yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-03-23 05:25:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow compile-time configuration of DTLS badmac limit

Browse source 
Introduces MBEDTLS_SSL_CONF_BADMAC_LIMIT to fix the maximum
number of records with bad MAC tolerated in DTLS at compile-time.

Impact on code-size:

|  | GCC | ARMC5 | ARMC6 |
| --- | --- | --- | --- |
| `libmbedtls.a` before  | 23511 | 24049 | 27903 |
| `libmbedtls.a` after | 23487 | 24025 | 27885 |
| gain in Bytes | 24 | 24 | 18 |
This commit is contained in:
Hanno Becker 2019-06-12 16:30:46 +01:00
parent 7f376f4ece
commit de67154658
8 changed files with 53 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
configs/baremetal.h
View file

@ -80,6 +80,7 @@
#define MBEDTLS_SSL_DTLS_CONNECTION_ID
/* Compile-time fixed parts of the SSL configuration */
#define MBEDTLS_SSL_CONF_BADMAC_LIMIT 0
#define MBEDTLS_SSL_CONF_ANTI_REPLAY MBEDTLS_SSL_ANTI_REPLAY_ENABLED
#define MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET \
MBEDTLS_SSL_EXTENDED_MS_ENABLED

3
include/mbedtls/config.h
View file

@ -3450,8 +3450,9 @@
* \{
*/
/* DTLS Anti replay */
/* DTLS-specific settings */
//#define MBEDTLS_SSL_CONF_ANTI_REPLAY MBEDTLS_SSL_ANTI_REPLAY_ENABLED
//#define MBEDTLS_SSL_CONF_BADMAC_LIMIT 0
/* ExtendedMasterSecret extension
* The following two options must be set/unset simultaneously. */

11
include/mbedtls/ssl.h
View file

@ -1029,7 +1029,9 @@ struct mbedtls_ssl_config
#endif
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
#if !defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
unsigned int badmac_limit; /*!< limit of records with a bad MAC */
#endif /* !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
#endif
#if defined(MBEDTLS_DHM_C) && defined(MBEDTLS_SSL_CLI_C)
@ -2043,7 +2045,8 @@ int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode );
#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY && !MBEDTLS_SSL_CONF_ANTI_REPLAY */
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
!defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
/**
* \brief Set a limit on the number of records with a bad MAC
* before terminating the connection.
@ -2066,9 +2069,13 @@ void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode );
* connection. On the other hand, a high limit or no limit
* might make us waste resources checking authentication on
* many bogus packets.
*
* \note On constrained systems, this option can also be
* fixed at compile-time by defining the constant
* MBEDTLS_SSL_CONF_BADMAC_LIMIT.
*/
void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit );
#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT && !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
#if defined(MBEDTLS_SSL_PROTO_DTLS)

17
include/mbedtls/ssl_internal.h
View file

@ -1085,6 +1085,23 @@ int mbedtls_ssl_decrypt_buf( mbedtls_ssl_context *ssl,
* be fixed at compile time via one of MBEDTLS_SSL_SSL_CONF_XXX.
*/
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
#if !defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
static inline unsigned int mbedtls_ssl_conf_get_badmac_limit(
mbedtls_ssl_config const *conf )
{
return( conf->badmac_limit );
}
#else /* !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
static inline unsigned int mbedtls_ssl_conf_get_badmac_limit(
mbedtls_ssl_config const *conf )
{
((void) conf);
return( MBEDTLS_SSL_CONF_BADMAC_LIMIT );
}
#endif /* MBEDTLS_SSL_CONF_BADMAC_LIMIT */
#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT */
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
#if !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
static inline unsigned int mbedtls_ssl_conf_get_anti_replay(

12
library/ssl_tls.c
View file

@ -5780,8 +5780,8 @@ static int ssl_get_next_record( mbedtls_ssl_context *ssl )
}
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
if( ssl->conf->badmac_limit != 0 &&
++ssl->badmac_seen >= ssl->conf->badmac_limit )
if( mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) != 0 &&
++ssl->badmac_seen >= mbedtls_ssl_conf_get_badmac_limit( ssl->conf ) )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
return( MBEDTLS_ERR_SSL_INVALID_MAC );
@ -8068,12 +8068,14 @@ void mbedtls_ssl_conf_dtls_anti_replay( mbedtls_ssl_config *conf, char mode )
}
#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY && !MBEDTLS_SSL_CONF_ANTI_REPLAY */
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf, unsigned limit )
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
!defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
void mbedtls_ssl_conf_dtls_badmac_limit( mbedtls_ssl_config *conf,
unsigned limit )
{
conf->badmac_limit = limit;
}
#endif
#endif /* MBEDTLS_SSL_DTLS_BADMAC_LIMIT && !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
#if defined(MBEDTLS_SSL_PROTO_DTLS)

8
programs/ssl/query_config.c
View file

@ -2586,6 +2586,14 @@ int query_config( const char *config )
}
#endif /* MBEDTLS_SSL_CONF_ANTI_REPLAY */
#if defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
if( strcmp( "MBEDTLS_SSL_CONF_BADMAC_LIMIT", config ) == 0 )
{
MACRO_EXPANSION_TO_STR( MBEDTLS_SSL_CONF_BADMAC_LIMIT );
return( 0 );
}
#endif /* MBEDTLS_SSL_CONF_BADMAC_LIMIT */
#if defined(MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET)
if( strcmp( "MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET", config ) == 0 )
{

8
programs/ssl/ssl_server2.c
View file

@ -325,7 +325,8 @@ int main( void )
#define USAGE_ANTI_REPLAY ""
#endif
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
!defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
#define USAGE_BADMAC_LIMIT \
" badmac_limit=%%d default: (library default: disabled)\n"
#else
@ -1898,12 +1899,14 @@ int main( int argc, char *argv[] )
goto usage;
}
#endif /* !MBEDTLS_SSL_CONF_ANTI_REPLAY */
#if !defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
else if( strcmp( p, "badmac_limit" ) == 0 )
{
opt.badmac_limit = atoi( q );
if( opt.badmac_limit < 0 )
goto usage;
}
#endif /* !MBEDTLS_SSL_CONF_BADMAC_LIMIT */
else if( strcmp( p, "hs_timeout" ) == 0 )
{
if( ( p = strchr( q, '-' ) ) == NULL )
@ -2589,7 +2592,8 @@ int main( int argc, char *argv[] )
mbedtls_ssl_conf_dtls_anti_replay( &conf, opt.anti_replay );
#endif
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT) && \
!defined(MBEDTLS_SSL_CONF_BADMAC_LIMIT)
if( opt.badmac_limit != DFL_BADMAC_LIMIT )
mbedtls_ssl_conf_dtls_badmac_limit( &conf, opt.badmac_limit );
#endif

3
tests/ssl-opt.sh
View file

@ -549,6 +549,9 @@ check_cmdline_compat() {
check_cmdline_param_compat "anti_replay" \
"MBEDTLS_SSL_CONF_ANTI_REPLAY"
# DTLS bad MAC limit
check_cmdline_param_compat "badmac_limit" \
"MBEDTLS_SSL_CONF_BADMAC_LIMIT"
}
# Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]]