Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-29 05:27:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

tls13_fetch_handshake_msg(): Remove require_record_boundary parameter

Browse Source 
Deduce it from the handshake message type

Signed-off-by: Ronald Cron <[email protected]>
This commit is contained in:
Ronald Cron
2026-06-24 15:51:33 +02:00
parent e08cea612f
commit 74b9ab2008
5 changed files with 31 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/ssl_misc.h
-1
View File
@@ -2028,7 +2028,6 @@ static inline int mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(
MBEDTLS_CHECK_RETURN_CRITICAL MBEDTLS_CHECK_RETURN_CRITICAL
int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl, int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
unsigned hs_type, unsigned hs_type,
unsigned require_record_boundary,
unsigned char **buf, unsigned char **buf,
size_t *buf_len); size_t *buf_len);
library/ssl_tls13_client.c
+4 -4
View File
@@ -2002,7 +2002,7 @@ static int ssl_tls13_process_server_hello(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> %s", __func__)); MBEDTLS_SSL_DEBUG_MSG(2, ("=> %s", __func__));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_SERVER_HELLO, 1, &buf, &buf_len)); ssl, MBEDTLS_SSL_HS_SERVER_HELLO, &buf, &buf_len));
ret = ssl_tls13_preprocess_server_hello(ssl, buf, buf + buf_len); ret = ssl_tls13_preprocess_server_hello(ssl, buf, buf + buf_len);
if (ret < 0) { if (ret < 0) {
@@ -2195,7 +2195,7 @@ static int ssl_tls13_process_encrypted_extensions(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse encrypted extensions")); MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse encrypted extensions"));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, 0, ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
&buf, &buf_len)); &buf, &buf_len));
/* Process the message contents */ /* Process the message contents */
@@ -2530,7 +2530,7 @@ static int ssl_tls13_process_certificate_request(mbedtls_ssl_context *ssl)
size_t buf_len; size_t buf_len;
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, 0, ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
&buf, &buf_len)); &buf, &buf_len));
MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_certificate_request( MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_certificate_request(
@@ -3025,7 +3025,7 @@ static int ssl_tls13_process_new_session_ticket(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse new session ticket")); MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse new session ticket"));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET, 0, ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
&buf, &buf_len)); &buf, &buf_len));
/* /*
library/ssl_tls13_generic.c
+24 -5
View File
@@ -47,11 +47,30 @@ const uint8_t mbedtls_ssl_tls13_hello_retry_request_magic[
int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl, int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
unsigned hs_type, unsigned hs_type,
unsigned require_record_boundary,
unsigned char **buf, unsigned char **buf,
size_t *buf_len) size_t *buf_len)
{ {
int ret; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
int require_record_boundary;
/* Require record-boundary alignment by default. The exceptions below are
* handshake messages that may legitimately be followed by additional
* handshake messages in the same record. Using the default behaviour for a
* message that should be exempt is an interoperability bug; exempting a
* message that should not be exempt may have security implications.
*/
switch (hs_type) {
case MBEDTLS_SSL_HS_NEW_SESSION_TICKET:
case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
case MBEDTLS_SSL_HS_CERTIFICATE:
case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST:
case MBEDTLS_SSL_HS_CERTIFICATE_VERIFY:
require_record_boundary = 0;
break;
default:
require_record_boundary = 1;
}
ret = mbedtls_ssl_read_record(ssl, 0); ret = mbedtls_ssl_read_record(ssl, 0);
if (ret != 0) { if (ret != 0) {
@@ -349,7 +368,7 @@ int mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_PROC_CHK( MBEDTLS_SSL_PROC_CHK(
mbedtls_ssl_tls13_fetch_handshake_msg( mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, 0, &buf, &buf_len)); ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, &buf, &buf_len));
/* Need to calculate the hash of the transcript first /* Need to calculate the hash of the transcript first
* before reading the message since otherwise it gets * before reading the message since otherwise it gets
@@ -701,7 +720,7 @@ int mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context *ssl)
size_t buf_len; size_t buf_len;
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_CERTIFICATE, 0, ssl, MBEDTLS_SSL_HS_CERTIFICATE,
&buf, &buf_len)); &buf, &buf_len));
/* Parse the certificate chain sent by the peer. */ /* Parse the certificate chain sent by the peer. */
@@ -1120,7 +1139,7 @@ int mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished message")); MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished message"));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_FINISHED, 1, &buf, &buf_len)); ssl, MBEDTLS_SSL_HS_FINISHED, &buf, &buf_len));
/* Preprocessing step: Compute handshake digest */ /* Preprocessing step: Compute handshake digest */
MBEDTLS_SSL_PROC_CHK(ssl_tls13_preprocess_finished_message(ssl)); MBEDTLS_SSL_PROC_CHK(ssl_tls13_preprocess_finished_message(ssl));
library/ssl_tls13_server.c
+2 -2
View File
@@ -1936,7 +1936,7 @@ static int ssl_tls13_process_client_hello(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello")); MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello"));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, 1, ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
&buf, &buflen)); &buf, &buflen));
MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_parse_client_hello(ssl, buf, MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_parse_client_hello(ssl, buf,
@@ -3027,7 +3027,7 @@ static int ssl_tls13_process_end_of_early_data(mbedtls_ssl_context *ssl)
size_t buf_len; size_t buf_len;
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg( MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_END_OF_EARLY_DATA, 1, ssl, MBEDTLS_SSL_HS_END_OF_EARLY_DATA,
&buf, &buf_len)); &buf, &buf_len));
MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_end_of_early_data( MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_end_of_early_data(
tests/suites/test_suite_ssl.function
+1 -1
View File
@@ -4169,7 +4169,7 @@ void tls13_server_certificate_msg_invalid_vector_len()
ret = mbedtls_ssl_tls13_fetch_handshake_msg(&(client_ep.ssl), ret = mbedtls_ssl_tls13_fetch_handshake_msg(&(client_ep.ssl),
MBEDTLS_SSL_HS_CERTIFICATE, MBEDTLS_SSL_HS_CERTIFICATE,
0, &buf, &buf_len); &buf, &buf_len);
TEST_EQUAL(ret, 0); TEST_EQUAL(ret, 0);
end = buf + buf_len; end = buf + buf_len;