@ -163,19 +163,51 @@
*
*
* Enable the memory allocation layer .
* Enable the memory allocation layer .
*
*
* By default m bed TLS uses the system - provided calloc ( ) and free ( ) .
* By default M bed TLS uses the system - provided calloc ( ) and free ( ) .
* This allows different allocators ( self - implemented or provided ) to be
* This allows different allocators ( self - implemented or provided ) to be
* provided to the platform abstraction layer .
* provided to the platform abstraction layer .
*
*
* Enabling MBEDTLS_PLATFORM_MEMORY without the
* Enabling # MBEDTLS_PLATFORM_MEMORY without the
* MBEDTLS_PLATFORM_ { FREE , CALLOC } _MACROs will provide
* MBEDTLS_PLATFORM_ { FREE , CALLOC } _MACROs will provide
* " mbedtls_platform_set_calloc_free() " allowing you to set an alternative calloc ( ) and
* " mbedtls_platform_set_calloc_free() " allowing you to set an alternative calloc ( ) and
* free ( ) function pointer at runtime .
* free ( ) function pointer at runtime .
*
*
* Enabling MBEDTLS_PLATFORM_MEMORY and specifying
* Enabling # MBEDTLS_PLATFORM_MEMORY and specifying
* MBEDTLS_PLATFORM_ { CALLOC , FREE } _MACROs will allow you to specify the
* MBEDTLS_PLATFORM_ { CALLOC , FREE } _MACROs will allow you to specify the
* alternate function at compile time .
* alternate function at compile time .
*
*
* An overview of how the value of mbedtls_calloc is determined :
*
* - if ! MBEDTLS_PLATFORM_MEMORY
* - mbedtls_calloc = calloc
* - if MBEDTLS_PLATFORM_MEMORY
* - if ( MBEDTLS_PLATFORM_CALLOC_MACRO & & MBEDTLS_PLATFORM_FREE_MACRO ) :
* - mbedtls_calloc = MBEDTLS_PLATFORM_CALLOC_MACRO
* - if ! ( MBEDTLS_PLATFORM_CALLOC_MACRO & & MBEDTLS_PLATFORM_FREE_MACRO ) :
* - Dynamic setup via mbedtls_platform_set_calloc_free is now possible with a default value MBEDTLS_PLATFORM_STD_CALLOC .
* - How is MBEDTLS_PLATFORM_STD_CALLOC handled ?
* - if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS :
* - MBEDTLS_PLATFORM_STD_CALLOC is not set to anything ;
* - MBEDTLS_PLATFORM_STD_MEM_HDR can be included if present ;
* - if ! MBEDTLS_PLATFORM_NO_STD_FUNCTIONS :
* - if MBEDTLS_PLATFORM_STD_CALLOC is present :
* - User - defined MBEDTLS_PLATFORM_STD_CALLOC is respected ;
* - if ! MBEDTLS_PLATFORM_STD_CALLOC :
* - MBEDTLS_PLATFORM_STD_CALLOC = calloc
*
* - At this point the presence of MBEDTLS_PLATFORM_STD_CALLOC is checked .
* - if ! MBEDTLS_PLATFORM_STD_CALLOC
* - MBEDTLS_PLATFORM_STD_CALLOC = uninitialized_calloc
*
* - mbedtls_calloc = MBEDTLS_PLATFORM_STD_CALLOC .
*
* Defining MBEDTLS_PLATFORM_CALLOC_MACRO and # MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible .
* MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time .
* # MBEDTLS_PLATFORM_STD_CALLOC and # MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time , as , if they are used ,
* dynamic setup of these functions is possible . See the tree above to see how are they handled in all cases .
* An uninitialized # MBEDTLS_PLATFORM_STD_CALLOC always fails , returning a null pointer .
* An uninitialized # MBEDTLS_PLATFORM_STD_FREE does not do anything .
*
* Requires : MBEDTLS_PLATFORM_C
* Requires : MBEDTLS_PLATFORM_C
*
*
* Enable this layer to allow use of alternative memory allocators .
* Enable this layer to allow use of alternative memory allocators .
