mirror of
https://github.com/deneraraujo/OpenVPNAdapter.git
synced 2026-04-24 00:00:05 +08:00
Update mbedTLS library
This commit is contained in:
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_AESNI_H
|
||||
#define MBEDTLS_AESNI_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "aes.h"
|
||||
|
||||
#define MBEDTLS_AESNI_AES 0x02000000u
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_ASN1_WRITE_H
|
||||
#define MBEDTLS_ASN1_WRITE_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "asn1.h"
|
||||
|
||||
#define MBEDTLS_ASN1_CHK_ADD(g, f) do { if( ( ret = f ) < 0 ) return( ret ); else \
|
||||
@@ -183,24 +189,27 @@ int mbedtls_asn1_write_ia5_string( unsigned char **p, unsigned char *start,
|
||||
const char *text, size_t text_len );
|
||||
|
||||
/**
|
||||
* \brief Write a bitstring tag (MBEDTLS_ASN1_BIT_STRING) and
|
||||
* value in ASN.1 format
|
||||
* Note: function works backwards in data buffer
|
||||
* \brief Write a bitstring tag (#MBEDTLS_ASN1_BIT_STRING) and
|
||||
* value in ASN.1 format.
|
||||
*
|
||||
* \param p reference to current position pointer
|
||||
* \param start start of the buffer (for bounds-checking)
|
||||
* \param buf the bitstring
|
||||
* \param bits the total number of bits in the bitstring
|
||||
* \note This function works backwards in data buffer.
|
||||
*
|
||||
* \return the length written or a negative error code
|
||||
* \param p The reference to the current position pointer.
|
||||
* \param start The start of the buffer, for bounds-checking.
|
||||
* \param buf The bitstring to write.
|
||||
* \param bits The total number of bits in the bitstring.
|
||||
*
|
||||
* \return The number of bytes written to \p p on success.
|
||||
* \return A negative error code on failure.
|
||||
*/
|
||||
int mbedtls_asn1_write_bitstring( unsigned char **p, unsigned char *start,
|
||||
const unsigned char *buf, size_t bits );
|
||||
|
||||
/**
|
||||
* \brief Write an octet string tag (MBEDTLS_ASN1_OCTET_STRING) and
|
||||
* value in ASN.1 format
|
||||
* Note: function works backwards in data buffer
|
||||
* \brief Write an octet string tag (#MBEDTLS_ASN1_OCTET_STRING)
|
||||
* and value in ASN.1 format.
|
||||
*
|
||||
* \note This function works backwards in data buffer.
|
||||
*
|
||||
* \param p reference to current position pointer
|
||||
* \param start start of the buffer (for bounds-checking)
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_BASE64_H
|
||||
#define MBEDTLS_BASE64_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#define MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL -0x002A /**< Output buffer too small. */
|
||||
|
||||
@@ -38,6 +38,12 @@
|
||||
#ifndef MBEDTLS_BN_MUL_H
|
||||
#define MBEDTLS_BN_MUL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "bignum.h"
|
||||
|
||||
#if defined(MBEDTLS_HAVE_ASM)
|
||||
@@ -170,19 +176,19 @@
|
||||
|
||||
#define MULADDC_INIT \
|
||||
asm( \
|
||||
"xorq %%r8, %%r8 \n\t"
|
||||
"xorq %%r8, %%r8\n"
|
||||
|
||||
#define MULADDC_CORE \
|
||||
"movq (%%rsi), %%rax \n\t" \
|
||||
"mulq %%rbx \n\t" \
|
||||
"addq $8, %%rsi \n\t" \
|
||||
"addq %%rcx, %%rax \n\t" \
|
||||
"movq %%r8, %%rcx \n\t" \
|
||||
"adcq $0, %%rdx \n\t" \
|
||||
"nop \n\t" \
|
||||
"addq %%rax, (%%rdi) \n\t" \
|
||||
"adcq %%rdx, %%rcx \n\t" \
|
||||
"addq $8, %%rdi \n\t"
|
||||
"movq (%%rsi), %%rax\n" \
|
||||
"mulq %%rbx\n" \
|
||||
"addq $8, %%rsi\n" \
|
||||
"addq %%rcx, %%rax\n" \
|
||||
"movq %%r8, %%rcx\n" \
|
||||
"adcq $0, %%rdx\n" \
|
||||
"nop \n" \
|
||||
"addq %%rax, (%%rdi)\n" \
|
||||
"adcq %%rdx, %%rcx\n" \
|
||||
"addq $8, %%rdi\n"
|
||||
|
||||
#define MULADDC_STOP \
|
||||
: "+c" (c), "+D" (d), "+S" (s) \
|
||||
@@ -734,7 +740,7 @@
|
||||
"sw $10, %2 \n\t" \
|
||||
: "=m" (c), "=m" (d), "=m" (s) \
|
||||
: "m" (s), "m" (d), "m" (c), "m" (b) \
|
||||
: "$9", "$10", "$11", "$12", "$13", "$14", "$15" \
|
||||
: "$9", "$10", "$11", "$12", "$13", "$14", "$15", "lo", "hi" \
|
||||
);
|
||||
|
||||
#endif /* MIPS */
|
||||
|
||||
@@ -34,6 +34,12 @@
|
||||
#ifndef MBEDTLS_CCM_H
|
||||
#define MBEDTLS_CCM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "cipher.h"
|
||||
|
||||
#define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D /**< Bad input parameters to the function. */
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_CERTS_H
|
||||
#define MBEDTLS_CERTS_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#ifdef __cplusplus
|
||||
|
||||
@@ -107,7 +107,7 @@
|
||||
#error "MBEDTLS_ECDSA_DETERMINISTIC defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_C) && ( !defined(MBEDTLS_BIGNUM_C) || ( \
|
||||
#if defined(MBEDTLS_ECP_C) && ( !defined(MBEDTLS_BIGNUM_C) || ( \
|
||||
!defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \
|
||||
@@ -118,10 +118,15 @@
|
||||
!defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) ) )
|
||||
!defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) && \
|
||||
!defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) ) )
|
||||
#error "MBEDTLS_ECP_C defined, but not all prerequisites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PK_PARSE_C) && !defined(MBEDTLS_ASN1_PARSE_C)
|
||||
#error "MBEDTLS_PK_PARSE_C defined, but not all prerequesites"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ENTROPY_C) && (!defined(MBEDTLS_SHA512_C) && \
|
||||
!defined(MBEDTLS_SHA256_C))
|
||||
#error "MBEDTLS_ENTROPY_C defined, but not all prerequisites"
|
||||
@@ -667,7 +672,7 @@
|
||||
/*
|
||||
* Avoid warning from -pedantic. This is a convenient place for this
|
||||
* workaround since this is included by every single file before the
|
||||
* #if defined(MBEDTLS_xxx_C) that results in emtpy translation units.
