Move things to conf substructure
A simple series of sed invocations.
This is the first step, purely internal changes. The conf substructure is not
ready to be shared between contexts yet.
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 9fb2c97..17c6495 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -68,7 +68,7 @@
static inline size_t ssl_ep_len( const mbedtls_ssl_context *ssl )
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
return( 2 );
#else
((void) ssl);
@@ -111,16 +111,16 @@
{
uint32_t new_timeout;
- if( ssl->handshake->retransmit_timeout >= ssl->hs_timeout_max )
+ if( ssl->handshake->retransmit_timeout >= ssl->conf->hs_timeout_max )
return( -1 );
new_timeout = 2 * ssl->handshake->retransmit_timeout;
/* Avoid arithmetic overflow and range overflow */
if( new_timeout < ssl->handshake->retransmit_timeout ||
- new_timeout > ssl->hs_timeout_max )
+ new_timeout > ssl->conf->hs_timeout_max )
{
- new_timeout = ssl->hs_timeout_max;
+ new_timeout = ssl->conf->hs_timeout_max;
}
ssl->handshake->retransmit_timeout = new_timeout;
@@ -132,7 +132,7 @@
static void ssl_reset_retransmit_timeout( mbedtls_ssl_context *ssl )
{
- ssl->handshake->retransmit_timeout = ssl->hs_timeout_min;
+ ssl->handshake->retransmit_timeout = ssl->conf->hs_timeout_min;
MBEDTLS_SSL_DEBUG_MSG( 3, ( "update timeout value to %d millisecs",
ssl->handshake->retransmit_timeout ) );
}
@@ -772,7 +772,7 @@
* Finally setup the cipher contexts, IVs and MAC secrets.
*/
#if defined(MBEDTLS_SSL_CLI_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
{
key1 = keyblk + transform->maclen * 2;
key2 = keyblk + transform->maclen * 2 + transform->keylen;
@@ -792,7 +792,7 @@
else
#endif /* MBEDTLS_SSL_CLI_C */
#if defined(MBEDTLS_SSL_SRV_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
{
key1 = keyblk + transform->maclen * 2 + transform->keylen;
key2 = keyblk + transform->maclen * 2;
@@ -1077,12 +1077,12 @@
#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED)
if( key_ex == MBEDTLS_KEY_EXCHANGE_PSK )
{
- if( end - p < 2 + (int) ssl->psk_len )
+ if( end - p < 2 + (int) ssl->conf->psk_len )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
- *(p++) = (unsigned char)( ssl->psk_len >> 8 );
- *(p++) = (unsigned char)( ssl->psk_len );
- p += ssl->psk_len;
+ *(p++) = (unsigned char)( ssl->conf->psk_len >> 8 );
+ *(p++) = (unsigned char)( ssl->conf->psk_len );
+ p += ssl->conf->psk_len;
}
else
#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */
@@ -1149,13 +1149,13 @@
}
/* opaque psk<0..2^16-1>; */
- if( end - p < 2 + (int) ssl->psk_len )
+ if( end - p < 2 + (int) ssl->conf->psk_len )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
- *(p++) = (unsigned char)( ssl->psk_len >> 8 );
- *(p++) = (unsigned char)( ssl->psk_len );
- memcpy( p, ssl->psk, ssl->psk_len );
- p += ssl->psk_len;
+ *(p++) = (unsigned char)( ssl->conf->psk_len >> 8 );
+ *(p++) = (unsigned char)( ssl->conf->psk_len );
+ memcpy( p, ssl->conf->psk, ssl->conf->psk_len );
+ p += ssl->conf->psk_len;
ssl->handshake->pmslen = p - ssl->handshake->premaster;
@@ -1327,7 +1327,7 @@
memcpy( add_data, ssl->out_ctr, 8 );
add_data[8] = ssl->out_msgtype;
mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
- ssl->transport, add_data + 9 );
+ ssl->conf->transport, add_data + 9 );
add_data[11] = ( ssl->out_msglen >> 8 ) & 0xFF;
add_data[12] = ssl->out_msglen & 0xFF;
@@ -1622,7 +1622,7 @@
memcpy( add_data, ssl->in_ctr, 8 );
add_data[8] = ssl->in_msgtype;
mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
- ssl->transport, add_data + 9 );
+ ssl->conf->transport, add_data + 9 );
add_data[11] = ( ssl->in_msglen >> 8 ) & 0xFF;
add_data[12] = ssl->in_msglen & 0xFF;
@@ -2005,7 +2005,7 @@
ssl->nb_zero = 0;
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
; /* in_ctr read from peer, not maintained internally */
}
@@ -2138,9 +2138,9 @@
{
/* If renegotiation is not enforced, retransmit until we would reach max
* timeout if we were using the usual handshake doubling scheme */
- if( ssl->renego_max_records < 0 )
+ if( ssl->conf->renego_max_records < 0 )
{
- uint32_t ratio = ssl->hs_timeout_max / ssl->hs_timeout_min + 1;
+ uint32_t ratio = ssl->conf->hs_timeout_max / ssl->conf->hs_timeout_min + 1;
unsigned char doublings = 1;
while( ratio != 0 )
@@ -2197,7 +2197,7 @@
}
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
uint32_t timeout;
@@ -2272,7 +2272,7 @@
if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
timeout = ssl->handshake->retransmit_timeout;
else
- timeout = ssl->read_timeout;
+ timeout = ssl->conf->read_timeout;