@ -204,10 +236,10 @@
/**
/**
* \ def MBEDTLS_PLATFORM_EXIT_ALT
* \ def MBEDTLS_PLATFORM_EXIT_ALT
*
*
* MBEDTLS_PLATFORM_XXX_ALT : Uncomment a macro to let m bed TLS support the
* MBEDTLS_PLATFORM_XXX_ALT : Uncomment a macro to let M bed TLS support the
* function in the platform abstraction layer .
* function in the platform abstraction layer .
*
*
* Example : In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT , m bed TLS will
* Example : In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT , M bed TLS will
* provide a function " mbedtls_platform_set_printf() " that allows you to set an
* provide a function " mbedtls_platform_set_printf() " that allows you to set an
* alternative printf function pointer .
* alternative printf function pointer .
*
*
@ -233,6 +265,45 @@
//#define MBEDTLS_PLATFORM_NV_SEED_ALT
//#define MBEDTLS_PLATFORM_NV_SEED_ALT
//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
/**
* Uncomment the macro to let Mbed TLS use your alternate implementation of
* mbedtls_platform_gmtime_r ( ) . This replaces the default implementation in
* platform_util . c .
*
* gmtime ( ) is not a thread - safe function as defined in the C standard . The
* library will try to use safer implementations of this function , such as
* gmtime_r ( ) when available . However , if Mbed TLS cannot identify the target
* system , the implementation of mbedtls_platform_gmtime_r ( ) will default to
* using the standard gmtime ( ) . In this case , calls from the library to
* gmtime ( ) will be guarded by the global mutex mbedtls_threading_gmtime_mutex
* if MBEDTLS_THREADING_C is enabled . We recommend that calls from outside the
* library are also guarded with this mutex to avoid race conditions . However ,
* if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined , Mbed TLS will
* unconditionally use the implementation for mbedtls_platform_gmtime_r ( )
* supplied at compile time .
*/
//#define MBEDTLS_PLATFORM_GMTIME_R_ALT
/**
* Uncomment the macro to let Mbed TLS use your alternate implementation of
* mbedtls_platform_zeroize ( ) . This replaces the default implementation in
* platform_util . c .
*
* mbedtls_platform_zeroize ( ) is a widely used function across the library to
* zero a block of memory . The implementation is expected to be secure in the
* sense that it has been written to prevent the compiler from removing calls
* to mbedtls_platform_zeroize ( ) as part of redundant code elimination
* optimizations . However , it is difficult to guarantee that calls to
* mbedtls_platform_zeroize ( ) will not be optimized by the compiler as older
* versions of the C language standards do not provide a secure implementation
* of memset ( ) . Therefore , MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to
* configure their own implementation of mbedtls_platform_zeroize ( ) , for
* example by using directives specific to their compiler , features from newer
* C standards ( e . g using memset_s ( ) in C11 ) or calling a secure memset ( ) from
* their system ( e . g explicit_bzero ( ) in BSD ) .
*/
//#define MBEDTLS_PLATFORM_ZEROIZE_ALT
/**
/**
* \ def MBEDTLS_DEPRECATED_WARNING
* \ def MBEDTLS_DEPRECATED_WARNING
*
*
@ -329,7 +400,7 @@
/** \} name SECTION: System support */ /** \} name SECTION: System support */
/**
/**
* \ name SECTION : m bed TLS feature support
* \ name SECTION : M bed TLS feature support
*
*
* This section sets support for features that are or are not needed
* This section sets support for features that are or are not needed
* within the modules that are enabled .
* within the modules that are enabled .
@ -352,7 +423,7 @@
/**
/**
* \ def MBEDTLS_AES_ALT
* \ def MBEDTLS_AES_ALT
*
*
* MBEDTLS__MODULE_NAME__ALT : Uncomment a macro to let m bed TLS use your
* MBEDTLS__MODULE_NAME__ALT : Uncomment a macro to let M bed TLS use your
* alternate core implementation of a symmetric crypto , an arithmetic or hash
* alternate core implementation of a symmetric crypto , an arithmetic or hash
* module ( e . g . platform specific assembly optimized implementations ) . Keep
* module ( e . g . platform specific assembly optimized implementations ) . Keep
* in mind that the function prototypes should remain the same .
* in mind that the function prototypes should remain the same .
