mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-07-29 11:41:15 +03:00
Merge branch 'development' into ccm_chunked
Conflicts: library/ccm.c Conflict resolved by re-applying the MBEDTLS_BYTE_0 macro. Conflict resolved by ignoring the MBEDTLS_PUT_UINT16_BE macro used in development branch on the 'b' buffer, because the 'b' buffer is removed in current branch.
This commit is contained in:
Mateusz Starzyk
@ -3194,6 +3194,17 @@
|
||||
//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 bits) */
|
||||
//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */
|
||||
|
||||
/** \def MBEDTLS_TLS_EXT_CID
|
||||
*
|
||||
* At the time of writing, the CID extension has not been assigned its
|
||||
* final value. Set this configuration option to make Mbed TLS use a
|
||||
* different value.
|
||||
*
|
||||
* A future minor revision of Mbed TLS may change the default value of
|
||||
* this option to match evolving standards and usage.
|
||||
*/
|
||||
//#define MBEDTLS_TLS_EXT_CID 254
|
||||
|
||||
/**
|
||||
* Complete list of ciphersuites to use, in order of preference.
|
||||
*
|
||||
|
||||
@ -337,6 +337,41 @@
|
||||
#define MBEDTLS_SSL_SIG_RSA 1
|
||||
#define MBEDTLS_SSL_SIG_ECDSA 3
|
||||
|
||||
/*
|
||||
* TLS 1.3 signature algorithms
|
||||
* RFC 8446, Section 4.2.2
|
||||
*/
|
||||
|
||||
/* RSASSA-PKCS1-v1_5 algorithms */
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PKCS1_SHA256 0x0401
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PKCS1_SHA384 0x0501
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PKCS1_SHA512 0x0601
|
||||
|
||||
/* ECDSA algorithms */
|
||||
#define MBEDTLS_TLS13_SIG_ECDSA_SECP256R1_SHA256 0x0403
|
||||
#define MBEDTLS_TLS13_SIG_ECDSA_SECP384R1_SHA384 0x0503
|
||||
#define MBEDTLS_TLS13_SIG_ECDSA_SECP521R1_SHA512 0x0603
|
||||
|
||||
/* RSASSA-PSS algorithms with public key OID rsaEncryption */
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PSS_RSAE_SHA256 0x0804
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PSS_RSAE_SHA384 0x0805
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PSS_RSAE_SHA512 0x0806
|
||||
|
||||
/* EdDSA algorithms */
|
||||
#define MBEDTLS_TLS13_SIG_ED25519 0x0807
|
||||
#define MBEDTLS_TLS13_SIG_ED448 0x0808
|
||||
|
||||
/* RSASSA-PSS algorithms with public key OID RSASSA-PSS */
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PSS_PSS_SHA256 0x0809
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PSS_PSS_SHA384 0x080A
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PSS_PSS_SHA512 0x080B
|
||||
|
||||
/* LEGACY ALGORITHMS */
|
||||
#define MBEDTLS_TLS13_SIG_RSA_PKCS1_SHA1 0x0201
|
||||
#define MBEDTLS_TLS13_SIG_ECDSA_SHA1 0x0203
|
||||
|
||||
#define MBEDTLS_TLS13_SIG_NONE 0x0
|
||||
|
||||
/*
|
||||
* Client Certificate Types
|
||||
* RFC 5246 section 7.4.4 plus RFC 4492 section 5.5
|
||||
@ -425,8 +460,14 @@
|
||||
|
||||
/* The value of the CID extension is still TBD as of
|
||||
* draft-ietf-tls-dtls-connection-id-05
|
||||
* (https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05) */
|
||||
* (https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05).
|
||||
*
|
||||
* A future minor revision of Mbed TLS may change the default value of
|
||||
* this option to match evolving standards and usage.