MBEDTLS_SSL_DEBUG_MSG( 3, ( "f_recv_timeout: %u ms", timeout ) );
@@ -2310,7 +2310,7 @@
return( MBEDTLS_ERR_NET_WANT_READ );
}
#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
- else if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER &&
+ else if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
{
if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
@@ -2655,7 +2655,7 @@
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write record" ) );
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
ssl->handshake != NULL &&
ssl->handshake->retransmit_state == MBEDTLS_SSL_RETRANS_SENDING )
{
@@ -2677,7 +2677,7 @@
* uint24 fragment_length;
*/
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
/* Make room for the additional DTLS fields */
memmove( ssl->out_msg + 12, ssl->out_msg + 4, len - 4 );
@@ -2709,7 +2709,7 @@
/* Save handshake and CCS messages for resending */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
ssl->handshake != NULL &&
ssl->handshake->retransmit_state != MBEDTLS_SSL_RETRANS_SENDING &&
( ssl->out_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC ||
@@ -2757,7 +2757,7 @@
{
ssl->out_hdr[0] = (unsigned char) ssl->out_msgtype;
mbedtls_ssl_write_version( ssl->major_ver, ssl->minor_ver,
- ssl->transport, ssl->out_hdr + 1 );
+ ssl->conf->transport, ssl->out_hdr + 1 );
ssl->out_len[0] = (unsigned char)( len >> 8 );
ssl->out_len[1] = (unsigned char)( len );
@@ -3036,7 +3036,7 @@
ssl->in_msglen, ssl->in_msg[0], ssl->in_hslen ) );
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
int ret;
unsigned int recv_msg_seq = ( ssl->in_msg[4] << 8 ) | ssl->in_msg[5];
@@ -3104,7 +3104,7 @@
/* Handshake message is complete, increment counter */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
ssl->handshake != NULL )
{
ssl->handshake->in_msg_seq++;
@@ -3149,7 +3149,7 @@
uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
uint64_t bit;
- if( ssl->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
+ if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
return( 0 );
if( rec_seqnum > ssl->in_window_top )
@@ -3173,7 +3173,7 @@
{
uint64_t rec_seqnum = ssl_load_six_bytes( ssl->in_ctr + 2 );
- if( ssl->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
+ if( ssl->conf->anti_replay == MBEDTLS_SSL_ANTI_REPLAY_DISABLED )
return;
if( rec_seqnum > ssl->in_window_top )
@@ -3218,7 +3218,7 @@
ssl->in_msgtype = ssl->in_hdr[0];
ssl->in_msglen = ( ssl->in_len[0] << 8 ) | ssl->in_len[1];
- mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->transport, ssl->in_hdr + 1 );
+ mbedtls_ssl_read_version( &major_ver, &minor_ver, ssl->conf->transport, ssl->in_hdr + 1 );
MBEDTLS_SSL_DEBUG_MSG( 3, ( "input record: msgtype = %d, "
"version = [%d:%d], msglen = %d",
@@ -3244,7 +3244,7 @@
}
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
/* Drop unexpected ChangeCipherSpec messages */
if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
@@ -3278,7 +3278,7 @@
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
}
- if( minor_ver > ssl->max_minor_ver )
+ if( minor_ver > ssl->conf->max_minor_ver )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
return( MBEDTLS_ERR_SSL_INVALID_RECORD );
@@ -3286,7 +3286,7 @@
/* Check epoch (and sequence number) with DTLS */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
@@ -3421,7 +3421,7 @@
#endif /* MBEDTLS_ZLIB_SUPPORT */
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
mbedtls_ssl_dtls_replay_update( ssl );
}
@@ -3480,7 +3480,7 @@
if( ( ret = ssl_parse_record_header( ssl ) ) != 0 )
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
/* Ignore bad record and get next one; drop the whole datagram
* since current header cannot be trusted to find the next record
@@ -3507,7 +3507,7 @@
/* Done reading this record, get ready for the next one */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
ssl->next_record_offset = ssl->in_msglen + mbedtls_ssl_hdr_len( ssl );
else
#endif
@@ -3516,15 +3516,15 @@
if( ( ret = ssl_prepare_record_content( ssl ) ) != 0 )
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
/* Silently discard invalid records */
if( ret == MBEDTLS_ERR_SSL_INVALID_RECORD ||
ret == MBEDTLS_ERR_SSL_INVALID_MAC )
{
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
- if( ssl->badmac_limit != 0 &&
- ++ssl->badmac_seen >= ssl->badmac_limit )
+ if( ssl->conf->badmac_limit != 0 &&
+ ++ssl->badmac_seen >= ssl->conf->badmac_limit )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "too many records with bad MAC" ) );
return( MBEDTLS_ERR_SSL_INVALID_MAC );
@@ -3569,7 +3569,7 @@
* being mistaken for an ancient message in the current handshake.
