yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-10-18 17:21:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Made support for the max_fragment_length extension configurable

Browse source
This commit is contained in:
Paul Bakker 2013-08-15 13:33:48 +02:00
parent 9f3478a37d
commit 05decb24c3
7 changed files with 62 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
include/polarssl/config.h
View file

@ -528,6 +528,15 @@
*/ */
#define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO #define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
/**
* \def POLARSSL_SSL_MAX_FRAGMENT_LENGTH
*
* Enable support for RFC 6066 max_fragment_length extension in SSL
*
* Comment this macro to disable support for the max_fragment_length extension
*/
#define POLARSSL_SSL_MAX_FRAGMENT_LENGTH
/** /**
* \def POLARSSL_SSL_SESSION_TICKETS * \def POLARSSL_SSL_SESSION_TICKETS
* *

7
include/polarssl/ssl.h
View file

@ -362,7 +362,10 @@ struct _ssl_session
uint32_t ticket_lifetime; /*!< ticket lifetime hint */ uint32_t ticket_lifetime; /*!< ticket lifetime hint */
#endif /* POLARSSL_SSL_SESSION_TICKETS */ #endif /* POLARSSL_SSL_SESSION_TICKETS */
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
unsigned char mfl_code; /*!< MaxFragmentLength negotiated by peer */ unsigned char mfl_code; /*!< MaxFragmentLength negotiated by peer */
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
int trunc_hmac; /*!< flag for truncated hmac activation */ int trunc_hmac; /*!< flag for truncated hmac activation */
}; };
@ -560,7 +563,9 @@ struct _ssl_context
size_t out_msglen; /*!< record header: message length */ size_t out_msglen; /*!< record header: message length */
size_t out_left; /*!< amount of data not yet written */ size_t out_left; /*!< amount of data not yet written */
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
unsigned char mfl_code; /*!< MaxFragmentLength chosen by us */ unsigned char mfl_code; /*!< MaxFragmentLength chosen by us */
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
/* /*
* PKI layer * PKI layer
@ -1025,6 +1030,7 @@ void ssl_set_max_version( ssl_context *ssl, int major, int minor );
*/ */
void ssl_set_min_version( ssl_context *ssl, int major, int minor ); void ssl_set_min_version( ssl_context *ssl, int major, int minor );
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
/** /**
* \brief Set the maximum fragment length to emit and/or negotiate * \brief Set the maximum fragment length to emit and/or negotiate
* (Default: SSL_MAX_CONTENT_LEN, usually 2^14 bytes) * (Default: SSL_MAX_CONTENT_LEN, usually 2^14 bytes)
@ -1041,6 +1047,7 @@ void ssl_set_min_version( ssl_context *ssl, int major, int minor );
* \return O if successful or POLARSSL_ERR_SSL_BAD_INPUT_DATA * \return O if successful or POLARSSL_ERR_SSL_BAD_INPUT_DATA
*/ */
int ssl_set_max_frag_len( ssl_context *ssl, unsigned char mfl_code ); int ssl_set_max_frag_len( ssl_context *ssl, unsigned char mfl_code );
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
/** /**
* \brief Activate negotiation of truncated HMAC (Client only) * \brief Activate negotiation of truncated HMAC (Client only)

