mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-08-01 10:06:53 +03:00
Drop support for SSLv3.
Remove options: MBEDTLS_SSL_MINOR_VERSION_0 and MBEDTLS_SSL_PROTO_SSL3). Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
This commit is contained in:
Mateusz Starzyk
@ -634,11 +634,6 @@
|
||||
#error "MBEDTLS_SHA512_NO_SHA384 defined without MBEDTLS_SHA512_C"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3) && ( !defined(MBEDTLS_MD5_C) || \
|
||||
!defined(MBEDTLS_SHA1_C) )
|
||||
#error "MBEDTLS_SSL_PROTO_SSL3 defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1) && ( !defined(MBEDTLS_MD5_C) || \
|
||||
!defined(MBEDTLS_SHA1_C) )
|
||||
#error "MBEDTLS_SSL_PROTO_TLS1 defined, but not all prerequisites"
|
||||
@ -659,8 +654,8 @@
|
||||
#error "MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if (defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_1) || defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \
|
||||
#if (defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) ||\
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \
|
||||
!(defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) || \
|
||||
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
|
||||
@ -695,28 +690,16 @@
|
||||
#error "MBEDTLS_SSL_SRV_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_TLS_C) && (!defined(MBEDTLS_SSL_PROTO_SSL3) && \
|
||||
!defined(MBEDTLS_SSL_PROTO_TLS1) && !defined(MBEDTLS_SSL_PROTO_TLS1_1) && \
|
||||
!defined(MBEDTLS_SSL_PROTO_TLS1_2))
|
||||
#if defined(MBEDTLS_SSL_TLS_C) && (!defined(MBEDTLS_SSL_PROTO_TLS1) && \
|
||||
!defined(MBEDTLS_SSL_PROTO_TLS1_1) && !defined(MBEDTLS_SSL_PROTO_TLS1_2))
|
||||
#error "MBEDTLS_SSL_TLS_C defined, but no protocols are active"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_SSL3) && \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_1) && !defined(MBEDTLS_SSL_PROTO_TLS1))
|
||||
#error "Illegal protocol selection"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_TLS1) && \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_2) && !defined(MBEDTLS_SSL_PROTO_TLS1_1))
|
||||
#error "Illegal protocol selection"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_TLS_C) && (defined(MBEDTLS_SSL_PROTO_SSL3) && \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_2) && (!defined(MBEDTLS_SSL_PROTO_TLS1) || \
|
||||
!defined(MBEDTLS_SSL_PROTO_TLS1_1)))
|
||||
#error "Illegal protocol selection"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && !defined(MBEDTLS_SSL_PROTO_DTLS)
|
||||
#error "MBEDTLS_SSL_DTLS_HELLO_VERIFY defined, but not all prerequisites"
|
||||
#endif
|
||||
@ -771,8 +754,7 @@
|
||||
#error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) && \
|
||||
!defined(MBEDTLS_SSL_PROTO_SSL3) && !defined(MBEDTLS_SSL_PROTO_TLS1)
|
||||
#if defined(MBEDTLS_SSL_CBC_RECORD_SPLITTING) && !defined(MBEDTLS_SSL_PROTO_TLS1)
|
||||
#error "MBEDTLS_SSL_CBC_RECORD_SPLITTING defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
@ -853,14 +835,6 @@
|
||||
#error "MBEDTLS_HAVE_INT32/MBEDTLS_HAVE_INT64 and MBEDTLS_HAVE_ASM cannot be defined simultaneously"
|
||||
#endif /* (MBEDTLS_HAVE_INT32 || MBEDTLS_HAVE_INT64) && MBEDTLS_HAVE_ASM */
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
#if defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#error "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#elif defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
#warning "MBEDTLS_SSL_PROTO_SSL3 is deprecated and will be removed in a future version of Mbed TLS"
|
||||
#endif
|
||||
#endif /* MBEDTLS_SSL_PROTO_SSL3 */
|
||||
|
||||
#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
|
||||
#if defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#error "MBEDTLS_SSL_HW_RECORD_ACCEL is deprecated and will be removed in a future version of Mbed TLS"
|
||||
|
||||
@ -1660,7 +1660,7 @@
|
||||
/**
|
||||
* \def MBEDTLS_SSL_CBC_RECORD_SPLITTING
|
||||
*
|
||||
* Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0.
|
||||
* Enable 1/n-1 record splitting for CBC mode in TLS 1.0.
|
||||
*
|
||||
* This is a countermeasure to the BEAST attack, which also minimizes the risk
|
||||
* of interoperability issues compared to sending 0-length records.
