TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-05-11 06:28:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/pr/590' into baremetal

Browse Source
This commit is contained in:
Simon Butcher
2019-06-17 17:57:26 +01:00
parent 01a8eb21d3 2e51098b34
commit c725e4b34e
8 changed files with 187 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
include/mbedtls/ssl.h
View File

@@ -158,6 +158,9 @@
#define MBEDTLS_SSL_EXTENDED_MS_DISABLED 0
#define MBEDTLS_SSL_EXTENDED_MS_ENABLED 1
#define MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED 0
#define MBEDTLS_SSL_EXTENDED_MS_ENFORCE_ENABLED 1
#define MBEDTLS_SSL_CID_DISABLED 0
#define MBEDTLS_SSL_CID_ENABLED 1
@@ -1031,6 +1034,9 @@ struct mbedtls_ssl_config
#endif
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
unsigned int extended_ms : 1; /*!< negotiate extended master secret? */
unsigned int enforce_extended_master_secret : 1; /*!< enforce the usage
* of extended master
* secret */
#endif
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
unsigned int anti_replay : 1; /*!< detect and prevent replay? */
@@ -2821,6 +2827,26 @@ void mbedtls_ssl_conf_encrypt_then_mac( mbedtls_ssl_config *conf, char etm );
* \param ems MBEDTLS_SSL_EXTENDED_MS_ENABLED or MBEDTLS_SSL_EXTENDED_MS_DISABLED
*/
void mbedtls_ssl_conf_extended_master_secret( mbedtls_ssl_config *conf, char ems );
/**
* \brief Enable or disable Extended Master Secret enforcing.
* (Default: MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED)
*
* \note If the use of extended master secret is configured (see
* `mbedtls_ssl_conf_extended_master_secret()`) and this
* option is set, handshakes not leading to the use of the
* extended master secret will be aborted: On the server, fail
* the handshake if the client doesn't advertise the
* ExtendedMasterSecret extension. On the client: Fail the
* handshake if the server doesn't consent to the use of the
* ExtendedMasterSecret extension in its ServerHello.
*
* \param conf Currently used SSL configuration struct.
* \param ems_enf MBEDTLS_SSL_EXTENDED_MS_ENFORCE_ENABLED or
* MBEDTLS_SSL_EXTENDED_MS_ENFORCE_DISABLED
*/
void mbedtls_ssl_conf_extended_master_secret_enforce( mbedtls_ssl_config *conf,
char ems_enf );
#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */
#if defined(MBEDTLS_ARC4_C)