8
library/ssl_cli.c
View file

@ -276,6 +276,7 @@ static void ssl_write_supported_point_formats_ext( ssl_context *ssl,
} }
#endif #endif
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
static void ssl_write_max_fragment_length_ext( ssl_context *ssl, static void ssl_write_max_fragment_length_ext( ssl_context *ssl,
unsigned char *buf, unsigned char *buf,
size_t *olen ) size_t *olen )
@ -299,6 +300,7 @@ static void ssl_write_max_fragment_length_ext( ssl_context *ssl,
*olen = 5; *olen = 5;
} }
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
static void ssl_write_truncated_hmac_ext( ssl_context *ssl, static void ssl_write_truncated_hmac_ext( ssl_context *ssl,
unsigned char *buf, size_t *olen ) unsigned char *buf, size_t *olen )
@ -546,8 +548,10 @@ static int ssl_write_client_hello( ssl_context *ssl )
ext_len += olen; ext_len += olen;
#endif #endif
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen ); ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
ext_len += olen; ext_len += olen;
#endif
ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen ); ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
ext_len += olen; ext_len += olen;
@ -621,6 +625,7 @@ static int ssl_parse_renegotiation_info( ssl_context *ssl,
return( 0 ); return( 0 );
} }
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
static int ssl_parse_max_fragment_length_ext( ssl_context *ssl, static int ssl_parse_max_fragment_length_ext( ssl_context *ssl,
const unsigned char *buf, const unsigned char *buf,
size_t len ) size_t len )
@ -638,6 +643,7 @@ static int ssl_parse_max_fragment_length_ext( ssl_context *ssl,
return( 0 ); return( 0 );
} }
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
static int ssl_parse_truncated_hmac_ext( ssl_context *ssl, static int ssl_parse_truncated_hmac_ext( ssl_context *ssl,
const unsigned char *buf, const unsigned char *buf,
@ -891,6 +897,7 @@ static int ssl_parse_server_hello( ssl_context *ssl )
break; break;
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
case TLS_EXT_MAX_FRAGMENT_LENGTH: case TLS_EXT_MAX_FRAGMENT_LENGTH:
SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) ); SSL_DEBUG_MSG( 3, ( "found max_fragment_length extension" ) );
@ -901,6 +908,7 @@ static int ssl_parse_server_hello( ssl_context *ssl )
} }
break; break;
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
case TLS_EXT_TRUNCATED_HMAC: case TLS_EXT_TRUNCATED_HMAC:
SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) ); SSL_DEBUG_MSG( 3, ( "found truncated_hmac extension" ) );

8
library/ssl_srv.c
View file

@ -564,6 +564,7 @@ static int ssl_parse_supported_point_formats( ssl_context *ssl,
} }
#endif /* POLARSSL_ECP_C */ #endif /* POLARSSL_ECP_C */
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
static int ssl_parse_max_fragment_length_ext( ssl_context *ssl, static int ssl_parse_max_fragment_length_ext( ssl_context *ssl,
const unsigned char *buf, const unsigned char *buf,
size_t len ) size_t len )
@ -578,6 +579,7 @@ static int ssl_parse_max_fragment_length_ext( ssl_context *ssl,
return( 0 ); return( 0 );
} }
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
static int ssl_parse_truncated_hmac_ext( ssl_context *ssl, static int ssl_parse_truncated_hmac_ext( ssl_context *ssl,
const unsigned char *buf, const unsigned char *buf,
@ -1174,6 +1176,7 @@ static int ssl_parse_client_hello( ssl_context *ssl )
break; break;
#endif /* POLARSSL_ECP_C */ #endif /* POLARSSL_ECP_C */
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
case TLS_EXT_MAX_FRAGMENT_LENGTH: case TLS_EXT_MAX_FRAGMENT_LENGTH:
SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) ); SSL_DEBUG_MSG( 3, ( "found max fragment length extension" ) );
@ -1181,6 +1184,7 @@ static int ssl_parse_client_hello( ssl_context *ssl )
if( ret != 0 ) if( ret != 0 )
return( ret ); return( ret );
break; break;
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
case TLS_EXT_TRUNCATED_HMAC: case TLS_EXT_TRUNCATED_HMAC:
SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) ); SSL_DEBUG_MSG( 3, ( "found truncated hmac extension" ) );
@ -1386,6 +1390,7 @@ static void ssl_write_renegotiation_ext( ssl_context *ssl,
*olen = 5 + ssl->verify_data_len * 2; *olen = 5 + ssl->verify_data_len * 2;
} }
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
static void ssl_write_max_fragment_length_ext( ssl_context *ssl, static void ssl_write_max_fragment_length_ext( ssl_context *ssl,
unsigned char *buf, unsigned char *buf,
size_t *olen ) size_t *olen )
@ -1410,6 +1415,7 @@ static void ssl_write_max_fragment_length_ext( ssl_context *ssl,
*olen = 5; *olen = 5;
} }
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
static int ssl_write_server_hello( ssl_context *ssl ) static int ssl_write_server_hello( ssl_context *ssl )
{ {
@ -1551,8 +1557,10 @@ static int ssl_write_server_hello( ssl_context *ssl )
ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen ); ssl_write_renegotiation_ext( ssl, p + 2 + ext_len, &olen );
ext_len += olen; ext_len += olen;
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen ); ssl_write_max_fragment_length_ext( ssl, p + 2 + ext_len, &olen );
ext_len += olen; ext_len += olen;
#endif
ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen ); ssl_write_truncated_hmac_ext( ssl, p + 2 + ext_len, &olen );
ext_len += olen; ext_len += olen;