|
||||
* #if defined(MBEDTLS_xxx_C) that results in empty translation units.
|
||||
*/
|
||||
typedef int mbedtls_iso_c_forbids_empty_translation_units;
|
||||
|
||||
|
||||
@@ -26,6 +26,12 @@
|
||||
#ifndef MBEDTLS_CMAC_H
|
||||
#define MBEDTLS_CMAC_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "cipher.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
|
||||
@@ -25,6 +25,12 @@
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if ! defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
|
||||
#if defined(MBEDTLS_DEPRECATED_WARNING)
|
||||
|
||||
@@ -112,7 +112,7 @@
|
||||
* \def MBEDTLS_HAVE_TIME_DATE
|
||||
*
|
||||
* System has time.h and time(), gmtime() and the clock is correct.
|
||||
* The time needs to be correct (not necesarily very accurate, but at least
|
||||
* The time needs to be correct (not necessarily very accurate, but at least
|
||||
* the date should be correct). This is used to verify the validity period of
|
||||
* X.509 certificates.
|
||||
*
|
||||
@@ -318,7 +318,7 @@
|
||||
* \note Because of a signature change, the core AES encryption and decryption routines are
|
||||
* currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt,
|
||||
* respectively. When setting up alternative implementations, these functions should
|
||||
* be overriden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt
|
||||
* be overridden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt
|
||||
* must stay untouched.
|
||||
*
|
||||
* \note If you use the AES_xxx_ALT macros, then is is recommended to also set
|
||||
@@ -333,6 +333,16 @@
|
||||
* dependencies on them, and considering stronger message digests
|
||||
* and ciphers instead.
|
||||
*
|
||||
* \warning If both MBEDTLS_ECDSA_SIGN_ALT and MBEDTLS_ECDSA_DETERMINISTIC are
|
||||
* enabled, then the deterministic ECDH signature functions pass the
|
||||
* the static HMAC-DRBG as RNG to mbedtls_ecdsa_sign(). Therefore
|
||||
* alternative implementations should use the RNG only for generating
|
||||
* the ephemeral key and nothing else. If this is not possible, then
|
||||
* MBEDTLS_ECDSA_DETERMINISTIC should be disabled and an alternative
|
||||
* implementation should be provided for mbedtls_ecdsa_sign_det_ext()
|
||||
* (and for mbedtls_ecdsa_sign_det() too if backward compatibility is
|
||||
* desirable).
|
||||
*
|
||||
*/
|
||||
//#define MBEDTLS_MD2_PROCESS_ALT
|
||||
//#define MBEDTLS_MD4_PROCESS_ALT
|
||||
@@ -556,6 +566,26 @@
|
||||
*/
|
||||
#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_REMOVE_3DES_CIPHERSUITES
|
||||
*
|
||||
* Remove 3DES ciphersuites by default in SSL / TLS.
|
||||
* This flag removes the ciphersuites based on 3DES from the default list as
|
||||
* returned by mbedtls_ssl_list_ciphersuites(). However, it is still possible
|
||||
* to enable (some of) them with mbedtls_ssl_conf_ciphersuites() by including
|
||||
* them explicitly.
|
||||
*
|
||||
* A man-in-the-browser attacker can recover authentication tokens sent through
|
||||
* a TLS connection using a 3DES based cipher suite (see "On the Practical
|
||||
* (In-)Security of 64-bit Block Ciphers" by Karthikeyan Bhargavan and Gaëtan
|
||||
* Leurent, see https://sweet32.info/SWEET32_CCS16.pdf). If this attack falls
|
||||
* in your threat model or you are unsure, then you should keep this option
|
||||
* enabled to remove 3DES based cipher suites.
|
||||
*
|
||||
* Comment this macro to keep 3DES in the default ciphersuite list.
|
||||
*/
|
||||
#define MBEDTLS_REMOVE_3DES_CIPHERSUITES
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_ECP_DP_SECP192R1_ENABLED
|
||||
*
|
||||
@@ -1188,7 +1218,7 @@
|
||||
/**
|
||||
* \def MBEDTLS_SSL_RENEGOTIATION
|
||||
*
|
||||
* Disable support for TLS renegotiation.
