mirror of
https://github.com/reactos/reactos.git
synced 2025-06-04 17:00:31 +00:00
[MBEDTLS] Update to version 2.7.11. CORE-16147
This commit is contained in:
Thomas Faber
parent
132ca99397
commit
430656f0b9
13 changed files with 271 additions and 165 deletions
28
dll/3rdparty/mbedtls/bignum.c
vendored
28
dll/3rdparty/mbedtls/bignum.c
vendored
|
|
@ -554,15 +554,20 @@ int mbedtls_mpi_write_string( const mbedtls_mpi *X, int radix,
|
|||
if( radix < 2 || radix > 16 )
|
||||
return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
|
||||
|
||||
n = mbedtls_mpi_bitlen( X );
|
||||
if( radix >= 4 ) n >>= 1;
|
||||
if( radix >= 16 ) n >>= 1;
|
||||
/*
|
||||
* Round up the buffer length to an even value to ensure that there is
|
||||
* enough room for hexadecimal values that can be represented in an odd
|
||||
* number of digits.
|
||||
*/
|
||||
n += 3 + ( ( n + 1 ) & 1 );
|
||||
n = mbedtls_mpi_bitlen( X ); /* Number of bits necessary to present `n`. */
|
||||
if( radix >= 4 ) n >>= 1; /* Number of 4-adic digits necessary to present
|
||||
* `n`. If radix > 4, this might be a strict
|
||||
* overapproximation of the number of
|
||||
* radix-adic digits needed to present `n`. */
|
||||
if( radix >= 16 ) n >>= 1; /* Number of hexadecimal digits necessary to
|
||||
* present `n`. */
|
||||
|
||||
n += 1; /* Terminating null byte */
|
||||
n += 1; /* Compensate for the divisions above, which round down `n`
|
||||
* in case it's not even. */
|
||||
n += 1; /* Potential '-'-sign. */
|
||||
n += ( n & 1 ); /* Make n even to have enough space for hexadecimal writing,
|
||||
* which always uses an even number of hex-digits. */
|
||||
|
||||
if( buflen < n )
|
||||
{
|
||||
|
|
@ -574,7 +579,10 @@ int mbedtls_mpi_write_string( const mbedtls_mpi *X, int radix,
|
|||
mbedtls_mpi_init( &T );
|
||||
|
||||
if( X->s == -1 )
|
||||
{
|
||||
*p++ = '-';
|
||||
buflen--;
|
||||
}
|
||||
|
||||
if( radix == 16 )
|
||||
{
|
||||
|
|
@ -1681,8 +1689,10 @@ int mbedtls_mpi_exp_mod( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
|
|||
wsize = ( i > 671 ) ? 6 : ( i > 239 ) ? 5 :
|
||||
( i > 79 ) ? 4 : ( i > 23 ) ? 3 : 1;
|
||||
|
||||
#if( MBEDTLS_MPI_WINDOW_SIZE < 6 )
|
||||
if( wsize > MBEDTLS_MPI_WINDOW_SIZE )
|
||||
wsize = MBEDTLS_MPI_WINDOW_SIZE;
|
||||
#endif
|
||||
|
||||
j = N->n + 1;
|
||||
MBEDTLS_MPI_CHK( mbedtls_mpi_grow( X, j ) );
|
||||
|
|
|
|||
94
dll/3rdparty/mbedtls/certs.c
vendored
94
dll/3rdparty/mbedtls/certs.c
vendored
|
|
@ -118,7 +118,6 @@ const size_t mbedtls_test_cli_key_ec_len = sizeof( mbedtls_test_cli_key_ec );
|
|||
#endif /* MBEDTLS_ECDSA_C */
|
||||
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
|
||||
#if defined(MBEDTLS_SHA256_C)
|
||||
#define TEST_CA_CRT_RSA_SHA256 \
|
||||
"-----BEGIN CERTIFICATE-----\r\n" \
|
||||
|
|
@ -143,13 +142,11 @@ const size_t mbedtls_test_cli_key_ec_len = sizeof( mbedtls_test_cli_key_ec );
|
|||
"n20NRVA1Vjs6GAROr4NqW4k/+LofY9y0LLDE+p0oIEKXIsIvhPr39swxSA==\r\n" \
|
||||
"-----END CERTIFICATE-----\r\n"
|
||||
|
||||
static const char mbedtls_test_ca_crt_rsa_sha256[] = TEST_CA_CRT_RSA_SHA256;
|
||||
const char mbedtls_test_ca_crt_rsa[] = TEST_CA_CRT_RSA_SHA256;
|
||||
const size_t mbedtls_test_ca_crt_rsa_len = sizeof( mbedtls_test_ca_crt_rsa );
|
||||
#define TEST_CA_CRT_RSA_SOME