|
||||
@ -1710,21 +1710,6 @@
|
||||
*/
|
||||
#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_SSL_PROTO_SSL3
|
||||
*
|
||||
* Enable support for SSL 3.0.
|
||||
*
|
||||
* Requires: MBEDTLS_MD5_C
|
||||
* MBEDTLS_SHA1_C
|
||||
*
|
||||
* \deprecated This option is deprecated and will be removed in a future
|
||||
* version of Mbed TLS.
|
||||
*
|
||||
* Comment this macro to disable support for SSL 3.0
|
||||
*/
|
||||
//#define MBEDTLS_SSL_PROTO_SSL3
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_SSL_PROTO_TLS1
|
||||
*
|
||||
|
||||
@ -137,8 +137,14 @@
|
||||
/*
|
||||
* Various constants
|
||||
*/
|
||||
|
||||
/* These are the high an low bytes of ProtocolVersion as defined by:
|
||||
* - RFC 2246: ProtocolVersion version = { 3, 1 }; // TLS v1.0
|
||||
* - RFC 4346: ProtocolVersion version = { 3, 2 }; // TLS v1.1
|
||||
* - RFC 5246: ProtocolVersion version = { 3, 3 }; // TLS v1.2
|
||||
* - RFC 8446: see section 4.2.1
|
||||
*/
|
||||
#define MBEDTLS_SSL_MAJOR_VERSION_3 3
|
||||
#define MBEDTLS_SSL_MINOR_VERSION_0 0 /*!< SSL v3.0 */
|
||||
#define MBEDTLS_SSL_MINOR_VERSION_1 1 /*!< TLS v1.0 */
|
||||
#define MBEDTLS_SSL_MINOR_VERSION_2 2 /*!< TLS v1.1 */
|
||||
#define MBEDTLS_SSL_MINOR_VERSION_3 3 /*!< TLS v1.2 */
|
||||
@ -296,11 +302,7 @@
|
||||
/*
|
||||
* Length of the verify data for secure renegotiation
|
||||
*/
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 36
|
||||
#else
|
||||
#define MBEDTLS_SSL_VERIFY_DATA_MAX_LEN 12
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Signaling ciphersuite values (SCSV)
|
||||
@ -499,7 +501,6 @@ mbedtls_ssl_states;
|
||||
typedef enum
|
||||
{
|
||||
MBEDTLS_SSL_TLS_PRF_NONE,
|
||||
MBEDTLS_SSL_TLS_PRF_SSL3,
|
||||
MBEDTLS_SSL_TLS_PRF_TLS1,
|
||||
MBEDTLS_SSL_TLS_PRF_SHA384,
|
||||
MBEDTLS_SSL_TLS_PRF_SHA256
|
||||
@ -961,7 +962,10 @@ struct mbedtls_ssl_config
|
||||
* Pointers
|
||||
*/
|
||||
|
||||
const int *ciphersuite_list[4]; /*!< allowed ciphersuites per version */
|
||||
/** Allowed ciphersuites per version. To access list's elements, please use
|
||||
* \c mbedtls_ssl_get_protocol_version_ciphersuites
|
||||
*/
|
||||
const int *ciphersuite_list[3];
|
||||
|
||||
/** Callback for printing debug output */
|
||||
void (*f_dbg)(void *, int, const char *, int, const char *);
|
||||
@ -1212,7 +1216,7 @@ struct mbedtls_ssl_context
|
||||
#endif /* MBEDTLS_SSL_RENEGOTIATION */
|
||||
|
||||
int major_ver; /*!< equal to MBEDTLS_SSL_MAJOR_VERSION_3 */
|
||||
int minor_ver; /*!< either 0 (SSL3) or 1 (TLS1.0) */
|
||||
int minor_ver; /*!< one of MBEDTLS_SSL_MINOR_VERSION_x macros */
|
||||
|
||||
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
|
||||
unsigned badmac_seen; /*!< records with a bad MAC received */
|
||||
@ -2557,6 +2561,17 @@ const mbedtls_ssl_session *mbedtls_ssl_get_session_pointer( const mbedtls_ssl_co
|
||||
void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf,
|
||||
const int *ciphersuites );
|
||||
|
||||
/**
|
||||
* \brief Get ciphersuite for given protocol's minor version.
|
||||
*
|
||||
* \param conf The SSL configuration.
|
||||
* \param prot_version Protocol version. One of MBEDTLS_SSL_MINOR_VERSION_x macros.
|
||||
* \return Ciphersuites pointer if succesful.
|
||||
* \return \c NULL if no ciphersuites where found.