|
||||
* Enable support for TLS renegotiation.
|
||||
*
|
||||
* The two main uses of renegotiation are (1) refresh keys on long-lived
|
||||
* connections and (2) client authentication after the initial handshake.
|
||||
@@ -1372,7 +1402,7 @@
|
||||
* \def MBEDTLS_SSL_SESSION_TICKETS
|
||||
*
|
||||
* Enable support for RFC 5077 session tickets in SSL.
|
||||
* Client-side, provides full support for session tickets (maintainance of a
|
||||
* Client-side, provides full support for session tickets (maintenance of a
|
||||
* session store remains the responsibility of the application, though).
|
||||
* Server-side, you also need to provide callbacks for writing and parsing
|
||||
* tickets, including authenticated encryption and key management. Example
|
||||
@@ -1538,7 +1568,7 @@
|
||||
*
|
||||
* \warning TLS-level compression MAY REDUCE SECURITY! See for example the
|
||||
* CRIME attack. Before enabling this option, you should examine with care if
|
||||
* CRIME or similar exploits may be a applicable to your use case.
|
||||
* CRIME or similar exploits may be applicable to your use case.
|
||||
*
|
||||
* \note Currently compression can't be used with DTLS.
|
||||
*
|
||||
@@ -2734,7 +2764,7 @@
|
||||
//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
|
||||
//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */
|
||||
//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */
|
||||
/* Note: your snprintf must correclty zero-terminate the buffer! */
|
||||
/* Note: your snprintf must correctly zero-terminate the buffer! */
|
||||
//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */
|
||||
//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */
|
||||
//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */
|
||||
@@ -2751,7 +2781,7 @@
|
||||
//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
|
||||
//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */
|
||||
//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */
|
||||
/* Note: your snprintf must correclty zero-terminate the buffer! */
|
||||
/* Note: your snprintf must correctly zero-terminate the buffer! */
|
||||
//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */
|
||||
//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
|
||||
//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
|
||||
|
||||
@@ -28,6 +28,12 @@
|
||||
#ifndef MBEDTLS_CTR_DRBG_H
|
||||
#define MBEDTLS_CTR_DRBG_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "aes.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
@@ -227,14 +233,37 @@ int mbedtls_ctr_drbg_reseed( mbedtls_ctr_drbg_context *ctx,
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param additional The data to update the state with.
|
||||
* \param add_len Length of \p additional data.
|
||||
* \param add_len Length of \p additional in bytes. This must be at
|
||||
* most #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT.
|
||||
*
|
||||
* \note If \p add_len is greater than #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT,
|
||||
* only the first #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT Bytes are used.
|
||||
* The remaining Bytes are silently discarded.
|
||||
* \return \c 0 on success.
|
||||
* \return #MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG if
|
||||
* \p add_len is more than
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT.
|
||||
* \return An error from the underlying AES cipher on failure.
|
||||
*/
|
||||
int mbedtls_ctr_drbg_update_ret( mbedtls_ctr_drbg_context *ctx,
|
||||
const unsigned char *additional,
|
||||
size_t add_len );
|
||||
|
||||
/**
|
||||
* \brief This function updates the state of the CTR_DRBG context.
|
||||
*
|
||||
* \warning This function cannot report errors. You should use
|
||||
* mbedtls_ctr_drbg_update_ret() instead.
|
||||
*
|
||||
* \note If \p add_len is greater than
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT, only the first
|
||||
* #MBEDTLS_CTR_DRBG_MAX_SEED_INPUT Bytes are used.
|
||||
* The remaining Bytes are silently discarded.
|
||||
*
|
||||
* \param ctx The CTR_DRBG context.
|
||||
* \param additional The data to update the state with.
|
||||
* \param add_len Length of \p additional data.
|
||||
*/
|
||||
void mbedtls_ctr_drbg_update( mbedtls_ctr_drbg_context *ctx,
|
||||
const unsigned char *additional, size_t add_len );
|
||||
const unsigned char *additional,
|
||||
size_t add_len );
|
||||
|
||||
/**
|
||||
* \brief This function updates a CTR_DRBG instance with additional
|
||||
|
||||
@@ -33,6 +33,12 @@
|
||||
#ifndef MBEDTLS_ECDH_H
|
||||
#define MBEDTLS_ECDH_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ecp.h"
|
||||
|
||||
#ifdef __cplusplus
|
||||
|
||||
@@ -31,6 +31,12 @@
|
||||
#ifndef MBEDTLS_ECDSA_H
|
||||
#define MBEDTLS_ECDSA_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ecp.h"
|
||||
#include "md.h"
|
||||
|
||||
@@ -101,6 +107,20 @@ int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
|
||||
* Usage of the Digital Signature Algorithm (DSA) and Elliptic
|
||||
* Curve Digital Signature Algorithm (ECDSA)</em>.
|
||||
*
|
||||
*
|
||||
* \warning Since the output of the internal RNG is always the same for
|
||||
* the same key and message, this limits the efficiency of
|
||||
* blinding and leaks information through side channels. For
|
||||
* secure behavior use mbedtls_ecdsa_sign_det_ext() instead.
|
||||
*
|
||||
* (Optimally the blinding is a random value that is different
|
||||
* on every execution. In this case the blinding is still
|
||||
* random from the attackers perspective, but is the same on
|
||||
* each execution. This means that this blinding does not
|
||||
* prevent attackers from recovering secrets by combining
|
||||
* several measurement traces, but may prevent some attacks
|
||||
* that exploit relationships between secret data.)
