Ivan Grokhotkov
fe4518da8d
Make SNI host name an ssl_client_new argument
...
ssl_set_hostname was mostly useless, because it allowed setting host name of an existing SSL object. However SNI was sent as part of client_hello, which was done in ssl_client_new. So it wasn't possible to actually set host name before connection would start.
2016-04-19 08:23:15 +03:00
Ivan Grokhotkov
5b4be7d273
Reserve 16k fragment buffer only when it is actually required.
...
This change reduces memory pressure when server response size fits into 6k buffer allocated by default.
2016-03-02 15:34:15 +03:00
Ivan Grokhotkov
b33ef68e6a
Fix handshake status not being set if increase_bm_data_size fails
...
Also set warning level to -Wall
https://github.com/esp8266/Arduino/issues/1708
2016-03-02 15:17:47 +03:00
Ivan Grokhotkov
324c2fdade
Terminate connection if increase_bm_data_size fails
...
As suggested in https://github.com/igrr/axtls-8266/issues/2#issuecomment-188544798
2016-02-26 17:53:19 +03:00
Ivan Grokhotkov
9eaeca3a03
Postpone freeing of X509 context to the first data exchange after handshake
...
X509 context contains certificate fingerprint and various names which may be used to verify the certificate.
Previously we would free it right after the handshake completion, which prevented the client from actually using any information from X509 context.
Postponing this to the first ssl_read/ssl_write call after the handshake, we give the client a chance to verify the certificate.
Also added logging to ssl_match_fingerprint function in case fingerprint doesn't match expected value.
2016-02-26 16:21:09 +03:00
Ivan Grokhotkov
28869ea94b
Use free followed by malloc instead of realloc when increasing raw buffer
...
At this point we don't need to preserve the data inside the buffer.
Using free followed by malloc reduces fragmentation for some heap implementations.
2016-02-26 16:09:47 +03:00
Slavey Karadzhov
1154d0a985
Changed the code to reserve bytes for hostname only if needed.
2016-02-22 10:16:01 +01:00
Slavey Karadzhov
63da8991c2
Added SNI ( https://en.wikipedia.org/wiki/Server_Name_Indication ) support.
2016-02-19 16:48:58 +01:00
Ivan Grokhotkov
514b6685c5
Disable RC4
2015-12-09 23:39:26 +03:00
Ivan Grokhotkov
f98cae7b2f
Don't try to load certificate and private key if it is null
2015-12-04 18:44:40 +03:00
Ivan Grokhotkov
1551076816
Remove default private key and certificate ( #3 )
2015-12-04 17:08:04 +03:00
Ivan Grokhotkov
6830d98c7f
Pre-allocate encrypt/decrypt ctx to reduce memory fragmentation
2015-11-17 02:35:09 +03:00
Ivan Grokhotkov
10b41c811a
Increase plaintext buffer size after handshake is complete
2015-11-17 01:50:35 +03:00
Ivan Grokhotkov
6f48f0d114
Store fingerprint as raw byte array
2015-09-18 12:38:27 +03:00
Ivan Grokhotkov
a069bc0eb6
Add function to match certificate fingerprint
2015-09-14 10:24:51 +03:00
Ivan Grokhotkov
ad9780684a
Calculate SHA-1 fingerprint when loading the certificate
2015-09-14 08:51:13 +03:00
Ivan Grokhotkov
6095fde37e
Allocation debugging, reduce SSL structure size.
2015-09-01 16:39:29 +03:00
Ivan Grokhotkov
6030371051
Initial compilation fixes
2015-08-31 09:05:04 +03:00
Ivan Grokhotkov
3661c54000
Add makefile
2015-08-30 13:46:41 +03:00
Ivan Grokhotkov
4e0ccaf9b2
Import axTLS 1.4.9
2015-08-30 13:34:00 +03:00
