Turn _SSL_SRV_RESPECT_CLIENT_PREFERENCE config option to a runtime option
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
diff --git a/ChangeLog.d/issue4398.txt b/ChangeLog.d/issue4398.txt
new file mode 100644
index 0000000..67acbf5
--- /dev/null
+++ b/ChangeLog.d/issue4398.txt
@@ -0,0 +1,9 @@
+API changes
+ * Remove the MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE option from config.h.
+ Replace it with SSL runtime option which can be enabled or disabled using
+ new added API function mbedtls_ssl_conf_respect_client_preference(). Add
+ a new field respect_cli_pref in the mbedtls_ssl_config structure and two
+ defines used as a parameter: MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_DISABLED
+ and MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_ENABLED. Adapt the code used for
+ searching for a matching ciphersuite to use the new field instead of the
+ removed config.h option. Fixes #3498.
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 3139b22..c1106a6 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -1472,16 +1472,6 @@
#define MBEDTLS_SSL_RENEGOTIATION
/**
- * \def MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
- *
- * Pick the ciphersuite according to the client's preferences rather than ours
- * in the SSL Server module (MBEDTLS_SSL_SRV_C).
- *
- * Uncomment this macro to respect client's ciphersuite order
- */
-//#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE
-
-/**
* \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
*
* Enable support for RFC 6066 max_fragment_length extension in SSL.
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index c293b88..364239a 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -200,6 +200,9 @@
#define MBEDTLS_SSL_DTLS_SRTP_MKI_UNSUPPORTED 0
#define MBEDTLS_SSL_DTLS_SRTP_MKI_SUPPORTED 1
+#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_ENABLED 1
+#define MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_DISABLED 0
+
/*
* Default range for DTLS retransmission timer value, in milliseconds.
* RFC 6347 4.2.4.1 says from 1 second to 60 seconds.
@@ -1185,6 +1188,9 @@
#if defined(MBEDTLS_SSL_SRV_C)
unsigned int cert_req_ca_list : 1; /*!< enable sending CA list in
Certificate Request messages? */
+ unsigned int respect_cli_pref : 1; /*!< pick the ciphersuite according to
+ the client's preferences rather
+ than ours */
#endif
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
unsigned int ignore_unexpected_cid : 1; /*!< Determines whether DTLS
@@ -2494,7 +2500,7 @@
*
* Note: The server uses its own preferences
* over the preference of the client unless
- * MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE is defined!
+ * conf->respect_cli_pref is enabled!
*
* \param conf SSL configuration
* \param ciphersuites 0-terminated list of allowed ciphersuites
@@ -3292,6 +3298,19 @@
int mbedtls_ssl_conf_max_frag_len( mbedtls_ssl_config *conf, unsigned char mfl_code );
#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */
+#if defined(MBEDTLS_SSL_SRV_C)
+/**
+ * \brief Pick the ciphersuite according to the client's preferences
+ * rather than ours in the SSL Server module (MBEDTLS_SSL_SRV_C).
+ * (Default: MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_DISABLED)
+ *
+ * \param conf SSL configuration
+ * \param enable Enable or disable (MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_ENABLED
+ * or MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_DISABLED)
+ */
+void mbedtls_ssl_conf_respect_client_preference( mbedtls_ssl_config *conf, int enable );
+#endif /* MBEDTLS_SSL_SRV_C */
+
#if defined(MBEDTLS_SSL_TRUNCATED_HMAC)
/**
* \brief Activate negotiation of truncated HMAC
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 4fe6b02..c7ec4fe 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -1872,27 +1872,43 @@
got_common_suite = 0;
ciphersuites = ssl->conf->ciphersuite_list;
ciphersuite_info = NULL;
-#if defined(MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
- for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
- for( i = 0; ciphersuites[i] != 0; i++ )
-#else
- for( i = 0; ciphersuites[i] != 0; i++ )
+
+ if (ssl->conf->respect_cli_pref == MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_ENABLED)
+ {
for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
-#endif
- {
- if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
- p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
- continue;
+ for( i = 0; ciphersuites[i] != 0; i++ )
+ {
+ if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
+ p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
+ continue;
- got_common_suite = 1;
+ got_common_suite = 1;
- if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
- &ciphersuite_info ) ) != 0 )
- return( ret );
+ if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
+ &ciphersuite_info ) ) != 0 )
+ return( ret );
- if( ciphersuite_info != NULL )
- goto have_ciphersuite;
- }
+ if( ciphersuite_info != NULL )
+ goto have_ciphersuite;
+ }
+ } else {
+ for( i = 0; ciphersuites[i] != 0; i++ )
+ for( j = 0, p = buf + ciph_offset + 2; j < ciph_len; j += 2, p += 2 )
+ {
+ if( p[0] != ( ( ciphersuites[i] >> 8 ) & 0xFF ) ||
+ p[1] != ( ( ciphersuites[i] ) & 0xFF ) )
+ continue;
+
+ got_common_suite = 1;
+
+ if( ( ret = ssl_ciphersuite_match( ssl, ciphersuites[i],
+ &ciphersuite_info ) ) != 0 )
+ return( ret );
+
+ if( ciphersuite_info != NULL )
+ goto have_ciphersuite;
+ }
+ }
if( got_common_suite )
{
@@ -4416,4 +4432,10 @@
return( ret );
}
+
+void mbedtls_ssl_conf_respect_client_preference( mbedtls_ssl_config *conf, int enable )
+{
+ conf->respect_cli_pref = enable;
+}
+
#endif /* MBEDTLS_SSL_SRV_C */
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 3bdc1cf..ab11391 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -6189,6 +6189,7 @@
#if defined(MBEDTLS_SSL_SRV_C)
conf->cert_req_ca_list = MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED;
+ conf->respect_cli_pref = MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREF_DISABLED;
#endif
#if defined(MBEDTLS_SSL_PROTO_DTLS)