327c93b182
Previously, mbedtls_ssl_read_record() always updated the handshake checksum in case a handshake record was received. While desirable most of the time, for the CertificateVerify message the checksum update must only happen after the message has been fully processed, because the validation requires the handshake digest up to but excluding the CertificateVerify itself. As a remedy, the bulk of mbedtls_ssl_read_record() was previously duplicated within ssl_parse_certificate_verify(), hardening maintenance in case mbedtls_ssl_read_record() is subject to changes. This commit adds a boolean parameter to mbedtls_ssl_read_record() indicating whether the checksum should be updated in case of a handshake message or not. This allows using it also for ssl_parse_certificate_verify(), manually updating the checksum after the message has been processed. |
||
|---|---|---|
| .. | ||
| mbedtls | ||
| .gitignore | ||
| CMakeLists.txt | ||