aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2019-03-01Merge remote-tracking branch 'public/pr/2421' into developmentarchive/mbedtls-2.17Simon Butcher19-449/+898
* public/pr/2421: (68 commits) Fix unused variable warning in ssl_parse_certificate_coordinate() Add missing compile time guard in ssl_client2 Update programs/ssl/query_config.c ssl_client2: Reset peer CRT info string on reconnect Add further debug statements on assertion failures Fix typo in documentation of ssl_parse_certificate_chain() Add debug output in case of assertion failure Fix typo in SSL ticket documentation Add config sanity check for !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE ssl_client2: Zeroize peer CRT info buffer when reconnecting Reintroduce numerous ssl-opt.sh tests if !MBEDTLS_SSL_KEEP_PEER_CERT ssl_client2: Extract peer CRT info from verification callback Improve documentation of mbedtls_ssl_get_peer_cert() Improve documentation of MBEDTLS_SSL_KEEP_PEER_CERTIFICATE Fix indentation of Doxygen comment in ssl_internal.h Set peer CRT length only after successful allocation Remove question in comment about verify flags on cli vs. server Remove misleading and redundant guard around restartable ECC field Add test for !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE to all.sh Free peer CRT chain immediately after verifying it ...
2019-03-01Merge remote-tracking branch 'restricted/pr/528' into developmentSimon Butcher10-31/+94
* restricted/pr/528: Update query_config.c Fix failure in SSLv3 per-version suites test Adjust DES exclude lists in test scripts Clarify 3DES changes in ChangeLog Fix documentation for 3DES removal Exclude 3DES tests in test scripts Fix wording of ChangeLog and 3DES_REMOVE docs Reduce priority of 3DES ciphersuites
2019-03-01Merge remote-tracking branch 'public/pr/2028' into developmentSimon Butcher23-122/+408
* public/pr/2028: Update the crypto submodule to a78c958 Fix ChangeLog entry to correct release version Fix typo in x509write test data Add ChangeLog entry for unused bits in bitstrings Improve docs for named bitstrings and their usage Add tests for (named) bitstring to suite_asn1write Add new function mbedtls_asn1_write_named_bitstring()
2019-03-01Merge remote-tracking branch 'public/pr/2447' into developmentSimon Butcher5-12/+12
* public/pr/2447: Unbump version to 0.0.0
2019-03-01Merge remote-tracking branch 'public/pr/2448' into developmentSimon Butcher2-21/+10
* public/pr/2448: Reword changelog entry Update change log Reenable GnuTLS next based tests
2019-03-01Update query_config.cManuel Pégourié-Gonnard1-0/+8
2019-03-01Fix failure in SSLv3 per-version suites testManuel Pégourié-Gonnard1-5/+16
The test used 3DES as the suite for SSLv3, which now makes the handshake fails with "no ciphersuite in common", failing the test as well. Use Camellia instead (as there are not enough AES ciphersuites before TLS 1.2 to distinguish between the 3 versions). Document some dependencies, but not all. Just trying to avoid introducing new issues by using a new cipher here, not trying to make it perfect, which is a much larger task out of scope of this commit.
2019-03-01Adjust DES exclude lists in test scriptsAndres Amaya Garcia3-3/+3
2019-03-01Clarify 3DES changes in ChangeLogAndres Amaya Garcia1-1/+2
2019-03-01Fix documentation for 3DES removalAndres Amaya Garcia2-1/+2
2019-03-01Exclude 3DES tests in test scriptsAndres Amaya Garcia3-4/+4
2019-03-01Fix wording of ChangeLog and 3DES_REMOVE docsAndres Amaya Garcia2-5/+13
2019-03-01Reduce priority of 3DES ciphersuitesAndres Amaya Garcia5-26/+60
2019-03-01Fix unused variable warning in ssl_parse_certificate_coordinate()Hanno Becker1-0/+2
This was triggered in client-only builds.
2019-02-28Update the crypto submodule to a78c958Simon Butcher1-19/+6
Update the crypto submodule to commit a78c958b17d75ddf63d8dd17255b6379dcbf259f to include the equivalent changes in this PR within the submodule.
2019-02-28Fix ChangeLog entry to correct release versionAndres Amaya Garcia1-2/+2
2019-02-28Fix typo in x509write test dataAndres Amaya Garcia1-1/+1
2019-02-28Add ChangeLog entry for unused bits in bitstringsAndres Amaya Garcia1-0/+8
2019-02-28Improve docs for named bitstrings and their usageAndres Amaya Garcia2-8/+18
2019-02-28Add tests for (named) bitstring to suite_asn1writeAndres Amaya Garcia16-78/+274
2019-02-28Add new function mbedtls_asn1_write_named_bitstring()Andres Amaya Garcia4-25/+110
Add a new function mbedtls_asn1_write_named_bitstring() that removes trailing 0s at the end of DER encoded bitstrings. The function is implemented according to Hanno Becker's suggestions. This commit also changes the functions x509write_crt_set_ns_cert_type and crt_set_key_usage to call the new function as the use named bitstrings instead of the regular bitstrings.
