Commit Graph

678 Commits

Author SHA1 Message Date
Janos Follath
bfcd032f9d Restore P>Q in RSA key generation (#558)
The PKCS#1 standard says nothing about the relation between P and Q
but many libraries guarantee P>Q and mbed TLS did so too in earlier
versions.

This commit restores this behaviour.
2016-10-13 12:54:33 +01:00
Simon Butcher
e337ee647f Clarified Changelog for fix #602 2016-10-13 12:54:32 +01:00
Andres AG
6ad5d9450a Fix documentation for mbedtls_gcm_finish()
Fix implementation and documentation missmatch for the function
arguments to mbedtls_gcm_finish(). Also, removed redundant if condition
that always evaluates to true.
2016-10-13 12:54:32 +01:00
Simon Butcher
6b8d9cffc2 Updated Changelog for fix #599 2016-10-13 12:54:32 +01:00
Andres AG
57e6e8fbb7 Fix 1 byte overread in mbedtls_asn1_get_int() 2016-10-13 12:54:32 +01:00
Andres AG
f527609849 Add test for bounds in X509 DER write funcs 2016-10-13 12:45:08 +01:00
Simon Butcher
1e5de32473 Update Changelog for fix #559 2016-10-13 12:45:07 +01:00
Andres AG
372bf79d67 Add missing bounds check in X509 DER write funcs
This patch adds checks in both mbedtls_x509write_crt_der and
mbedtls_x509write_csr_der before the signature is written to buf
using memcpy().
2016-10-13 12:45:07 +01:00
Simon Butcher
80d191bbe9 Update for ChangeLog for fixes for cert_app 2016-10-13 12:44:20 +01:00
Simon Butcher
2491fa2f2e Update to ChangeLog for bug #428 2016-10-13 12:44:20 +01:00
Simon Butcher
6f3c9cc8b7 Update ChangeLog for fix to crypt_and_hash #441 2016-10-13 12:44:20 +01:00
Janos Follath
af1e74be70 X509: Fix bug triggered by future CA among trusted
Fix an issue that caused valid certificates being rejected whenever an
expired or not yet valid version of the trusted certificate was before the
valid version in the trusted certificate list.
2016-10-13 12:44:19 +01:00
Janos Follath
17da9dd829 Add option for relaxed X509 time verification.
The certificates are not valid according to the RFC, but are in wide
distribution across the internet. Hence the request to add a
compile-time flag to accept these certificates if wanted by the
application.

If POLARSSL_RELAXED_X509_DATE is enabled it will allow dates without
seconds, and allow dates with timezones (but doesn't actually use
the timezone).

Patch provided by OpenVPN.
2016-09-30 09:04:18 +01:00
Simon Butcher
2d01f2d4c5 Update Changelog for release 2016-06-27 20:00:26 +01:00
Simon Butcher
fd349bcb8e Merge branch 'mbedtls-1.3' into mbedtls-1.3 2016-06-27 01:29:03 +01:00
Janos Follath
307e181cfa Fix non compliance SSLv3 in server extension handling.
The server code parses the client hello extensions even when the
protocol is SSLv3 and this behaviour is non compliant with rfc6101.
Also the server sends extensions in the server hello and omitting
them may prevent interoperability problems.
2016-05-23 18:52:14 +01:00
Simon Butcher
959d4328c1 Fix ChangeLog for backport of IOTSSL-621 2016-05-18 20:08:16 +01:00
Janos Follath
af1836e1cf Add Changelog entry for current branch 2016-05-18 20:07:27 +01:00
Simon Butcher
49ed628ede Fix ChangeLog after merging fix for IOTSSL-628 2016-05-18 20:07:27 +01:00
Janos Follath
f383363d43 Extended ChangeLog entry 2016-05-18 20:01:46 +01:00
Janos Follath
c70515d455 Add Changelog entry for current branch 2016-05-18 20:00:19 +01:00
Simon Butcher
f31d9676d1 Fix ChangeLog for backport of IOTSSL-621 2016-05-18 19:58:41 +01:00
Janos Follath
21ca00243c Add Changelog entry for current branch 2016-05-18 19:58:41 +01:00
Simon Butcher
2d49c4d2f6 Fix ChangeLog after merging fix for IOTSSL-628 2016-05-18 19:58:41 +01:00
Janos Follath
7295c189ee Extended ChangeLog entry 2016-05-18 19:58:41 +01:00
Janos Follath
574b118bf8 Add Changelog entry for current branch 2016-05-18 19:58:40 +01:00
Janos Follath
a1ebe662f3 Add Changelog entry for current branch 2016-05-18 19:58:40 +01:00
Janos Follath
4e03439e6a Fix bug in ssl_write_supported_elliptic_curves_ext
Passing invalid curves to mbedtls_ssl_conf_curves potentially could caused a
crash later in ssl_write_supported_elliptic_curves_ext. #373
2016-04-22 09:59:00 +01:00
Janos Follath
7ddc2cdfce Fix null pointer dereference in the RSA module.
Introduced null pointer checks in mbedtls_rsa_rsaes_pkcs1_v15_encrypt
2016-04-19 10:28:24 +01:00
Janos Follath
d61fc6881a Fix odd bitlength RSA key generation
Fix issue that caused a hang up when generating RSA keys of odd
bitlength.
2016-04-19 09:42:17 +01:00
Janos Follath
4dfecabb97 Update default configuration
Change the default settings for SSL and modify the tests accordingly.
2016-03-14 13:40:43 +00:00
Manuel Pégourié-Gonnard
54f2c490ed Avoid build errors with -O0 due to assembly 2016-01-08 15:30:03 +01:00
Manuel Pégourié-Gonnard
20715dc73b Make ar invocation more portable
armar doesn't understand the syntax without dash. OTOH, the syntax with dash
is the only one specified by POSIX, and it's accepted by GNU ar, BSD ar (as
bundled with OS X) and armar, so it looks like the most portable syntax.