|
||||
*
|
||||
* \param grp The ECP group.
|
||||
* \param r The first output integer.
|
||||
* \param s The second output integer.
|
||||
@@ -121,9 +141,56 @@ int mbedtls_ecdsa_sign( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
|
||||
*
|
||||
* \see ecp.h
|
||||
*/
|
||||
int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r, mbedtls_mpi *s,
|
||||
const mbedtls_mpi *d, const unsigned char *buf, size_t blen,
|
||||
mbedtls_md_type_t md_alg );
|
||||
int mbedtls_ecdsa_sign_det( mbedtls_ecp_group *grp, mbedtls_mpi *r,
|
||||
mbedtls_mpi *s, const mbedtls_mpi *d,
|
||||
const unsigned char *buf, size_t blen,
|
||||
mbedtls_md_type_t md_alg );
|
||||
/**
|
||||
* \brief This function computes the ECDSA signature of a
|
||||
* previously-hashed message, deterministic version.
|
||||
*
|
||||
* For more information, see <em>RFC-6979: Deterministic
|
||||
* Usage of the Digital Signature Algorithm (DSA) and Elliptic
|
||||
* Curve Digital Signature Algorithm (ECDSA)</em>.
|
||||
*
|
||||
* \note If the bitlength of the message hash is larger than the
|
||||
* bitlength of the group order, then the hash is truncated as
|
||||
* defined in <em>Standards for Efficient Cryptography Group
|
||||
* (SECG): SEC1 Elliptic Curve Cryptography</em>, section
|
||||
* 4.1.3, step 5.
|
||||
*
|
||||
* \see ecp.h
|
||||
*
|
||||
* \param grp The context for the elliptic curve to use.
|
||||
* This must be initialized and have group parameters
|
||||
* set, for example through mbedtls_ecp_group_load().
|
||||
* \param r The MPI context in which to store the first part
|
||||
* the signature. This must be initialized.
|
||||
* \param s The MPI context in which to store the second part
|
||||
* the signature. This must be initialized.
|
||||
* \param d The private signing key. This must be initialized
|
||||
* and setup, for example through mbedtls_ecp_gen_privkey().
|
||||
* \param buf The hashed content to be signed. This must be a readable
|
||||
* buffer of length \p blen Bytes. It may be \c NULL if
|
||||
* \p blen is zero.
|
||||
* \param blen The length of \p buf in Bytes.
|
||||
* \param md_alg The hash algorithm used to hash the original data.
|
||||
* \param f_rng_blind The RNG function used for blinding. This must not be
|
||||
* \c NULL.
|
||||
* \param p_rng_blind The RNG context to be passed to \p f_rng. This may be
|
||||
* \c NULL if \p f_rng doesn't need a context parameter.
|
||||
*
|
||||
* \return \c 0 on success.
|
||||
* \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX
|
||||
* error code on failure.
|
||||
*/
|
||||
int mbedtls_ecdsa_sign_det_ext( mbedtls_ecp_group *grp, mbedtls_mpi *r,
|
||||
mbedtls_mpi *s, const mbedtls_mpi *d,
|
||||
const unsigned char *buf, size_t blen,
|
||||
mbedtls_md_type_t md_alg,
|
||||
int (*f_rng_blind)(void *, unsigned char *,
|
||||
size_t),
|
||||
void *p_rng_blind );
|
||||
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
|
||||
|
||||
/**
|
||||
|
||||
@@ -40,6 +40,11 @@
|
||||
* The payloads are serialized in a way suitable for use in TLS, but could
|
||||
* also be use outside TLS.
|
||||
*/
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ecp.h"
|
||||
#include "md.h"
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_ECP_H
|
||||
#define MBEDTLS_ECP_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "bignum.h"
|
||||
|
||||
/*
|
||||
@@ -595,6 +601,22 @@ int mbedtls_ecp_check_pubkey( const mbedtls_ecp_group *grp, const mbedtls_ecp_po
|
||||
*/
|
||||
int mbedtls_ecp_check_privkey( const mbedtls_ecp_group *grp, const mbedtls_mpi *d );
|
||||
|
||||
/**
|
||||
* \brief Generate a private key
|
||||
*
|
||||
* \param grp ECP group
|
||||
* \param d Destination MPI (secret part)
|
||||
* \param f_rng RNG function
|
||||
* \param p_rng RNG parameter
|
||||
*
|
||||
* \return 0 if successful,
|
||||
* or a MBEDTLS_ERR_ECP_XXX or MBEDTLS_MPI_XXX error code
|
||||
*/
|
||||
int mbedtls_ecp_gen_privkey( const mbedtls_ecp_group *grp,
|
||||
mbedtls_mpi *d,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
void *p_rng );
|
||||
|
||||
/**
|
||||
* \brief Generate a keypair with configurable base point
|
||||
*
|
||||
|
||||
@@ -61,6 +61,12 @@
|
||||
#ifndef MBEDTLS_ECP_INTERNAL_H
|
||||
#define MBEDTLS_ECP_INTERNAL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ECP_INTERNAL_ALT)
|
||||
|
||||
/**
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_ERROR_H
|
||||
#define MBEDTLS_ERROR_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
/**
|
||||
|
||||
@@ -31,6 +31,12 @@
|
||||
#ifndef MBEDTLS_GCM_H
|
||||
#define MBEDTLS_GCM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "cipher.h"
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_HAVEGE_H
|
||||
#define MBEDTLS_HAVEGE_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
#define MBEDTLS_HAVEGE_COLLECT_SIZE 1024
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_HMAC_DRBG_H
|
||||
#define MBEDTLS_HMAC_DRBG_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "md.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
@@ -76,7 +82,7 @@ extern "C" {
|
||||
*/
|
||||
typedef struct
|
||||
{
|
||||
/* Working state: the key K is not stored explicitely,
|
||||
/* Working state: the key K is not stored explicitly,
|
||||
* but is implied by the HMAC context */
|
||||
mbedtls_md_context_t md_ctx; /*!< HMAC context (inc. K) */
|
||||
unsigned char V[MBEDTLS_MD_MAX_SIZE]; /*!< V in the spec */
|
||||
@@ -195,11 +201,31 @@ void mbedtls_hmac_drbg_set_reseed_interval( mbedtls_hmac_drbg_context *ctx,
|
||||
* \param additional Additional data to update state with, or NULL
|
||||
* \param add_len Length of additional data, or 0
|
||||
*
|
||||
* \return \c 0 on success, or an error from the underlying
|
||||
* hash calculation.