|
||||
*/
|
||||
const int *mbedtls_ssl_get_protocol_version_ciphersuites(
|
||||
const mbedtls_ssl_config *conf, int prot_version );
|
||||
|
||||
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
|
||||
#define MBEDTLS_SSL_UNEXPECTED_CID_IGNORE 0
|
||||
#define MBEDTLS_SSL_UNEXPECTED_CID_FAIL 1
|
||||
@ -2608,8 +2623,8 @@ int mbedtls_ssl_conf_cid( mbedtls_ssl_config *conf, size_t len,
|
||||
* \param ciphersuites 0-terminated list of allowed ciphersuites
|
||||
* \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3
|
||||
* supported)
|
||||
* \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,
|
||||
* MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,
|
||||
* \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_1,
|
||||
* MBEDTLS_SSL_MINOR_VERSION_2,
|
||||
* MBEDTLS_SSL_MINOR_VERSION_3 supported)
|
||||
*
|
||||
* \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0
|
||||
@ -3296,8 +3311,7 @@ void mbedtls_ssl_get_dtls_srtp_negotiation_result( const mbedtls_ssl_context *ss
|
||||
*
|
||||
* \param conf SSL configuration
|
||||
* \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported)
|
||||
* \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,
|
||||
* MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,
|
||||
* \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,
|
||||
* MBEDTLS_SSL_MINOR_VERSION_3 supported)
|
||||
*/
|
||||
void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int minor );
|
||||
@ -3309,15 +3323,13 @@ void mbedtls_ssl_conf_max_version( mbedtls_ssl_config *conf, int major, int mino
|
||||
* \note Input outside of the SSL_MAX_XXXXX_VERSION and
|
||||
* SSL_MIN_XXXXX_VERSION range is ignored.
|
||||
*
|
||||
* \note MBEDTLS_SSL_MINOR_VERSION_0 (SSL v3) should be avoided.
|
||||
*
|
||||
* \note With DTLS, use MBEDTLS_SSL_MINOR_VERSION_2 for DTLS 1.0 and
|
||||
* MBEDTLS_SSL_MINOR_VERSION_3 for DTLS 1.2
|
||||
*
|
||||
* \param conf SSL configuration
|
||||
* \param major Major version number (only MBEDTLS_SSL_MAJOR_VERSION_3 supported)
|
||||
* \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_0,
|
||||
* MBEDTLS_SSL_MINOR_VERSION_1 and MBEDTLS_SSL_MINOR_VERSION_2,
|
||||
* \param minor Minor version number (MBEDTLS_SSL_MINOR_VERSION_1,
|
||||
* MBEDTLS_SSL_MINOR_VERSION_2,
|
||||
* MBEDTLS_SSL_MINOR_VERSION_3 supported)
|
||||
*/
|
||||
void mbedtls_ssl_conf_min_version( mbedtls_ssl_config *conf, int major, int minor );
|
||||
@ -3463,7 +3475,7 @@ void mbedtls_ssl_conf_truncated_hmac( mbedtls_ssl_config *conf, int truncate );
|
||||
* \brief Enable / Disable 1/n-1 record splitting
|
||||
* (Default: MBEDTLS_SSL_CBC_RECORD_SPLITTING_ENABLED)
|
||||
*
|
||||
* \note Only affects SSLv3 and TLS 1.0, not higher versions.
|
||||
* \note Only affects TLS 1.0, not higher versions.
|
||||
* Does not affect non-CBC ciphersuites in any version.