*/
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
ssl->handshake != NULL &&
ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER )
{
@@ -3735,7 +3735,7 @@
}
#if defined(MBEDTLS_SSL_CLI_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
{
if( ssl->client_auth == 0 )
{
@@ -3764,7 +3764,7 @@
}
#endif /* MBEDTLS_SSL_CLI_C */
#if defined(MBEDTLS_SSL_SRV_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
{
if( mbedtls_ssl_own_cert( ssl ) == NULL )
{
@@ -3849,8 +3849,8 @@
}
#if defined(MBEDTLS_SSL_SRV_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER &&
- ( ssl->authmode == MBEDTLS_SSL_VERIFY_NONE ||
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
+ ( ssl->conf->authmode == MBEDTLS_SSL_VERIFY_NONE ||
ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ) )
{
ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
@@ -3873,7 +3873,7 @@
/*
* Check if the client sent an empty certificate
*/
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER &&
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 )
{
if( ssl->in_msglen == 2 &&
@@ -3884,7 +3884,7 @@
MBEDTLS_SSL_DEBUG_MSG( 1, ( "SSLv3 client has no certificate" ) );
ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
- if( ssl->authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
+ if( ssl->conf->authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
return( 0 );
else
return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
@@ -3894,7 +3894,7 @@
#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
defined(MBEDTLS_SSL_PROTO_TLS1_2)
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER &&
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
ssl->minor_ver != MBEDTLS_SSL_MINOR_VERSION_0 )
{
if( ssl->in_hslen == 3 + mbedtls_ssl_hs_hdr_len( ssl ) &&
@@ -3905,7 +3905,7 @@
MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLSv1 client has no certificate" ) );
ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_MISSING;
- if( ssl->authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
+ if( ssl->conf->authmode == MBEDTLS_SSL_VERIFY_REQUIRED )
return( MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE );
else
return( 0 );
@@ -3997,7 +3997,7 @@
* avoid "triple handshake" attack: https://secure-resumption.com/
*/
#if defined(MBEDTLS_SSL_RENEGOTIATION) && defined(MBEDTLS_SSL_CLI_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT &&
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS )
{
if( ssl->session->peer_cert == NULL )
@@ -4018,9 +4018,9 @@
}
#endif /* MBEDTLS_SSL_RENEGOTIATION && MBEDTLS_SSL_CLI_C */
- if( ssl->authmode != MBEDTLS_SSL_VERIFY_NONE )
+ if( ssl->conf->authmode != MBEDTLS_SSL_VERIFY_NONE )
{
- if( ssl->ca_chain == NULL )
+ if( ssl->conf->ca_chain == NULL )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "got no CA chain" ) );
return( MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED );
@@ -4030,9 +4030,9 @@
* Main check: verify certificate
*/
ret = mbedtls_x509_crt_verify( ssl->session_negotiate->peer_cert,
- ssl->ca_chain, ssl->ca_crl, ssl->peer_cn,
+ ssl->conf->ca_chain, ssl->conf->ca_crl, ssl->peer_cn,
&ssl->session_negotiate->verify_result,
- ssl->f_vrfy, ssl->p_vrfy );
+ ssl->conf->f_vrfy, ssl->conf->p_vrfy );
if( ret != 0 )
{
@@ -4060,7 +4060,7 @@
if( mbedtls_ssl_check_cert_usage( ssl->session_negotiate->peer_cert,
ciphersuite_info,
- ! ssl->endpoint,
+ ! ssl->conf->endpoint,
&ssl->session_negotiate->verify_result ) != 0 )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad certificate (usage extensions)" ) );
@@ -4068,7 +4068,7 @@
ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE;
}
- if( ssl->authmode != MBEDTLS_SSL_VERIFY_REQUIRED )
+ if( ssl->conf->authmode != MBEDTLS_SSL_VERIFY_REQUIRED )
ret = 0;
}
@@ -4140,7 +4140,7 @@
ssl->session_in = ssl->session_negotiate;
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
ssl_dtls_replay_reset( ssl );
@@ -4571,16 +4571,16 @@
/*
* Add cache entry
*/
- if( ssl->f_set_cache != NULL &&
+ if( ssl->conf->f_set_cache != NULL &&
ssl->session->length != 0 &&
resume == 0 )
{
- if( ssl->f_set_cache( ssl->p_set_cache, ssl->session ) != 0 )
+ if( ssl->conf->f_set_cache( ssl->conf->p_set_cache, ssl->session ) != 0 )
MBEDTLS_SSL_DEBUG_MSG( 1, ( "cache did not store session" ) );
}
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
ssl->handshake->flight != NULL )
{
/* Cancel handshake timer */
@@ -4616,7 +4616,7 @@
else
ssl->out_msg = ssl->out_iv;
- ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->endpoint );
+ ssl->handshake->calc_finished( ssl, ssl->out_msg + 4, ssl->conf->endpoint );
// TODO TLS/1.2 Hash length is determined by cipher suite (Page 63)
hash_len = ( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 ) ? 36 : 12;
@@ -4637,11 +4637,11 @@
if( ssl->handshake->resume != 0 )
{
#if defined(MBEDTLS_SSL_CLI_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
