Manuel Pégourié-Gonnard
7551cb9ee9
Replace malloc with calloc
...
- platform layer currently broken (not adapted yet)
- memmory_buffer_alloc too
2015-05-26 16:04:06 +02:00
Manuel Pégourié-Gonnard
065122cfe9
Move some defines to ssl_internal.h
2015-05-26 15:01:37 +02:00
Manuel Pégourié-Gonnard
56273daea0
Move some includes to ssl_internal.h
...
Also removed one from ssl.h and add it in programs where it belongs
2015-05-26 15:01:37 +02:00
Manuel Pégourié-Gonnard
cd4fcc6c8b
Move some structures to ssl_internal.h
2015-05-26 15:01:37 +02:00
Manuel Pégourié-Gonnard
5e94ddebbc
Create ssl_internal.h and move some functions
2015-05-26 11:57:05 +02:00
Manuel Pégourié-Gonnard
50518f4195
Rename _wrap headers to _internal
...
Makes it clearer that the user is not supposed to include them
2015-05-26 11:06:12 +02:00
Manuel Pégourié-Gonnard
4214e3a0eb
Update dependencies and documentation
2015-05-25 19:42:14 +02:00
Manuel Pégourié-Gonnard
1e9c4db524
Implement key rotation
2015-05-25 19:42:14 +02:00
Manuel Pégourié-Gonnard
887674a33b
Internal changes in preparation for key rotation
...
- two sets of keys
- separate function for key generation/update
2015-05-25 12:19:00 +02:00
Manuel Pégourié-Gonnard
a0adc1bbe4
Make cipher used in ssl tickets configurable
2015-05-25 10:35:16 +02:00
Manuel Pégourié-Gonnard
1041a39338
Use AES-GCM-256 for session ticket protection
2015-05-20 20:19:42 +02:00
Manuel Pégourié-Gonnard
0849a0a910
Make ssl ticket functions thread-safe
2015-05-20 11:34:54 +02:00
Manuel Pégourié-Gonnard
e057d3bf6b
Relax some dependencies
...
- DTLS_HELLO_VERIFY no longer depends on SRV_C
- SSL_COOKIE_C no longer depends on DTLS_HELLO_VERIFY
Not that much work for us, and easier on users (esp. since it allows just
disabling SRV_C alone).
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
b596abfdc0
Refine cli/srv ifdefs for session tickets
...
- Only the server needs to generate/parse tickets
- Only the client needs to store them
Also adjust prototype of ssl_conf_session_tickets() while at it.
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
cf141ca7e7
Fix #ifdefs on ssl_cli.c or ssl_srv.c
...
Nothing to do with the current branch except I'm going to refine such #ifdefs
for tickets next and I want to start from a clean state
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
0c0f11f4b3
Update dependencies & includes for session tickets
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
d59675d92c
Move to callback for session tickets
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
2ff873c0fa
Fix SSL_DEBUG macros
...
Avoid doubled semicolon on usage, which would be bad in non-braced "if"
branches for example.
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
b0394bebdb
Further adapt prototypes of ticket functions
...
Moving everything in ticket_keys structure, that will soon become
ticket_context.
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
69f17280d3
Adapt prototypes of ticket handling functions
...
This is an intermediate step. The ssl_config argument will be replace by a
ticket context next.
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
a4a473516e
Rename & move ticket functions to ticket module
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
fd6d8978f9
Add new submodule ssl_ticket
2015-05-20 11:14:57 +02:00
Manuel Pégourié-Gonnard
53ebe138c6
Fix copyright lines still mentioning Brainspark
2015-05-15 12:01:12 +02:00
Manuel Pégourié-Gonnard
dad1ad739d
Doc tune-ups
2015-05-14 21:58:34 +02:00
Manuel Pégourié-Gonnard
0b104b056b
Adapt prototype of net_accept() for explicit size
2015-05-14 21:58:34 +02:00
Manuel Pégourié-Gonnard
d9e6a3ac10
Rename pk_init_ctx() -> pk_setup()
2015-05-14 21:58:34 +02:00
Manuel Pégourié-Gonnard
d4f04dba42
net.c now depends on select() unconditionally
2015-05-14 21:58:34 +02:00
Manuel Pégourié-Gonnard
a63bc94a2d
Remove timing_m_sleep() -> net_usleep()
2015-05-14 21:58:34 +02:00
Manuel Pégourié-Gonnard
151dc77732
Fix some old names that remained
...
- most in doxygen doc that was never renamed
- some re-introduced in comments/doc/strings by me
2015-05-14 21:58:34 +02:00
Manuel Pégourié-Gonnard
8473f87984
Rename cipher_init_ctx() to cipher_setup()
2015-05-14 21:58:34 +02:00
Manuel Pégourié-Gonnard
66dc5555f0
mbedtls_ssl_conf_arc4_support() depends on ARC4_C
2015-05-14 12:31:10 +02:00
Manuel Pégourié-Gonnard
e391c8deda
Doc tune-up
2015-05-13 20:34:24 +02:00
Manuel Pégourié-Gonnard
70860adccc
SSL timers are no longer just for DTLS
...
Also, clean up leftover temporary stuff... embarassing
2015-05-13 10:25:28 +02:00
Manuel Pégourié-Gonnard
bbd28f7bcc
Improve SSL doc about I/O and timeouts
2015-05-13 10:21:42 +02:00
Manuel Pégourié-Gonnard
5a8d56d3a3
Rm hard dependency of DTLS on TIMING_C
2015-05-13 10:10:00 +02:00
Manuel Pégourié-Gonnard
2e01291739
Prepare the SSL modules for using timer callbacks
2015-05-13 09:43:39 +02:00
Manuel Pégourié-Gonnard
ca3bdc5632
Add mbedtls_timing_set/get_delay()
2015-05-12 20:45:34 +02:00
Manuel Pégourié-Gonnard
8903fe0fd3
Define timing_selftest() even with TIMING_ALT
2015-05-12 19:30:45 +02:00
Manuel Pégourié-Gonnard
31993f271d
Add per-function override for AES
2015-05-12 15:41:08 +02:00
Manuel Pégourié-Gonnard
70a5010783
Create function-level MBETLS_DES_xxx_ALT
2015-05-12 15:17:15 +02:00
Manuel Pégourié-Gonnard
e45dba47b5
Remove unused member in des_context
2015-05-12 14:54:15 +02:00
Manuel Pégourié-Gonnard
d1a82603ad
Tune comments in config.h
2015-05-12 14:20:23 +02:00
Manuel Pégourié-Gonnard
eecb43cf0b
Manually merge doc fixes from 1.3
2015-05-12 12:56:41 +02:00
Manuel Pégourié-Gonnard
48647b9255
Merge remote-tracking branch 'nw/misc' into mbedtls-1.3
...
* nw/misc:
Typos and doc additions
2015-05-12 12:48:12 +02:00
Manuel Pégourié-Gonnard
43b37cbc92
Fix use of pem_read_buffer() in PK, DHM and X509
2015-05-12 11:26:43 +02:00
Manuel Pégourié-Gonnard
e6ef16f98c
Change X.509 verify flags to uint32_t
2015-05-11 19:54:43 +02:00
Manuel Pégourié-Gonnard
e3a062ba1f
Rename ecp_use_known_dp -> mbedtls_ecp_group_load()
2015-05-11 18:46:47 +02:00
Manuel Pégourié-Gonnard
56cc88a796
Rm ecp_add() and add ecp_muladd()
2015-05-11 18:40:45 +02:00
Manuel Pégourié-Gonnard
6dde596a03
Remove ecp_sub()
2015-05-11 18:18:32 +02:00
Manuel Pégourié-Gonnard
aff37e5aa1
Remove ecp_group_read_string()
2015-05-11 18:11:57 +02:00
Manuel Pégourié-Gonnard
06939cebef
Fix order of ssl_conf vs ssl_setup in programs
...
