yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-22 19:20:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'public/pr/2096' into mbedtls-2.7-proposed

Browse source
This commit is contained in:
Simon Butcher 2018-11-04 18:48:46 +00:00
parent fa8c974329 74a1c4b178
commit 5a15fa3cdc
4 changed files with 28 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ChangeLog
View file

@ -18,6 +18,9 @@ Bugfix
program programs/x509/cert_write. Fixes #1422.
* Ignore iv in mbedtls_cipher_set_iv() when the cipher mode is MBEDTLS_MODE_ECB
Fix for #1091 raised by ezdevelop
* Zeroize memory used for reassembling handshake messages after use.
* Use `mbedtls_zeroize()` instead of `memset()` for zeroization of
sensitive data in the example programs aescrypt2 and crypt_and_hash.
Changes
* Add tests for session resumption in DTLS.

1
library/ssl_tls.c
View file

@ -3235,6 +3235,7 @@ static int ssl_reassemble_dtls_handshake( mbedtls_ssl_context *ssl )
memcpy( ssl->in_msg, ssl->handshake->hs_msg, ssl->in_hslen );
mbedtls_zeroize( ssl->handshake->hs_msg, ssl->in_hslen );
mbedtls_free( ssl->handshake->hs_msg );
ssl->handshake->hs_msg = NULL;

18
programs/aes/aescrypt2.c
View file

@ -72,6 +72,12 @@ int main( void )
return( 0 );
}
#else
/* Implementation that should never be optimized out by the compiler */
static void mbedtls_zeroize( void *v, size_t n ) {
volatile unsigned char *p = v; while( n-- ) *p++ = 0;
}
int main( int argc, char *argv[] )
{
int ret = 0;
@ -445,13 +451,13 @@ exit:
the case when the user has missed or reordered some,
in which case the key might not be in argv[4]. */
for( i = 0; i < (unsigned int) argc; i++ )
memset( argv[i], 0, strlen( argv[i] ) );
mbedtls_zeroize( argv[i], strlen( argv[i] ) );
memset( IV, 0, sizeof( IV ) );
memset( key, 0, sizeof( key ) );
memset( tmp, 0, sizeof( tmp ) );
memset( buffer, 0, sizeof( buffer ) );
memset( digest, 0, sizeof( digest ) );
mbedtls_zeroize( IV, sizeof( IV ) );
mbedtls_zeroize( key, sizeof( key ) );
mbedtls_zeroize( tmp, sizeof( tmp ) );
mbedtls_zeroize( buffer, sizeof( buffer ) );
mbedtls_zeroize( digest, sizeof( digest ) );
mbedtls_aes_free( &aes_ctx );
mbedtls_md_free( &sha_ctx );

18
programs/aes/crypt_and_hash.c
View file

@ -74,6 +74,12 @@ int main( void )
return( 0 );
}
#else
/* Implementation that should never be optimized out by the compiler */
static void mbedtls_zeroize( void *v, size_t n ) {
volatile unsigned char *p = v; while( n-- ) *p++ = 0;
}
int main( int argc, char *argv[] )
{
int ret = 1, i, n;
@ -542,13 +548,13 @@ exit:
the case when the user has missed or reordered some,
in which case the key might not be in argv[6]. */
for( i = 0; i < argc; i++ )
memset( argv[i], 0, strlen( argv[i] ) );
mbedtls_zeroize( argv[i], strlen( argv[i] ) );
memset( IV, 0, sizeof( IV ) );
memset( key, 0, sizeof( key ) );
memset( buffer, 0, sizeof( buffer ) );
memset( output, 0, sizeof( output ) );
memset( digest, 0, sizeof( digest ) );
mbedtls_zeroize( IV, sizeof( IV ) );
mbedtls_zeroize( key, sizeof( key ) );
mbedtls_zeroize( buffer, sizeof( buffer ) );
mbedtls_zeroize( output, sizeof( output ) );
mbedtls_zeroize( digest, sizeof( digest ) );
mbedtls_cipher_free( &cipher_ctx );
mbedtls_md_free( &md_ctx );