|
||||
|
||||
static const char mbedtls_test_ca_crt_rsa_sha256[] = TEST_CA_CRT_RSA_SHA256;
|
||||
|
||||
#endif
|
||||
#endif /* MBEDTLS_SHA256_C */
|
||||
|
||||
#if !defined(TEST_CA_CRT_RSA_SOME) || defined(MBEDTLS_SHA1_C)
|
||||
#define TEST_CA_CRT_RSA_SHA1 \
|
||||
|
|
@ -175,14 +172,72 @@ static const char mbedtls_test_ca_crt_rsa_sha256[] = TEST_CA_CRT_RSA_SHA256;
|
|||
"7Z2mCGDNMhjQc+BYcdnl0lPXjdDK6V0qCg1dVewhUBcW5gZKzV7e9+DpVA==\r\n" \
|
||||
"-----END CERTIFICATE-----\r\n"
|
||||
|
||||
static const char mbedtls_test_ca_crt_rsa_sha1[] = TEST_CA_CRT_RSA_SHA1;
|
||||
|
||||
#if !defined (TEST_CA_CRT_RSA_SOME)
|
||||
const char mbedtls_test_ca_crt_rsa[] = TEST_CA_CRT_RSA_SHA1;
|
||||
const size_t mbedtls_test_ca_crt_rsa_len = sizeof( mbedtls_test_ca_crt_rsa );
|
||||
#endif
|
||||
#endif /* !TEST_CA_CRT_RSA_SOME */
|
||||
#endif /* !TEST_CA_CRT_RSA_COME || MBEDTLS_SHA1_C */
|
||||
|
||||
static const char mbedtls_test_ca_crt_rsa_sha1[] = TEST_CA_CRT_RSA_SHA1;
|
||||
#if defined(MBEDTLS_SHA256_C)
|
||||
/* tests/data_files/server2-sha256.crt */
|
||||
#define TEST_SRV_CRT_RSA_SHA256 \
|
||||
"-----BEGIN CERTIFICATE-----\r\n" \
|
||||
"MIIDNzCCAh+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADA7MQswCQYDVQQGEwJOTDER\r\n" \
|
||||
"MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN\r\n" \
|
||||
"MTEwMjEyMTQ0NDA2WhcNMjEwMjEyMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G\r\n" \
|
||||
"A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN\r\n" \
|
||||
"AQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTN\r\n" \
|
||||
"owCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKz\r\n" \
|
||||
"NtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kM\r\n" \
|
||||
"tQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8P\r\n" \
|
||||
"hYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjya\r\n" \
|
||||
"HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaNNMEswCQYD\r\n" \
|
||||
"VR0TBAIwADAdBgNVHQ4EFgQUpQXoZLjc32APUBJNYKhkr02LQ5MwHwYDVR0jBBgw\r\n" \
|
||||
"FoAUtFrkpbPe0lL2udWmlQ/rPrzH/f8wDQYJKoZIhvcNAQELBQADggEBAGGEshT5\r\n" \
|
||||
"kvnRmLVScVeUEdwIrvW7ezbGbUvJ8VxeJ79/HSjlLiGbMc4uUathwtzEdi9R/4C5\r\n" \
|
||||
"DXBNeEPTkbB+fhG1W06iHYj/Dp8+aaG7fuDxKVKHVZSqBnmQLn73ymyclZNHii5A\r\n" \
|
||||
"3nTS8WUaHAzxN/rajOtoM7aH1P9tULpHrl+7HOeLMpxUnwI12ZqZaLIzxbcdJVcr\r\n" \
|
||||
"ra2F00aXCGkYVLvyvbZIq7LC+yVysej5gCeQYD7VFOEks0jhFjrS06gP0/XnWv6v\r\n" \
|
||||
"eBoPez9d+CCjkrhseiWzXOiriIMICX48EloO/DrsMRAtvlwq7EDz4QhILz6ffndm\r\n" \
|
||||
"e4K1cVANRPN2o9Y=\r\n" \
|
||||
"-----END CERTIFICATE-----\r\n"
|
||||
|
||||
#endif
|
||||
const char mbedtls_test_srv_crt_rsa[] = TEST_SRV_CRT_RSA_SHA256;
|
||||
const size_t mbedtls_test_srv_crt_rsa_len = sizeof( mbedtls_test_srv_crt_rsa );
|
||||
#define TEST_SRV_CRT_RSA_SOME
|
||||
#endif /* MBEDTLS_SHA256_C */
|
||||
|
||||
#if !defined(TEST_SRV_CRT_RSA_SOME) || defined(MBEDTLS_SHA1_C)
|
||||
/* tests/data_files/server2.crt */
|
||||
#define TEST_SRV_CRT_RSA_SHA1 \
|
||||
"-----BEGIN CERTIFICATE-----\r\n" \
|
||||
"MIIDNzCCAh+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER\r\n" \
|
||||
"MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN\r\n" \
|
||||
"MTEwMjEyMTQ0NDA2WhcNMjEwMjEyMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G\r\n" \