Except ssl_phtread_server that will be done later
2015-05-11 14:35:42 +02:00
Manuel Pégourié-Gonnard
01e5e8c1f8
Change a few ssl_conf return types to void
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
6729e79482
Rename ssl_set_xxx() to ssl_conf_xxx()
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
22bfa4bb53
Add ssl_set_hs_ca_chain()
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
1897af9e93
Make conf const inside ssl_context (finally)
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
17a40cd255
Change ssl_own_cert to work on ssl_config
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
1af6c8500b
Add ssl_set_hs_own_cert()
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
8f618a8e65
Rework ssl_set_own_cert() internals
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
120fdbdb3d
Change ssl_set_psk() to act on ssl_config
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
4b68296626
Use a specific function in the PSK callback
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
0a4fb09534
Make xxx_drbg_random() thread-safe
2015-05-11 14:35:41 +02:00
Manuel Pégourié-Gonnard
750e4d7769
Move ssl_set_rng() to act on config
2015-05-11 12:33:27 +02:00
Manuel Pégourié-Gonnard
5cb3308e5f
Merge contexts for session cache
2015-05-11 12:33:27 +02:00
Manuel Pégourié-Gonnard
ae31914990
Rename ssl_legacy_renegotiation() to ssl_set_...
2015-05-11 12:33:27 +02:00
Manuel Pégourié-Gonnard
662c6e8cdd
Disable truncated HMAC by default
2015-05-11 12:33:27 +02:00
Manuel Pégourié-Gonnard
1028b74cff
Upgrade default DHM params size
2015-05-11 12:33:27 +02:00
Manuel Pégourié-Gonnard
8836994f6b
Move WANT_READ/WANT_WRITE codes to SSL
2015-05-11 12:33:26 +02:00
Manuel Pégourié-Gonnard
1b511f93c6
Rename ssl_set_bio_timeout() to set_bio()
...
Initially thought it was best to keep the old function around and add a new
one, but this so many ssl_set_xxx() functions are changing anyway...
2015-05-11 12:33:26 +02:00
Manuel Pégourié-Gonnard
97fd52c529
Split ssl_set_read_timeout() out of bio_timeout()
2015-05-11 12:33:26 +02:00
Manuel Pégourié-Gonnard
cc3195e81f
Fix misplaced #ifdef
2015-05-11 12:33:26 +02:00
Manuel Pégourié-Gonnard
8620f73cdc
Documentation tune-ups
2015-05-11 12:33:26 +02:00
Manuel Pégourié-Gonnard
bc2b771af4
Move ssl_set_ca_chain() to work on config
2015-05-11 12:33:26 +02:00
Nicholas Wilson
d0fa5ccbb0
Typos and doc additions
2015-05-11 10:44:11 +01:00
Manuel Pégourié-Gonnard
ba26c24769
Change how hostname is stored internally
2015-05-07 10:19:14 +01:00
Manuel Pégourié-Gonnard
2b49445876
Move session ticket keys to conf
...
This is temporary, they will soon be replaced by callbacks.
!!! In this intermediate step security is removed !!!
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
e51bba05cf
Make mfl_code a bitfield member
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
684b0592cb
Move ssl_set_fallback() to work on conf
...
Initially thought it would be per-connection, but since max_version is in conf
too, and you need to lower that for a fallback connection, the fallback flag
should be in the same place
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
6bf89d6ad9
Move ssl_set_max_fragment_len to work on conf
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
17eab2b65c
Move set_cbc_record_splitting() to conf
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
d36e33fc07
Move easy ssl_set_xxx() functions to work on conf
...
mbedtls_ssl_set_alpn_protocols
mbedtls_ssl_set_arc4_support
mbedtls_ssl_set_authmode
mbedtls_ssl_set_ciphersuites
mbedtls_ssl_set_ciphersuites_for_version
mbedtls_ssl_set_curves
mbedtls_ssl_set_dbg
mbedtls_ssl_set_dh_param
mbedtls_ssl_set_dh_param_ctx
mbedtls_ssl_set_dtls_anti_replay
mbedtls_ssl_set_dtls_badmac_limit
mbedtls_ssl_set_dtls_cookies
mbedtls_ssl_set_encrypt_then_mac
mbedtls_ssl_set_endpoint
mbedtls_ssl_set_extended_master_secret
mbedtls_ssl_set_handshake_timeout
mbedtls_ssl_legacy_renegotiation
mbedtls_ssl_set_max_version
mbedtls_ssl_set_min_version
mbedtls_ssl_set_psk_cb
mbedtls_ssl_set_renegotiation
mbedtls_ssl_set_renegotiation_enforced
mbedtls_ssl_set_renegotiation_period
mbedtls_ssl_set_session_cache
mbedtls_ssl_set_session_ticket_lifetime
mbedtls_ssl_set_sni
mbedtls_ssl_set_transport
mbedtls_ssl_set_truncated_hmac
mbedtls_ssl_set_verify
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
419d5ae419
Make endpoint+transport args of config_defaults()
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
def0bbe3ab
Allocate ssl_config out of ssl_setup()
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
cd523e2a5e
Introduce mbedtls_ssl_config_{init,defaults,free}()
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
7ca4e4dc79
Move things to conf substructure
...
A simple series of sed invocations.
This is the first step, purely internal changes. The conf substructure is not
ready to be shared between contexts yet.
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
fa6473d79b
Create structure ssl_config
2015-05-07 10:19:13 +01:00
Manuel Pégourié-Gonnard
5a74e8bf19
Make struct cipher_base_t opaque
2015-05-06 17:10:55 +01:00
Manuel Pégourié-Gonnard
da61ed3346
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Include changes from the 1.2 branch
Remove unused headers in o_p_test
Add countermeasure against cache-based lucky 13
Make results of (ext)KeyUsage accessible
Fix missing NULL check in MPI
Fix detection of getrandom()
Fix "make install" handling of symlinks
Fix bugs in programs displaying verify flags
Conflicts:
Makefile
include/polarssl/ssl.h
library/entropy_poll.c
library/ssl_srv.c
library/ssl_tls.c
programs/test/o_p_test.c
programs/test/ssl_cert_test.c
programs/x509/cert_app.c
2015-04-30 10:38:44 +02:00
Manuel Pégourié-Gonnard
e16b62c3a9
Make results of (ext)KeyUsage accessible
2015-04-29 17:07:31 +02:00
Manuel Pégourié-Gonnard
770b5e1e9e
Fix missing NULL check in MPI
2015-04-29 17:02:01 +02:00
Manuel Pégourié-Gonnard
1e2eae02cb
Adapt pthread implementation to recent changes
2015-04-29 02:08:34 +02:00
Manuel Pégourié-Gonnard
eab147c4d0
Rename pkcs11_xxx_init() to bind()
2015-04-29 02:08:34 +02:00
Manuel Pégourié-Gonnard
69a69cc5ae
memory_buffer_alloc_init() now returns void
2015-04-29 02:08:34 +02:00
Manuel Pégourié-Gonnard
41d479e7df
Split ssl_init() -> ssl_setup()
2015-04-29 02:08:34 +02:00
Manuel Pégourié-Gonnard
8d128efd48
Split mbedtls_ctr_drbg_init() -> seed()
2015-04-28 22:38:08 +02:00
Manuel Pégourié-Gonnard
f9e9481bc5
Split mbedtls_hmac_drbg_init() -> seed{,_buf}()
2015-04-28 22:07:14 +02:00
Manuel Pégourié-Gonnard
c34e8dd265
Split mbedtls_gcm_init() -> gcm_setkey()
2015-04-28 21:42:17 +02:00
Manuel Pégourié-Gonnard
6963ff0969
Split mbedtls_ccm_init() -> setkey()
2015-04-28 18:02:54 +02:00
Manuel Pégourié-Gonnard
8f5fd31212
Change mutex_init/free to return void
2015-04-24 14:42:34 +02:00
Manuel Pégourié-Gonnard
331ba5778a
Fix some additional renaming issues
2015-04-20 12:33:57 +01:00
Manuel Pégourié-Gonnard
e6028c93f5
Fix some X509 macro names
...