#endif
#if defined(MBEDTLS_SSL_SRV_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
#endif
}
@@ -4655,7 +4655,7 @@
MBEDTLS_SSL_DEBUG_MSG( 3, ( "switching to new transform spec for outbound data" ) );
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
unsigned char i;
@@ -4697,7 +4697,7 @@
#endif
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
mbedtls_ssl_send_flight_completed( ssl );
#endif
@@ -4726,7 +4726,7 @@
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse finished" ) );
- ssl->handshake->calc_finished( ssl, buf, ssl->endpoint ^ 1 );
+ ssl->handshake->calc_finished( ssl, buf, ssl->conf->endpoint ^ 1 );
if( ( ret = mbedtls_ssl_read_record( ssl ) ) != 0 )
{
@@ -4770,11 +4770,11 @@
if( ssl->handshake->resume != 0 )
{
#if defined(MBEDTLS_SSL_CLI_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
ssl->state = MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC;
#endif
#if defined(MBEDTLS_SSL_SRV_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
ssl->state = MBEDTLS_SSL_HANDSHAKE_WRAPUP;
#endif
}
@@ -4782,7 +4782,7 @@
ssl->state++;
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
mbedtls_ssl_recv_flight_completed( ssl );
#endif
@@ -4893,7 +4893,7 @@
ssl_handshake_params_init( ssl->handshake );
#if defined(MBEDTLS_X509_CRT_PARSE_C)
- ssl->handshake->key_cert = ssl->key_cert;
+ ssl->handshake->key_cert = ssl->conf->key_cert;
#endif
/*
@@ -4904,7 +4904,7 @@
ssl->handshake->alt_transform_out = ssl->transform_out;
// TODO: not the right place, we may not know endpoint yet
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_PREPARING;
else
ssl->handshake->retransmit_state = MBEDTLS_SSL_RETRANS_WAITING;
@@ -4958,28 +4958,34 @@
int ret;
int len = MBEDTLS_SSL_BUFFER_LEN;
+ ssl->conf = mbedtls_malloc( sizeof( mbedtls_ssl_config ) );
+ if( ssl->conf == NULL )
+ return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
+
+ memset( ssl->conf, 0, sizeof( mbedtls_ssl_config ) );
+
/*
* Sane defaults
*/
- ssl->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
- ssl->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_1; /* TLS 1.0 */
- ssl->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
- ssl->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
+ ssl->conf->min_major_ver = MBEDTLS_SSL_MAJOR_VERSION_3;
+ ssl->conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_1; /* TLS 1.0 */
+ ssl->conf->max_major_ver = MBEDTLS_SSL_MAX_MAJOR_VERSION;
+ ssl->conf->max_minor_ver = MBEDTLS_SSL_MAX_MINOR_VERSION;
mbedtls_ssl_set_ciphersuites( ssl, mbedtls_ssl_list_ciphersuites() );
mbedtls_ssl_set_arc4_support( ssl, MBEDTLS_SSL_ARC4_DISABLED );
#if defined(MBEDTLS_SSL_RENEGOTIATION)
- ssl->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
- memset( ssl->renego_period, 0xFF, 7 );
- ssl->renego_period[7] = 0x00;
+ ssl->conf->renego_max_records = MBEDTLS_SSL_RENEGO_MAX_RECORDS_DEFAULT;
+ memset( ssl->conf->renego_period, 0xFF, 7 );
+ ssl->conf->renego_period[7] = 0x00;
#endif
#if defined(MBEDTLS_DHM_C)
- if( ( ret = mbedtls_mpi_read_string( &ssl->dhm_P, 16,
+ if( ( ret = mbedtls_mpi_read_string( &ssl->conf->dhm_P, 16,
MBEDTLS_DHM_RFC5114_MODP_1024_P) ) != 0 ||
- ( ret = mbedtls_mpi_read_string( &ssl->dhm_G, 16,
+ ( ret = mbedtls_mpi_read_string( &ssl->conf->dhm_G, 16,
MBEDTLS_DHM_RFC5114_MODP_1024_G) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_read_string", ret );
@@ -5006,33 +5012,33 @@
(void) mbedtls_ssl_set_transport( ssl, MBEDTLS_SSL_TRANSPORT_STREAM );
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
- ssl->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
+ ssl->conf->encrypt_then_mac = MBEDTLS_SSL_ETM_ENABLED;
#endif
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
- ssl->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
+ ssl->conf->extended_ms = MBEDTLS_SSL_EXTENDED_MS_ENABLED;
#endif
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
- ssl->ticket_lifetime = MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME;
+ ssl->conf->ticket_lifetime = MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME;
#endif
#if defined(MBEDTLS_SSL_SET_CURVES)
- ssl->curve_list = mbedtls_ecp_grp_id_list( );
+ ssl->conf->curve_list = mbedtls_ecp_grp_id_list( );
#endif
#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
- ssl->f_cookie_write = ssl_cookie_write_dummy;
- ssl->f_cookie_check = ssl_cookie_check_dummy;
+ ssl->conf->f_cookie_write = ssl_cookie_write_dummy;
+ ssl->conf->f_cookie_check = ssl_cookie_check_dummy;
#endif
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
- ssl->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
+ ssl->conf->anti_replay = MBEDTLS_SSL_ANTI_REPLAY_ENABLED;
#endif
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- ssl->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
- ssl->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