@ -360,7 +431,7 @@
* This replaces the whole module . If you only want to replace one of the
* This replaces the whole module . If you only want to replace one of the
* functions , use one of the MBEDTLS__FUNCTION_NAME__ALT flags .
* functions , use one of the MBEDTLS__FUNCTION_NAME__ALT flags .
*
*
* Example : In case you uncomment MBEDTLS_AES_ALT , m bed TLS will no longer
* Example : In case you uncomment MBEDTLS_AES_ALT , M bed TLS will no longer
* provide the " struct mbedtls_aes_context " definition and omit the base
* provide the " struct mbedtls_aes_context " definition and omit the base
* function declarations and implementations . " aes_alt.h " will be included from
* function declarations and implementations . " aes_alt.h " will be included from
* " aes.h " to include the new function definitions .
* " aes.h " to include the new function definitions .
@ -413,14 +484,14 @@
/**
/**
* \ def MBEDTLS_MD2_PROCESS_ALT
* \ def MBEDTLS_MD2_PROCESS_ALT
*
*
* MBEDTLS__FUNCTION_NAME__ALT : Uncomment a macro to let m bed TLS use you
* MBEDTLS__FUNCTION_NAME__ALT : Uncomment a macro to let M bed TLS use you
* alternate core implementation of symmetric crypto or hash function . Keep in
* alternate core implementation of symmetric crypto or hash function . Keep in
* mind that function prototypes should remain the same .
* mind that function prototypes should remain the same .
*
*
* This replaces only one function . The header file from m bed TLS is still
* This replaces only one function . The header file from M bed TLS is still
* used , in contrast to the MBEDTLS__MODULE_NAME__ALT flags .
* used , in contrast to the MBEDTLS__MODULE_NAME__ALT flags .
*
*
* Example : In case you uncomment MBEDTLS_SHA256_PROCESS_ALT , m bed TLS will
* Example : In case you uncomment MBEDTLS_SHA256_PROCESS_ALT , M bed TLS will
* no longer provide the mbedtls_sha1_process ( ) function , but it will still provide
* no longer provide the mbedtls_sha1_process ( ) function , but it will still provide
* the other function ( using your mbedtls_sha1_process ( ) function ) and the definition
* the other function ( using your mbedtls_sha1_process ( ) function ) and the definition
* of mbedtls_sha1_context , so your implementation of mbedtls_sha1_process must be compatible
* of mbedtls_sha1_context , so your implementation of mbedtls_sha1_process must be compatible
@ -480,11 +551,11 @@
*
*
* Expose a part of the internal interface of the Elliptic Curve Point module .
* Expose a part of the internal interface of the Elliptic Curve Point module .
*
*
* MBEDTLS_ECP__FUNCTION_NAME__ALT : Uncomment a macro to let m bed TLS use your
* MBEDTLS_ECP__FUNCTION_NAME__ALT : Uncomment a macro to let M bed TLS use your
* alternative core implementation of elliptic curve arithmetic . Keep in mind
* alternative core implementation of elliptic curve arithmetic . Keep in mind
* that function prototypes should remain the same .
* that function prototypes should remain the same .
*
*
* This partially replaces one function . The header file from m bed TLS is still
* This partially replaces one function . The header file from M bed TLS is still
* used , in contrast to the MBEDTLS_ECP_ALT flag . The original implementation
* used , in contrast to the MBEDTLS_ECP_ALT flag . The original implementation
* is still present and it is used for group structures not supported by the
* is still present and it is used for group structures not supported by the
* alternative .
* alternative .
@ -508,11 +579,11 @@
* implement optimized set up and tear down instructions .
* implement optimized set up and tear down instructions .