For some reason, during the great renaming, some names that should have been
prefixed with MBEDTLS_X509_ have only been prefixed with MBEDTLS_
2015-04-20 12:19:02 +01:00
Manuel Pégourié-Gonnard
e75fa70b36
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Make results of (ext)KeyUsage accessible
Use x509_crt_verify_info() in programs
Add x509_crt_verify_info()
Conflicts:
ChangeLog
include/mbedtls/x509_crt.h
include/polarssl/ssl.h
include/polarssl/x509.h
library/ssl_srv.c
library/ssl_tls.c
library/x509_crt.c
programs/ssl/ssl_client1.c
programs/ssl/ssl_client2.c
programs/ssl/ssl_mail_client.c
programs/ssl/ssl_server2.c
programs/test/ssl_cert_test.c
programs/x509/cert_app.c
tests/ssl-opt.sh
tests/suites/test_suite_x509parse.function
2015-04-20 11:51:34 +01:00
Manuel Pégourié-Gonnard
e6efa6f54e
manually merge 9f98251
make extKeyUsage accessible
2015-04-20 11:23:24 +01:00
Manuel Pégourié-Gonnard
b5f48ad82f
manually merge 39a183a
add x509_crt_verify_info()
2015-04-20 11:22:57 +01:00
Manuel Pégourié-Gonnard
9f98251e72
Make results of (ext)KeyUsage accessible
2015-04-17 19:57:21 +02:00
Manuel Pégourié-Gonnard
39a183a629
Add x509_crt_verify_info()
2015-04-17 17:24:25 +02:00
Manuel Pégourié-Gonnard
ab22910191
Just use stdint.h even with MSVC
2015-04-15 11:58:31 +02:00
Manuel Pégourié-Gonnard
862d503c01
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Fix typos in Changelog
Fix macro name from wrong branch
Fix bug in pk_parse_key()
Fixed typos
Updated Travis CI config for mbedtls project
Conflicts:
include/mbedtls/ecp.h
include/polarssl/compat-1.2.h
include/polarssl/openssl.h
include/polarssl/platform.h
library/pkparse.c
programs/pkey/mpi_demo.c
2015-04-15 11:30:46 +02:00
Manuel Pégourié-Gonnard
a1e32415d5
Fix macro name from wrong branch
2015-04-15 11:21:24 +02:00
Paul Bakker
6152b0267c
Fixed typos
2015-04-14 15:00:09 +02:00
Manuel Pégourié-Gonnard
eed55a4d51
Changed values of PK and PKCS5 error codes
2015-04-10 11:34:22 +02:00
Manuel Pégourié-Gonnard
975d5fa206
Remove option HAVE_LONGLONG
2015-04-10 11:34:22 +02:00
Manuel Pégourié-Gonnard
7b53889f05
Remove support for HAVE_INT8 and HAVE_INT16
2015-04-10 11:34:22 +02:00
Manuel Pégourié-Gonnard
b31424c86a
Make HAVE_IPV6 non-optional
2015-04-09 16:42:38 +02:00
Manuel Pégourié-Gonnard
23ce09b18f
Deprecate HAVE_INT8 and HAVE_INT16
2015-04-09 14:51:51 +02:00
Manuel Pégourié-Gonnard
a98af5e2b2
Deprecate using NET_C without HAVE_IPV6
2015-04-09 14:40:46 +02:00
Manuel Pégourié-Gonnard
8c3f0f4c16
Official deprecate compat-1.2.h and openssl.h
2015-04-09 14:10:26 +02:00
Manuel Pégourié-Gonnard
a79efde184
Move a pair of macros to inline functions
2015-04-09 11:02:09 +02:00
Manuel Pégourié-Gonnard
f2c8711088
Add compat-1.3.h for new names
2015-04-08 20:13:33 +02:00
Manuel Pégourié-Gonnard
2cf5a7c98e
The Great Renaming
...
A simple execution of tmp/invoke-rename.pl
2015-04-08 13:25:31 +02:00
Manuel Pégourié-Gonnard
f5fc64997c
Cosmetic change
...
Make one of the name listing scripts happier
2015-04-03 18:46:55 +02:00
Manuel Pégourié-Gonnard
8a89fcd13f
Rm references to removed config options
...
POLARSSL_MEMORY_C POLARSSL_PBKDF2_C DISABLE_RENEGO
2015-04-03 18:46:55 +02:00
Manuel Pégourié-Gonnard
932e3934bd
Fix typos & Co
2015-04-03 18:46:55 +02:00
Manuel Pégourié-Gonnard
62edcc8176
Document POLARSSL_CAMELLIA_SMALL_MEMORY
2015-04-03 18:46:55 +02:00
Manuel Pégourié-Gonnard
a82135c5cf
Document POLARSSL_CAMELLIA_SMALL_MEMORY
2015-04-03 17:58:26 +02:00
Manuel Pégourié-Gonnard
fbbbc933fc
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Fix ifdef issue
2015-04-02 14:17:42 +01:00
Manuel Pégourié-Gonnard
2a73a901d6
Fix ifdef issue
2015-04-02 14:16:45 +01:00
Manuel Pégourié-Gonnard
427b672551
Add XXX_PROCESS_ALT mecchanism
2015-03-31 18:32:50 +02:00
Manuel Pégourié-Gonnard
26c9f90cae
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Add missing depends in x509 programs
Simplify ifdef checks in programs/x509
Fix thread safety issue in RSA operations
Add test certificate for bitstring in DN
Add support for X.520 uniqueIdentifier
Accept bitstrings in X.509 names
2015-03-31 17:56:15 +02:00
Manuel Pégourié-Gonnard
c89d6cf77c
Make pk_info_t opaque
2015-03-31 14:43:19 +02:00
Manuel Pégourié-Gonnard
8c8be1ebbb
Change default min TLS version to TLS 1.0
2015-03-31 14:22:30 +02:00
Manuel Pégourié-Gonnard
d16df8f60a
Cleanup unused bit in ssl
...
Became unused when removing deprecated ssl_set_own_cert_xxx() functions
2015-03-31 14:04:51 +02:00
Manuel Pégourié-Gonnard
348bcb3694
Make RSA_ALT support optionnal
2015-03-31 14:01:33 +02:00
Manuel Pégourié-Gonnard
8fce937a1a
Simplify ecdsa_context
2015-03-31 13:06:41 +02:00
Manuel Pégourié-Gonnard
49ce6f0973
Fix constness of asn1_write_mpi()
2015-03-31 13:05:39 +02:00
Manuel Pégourié-Gonnard
5bf262d710
Doc fixes
2015-03-31 11:46:01 +02:00
Manuel Pégourié-Gonnard
dfdcac9d51
Merge ecdsa_write_signature{,_det}() together
2015-03-31 11:41:42 +02:00
Manuel Pégourié-Gonnard
63e931902b
Make a helpful constant public
2015-03-31 11:15:48 +02:00
Manuel Pégourié-Gonnard
b8cfe3f0d9
pk_sign() now requires non-NONE md_alg for ECDSA
2015-03-31 11:14:41 +02:00
Manuel Pégourié-Gonnard
fa44f20b9f
Change authmode default to Required on client
2015-03-27 17:52:25 +01:00
Manuel Pégourié-Gonnard
1d0ca1a336
Move key_usage to more that 8 bits
2015-03-27 16:50:00 +01:00
Manuel Pégourié-Gonnard
1022fed36e
Remove redundant sig_oid2 in x509 structures
2015-03-27 16:34:42 +01:00
Manuel Pégourié-Gonnard
9409e0cea2
Add support for X.520 uniqueIdentifier
2015-03-27 13:03:54 +01:00
Manuel Pégourié-Gonnard
da1619d345
CERTS_C no longer depends on PEM_PARSE_C
2015-03-27 10:58:20 +01:00
Manuel Pégourié-Gonnard
a958d69a70
Rename test_ca_list to test_cas_pem
2015-03-27 10:29:25 +01:00
Manuel Pégourié-Gonnard
2f165060f0
Start introducing test_cas NULL-terminated list
2015-03-27 10:20:26 +01:00
Manuel Pégourié-Gonnard
75f901006b
Add len constants to certs.c
2015-03-27 09:56:18 +01:00
Manuel Pégourié-Gonnard
eca510fac2
Rework documentation of MD layer
...
