yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-29 15:44:21 +01:00
Code Issues Packages Projects Releases Wiki Activity
488 Commits 88 Branches 205 Tags 69 MiB
8648f04e47
Commit Graph

49 Commits

Author SHA1 Message Date
Paul Bakker
8648f04e47 Potential buffer-overflow for ssl_read_record() 2013-09-11 13:16:28 +02:00
Paul Bakker
b5df3bf1b4 ssl_parse_certificate() now calls x509parse_crt_der() directly 
(cherry picked from commit 1922a4e6aa)

Conflicts:
	library/ssl_tls.c
 2013-06-19 12:08:47 +02:00
Paul Bakker
0a971b5dc8 Removed further timing differences during SSL message decryption in ssl_decrypt_buf() 
New padding checking is unbiased on correct or incorrect padding and
has no branch prediction timing differences.

The additional MAC checks further straighten out the timing differences.
(cherry picked from commit e47b34bdc8)

Conflicts:
	ChangeLog
	library/ssl_tls.c
 2013-03-11 16:08:06 +01:00
Paul Bakker
9fa6ea7cdf Fixed comment 
(cherry picked from commit 86f04f400b)
 2013-03-11 16:03:35 +01:00
Paul Bakker
48b7cb8ea2 Disable debug messages that can introduce a timing side channel. 
Introduced the POLARSSL_SSL_DEBUG_ALL flag to enable all these debug
messages in case somebody does want to see the reason checks fail.
(cherry picked from commit d66f070d49)

Conflicts:
	include/polarssl/config.h
	library/ssl_tls.c
 2013-03-11 15:59:03 +01:00
Paul Bakker
6a229c1f8c Fixed timing difference resulting from badly formatted padding. 
(cherry picked from commit 4582999be6)

