lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-29 11:41:15 +03:00
Code Activity

Improve comments across record size limit changes

Browse Source 
Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>
This commit is contained in:
Waleed Elmelegy
2024-01-09 14:18:34 +00:00
parent 9457e67afd
commit f501790ff2
3 changed files with 22 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
library/ssl_misc.h
View File

@ -2704,6 +2704,7 @@ int mbedtls_ssl_parse_server_name_ext(mbedtls_ssl_context *ssl,
#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT)
#define MBEDTLS_SSL_RECORD_SIZE_LIMIT_EXTENSION_DATA_LENGTH (2)
/* This value is defined by RFC 8449 */
#define MBEDTLS_SSL_RECORD_SIZE_LIMIT_MIN (64)
MBEDTLS_CHECK_RETURN_CRITICAL

18
library/ssl_tls.c
View File

@ -3521,15 +3521,15 @@ int mbedtls_ssl_get_max_out_record_payload(const mbedtls_ssl_context *ssl)
if (ssl->transform_out != NULL &&
ssl->transform_out->tls_version == MBEDTLS_SSL_VERSION_TLS1_3) {
/* RFC 8449, section 4:
*
* This value [record_size_limit] is the length of the plaintext
* of a protected record.
* The value includes the content type and padding added in TLS 1.3
* (that is, the complete length of TLSInnerPlaintext).
*
* Thus, round down to a multiple of MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY
* and subtract 1 (for the content type that will be added later)
/*
* In TLS 1.3 case, when records are protected, `max_len` as computed
* above is the maximum length of the TLSInnerPlaintext structure that
* along the plaintext payload contains the inner content type (one byte)
* and some zero padding. Given the algorithm used for padding
* in mbedtls_ssl_encrypt_buf(), compute the maximum length for
* the plaintext payload. Round down to a multiple of
* MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY and
* subtract 1.
*/
max_len = ((max_len / MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) *
MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) - 1;