7c0f17d115
Add MBEDTLS_RSA_NO_CRT to options unaffected by config.pl full
...
The effect of `config.pl full` on 'negative' options such as
`NO_PLATFORM_ENTROPY` is usually inverted, but `MBEDTLS_RSA_NO_CRT` was not
included in the list of such options. This commit adds it.
2017-09-28 12:53:34 +01:00
a2f6b72cbb
Add warnings regarding the use of DHM in general
2017-09-28 11:06:31 +01:00
e764324d96
Improve documentation in dhm.h
2017-09-28 11:06:31 +01:00
e71ad12cd5
Minor code-improvements in dhm.c
2017-09-28 11:06:31 +01:00
13be990114
Correct expectation in DHM test in ssl-opt.sh
...
The previous test expected a DHM group generator of size 2048 bits, while with
the change to RFC 7919, the base is 2, so has bit-size 2.
2017-09-28 11:06:31 +01:00
2c9f027e32
Don't require P,Q if CRT is not used
...
Previously, verification used P,Q regardless of whether CRT was used in the
computation, but this has changed in the meantime.
2017-09-28 11:04:13 +01:00
8d1dd1b5b9
Fix bug in mbedtls_mpi_exp_mod
...
Calling `mbedtls_mpi_exp_mod` with a freshly initialized exponent MPI `N`,
i.e. `N.p == NULL`, would lead to a null-pointer dereference.
2017-09-28 11:02:24 +01:00
4c72b000cb
Add const-qualifiers to prime constants
2017-09-27 16:06:37 +01:00
b1d4d1fa6e
Add description of how the primes from RFC 3526/7919 were generated
2017-09-27 12:43:57 +01:00
8c8b0ab877
Change default Diffie-Hellman parameters from RFC 5114 to RFC 7919
...
The origin of the primes in RFC 5114 is undocumented and their use therefore
constitutes a security risk.
2017-09-27 12:43:57 +01:00
b2bad800e4
Introduce Diffie-Hellman parameters from RFC 7919
2017-09-27 12:43:55 +01:00
0e6dc84f3e
Deprecate Diffie-Hellman groups from RFC 5114
...
Also, change the way the standardized Diffie-Hellman groups are provided from
macro-based string-literals to global variables.
2017-09-27 11:48:02 +01:00
cc56628117
Don't use all_final as a target in tests/data_files/Makefile
...
The `neat` target in that Makefile assumes all_final to be a concatenation of
file names.
2017-09-26 16:21:19 +01:00
2f73c9342f
Fix Changelog notation
...
Remove backticks, since ChangeLog is not in MarkDown
2017-09-26 15:06:56 +03:00
8b766218a8
Update ChangeLog
...
Update ChangeLog according to Andres seggestion
2017-09-24 15:44:56 +03:00
2981a0a740
Address Andres PR comments
...
Address Andres' comments in the PR
2017-09-24 15:41:09 +03:00
1526330931
Allow alternate implementation of GCM
...
Provide the ability to use an alternative implementation of GCM in place
of the library-provided implementation.
2017-09-22 17:42:44 +01:00
6428f8d78e
Let ssl-opt.sh gracefully fail is SSL_MAX_CONTENT_LEN is not 16384
...
Some tests in ssl-opt.sh require MBEDTLS_SSL_MAX_CONTENT_LEN to be set to its
default value of 16384 to succeed. While ideally such a dependency should not
exist, as a short-term remedy this commit adds a small check that will at least
lead to graceful exit if that assumption is violated.
2017-09-22 16:58:50 +01:00
d8a6f7cfbe
Clarify code-paths in x509write_csr and x509write_crt
2017-09-22 16:05:43 +01:00
a20e33ad59
Use X509 CRT version macros for version checks in x509write_crt_der
2017-09-22 15:40:01 +01:00
7f3652ddf1
Fix error code printing in cert_write
...
Error codes can consume up to two bytes, but only one was printed so far.
2017-09-22 15:39:02 +01:00
38eff43791
Use X509 CRT version macros in cert_write program
2017-09-22 15:38:20 +01:00
e1b1d0af8e
Fix senseless comment
2017-09-22 15:35:16 +01:00
1ad1c6d4e1
Fix typo
2017-09-21 12:05:30 +01:00
b174c84a3b
Refine dhm_check_range() fix Changelog entry
2017-09-21 12:05:14 +01:00
aa325d7b7f
DHM: Fix dhm_check_range() always returning 0
...