|
||||
*
|
||||
* \note Additional data is optional, pass NULL and 0 as second
|
||||
* third argument if no additional data is being used.
|
||||
*/
|
||||
int mbedtls_hmac_drbg_update_ret( mbedtls_hmac_drbg_context *ctx,
|
||||
const unsigned char *additional, size_t add_len );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG update state
|
||||
*
|
||||
* \warning This function cannot report errors. You should use
|
||||
* mbedtls_hmac_drbg_update_ret() instead.
|
||||
*
|
||||
* \param ctx HMAC_DRBG context
|
||||
* \param additional Additional data to update state with, or NULL
|
||||
* \param add_len Length of additional data, or 0
|
||||
*
|
||||
* \note Additional data is optional, pass NULL and 0 as second
|
||||
* third argument if no additional data is being used.
|
||||
*/
|
||||
void mbedtls_hmac_drbg_update( mbedtls_hmac_drbg_context *ctx,
|
||||
const unsigned char *additional, size_t add_len );
|
||||
const unsigned char *additional,
|
||||
size_t add_len );
|
||||
|
||||
/**
|
||||
* \brief HMAC_DRBG reseeding (extracts data from entropy source)
|
||||
|
||||
@@ -23,6 +23,11 @@
|
||||
*
|
||||
* This file is part of mbed TLS (https://tls.mbed.org)
|
||||
*/
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#if !defined(MBEDTLS_DEPRECATED_REMOVED)
|
||||
#include "net_sockets.h"
|
||||
|
||||
@@ -25,6 +25,12 @@
|
||||
#ifndef MBEDTLS_PADLOCK_H
|
||||
#define MBEDTLS_PADLOCK_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "aes.h"
|
||||
|
||||
#define MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED -0x0030 /**< Input data should be aligned. */
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_PEM_H
|
||||
#define MBEDTLS_PEM_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include <stddef.h>
|
||||
|
||||
/**
|
||||
|
||||
@@ -343,6 +343,10 @@ int mbedtls_pk_verify_ext( mbedtls_pk_type_t type, const void *options,
|
||||
*
|
||||
* \note For RSA, md_alg may be MBEDTLS_MD_NONE if hash_len != 0.
|
||||
* For ECDSA, md_alg may never be MBEDTLS_MD_NONE.
|
||||
*
|
||||
* \note In order to ensure enough space for the signature, the
|
||||
* \p sig buffer size must be of at least
|
||||
* `max(MBEDTLS_ECDSA_MAX_LEN, MBEDTLS_MPI_MAX_SIZE)` bytes.
|
||||
*/
|
||||
int mbedtls_pk_sign( mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg,
|
||||
const unsigned char *hash, size_t hash_len,
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_PKCS12_H
|
||||
#define MBEDTLS_PKCS12_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "md.h"
|
||||
#include "cipher.h"
|
||||
#include "asn1.h"
|
||||
@@ -46,6 +52,8 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ASN1_PARSE_C)
|
||||
|
||||
/**
|
||||
* \brief PKCS12 Password Based function (encryption / decryption)
|
||||
* for pbeWithSHAAnd128BitRC4
|
||||
@@ -87,6 +95,8 @@ int mbedtls_pkcs12_pbe( mbedtls_asn1_buf *pbe_params, int mode,
|
||||
const unsigned char *input, size_t len,
|
||||
unsigned char *output );
|
||||
|
||||
#endif /* MBEDTLS_ASN1_PARSE_C */
|
||||
|
||||
/**
|
||||
* \brief The PKCS#12 derivation function uses a password and a salt
|
||||
* to produce pseudo-random bits for a particular "purpose".
|
||||
|
||||
@@ -26,6 +26,12 @@
|
||||
#ifndef MBEDTLS_PKCS5_H
|
||||
#define MBEDTLS_PKCS5_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "asn1.h"
|
||||
#include "md.h"
|
||||
|
||||
@@ -44,6 +50,8 @@
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_ASN1_PARSE_C)
|
||||
|
||||
/**
|
||||
* \brief PKCS#5 PBES2 function
|
||||
*
|
||||
@@ -62,6 +70,8 @@ int mbedtls_pkcs5_pbes2( const mbedtls_asn1_buf *pbe_params, int mode,
|
||||
const unsigned char *data, size_t datalen,
|
||||
unsigned char *output );
|
||||
|
||||
#endif /* MBEDTLS_ASN1_PARSE_C */
|
||||
|
||||
/**
|
||||
* \brief PKCS#5 PBKDF2 using HMAC
|
||||
*
|
||||
|
||||
@@ -146,13 +146,13 @@ mbedtls_rsa_context;
|
||||
* \note The choice of padding mode is strictly enforced for private key
|
||||
* operations, since there might be security concerns in
|
||||
* mixing padding modes. For public key operations it is
|
||||
* a default value, which can be overriden by calling specific
|
||||
* a default value, which can be overridden by calling specific
|
||||
* \c rsa_rsaes_xxx or \c rsa_rsassa_xxx functions.