10
library/ssl_tls.c
View file

@ -59,6 +59,7 @@
#define strcasecmp _stricmp #define strcasecmp _stricmp
#endif #endif
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
/* /*
* Convert max_fragment_length codes to length. * Convert max_fragment_length codes to length.
* RFC 6066 says: * RFC 6066 says:
@ -75,6 +76,7 @@ static unsigned int mfl_code_to_length[SSL_MAX_FRAG_LEN_INVALID] =
2048, /* SSL_MAX_FRAG_LEN_2048 */ 2048, /* SSL_MAX_FRAG_LEN_2048 */
4096, /* SSL_MAX_FRAG_LEN_4096 */ 4096, /* SSL_MAX_FRAG_LEN_4096 */
}; };
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
static int ssl_session_copy( ssl_session *dst, const ssl_session *src ) static int ssl_session_copy( ssl_session *dst, const ssl_session *src )
{ {
@ -3238,6 +3240,7 @@ void ssl_set_min_version( ssl_context *ssl, int major, int minor )
ssl->min_minor_ver = minor; ssl->min_minor_ver = minor;
} }
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
int ssl_set_max_frag_len( ssl_context *ssl, unsigned char mfl_code ) int ssl_set_max_frag_len( ssl_context *ssl, unsigned char mfl_code )
{ {
if( mfl_code >= sizeof( mfl_code_to_length ) || if( mfl_code >= sizeof( mfl_code_to_length ) ||
@ -3250,6 +3253,7 @@ int ssl_set_max_frag_len( ssl_context *ssl, unsigned char mfl_code )
return( 0 ); return( 0 );
} }
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
int ssl_set_truncated_hmac( ssl_context *ssl, int truncate ) int ssl_set_truncated_hmac( ssl_context *ssl, int truncate )
{ {
@ -3555,7 +3559,7 @@ int ssl_write( ssl_context *ssl, const unsigned char *buf, size_t len )
{ {
int ret; int ret;
size_t n; size_t n;
unsigned int max_len; unsigned int max_len = SSL_MAX_CONTENT_LEN;
SSL_DEBUG_MSG( 2, ( "=> write" ) ); SSL_DEBUG_MSG( 2, ( "=> write" ) );
@ -3568,19 +3572,21 @@ int ssl_write( ssl_context *ssl, const unsigned char *buf, size_t len )
} }
} }
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
/* /*
* Assume mfl_code is correct since it was checked when set * Assume mfl_code is correct since it was checked when set
*/ */
max_len = mfl_code_to_length[ssl->mfl_code]; max_len = mfl_code_to_length[ssl->mfl_code];
/* /*
* Check if a smaller max length was negociated * Check if a smaller max length was negotiated
*/ */
if( ssl->session_out != NULL && if( ssl->session_out != NULL &&
mfl_code_to_length[ssl->session_out->mfl_code] < max_len ) mfl_code_to_length[ssl->session_out->mfl_code] < max_len )
{ {
max_len = mfl_code_to_length[ssl->session_out->mfl_code]; max_len = mfl_code_to_length[ssl->session_out->mfl_code];
} }
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
n = ( len < max_len) ? len : max_len; n = ( len < max_len) ? len : max_len;