- avoid overuse of generic terms such as "initialize"
- spell out the succession of functions
2015-03-26 12:26:34 +01:00
Manuel Pégourié-Gonnard
147fa097e2
Reintroduce md_init_ctx compatibility wrapper
2015-03-25 21:55:56 +01:00
Manuel Pégourié-Gonnard
abb674467b
Rename md_init_ctx() to md_setup()
2015-03-25 21:55:56 +01:00
Manuel Pégourié-Gonnard
a77edade0c
Clean up unneeded things
2015-03-25 21:55:56 +01:00
Manuel Pégourié-Gonnard
4063ceb281
Make hmac_ctx optional
...
Note from future self: actually md_init_ctx will be re-introduced with the
same signature later, and a new function with the additional argument will be
added.
2015-03-25 21:55:56 +01:00
Manuel Pégourié-Gonnard
dfb3dc8b53
Make ipad/opad dynamic and more opaque
2015-03-25 21:55:56 +01:00
Manuel Pégourié-Gonnard
80c988ba79
Remove ipad and opad from specific md contexts
2015-03-25 21:55:56 +01:00
Manuel Pégourié-Gonnard
4da88c50c1
Remove specific xxx_hmac functions
2015-03-25 21:55:56 +01:00
Manuel Pégourié-Gonnard
0a8896ad6f
Remove references to xxx_hmac() from MD layer
2015-03-25 21:37:15 +01:00
Manuel Pégourié-Gonnard
8379a82a76
Implement hmac in the MD layer
2015-03-25 21:37:15 +01:00
Manuel Pégourié-Gonnard
ca878dbaa5
Make md_info_t an opaque structure
...
- more freedom for us to change it in the future
- enforces hygiene
- performance impact of making accessors no longer inline should really be
negligible
2015-03-25 21:37:15 +01:00
Manuel Pégourié-Gonnard
9a65e80e4f
Properly mark ssl_set_bio() as deprecated
2015-03-25 18:09:46 +01:00
Manuel Pégourié-Gonnard
29c28f961d
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Fix gcc detection in check_config.h
2015-03-23 15:27:25 +01:00
Manuel Pégourié-Gonnard
757ca00396
Fix gcc detection in check_config.h
2015-03-23 15:24:07 +01:00
Manuel Pégourié-Gonnard
d81562ffc0
Remove RC4 ciphersuites by default
2015-03-23 14:51:08 +01:00
Manuel Pégourié-Gonnard
8a80318df2
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Update generated file
Update Changelog for deprecation config flags
Fix tests to work with DEPRECATED_REMOVED
Add POLARSSL_DEPRECATED_{WARNING,REMOVED}
Suppress clang warning we don't want
2015-03-23 14:31:25 +01:00
Manuel Pégourié-Gonnard
c70581c272
Add POLARSSL_DEPRECATED_{WARNING,REMOVED}
2015-03-23 14:11:11 +01:00
Manuel Pégourié-Gonnard
849b174e57
Disable RC4 by default in the library
2015-03-20 19:14:19 +00:00
Manuel Pégourié-Gonnard
47723147f5
Remove functions deprecated in 1.3
2015-03-20 18:21:12 +00:00
Manuel Pégourié-Gonnard
1e5e819d31
Fix forgotten merge conflict
2015-03-20 17:46:17 +00:00
Manuel Pégourié-Gonnard
7c4e60fa7d
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Mark a few additional deprecations
Use proper doxygen markup to mark deprecations
Add -fdata-sections in memory.sh too
2015-03-20 17:30:31 +00:00
Manuel Pégourié-Gonnard
e658176dfa
Mark a few additional deprecations
2015-03-20 17:26:50 +00:00
Manuel Pégourié-Gonnard
71432849ed
Use proper doxygen markup to mark deprecations
2015-03-20 17:26:50 +00:00
Manuel Pégourié-Gonnard
a78b218042
Fix contness of debug_print_buf()
2015-03-19 17:16:11 +00:00
Manuel Pégourié-Gonnard
6e0643762d
Reverse meaning of OID_CMP
2015-03-19 16:54:56 +00:00
Manuel Pégourié-Gonnard
852a6d3d8f
Rename ssl.renegotiation to ssl.renego_status
2015-03-19 16:15:20 +00:00
Manuel Pégourié-Gonnard
240b092a6c
Drop dummy self_test functions
2015-03-19 15:30:28 +00:00
Manuel Pégourié-Gonnard
8d92cedd11
Fix constness issue in pkcs5_pbes2()
2015-03-19 15:21:13 +00:00
Manuel Pégourié-Gonnard
0db107e4ba
Fix pk_can_do() constness issue
2015-03-19 14:01:57 +00:00
Manuel Pégourié-Gonnard
fa8aebcbcc
Fix a constness issue
2015-03-19 13:38:17 +00:00
Manuel Pégourié-Gonnard
35f1d7f0aa
Update signature of mpi_mul_mpi()
2015-03-19 12:42:40 +00:00
Manuel Pégourié-Gonnard
b6b16bddc3
Drop pbkdf2 module (superseded by pkcs5)
2015-03-11 11:31:51 +00:00
Manuel Pégourié-Gonnard
f9c1387b9d
Drop POLARSSL_ERROR_STRERROR_BC
2015-03-11 10:59:38 +00:00
Manuel Pégourié-Gonnard
fc51f40a1a
Remove compatibility header memory.h
2015-03-11 10:46:35 +00:00
Manuel Pégourié-Gonnard
57a26da593
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Use link-time garbage collection in memory.sh
scripts/memory.sh only work on Linux
Add missing 'const' on selftest data
Use only headers for doxygen (no doc in C files)
Add missing extern "C" guard in aesni.h
Fix compile error with renego disabled
Remove slow PKCS5 test
Stop checking key-cert match systematically
Make tests/*.sh runnable from anywhere
Update visual C files
2015-03-11 10:30:21 +00:00
Manuel Pégourié-Gonnard
1a90147dc5
Add missing extern "C" guard in aesni.h
2015-03-10 16:12:29 +00:00
Manuel Pégourié-Gonnard
265dd5c20b
Disable support for SSLv2 ClientHello by default
2015-03-10 13:48:34 +00:00
Manuel Pégourié-Gonnard
3b2c0d6162
Add comments on some renego flags
2015-03-10 13:20:49 +00:00
Manuel Pégourié-Gonnard
69849f8595
Drop renego state from context if no renego support
2015-03-10 11:54:02 +00:00
Manuel Pégourié-Gonnard
55f968b2c9
Switch renego define from disable to enable
2015-03-10 11:30:43 +00:00
Manuel Pégourié-Gonnard
83b04de09b
Rename a few incidental references to PolarSSL
2015-03-10 11:23:56 +00:00
Manuel Pégourié-Gonnard
7f8099773e
Rename include directory to mbedtls
2015-03-10 11:23:56 +00:00
Manuel Pégourié-Gonnard
ed99d70309
Rename macro to avoid possible future collision
2015-03-09 13:05:06 +00:00
Manuel Pégourié-Gonnard
2f5a1b4e55
Rename SSL_RENEGOTIATION macro
...
- new name is more explicit
- avoids collision with POLARSSL_SSL_RENEGOTIATION config flag when prefixing
will be applied
2015-03-09 13:05:06 +00:00
Manuel Pégourié-Gonnard
e7e906de13
Normalize a few more name references
2015-03-09 13:05:06 +00:00
Manuel Pégourié-Gonnard
9b6699066e
Fix typos in macro names
2015-03-09 13:05:06 +00:00
Manuel Pégourié-Gonnard
35ac8eb35a
Remove comments about old names
...
(Annoying for the Great Renaming)
2015-03-09 13:05:06 +00:00
Manuel Pégourié-Gonnard
34be402270
Rm obsolete things (compat-1.2, openssl, etc)
2015-03-09 13:05:06 +00:00
Manuel Pégourié-Gonnard
e4d4890350
Finish renaming website
2015-03-06 13:40:52 +00:00
Manuel Pégourié-Gonnard
998897be3d
Merge branch 'mbedtls-1.3' into development
...