+ ssl->conf->hs_timeout_min = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MIN;
+ ssl->conf->hs_timeout_max = MBEDTLS_SSL_DTLS_TIMEOUT_DFL_MAX;
#endif
if( ( ret = ssl_handshake_init( ssl ) ) != 0 )
@@ -5198,20 +5204,20 @@
*/
void mbedtls_ssl_set_endpoint( mbedtls_ssl_context *ssl, int endpoint )
{
- ssl->endpoint = endpoint;
+ ssl->conf->endpoint = endpoint;
#if defined(MBEDTLS_SSL_SESSION_TICKETS) && \
defined(MBEDTLS_SSL_CLI_C)
if( endpoint == MBEDTLS_SSL_IS_CLIENT )
{
- ssl->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
- ssl->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
+ ssl->conf->session_tickets = MBEDTLS_SSL_SESSION_TICKETS_ENABLED;
+ ssl->conf->authmode = MBEDTLS_SSL_VERIFY_REQUIRED;
}
#endif
#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
if( endpoint == MBEDTLS_SSL_IS_SERVER )
- ssl->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
+ ssl->conf->trunc_hmac = MBEDTLS_SSL_TRUNC_HMAC_ENABLED;
#endif
}
@@ -5220,7 +5226,7 @@
#if defined(MBEDTLS_SSL_PROTO_DTLS)
if( transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
- ssl->transport = transport;
+ ssl->conf->transport = transport;
ssl->out_hdr = ssl->out_buf;
ssl->out_ctr = ssl->out_buf + 3;
@@ -5235,11 +5241,11 @@
ssl->in_msg = ssl->in_buf + 13;
/* DTLS starts with TLS1.1 */
- if( ssl->min_minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
- ssl->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
+ if( ssl->conf->min_minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
+ ssl->conf->min_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
- if( ssl->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
- ssl->max_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
+ if( ssl->conf->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_2 )
+ ssl->conf->max_minor_ver = MBEDTLS_SSL_MINOR_VERSION_2;
return( 0 );
}
@@ -5247,7 +5253,7 @@
if( transport == MBEDTLS_SSL_TRANSPORT_STREAM )
{
- ssl->transport = transport;
+ ssl->conf->transport = transport;
ssl->out_ctr = ssl->out_buf;
ssl->out_hdr = ssl->out_buf + 8;
@@ -5270,28 +5276,28 @@
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
void mbedtls_ssl_set_dtls_anti_replay( mbedtls_ssl_context *ssl, char mode )
{
- ssl->anti_replay = mode;
+ ssl->conf->anti_replay = mode;
}
#endif
#if defined(MBEDTLS_SSL_DTLS_BADMAC_LIMIT)
void mbedtls_ssl_set_dtls_badmac_limit( mbedtls_ssl_context *ssl, unsigned limit )
{
- ssl->badmac_limit = limit;
+ ssl->conf->badmac_limit = limit;
}
#endif
#if defined(MBEDTLS_SSL_PROTO_DTLS)
void mbedtls_ssl_set_handshake_timeout( mbedtls_ssl_context *ssl, uint32_t min, uint32_t max )
{
- ssl->hs_timeout_min = min;
- ssl->hs_timeout_max = max;
+ ssl->conf->hs_timeout_min = min;
+ ssl->conf->hs_timeout_max = max;
}
#endif
void mbedtls_ssl_set_authmode( mbedtls_ssl_context *ssl, int authmode )
{
- ssl->authmode = authmode;
+ ssl->conf->authmode = authmode;
}
#if defined(MBEDTLS_X509_CRT_PARSE_C)
@@ -5299,8 +5305,8 @@
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, int *),
void *p_vrfy )
{
- ssl->f_vrfy = f_vrfy;
- ssl->p_vrfy = p_vrfy;
+ ssl->conf->f_vrfy = f_vrfy;
+ ssl->conf->p_vrfy = p_vrfy;
}
#endif /* MBEDTLS_X509_CRT_PARSE_C */
@@ -5316,8 +5322,8 @@
void (*f_dbg)(void *, int, const char *),
void *p_dbg )
{
- ssl->f_dbg = f_dbg;
- ssl->p_dbg = p_dbg;
+ ssl->conf->f_dbg = f_dbg;
+ ssl->conf->p_dbg = p_dbg;
}
#if ! defined(MBEDTLS_DEPRECATED_REMOVED)
@@ -5350,7 +5356,7 @@
ssl->f_send = f_send;
ssl->f_recv = f_recv;
ssl->f_recv_timeout = f_recv_timeout;
- ssl->read_timeout = timeout;
+ ssl->conf->read_timeout = timeout;
}
#if defined(MBEDTLS_SSL_SRV_C)
@@ -5358,10 +5364,10 @@
int (*f_get_cache)(void *, mbedtls_ssl_session *), void *p_get_cache,
int (*f_set_cache)(void *, const mbedtls_ssl_session *), void *p_set_cache )
{
- ssl->f_get_cache = f_get_cache;
- ssl->p_get_cache = p_get_cache;
- ssl->f_set_cache = f_set_cache;
- ssl->p_set_cache = p_set_cache;
+ ssl->conf->f_get_cache = f_get_cache;
+ ssl->conf->p_get_cache = p_get_cache;
+ ssl->conf->f_set_cache = f_set_cache;
+ ssl->conf->p_set_cache = p_set_cache;
}
#endif /* MBEDTLS_SSL_SRV_C */
@@ -5373,7 +5379,7 @@
if( ssl == NULL ||
session == NULL ||
ssl->session_negotiate == NULL ||
- ssl->endpoint != MBEDTLS_SSL_IS_CLIENT )
+ ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
{
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
@@ -5389,10 +5395,10 @@
void mbedtls_ssl_set_ciphersuites( mbedtls_ssl_context *ssl, const int *ciphersuites )
{
- ssl->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites;
- ssl->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites;
- ssl->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites;
- ssl->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites;
+ ssl->conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_0] = ciphersuites;