|
||||
"A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN\r\n" \
|
||||
"AQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTN\r\n" \
|
||||
"owCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKz\r\n" \
|
||||
"NtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kM\r\n" \
|
||||
"tQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8P\r\n" \
|
||||
"hYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjya\r\n" \
|
||||
"HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaNNMEswCQYD\r\n" \
|
||||
"VR0TBAIwADAdBgNVHQ4EFgQUpQXoZLjc32APUBJNYKhkr02LQ5MwHwYDVR0jBBgw\r\n" \
|
||||
"FoAUtFrkpbPe0lL2udWmlQ/rPrzH/f8wDQYJKoZIhvcNAQEFBQADggEBAJxnXClY\r\n" \
|
||||
"oHkbp70cqBrsGXLybA74czbO5RdLEgFs7rHVS9r+c293luS/KdliLScZqAzYVylw\r\n" \
|
||||
"UfRWvKMoWhHYKp3dEIS4xTXk6/5zXxhv9Rw8SGc8qn6vITHk1S1mPevtekgasY5Y\r\n" \
|
||||
"iWQuM3h4YVlRH3HHEMAD1TnAexfXHHDFQGe+Bd1iAbz1/sH9H8l4StwX6egvTK3M\r\n" \
|
||||
"wXRwkKkvjKaEDA9ATbZx0mI8LGsxSuCqe9r9dyjmttd47J1p1Rulz3CLzaRcVIuS\r\n" \
|
||||
"RRQfaD8neM9c1S/iJ/amTVqJxA1KOdOS5780WhPfSArA+g4qAmSjelc3p4wWpha8\r\n" \
|
||||
"zhuYwjVuX6JHG0c=\r\n" \
|
||||
"-----END CERTIFICATE-----\r\n";
|
||||
|
||||
#if !defined(TEST_SRV_CRT_RSA_SOME)
|
||||
const char mbedtls_test_srv_crt_rsa[] = TEST_SRV_CRT_RSA_SHA1;
|
||||
const size_t mbedtls_test_srv_crt_rsa_len = sizeof( mbedtls_test_srv_crt_rsa );
|
||||
#endif /* TEST_SRV_CRT_RSA_SOME */
|
||||
#endif /* !TEST_CA_CRT_RSA_SOME || MBEDTLS_SHA1_C */
|
||||
|
||||
const char mbedtls_test_ca_key_rsa[] =
|
||||
"-----BEGIN RSA PRIVATE KEY-----\r\n"
|
||||
|
|
@ -220,29 +275,6 @@ const size_t mbedtls_test_ca_key_rsa_len = sizeof( mbedtls_test_ca_key_rsa );
|
|||
const char mbedtls_test_ca_pwd_rsa[] = "PolarSSLTest";
|
||||
const size_t mbedtls_test_ca_pwd_rsa_len = sizeof( mbedtls_test_ca_pwd_rsa ) - 1;
|
||||
|
||||
const char mbedtls_test_srv_crt_rsa[] =
|
||||
"-----BEGIN CERTIFICATE-----\r\n"
|
||||
"MIIDNzCCAh+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER\r\n"
|
||||
"MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN\r\n"
|
||||
"MTEwMjEyMTQ0NDA2WhcNMjEwMjEyMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G\r\n"
|
||||
"A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN\r\n"
|
||||
"AQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTN\r\n"
|
||||
"owCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKz\r\n"
|
||||
"NtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kM\r\n"
|
||||
"tQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8P\r\n"
|
||||
"hYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjya\r\n"
|
||||
"HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaNNMEswCQYD\r\n"
|
||||
"VR0TBAIwADAdBgNVHQ4EFgQUpQXoZLjc32APUBJNYKhkr02LQ5MwHwYDVR0jBBgw\r\n"
|
||||
"FoAUtFrkpbPe0lL2udWmlQ/rPrzH/f8wDQYJKoZIhvcNAQEFBQADggEBAJxnXClY\r\n"
|
||||
"oHkbp70cqBrsGXLybA74czbO5RdLEgFs7rHVS9r+c293luS/KdliLScZqAzYVylw\r\n"
|
||||
"UfRWvKMoWhHYKp3dEIS4xTXk6/5zXxhv9Rw8SGc8qn6vITHk1S1mPevtekgasY5Y\r\n"
|
||||
"iWQuM3h4YVlRH3HHEMAD1TnAexfXHHDFQGe+Bd1iAbz1/sH9H8l4StwX6egvTK3M\r\n"
|
||||
"wXRwkKkvjKaEDA9ATbZx0mI8LGsxSuCqe9r9dyjmttd47J1p1Rulz3CLzaRcVIuS\r\n"
|
||||
"RRQfaD8neM9c1S/iJ/amTVqJxA1KOdOS5780WhPfSArA+g4qAmSjelc3p4wWpha8\r\n"
|
||||
"zhuYwjVuX6JHG0c=\r\n"
|
||||