* mbedtls-1.3:
Rename website and repository
Move private macro from header to C file
Add some missing 'static' on a few objects
Fix whitespace issues
Minor portability fix in benchmark
2015-03-06 13:25:41 +00:00
Manuel Pégourié-Gonnard
fe44643b0e
Rename website and repository
2015-03-06 13:17:10 +00:00
Manuel Pégourié-Gonnard
1dd1674559
Move private macro from header to C file
2015-03-06 12:01:27 +00:00
Manuel Pégourié-Gonnard
fb57e644a7
Fix whitespace issues
2015-03-06 11:56:40 +00:00
Manuel Pégourié-Gonnard
b63e3dd752
Fix typo in comments
2015-03-06 09:42:40 +00:00
Manuel Pégourié-Gonnard
d901d17817
Merge branch 'development' into dtls
...
* development: (100 commits)
Update Changelog for the mem-measure branch
Fix issues introduced when rebasing
Fix compile error in memory_buffer_alloc_selftest
Code cosmetics
Add curve25519 to ecc-heap.sh
Add curve25519 to the benchmark program
Fix compile issue when buffer_alloc not available
New script ecc-heap.sh
Fix unused variable issue in some configs
Rm usunused member in private struct
Add heap usage for PK in benchmark
Use memory_buffer_alloc() in benchmark if available
Only define mode_func if mode is enabled (CBC etc)
PKCS8 encrypted key depend on PKCS5 or PKCS12
Disable SRV_C for client measurement
Output stack+heap usage with massif
Enable NIST_OPTIM by default for config-suite-b
Refactor memory.sh
Adapt memory.sh to config-suite-b
Adapt mini-client for config-suite-b.h
...
Conflicts:
ChangeLog
include/polarssl/net.h
library/Makefile
library/error.c
library/ssl_tls.c
programs/Makefile
programs/ssl/ssl_client2.c
programs/ssl/ssl_server2.c
tests/Makefile
2015-02-16 18:44:39 +00:00
Manuel Pégourié-Gonnard
50da0482e0
Add heap usage for PK in benchmark
2015-02-16 17:28:10 +00:00
Manuel Pégourié-Gonnard
b8ca723154
Only define mode_func if mode is enabled (CBC etc)
2015-02-16 17:23:59 +00:00
Manuel Pégourié-Gonnard
ac1f76c362
Merge remote-tracking branch 'rich/platform' into development
...
* rich/platform:
Remove dependency on sscanf in lib x509
Fix extra guard in memory_buffer_alloc
rebase from development
implemented macro overriding for polarssl_* library functions
fix bug introduced by the addition of snprintf and assert macro which caused tests to fail without polarssl_platform_c defined
add initial symbols to config and checks to check_config to allow use of macros to define standard functions
reformat and arrange additions to config alphabetically
add missing checks to check_config
add macro definition of assert using polarssl_exit
modify library/memory_buffer_alloc.c, benchmark.c and the tests main code to use polarssl_exit
add POLARSSL_PLATFORM_EXIT_ALT
modify scripts/* and tests/* to use polarssl_snprintf
modify programs/*.c to use polarssl_snprintf
modify library/debug.c to use polarssl_snprintf
modify library/x509*.c to use polarssl_snprintf
modify library/net.c to use polarssl_snprintf
modify oid.c to use polarssl_snprintf
add platform_set_snprintf
Conflicts:
library/memory_buffer_alloc.c
programs/pkey/pk_sign.c
programs/pkey/pk_verify.c
programs/pkey/rsa_sign_pss.c
programs/pkey/rsa_verify_pss.c
programs/ssl/ssl_client2.c
programs/ssl/ssl_pthread_server.c
programs/test/benchmark.c
programs/test/ssl_cert_test.c
2015-02-13 15:11:24 +00:00
Manuel Pégourié-Gonnard
6c5abfa42b
Style: fix trailing spaces
2015-02-13 14:12:07 +00:00
Manuel Pégourié-Gonnard
013bffe5a7
Style: add spaces before line continuation
2015-02-13 14:09:44 +00:00
Rich Evans
401bb90ac0
rebase from development
2015-02-13 13:50:26 +00:00
Rich Evans
16f8cd8e87
implemented macro overriding for polarssl_* library functions
2015-02-13 13:50:26 +00:00
Rich Evans
4cc8a22d88
add initial symbols to config and checks to check_config to allow use of macros to define standard functions
2015-02-13 13:50:26 +00:00
Rich Evans
98081c5ec6
reformat and arrange additions to config alphabetically
2015-02-13 13:50:26 +00:00
Rich Evans
c0b6da3b43
add missing checks to check_config
2015-02-13 13:50:26 +00:00
Rich Evans
c39cb4986b
add POLARSSL_PLATFORM_EXIT_ALT
2015-02-13 13:50:26 +00:00
Rich Evans
46b0a8d15a
add platform_set_snprintf
2015-02-13 13:50:25 +00:00
Manuel Pégourié-Gonnard
dda5213982
Fix harmless warnings with mingw in timing.c
2015-02-11 12:33:40 +00:00
Rich Evans
00ab47026b
cleanup library and some basic tests. Includes, add guards to includes
2015-02-10 11:28:46 +00:00
Rich Evans
e83ac1d7d1
modify include .gitignore to ignore check_config generated when build fails due to incorrect config
2015-02-10 10:14:15 +00:00
Paul Bakker
daae3b749b
Prepare for mbed TLS 1.3.10 release
2015-02-08 15:49:54 +01:00
Manuel Pégourié-Gonnard
4eaf8f02bb
Merge branch 'development' into dtls
...
* development:
Support composite RDNs in X.509 certs parsing
2015-02-05 11:01:37 +00:00
Manuel Pégourié-Gonnard
555fbf8758
Support composite RDNs in X.509 certs parsing
2015-02-04 17:11:55 +00:00
Manuel Pégourié-Gonnard
3d2c4b70f2
Fix url in new files
2015-01-29 11:34:14 +00:00
Manuel Pégourié-Gonnard
2a0718d947
Merge branch 'development' into dtls
...
* development: (46 commits)
Fix url again
Fix small bug in base64_encode()
Fix depend that was checked but not documented
Fix dependency that was not checked
Minor gitginore fixes
Move some ignore patterns to subdirectories
Ignore CMake/MSVC-related build files.
Re-categorize changelog entry
Fix misattribution
Minor nits with stdout/stderr.
Add cmake compatibility targets
Add script for polarssl symlink creation
Fix more stdio inclusion issues
Add debug info for cert/suite selection
Fix possible portability issue
Fix bug in ssl_get_verify_result()
aescrypt2.c local char array not initial
Update Changelog
Fix mips64 bignum implementation
Fix usage string of ssl_client2
...
Conflicts:
include/polarssl/ssl.h
library/CMakeLists.txt
library/Makefile
programs/Makefile
programs/ssl/ssl_client2.c
programs/ssl/ssl_server2.c
visualc/VS2010/PolarSSL.sln
visualc/VS2010/mbedTLS.vcxproj
visualc/VS6/mbedtls.dsp
visualc/VS6/mbedtls.dsw
2015-01-29 11:29:12 +00:00
Manuel Pégourié-Gonnard
860b51642d
Fix url again
2015-01-28 17:12:07 +00:00
Manuel Pégourié-Gonnard
bbbb3cfba5
Fix depend that was checked but not documented
2015-01-28 16:44:37 +00:00
Manuel Pégourié-Gonnard
94de33140b
Fix dependency that was not checked
2015-01-28 16:32:36 +00:00
Manuel Pégourié-Gonnard
3f738ca40a
Move some ignore patterns to subdirectories
2015-01-28 15:33:23 +00:00
Manuel Pégourié-Gonnard
607d663b41
Add debug info for cert/suite selection
2015-01-28 15:28:30 +01:00
Manuel Pégourié-Gonnard
e89163c0a8
Fix bug in ssl_get_verify_result()
2015-01-28 15:28:30 +01:00
James Cowgill
d1e7e8ba05
Fix mips64 bignum implementation
...
