Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

extmod/modtls_mbedtls: Fix key_len passed to mbedtls_pk_parse_key. #14385

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

peterzuger
Copy link
Contributor

See issue #14371:

mbedtls_pk_parse_key() expects key_len to include the NULL terminator for PEM data but not for DER encoded data.

Since all PEM data starts with "-----BEGIN" this is used to check if the data is PEM.

This can be done for both v2 and v3 of mbedtls since the fundamental behaviour/expectation did not change.

What changed is that in v3 the PKCS#8 DER parser now checks that the passed key buffer was fully utilized and no bytes are remaining (all other DER formats still do not check this).

Copy link

codecov bot commented Apr 27, 2024

Codecov Report

Attention: Patch coverage is 66.66667% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 98.39%. Comparing base (e60e807) to head (bb981c8).

Files Patch % Lines
extmod/modtls_mbedtls.c 66.66% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #14385      +/-   ##
==========================================
- Coverage   98.39%   98.39%   -0.01%     
==========================================
  Files         161      161              
  Lines       21204    21206       +2     
==========================================
+ Hits        20864    20865       +1     
- Misses        340      341       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@peterzuger peterzuger force-pushed the mbedtls-mbedtls_pk_parse_key-key_len-fix branch from a3ed858 to dcdd202 Compare April 27, 2024 08:41
mbedtls_pk_parse_key() expects key_len to include the NULL terminator for
PEM data but not for DER encoded data.

Since all PEM data starts with "-----BEGIN" this is used to check if the
data is PEM.

Signed-off-by: Peter Züger <zueger.peter@icloud.com>
@peterzuger peterzuger force-pushed the mbedtls-mbedtls_pk_parse_key-key_len-fix branch from dcdd202 to bb981c8 Compare April 27, 2024 08:42
Copy link

Code size report:

   bare-arm:    +0 +0.000% 
minimal x86:    +0 +0.000% 
   unix x64:   +56 +0.007% standard
      stm32:    +0 +0.000% PYBV10
     mimxrt:    +0 +0.000% TEENSY40
        rp2:    +0 +0.000% RPI_PICO
       samd:    +0 +0.000% ADAFRUIT_ITSYBITSY_M4_EXPRESS

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant