dba460f2f3
Add SSL "assertion" to help static analysis
2015-06-25 10:59:57 +02:00
1cf7b30dc8
Rewrite test to make Coverity happier
...
With the default config, it noticed the accept_comp was always 0, so the rest
of the test was dead code.
2015-06-25 10:59:56 +02:00
5c59a4fea5
Split libs with make + general make cleanups
2015-06-25 10:59:56 +02:00
21dcc1e748
fixup
2015-06-25 10:59:56 +02:00
463e09d64b
Prepare library split
2015-06-24 12:05:33 +02:00
bae389b4d4
Fix uninitialized access
...
Found using Codenomicon Defensics.
2015-06-24 10:47:33 +02:00
bcc030849a
Avoid fclose( NULL )
...
Found by Coverity Scan.
2015-06-24 00:09:29 +02:00
fd474233c8
Change SSL debug API in the library
2015-06-23 18:44:11 +02:00
79c4e3ee59
Rm obsolete comments
2015-06-23 18:44:10 +02:00
b86145e6cd
Avoid potential NULL dereference.
...
May happen with a faulty configuration (eg no allowed curve but trying to use
ECDHE key exchange), but not trigger able remotely.
(Found with Clang's scan-build.)
2015-06-23 18:44:10 +02:00
14bf7063b9
Add SSL "assertions" to help static analyzers
...
scan-build was reporting NULL dereferences
2015-06-23 18:44:10 +02:00
b9c93d0d0a
Fix earlier incomplete change in RSA PMS reading
...
Probably a bad merge from the 1.3 branch
2015-06-23 18:43:53 +02:00
19389753c8
Avoid dead stores (makes scan-build happier)
2015-06-23 13:46:44 +02:00
c0d749418b
Make 'port' a string in NET module
...
- avoids dependency on snprintf
- allows using "smtps" instead of "456" if desired
2015-06-23 13:09:11 +02:00
d23f593737
Avoid static buffer in debug module
...
Caused issues in threading situations
2015-06-23 13:09:11 +02:00
96fb685e31
Some more init calls
2015-06-23 13:09:11 +02:00
496f24e949
Deduplicate SHA-2 wrappers
2015-06-23 13:09:11 +02:00
ab5932192a
Call init functions in MD alloc wrappers
...
When someone defines MBEDTLS_MD5_ALT for example, the init function may need
to do more that just zeroizing the context
2015-06-23 13:09:11 +02:00
1cd10adc7c
Update prototype of x509write_set_key_usage()
...
Allow for future support of decipherOnly and encipherOnly. Some work will be
required to ensure we still write only one byte when only one is needed.
2015-06-23 13:09:10 +02:00
655a964539
Adapt check_key_usage to new weird bits
2015-06-23 13:09:10 +02:00
9a702255f4
Add parsing/printing for new X.509 keyUsage flags
2015-06-23 13:09:10 +02:00
b80d16d171
Fix return convention of x509_wildcard_verify()
2015-06-23 13:09:10 +02:00
07894338a0
Rename M255 to Curve25519
2015-06-23 13:09:10 +02:00
7320eb46d4
Remove references to some Montgomery curves
...
After all it looks like those won't become standard.
2015-06-23 13:09:10 +02:00
9386664543
Move from inttypes.h to stdint.h
...
Some toolchains do not have inttypes.h, and we only need stdint.h which is a
subset of it.
2015-06-22 23:41:26 +02:00
e7e89844d6
Fix and document corner-cases of time checking
2015-06-22 23:41:24 +02:00
57e10d71be
Fix potential NULL dereference.
...
Introduced when moving from gmtime_r() to gmtime().
Found with fbinfer.
2015-06-22 23:40:44 +02:00
f9b85d96a9
Fix potential resource leak in X.509 parse dir
...
Found with fbinfer.
2015-06-22 18:39:57 +02:00
bcf13bab5d
Fix issue with MemSan and entropy
...
Due to the recent change about entropy sources strength, it is no longer
acceptable to just disable the platform source. So, instead "fix" it so that
it is clear to MemSan that memory is initialized.
I tried __attribute__((no_sanitize_memory)) and MemSan's blacklist file, but
couldn't seem to get them to work.
2015-06-22 18:25:41 +02:00
cdc26ae099
Add mbedtls_ssl_set_hs_authmode
...
While at it, fix the following:
- on server with RSA_PSK, we don't want to set flags (client auth happens via
the PSK, no cert is expected).
- use safer tests (eg == OPTIONAL vs != REQUIRED)
2015-06-22 14:52:40 +02:00
9dbaf400ef
Rationalize other snprintf() uses
2015-06-22 14:42:04 +02:00
1685368408
Rationalize snprintf() usage in X.509 modules
2015-06-22 14:42:04 +02:00
6c0c8e0d3d
Include fixed snprintf for Windows in platform.c
...
Use _WIN32 to detect it rather that _MSC_VER as it turns out MSYS2 uses the
broken MS version by default too.
2015-06-22 14:42:04 +02:00
f9cbd73191
Update generated files
2015-06-22 14:40:56 +02:00
7580ba475d
Add a concept of entropy source strength.
...
The main goal is, we want and error if cycle counter is the only source.
2015-06-22 14:40:56 +02:00
3f77dfbd52
Add MBEDTLS_ENTROPY_HARDWARE_ALT
...
Makes it easier for an external module to plug its hardware entropy collector.
2015-06-22 14:40:56 +02:00
bf82ff0209
Fix entropy thresholds
2015-06-22 14:40:56 +02:00
60c793bdc9
Split HAVE_TIME into HAVE_TIME + HAVE_TIME_DATE
...
First one means we have time() but it may not return the actual wall clock
time, second means it does.
2015-06-22 14:40:56 +02:00
c0696c216b
Rename mbedtls_mpi_msb to mbedtls_mpi_bitlen
2015-06-18 16:49:37 +02:00
097c7bb05b
Rename relevant global symbols from size to bitlen
...
Just applying rename.pl with this file:
mbedtls_cipher_get_key_size mbedtls_cipher_get_key_bitlen
mbedtls_pk_get_size mbedtls_pk_get_bitlen
MBEDTLS_BLOWFISH_MIN_KEY MBEDTLS_BLOWFISH_MIN_KEY_BITS
MBEDTLS_BLOWFISH_MAX_KEY MBEDTLS_BLOWFISH_MAX_KEY_BITS
2015-06-18 16:43:38 +02:00
fb317c5221
Rename parameter in a x509 helper
2015-06-18 16:41:13 +02:00
39a48f4934
Internal renamings in PK
...
+ an unrelated comment in SSL
2015-06-18 16:06:55 +02:00
12ad798c87
Rename ssl_session.length to id_len
2015-06-18 15:50:37 +02:00
898e0aa210
Rename key_length in cipher_info
2015-06-18 15:31:10 +02:00
b8186a5e54
Rename len to bitlen in function parameters
...
Clarify a few comments too.
2015-06-18 14:58:58 +02:00
b31c5f68b1
Add SSL presets.
...
No need to use a separate profile as in X.509, everything we need is already
in ssl_config. Just load appropriate values.
2015-06-17 14:59:27 +02:00
7bfc122703
Implement sig_hashes
2015-06-17 14:34:48 +02:00
36a8b575a9
Create API for mbedtls_ssl_conf_sig_hashes().
...
Not implemented yet.
2015-06-17 14:27:39 +02:00
9d412d872c
Small internal changes in curve checking
...
- switch from is_acceptable to the more usual check
- add NULL check just in case user screwed up config
2015-06-17 14:27:39 +02:00
a83e4e2bf5
Extra check in verify_with_profile()
...
This could happen if someone doesn't set the SSL configuration properly. In
that case we don't want to segfault...
2015-06-17 14:27:38 +02:00
