tree 4af36ad763b29d64a7adbfaacb06313f5c60b736
parent e1dcb0355743aab27b3e538ebf9eda53f4f9ef61
author Hanno Becker <hanno.becker@arm.com> 1534337778 +0100
committer Hanno Becker <hanno.becker@arm.com> 1534521128 +0100

Add parameter to ssl_read_record() controlling checksum update

Previously, mbedtls_ssl_read_record() always updated the handshake
checksum in case a handshake record was received. While desirable
most of the time, for the CertificateVerify message the checksum
update must only happen after the message has been fully processed,
because the validation requires the handshake digest up to but
excluding the CertificateVerify itself. As a remedy, the bulk
of mbedtls_ssl_read_record() was previously duplicated within
ssl_parse_certificate_verify(), hardening maintenance in case
mbedtls_ssl_read_record() is subject to changes.

This commit adds a boolean parameter to mbedtls_ssl_read_record()
indicating whether the checksum should be updated in case of a
handshake message or not. This allows using it also for
ssl_parse_certificate_verify(), manually updating the checksum
after the message has been processed.