|
||||
*
|
||||
* \param conf SSL configuration
|
||||
@ -3687,11 +3699,11 @@ uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl );
|
||||
const char *mbedtls_ssl_get_ciphersuite( const mbedtls_ssl_context *ssl );
|
||||
|
||||
/**
|
||||
* \brief Return the current SSL version (SSLv3/TLSv1/etc)
|
||||
* \brief Return the current TLS version
|
||||
*
|
||||
* \param ssl SSL context
|
||||
*
|
||||
* \return a string containing the SSL version
|
||||
* \return a string containing the TLS version
|
||||
*/
|
||||
const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl );
|
||||
|
||||
|
||||
@ -122,28 +122,28 @@ extern "C" {
|
||||
#define MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 0xC4 /**< TLS 1.2 */
|
||||
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA 0xC001 /**< Weak! */
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA 0xC002 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC003 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_RC4_128_SHA 0xC002
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC003
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 0xC004
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 0xC005
|
||||
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA 0xC006 /**< Weak! */
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 0xC007 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC008 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 0xC007
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 0xC008
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 0xC009
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 0xC00A
|
||||
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA 0xC00B /**< Weak! */
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA 0xC00C /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 0xC00D /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_RC4_128_SHA 0xC00C
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 0xC00D
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 0xC00E
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 0xC00F
|
||||
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA 0xC010 /**< Weak! */
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA 0xC011 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_RC4_128_SHA 0xC011
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 0xC012
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 0xC013
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 0xC014
|
||||
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 0xC023 /**< TLS 1.2 */
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 0xC024 /**< TLS 1.2 */
|
||||
@ -163,15 +163,15 @@ extern "C" {
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 0xC031 /**< TLS 1.2 */
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 0xC032 /**< TLS 1.2 */
|
||||
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA 0xC033 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA 0xC034 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA 0xC039 /**< Weak! No SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A /**< Weak! No SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B /**< Weak! No SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA 0xC033
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA 0xC034
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 0xC035
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 0xC036
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256 0xC037
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 0xC038
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA 0xC039
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B
|
||||
|
||||
#define MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 0xC03C /**< TLS 1.2 */
|
||||
#define MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 0xC03D /**< TLS 1.2 */
|
||||
@ -212,14 +212,14 @@ extern "C" {
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC070 /**< TLS 1.2 */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC071 /**< TLS 1.2 */
|
||||
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC075 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC076 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC077 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC078 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC079 /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072
|
||||
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074
|
||||
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC075
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC076
|
||||
#define MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC077
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256 0xC078
|
||||
#define MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384 0xC079
|
||||
|
||||
#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256 0xC07A /**< TLS 1.2 */
|
||||
#define MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384 0xC07B /**< TLS 1.2 */
|
||||
@ -247,8 +247,8 @@ extern "C" {
|
||||
#define MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC097
|
||||
#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC098
|
||||
#define MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC099
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC09A /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC09B /**< Not in SSL3! */
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256 0xC09A
|
||||
#define MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384 0xC09B
|
||||
|
||||
#define MBEDTLS_TLS_RSA_WITH_AES_128_CCM 0xC09C /**< TLS 1.2 */
|
||||
#define MBEDTLS_TLS_RSA_WITH_AES_256_CCM 0xC09D /**< TLS 1.2 */
|
||||
|
||||
@ -68,9 +68,6 @@
|
||||
/* Determine minimum supported version */
|
||||
#define MBEDTLS_SSL_MIN_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0
|
||||
#else
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1)
|
||||
#define MBEDTLS_SSL_MIN_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
|
||||
#else
|
||||
@ -82,7 +79,6 @@
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1 */
|
||||
#endif /* MBEDTLS_SSL_PROTO_SSL3 */
|
||||
|
||||
#define MBEDTLS_SSL_MIN_VALID_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
|
||||
#define MBEDTLS_SSL_MIN_VALID_MAJOR_VERSION MBEDTLS_SSL_MAJOR_VERSION_3
|
||||
@ -99,9 +95,6 @@
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1)
|
||||
#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_1
|
||||
#else
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
#define MBEDTLS_SSL_MAX_MINOR_VERSION MBEDTLS_SSL_MINOR_VERSION_0
|
||||
#endif /* MBEDTLS_SSL_PROTO_SSL3 */
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1 */
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
||||
@ -153,8 +146,7 @@
|
||||
#define MBEDTLS_SSL_SOME_SUITES_USE_CBC
|
||||
#endif
|
||||
|
||||
/* This macro determines whether the CBC construct used in TLS 1.0-1.2 (as
|
||||
* opposed to the very different CBC construct used in SSLv3) is supported. */
|
||||
/* This macro determines whether the CBC construct used in TLS 1.0-1.2 is supported. */
|
||||
#if defined(MBEDTLS_SSL_SOME_SUITES_USE_CBC) && \
|
||||
( defined(MBEDTLS_SSL_PROTO_TLS1) || \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
|
||||
@ -563,8 +555,7 @@ struct mbedtls_ssl_handshake_params
|
||||
/*
|
||||
* Checksum contexts
|
||||
*/
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_1)
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
|
||||
mbedtls_md5_context fin_md5;
|
||||
mbedtls_sha1_context fin_sha1;
|
||||
#endif
|
||||
@ -636,8 +627,8 @@ typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
|
||||
* - CBC block cipher transformations ([D]TLS versions <= 1.2 only)
|
||||
* In addition to the distinction of the order of encryption and
|
||||
* authentication, there's a fundamental difference between the
|
||||
* handling in SSL3 & TLS 1.0 and TLS 1.1 and TLS 1.2: For SSL3
|
||||
* and TLS 1.0, the final IV after processing a record is used
|
||||
* handling in TLS 1.0 and TLS 1.1 and TLS 1.2: For TLS 1.0,
|
||||
* the final IV after processing a record is used
|
||||
* as the IV for the next record. No explicit IV is contained
|
||||
* in an encrypted record. The IV for the first record is extracted
|
||||
* at key extraction time. In contrast, for TLS 1.1 and 1.2, no
|
||||
@ -666,7 +657,7 @@ typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
|
||||
* - For stream/CBC, (static) encryption/decryption keys for the digest.
