commit 60bfe60d0f1dedb0cc0ea3bc4a64719a16b1f31e
author Glenn Strauss <gstrauss@gluelogic.com> Mon Mar 14 19:04:24 2022 -0400
committer Glenn Strauss <gstrauss@gluelogic.com> Thu Apr 14 15:40:12 2022 -0400
tree 74d712ccb611752e9e5cf28de2497f8b7389fe8e
parent 2dfcea2b9dd58ffd68fac4d024c52d2968779d6e

mbedtls_ssl_ciphersuite_t min_tls_version,max_tls_version

Store the TLS version in tls_version instead of major, minor version num

Note: existing application use which accesses the struct member
(using MBEDTLS_PRIVATE) is not compatible, as the struct is now smaller.

Reduce size of mbedtls_ssl_ciphersuite_t

members are defined using integral types instead of enums in
order to pack structure and reduce memory usage by internal
ciphersuite_definitions[]

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>

library/ssl_msg.c

diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index c79fcfa..0112951 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -2675,14 +2675,14 @@
 #endif
         /* Skip writing the record content type to after the encryption,
          * as it may change when using the CID extension. */
-        int minor_ver = ssl->minor_ver;
+        mbedtls_ssl_protocol_version tls_ver = ssl->tls_version;
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
         /* TLS 1.3 still uses the TLS 1.2 version identifier
          * for backwards compatibility. */
-        if( minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
-            minor_ver = MBEDTLS_SSL_MINOR_VERSION_3;
+        if( tls_ver == MBEDTLS_SSL_VERSION_TLS1_3 )
+            tls_ver = MBEDTLS_SSL_VERSION_TLS1_2;
 #endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
-        mbedtls_ssl_write_version( ssl->major_ver, minor_ver,
+        mbedtls_ssl_write_version( tls_ver >> 8, tls_ver & 0xFF,
                                    ssl->conf->transport, ssl->out_hdr + 1 );
 
         memcpy( ssl->out_ctr, ssl->cur_out_ctr, MBEDTLS_SSL_SEQUENCE_NUMBER_LEN );
@@ -2698,7 +2698,7 @@
             rec.data_offset = ssl->out_msg - rec.buf;
 
             memcpy( &rec.ctr[0], ssl->out_ctr, sizeof( rec.ctr ) );
-            mbedtls_ssl_write_version( ssl->major_ver, minor_ver,
+            mbedtls_ssl_write_version( tls_ver >> 8, tls_ver & 0xFF,
                                        ssl->conf->transport, rec.ver );
             rec.type = ssl->out_msgtype;
 
@@ -3535,15 +3535,9 @@
                               ssl->conf->transport,
                               &rec->ver[0] );
 
-    if( major_ver != ssl->major_ver )
+    if( ( ( major_ver << 8 ) | minor_ver ) > ssl->conf->max_tls_version )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-    }
-
-    if( minor_ver > ( ssl->conf->max_tls_version & 0xFF ) )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "TLS version mismatch" ) );
         return( MBEDTLS_ERR_SSL_INVALID_RECORD );
     }
 
@@ -3749,7 +3743,7 @@
         if( rec->data_len == 0 )
         {
 #if defined(MBEDTLS_SSL_PROTO_TLS1_2)
-            if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_3
+            if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_2
                 && rec->type != MBEDTLS_SSL_MSG_APPLICATION_DATA )
             {
                 /* TLS v1.2 explicitly disallows zero-length messages which are not application data */
@@ -4752,7 +4746,7 @@
 #endif
 
 #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
-        if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_4 )
+        if( ssl->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 )
         {
 #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
             MBEDTLS_SSL_DEBUG_MSG( 1,