The previous commit b3e6872c9381ed4ce020d631dda1e0126c42b64f changed
to public functions from ssl_ciphersuite.h to static inline. This
commit reverts this change.
Fix a resource leak on windows platform, in mbedtls_x509_crt_parse_path,
in case a failure. when an error occurs, goto cleanup, and free the
resource, instead of returning error code immediately.
Protecting the ECP hardware acceleratior with mutexes is inconsistent with the
philosophy of the library. Pre-existing hardware accelerator interfaces
leave concurrency support to the underlying platform.
Fixes#863
If we didn't walk the whole chain, then there may be any kind of errors in the
part of the chain we didn't check, so setting all flags looks like the safe
thing to do.
This change moves the calls to mbedtls_sha256_starts() and
mbedtls_sha512_starts() out of the mbedtls_entropy_init() function as
these now have return codes which need to be checked.
This patch modifies the entropy.c module to ensure that the sha256 and
sha512 contexts are correctly initialised and freed instead of skipping
these calls or simply zeroizing with memset() or mbedtls_zeroize().
This is important as the sha contexts might otherwise leak memory or
other resources, and even more so in the context of hardware
accelerators where the configuration of the device might be done in the
init and free calls.
This patch modifies the internal md context structure in md_wrap.c to
add return values to the function pointers. This enables us to use the
new API in the corresponding MD modules so that failures can be
found at any point in an MD computation.
The following function calls are being deprecated to introduce int
return values.
* mbedtls_sha512()
* mbedtls_sha512_starts()
* mbedtls_sha512_update()
* mbedtls_sha512_finish()
* mbedtls_sha512_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
The following function calls are being deprecated to introduce int
return values.
* mbedtls_sha256()
* mbedtls_sha256_starts()
* mbedtls_sha256_update()
* mbedtls_sha256_finish()
* mbedtls_sha256_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
The following function calls are being deprecated to introduce int
return values.
* mbedtls_ripemd160()
* mbedtls_ripemd160_starts()
* mbedtls_ripemd160_update()
* mbedtls_ripemd160_finish()
* mbedtls_ripemd160_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
The following function calls are being deprecated to introduce int
return values.
* mbedtls_md5()
* mbedtls_md5_starts()
* mbedtls_md5_update()
* mbedtls_md5_finish()
* mbedtls_md5_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
The following function calls are being deprecated to introduce int
return values.
* mbedtls_md4()
* mbedtls_md4_starts()
* mbedtls_md4_update()
* mbedtls_md4_finish()
* mbedtls_md4_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
The following function calls are being deprecated to introduce int
return values.
* mbedtls_md2()
* mbedtls_md2_starts()
* mbedtls_md2_update()
* mbedtls_md2_finish()
* mbedtls_md2_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
The following function calls are being deprecated to introduce int
return values.
* mbedtls_sha1()
* mbedtls_sha1_starts()
* mbedtls_sha1_update()
* mbedtls_sha1_finish()
* mbedtls_sha1_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
The check `if( *p + n > end )` in `ssl_parse_client_psk_identity` is
unsafe because `*p + n` might overflow, thus bypassing the check. As
`n` is a user-specified value up to 65K, this is relevant if the
library happens to be located in the last 65K of virtual memory.
This commit replaces the check by a safe version.
This patch modifies the function mbedtls_gcm_self_test() function to
ensure that AES-GCM-192 tests are only run if the key size is supported
by the available implementation. This is useful when using
MBEDTLS_AES_ALT as some hardware crypto accelerators might not support
AES-192.
This patch modifies the function mbedtls_aes_selftest() function to
ensure that AES-192 tests are only run if the key size is supported by
the available implementation. This is useful when using MBEDTLS_AES_ALT
as some hardware crypto accelerators might not support AES-192.
