coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

tls13_fetch_handshake_msg(): Remove require_record_boundary parameter

Browse Source 
Deduce it from the handshake message type

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
This commit is contained in:
Ronald Cron 2026-06-16 18:41:56 +02:00
parent e08cea612f
commit 74b9ab2008
5 changed files with 31 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
library/ssl_misc.h
View File

@ -2028,7 +2028,6 @@ static inline int mbedtls_ssl_tls13_key_exchange_mode_with_ephemeral(
MBEDTLS_CHECK_RETURN_CRITICAL
int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
unsigned hs_type,
unsigned require_record_boundary,
unsigned char **buf,
size_t *buf_len);

8
library/ssl_tls13_client.c
View File

@ -2002,7 +2002,7 @@ static int ssl_tls13_process_server_hello(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> %s", __func__));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_SERVER_HELLO, 1, &buf, &buf_len));
ssl, MBEDTLS_SSL_HS_SERVER_HELLO, &buf, &buf_len));
ret = ssl_tls13_preprocess_server_hello(ssl, buf, buf + buf_len);
if (ret < 0) {
@ -2195,7 +2195,7 @@ static int ssl_tls13_process_encrypted_extensions(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse encrypted extensions"));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS, 0,
ssl, MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS,
&buf, &buf_len));
/* Process the message contents */
@ -2530,7 +2530,7 @@ static int ssl_tls13_process_certificate_request(mbedtls_ssl_context *ssl)
size_t buf_len;
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST, 0,
ssl, MBEDTLS_SSL_HS_CERTIFICATE_REQUEST,
&buf, &buf_len));
MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_certificate_request(
@ -3025,7 +3025,7 @@ static int ssl_tls13_process_new_session_ticket(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse new session ticket"));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET, 0,
ssl, MBEDTLS_SSL_HS_NEW_SESSION_TICKET,
&buf, &buf_len));
/*

29
library/ssl_tls13_generic.c
View File

@ -47,11 +47,30 @@ const uint8_t mbedtls_ssl_tls13_hello_retry_request_magic[
int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
unsigned hs_type,
unsigned require_record_boundary,
unsigned char **buf,
size_t *buf_len)
{
int ret;
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
int require_record_boundary;
/* Require record-boundary alignment by default. The exceptions below are
* handshake messages that may legitimately be followed by additional
* handshake messages in the same record. Using the default behaviour for a
* message that should be exempt is an interoperability bug; exempting a
* message that should not be exempt may have security implications.
*/
switch (hs_type) {
case MBEDTLS_SSL_HS_NEW_SESSION_TICKET:
case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
case MBEDTLS_SSL_HS_CERTIFICATE:
case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST:
case MBEDTLS_SSL_HS_CERTIFICATE_VERIFY:
require_record_boundary = 0;
break;
default:
require_record_boundary = 1;
}
ret = mbedtls_ssl_read_record(ssl, 0);
if (ret != 0) {
@ -349,7 +368,7 @@ int mbedtls_ssl_tls13_process_certificate_verify(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_PROC_CHK(
mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, 0, &buf, &buf_len));
ssl, MBEDTLS_SSL_HS_CERTIFICATE_VERIFY, &buf, &buf_len));
/* Need to calculate the hash of the transcript first
* before reading the message since otherwise it gets
@ -701,7 +720,7 @@ int mbedtls_ssl_tls13_process_certificate(mbedtls_ssl_context *ssl)
size_t buf_len;
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_CERTIFICATE, 0,
ssl, MBEDTLS_SSL_HS_CERTIFICATE,
&buf, &buf_len));
/* Parse the certificate chain sent by the peer. */
@ -1120,7 +1139,7 @@ int mbedtls_ssl_tls13_process_finished_message(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse finished message"));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_FINISHED, 1, &buf, &buf_len));
ssl, MBEDTLS_SSL_HS_FINISHED, &buf, &buf_len));
/* Preprocessing step: Compute handshake digest */
MBEDTLS_SSL_PROC_CHK(ssl_tls13_preprocess_finished_message(ssl));

4
library/ssl_tls13_server.c
View File

@ -1936,7 +1936,7 @@ static int ssl_tls13_process_client_hello(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(2, ("=> parse client hello"));
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_CLIENT_HELLO, 1,
ssl, MBEDTLS_SSL_HS_CLIENT_HELLO,
&buf, &buflen));
MBEDTLS_SSL_PROC_CHK_NEG(ssl_tls13_parse_client_hello(ssl, buf,
@ -3027,7 +3027,7 @@ static int ssl_tls13_process_end_of_early_data(mbedtls_ssl_context *ssl)
size_t buf_len;
MBEDTLS_SSL_PROC_CHK(mbedtls_ssl_tls13_fetch_handshake_msg(
ssl, MBEDTLS_SSL_HS_END_OF_EARLY_DATA, 1,
ssl, MBEDTLS_SSL_HS_END_OF_EARLY_DATA,
&buf, &buf_len));
MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_end_of_early_data(

2
tests/suites/test_suite_ssl.function
View File

@ -4169,7 +4169,7 @@ void tls13_server_certificate_msg_invalid_vector_len()
ret = mbedtls_ssl_tls13_fetch_handshake_msg(&(client_ep.ssl),
MBEDTLS_SSL_HS_CERTIFICATE,
0, &buf, &buf_len);
&buf, &buf_len);
TEST_EQUAL(ret, 0);
end = buf + buf_len;