+ ssl->conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_1] = ciphersuites;
+ ssl->conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_2] = ciphersuites;
+ ssl->conf->ciphersuite_list[MBEDTLS_SSL_MINOR_VERSION_3] = ciphersuites;
}
void mbedtls_ssl_set_ciphersuites_for_version( mbedtls_ssl_context *ssl,
@@ -5405,7 +5411,7 @@
if( minor < MBEDTLS_SSL_MINOR_VERSION_0 || minor > MBEDTLS_SSL_MINOR_VERSION_3 )
return;
- ssl->ciphersuite_list[minor] = ciphersuites;
+ ssl->conf->ciphersuite_list[minor] = ciphersuites;
}
#if defined(MBEDTLS_X509_CRT_PARSE_C)
@@ -5421,15 +5427,15 @@
memset( key_cert, 0, sizeof( mbedtls_ssl_key_cert ) );
/* Append the new key_cert to the (possibly empty) current list */
- if( ssl->key_cert == NULL )
+ if( ssl->conf->key_cert == NULL )
{
- ssl->key_cert = key_cert;
+ ssl->conf->key_cert = key_cert;
if( ssl->handshake != NULL )
ssl->handshake->key_cert = key_cert;
}
else
{
- last = ssl->key_cert;
+ last = ssl->conf->key_cert;
while( last->next != NULL )
last = last->next;
last->next = key_cert;
@@ -5441,8 +5447,8 @@
void mbedtls_ssl_set_ca_chain( mbedtls_ssl_context *ssl, mbedtls_x509_crt *ca_chain,
mbedtls_x509_crl *ca_crl, const char *peer_cn )
{
- ssl->ca_chain = ca_chain;
- ssl->ca_crl = ca_crl;
+ ssl->conf->ca_chain = ca_chain;
+ ssl->conf->ca_crl = ca_crl;
ssl->peer_cn = peer_cn;
}
@@ -5471,25 +5477,25 @@
if( psk_len > MBEDTLS_PSK_MAX_LEN )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
- if( ssl->psk != NULL || ssl->psk_identity != NULL )
+ if( ssl->conf->psk != NULL || ssl->conf->psk_identity != NULL )
{
- mbedtls_free( ssl->psk );
- mbedtls_free( ssl->psk_identity );
+ mbedtls_free( ssl->conf->psk );
+ mbedtls_free( ssl->conf->psk_identity );
}
- if( ( ssl->psk = mbedtls_malloc( psk_len ) ) == NULL ||
- ( ssl->psk_identity = mbedtls_malloc( psk_identity_len ) ) == NULL )
+ if( ( ssl->conf->psk = mbedtls_malloc( psk_len ) ) == NULL ||
+ ( ssl->conf->psk_identity = mbedtls_malloc( psk_identity_len ) ) == NULL )
{
- mbedtls_free( ssl->psk );
- ssl->psk = NULL;
+ mbedtls_free( ssl->conf->psk );
+ ssl->conf->psk = NULL;
return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
}
- ssl->psk_len = psk_len;
- ssl->psk_identity_len = psk_identity_len;
+ ssl->conf->psk_len = psk_len;
+ ssl->conf->psk_identity_len = psk_identity_len;
- memcpy( ssl->psk, psk, ssl->psk_len );
- memcpy( ssl->psk_identity, psk_identity, ssl->psk_identity_len );
+ memcpy( ssl->conf->psk, psk, ssl->conf->psk_len );
+ memcpy( ssl->conf->psk_identity, psk_identity, ssl->conf->psk_identity_len );
return( 0 );
}
@@ -5499,8 +5505,8 @@
size_t),
void *p_psk )
{
- ssl->f_psk = f_psk;
- ssl->p_psk = p_psk;
+ ssl->conf->f_psk = f_psk;
+ ssl->conf->p_psk = p_psk;
}
#endif /* MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED */
@@ -5509,13 +5515,13 @@
{
int ret;
- if( ( ret = mbedtls_mpi_read_string( &ssl->dhm_P, 16, dhm_P ) ) != 0 )
+ if( ( ret = mbedtls_mpi_read_string( &ssl->conf->dhm_P, 16, dhm_P ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_read_string", ret );
return( ret );
}
- if( ( ret = mbedtls_mpi_read_string( &ssl->dhm_G, 16, dhm_G ) ) != 0 )
+ if( ( ret = mbedtls_mpi_read_string( &ssl->conf->dhm_G, 16, dhm_G ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_read_string", ret );
return( ret );
@@ -5528,13 +5534,13 @@
{
int ret;
- if( ( ret = mbedtls_mpi_copy( &ssl->dhm_P, &dhm_ctx->P ) ) != 0 )
+ if( ( ret = mbedtls_mpi_copy( &ssl->conf->dhm_P, &dhm_ctx->P ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
return( ret );
}
- if( ( ret = mbedtls_mpi_copy( &ssl->dhm_G, &dhm_ctx->G ) ) != 0 )
+ if( ( ret = mbedtls_mpi_copy( &ssl->conf->dhm_G, &dhm_ctx->G ) ) != 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_mpi_copy", ret );
return( ret );
@@ -5550,7 +5556,7 @@
*/
void mbedtls_ssl_set_curves( mbedtls_ssl_context *ssl, const mbedtls_ecp_group_id *curve_list )
{
- ssl->curve_list = curve_list;
+ ssl->conf->curve_list = curve_list;
}
#endif
@@ -5583,8 +5589,8 @@
const unsigned char *, size_t),
void *p_sni )
{
- ssl->f_sni = f_sni;
- ssl->p_sni = p_sni;
+ ssl->conf->f_sni = f_sni;
+ ssl->conf->p_sni = p_sni;
}
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
@@ -5608,7 +5614,7 @@
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
- ssl->alpn_list = protos;
+ ssl->conf->alpn_list = protos;
return( 0 );
}
@@ -5628,7 +5634,7 @@
}
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
minor < MBEDTLS_SSL_MINOR_VERSION_2 )
{
return( -1 );
@@ -5645,8 +5651,8 @@
if( ssl_check_version( ssl, major, minor ) != 0 )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
- ssl->max_major_ver = major;
- ssl->max_minor_ver = minor;
+ ssl->conf->max_major_ver = major;
+ ssl->conf->max_minor_ver = minor;
return( 0 );
}
@@ -5656,8 +5662,8 @@