"-----END CERTIFICATE-----\r\n";
|
||||
const size_t mbedtls_test_srv_crt_rsa_len = sizeof( mbedtls_test_srv_crt_rsa );
|
||||
|
||||
const char mbedtls_test_srv_key_rsa[] =
|
||||
"-----BEGIN RSA PRIVATE KEY-----\r\n"
|
||||
"MIIEpAIBAAKCAQEAwU2j3efNHdEE10lyuJmsDnjkOjxKzzoTFtBa5M2jAIin7h5r\r\n"
|
||||
|
|
|
|||
44
dll/3rdparty/mbedtls/debug.c
vendored
44
dll/3rdparty/mbedtls/debug.c
vendored
|
|
@ -88,8 +88,13 @@ void mbedtls_debug_print_msg( const mbedtls_ssl_context *ssl, int level,
|
|||
char str[DEBUG_BUF_SIZE];
|
||||
int ret;
|
||||
|
||||
if( NULL == ssl || NULL == ssl->conf || NULL == ssl->conf->f_dbg || level > debug_threshold )
|
||||
if( NULL == ssl ||
|
||||
NULL == ssl->conf ||
|
||||
NULL == ssl->conf->f_dbg ||
|
||||
level > debug_threshold )
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
va_start( argp, format );
|
||||
#if defined(_WIN32)
|
||||
|
|
@ -123,8 +128,13 @@ void mbedtls_debug_print_ret( const mbedtls_ssl_context *ssl, int level,
|
|||
{
|
||||
char str[DEBUG_BUF_SIZE];
|
||||
|
||||
if( ssl->conf == NULL || ssl->conf->f_dbg == NULL || level > debug_threshold )
|
||||
if( NULL == ssl ||
|
||||
NULL == ssl->conf ||
|
||||
NULL == ssl->conf->f_dbg ||
|
||||
level > debug_threshold )
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* With non-blocking I/O and examples that just retry immediately,
|
||||
|
|
@ -148,8 +158,13 @@ void mbedtls_debug_print_buf( const mbedtls_ssl_context *ssl, int level,
|
|||
char txt[17];
|
||||
size_t i, idx = 0;
|
||||
|
||||
if( ssl->conf == NULL || ssl->conf->f_dbg == NULL || level > debug_threshold )
|
||||
if( NULL == ssl ||
|
||||
NULL == ssl->conf ||
|
||||
NULL == ssl->conf->f_dbg ||
|
||||
level > debug_threshold )
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
mbedtls_snprintf( str + idx, sizeof( str ) - idx, "dumping '%s' (%u bytes)\n",
|
||||
text, (unsigned int) len );
|
||||
|
|
@ -201,8 +216,13 @@ void mbedtls_debug_print_ecp( const mbedtls_ssl_context *ssl, int level,
|
|||
{
|
||||
char str[DEBUG_BUF_SIZE];
|
||||
|
||||
if( ssl->conf == NULL || ssl->conf->f_dbg == NULL || level > debug_threshold )
|
||||
if( NULL == ssl ||
|
||||
NULL == ssl->conf ||
|
||||
NULL == ssl->conf->f_dbg ||
|
||||
level > debug_threshold )
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
mbedtls_snprintf( str, sizeof( str ), "%s(X)", text );
|
||||
mbedtls_debug_print_mpi( ssl, level, file, line, str, &X->X );
|
||||
|
|
@ -221,8 +241,14 @@ void mbedtls_debug_print_mpi( const mbedtls_ssl_context *ssl, int level,
|
|||
int j, k, zeros = 1;
|
||||
size_t i, n, idx = 0;
|
||||
|
||||
if( ssl->conf == NULL || ssl->conf->f_dbg == NULL || X == NULL || level > debug_threshold )
|
||||
if( NULL == ssl ||
|
||||
NULL == ssl->conf ||
|
||||
NULL == ssl->conf->f_dbg ||
|
||||
NULL == X ||
|
||||
level > debug_threshold )
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
for( n = X->n - 1; n > 0; n-- )
|
||||
if( X->p[n] != 0 )
|
||||
|
|
@ -347,8 +373,14 @@ void mbedtls_debug_print_crt( const mbedtls_ssl_context *ssl, int level,
|
|||
char str[DEBUG_BUF_SIZE];
|
||||
int i = 0;
|
||||
|
||||
if( ssl->conf == NULL || ssl->conf->f_dbg == NULL || crt == NULL || level > debug_threshold )
|
||||
if( NULL == ssl ||
|
||||
NULL == ssl->conf ||
|
||||
NULL == ssl->conf->f_dbg ||