|
||||
* - For AEAD transformations, the size (potentially 0) of an explicit,
|
||||
* random initialization vector placed in encrypted records.
|
||||
* - For some transformations (currently AEAD and CBC in SSL3 and TLS 1.0)
|
||||
* - For some transformations (currently AEAD and CBC in TLS 1.0)
|
||||
* an implicit IV. It may be static (e.g. AEAD) or dynamic (e.g. CBC)
|
||||
* and (if present) is combined with the explicit IV in a transformation-
|
||||
* dependent way (e.g. appending in TLS 1.2 and XOR'ing in TLS 1.3).
|
||||
@ -674,7 +665,7 @@ typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
|
||||
* - The details of the transformation depend on the SSL/TLS version.
|
||||
* - The length of the authentication tag.
|
||||
*
|
||||
* Note: Except for CBC in SSL3 and TLS 1.0, these parameters are
|
||||
* Note: Except for CBC in TLS 1.0, these parameters are
|
||||
* constant across multiple encryption/decryption operations.
|
||||
* For CBC, the implicit IV needs to be updated after each
|
||||
* operation.
|
||||
@ -691,13 +682,11 @@ typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
|
||||
* - For stream/CBC transformations, the message digest contexts
|
||||
* used for the MAC's are stored in md_ctx_{enc/dec}. These contexts
|
||||
* are unused for AEAD transformations.
|
||||
* - For stream/CBC transformations and versions > SSL3, the
|
||||
* - For stream/CBC transformations and versions >= TLS 1.0, the
|
||||
* MAC keys are not stored explicitly but maintained within
|
||||
* md_ctx_{enc/dec}.
|
||||
* - For stream/CBC transformations and version SSL3, the MAC
|
||||
* keys are stored explicitly in mac_enc, mac_dec and have
|
||||
* a fixed size of 20 bytes. These fields are unused for
|
||||
* AEAD transformations or transformations >= TLS 1.0.
|
||||
* - The mac_enc and mac_dec fields are unused for EAD transformations or
|
||||
* transformations >= TLS 1.0.
|
||||
* - For transformations using an implicit IV maintained within
|
||||
* the transformation context, its contents are stored within
|
||||
* iv_{enc/dec}.
|
||||
@ -711,7 +700,7 @@ typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
|
||||
* and indicates the length of the static part of the IV which is
|
||||
* constant throughout the communication, and which is stored in
|
||||
* the first fixed_ivlen bytes of the iv_{enc/dec} arrays.
|
||||
* Note: For CBC in SSL3 and TLS 1.0, the fields iv_{enc/dec}
|
||||
* Note: For CBC in TLS 1.0, the fields iv_{enc/dec}
|
||||
* still store IV's for continued use across multiple transformations,
|
||||
* so it is not true that fixed_ivlen == 0 means that iv_{enc/dec} are
|
||||
* not being used!
|
||||
@ -741,12 +730,6 @@ struct mbedtls_ssl_transform
|
||||
|
||||
#if defined(MBEDTLS_SSL_SOME_MODES_USE_MAC)
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
/* Needed only for SSL v3.0 secret */
|
||||
unsigned char mac_enc[20]; /*!< SSL v3.0 secret (enc) */
|
||||
unsigned char mac_dec[20]; /*!< SSL v3.0 secret (dec) */
|
||||
#endif /* MBEDTLS_SSL_PROTO_SSL3 */
|
||||
|
||||
mbedtls_md_context_t md_ctx_enc; /*!< MAC (encryption) */
|
||||
mbedtls_md_context_t md_ctx_dec; /*!< MAC (decryption) */
|
||||
|
||||
@ -1232,13 +1215,11 @@ static inline int mbedtls_ssl_safer_memcmp( const void *a, const void *b, size_t
|
||||
return( diff );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_1)
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1)
|
||||
int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
|
||||
unsigned char *output,
|
||||
unsigned char *data, size_t data_len );
|
||||
#endif /* MBEDTLS_SSL_PROTO_SSL3 || MBEDTLS_SSL_PROTO_TLS1 || \
|
||||
MBEDTLS_SSL_PROTO_TLS1_1 */
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 */
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
|
||||
Reference in New Issue
Block a user