- Use correct mips64 define (__mips64, not __mips64__).
- Added mips64 to the list of arches supporting 64-bit ints.
2015-01-28 15:28:29 +01:00
Manuel Pégourié-Gonnard
e94e6e5b9c
Fix stdio (non-)inclusion issues.
2015-01-28 15:28:28 +01:00
Manuel Pégourié-Gonnard
9014b6f227
Rename project in CMake
...
TODO: to create symlinks to the old names!
2015-01-27 15:44:46 +00:00
Manuel Pégourié-Gonnard
0a155b826c
Fix bug with compatibility memory define/header
2015-01-23 17:28:27 +00:00
Manuel Pégourié-Gonnard
2be147a9cb
Improve documentation of CBC functions
2015-01-23 16:23:13 +00:00
Manuel Pégourié-Gonnard
cfa9a45dd6
Rename in cmake help strings
2015-01-23 13:33:31 +00:00
Manuel Pégourié-Gonnard
dba564bc79
Fix files that are not in development
2015-01-23 11:37:14 +00:00
Manuel Pégourié-Gonnard
df6411d8d8
Merge branch 'development' into dtls
...
* development:
Fix website url to use https.
Remove maintainer line.
Remove redundant "all rights reserved"
2015-01-23 11:23:08 +00:00
Manuel Pégourié-Gonnard
085ab040aa
Fix website url to use https.
2015-01-23 11:06:27 +00:00
Manuel Pégourié-Gonnard
9698f5852c
Remove maintainer line.
2015-01-23 10:59:00 +00:00
Manuel Pégourié-Gonnard
19f6b5dfaa
Remove redundant "all rights reserved"
2015-01-23 10:54:00 +00:00
Manuel Pégourié-Gonnard
eab72e2ced
Merge branch 'development' into dtls
...
* development:
Update copyright
Fix issue in compat.sh
Rename doxyfile
Rename to mbed TLS in tests/
Rename to mbed TLS in examples
Remove old test certificates.
Rename to mbed TLS in the documentation/comments
Change name to mbed TLS in the copyright notice
Conflicts:
doxygen/input/doc_mainpage.h
doxygen/mbedtls.doxyfile
include/polarssl/version.h
tests/compat.sh
2015-01-23 10:23:17 +00:00
Manuel Pégourié-Gonnard
a658a4051b
Update copyright
2015-01-23 09:55:24 +00:00
Manuel Pégourié-Gonnard
b4fe3cb1fa
Rename to mbed TLS in the documentation/comments
2015-01-22 16:11:05 +00:00
Manuel Pégourié-Gonnard
967a2a5f8c
Change name to mbed TLS in the copyright notice
2015-01-22 14:28:16 +00:00
Manuel Pégourié-Gonnard
3a173f497b
Merge branch 'development' into dtls
...
* development:
Fix error code description.
generate_errors.pl now errors on duplicate codes
Avoid nested if's without braces.
Move renego SCSV after actual ciphersuites
Fix send_close_notify usage.
Rename variable for clarity
Improve script portability
Conflicts:
library/ssl_srv.c
programs/ssl/ssl_client2.c
programs/ssl/ssl_server2.c
tests/ssl-opt.sh
2015-01-22 13:30:33 +00:00
Manuel Pégourié-Gonnard
11c919208d
Fix error code description.
2015-01-22 13:22:12 +00:00
Manuel Pégourié-Gonnard
67505bf9e8
Merge branch 'development' into dtls
...
* development:
Adapt tests to new defaults/errors.
Fix typos/cosmetics in Changelog
Disable RC4 by default in example programs.
Add ssl_set_arc4_support()
Set min version to TLS 1.0 in programs
Conflicts:
include/polarssl/ssl.h
library/ssl_cli.c
library/ssl_srv.c
tests/compat.sh
2015-01-21 13:57:33 +00:00
Manuel Pégourié-Gonnard
bfccdd3c92
Merge commit '36adc36' into dtls
...
* commit '36adc36':
Add support for getrandom()
Use library default for trunc-hmac in ssl_client2
Make truncated hmac a runtime option server-side
Fix portability issue in script
Specific error for suites in common but none good
Prefer SHA-1 certificates for pre-1.2 clients
Some more refactoring/tuning.
Minor refactoring
Conflicts:
include/polarssl/error.h
include/polarssl/ssl.h
library/error.c
2015-01-21 13:48:45 +00:00
Manuel Pégourié-Gonnard
0017c2be48
Merge commit '9835bc0' into dtls
...
* commit '9835bc0':
Fix racy test.
Fix stupid error in previous commit
Don't check errors on ssl_close_notify()
Fix char signedness issue
Fix issue with non-blocking I/O & record splitting
Fix warning
Conflicts:
programs/ssl/ssl_client2.c
programs/ssl/ssl_server2.c
2015-01-21 13:42:16 +00:00
Manuel Pégourié-Gonnard
8fbb01ec84
Merge commit 'b2eaac1' into dtls
...
* commit 'b2eaac1':
Stop assuming chars are signed
Add tests for CBC record splitting
Fix tests that were failing with record splitting
Allow disabling record splitting at runtime
Add 1/n-1 record splitting
Enhance doc on ssl_write()
Conflicts:
include/polarssl/ssl.h
programs/ssl/ssl_client2.c
programs/ssl/ssl_server2.c
2015-01-21 13:37:08 +00:00
Manuel Pégourié-Gonnard
0af1ba3521
Merge commit 'f6080b8' into dtls
...
* commit 'f6080b8':
Fix warning in reduced configs
Adapt to "negative" switch for renego
Add tests for periodic renegotiation
Make renego period configurable
Auto-renegotiate before sequence number wrapping
Update Changelog for compile-option renegotiation
Switch from an enable to a disable flag
Save 48 bytes if SSLv3 is not defined
Make renegotiation a compile-time option
Add tests for renego security enforcement
Conflicts:
include/polarssl/ssl.h
library/ssl_cli.c
library/ssl_srv.c
library/ssl_tls.c
programs/ssl/ssl_server2.c
tests/ssl-opt.sh
2015-01-21 11:54:33 +00:00
Manuel Pégourié-Gonnard
edb7ed3a43
Merge commit 'd7e2483' into dtls
...
* commit 'd7e2483': (57 commits)
Skip signature_algorithms ext if PSK only
Fix bug in ssl_client2 reconnect option
Cosmetics in ssl_server2
Improve debugging message.
Fix net_usleep for durations greater than 1 second
Use pk_load_file() in X509
Create ticket keys only if enabled
Fix typo in #ifdef
Clarify documentation a bit
Fix comment on resumption
Update comment from draft to RFC
Use more #ifdef's on CLI_C and SRV_C in ssl_tls.c
Add recursion.pl to all.sh
Allow x509_crt_verify_child() in recursion.pl
Set a compile-time limit to X.509 chain length
Fix 3DES -> DES in all.sh (+ time estimates)
Add curves.pl to all.sh
Rework all.sh to use MSan instead of valgrind
Fix depends on individual curves in tests
Add script to test depends on individual curves
...
Conflicts:
CMakeLists.txt
programs/ssl/ssl_client2.c
2015-01-20 16:52:28 +00:00
Manuel Pégourié-Gonnard
f9c8a606b5
Merge commit '8b9bcec' into dtls
...