|
||||
NULL == crt ||
|
||||
level > debug_threshold )
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
while( crt != NULL )
|
||||
{
|
||||
|
|
|
|||
16
dll/3rdparty/mbedtls/ecdh.c
vendored
16
dll/3rdparty/mbedtls/ecdh.c
vendored
|
|
@ -181,8 +181,20 @@ int mbedtls_ecdh_get_params( mbedtls_ecdh_context *ctx, const mbedtls_ecp_keypai
|
|||
{
|
||||
int ret;
|
||||
|
||||
if( ( ret = mbedtls_ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 )
|
||||
return( ret );
|
||||
if( ctx->grp.id == MBEDTLS_ECP_DP_NONE )
|
||||
{
|
||||
/* This is the first call to get_params(). Copy the group information
|
||||
* into the context. */
|
||||
if( ( ret = mbedtls_ecp_group_copy( &ctx->grp, &key->grp ) ) != 0 )
|
||||
return( ret );
|
||||
}
|
||||
else
|
||||
{
|
||||
/* This is not the first call to get_params(). Check that the group
|
||||
* is the same as the first time. */
|
||||
if( ctx->grp.id != key->grp.id )
|
||||
return( MBEDTLS_ERR_ECP_BAD_INPUT_DATA );
|
||||
}
|
||||
|
||||
/* If it's not our key, just import the public part as Qp */
|
||||
if( side == MBEDTLS_ECDH_THEIRS )
|
||||
|
|
|
|||
143
dll/3rdparty/mbedtls/ssl_tls.c
vendored
143
dll/3rdparty/mbedtls/ssl_tls.c
vendored
|
|
@ -3704,81 +3704,23 @@ static int ssl_parse_record_header( mbedtls_ssl_context *ssl )
|
|||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
|
||||
/* Check length against bounds of the current transform and version */
|
||||
if( ssl->transform_in == NULL )
|
||||
{
|
||||
if( ssl->in_msglen < 1 ||
|
||||
ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
|
||||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
if( ssl->in_msglen < ssl->transform_in->minlen )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
|
||||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
|
||||
ssl->in_msglen > ssl->transform_in->minlen + MBEDTLS_SSL_MAX_CONTENT_LEN )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
|
||||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
/*
|
||||
* TLS encrypted messages can have up to 256 bytes of padding
|
||||
*/
|
||||
if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 &&
|
||||
ssl->in_msglen > ssl->transform_in->minlen +
|
||||
MBEDTLS_SSL_MAX_CONTENT_LEN + 256 )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
|
||||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
* DTLS-related tests done last, because most of them may result in
|
||||
* silently dropping the record (but not the whole datagram), and we only
|
||||
* want to consider that after ensuring that the "basic" fields (type,
|
||||
* version, length) are sane.
|
||||
* DTLS-related tests.
|
||||
* Check epoch before checking length constraint because
|
||||
* the latter varies with the epoch. E.g., if a ChangeCipherSpec
|
||||
* message gets duplicated before the corresponding Finished message,
|
||||
* the second ChangeCipherSpec should be discarded because it belongs
|
||||
* to an old epoch, but not because its length is shorter than
|
||||
* the minimum record length for packets using the new record transform.
|
||||
* Note that these two kinds of failures are handled differently,
|
||||
* as an unexpected record is silently skipped but an invalid
|
||||
* record leads to the entire datagram being dropped.
