commit e117a8fc0dcdd9c2528856876748cfa8b06e4fd7
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Fri Jan 09 12:39:35 2015 +0100
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Fri Jan 09 12:52:20 2015 +0100
tree 01c4874b0edb46056886b882c511f256a0943d2b
parent 8e4b3374d744d83c7a881408a602e5abb85f6464

Make truncated hmac a runtime option server-side

Reading the documentation of ssl_set_truncated_hmac() may give the impression
I changed the default for clients but I didn't, the old documentation was
wrong.

library/ssl_srv.c

diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 6d8626c..534525a 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -629,7 +629,8 @@
 
     ((void) buf);
 
-    ssl->session_negotiate->trunc_hmac = SSL_TRUNC_HMAC_ENABLED;
+    if( ssl->trunc_hmac == SSL_TRUNC_HMAC_ENABLED )
+        ssl->session_negotiate->trunc_hmac = SSL_TRUNC_HMAC_ENABLED;
 
     return( 0 );
 }

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index ea34f66..eda3d6d 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -3782,6 +3782,11 @@
     if( endpoint == SSL_IS_CLIENT )
         ssl->session_tickets = SSL_SESSION_TICKETS_ENABLED;
 #endif
+
+#if defined(POLARSSL_SSL_TRUNCATED_HMAC)
+    if( endpoint == SSL_IS_SERVER )
+        ssl->trunc_hmac = SSL_TRUNC_HMAC_ENABLED;
+#endif
 }
 
 void ssl_set_authmode( ssl_context *ssl, int authmode )
@@ -4203,9 +4208,6 @@
 #if defined(POLARSSL_SSL_TRUNCATED_HMAC)
 int ssl_set_truncated_hmac( ssl_context *ssl, int truncate )
 {
-    if( ssl->endpoint != SSL_IS_CLIENT )
-        return( POLARSSL_ERR_SSL_BAD_INPUT_DATA );
-
     ssl->trunc_hmac = truncate;
 
     return( 0 );