if( ssl_check_version( ssl, major, minor ) != 0 )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
- ssl->min_major_ver = major;
- ssl->min_minor_ver = minor;
+ ssl->conf->min_major_ver = major;
+ ssl->conf->min_minor_ver = minor;
return( 0 );
}
@@ -5672,20 +5678,20 @@
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
void mbedtls_ssl_set_encrypt_then_mac( mbedtls_ssl_context *ssl, char etm )
{
- ssl->encrypt_then_mac = etm;
+ ssl->conf->encrypt_then_mac = etm;
}
#endif
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
void mbedtls_ssl_set_extended_master_secret( mbedtls_ssl_context *ssl, char ems )
{
- ssl->extended_ms = ems;
+ ssl->conf->extended_ms = ems;
}
#endif
void mbedtls_ssl_set_arc4_support( mbedtls_ssl_context *ssl, char arc4 )
{
- ssl->arc4_disabled = arc4;
+ ssl->conf->arc4_disabled = arc4;
}
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
@@ -5697,7 +5703,7 @@
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
- ssl->mfl_code = mfl_code;
+ ssl->conf->mfl_code = mfl_code;
return( 0 );
}
@@ -5706,7 +5712,7 @@
#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
int mbedtls_ssl_set_truncated_hmac( mbedtls_ssl_context *ssl, int truncate )
{
- ssl->trunc_hmac = truncate;
+ ssl->conf->trunc_hmac = truncate;
return( 0 );
}
@@ -5721,34 +5727,34 @@
void mbedtls_ssl_legacy_renegotiation( mbedtls_ssl_context *ssl, int allow_legacy )
{
- ssl->allow_legacy_renegotiation = allow_legacy;
+ ssl->conf->allow_legacy_renegotiation = allow_legacy;
}
#if defined(MBEDTLS_SSL_RENEGOTIATION)
void mbedtls_ssl_set_renegotiation( mbedtls_ssl_context *ssl, int renegotiation )
{
- ssl->disable_renegotiation = renegotiation;
+ ssl->conf->disable_renegotiation = renegotiation;
}
void mbedtls_ssl_set_renegotiation_enforced( mbedtls_ssl_context *ssl, int max_records )
{
- ssl->renego_max_records = max_records;
+ ssl->conf->renego_max_records = max_records;
}
void mbedtls_ssl_set_renegotiation_period( mbedtls_ssl_context *ssl,
const unsigned char period[8] )
{
- memcpy( ssl->renego_period, period, 8 );
+ memcpy( ssl->conf->renego_period, period, 8 );
}
#endif /* MBEDTLS_SSL_RENEGOTIATION */
#if defined(MBEDTLS_SSL_SESSION_TICKETS)
int mbedtls_ssl_set_session_tickets( mbedtls_ssl_context *ssl, int use_tickets )
{
- ssl->session_tickets = use_tickets;
+ ssl->conf->session_tickets = use_tickets;
#if defined(MBEDTLS_SSL_CLI_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
return( 0 );
#endif
@@ -5763,7 +5769,7 @@
void mbedtls_ssl_set_session_ticket_lifetime( mbedtls_ssl_context *ssl, int lifetime )
{
- ssl->ticket_lifetime = lifetime;
+ ssl->conf->ticket_lifetime = lifetime;
}
#endif /* MBEDTLS_SSL_SESSION_TICKETS */
@@ -5797,7 +5803,7 @@
const char *mbedtls_ssl_get_version( const mbedtls_ssl_context *ssl )
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
switch( ssl->minor_ver )
{
@@ -5882,7 +5888,7 @@
if( ssl == NULL ||
dst == NULL ||
ssl->session == NULL ||
- ssl->endpoint != MBEDTLS_SSL_IS_CLIENT )
+ ssl->conf->endpoint != MBEDTLS_SSL_IS_CLIENT )
{
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
}
@@ -5899,11 +5905,11 @@
int ret = MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE;
#if defined(MBEDTLS_SSL_CLI_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
ret = mbedtls_ssl_handshake_client_step( ssl );
#endif
#if defined(MBEDTLS_SSL_SRV_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
ret = mbedtls_ssl_handshake_server_step( ssl );
#endif
@@ -5980,10 +5986,10 @@
/* RFC 6347 4.2.2: "[...] the HelloRequest will have message_seq = 0 and
* the ServerHello will have message_seq = 1" */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
{
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
ssl->handshake->out_msg_seq = 1;
else
ssl->handshake->in_msg_seq = 1;
@@ -6014,7 +6020,7 @@
#if defined(MBEDTLS_SSL_SRV_C)
/* On server, just send the request */
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER )
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER )
{
if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER )
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
@@ -6065,14 +6071,14 @@
{
if( ssl->state != MBEDTLS_SSL_HANDSHAKE_OVER ||
ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING ||
- ssl->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED )
+ ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED )
{
return( 0 );
}
// TODO: adapt for DTLS
- if( memcmp( ssl->in_ctr, ssl->renego_period, 8 ) <= 0 &&
- memcmp( ssl->out_ctr, ssl->renego_period, 8 ) <= 0 )
+ if( memcmp( ssl->in_ctr, ssl->conf->renego_period, 8 ) <= 0 &&
+ memcmp( ssl->out_ctr, ssl->conf->renego_period, 8 ) <= 0 )
{
return( 0 );
}
@@ -6093,7 +6099,7 @@
MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> read" ) );
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
if( ( ret = mbedtls_ssl_flush_output( ssl ) ) != 0 )
