Skip to content

Commit

Permalink
ssl_tls12_populate_transform optim
Browse files Browse the repository at this point in the history 
- remove redundant calls to retrieve info
- defer calls to where needed for specific ssl_modes

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
  • Loading branch information
@gstrauss
gstrauss committed Jul 8, 2022
1 parent 6e80e09 commit 6811c33
Showing 1 changed file with 49 additions and 36 deletions.
85 changes: 49 additions & 36 deletions library/ssl_tls.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1778,21 +1778,19 @@ static mbedtls_ssl_mode_t mbedtls_ssl_get_base_mode(
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */

#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
static mbedtls_ssl_mode_t mbedtls_ssl_get_actual_mode(
mbedtls_ssl_mode_t base_mode,
int encrypt_then_mac )
{
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
if( encrypt_then_mac == MBEDTLS_SSL_ETM_ENABLED &&
base_mode == MBEDTLS_SSL_MODE_CBC )
{
return( MBEDTLS_SSL_MODE_CBC_ETM );
}
#else
(void) encrypt_then_mac;
#endif
return( base_mode );
}
#endif

mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
const mbedtls_ssl_transform *transform )
Expand All @@ -1805,11 +1803,12 @@ mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_transform(
#endif
);

int encrypt_then_mac = 0;
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
encrypt_then_mac = transform->encrypt_then_mac;
#endif
int encrypt_then_mac = transform->encrypt_then_mac;
return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
#else
return( base_mode );
#endif
}

mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
Expand Down Expand Up @@ -1839,10 +1838,11 @@ mbedtls_ssl_mode_t mbedtls_ssl_get_mode_from_ciphersuite(
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */

#if !defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
int encrypt_then_mac = 0;
#endif
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
return( mbedtls_ssl_get_actual_mode( base_mode, encrypt_then_mac ) );
#else
return( base_mode );
#endif
}

#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3)
Expand Down Expand Up @@ -7085,7 +7085,6 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
mbedtls_ssl_mode_t ssl_mode;
#if !defined(MBEDTLS_USE_PSA_CRYPTO)
const mbedtls_cipher_info_t *cipher_info;
const mbedtls_md_info_t *md_info;
#endif /* !MBEDTLS_USE_PSA_CRYPTO */

#if defined(MBEDTLS_USE_PSA_CRYPTO)
Expand Down Expand Up @@ -7138,27 +7137,20 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}

ssl_mode = mbedtls_ssl_get_mode_from_ciphersuite(
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
encrypt_then_mac,
#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */
ciphersuite_info );

if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
transform->taglen =
ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;

#if defined(MBEDTLS_USE_PSA_CRYPTO)

if( ( status = mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher,
transform->taglen,
0,
&alg,
&key_type,
&key_bits ) ) != PSA_SUCCESS )
{
ret = psa_ssl_status_to_mbedtls( status );
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_cipher_to_psa", ret );
goto end;
return( ret );
}

ssl_mode = mbedtls_ssl_get_base_mode( alg );
#else
cipher_info = mbedtls_cipher_info_from_type( ciphersuite_info->cipher );
if( cipher_info == NULL )
Expand All @@ -7167,7 +7159,24 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
ciphersuite_info->cipher ) );
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}

ssl_mode = mbedtls_ssl_get_base_mode(
mbedtls_cipher_info_get_mode( cipher_info ) );
#endif /* MBEDTLS_USE_PSA_CRYPTO */

if( ssl_mode == MBEDTLS_SSL_MODE_AEAD )
{
transform->taglen =
ciphersuite_info->flags & MBEDTLS_CIPHERSUITE_SHORT_TAG ? 8 : 16;
#if defined(MBEDTLS_USE_PSA_CRYPTO)
mbedtls_ssl_cipher_to_psa( ciphersuite_info->cipher, transform->taglen,
&alg, &key_type, &key_bits );
#endif /* MBEDTLS_USE_PSA_CRYPTO */
}
else
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM)
ssl_mode = mbedtls_ssl_get_actual_mode( ssl_mode, encrypt_then_mac );
#endif /* MBEDTLS_SSL_SOME_SUITES_USE_CBC_ETM */

#if defined(MBEDTLS_USE_PSA_CRYPTO)
mac_alg = mbedtls_psa_translate_md( ciphersuite_info->mac );
Expand All @@ -7177,14 +7186,6 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
(unsigned) ciphersuite_info->mac ) );
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
#else
md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
if( md_info == NULL )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
(unsigned) ciphersuite_info->mac ) );
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */

#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
Expand Down Expand Up @@ -7272,10 +7273,16 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
ssl_mode == MBEDTLS_SSL_MODE_CBC ||
ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
{
#if defined(MBEDTLS_USE_PSA_CRYPTO)
size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type );
#else
size_t block_size = cipher_info->block_size;
#if !defined(MBEDTLS_USE_PSA_CRYPTO)
const mbedtls_md_info_t *md_info;
md_info = mbedtls_md_info_from_type( ciphersuite_info->mac );
if( md_info == NULL )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "mbedtls_md info for %u not found",
(unsigned) ciphersuite_info->mac ) );
ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
goto end;
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */

#if defined(MBEDTLS_USE_PSA_CRYPTO)
Expand Down Expand Up @@ -7313,6 +7320,11 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
* otherwise: * first multiple of blocklen greater than maclen
* 2. IV
*/
#if defined(MBEDTLS_USE_PSA_CRYPTO)
size_t block_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type );
#else
size_t block_size = cipher_info->block_size;
#endif /* MBEDTLS_USE_PSA_CRYPTO */
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
if( ssl_mode == MBEDTLS_SSL_MODE_CBC_ETM )
{
Expand Down Expand Up @@ -7343,7 +7355,8 @@ static int ssl_tls12_populate_transform( mbedtls_ssl_transform *transform,
#endif /* MBEDTLS_SSL_SOME_SUITES_USE_MAC */
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) );
return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
goto end;
}

MBEDTLS_SSL_DEBUG_MSG( 3, ( "keylen: %u, minlen: %u, ivlen: %u, maclen: %u",
Expand Down

0 comments on commit 6811c33

Please sign in to comment.