* commit '8b9bcec':
Stop assuming chars are signed
Fix len miscalculation in buffer-based allocator
Fix NULL dereference in buffer-based allocator
Add test_suite_memory_buffer_alloc
Add memory_buffer_alloc_self_test()
Fix missing bound check
Add test for ctr_drbg_update() input sanitizing
Refactor for clearer correctness/security
Stop assuming chars are signed
Conflicts:
library/ssl_tls.c
2015-01-20 16:38:39 +00:00
Paul Bakker
5b8f7eaa3e
Merge new security defaults for programs (RC4 disabled, SSL3 disabled)
2015-01-14 16:26:54 +01:00
Paul Bakker
c82b7e2003
Merge option to disable truncated hmac on the server-side
2015-01-14 16:16:55 +01:00
Paul Bakker
e522d0fa57
Merge smarter certificate selection for pre-TLS-1.2 clients
2015-01-14 16:12:48 +01:00
Manuel Pégourié-Gonnard
78803c0567
Fix char signedness issue
2015-01-13 21:20:22 +01:00
Paul Bakker
f3561154ff
Merge support for 1/n-1 record splitting
2015-01-13 16:31:34 +01:00
Paul Bakker
f6080b8557
Merge support for enabling / disabling renegotiation support at compile-time
2015-01-13 16:18:23 +01:00
Paul Bakker
d7e2483bfc
Merge miscellaneous fixes into development
2015-01-13 16:04:38 +01:00
Manuel Pégourié-Gonnard
5ba1d52f96
Add memory_buffer_alloc_self_test()
2015-01-13 14:58:00 +01:00
Manuel Pégourié-Gonnard
5cb4b31057
Fix missing bound check
2015-01-13 14:58:00 +01:00
Manuel Pégourié-Gonnard
bd47a58221
Add ssl_set_arc4_support()
...
Rationale: if people want to disable RC4 but otherwise keep the default suite
list, it was cumbersome. Also, since it uses a global array,
ssl_list_ciphersuite() is not a convenient place. So the SSL modules look like
the best place, even if it means temporarily adding one SSL setting.
2015-01-13 13:03:06 +01:00
Manuel Pégourié-Gonnard
448ea506bf
Set min version to TLS 1.0 in programs
2015-01-12 12:32:04 +01:00
Manuel Pégourié-Gonnard
e117a8fc0d
Make truncated hmac a runtime option server-side
...
Reading the documentation of ssl_set_truncated_hmac() may give the impression
I changed the default for clients but I didn't, the old documentation was
wrong.
2015-01-09 12:52:20 +01:00
Manuel Pégourié-Gonnard
f01768c55e
Specific error for suites in common but none good
2015-01-08 17:06:16 +01:00
Manuel Pégourié-Gonnard
cfa477ef2f
Allow disabling record splitting at runtime
2015-01-07 14:56:54 +01:00
Manuel Pégourié-Gonnard
d76314c44c
Add 1/n-1 record splitting
2015-01-07 14:56:54 +01:00
Manuel Pégourié-Gonnard
edd371a82c
Enhance doc on ssl_write()
2015-01-07 14:56:54 +01:00
Manuel Pégourié-Gonnard
d94232389e
Skip signature_algorithms ext if PSK only
2014-12-02 11:57:29 +01:00
Manuel Pégourié-Gonnard
837f0fe831
Make renego period configurable
2014-12-02 10:40:55 +01:00
Manuel Pégourié-Gonnard
037170465a
Switch from an enable to a disable flag
2014-12-02 10:40:54 +01:00
Manuel Pégourié-Gonnard
6186019d5d
Save 48 bytes if SSLv3 is not defined
2014-12-02 10:40:54 +01:00
Manuel Pégourié-Gonnard
615e677c0b
Make renegotiation a compile-time option
2014-12-02 10:40:54 +01:00
Manuel Pégourié-Gonnard
9439f93ea4
Use pk_load_file() in X509
...
Saves a bit of ROM. X509 depends on PK anyway.
2014-11-27 17:44:46 +01:00
Manuel Pégourié-Gonnard
cb7da352fd
Fix typo in #ifdef
...
Since length is checked afterwards anyway, no security risk here
2014-11-27 17:44:45 +01:00
Manuel Pégourié-Gonnard
150c4f62f1
Clarify documentation a bit
2014-11-27 17:44:45 +01:00
Manuel Pégourié-Gonnard
3e9449350c
Fix comment on resumption
2014-11-27 17:44:45 +01:00
Manuel Pégourié-Gonnard
6b298e6cc1
Update comment from draft to RFC
2014-11-27 17:44:45 +01:00
Manuel Pégourié-Gonnard
d16d1cb96a
Use more #ifdef's on CLI_C and SRV_C in ssl_tls.c
2014-11-27 17:44:45 +01:00
Manuel Pégourié-Gonnard
fd6c85c3eb
Set a compile-time limit to X.509 chain length
2014-11-20 16:37:41 +01:00
Manuel Pégourié-Gonnard
426d4ae7ff
Split x509_crl_parse_der() out of x509_crl_parse()
2014-11-20 16:36:07 +01:00
Manuel Pégourié-Gonnard
70bdadf54b
Add pk_check_pair()
2014-11-06 18:25:51 +01:00
Manuel Pégourié-Gonnard
30668d688d
Add ecp_check_pub_priv()
2014-11-06 18:25:51 +01:00
Manuel Pégourié-Gonnard
2f8d1f9fc3
Add rsa_check_pub_priv()
2014-11-06 18:25:51 +01:00
Manuel Pégourié-Gonnard
e10e06d863
Blind RSA operations even without CRT
2014-11-06 18:25:44 +01:00
Manuel Pégourié-Gonnard
d056ce0e3e
Use seq_num as AEAD nonce by default
2014-11-06 18:23:49 +01:00
Manuel Pégourié-Gonnard
f9d778d635
Merge branch 'etm' into dtls
...
* etm:
Fix warning in reduced config
Update Changelog for EtM
Keep EtM state across renegotiations
Adjust minimum length for EtM
Don't send back EtM extension if not using CBC
Fix for the RFC erratum
Implement EtM
Preparation for EtM
Implement initial negotiation of EtM
Conflicts:
include/polarssl/check_config.h
2014-11-06 01:36:32 +01:00
Manuel Pégourié-Gonnard
56d985d0a6
Merge branch 'session-hash' into dtls
...
* session-hash:
Update Changelog for session-hash
Make session-hash depend on TLS versions
Forbid extended master secret with SSLv3
compat.sh: allow git version of gnutls
compat.sh: make options a bit more robust
Implement extended master secret
Add negotiation of Extended Master Secret
Conflicts:
include/polarssl/check_config.h
programs/ssl/ssl_server2.c
2014-11-06 01:25:09 +01:00
Manuel Pégourié-Gonnard
fedba98ede
Merge branch 'fb-scsv' into dtls
...
* fb-scsv:
Update Changelog for FALLBACK_SCSV
Implement FALLBACK_SCSV server-side
Implement FALLBACK_SCSV client-side
2014-11-05 16:12:09 +01:00
Manuel Pégourié-Gonnard
769c6b6351
Make session-hash depend on TLS versions
2014-11-05 16:00:50 +01:00
Manuel Pégourié-Gonnard
699cafaea2
Implement initial negotiation of EtM
...
Not implemented yet:
- actually using EtM
- conditions on renegotiation
2014-11-05 16:00:50 +01:00
Manuel Pégourié-Gonnard
01b2699198
Implement FALLBACK_SCSV server-side
2014-11-05 16:00:49 +01:00
Manuel Pégourié-Gonnard
1cbd39dbeb
Implement FALLBACK_SCSV client-side
2014-11-05 16:00:49 +01:00
Manuel Pégourié-Gonnard
367381fddd
Add negotiation of Extended Master Secret
...
(But not the actual thing yet.)