|
||||
*
|
||||
* \note The hash selected in \p hash_id is always used for OEAP
|
||||
* encryption. For PSS signatures, it is always used for
|
||||
* making signatures, but can be overriden for verifying them.
|
||||
* If set to #MBEDTLS_MD_NONE, it is always overriden.
|
||||
* making signatures, but can be overridden for verifying them.
|
||||
* If set to #MBEDTLS_MD_NONE, it is always overridden.
|
||||
*/
|
||||
void mbedtls_rsa_init( mbedtls_rsa_context *ctx,
|
||||
int padding,
|
||||
@@ -819,6 +819,7 @@ int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
|
||||
*
|
||||
* \note The \p sig buffer must be as large as the size
|
||||
* of \p ctx->N. For example, 128 Bytes if RSA-1024 is used.
|
||||
* A buffer length of #MBEDTLS_MPI_MAX_SIZE is always safe.
|
||||
*
|
||||
* \note For PKCS#1 v2.1 encoding, see comments on
|
||||
* mbedtls_rsa_rsassa_pss_sign() for details on
|
||||
@@ -862,6 +863,7 @@ int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
|
||||
*
|
||||
* \note The \p sig buffer must be as large as the size
|
||||
* of \p ctx->N. For example, 128 Bytes if RSA-1024 is used.
|
||||
* A buffer length of #MBEDTLS_MPI_MAX_SIZE is always safe.
|
||||
*/
|
||||
int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
|
||||
int (*f_rng)(void *, unsigned char *, size_t),
|
||||
@@ -902,6 +904,7 @@ int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
|
||||
*
|
||||
* \note The \p sig buffer must be as large as the size
|
||||
* of \p ctx->N. For example, 128 Bytes if RSA-1024 is used.
|
||||
* A buffer length of #MBEDTLS_MPI_MAX_SIZE is always safe.
|
||||
*
|
||||
* \note The \p hash_id in the RSA context is the one used for the
|
||||
* encoding. \p md_alg in the function call is the type of hash
|
||||
|
||||
@@ -1611,7 +1611,7 @@ void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
|
||||
* provision more than one cert/key pair (eg one ECDSA, one
|
||||
* RSA with SHA-256, one RSA with SHA-1). An adequate
|
||||
* certificate will be selected according to the client's
|
||||
* advertised capabilities. In case mutliple certificates are
|
||||
* advertised capabilities. In case multiple certificates are
|
||||
* adequate, preference is given to the one set by the first
|
||||
* call to this function, then second, etc.
|
||||
*
|
||||
@@ -1622,6 +1622,14 @@ void mbedtls_ssl_conf_ca_chain( mbedtls_ssl_config *conf,
|
||||
* whether it matches those preferences - the server can then
|
||||
* decide what it wants to do with it.
|
||||
*
|
||||
* \note The provided \p pk_key needs to match the public key in the
|
||||
* first certificate in \p own_cert, or all handshakes using
|
||||
* that certificate will fail. It is your responsibility
|
||||
* to ensure that; this function will not perform any check.
|
||||
* You may use mbedtls_pk_check_pair() in order to perform
|
||||
* this check yourself, but be aware that this function can
|
||||
* be computationally expensive on some key types.
|
||||
*
|
||||
* \param conf SSL configuration
|
||||
* \param own_cert own public certificate chain
|
||||
* \param pk_key own private key
|
||||
@@ -2102,12 +2110,27 @@ void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
|
||||
|
||||
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
||||
/**
|
||||
* \brief Set the maximum fragment length to emit and/or negotiate
|
||||
* (Default: MBEDTLS_SSL_MAX_CONTENT_LEN, usually 2^14 bytes)
|
||||
* \brief Set the maximum fragment length to emit and/or negotiate.
|
||||
* (Typical: #MBEDTLS_SSL_MAX_CONTENT_LEN, by default that is
|
||||
* set to `2^14` bytes)
|
||||
* (Server: set maximum fragment length to emit,
|
||||
* usually negotiated by the client during handshake
|
||||
* usually negotiated by the client during handshake)
|
||||
* (Client: set maximum fragment length to emit *and*
|
||||
* negotiate with the server during handshake)
|
||||
* (Default: #MBEDTLS_SSL_MAX_FRAG_LEN_NONE)
|
||||
*
|
||||
* \note With TLS, this currently only affects ApplicationData (sent
|
||||
* with \c mbedtls_ssl_read()), not handshake messages.
|
||||
* With DTLS, this affects both ApplicationData and handshake.
|
||||
*
|
||||
* \note On the client side, the maximum fragment length extension
|
||||
* *will not* be used, unless the maximum fragment length has
|
||||
* been set via this function to a value different than
|
||||
* #MBEDTLS_SSL_MAX_FRAG_LEN_NONE.