*
*
* Example : In case you set MBEDTLS_ECP_INTERNAL_ALT and
* Example : In case you set MBEDTLS_ECP_INTERNAL_ALT and
* MBEDTLS_ECP_DOUBLE_JAC_ALT , m bed TLS will still provide the ecp_double_jac ( )
* MBEDTLS_ECP_DOUBLE_JAC_ALT , M bed TLS will still provide the ecp_double_jac ( )
* function , but will use your mbedtls_internal_ecp_double_jac ( ) if the group
* function , but will use your mbedtls_internal_ecp_double_jac ( ) if the group
* for the operation is supported by your implementation ( i . e . your
* for the operation is supported by your implementation ( i . e . your
* mbedtls_internal_ecp_grp_capable ( ) function returns 1 for this group ) . If the
* mbedtls_internal_ecp_grp_capable ( ) function returns 1 for this group ) . If the
* group is not supported by your implementation , then the original m bed TLS
* group is not supported by your implementation , then the original M bed TLS
* implementation of ecp_double_jac ( ) is used instead , unless this fallback
* implementation of ecp_double_jac ( ) is used instead , unless this fallback
* behaviour is disabled by setting MBEDTLS_ECP_NO_FALLBACK ( in which case
* behaviour is disabled by setting MBEDTLS_ECP_NO_FALLBACK ( in which case
* ecp_double_jac ( ) will return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ) .
* ecp_double_jac ( ) will return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE ) .
@ -543,7 +614,7 @@
/**
/**
* \ def MBEDTLS_TEST_NULL_ENTROPY
* \ def MBEDTLS_TEST_NULL_ENTROPY
*
*
* Enables testing and use of m bed TLS without any configured entropy sources .
* Enables testing and use of M bed TLS without any configured entropy sources .
* This permits use of the library on platforms before an entropy source has
* This permits use of the library on platforms before an entropy source has
* been integrated ( see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the
* been integrated ( see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the
* MBEDTLS_ENTROPY_NV_SEED switches ) .
* MBEDTLS_ENTROPY_NV_SEED switches ) .
@ -560,7 +631,7 @@
/**
/**
* \ def MBEDTLS_ENTROPY_HARDWARE_ALT
* \ def MBEDTLS_ENTROPY_HARDWARE_ALT
*
*
* Uncomment this macro to let m bed TLS use your own implementation of a
* Uncomment this macro to let M bed TLS use your own implementation of a
* hardware entropy collector .
* hardware entropy collector .
*
*
* Your function must be called \ c mbedtls_hardware_poll ( ) , have the same
* Your function must be called \ c mbedtls_hardware_poll ( ) , have the same
@ -786,6 +857,15 @@
*/
*/
# define MBEDTLS_REMOVE_3DES_CIPHERSUITES # define MBEDTLS_REMOVE_3DES_CIPHERSUITES
/**
* Enable the verified implementations of ECDH primitives from Project Everest
* ( currently only Curve25519 ) . This feature changes the layout of ECDH
* contexts and therefore is a compatibility break for applications that access
* fields of a mbedtls_ecdh_context structure directly . See also
* MBEDTLS_ECDH_LEGACY_CONTEXT in include / mbedtls / ecdh . h .
*/
//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
/**
/**
* \ def MBEDTLS_ECP_DP_SECP192R1_ENABLED
* \ def MBEDTLS_ECP_DP_SECP192R1_ENABLED
*
*
@ -1559,7 +1639,7 @@
* \ def MBEDTLS_SSL_ALL_ALERT_MESSAGES
* \ def MBEDTLS_SSL_ALL_ALERT_MESSAGES
*
*
* Enable sending of alert messages in case of encountered errors as per RFC .
* Enable sending of alert messages in case of encountered errors as per RFC .
* If you choose not to send the alert messages , m bed TLS can still communicate
* If you choose not to send the alert messages , M bed TLS can still communicate
* with other servers , only debugging of failures is harder .
* with other servers , only debugging of failures is harder .
*
*
* The advantage of not sending alert messages , is that no information is given
* The advantage of not sending alert messages , is that no information is given
@ -2085,6 +2165,23 @@
*/
*/
//#define MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
//#define MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
/**
* Allow SHA - 1 in the default TLS configuration for TLS 1.2 handshake
* signature and ciphersuite selection . Without this build - time option , SHA - 1
* support must be activated explicitly through mbedtls_ssl_conf_sig_hashes .
* The use of SHA - 1 in TLS < = 1.1 and in HMAC - SHA - 1 is always allowed by
* default . At the time of writing , there is no practical attack on the use
* of SHA - 1 in handshake signatures , hence this option is turned on by default
* to preserve compatibility with existing peers , but the general
* warning applies nonetheless :
*
* \ warning SHA - 1 is considered a weak message digest and its use constitutes
* a security risk . If possible , we recommend avoiding dependencies
* on it , and considering stronger message digests instead .