2014-11-05 16:00:49 +01:00
Paul Bakker
f2a459df05
Preparation for PolarSSL 1.4.0
2014-10-21 16:40:54 +02:00
Manuel Pégourié-Gonnard
ef88e68188
Deprecate ssl_set_bio()
2014-10-21 16:32:58 +02:00
Manuel Pégourié-Gonnard
df3acd82e2
Limit HelloRequest retransmission if not enforced
2014-10-21 16:32:58 +02:00
Manuel Pégourié-Gonnard
8e704f0f74
DTLS depends on TIMING_C for now
2014-10-21 16:32:56 +02:00
Manuel Pégourié-Gonnard
b0643d152d
Add ssl_set_dtls_badmac_limit()
2014-10-21 16:32:55 +02:00
Manuel Pégourié-Gonnard
9b35f18f66
Add ssl_get_record_expansion()
2014-10-21 16:32:55 +02:00
Manuel Pégourié-Gonnard
a6fcffe516
Add warnings about disabling replay detection
2014-10-21 16:32:53 +02:00
Manuel Pégourié-Gonnard
37e08e1689
Fix max_fragment_length with DTLS
2014-10-21 16:32:53 +02:00
Manuel Pégourié-Gonnard
2707430a4d
Fix types and comments about read_timeout
2014-10-21 16:32:45 +02:00
Manuel Pégourié-Gonnard
6c1fa3a184
Fix misplaced initialisation of timeout
2014-10-21 16:32:45 +02:00
Manuel Pégourié-Gonnard
c8d8e97cbd
Move to milliseconds in recv_timeout()
2014-10-21 16:32:44 +02:00
Manuel Pégourié-Gonnard
905dd2425c
Add ssl_set_handshake_timeout()
2014-10-21 16:32:43 +02:00
Manuel Pégourié-Gonnard
0ac247fd88
Implement timeout back-off (fixed range for now)
2014-10-21 16:32:43 +02:00
Manuel Pégourié-Gonnard
579950c2bb
Fix bug with non-blocking I/O and cookies
2014-10-21 16:32:42 +02:00
Manuel Pégourié-Gonnard
7de3c9eecb
Count timeout per flight, not per message
2014-10-21 16:32:41 +02:00
Manuel Pégourié-Gonnard
db2858ce96
Preparation for timers
...
Currently directly using timing.c, plan to use callbacks later to loosen
coupling, but first just get things working.
2014-10-21 16:32:41 +02:00
Manuel Pégourié-Gonnard
23b7b703aa
Fix issue with renego & resend
2014-10-21 16:32:38 +02:00
Manuel Pégourié-Gonnard
2739313cea
Make anti-replay a runtime option
2014-10-21 16:32:35 +02:00
Manuel Pégourié-Gonnard
8464a46b6b
Make DTLS_ANTI_REPLAY depends on PROTO_DTLS
2014-10-21 16:32:35 +02:00
Manuel Pégourié-Gonnard
246c13a05f
Fix epoch checking
2014-10-21 16:32:34 +02:00
Manuel Pégourié-Gonnard
7a7e140d4e
Add functions for replay protection
2014-10-21 16:32:33 +02:00
Manuel Pégourié-Gonnard
5d8ba53ace
Expand and fix resend infrastructure
2014-10-21 16:32:28 +02:00
Manuel Pégourié-Gonnard
ffa67be698
Infrastructure for buffering & resending flights
2014-10-21 16:32:27 +02:00
Manuel Pégourié-Gonnard
57fa314412
Fix depend documentation
2014-10-21 16:32:27 +02:00
Manuel Pégourié-Gonnard
9d9b003a9a
Add net_recv_timeout()
2014-10-21 16:32:26 +02:00
Manuel Pégourié-Gonnard
8fa6dfd560
Introduce f_recv_timeout callback
2014-10-21 16:32:26 +02:00
Manuel Pégourié-Gonnard
e6bdc4497c
Merge I/O contexts into one
2014-10-21 16:32:25 +02:00
Manuel Pégourié-Gonnard
624bcb5260
No memmove: done, rm temporary things
2014-10-21 16:30:31 +02:00
Manuel Pégourié-Gonnard
f899583f94
Prepare moving away from memmove() on incoming HS
2014-10-21 16:30:29 +02:00
Manuel Pégourié-Gonnard
9d1d7196e4
Check length before reading handshake header
2014-10-21 16:30:24 +02:00
Manuel Pégourié-Gonnard
d9ba0d96b6
Prepare for checking incoming handshake seqnum
2014-10-21 16:30:23 +02:00
Manuel Pégourié-Gonnard
64dffc5d14
Make handshake reassembly work with openssl
2014-10-21 16:30:22 +02:00
Manuel Pégourié-Gonnard
502bf30fb5
Handle reassembly of handshake messages
...
Works only with GnuTLS for now, OpenSSL packs other records in the same
datagram after the last fragmented one, which we don't handle yet.
Also, ssl-opt.sh fails the tests with valgrind for now: we're so slow with
valgrind that gnutls-serv retransmits some messages, and we don't handle
duplicated messages yet.
2014-10-21 16:30:22 +02:00
Manuel Pégourié-Gonnard
562eb787ec
Add and use POLARSSL_ERR_SSL_BUFFER_TOO_SMALL
2014-10-21 16:30:20 +02:00
Manuel Pégourié-Gonnard
bef8f09899
Make cookie timeout configurable
2014-10-21 16:30:19 +02:00
Manuel Pégourié-Gonnard
e90308178f
Add timestamp/serial to cookies, with timeout
2014-10-21 16:30:19 +02:00
Manuel Pégourié-Gonnard
a64acd4f84
Add separate SSL_COOKIE_C define
2014-10-21 16:30:18 +02:00
Manuel Pégourié-Gonnard
7d38d215b1
Allow disabling HelloVerifyRequest
2014-10-21 16:30:18 +02:00
Manuel Pégourié-Gonnard
232edd46be
Move cookie callbacks implementation to own module
2014-10-21 16:30:17 +02:00
Manuel Pégourié-Gonnard
d485d194f9
Move to a callback interface for DTLS cookies
2014-10-21 16:30:17 +02:00
Manuel Pégourié-Gonnard
d7f9bc5091
Refactor cookie to prepare for external callbacks
...
Also adds flexibility to the verification process.
2014-10-21 16:30:16 +02:00
Manuel Pégourié-Gonnard
82202f0a9c
Make DTLS_HELLO_VERIFY a compile option
2014-10-21 16:30:16 +02:00
Manuel Pégourié-Gonnard
98545f128a
Generate random key for HelloVerifyRequest
2014-10-21 16:30:16 +02:00
Manuel Pégourié-Gonnard
43c021874d
Add ssl_set_client_transport_id()
2014-10-21 16:30:15 +02:00
Manuel Pégourié-Gonnard
2c9ee81f6e
Start adding srv support for hello verify request
...
Dummy fixed content for now.
Also, seems to be a race condition in the way the socket is closed and
reopened, leading to a few "random" failures in compat.sh. A fix is planned
for later.
2014-10-21 16:30:13 +02:00
Manuel Pégourié-Gonnard
a0e1632b79
Do not use compression with DTLS
2014-10-21 16:30:13 +02:00
Manuel Pégourié-Gonnard
67427c07b2
Fix checksum computation with HelloVerifyRequest
2014-10-21 16:30:11 +02:00
Manuel Pégourié-Gonnard
74848811b4
Implement HelloVerifyRequest on client
2014-10-21 16:30:11 +02:00
Manuel Pégourié-Gonnard
b2f3be8757
Support multiple records in one datagram
2014-10-21 16:30:10 +02:00
Manuel Pégourié-Gonnard
34c1011b3d
Fix a few warnings in reduced configs
2014-10-21 16:30:09 +02:00
Manuel Pégourié-Gonnard
fe98aceb70
Adapt ssl_fetch_input() for UDP
2014-10-21 16:30:09 +02:00
Manuel Pégourié-Gonnard
f5a1312eaa
Add UDP support to the NET module
2014-10-21 16:30:09 +02:00
Manuel Pégourié-Gonnard
e89bcf05da
Write new DTLS handshake fields correctly
2014-10-21 16:30:07 +02:00
Manuel Pégourié-Gonnard
0619348288
Add explicit counter in DTLS record header
2014-10-21 16:30:06 +02:00
Manuel Pégourié-Gonnard
7ee6f0e6e5
Preparation: allow {in,out}_ctr != {in,out}_buf
2014-10-21 16:30:05 +02:00
Manuel Pégourié-Gonnard
abc7e3b4ba
Handle DTLS version encoding and fix some checks
2014-10-21 16:30:05 +02:00
Manuel Pégourié-Gonnard
864a81fdc0
More ssl_set_XXX() functions can return BAD_INPUT
2014-10-21 16:30:04 +02:00