commit c5a23a0f1214d738491bd0a07d3fd0a3344738df
author Jerry Yu <jerry.h.yu@arm.com> Thu Aug 25 10:51:44 2022 +0800
committer Jerry Yu <jerry.h.yu@arm.com> Thu Aug 25 11:09:35 2022 +0800
tree 2bab65ceaadab9dcb3bb5602af4fc76c09fd5080
parent 2185c0f2e9ee3f9fb6051762ce4fb1493cd510c5

fix various issues

- code style
- variable initialize
- update comments


Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>

library/ssl_tls13_keys.c

diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index 3948ea6..32a4f2a 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -1572,10 +1572,9 @@
                                             unsigned char **psk,
                                             size_t *psk_len )
 {
-
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
-    psa_status_t status;
+    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
 
     *psk_len = 0;
     *psk = NULL;
@@ -1585,16 +1584,12 @@
 
     status = psa_get_key_attributes( ssl->handshake->psk_opaque, &key_attributes );
     if( status != PSA_SUCCESS )
-    {
         return( psa_ssl_status_to_mbedtls( status ) );
-    }
 
     *psk_len = PSA_BITS_TO_BYTES( psa_get_key_bits( &key_attributes ) );
     *psk = mbedtls_calloc( 1, *psk_len );
     if( *psk == NULL )
-    {
         return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
-    }
 
     status = psa_export_key( ssl->handshake->psk_opaque,
                              (uint8_t *)*psk, *psk_len, psk_len );

library/ssl_tls13_server.c

diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c
index 2c4dd86..906ead7 100644
--- a/library/ssl_tls13_server.c
+++ b/library/ssl_tls13_server.c
@@ -47,9 +47,9 @@
 #include "ssl_debug_helpers.h"
 
 
-static const mbedtls_ssl_ciphersuite_t *ssl_tls13_get_ciphersuite_info_by_id(
+static const mbedtls_ssl_ciphersuite_t *ssl_tls13_validate_peer_ciphersuite(
                                       mbedtls_ssl_context *ssl,
-                                      uint16_t cipher_suite )
+                                      unsigned int cipher_suite )
 {
     const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
     if( ! mbedtls_ssl_tls13_cipher_suite_is_offered( ssl, cipher_suite ) )
@@ -235,8 +235,8 @@
         const mbedtls_ssl_ciphersuite_t *ciphersuite_info;
 
         cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
-        ciphersuite_info = ssl_tls13_get_ciphersuite_info_by_id(
-                               ssl,cipher_suite );
+        ciphersuite_info = ssl_tls13_validate_peer_ciphersuite( ssl,
+                                                                cipher_suite );
         if( ciphersuite_info == NULL )
             continue;
 
@@ -416,9 +416,10 @@
                   mbedtls_psa_translate_md( ciphersuite_info->mac ) );
         if( ret != SSL_TLS1_3_OFFERED_PSK_MATCH )
         {
-            /* For the security rationale, handshake should be abort when binder
-             * value mismatch. See RFC 8446 section 4.2.11.2 and appendix E.6. */
-            MBEDTLS_SSL_DEBUG_MSG( 3, ( "Binder is not matched." ) );
+            /* For security reasons, the handshake should be aborted when we
+             * fail to validate a binder value. See RFC 8446 section 4.2.11.2
+             * and appendix E.6. */
+            MBEDTLS_SSL_DEBUG_MSG( 3, ( "Invalid binder." ) );
             MBEDTLS_SSL_DEBUG_RET( 1,
                 "ssl_tls13_offered_psks_check_binder_match" , ret );
             MBEDTLS_SSL_PEND_FATAL_ALERT(
@@ -1176,7 +1177,7 @@
         MBEDTLS_SSL_CHK_BUF_READ_PTR( p, cipher_suites_end, 2 );
 
         cipher_suite = MBEDTLS_GET_UINT16_BE( p, 0 );
-        ciphersuite_info = ssl_tls13_get_ciphersuite_info_by_id(
+        ciphersuite_info = ssl_tls13_validate_peer_ciphersuite(
                                ssl,cipher_suite );
         if( ciphersuite_info == NULL )
             continue;