*
*/
//#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE
/**
/**
* \ def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN
* \ def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN
*
*
@ -2332,12 +2429,12 @@
* Uncomment to enable use of ZLIB
* Uncomment to enable use of ZLIB
*/
*/
//#define MBEDTLS_ZLIB_SUPPORT
//#define MBEDTLS_ZLIB_SUPPORT
/** \} name SECTION: m bed TLS feature support *//** \} name SECTION: M bed TLS feature support */
/**
/**
* \ name SECTION : m bed TLS modules
* \ name SECTION : M bed TLS modules
*
*
* This section enables or disables entire modules in m bed TLS
* This section enables or disables entire modules in M bed TLS
* \ {
* \ {
*/
*/
@ -3058,7 +3155,7 @@
* Module : library / memory_buffer_alloc . c
* Module : library / memory_buffer_alloc . c
*
*
* Requires : MBEDTLS_PLATFORM_C
* Requires : MBEDTLS_PLATFORM_C
* MBEDTLS_PLATFORM_MEMORY ( to use it within m bed TLS )
* MBEDTLS_PLATFORM_MEMORY ( to use it within M bed TLS )
*
*
* Enable this module to enable the buffer memory allocator .
* Enable this module to enable the buffer memory allocator .
*/
*/
@ -3498,7 +3595,7 @@
* \ def MBEDTLS_THREADING_C
* \ def MBEDTLS_THREADING_C
*
*
* Enable the threading abstraction layer .
* Enable the threading abstraction layer .
* By default m bed TLS assumes it is used in a non - threaded environment or that
* By default M bed TLS assumes it is used in a non - threaded environment or that
* contexts are not shared between threads . If you do intend to use contexts
* contexts are not shared between threads . If you do intend to use contexts
* between threads , you will need to enable this layer to prevent race
* between threads , you will need to enable this layer to prevent race
* conditions . See also our Knowledge Base article about threading :
* conditions . See also our Knowledge Base article about threading :
@ -3512,7 +3609,7 @@
* You will have to enable either MBEDTLS_THREADING_ALT or
* You will have to enable either MBEDTLS_THREADING_ALT or
* MBEDTLS_THREADING_PTHREAD .
* MBEDTLS_THREADING_PTHREAD .
*
*
* Enable this layer to allow use of mutexes within m bed TLS
* Enable this layer to allow use of mutexes within M bed TLS
*/
*/
//#define MBEDTLS_THREADING_C
//#define MBEDTLS_THREADING_C
@ -3664,7 +3761,7 @@
*/
*/
# define MBEDTLS_XTEA_C # define MBEDTLS_XTEA_C
/** \} name SECTION: m bed TLS modules *//** \} name SECTION: M bed TLS modules */
/**
/**
* \ name SECTION : General configuration options
* \ name SECTION : General configuration options
@ -3798,8 +3895,29 @@
/* Platform options */ /* Platform options */
//#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
//#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */
//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */
/** \def MBEDTLS_PLATFORM_STD_CALLOC
*
* Default allocator to use , can be undefined .
* It must initialize the allocated buffer memory to zeroes .
* The size of the buffer is the product of the two parameters .
* The calloc function returns either a null pointer or a pointer to the allocated space .
* If the product is 0 , the function may either return NULL or a valid pointer to an array of size 0 which is a valid input to the deallocation function .
* An uninitialized # MBEDTLS_PLATFORM_STD_CALLOC always fails , returning a null pointer .
* See the description of # MBEDTLS_PLATFORM_MEMORY for more details .
* The corresponding deallocation function is # MBEDTLS_PLATFORM_STD_FREE .
*/
//#define MBEDTLS_PLATFORM_STD_CALLOC calloc
/** \def MBEDTLS_PLATFORM_STD_FREE
*
* Default free to use , can be undefined .
* NULL is a valid parameter , and the function must do nothing .
* A non - null parameter will always be a pointer previously returned by # MBEDTLS_PLATFORM_STD_CALLOC and not yet freed .
