yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-22 11:15:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'development' into dtls

Browse Source 
* development:
  Fix error code description.
  generate_errors.pl now errors on duplicate codes
  Avoid nested if's without braces.
  Move renego SCSV after actual ciphersuites
  Fix send_close_notify usage.
  Rename variable for clarity
  Improve script portability

Conflicts:
	library/ssl_srv.c
	programs/ssl/ssl_client2.c
	programs/ssl/ssl_server2.c
	tests/ssl-opt.sh
This commit is contained in:
Manuel Pégourié-Gonnard 2015-01-22 13:30:33 +00:00
commit 3a173f497b
8 changed files with 50 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
include/polarssl/ssl.h
View File

@ -124,7 +124,7 @@
#define POLARSSL_ERR_SSL_NO_CIPHER_CHOSEN -0x7380 /**< The server has no ciphersuites in common with the client. */
#define POLARSSL_ERR_SSL_NO_RNG -0x7400 /**< No RNG was provided to the SSL module. */
#define POLARSSL_ERR_SSL_NO_CLIENT_CERTIFICATE -0x7480 /**< No client certification received from the client, but required by the authentication mode. */
#define POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 /**< Our own certificate(s) is/are too large to send in an SSL message.*/
#define POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE -0x7500 /**< Our own certificate(s) is/are too large to send in an SSL message. */
#define POLARSSL_ERR_SSL_CERTIFICATE_REQUIRED -0x7580 /**< The own certificate is not set, but needed by the server. */
#define POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED -0x7600 /**< The own private key or pre-shared key is not set, but needed. */
#define POLARSSL_ERR_SSL_CA_CHAIN_REQUIRED -0x7680 /**< No CA Chain is set, but required to operate. */

2
library/error.c
View File

@ -386,7 +386,7 @@ void polarssl_strerror( int ret, char *buf, size_t buflen )
if( use_ret == -(POLARSSL_ERR_SSL_NO_CLIENT_CERTIFICATE) )
snprintf( buf, buflen, "SSL - No client certification received from the client, but required by the authentication mode" );
if( use_ret == -(POLARSSL_ERR_SSL_CERTIFICATE_TOO_LARGE) )
snprintf( buf, buflen, "SSL - DESCRIPTION MISSING" );
snprintf( buf, buflen, "SSL - Our own certificate(s) is/are too large to send in an SSL message" );
if( use_ret == -(POLARSSL_ERR_SSL_CERTIFICATE_REQUIRED) )
snprintf( buf, buflen, "SSL - The own certificate is not set, but needed by the server" );
if( use_ret == -(POLARSSL_ERR_SSL_PRIVATE_KEY_REQUIRED) )

40
library/ssl_cli.c
View File

@ -635,16 +635,18 @@ static int ssl_write_client_hello( ssl_context *ssl )
*/
#if defined(POLARSSL_SSL_RENEGOTIATION)
if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
#endif
if( ssl->session_negotiate->ticket != NULL &&
ssl->session_negotiate->ticket_len != 0 )
{
ret = ssl->f_rng( ssl->p_rng, ssl->session_negotiate->id, 32 );
#endif
if( ssl->session_negotiate->ticket != NULL &&
ssl->session_negotiate->ticket_len != 0 )
{
ret = ssl->f_rng( ssl->p_rng, ssl->session_negotiate->id, 32 );
if( ret != 0 )
return( ret );
if( ret != 0 )
return( ret );
ssl->session_negotiate->length = n = 32;
ssl->session_negotiate->length = n = 32;
}
}
#endif /* POLARSSL_SSL_SESSION_TICKETS */
@ -691,18 +693,6 @@ static int ssl_write_client_hello( ssl_context *ssl )
q = p;
p += 2;
/*
* Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
*/
#if defined(POLARSSL_SSL_RENEGOTIATION)
if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
#endif
{
*p++ = (unsigned char)( SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
*p++ = (unsigned char)( SSL_EMPTY_RENEGOTIATION_INFO );
n++;
}
for( i = 0; ciphersuites[i] != 0; i++ )
{
ciphersuite_info = ssl_ciphersuite_from_id( ciphersuites[i] );
@ -732,6 +722,18 @@ static int ssl_write_client_hello( ssl_context *ssl )
*p++ = (unsigned char)( ciphersuites[i] );
}
/*
* Add TLS_EMPTY_RENEGOTIATION_INFO_SCSV
*/
#if defined(POLARSSL_SSL_RENEGOTIATION)
if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
#endif
{
*p++ = (unsigned char)( SSL_EMPTY_RENEGOTIATION_INFO >> 8 );
*p++ = (unsigned char)( SSL_EMPTY_RENEGOTIATION_INFO );
n++;
}
/* Some versions of OpenSSL don't handle it correctly if not at end */
#if defined(POLARSSL_SSL_FALLBACK_SCSV)
if( ssl->fallback == SSL_IS_FALLBACK )