|
||||
*/
|
||||
#if !defined(MBEDTLS_TLS_EXT_CID)
|
||||
#define MBEDTLS_TLS_EXT_CID 254 /* TBD */
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_TLS_EXT_ECJPAKE_KKPP 256 /* experimental */
|
||||
|
||||
@ -537,10 +578,11 @@ typedef int mbedtls_ssl_send_t( void *ctx,
|
||||
* \param buf Buffer to write the received data to
|
||||
* \param len Length of the receive buffer
|
||||
*
|
||||
* \return The callback must return the number of bytes received,
|
||||
* or a non-zero error code.
|
||||
* If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_READ
|
||||
* \returns If data has been received, the positive number of bytes received.
|
||||
* \returns \c 0 if the connection has been closed.
|
||||
* \returns If performing non-blocking I/O, \c MBEDTLS_ERR_SSL_WANT_READ
|
||||
* must be returned when the operation would block.
|
||||
* \returns Another negative error code on other kinds of failures.
|
||||
*
|
||||
* \note The callback may receive fewer bytes than the length of the
|
||||
* buffer. It must always return the number of bytes actually
|
||||
@ -560,7 +602,7 @@ typedef int mbedtls_ssl_recv_t( void *ctx,
|
||||
* \param ctx Context for the receive callback (typically a file descriptor)
|
||||
* \param buf Buffer to write the received data to
|
||||
* \param len Length of the receive buffer
|
||||
* \param timeout Maximum nomber of millisecondes to wait for data
|
||||
* \param timeout Maximum number of milliseconds to wait for data
|
||||
* 0 means no timeout (potentially waiting forever)
|
||||
*
|
||||
* \return The callback must return the number of bytes received,
|
||||
@ -1147,6 +1189,10 @@ struct mbedtls_ssl_config
|
||||
|
||||
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
|
||||
const int *MBEDTLS_PRIVATE(sig_hashes); /*!< allowed signature hashes */
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
|
||||
const uint16_t *MBEDTLS_PRIVATE(tls13_sig_algs); /*!< allowed signature algorithms for TLS 1.3 */
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_C)
|
||||
@ -1328,10 +1374,24 @@ struct mbedtls_ssl_context
|
||||
/*
|
||||
* Record layer transformations
|
||||
*/
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_in); /*!< current transform params (in) */
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_out); /*!< current transform params (in) */
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform); /*!< negotiated transform params */
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_negotiate); /*!< transform params in negotiation */
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_in); /*!< current transform params (in)
|
||||
* This is always a reference,
|
||||
* never an owning pointer. */
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_out); /*!< current transform params (out)
|
||||
* This is always a reference,
|
||||
* never an owning pointer. */
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform); /*!< negotiated transform params
|
||||
* This pointer owns the transform
|
||||
* it references. */
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_negotiate); /*!< transform params in negotiation
|
||||
* This pointer owns the transform
|
||||
* it references. */
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
|
||||
/*! The application data transform in TLS 1.3.
|
||||
* This pointer owns the transform it references. */
|
||||
mbedtls_ssl_transform *MBEDTLS_PRIVATE(transform_application);
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
|
||||
|
||||
/*
|
||||
* Timers
|
||||
@ -2991,6 +3051,20 @@ void mbedtls_ssl_conf_curves( mbedtls_ssl_config *conf,
|
||||
*/
|
||||
void mbedtls_ssl_conf_sig_hashes( mbedtls_ssl_config *conf,
|
||||
const int *hashes );
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)
|
||||
/**
|
||||
* \brief Configure allowed signature algorithms for use in TLS 1.3
|
||||
*
|
||||
* \param conf The SSL configuration to use.
|
||||
* \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms,
|
||||
* terminated by \c MBEDTLS_TLS13_SIG_NONE. The list must remain
|
||||
* available throughout the lifetime of the conf object. Supported
|
||||
* values are available as \c MBEDTLS_TLS13_SIG_XXXX
|
||||
*/
|
||||
void mbedtls_ssl_conf_sig_algs( mbedtls_ssl_config *conf,
|
||||
const uint16_t* sig_algs );
|
||||
#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */
|
||||
#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */
|
||||
|
||||
#if defined(MBEDTLS_X509_CRT_PARSE_C)
|
||||
|
||||
Reference in New Issue
Block a user