Allow compile-time configuration of DTLS anti replay
Introduce MBEDTLS_SSL_CONF_ANTI_REPLAY to allow configuring
the use/nonuse of DTLS anti replay protection at compile-time.
Impact on code-size, measured with
> ./scripts/baremetal.sh --rom --gcc --armc5 --armc6
| | GCC | ARMC5 | ARMC6 |
| --- | --- | --- | --- |
| `libmbedtls.a` before | 23559 | 24089 | 27921 |
| `libmbedtls.a` after | 23511 | 24049 | 27903 |
| gain in Bytes | 48 | 40 | 18 |
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 7bcba24..6d71120 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -544,6 +544,11 @@
"MBEDTLS_SSL_CONF_EXTENDED_MASTER_SECRET"
check_cmdline_param_compat "enforce_extended_master_secret" \
"MBEDTLS_SSL_CONF_ENFORCE_EXTENDED_MASTER_SECRET"
+
+ # DTLS anti replay protection configuration
+ check_cmdline_param_compat "anti_replay" \
+ "MBEDTLS_SSL_CONF_ANTI_REPLAY"
+
}
# Usage: run_test name [-p proxy_cmd] srv_cmd cli_cmd cli_exit [option [...]]
@@ -7669,7 +7674,7 @@
not_with_valgrind # spurious resend due to timeout
run_test "DTLS proxy: duplicate every packet" \
-p "$P_PXY duplicate=1" \
- "$P_SRV dtls=1 dgram_packing=0 debug_level=2" \
+ "$P_SRV dtls=1 dgram_packing=0 debug_level=2 anti_replay=1" \
"$P_CLI dtls=1 dgram_packing=0 debug_level=2" \
0 \
-c "replayed record" \