Although the variable ret was initialised to an error, the
MBEDTLS_MPI_CHK macro was overwriting it. Therefore it ended up being
0 whenewer the bignum computation was successfull and stayed 0
independently of the actual check.
2017-09-21 12:04:41 +01:00
4b151fabb7
DHM: Add negative tests for parameter checking
...
A bug in the dhm_check_range() function makes it pass even when the
parameters are not in the range. This commit adds tests for signalling
this problem as well as a couple of other negative tests.
2017-09-21 12:03:06 +01:00
930025da6d
Adapt ChangeLog
2017-09-18 16:12:28 +01:00
0b7b83fd91
Fixed SIGSEGV problem when writing with ssl_write_real a buffer that is over MBEDTLS_SSL_MAX_CONTENT_LEN bytes
...
Signed-off-by: Florin <petriuc.florin@gmail.com >
2017-09-18 16:11:42 +01:00
2b187c4d5f
Correct typo
2017-09-18 16:11:42 +01:00
09930d1f01
Add expected number of fragments to 16384-byte packet tests
2017-09-18 16:11:42 +01:00
c526696c05
Add tests for messages beyond 16384 bytes to ssl-opt.sh
...
This commit adds four tests to ssl-opt.sh testing the library's behavior when
`mbedtls_ssl_write` is called with messages beyond 16384 bytes. The combinations
tested are TLS vs. DTLS and MBEDTLS_SSL_MAX_FRAGMENT_LENGTH enabled vs. disabled.
2017-09-18 16:11:42 +01:00
4aed27e469
Add missing test-dependencies for MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
...
The tests for the maximum fragment length extension were lacking a dependency on
MBEDTLS_SSL_MAX_FRAGMENT_LENGTH being set in the config.
2017-09-18 16:11:42 +01:00
e4ad3e8803
Allow requests of size larger than 16384 in ssl_client2
2017-09-18 16:11:42 +01:00
5175ac6e13
Add tests for disabled MFL-extension to all.sh
...
This commit adds a build with default config except
MBEDTLS_SSL_MAX_FRAGMENT_LENGTH to all.sh, as well as a run of the MFL-related
tests in ssl-opt.sh.
2017-09-18 16:11:39 +01:00
4a2fb4c6be
Addres review comments
...
Resolves comments raised in the review
2017-09-18 13:43:05 +03:00
81e96dd54a
Adapt ChangeLog
2017-09-18 11:07:25 +01:00
147d142948
Add log and fix stle issues
...
Address Andres comments of PR
2017-09-18 13:05:53 +03:00
714785dcc2
Write correct number of ciphersuites in log
...
Change location of log, to fit the correct number of used ciphersuites
2017-09-18 13:05:48 +03:00
9648f8b59c
Add run-time check for handshake message size in ssl_write_record
2017-09-18 10:56:15 +01:00
d33f1ca34c
Add run-time check for record content size in ssl_encrypt_buf
2017-09-18 10:56:14 +01:00
a8434e8f95
Add compile-time checks for size of record content and payload
2017-09-18 10:56:14 +01:00
01692531c6
Document code silently discarding invalid records
2017-09-14 20:20:31 +01:00
f569f701c2
Fix ChangeLog entry
2017-09-14 20:20:21 +01:00
06fc6650f4
Add ChangeLog entry
2017-09-14 20:20:15 +01:00
2fad94b193
Dont send alert on invalid DTLS record type
...
Do not send fatal alerts when receiving a record with an invalid header
while running DTLS as this is not compliant behaviour.
2017-09-14 20:18:37 +01:00
d4a872ee67
Rename internal MBEDTLS_ENTROPY_HAVE_STRONG to ENTROPY_HAVE_STRONG
...
This commit renames the test-only flag MBEDTLS_ENTROPY_HAVE_STRONG to ENTROPY_HAVE_STRONG to make it more transparent
that it's an internal flag, and also to content the testscript tests/scripts/check-names.pl which previously complained
about the macro occurring in a comment in `entropy.c` without being defined in a library file.
2017-09-14 08:04:13 +01:00
45037ceac5
Add check for presence of relevant parameters in mbedtls_rsa_private
...
If CRT is used, check for the presence N, P, Q, D, E, DP, DQ and QP. If CRT is
not used, check for N, P, Q, D, E only.
2017-09-14 08:02:14 +01:00
81535d0011
Minor style and typo corrections
2017-09-14 07:51:54 +01:00
476986547b
Omit version from X.509 v1 certificates
...
The version field in an X.509 certificate is optional and defaults to v1, so it
may be omitted in this case.
2017-09-14 07:51:54 +01:00