13
programs/ssl/ssl_client2.c
View file

@ -185,6 +185,14 @@ static int my_verify( void *data, x509_cert *crt, int depth, int *flags )
#define USAGE_TICKETS "" #define USAGE_TICKETS ""
#endif /* POLARSSL_SSL_SESSION_TICKETS */ #endif /* POLARSSL_SSL_SESSION_TICKETS */
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
#define USAGE_MAX_FRAG_LEN \
" max_frag_len=%%d default: 16384 (tls default)\n" \
" options: 512, 1024, 2048, 4096\n"
#else
#define USAGE_MAX_FRAG_LEN ""
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
#define USAGE \ #define USAGE \
"\n usage: ssl_client2 param=<>...\n" \ "\n usage: ssl_client2 param=<>...\n" \
"\n acceptable parameters:\n" \ "\n acceptable parameters:\n" \
@ -204,8 +212,7 @@ static int my_verify( void *data, x509_cert *crt, int depth, int *flags )
" options: ssl3, tls1, tls1_1, tls1_2\n" \ " options: ssl3, tls1, tls1_1, tls1_2\n" \
" auth_mode=%%s default: \"optional\"\n" \ " auth_mode=%%s default: \"optional\"\n" \
" options: none, optional, required\n" \ " options: none, optional, required\n" \
" max_frag_len=%%d default: 16384 (tls default)\n" \ USAGE_MAX_FRAG_LEN \
" options: 512, 1024, 2048, 4096\n" \
" trunc_hmac=%%d default: 0 (disabled)\n" \ " trunc_hmac=%%d default: 0 (disabled)\n" \
USAGE_PSK \ USAGE_PSK \
"\n" \ "\n" \
@ -671,7 +678,9 @@ int main( int argc, char *argv[] )
ssl_set_endpoint( &ssl, SSL_IS_CLIENT ); ssl_set_endpoint( &ssl, SSL_IS_CLIENT );
ssl_set_authmode( &ssl, opt.auth_mode ); ssl_set_authmode( &ssl, opt.auth_mode );
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
ssl_set_max_frag_len( &ssl, opt.mfl_code ); ssl_set_max_frag_len( &ssl, opt.mfl_code );
#endif
if( opt.trunc_hmac != 0 ) if( opt.trunc_hmac != 0 )
ssl_set_truncated_hmac( &ssl, SSL_TRUNC_HMAC_ENABLED ); ssl_set_truncated_hmac( &ssl, SSL_TRUNC_HMAC_ENABLED );

13
programs/ssl/ssl_server2.c
View file

@ -153,6 +153,14 @@ static void my_debug( void *ctx, int level, const char *str )
#define USAGE_TICKETS "" #define USAGE_TICKETS ""
#endif /* POLARSSL_SSL_SESSION_TICKETS */ #endif /* POLARSSL_SSL_SESSION_TICKETS */
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
#define USAGE_MAX_FRAG_LEN \
" max_frag_len=%%d default: 16384 (tls default)\n" \
" options: 512, 1024, 2048, 4096\n"
#else
#define USAGE_MAX_FRAG_LEN ""
#endif /* POLARSSL_SSL_MAX_FRAGMENT_LENGTH */
#define USAGE \ #define USAGE \
"\n usage: ssl_server2 param=<>...\n" \ "\n usage: ssl_server2 param=<>...\n" \
"\n acceptable parameters:\n" \ "\n acceptable parameters:\n" \
@ -169,8 +177,7 @@ static void my_debug( void *ctx, int level, const char *str )
" options: ssl3, tls1, tls1_1, tls1_2\n" \ " options: ssl3, tls1, tls1_1, tls1_2\n" \
" auth_mode=%%s default: \"optional\"\n" \ " auth_mode=%%s default: \"optional\"\n" \
" options: none, optional, required\n" \ " options: none, optional, required\n" \
" max_frag_len=%%d default: 16384 (tls default)\n" \ USAGE_MAX_FRAG_LEN \
" options: 512, 1024, 2048, 4096\n" \
USAGE_PSK \ USAGE_PSK \
"\n" \ "\n" \
" force_ciphersuite=<name> default: all enabled\n"\ " force_ciphersuite=<name> default: all enabled\n"\
@ -618,7 +625,9 @@ int main( int argc, char *argv[] )
ssl_set_endpoint( &ssl, SSL_IS_SERVER ); ssl_set_endpoint( &ssl, SSL_IS_SERVER );
ssl_set_authmode( &ssl, opt.auth_mode ); ssl_set_authmode( &ssl, opt.auth_mode );
#if defined(POLARSSL_SSL_MAX_FRAGMENT_LENGTH)
ssl_set_max_frag_len( &ssl, opt.mfl_code ); ssl_set_max_frag_len( &ssl, opt.mfl_code );
#endif
ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg ); ssl_set_rng( &ssl, ctr_drbg_random, &ctr_drbg );
ssl_set_dbg( &ssl, my_debug, stdout ); ssl_set_dbg( &ssl, my_debug, stdout );