lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Add 1/n-1 record splitting

Browse Source
This commit is contained in:
Manuel Pégourié-Gonnard
2015-01-07 12:39:44 +01:00
parent edd371a82c
commit d76314c44c
4 changed files with 64 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
include/polarssl/check_config.h
View File

@ -263,6 +263,11 @@
#error "POLARSSL_SSL_SESSION_TICKETS_C defined, but not all prerequisites"
#endif
#if defined(POLARSSL_SSL_CBC_RECORD_SPLITTING) && \
!defined(POLARSSL_SSL_PROTO_SSL3) && !defined(POLARSSL_SSL_PROTO_TLS1)
#error "POLARSSL_SSL_CBC_RECORD_SPLITTING defined, but not all prerequisites"
#endif
#if defined(POLARSSL_SSL_SERVER_NAME_INDICATION) && \
!defined(POLARSSL_X509_CRT_PARSE_C)
#error "POLARSSL_SSL_SERVER_NAME_INDICATION defined, but not all prerequisites"

12
include/polarssl/config.h
View File

@ -821,6 +821,18 @@
*/
//#define POLARSSL_SSL_HW_RECORD_ACCEL
/**
* \def POLARSSL_SSL_CBC_RECORD_SPLITTING
*
* Enable 1/n-1 record splitting for CBC mode in SSLv3 and TLS 1.0.
*
* This is a countermeasure to the BEAST attack, which also minimizes the risk
* of interoperability issues compared to sending 0-length records.
*
* Comment this macro to disable 1/n-1 record splitting.
*/
#define POLARSSL_SSL_CBC_RECORD_SPLITTING
/**
* \def POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
*

3
include/polarssl/ssl.h
View File

@ -784,6 +784,9 @@ struct _ssl_context
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
unsigned char mfl_code; /*!< MaxFragmentLength chosen by us */
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
#if defined(POLARSSL_SSL_CBC_RECORD_SPLITTING)
unsigned char split_done; /*!< flag for record splitting */
#endif
/*
* PKI layer