2019-02-27Add missing compile time guard in ssl_client2Hanno Becker1-0/+4
2019-02-26Update programs/ssl/query_config.cHanno Becker1-0/+8
2019-02-26ssl_client2: Reset peer CRT info string on reconnectHanno Becker1-0/+2
2019-02-26Add further debug statements on assertion failuresHanno Becker1-0/+2
2019-02-26Fix typo in documentation of ssl_parse_certificate_chain()Hanno Becker1-1/+1
2019-02-26Add debug output in case of assertion failureHanno Becker1-0/+1
2019-02-26Fix typo in SSL ticket documentationHanno Becker1-1/+1
2019-02-26Add config sanity check for !MBEDTLS_SSL_KEEP_PEER_CERTIFICATEHanno Becker2-2/+13
2019-02-26ssl_client2: Zeroize peer CRT info buffer when reconnectingHanno Becker1-1/+4
2019-02-26Reintroduce numerous ssl-opt.sh tests if !MBEDTLS_SSL_KEEP_PEER_CERTHanno Becker1-11/+0
2019-02-26ssl_client2: Extract peer CRT info from verification callbackHanno Becker1-10/+12
So far, `ssl_client2` printed the CRT info for the peer's CRT by requesting the latter through `mbedtls_ssl_get_peer_cert()` at the end of the handshake, and printing it via `mbedtls_x509_crt_info()`. When `MBEDTLS_SSL_KEEP_PEER_CERTIFICATE` is disabled, this does no longer work because the peer's CRT isn't stored beyond the handshake. This makes some tests in `ssl-opt.sh` fail which rely on the CRT info output for the peer certificate. This commit modifies `ssl_client2` to extract the peer CRT info from the verification callback, which is always called at a time when the peer's CRT is available. This way, the peer's CRT info is still printed if `MBEDTLS_SSL_KEEP_PEER_CERTIFICATE` is disabled.
2019-02-26Improve documentation of mbedtls_ssl_get_peer_cert()Hanno Becker1-12/+8
2019-02-26Improve documentation of MBEDTLS_SSL_KEEP_PEER_CERTIFICATEHanno Becker1-1/+1
2019-02-26Fix indentation of Doxygen comment in ssl_internal.hHanno Becker1-1/+1
2019-02-26Set peer CRT length only after successful allocationHanno Becker1-2/+2
2019-02-26Remove question in comment about verify flags on cli vs. serverHanno Becker1-2/+0
2019-02-26Remove misleading and redundant guard around restartable ECC fieldHanno Becker1-2/+0
`MBEDTLS_SSL__ECP_RESTARTABLE` is only defined if `MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED` is set, which requires `MBEDTLS_X509_PARSE_C` to be set (this is checked in `check_config.`). The additional `MBEDTLS_X509_PARSE_C` guard around the `ecrs_peer_cert` field is therefore not necessary; moreover, it's misleading, because it hasn't been used consistently throughout the code.
2019-02-26Add test for !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE to all.shHanno Becker1-0/+16
2019-02-26Free peer CRT chain immediately after verifying itHanno Becker1-39/+77
If we don't need to store the peer's CRT chain permanently, we may free it immediately after verifying it. Moreover, since we parse the CRT chain in-place from the input buffer in this case, pointers from the CRT structure remain valid after freeing the structure, and we use that to extract the digest and pubkey from the CRT after freeing the structure.
2019-02-26Parse peer's CRT chain in-place from the input bufferHanno Becker1-0/+6
2019-02-26Free peer's public key as soon as it's no longer neededHanno Becker1-0/+18
On constrained devices, this saves a significant amount of RAM that might be needed for subsequent expensive operations like ECDHE.
2019-02-26Correct compile-time guards for ssl_clear_peer_cert()Hanno Becker1-21/+23
It is used in `mbedtls_ssl_session_free()` under `MBEDTLS_X509_CRT_PARSE_C`, but defined only if `MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED`. Issue #2422 tracks the use of `MBEDTLS_KEY_EXCHANGE__WITH_CERT_ENABLED` instead of `MBEDTLS_X509_CRT_PARSE_C` for code and fields related to CRT-based ciphersuites.
2019-02-26Adapt ChangeLogHanno Becker1-0/+7
2019-02-26Guard mbedtls_ssl_get_peer_cert() by new compile-time optionHanno Becker1-0/+4
2019-02-26Add dependency to ssl-opt.sh tests which need peer CRT debug infoHanno Becker1-0/+11
2019-02-26Adapt mbedtls_ssl_parse_certificate() to removal of peer_cert fieldHanno Becker1-2/+2
2019-02-26Adapt ssl_clear_peer_cert() to removal of `peer_cert` fieldHanno Becker1-3/+3
2019-02-26Adapt mbedtls_ssl_session_copy() to removal of `peer_cert` fieldHanno Becker1-2/+3
2019-02-26Adapt session ticket implementation to removal of `peer_cert` fieldHanno Becker1-1/+2
generated by cgit v1.1 at 2024-07-11 10:26:16 +0000