|
||||
*/
|
||||
#if defined(MBEDTLS_SSL_PROTO_DTLS)
|
||||
if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
|
||||
{
|
||||
unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
|
||||
|
||||
/* Drop unexpected ChangeCipherSpec messages */
|
||||
if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
|
||||
ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
|
||||
ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ChangeCipherSpec" ) );
|
||||
return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
|
||||
}
|
||||
|
||||
/* Drop unexpected ApplicationData records,
|
||||
* except at the beginning of renegotiations */
|
||||
if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
|
||||
ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
|
||||
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
||||
&& ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
|
||||
ssl->state == MBEDTLS_SSL_SERVER_HELLO )
|
||||
#endif
|
||||
)
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
|
||||
return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
|
||||
}
|
||||
|
||||
/* Check epoch (and sequence number) with DTLS */
|
||||
if( rec_epoch != ssl->in_epoch )
|
||||
{
|
||||
|
|
@ -3818,9 +3760,74 @@ static int ssl_parse_record_header( mbedtls_ssl_context *ssl )
|
|||
return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
|
||||
}
|
||||
#endif
|
||||
|
||||
/* Drop unexpected ChangeCipherSpec messages */
|
||||
if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
|
||||
ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
|
||||
ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ChangeCipherSpec" ) );
|
||||
return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
|
||||
}
|
||||
|
||||
/* Drop unexpected ApplicationData records,
|
||||
* except at the beginning of renegotiations */
|
||||
if( ssl->in_msgtype == MBEDTLS_SSL_MSG_APPLICATION_DATA &&
|
||||
ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER
|
||||
#if defined(MBEDTLS_SSL_RENEGOTIATION)
|
||||
&& ! ( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS &&
|
||||
ssl->state == MBEDTLS_SSL_SERVER_HELLO )
|
||||
#endif
|
||||
)
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" ) );
|
||||
return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_SSL_PROTO_DTLS */
|
||||
|
||||
|
||||
/* Check length against bounds of the current transform and version */
|
||||
if( ssl->transform_in == NULL )
|
||||
{
|
||||
if( ssl->in_msglen < 1 ||
|
||||
ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
|
||||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
if( ssl->in_msglen < ssl->transform_in->minlen )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
|
||||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_SSL_PROTO_SSL3)
|
||||
if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
|
||||
ssl->in_msglen > ssl->transform_in->minlen + MBEDTLS_SSL_MAX_CONTENT_LEN )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
|
||||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
|
||||
defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
||||
/*
|
||||
* TLS encrypted messages can have up to 256 bytes of padding
|
||||
*/
|
||||
if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 &&
|
||||
ssl->in_msglen > ssl->transform_in->minlen +
|
||||
MBEDTLS_SSL_MAX_CONTENT_LEN + 256 )
|
||||
{
|
||||
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
|
||||
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
return( 0 );
|
||||
}
|
||||
|
||||
|
|
|
|||
51
dll/3rdparty/mbedtls/x509.c
vendored
51
dll/3rdparty/mbedtls/x509.c
vendored
|
|
@ -359,6 +359,8 @@ static int x509_get_attr_type_value( unsigned char **p,
|
|||
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
|
||||
return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
|
||||
|
||||
end = *p + len;
|
||||
|
||||
if( ( end - *p ) < 1 )
|
||||
return( MBEDTLS_ERR_X509_INVALID_NAME +
|
||||
MBEDTLS_ERR_ASN1_OUT_OF_DATA );
|
||||
|
|
@ -392,6 +394,12 @@ static int x509_get_attr_type_value( unsigned char **p,
|
|||
val->p = *p;
|
||||
*p += val->len;
|
||||
|
||||
if( *p != end )
|
||||
{
|
||||
return( MBEDTLS_ERR_X509_INVALID_NAME +
|
||||
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
|
||||
}
|
||||
|
||||
cur->next = NULL;
|
||||
|
||||
return( 0 );
|
||||
|
|
@ -698,30 +706,25 @@ int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x50
|
|||
* be either manually updated or extensions should be parsed!)