15
library/ssl_srv.c
View File

@ -1294,10 +1294,12 @@ read_record_header:
#if defined(POLARSSL_SSL_RENEGOTIATION)
if( ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
#endif
if( ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
{
SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
return( ret );
if( ( ret = ssl_fetch_input( ssl, 5 ) ) != 0 )
{
SSL_DEBUG_RET( 1, "ssl_fetch_input", ret );
return( ret );
}
}
buf = ssl->in_hdr;
@ -1351,8 +1353,11 @@ read_record_header:
/* For DTLS if this is the initial handshake, remember the client sequence
* number to use it in our next message (RFC 6347 4.2.1) */
#if defined(POLARSSL_SSL_PROTO_DTLS)
if( ssl->transport == SSL_TRANSPORT_DATAGRAM &&
ssl->renegotiation == SSL_INITIAL_HANDSHAKE )
if( ssl->transport == SSL_TRANSPORT_DATAGRAM
#if defined(POLARSSL_SSL_RENEGOTIATION)
&& ssl->renegotiation == SSL_INITIAL_HANDSHAKE
#endif
)
{
/* Epoch should be 0 for initial handshakes */
if( ssl->in_ctr[0] != 0 || ssl->in_ctr[1] != 0 )

3
programs/ssl/ssl_client2.c
View File

@ -1487,8 +1487,7 @@ close_notify:
printf( " . Closing the connection..." );
/* No error checking, the connection might be closed already */
do
ret = ssl_close_notify( &ssl );
do ret = ssl_close_notify( &ssl );
while( ret == POLARSSL_ERR_NET_WANT_WRITE );
ret = 0;

11
programs/ssl/ssl_server2.c
View File

@ -687,7 +687,7 @@ void term_handler( int sig )
int main( int argc, char *argv[] )
{
int ret = 0, len, written, frags, exchanges;
int ret = 0, len, written, frags, exchanges_left;
int version_suites[4][2];
unsigned char buf[IO_BUF_LEN];
#if defined(POLARSSL_KEY_EXCHANGE__SOME__PSK_ENABLED)
@ -1902,7 +1902,7 @@ reset:
if( opt.exchanges == 0 )
goto close_notify;
exchanges = opt.exchanges;
exchanges_left = opt.exchanges;
data_exchange:
/*
* 6. Read the HTTP Request
@ -2042,7 +2042,7 @@ data_exchange:
* (only on the first exchange, to be able to test retransmission)
*/
#if defined(POLARSSL_SSL_RENEGOTIATION)
if( opt.renegotiate && exchanges == opt.exchanges )
if( opt.renegotiate && exchanges_left == opt.exchanges )
{
printf( " . Requestion renegotiation..." );
fflush( stdout );
@ -2115,7 +2115,7 @@ data_exchange:
/*
* 7b. Continue doing data exchanges?
*/
if( --exchanges > 0 )
if( --exchanges_left > 0 )
goto data_exchange;
/*
@ -2125,8 +2125,7 @@ close_notify:
printf( " . Closing the connection..." );
/* No error checking, the connection might be closed already */
do
ret = ssl_close_notify( &ssl );
do ret = ssl_close_notify( &ssl );
while( ret == POLARSSL_ERR_NET_WANT_WRITE );
ret = 0;

11
scripts/generate_errors.pl
View File

@ -56,13 +56,22 @@ my $hl_code_check = "";
my $headers = "";
my %error_codes_seen;
while (my $line = <GREP>)
{
next if ($line =~ /compat-1.2.h/);
my ($error_name, $error_code) = $line =~ /(POLARSSL_ERR_\w+)\s+\-(0x\w+)/;
my ($description) = $line =~ /\/\*\*< (.*?)\.? \*\//;
die "Duplicated error code: $error_code ($error_name)\n"
if( $error_codes_seen{$error_code}++ );
$description =~ s/\\/\\\\/g;
$description = "DESCRIPTION MISSING" if ($description eq "");
if ($description eq "") {
$description = "DESCRIPTION MISSING";
warn "Missing description for $error_name\n";
}
my ($module_name) = $error_name =~ /^POLARSSL_ERR_([^_]+)/;

2
tests/ssl-opt.sh
View File

@ -495,7 +495,7 @@ CLI_DELAY_FACTOR=1
# Pick a "unique" server port in the range 10000-19999, and a proxy port
PORT_BASE="0000$$"
PORT_BASE="$( echo -n $PORT_BASE | tail -c 5 )"
PORT_BASE="$( printf $PORT_BASE | tail -c 4 )"
SRV_PORT="1$PORT_BASE"
PXY_PORT="2$PORT_BASE"
unset PORT_BASE