fixes #386
2016-01-08 15:28:40 +01:00
Manuel Pégourié-Gonnard
40510a3a79 Update ChangeLog for latest PR merged
fixes #309
2016-01-08 15:22:41 +01:00
Manuel Pégourié-Gonnard
a3a1cd33d1 Update reference to attack in ChangeLog
We couldn't do that before the attack was public
2016-01-08 15:11:12 +01:00
Simon Butcher
84181adae8 Change version number to 1.3.16
Changed version for library files and yotta module
2016-01-04 22:49:30 +00:00
Simon Butcher
a39690e7bf Correction to ChangeLog
Corrected function name for rsa_rsassa_pkcs1_v15_sign()
2016-01-02 00:49:12 +00:00
Simon Butcher
14400c8fb0 Merge memory leak fix into branch 'mbedtls-1.3'
Merge of fix for memory leak in RSA-SSA signing - #372
2016-01-02 00:28:19 +00:00
Simon Butcher
7d3f3a8ac8 Fix for memory leak in RSA-SSA signing
Fix in mbedtls_rsa_rsassa_pkcs1_v15_sign() in rsa.c. Resolves github issue #372
2016-01-02 00:03:39 +00:00
Simon Butcher
a192c8f5d8 Merge branch 'iotssl-541-1.3-pathlen-bugfix' 2016-01-01 01:13:45 +00:00
Manuel Pégourié-Gonnard
c05014459e Fix wrong length limit in GCM
See for example page 8 of
http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf

The previous constant probably came from a typo as it was 2^26 - 2^5 instead
of 2^36 - 2^5. Clearly the intention was to allow for a constant bigger than
2^32 as the ull suffix and cast to uint64_t show.

fixes #362
2015-12-10 16:34:32 +01:00
Manuel Pégourié-Gonnard
c4a47e3483 Fix bug checking pathlen on first intermediate
Remove check on the pathLenConstraint value when looking for a parent to the
EE cert, as the constraint is on the number of intermediate certs below the
parent, and that number is always 0 at that point, so the constraint is always
satisfied.

The check was actually off-by-one, which caused valid chains to be rejected
under the following conditions:
- the parent certificate is not a trusted root, and
- it has pathLenConstraint == 0 (max_pathlen == 1 in our representation)

fixes #280
2015-11-19 12:06:45 +01:00
Simon Butcher
1f4e08c979 Changed version number to 1.3.15
Changed for library
2015-11-05 15:44:46 +00:00
Simon Butcher
34fc23fa6a Corrected typo in ChangeLog 2015-11-03 23:14:16 +00:00
Manuel Pégourié-Gonnard
edb2327609 Merge branch 'mbedtls-1.3' into mbedtls-1.3-restricted
* mbedtls-1.3:
  Use own implementation of strsep()
  Add Changelog entries for this branch
  Use symbolic constants in test data
  Fixed pathlen contraint enforcement.
  Additional corner cases for testing pathlen constrains. Just in case.
  Added test case for pathlen constrains in intermediate certificates
2015-11-02 06:57:30 +09:00
Manuel Pégourié-Gonnard
f23d6c56a4 Merge branch 'mbedtls-1.3' into mbedtls-1.3-restricted
* mbedtls-1.3:
  Add ChangeLog entry for previous commit
  cert_write : fix "Destination buffer is too small" error
  Add ChangeLog entry for previous two commits
  Test certificate "Server1 SHA1, key_usage" reissued.
  Fix boolean values according to DER specs
  Fix typo in an OID name
  Disable reportedly broken assembly of Sparc(64)
  ECHDE-PSK does not use a certificate
  Actually ignore most non-fatal alerts
2015-10-30 10:17:05 +01:00
Manuel Pégourié-Gonnard
54150a36d1 Add Changelog entries for this branch 2015-10-30 09:45:00 +01:00
Manuel Pégourié-Gonnard
664b751572 Add ChangeLog entry for previous commit 2015-10-27 15:12:39 +01:00
Manuel Pégourié-Gonnard
96e75ac97c Add ChangeLog entry for previous two commits 2015-10-27 15:12:39 +01:00
Manuel Pégourié-Gonnard
c4baf98ce6 Fix typo in an OID name
fixes #314
2015-10-27 15:12:39 +01:00