return( ret );
@@ -6134,7 +6140,7 @@
#if defined(MBEDTLS_SSL_PROTO_DTLS)
/* Start timer if not already running */
if( ssl->time_limit == 0 )
- ssl_set_timer( ssl, ssl->read_timeout );
+ ssl_set_timer( ssl, ssl->conf->read_timeout );
#endif
if( ! record_read )
@@ -6171,7 +6177,7 @@
MBEDTLS_SSL_DEBUG_MSG( 1, ( "received handshake message" ) );
#if defined(MBEDTLS_SSL_CLI_C)
- if( ssl->endpoint == MBEDTLS_SSL_IS_CLIENT &&
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
( ssl->in_msg[0] != MBEDTLS_SSL_HS_HELLO_REQUEST ||
ssl->in_hslen != mbedtls_ssl_hs_hdr_len( ssl ) ) )
{
@@ -6179,29 +6185,29 @@
/* With DTLS, drop the packet (probably from last handshake) */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
return( MBEDTLS_ERR_NET_WANT_READ );
#endif
return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
}
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER &&
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
ssl->in_msg[0] != MBEDTLS_SSL_HS_CLIENT_HELLO )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "handshake received (not ClientHello)" ) );
/* With DTLS, drop the packet (probably from last handshake) */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
return( MBEDTLS_ERR_NET_WANT_READ );
#endif
return( MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE );
}
#endif
- if( ssl->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
+ if( ssl->conf->disable_renegotiation == MBEDTLS_SSL_RENEGOTIATION_DISABLED ||
( ssl->secure_renegotiation == MBEDTLS_SSL_LEGACY_RENEGOTIATION &&
- ssl->allow_legacy_renegotiation ==
+ ssl->conf->allow_legacy_renegotiation ==
MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION ) )
{
MBEDTLS_SSL_DEBUG_MSG( 3, ( "refusing renegotiation, sending alert" ) );
@@ -6240,8 +6246,8 @@
{
/* DTLS clients need to know renego is server-initiated */
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
- ssl->endpoint == MBEDTLS_SSL_IS_CLIENT )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
+ ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT )
{
ssl->renego_status = MBEDTLS_SSL_RENEGOTIATION_PENDING;
}
@@ -6266,9 +6272,9 @@
else if( ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
{
- if( ssl->renego_max_records >= 0 )
+ if( ssl->conf->renego_max_records >= 0 )
{
- if( ++ssl->renego_records_seen > ssl->renego_max_records )
+ if( ++ssl->renego_records_seen > ssl->conf->renego_max_records )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "renegotiation requested, "
"but not honored by client" ) );
@@ -6303,7 +6309,7 @@
* Do it now, after setting in_offt, to avoid taking this branch
* again if ssl_write_hello_request() returns WANT_WRITE */
#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_RENEGOTIATION)
- if( ssl->endpoint == MBEDTLS_SSL_IS_SERVER &&
+ if( ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER &&
ssl->renego_status == MBEDTLS_SSL_RENEGOTIATION_PENDING )
{
if( ( ret = ssl_resend_hello_request( ssl ) ) != 0 )
@@ -6350,7 +6356,7 @@
/*
* Assume mfl_code is correct since it was checked when set
*/
- max_len = mfl_code_to_length[ssl->mfl_code];
+ max_len = mfl_code_to_length[ssl->conf->mfl_code];
/*
* Check if a smaller max length was negotiated
@@ -6364,7 +6370,7 @@
if( len > max_len )
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
- if( ssl->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
+ if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
{
MBEDTLS_SSL_DEBUG_MSG( 1, ( "fragment larger than the (negotiated) "
"maximum fragment length: %d > %d",
@@ -6632,8 +6638,8 @@
#endif
#if defined(MBEDTLS_DHM_C)
- mbedtls_mpi_free( &ssl->dhm_P );
- mbedtls_mpi_free( &ssl->dhm_G );
+ mbedtls_mpi_free( &ssl->conf->dhm_P );
+ mbedtls_mpi_free( &ssl->conf->dhm_G );
#endif
if( ssl->transform )
@@ -6677,19 +6683,19 @@
#endif
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
- if( ssl->psk != NULL )
+ if( ssl->conf->psk != NULL )
{
- mbedtls_zeroize( ssl->psk, ssl->psk_len );
- mbedtls_zeroize( ssl->psk_identity, ssl->psk_identity_len );
- mbedtls_free( ssl->psk );
- mbedtls_free( ssl->psk_identity );
- ssl->psk_len = 0;
- ssl->psk_identity_len = 0;
+ mbedtls_zeroize( ssl->conf->psk, ssl->conf->psk_len );
+ mbedtls_zeroize( ssl->conf->psk_identity, ssl->conf->psk_identity_len );
+ mbedtls_free( ssl->conf->psk );
+ mbedtls_free( ssl->conf->psk_identity );
+ ssl->conf->psk_len = 0;
+ ssl->conf->psk_identity_len = 0;
}
#endif
#if defined(MBEDTLS_X509_CRT_PARSE_C)
- ssl_key_cert_free( ssl->key_cert );
+ ssl_key_cert_free( ssl->conf->key_cert );
#endif
#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL)
@@ -6786,7 +6792,7 @@
{
const mbedtls_ecp_group_id *gid;
- for( gid = ssl->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
+ for( gid = ssl->conf->curve_list; *gid != MBEDTLS_ECP_DP_NONE; gid++ )
if( *gid == grp_id )
return( 1 );