|
||||
*/
|
||||
int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end,
|
||||
mbedtls_x509_buf *ext, int tag )
|
||||
mbedtls_x509_buf *ext, int tag )
|
||||
{
|
||||
int ret;
|
||||
size_t len;
|
||||
|
||||
if( *p == end )
|
||||
return( 0 );
|
||||
/* Extension structure use EXPLICIT tagging. That is, the actual
|
||||
* `Extensions` structure is wrapped by a tag-length pair using
|
||||
* the respective context-specific tag. */
|
||||
ret = mbedtls_asn1_get_tag( p, end, &ext->len,
|
||||
MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | tag );
|
||||
if( ret != 0 )
|
||||
return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret );
|
||||
|
||||
ext->tag = **p;
|
||||
|
||||
if( ( ret = mbedtls_asn1_get_tag( p, end, &ext->len,
|
||||
MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | tag ) ) != 0 )
|
||||
return( ret );
|
||||
|
||||
ext->p = *p;
|
||||
end = *p + ext->len;
|
||||
ext->tag = MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | tag;
|
||||
ext->p = *p;
|
||||
end = *p + ext->len;
|
||||
|
||||
/*
|
||||
* Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
|
||||
*
|
||||
* Extension ::= SEQUENCE {
|
||||
* extnID OBJECT IDENTIFIER,
|
||||
* critical BOOLEAN DEFAULT FALSE,
|
||||
* extnValue OCTET STRING }
|
||||
*/
|
||||
if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
|
||||
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
|
||||
|
|
@ -1034,8 +1037,8 @@ int mbedtls_x509_time_is_future( const mbedtls_x509_time *from )
|
|||
*/
|
||||
int mbedtls_x509_self_test( int verbose )
|
||||
{
|
||||
int ret = 0;
|
||||
#if defined(MBEDTLS_CERTS_C) && defined(MBEDTLS_SHA256_C)
|
||||
int ret;
|
||||
uint32_t flags;
|
||||
mbedtls_x509_crt cacert;
|
||||
mbedtls_x509_crt clicert;
|
||||
|
|
@ -1043,6 +1046,7 @@ int mbedtls_x509_self_test( int verbose )
|
|||
if( verbose != 0 )
|
||||
mbedtls_printf( " X.509 certificate load: " );
|
||||
|
||||
mbedtls_x509_crt_init( &cacert );
|
||||
mbedtls_x509_crt_init( &clicert );
|
||||
|
||||
ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) mbedtls_test_cli_crt,
|
||||
|
|
@ -1052,11 +1056,9 @@ int mbedtls_x509_self_test( int verbose )
|
|||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed\n" );
|
||||
|
||||
return( ret );
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
mbedtls_x509_crt_init( &cacert );
|
||||
|
||||
ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) mbedtls_test_ca_crt,
|
||||
mbedtls_test_ca_crt_len );
|
||||
if( ret != 0 )
|
||||
|
|
@ -1064,7 +1066,7 @@ int mbedtls_x509_self_test( int verbose )
|
|||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed\n" );
|
||||
|
||||
return( ret );
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if( verbose != 0 )
|
||||
|
|
@ -1076,20 +1078,19 @@ int mbedtls_x509_self_test( int verbose )
|
|||
if( verbose != 0 )
|
||||
mbedtls_printf( "failed\n" );
|
||||
|
||||
return( ret );
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if( verbose != 0 )
|
||||
mbedtls_printf( "passed\n\n");
|
||||
|
||||
cleanup:
|
||||
mbedtls_x509_crt_free( &cacert );
|
||||
mbedtls_x509_crt_free( &clicert );
|
||||
|
||||
return( 0 );
|
||||
#else
|
||||
((void) verbose);
|
||||
return( 0 );
|
||||
#endif /* MBEDTLS_CERTS_C && MBEDTLS_SHA1_C */
|
||||
return( ret );
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_SELF_TEST */
|
||||
|
|
|
|||
10
dll/3rdparty/mbedtls/x509_crl.c
vendored
10
dll/3rdparty/mbedtls/x509_crl.c
vendored
|
|
@ -109,17 +109,17 @@ static int x509_get_crl_ext( unsigned char **p,
|
|||
{
|
||||
int ret;
|
||||
|
||||
if( *p == end )
|
||||
return( 0 );
|
||||
|
||||
/*
|
||||
* crlExtensions [0] EXPLICIT Extensions OPTIONAL
|
||||
* -- if present, version MUST be v2
|
||||
*/
|
||||
if( ( ret = mbedtls_x509_get_ext( p, end, ext, 0 ) ) != 0 )
|
||||
{
|
||||
if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
|
||||
return( 0 );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
end = ext->p + ext->len;
|
||||
|
||||
while( *p < end )
|
||||
{
|
||||
|
|
|
|||
13
dll/3rdparty/mbedtls/x509_crt.c
vendored
13
dll/3rdparty/mbedtls/x509_crt.c
vendored
|
|
@ -236,7 +236,7 @@ static int x509_get_version( unsigned char **p,
|
|||
return( 0 );
|
||||
}
|
||||
|
||||
return( ret );
|
||||
return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret );
|
||||
}
|
||||
|
||||
end = *p + len;
|
||||
|
|
@ -303,7 +303,7 @@ static int x509_get_uid( unsigned char **p,
|
|||
if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
|
||||
return( 0 );
|
||||
|
||||
return( ret );
|
||||
return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret );
|
||||
}
|
||||
|
||||
uid->p = *p;
|
||||
|
|
@ -542,14 +542,13 @@ static int x509_get_crt_ext( unsigned char **p,
|
|||
size_t len;
|
||||
unsigned char *end_ext_data, *end_ext_octet;
|
||||
|
||||
if( *p == end )
|
||||
return( 0 );
|
||||
|
||||
if( ( ret = mbedtls_x509_get_ext( p, end, &crt->v3_ext, 3 ) ) != 0 )
|
||||
{
|
||||
if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
|
||||
return( 0 );
|
||||
|
||||
return( ret );
|
||||
}
|
||||
|
||||
end = crt->v3_ext.p + crt->v3_ext.len;
|
||||
while( *p < end )
|
||||
{
|
||||
/*
|
||||
|
|
|
|||
|
|
@ -87,7 +87,7 @@ Used Version: 4.0.10
|
|||
Website: http://www.simplesystems.org/libtiff/
|
||||
|
||||
Title: mbed TLS
|
||||
Used Version: 2.7.10
|
||||
Used Version: 2.7.11
|
||||
Website: https://tls.mbed.org/
|
||||
|
||||
Title: libpng
|
||||
|
|
|
|||
|
|
@ -1897,9 +1897,7 @@
|
|||
*
|
||||
* This module provides debugging functions.