Conflicts:
	ChangeLog
	library/ssl_tls.c
 2013-03-11 15:56:17 +01:00
Paul Bakker
8639578f58 - Correctly handle empty packets (Found by James Yonan) 2012-05-30 07:39:36 +00:00
Paul Bakker
e2f8ff6797 - Merged security fixes to 1.1 branch 2012-04-20 13:33:14 +00:00
Paul Bakker
e2e36d31bd - Merged changes from trunk to PolarSSL 1.1 branch 2012-01-23 09:56:51 +00:00
Paul Bakker
732e1a893c - Merged trunk into 1.1 branch 2011-12-11 16:35:09 +00:00
Paul Bakker
6c0ceb3f9a - Added permissive certificate parsing to x509parse_crt() and x509parse_crtfile(). With permissive parsing the parsing does not stop on encountering a parse-error 2011-12-04 12:24:18 +00:00
Paul Bakker
a3d195c41f - Changed the used random function pointer to more flexible format. Renamed havege_rand() to havege_random() to prevent mistakes. Lots of changes as a consequence in library code and programs 2011-11-27 21:07:34 +00:00
Paul Bakker
490ecc8c3e - Added ssl_set_max_version() to set the client's maximum sent version number 2011-10-06 13:04:09 +00:00
Paul Bakker
7eb013face - Added ssl_session_reset() to allow re-use of already set non-connection specific context information 2011-10-06 12:37:39 +00:00
Paul Bakker
8934a98f82 - Fixed memcpy() that had possible overlapping areas to memmove() 2011-08-05 11:11:53 +00:00
Paul Bakker
39bb418d93 - Made second argument of f_send() prototype and of net_send() const 2011-06-21 07:36:43 +00:00
Paul Bakker
887bd502d2 - Undid fix for ssl_write that introduced a true bug when buffers are running full. 2011-06-08 13:10:54 +00:00
Paul Bakker
831a755d9e - Changed behaviour of net_recv(), ssl_fetch_input() and ssl_read(). net_recv() now returns 0 on EOF instead of POLARSSL_ERR_NET_CONN_RESET. ssl_fetch_input() returns POLARSSL_ERR_SSL_CONN_EOF on an EOF from its f_recv() function. ssl_read() returns 0 if a POLARSSL_ERR_SSL_CONN_EOF is received after the handshake. 
- Network functions now return POLARSSL_ERR_NET_WANT_READ or POLARSSL_ERR_NET_WANT_WRITE instead of the ambiguous POLARSSL_ERR_NET_TRY_AGAIN
 2011-05-18 13:32:51 +00:00
Paul Bakker
9d781407bc - A error_strerror function() has been added to translate between error codes and their description. 
- The error codes have been remapped and combining error codes is now done with a PLUS instead of an OR as error codes used are negative.
 - Descriptions to all error codes have been added.
 - Generation script for error.c has been created to automatically generate error.c from the available error definitions in the headers.
 2011-05-09 16:17:09 +00:00
Paul Bakker
23986e5d5d - Major type rewrite of int to size_t for most variables and arguments used for buffer lengths and loops 2011-04-24 08:57:21 +00:00
Paul Bakker
af5c85fc10 - Improved portability with Microsoft Visual C 2011-04-18 03:47:52 +00:00
Paul Bakker
1fd00bfe82 - Fixed bug in ssl_write() when flushing old data (Fixes ticket #18) 2011-03-14 20:50:15 +00:00
Paul Bakker
cdf07e9979 - Information about missing or non-verified client certificate is not provided as well. 2011-01-30 17:05:13 +00:00
Paul Bakker
e3166ce040 - Renamed ciphers member of ssl_context and cipher member of ssl_session to ciphersuites and ciphersuite respectively. This clarifies the difference with the generic cipher layer and is better naming altogether 
- Adapted in the rest of using code as well
 2011-01-27 17:40:50 +00:00
Paul Bakker
43b7e35b25 - Support for PKCS#11 through the use of the pkcs11-helper library 2011-01-18 15:27:19 +00:00
Paul Bakker
72f6266f02 - Improved information provided about current Hashing, Cipher and Suite capabilities 2011-01-16 21:27:44 +00:00
Paul Bakker
43ca69c38a - Added function for stringified SSL/TLS version 2011-01-15 17:35:19 +00:00
Paul Bakker
b63b0afc05 - Added verification callback in certificate verification chain in order to allow external blacklisting 2011-01-13 17:54:59 +00:00
Paul Bakker
1b57b06751 - Added reading of DHM context from memory and file 2011-01-06 15:48:19 +00:00
Paul Bakker
2e11f7d966 - Added support for TLS v1.1 
- Renamed some SSL defines to prevent future naming confusion
 2010-07-25 14:24:53 +00:00
Paul Bakker
b96f154e51 - Fixed copyright message 2010-07-18 20:36:00 +00:00
Paul Bakker
84f12b76fc - Updated Copyright to correct entity 2010-07-18 10:13:04 +00:00
Paul Bakker
77a43580da - Added support for the SSL_EDH_RSA_AES_128_SHA and SSL_EDH_RSA_CAMELLIA_128_SHA ciphersuites 2010-06-15 21:32:46 +00:00
Paul Bakker
57b7914445 - String peer_cn in ssl context made const as well. 2010-03-24 06:51:15 +00:00
Paul Bakker
2908713af1 - Corrected behaviour 2010-03-21 21:03:34 +00:00
Paul Bakker
fc8c4360b8 - Updated copyright line to 2010 2010-03-21 17:37:16 +00:00
Paul Bakker
1f3c39c194 - Removed copyright line for Christophe Devine for clarity 2010-03-21 17:30:05 +00:00
Paul Bakker
baad6504d4 - Changed ARC4 to use seperate input/output buffer 2010-03-21 15:42:15 +00:00
Paul Bakker
ff60ee6c2a - Added const-correctness to main codebase 2010-03-16 21:09:09 +00:00
Paul Bakker
1f76115340 - Fixed bug resulting in failure to send the last certificate in the chain in ssl_write_certificate() and ssl_write_certificate_request() 2010-02-18 18:16:31 +00:00
Paul Bakker
77b385e91a - Updated copyright messages on all relevant files 2009-07-28 17:23:11 +00:00
Paul Bakker
40ea7de46d - Added CRL revocation support to x509parse_verify() 
- Fixed an off-by-one allocation in ssl_set_hostname()
 - Added CRL support to SSL/TLS code
 2009-05-03 10:18:48 +00:00
Paul Bakker
ef75f25be7 - Proper sequence of ciphersuites 2009-03-28 18:43:23 +00:00
Paul Bakker
2da561c2a1 - Moved debug message in ssl_free() before clearing of ssl context 2009-02-05 18:00:28 +00:00
Paul Bakker
785a9eeece - Added email address to header license information 2009-01-25 14:15:10 +00:00
Paul Bakker
b5ef0bada4 - Added SSL_RSA_CAMELLIA_128_SHA, SSL_RSA_CAMELLIA_256_SHA, SSL_EDH_RSA_CAMELLIA_256_SHA ciphersuites to SSL 2009-01-11 20:25:36 +00:00
Paul Bakker
e0ccd0a7c3 - Updated Copyright notices 2009-01-04 16:27:10 +00:00
Paul Bakker
40e46940df - First replacement of xyssl by polarssl where needed 2009-01-03 21:51:57 +00:00
Paul Bakker
5121ce5bdb - Renamed include directory to polarssl 2009-01-03 21:22:43 +00:00