|
||||
*
|
||||
* \note This sets the maximum length for a record's payload,
|
||||
* excluding record overhead that will be added to it, see
|
||||
* \c mbedtls_ssl_get_record_expansion().
|
||||
*
|
||||
* \param conf SSL configuration
|
||||
* \param mfl_code Code for maximum fragment length (allowed values:
|
||||
@@ -2309,13 +2332,14 @@ size_t mbedtls_ssl_get_bytes_avail( const mbedtls_ssl_context *ssl );
|
||||
/**
|
||||
* \brief Return the result of the certificate verification
|
||||
*
|
||||
* \param ssl SSL context
|
||||
* \param ssl The SSL context to use.
|
||||
*
|
||||
* \return 0 if successful,
|
||||
* -1 if result is not available (eg because the handshake was
|
||||
* aborted too early), or
|
||||
* a combination of BADCERT_xxx and BADCRL_xxx flags, see
|
||||
* x509.h
|
||||
* \return \c 0 if the certificate verification was successful.
|
||||
* \return \c -1u if the result is not available. This may happen
|
||||
* e.g. if the handshake aborts early, or a verification
|
||||
* callback returned a fatal error.
|
||||
* \return A bitwise combination of \c MBEDTLS_X509_BADCERT_XXX
|
||||
* and \c MBEDTLS_X509_BADCRL_XXX failure flags; see x509.h.
|
||||
*/
|
||||
uint32_t mbedtls_ssl_get_verify_result( const mbedtls_ssl_context *ssl );
|
||||
|
||||
@@ -2610,7 +2634,7 @@ void mbedtls_ssl_free( mbedtls_ssl_context *ssl );
|
||||
* mbedtls_ssl_config_defaults() or mbedtls_ssl_config_free().
|
||||
*
|
||||
* \note You need to call mbedtls_ssl_config_defaults() unless you
|
||||
* manually set all of the relevent fields yourself.
|
||||
* manually set all of the relevant fields yourself.
|
||||
*
|
||||
* \param conf SSL configuration context
|
||||
*/
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_SSL_CACHE_H
|
||||
#define MBEDTLS_SSL_CACHE_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ssl.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_SSL_CIPHERSUITES_H
|
||||
#define MBEDTLS_SSL_CIPHERSUITES_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "pk.h"
|
||||
#include "cipher.h"
|
||||
#include "md.h"
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_SSL_COOKIE_H
|
||||
#define MBEDTLS_SSL_COOKIE_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ssl.h"
|
||||
|
||||
#if defined(MBEDTLS_THREADING_C)
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_SSL_INTERNAL_H
|
||||
#define MBEDTLS_SSL_INTERNAL_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
#include "ssl.h"
|
||||
#include "cipher.h"
|
||||
|
||||
|
||||
@@ -24,6 +24,12 @@
|
||||
#ifndef MBEDTLS_SSL_TICKET_H
|
||||
#define MBEDTLS_SSL_TICKET_H
|
||||
|
||||
#if !defined(MBEDTLS_CONFIG_FILE)
|
||||
#include "config.h"
|
||||
#else
|
||||
#include MBEDTLS_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
/*
|
||||
* This implementation of the session ticket callbacks includes key
|
||||
* management, rotating the keys periodically in order to preserve forward
|
||||
@@ -111,14 +117,14 @@ int mbedtls_ssl_ticket_setup( mbedtls_ssl_ticket_context *ctx,
|
||||
/**
|
||||
* \brief Implementation of the ticket write callback
|
||||
*
|
||||
* \note See \c mbedlts_ssl_ticket_write_t for description
|
||||
* \note See \c mbedtls_ssl_ticket_write_t for description
|
||||
*/
|
||||
mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write;
|
||||
|
||||
/**
|
||||
* \brief Implementation of the ticket parse callback
|
||||
*
|
||||
* \note See \c mbedlts_ssl_ticket_parse_t for description
|
||||
* \note See \c mbedtls_ssl_ticket_parse_t for description
|
||||
*/
|
||||
mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse;
|
||||
|
||||
|
||||
@@ -40,16 +40,16 @@
|
||||
*/
|
||||
#define MBEDTLS_VERSION_MAJOR 2
|
||||
#define MBEDTLS_VERSION_MINOR 7
|
||||
#define MBEDTLS_VERSION_PATCH 5
|
||||
#define MBEDTLS_VERSION_PATCH 12
|
||||
|
||||
/**
|
||||
* The single version number has the following structure:
|
||||
* MMNNPP00
|
||||
* Major version | Minor version | Patch version
|
||||
*/
|
||||
#define MBEDTLS_VERSION_NUMBER 0x02070500
|
||||
#define MBEDTLS_VERSION_STRING "2.7.5"
|
||||
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.7.5"
|
||||
#define MBEDTLS_VERSION_NUMBER 0x02070C00
|
||||
#define MBEDTLS_VERSION_STRING "2.7.12"
|
||||
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.7.12"
|
||||
|
||||
#if defined(MBEDTLS_VERSION_C)
|
||||
|
||||
|
||||
@@ -77,7 +77,7 @@
|
||||
#define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880 /**< Allocation of memory failed. */
|
||||
#define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900 /**< Read/write of file failed. */
|
||||
#define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980 /**< Destination buffer is too small. */
|
||||
#define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 /**< A fatal error occured, eg the chain is too long or the vrfy callback failed. */
|
||||
#define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 /**< A fatal error occurred, eg the chain is too long or the vrfy callback failed. */
|
||||
/* \} name */
|
||||
|
||||
/**
|
||||
@@ -250,7 +250,7 @@ int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *se
|
||||
*
|
||||
* \param to mbedtls_x509_time to check
|
||||
*
|
||||
* \return 1 if the given time is in the past or an error occured,
|
||||
* \return 1 if the given time is in the past or an error occurred,
|
||||
* 0 otherwise.