|
||||
*/
|
||||
#ifndef __REACTOS__
|
||||
#define MBEDTLS_DEBUG_C
|
||||
#endif
|
||||
//#define MBEDTLS_DEBUG_C /* swyter: we don't even need this level of verboseness, useful only when developing */
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_DES_C
|
||||
|
|
|
|||
|
|
@ -2108,12 +2108,27 @@ void mbedtls_ssl_conf_cert_req_ca_list( mbedtls_ssl_config *conf,
|
|||
|
||||
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
|
||||
/**
|
||||
* \brief Set the maximum fragment length to emit and/or negotiate
|
||||
* (Default: MBEDTLS_SSL_MAX_CONTENT_LEN, usually 2^14 bytes)
|
||||
* \brief Set the maximum fragment length to emit and/or negotiate.
|
||||
* (Typical: #MBEDTLS_SSL_MAX_CONTENT_LEN, by default that is
|
||||
* set to `2^14` bytes)
|
||||
* (Server: set maximum fragment length to emit,
|
||||
* usually negotiated by the client during handshake
|
||||
* usually negotiated by the client during handshake)
|
||||
* (Client: set maximum fragment length to emit *and*
|
||||
* negotiate with the server during handshake)
|
||||
* (Default: #MBEDTLS_SSL_MAX_FRAG_LEN_NONE)
|
||||
*
|
||||
* \note With TLS, this currently only affects ApplicationData (sent
|
||||
* with \c mbedtls_ssl_read()), not handshake messages.
|
||||
* With DTLS, this affects both ApplicationData and handshake.
|
||||
*
|
||||
* \note On the client side, the maximum fragment length extension
|
||||
* *will not* be used, unless the maximum fragment length has
|
||||
* been set via this function to a value different than
|
||||
* #MBEDTLS_SSL_MAX_FRAG_LEN_NONE.
|
||||
*
|
||||
* \note This sets the maximum length for a record's payload,
|
||||
* excluding record overhead that will be added to it, see
|
||||
* \c mbedtls_ssl_get_record_expansion().
|
||||
*
|
||||
* \param conf SSL configuration
|
||||
* \param mfl_code Code for maximum fragment length (allowed values:
|
||||
|
|
|
|||
|
|
@ -42,16 +42,16 @@
|
|||
*/
|
||||
#define MBEDTLS_VERSION_MAJOR 2
|
||||
#define MBEDTLS_VERSION_MINOR 7
|
||||
#define MBEDTLS_VERSION_PATCH 10
|
||||
#define MBEDTLS_VERSION_PATCH 11
|
||||
|
||||
/**
|
||||
* The single version number has the following structure:
|
||||
* MMNNPP00
|
||||
* Major version | Minor version | Patch version
|
||||
*/
|
||||
#define MBEDTLS_VERSION_NUMBER 0x02070A00
|
||||
#define MBEDTLS_VERSION_STRING "2.7.10"
|
||||
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.7.10"
|
||||
#define MBEDTLS_VERSION_NUMBER 0x02070B00
|
||||
#define MBEDTLS_VERSION_STRING "2.7.11"
|
||||
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.7.11"
|
||||
|
||||
#if defined(MBEDTLS_VERSION_C)
|
||||
|
||||
|
|
|
|||
|
|
@ -100,7 +100,7 @@ mbedtls_x509_crt;
|
|||
* Build flag from an algorithm/curve identifier (pk, md, ecp)
|
||||
* Since 0 is always XXX_NONE, ignore it.
|
||||
*/
|
||||
#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( id - 1 ) )
|
||||
#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( ( id ) - 1 ) )
|
||||
|
||||
/**
|
||||
* Security profile for certificate verification.
|
||||
|
|
|
|||
Loading…
Reference in a new issue