coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-08-04 10:48:06 +08:00
Code Issues Packages Projects Releases Wiki Activity
mbedtls/library
History
Gilles Peskine 488b91929d Require calling mbedtls_ssl_set_hostname() for security 
In a TLS client, when using certificate authentication, the client should
check that the certificate is valid for the server name that the client
expects. Otherwise, in most scenarios, a malicious server can impersonate
another server.

Normally, the application code should call mbedtls_ssl_set_hostname().
However, it's easy to forget. So raise an error if mandatory certificate
authentication is in effect and mbedtls_ssl_set_hostname() has not been
called. Raise the new error code
MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME, for easy
identification.

But don't raise the error if the backward compatibility option
MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME is
enabled.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2025-02-24 18:48:49 +01:00
..
.gitignore Move crypto modules 2024-07-10 08:07:34 +02:00
CMakeLists.txt Move back timing.c to mbedtls 2024-12-04 14:25:02 +01:00
debug_internal.h
debug.c Include ssl_misc.h for additional SSL helper files 2024-10-11 12:21:30 +01:00
Makefile Move driver wrappers generation to tf-psa-crypto 2024-12-04 14:25:02 +01:00
mps_common.h
mps_error.h
mps_reader.c Include ssl_misc.h for additional SSL helper files 2024-10-11 12:21:30 +01:00
mps_reader.h
mps_trace.c Include ssl_misc.h for additional SSL helper files 2024-10-11 12:21:30 +01:00
mps_trace.h Include ssl_misc.h for additional SSL helper files 2024-10-11 12:21:30 +01:00
net_sockets.c Make mbedTLS compile with MS-DOS DJGPP 2024-12-01 10:05:21 +01:00
pkcs7.c Remove mbedtls/build_info from pkcs7.c 2024-10-11 12:20:13 +01:00
ssl_cache.c Update includes for each library file 2024-10-09 11:18:50 +01:00
ssl_ciphersuites_internal.h ssl_ciphersuites: remove references to DHE-RSA key exchanges 2025-02-06 10:05:58 +01:00
ssl_ciphersuites.c ssl_ciphersuites: remove references to DHE-RSA key exchanges 2025-02-06 10:05:58 +01:00
ssl_client.c Remove internal helper mbedtls_ssl_get_groups() 2025-01-14 12:23:56 +01:00
ssl_client.h Update includes for each library file 2024-10-09 11:18:50 +01:00
ssl_cookie.c Rm dead !USE_PSA code: SSL hooks 2025-01-28 16:14:43 +01:00
ssl_debug_helpers.h Update includes for each library file 2024-10-09 11:18:50 +01:00
ssl_misc.h Keep track of whether mbedtls_ssl_set_hostname() has been called 2025-02-24 18:47:44 +01:00
ssl_msg.c Rm dead !USE_PSA code: ssl_msg.c 2025-01-28 16:18:02 +01:00
ssl_ticket.c Move ssl_ticket to the PSA API 2025-01-30 08:22:40 +00:00
ssl_tls12_client.c ssl_tls: remove code related to DHE-RSA 2025-02-06 10:05:58 +01:00
ssl_tls12_server.c ssl_ciphersuites: remove references to DHE-RSA key exchanges 2025-02-06 10:05:58 +01:00
ssl_tls13_client.c Remove internal helper mbedtls_ssl_get_groups() 2025-01-14 12:23:56 +01:00
ssl_tls13_generic.c Update includes for each library file 2024-10-09 11:18:50 +01:00
ssl_tls13_invasive.h Update includes for each library file 2024-10-09 11:18:50 +01:00
ssl_tls13_keys.c Rm dead !USE_PSA code: ssl_tls13*.c part 2 2025-01-28 16:15:40 +01:00
ssl_tls13_keys.h
ssl_tls13_server.c Rm dead !USE_PSA code: ssl_tls13_xxx (part 1) 2025-01-28 16:15:29 +01:00
ssl_tls.c Require calling mbedtls_ssl_set_hostname() for security 2025-02-24 18:48:49 +01:00
timing.c Move back timing.c to mbedtls 2024-12-04 14:25:02 +01:00
version.c Include ssl_misc.h for additional SSL helper files 2024-10-11 12:21:30 +01:00
x509_create.c Update includes for each library file 2024-10-09 11:18:50 +01:00
x509_crl.c Update includes for each library file 2024-10-09 11:18:50 +01:00
x509_crt.c Rm dead !USE_PSA code: X.509 2025-01-28 16:14:38 +01:00
x509_csr.c Update includes for each library file 2024-10-09 11:18:50 +01:00
x509_internal.h Switch to actual TF-PSA-Crypto build_info.h 2024-12-11 22:32:45 +01:00
x509.c Update includes for each library file 2024-10-09 11:18:50 +01:00
x509write_crt.c Rm dead !USE_PSA code: X.509 2025-01-28 16:14:38 +01:00
x509write_csr.c Rm dead !USE_PSA code: X.509 2025-01-28 16:14:38 +01:00
x509write.c Rm dead !USE_PSA code: X.509 2025-01-28 16:14:38 +01:00