|
||||
*/
|
||||
int mbedtls_x509_time_is_past( const mbedtls_x509_time *to );
|
||||
@@ -264,7 +264,7 @@ int mbedtls_x509_time_is_past( const mbedtls_x509_time *to );
|
||||
*
|
||||
* \param from mbedtls_x509_time to check
|
||||
*
|
||||
* \return 1 if the given time is in the future or an error occured,
|
||||
* \return 1 if the given time is in the future or an error occurred,
|
||||
* 0 otherwise.
|
||||
*/
|
||||
int mbedtls_x509_time_is_future( const mbedtls_x509_time *from );
|
||||
|
||||
@@ -111,7 +111,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
|
||||
/**
|
||||
* \brief Parse one or more CRLs and append them to the chained list
|
||||
*
|
||||
* \note Mutliple CRLs are accepted only if using PEM format
|
||||
* \note Multiple CRLs are accepted only if using PEM format
|
||||
*
|
||||
* \param chain points to the start of the chain
|
||||
* \param buf buffer holding the CRL data in PEM or DER format
|
||||
@@ -126,7 +126,7 @@ int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, s
|
||||
/**
|
||||
* \brief Load one or more CRLs and append them to the chained list
|
||||
*
|
||||
* \note Mutliple CRLs are accepted only if using PEM format
|
||||
* \note Multiple CRLs are accepted only if using PEM format
|
||||
*
|
||||
* \param chain points to the start of the chain
|
||||
* \param path filename to read the CRLs from (in PEM or DER encoding)
|
||||
|
||||
@@ -100,7 +100,7 @@ mbedtls_x509_crt;
|
||||
* Build flag from an algorithm/curve identifier (pk, md, ecp)
|
||||
* Since 0 is always XXX_NONE, ignore it.
|
||||
*/
|
||||
#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( id - 1 ) )
|
||||
#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( ( id ) - 1 ) )
|
||||
|
||||
/**
|
||||
* Security profile for certificate verification.
|
||||
@@ -177,19 +177,34 @@ int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, const unsigned char *bu
|
||||
size_t buflen );
|
||||
|
||||
/**
|
||||
* \brief Parse one or more certificates and add them
|
||||
* to the chained list. Parses permissively. If some
|
||||
* certificates can be parsed, the result is the number
|
||||
* of failed certificates it encountered. If none complete
|
||||
* correctly, the first error is returned.
|
||||
* \brief Parse one DER-encoded or one or more concatenated PEM-encoded
|
||||
* certificates and add them to the chained list.
|
||||
*
|
||||
* \param chain points to the start of the chain
|
||||
* \param buf buffer holding the certificate data in PEM or DER format
|
||||
* \param buflen size of the buffer
|
||||
* (including the terminating null byte for PEM data)
|
||||
* For CRTs in PEM encoding, the function parses permissively:
|
||||
* if at least one certificate can be parsed, the function
|
||||
* returns the number of certificates for which parsing failed
|
||||
* (hence \c 0 if all certificates were parsed successfully).
|
||||
* If no certificate could be parsed, the function returns
|
||||
* the first (negative) error encountered during parsing.
|
||||
*
|
||||
* PEM encoded certificates may be interleaved by other data
|
||||
* such as human readable descriptions of their content, as
|
||||
* long as the certificates are enclosed in the PEM specific
|
||||
* '-----{BEGIN/END} CERTIFICATE-----' delimiters.
|
||||
*
|
||||
* \param chain The chain to which to add the parsed certificates.
|
||||
* \param buf The buffer holding the certificate data in PEM or DER format.
|
||||
* For certificates in PEM encoding, this may be a concatenation
|
||||
* of multiple certificates; for DER encoding, the buffer must
|
||||
* comprise exactly one certificate.
|
||||
* \param buflen The size of \p buf, including the terminating \c NULL byte
|
||||
* in case of PEM encoded data.
|
||||
*
|
||||
* \return \c 0 if all certificates were parsed successfully.
|
||||
* \return The (positive) number of certificates that couldn't
|
||||
* be parsed if parsing was partly successful (see above).
|
||||
* \return A negative X509 or PEM error code otherwise.
|
||||
*
|
||||
* \return 0 if all certificates parsed successfully, a positive number
|
||||
* if partly successful or a specific X509 or PEM error code
|
||||
*/
|
||||
int mbedtls_x509_crt_parse( mbedtls_x509_crt *chain, const unsigned char *buf, size_t buflen );
|
||||
|
||||
|
||||
@@ -205,6 +205,14 @@ void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_ty
|
||||
* \param key_usage key usage flags to set
|
||||
*
|
||||
* \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED
|
||||
*
|
||||
* \note The <code>decipherOnly</code> flag from the Key Usage
|
||||
* extension is represented by bit 8 (i.e.
|
||||
* <code>0x8000</code>), which cannot typically be represented
|
||||
* in an unsigned char. Therefore, the flag
|
||||
* <code>decipherOnly</code> (i.e.
|
||||
* #MBEDTLS_X509_KU_DECIPHER_ONLY) cannot be set using this
|
||||
* function.
|
||||
*/
|
||||
int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage );
|
||||
|
||||
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Reference in New Issue
Block a user