* An uninitialized # MBEDTLS_PLATFORM_STD_FREE does not do anything .
* See the description of # MBEDTLS_PLATFORM_MEMORY for more details ( same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply ) .
*/
//#define MBEDTLS_PLATFORM_STD_FREE free
//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */
//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */
//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */
//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */
@ -3812,10 +3930,10 @@
//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */
//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */
/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled *//* To use the following function macros, MBEDTLS_PLATFORM_C must be enabled. */
/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ /* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */
//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */
//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined . See MBEDTLS_PLATFORM_STD_CALLOC for requirements. */
//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */
//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined . See MBEDTLS_PLATFORM_STD_FREE for requirements. */
//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */
//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */
//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
@ -4088,71 +4206,6 @@
//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */
//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */
//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */
//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */
/**
* Allow SHA - 1 in the default TLS configuration for TLS 1.2 handshake
* signature and ciphersuite selection . Without this build - time option , SHA - 1
* support must be activated explicitly through mbedtls_ssl_conf_sig_hashes .
* The use of SHA - 1 in TLS < = 1.1 and in HMAC - SHA - 1 is always allowed by
* default . At the time of writing , there is no practical attack on the use
* of SHA - 1 in handshake signatures , hence this option is turned on by default
* to preserve compatibility with existing peers , but the general
* warning applies nonetheless :
*
* \ warning SHA - 1 is considered a weak message digest and its use constitutes
* a security risk . If possible , we recommend avoiding dependencies
* on it , and considering stronger message digests instead .
*
*/
//#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE
/**
* Uncomment the macro to let mbed TLS use your alternate implementation of
* mbedtls_platform_zeroize ( ) . This replaces the default implementation in
* platform_util . c .
*
* mbedtls_platform_zeroize ( ) is a widely used function across the library to
* zero a block of memory . The implementation is expected to be secure in the
* sense that it has been written to prevent the compiler from removing calls
* to mbedtls_platform_zeroize ( ) as part of redundant code elimination
* optimizations . However , it is difficult to guarantee that calls to
* mbedtls_platform_zeroize ( ) will not be optimized by the compiler as older
* versions of the C language standards do not provide a secure implementation
* of memset ( ) . Therefore , MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to
* configure their own implementation of mbedtls_platform_zeroize ( ) , for
* example by using directives specific to their compiler , features from newer
* C standards ( e . g using memset_s ( ) in C11 ) or calling a secure memset ( ) from
* their system ( e . g explicit_bzero ( ) in BSD ) .
*/
//#define MBEDTLS_PLATFORM_ZEROIZE_ALT
/**
* Uncomment the macro to let Mbed TLS use your alternate implementation of
* mbedtls_platform_gmtime_r ( ) . This replaces the default implementation in
* platform_util . c .
*
* gmtime ( ) is not a thread - safe function as defined in the C standard . The
* library will try to use safer implementations of this function , such as
* gmtime_r ( ) when available . However , if Mbed TLS cannot identify the target
* system , the implementation of mbedtls_platform_gmtime_r ( ) will default to
* using the standard gmtime ( ) . In this case , calls from the library to
* gmtime ( ) will be guarded by the global mutex mbedtls_threading_gmtime_mutex
* if MBEDTLS_THREADING_C is enabled . We recommend that calls from outside the
* library are also guarded with this mutex to avoid race conditions . However ,
* if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined , Mbed TLS will
* unconditionally use the implementation for mbedtls_platform_gmtime_r ( )
* supplied at compile time .
*/
//#define MBEDTLS_PLATFORM_GMTIME_R_ALT
/**
* Enable the verified implementations of ECDH primitives from Project Everest
* ( currently only Curve25519 ) . This feature changes the layout of ECDH
* contexts and therefore is a compatibility break for applications that access
* fields of a mbedtls_ecdh_context structure directly . See also
* MBEDTLS_ECDH_LEGACY_CONTEXT in include / mbedtls / ecdh . h .
*/
//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
/** \} name SECTION: Module configuration options */ /** \} name SECTION: Module configuration options */
/* Target and application specific configurations
/* Target and application specific configurations
Fabio Alessandrelli
Rémi Verschelde