chenjintao/banban
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prefer X25519 for legacy WSS full handshakes

Browse Source 
Prioritize X25519 while retaining enabled curve fallbacks and log the negotiated ECDHE group. Extend ABI checks, crypto benchmarks and backend group probes, and document the updated APP package.
This commit is contained in:
chenjintao
2026-09-16 15:32:22 +08:00
parent 3a0714c735
commit 551a7bb1e6
10 changed files with 189 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/test_wss_handshake.py
+10 -9
View File
@@ -10,14 +10,7 @@ harness = r'''
#include <stdio.h>
#include <string.h>
#include <stdarg.h>
enum { MBEDTLS_SSL_CLIENT_HELLO, MBEDTLS_SSL_SERVER_HELLO,
MBEDTLS_SSL_SERVER_CERTIFICATE, MBEDTLS_SSL_SERVER_KEY_EXCHANGE,
MBEDTLS_SSL_CLIENT_KEY_EXCHANGE, MBEDTLS_SSL_SERVER_FINISHED,
MBEDTLS_SSL_HANDSHAKE_OVER };
#define MBEDTLS_ERR_SSL_WANT_READ -2
#define MBEDTLS_ERR_SSL_WANT_WRITE -3
#define MBEDTLS_ERR_SSL_TIMEOUT -4
typedef struct { int state; } mbedtls_ssl_context;
#include "mbedtls/ssl_internal.h"
typedef struct { int ret, next_state; unsigned int duration; } step;
static step steps[16];
static int count, calls, sleeps;
@@ -26,7 +19,7 @@ static void test_log(const char *fmt, ...) { (void)fmt; }
#define LOG_I test_log
static unsigned int ql_rtos_get_systicks(void) { return ticks; }
static void rws_thread_sleep(unsigned int ms) { ticks += ms / 5; ++sleeps; }
static int mbedtls_ssl_handshake_step(mbedtls_ssl_context *ctx) {
int mbedtls_ssl_handshake_step(mbedtls_ssl_context *ctx) {
step s;
assert(ctx->state != MBEDTLS_SSL_HANDSHAKE_OVER);
if (calls >= count) { ++calls; return MBEDTLS_ERR_SSL_WANT_READ; }
@@ -36,11 +29,13 @@ static int mbedtls_ssl_handshake_step(mbedtls_ssl_context *ctx) {
harness += body
harness += r'''
static void reset(mbedtls_ssl_context *ctx) {
memset(ctx, 0, sizeof(*ctx));
ctx->state = MBEDTLS_SSL_CLIENT_HELLO;
count = calls = sleeps = 0; ticks = 0; memset(steps, 0, sizeof(steps));
}
int main(void) {
mbedtls_ssl_context ctx;
mbedtls_ssl_handshake_params handshake = {0};
reset(&ctx);
steps[0] = (step){0, MBEDTLS_SSL_SERVER_HELLO, 1};
steps[1] = (step){MBEDTLS_ERR_SSL_WANT_READ, MBEDTLS_SSL_SERVER_HELLO, 0};
@@ -50,6 +45,11 @@ int main(void) {
steps[5] = (step){0, MBEDTLS_SSL_SERVER_FINISHED, 5};
steps[6] = (step){0, MBEDTLS_SSL_HANDSHAKE_OVER, 1}; count = 7;
assert(rws_tls_handshake_timed(&ctx) == 0 && calls == 7 && sleeps == 2 && ticks == 24);
reset(&ctx); ctx.handshake = &handshake; ctx.state = MBEDTLS_SSL_SERVER_KEY_EXCHANGE;
handshake.ecdh_ctx.grp_id = MBEDTLS_ECP_DP_CURVE25519;
steps[0] = (step){0, MBEDTLS_SSL_CLIENT_KEY_EXCHANGE, 1};
steps[1] = (step){0, MBEDTLS_SSL_HANDSHAKE_OVER, 1}; count = 2;
assert(rws_tls_handshake_timed(&ctx) == 0 && calls == 2 && sleeps == 0);
reset(&ctx); steps[0] = (step){-99, MBEDTLS_SSL_SERVER_CERTIFICATE, 1}; count = 1;
assert(rws_tls_handshake_timed(&ctx) == -99 && calls == 1 && sleeps == 0);
reset(&ctx);
@@ -70,5 +70,6 @@ cfile = output / 'test_wss_handshake.c'
cfile.write_text(harness, encoding='utf-8')
exe = output / 'test_wss_handshake.exe'
subprocess.run(['cl', '/nologo', '/W4', '/WX', '/TC', str(cfile),
'/I' + str(root / 'ql-application/threadx/common/include'),
'/Fo' + str(output / 'test_wss_handshake.obj'), '/Fe' + str(exe)], check=True)
subprocess.run([str(exe)], check=True)