commit 6f87f2521c8da36e68b074c92774e30aa20fca44
author Jerry Yu <jerry.h.yu@arm.com> Fri Oct 29 20:12:51 2021 +0800
committer Jerry Yu <jerry.h.yu@arm.com> Fri Oct 29 20:15:03 2021 +0800
tree 385c3ae0c6541a093807b90601e73a10a64c117a
parent daac3593318e57390baa7ba77e312e2ce963bab2

Refactor ssl_tls13_parse_certificate_verify

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>

library/ssl_tls13_generic.c

diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c
index c83c98b..45692d8 100644
--- a/library/ssl_tls13_generic.c
+++ b/library/ssl_tls13_generic.c
@@ -341,8 +341,7 @@
      * certificates and decides to abort the handshake, then it MUST abort the handshake
      * with an appropriate certificate-related alert (by default, "unsupported_certificate").
      *
-     * Check if algorithm is an offered signature algorithm. Send `unsupported_certificate`
-     * alert message on failure.
+     * Check if algorithm is an offered signature algorithm.
      */
     if( ! ssl_tls13_sig_alg_is_offered( ssl, algorithm ) )
     {
@@ -350,10 +349,7 @@
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "Received signature algorithm(%04x) is not "
                                     "offered.",
                                     ( unsigned int ) algorithm ) );
-        MBEDTLS_SSL_PEND_FATAL_ALERT(
-            MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT,
-            MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        goto error;
     }
 
     /* We currently only support ECDSA-based signatures */
@@ -373,10 +369,7 @@
             break;
         default:
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "Certificate Verify: Unknown signature algorithm." ) );
-            MBEDTLS_SSL_PEND_FATAL_ALERT(
-                MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT,
-                MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
-            return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+            goto error;
     }
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "Certificate Verify: Signature algorithm ( %04x )",
@@ -388,10 +381,7 @@
     if( !mbedtls_pk_can_do( &ssl->session_negotiate->peer_cert->pk, sig_alg ) )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "signature algorithm doesn't match cert key" ) );
-        MBEDTLS_SSL_PEND_FATAL_ALERT(
-            MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT,
-            MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        goto error;
     }
 
     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, 2 );
@@ -431,10 +421,7 @@
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1, "hash computation error", ret );
-        MBEDTLS_SSL_PEND_FATAL_ALERT(
-                        MBEDTLS_SSL_ALERT_MSG_UNSUPPORTED_CERT,
-                        MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
-        return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+        goto error;
     }
 
     MBEDTLS_SSL_DEBUG_BUF( 3, "verify hash", verify_hash, verify_hash_len );
@@ -442,21 +429,22 @@
     if( ( ret = mbedtls_pk_verify_ext( sig_alg, NULL,
                                        &ssl->session_negotiate->peer_cert->pk,
                                        md_alg, verify_hash, verify_hash_len,
-                                       p, signature_len ) ) != 0 )
+                                       p, signature_len ) ) == 0 )
     {
-        MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify_ext", ret );
-
-        /* RFC 8446 section 4.4.3
-         *
-         * If the verification fails, the receiver MUST terminate the handshake
-         * with a "decrypt_error" alert.
-         */
-        MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR, ret );
-
-        return( ret );
+        return( 0 );
     }
+    MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_pk_verify_ext", ret );
 
-    return( 0 );
+error:
+    /* RFC 8446 section 4.4.3
+     *
+     * If the verification fails, the receiver MUST terminate the handshake
+     * with a "decrypt_error" alert.
+    */
+    MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR,
+                                  MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+    return( MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE );
+
 }
 #endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */