RSA_C */
 
             default:
                 return( MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE );
@@ -2149,7 +2153,7 @@
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
     if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
     {
-        return( mbedtls_ssl_tls13_sig_alg_is_supported( sig_alg ) );
+       return( mbedtls_ssl_tls13_sig_alg_is_supported( sig_alg ) );
     }
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
     ((void) ssl);

library/ssl_tls13_generic.c

diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index 3ab6cc2..3d5baa2 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -864,6 +864,12 @@
     *algorithm = MBEDTLS_TLS1_3_SIG_NONE;
     for( ; *sig_alg != MBEDTLS_TLS1_3_SIG_NONE ; sig_alg++ )
     {
+        if( *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256 ||
+            *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384 ||
+            *sig_alg == MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512 )
+        {
+            continue;
+        }
         if( mbedtls_ssl_sig_alg_is_supported( ssl, *sig_alg) &&
             mbedtls_ssl_tls13_sig_alg_is_available_for_pk(
                                               ssl, *sig_alg, own_key ) )

tests/ssl-opt.sh

diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index afabb64..a7d6fbf 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -1600,7 +1600,7 @@
 requires_config_enabled MBEDTLS_ECP_DP_CURVE25519_ENABLED
 run_test    "Default" \
             "$P_SRV debug_level=3" \
-            "$P_CLI" \
+            "$P_CLI debug_level=4" \
             0 \
             -s "Protocol is TLSv1.2" \
             -s "Ciphersuite is TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256" \
@@ -11483,7 +11483,7 @@
 requires_config_enabled MBEDTLS_SSL_SRV_C
 requires_config_enabled MBEDTLS_SSL_CLI_C
 run_test    "TLS 1.3: Server side check - mbedtls with sni" \
-            "$P_SRV debug_level=4 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=0 \
+            "$P_SRV debug_level=4 allow_sha1=0 auth_mode=required crt_file=data_files/server5.crt key_file=data_files/server5.key force_version=tls13 tickets=0 \
              sni=localhost,data_files/server2.crt,data_files/server2.key,-,-,-,polarssl.example,data_files/server1-nospace.crt,data_files/server1.key,-,-,-" \
             "$P_CLI debug_level=4 server_name=localhost crt_file=data_files/server5.crt key_file=data_files/server5.key \
             force_version=tls13" \