Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Turn MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE configuration option into a runtime option #4398

Closed
ronald-cron-arm opened this issue Apr 22, 2021 · 0 comments · Fixed by #4606
Assignees
Labels
component-tls enhancement good-first-issue Good for newcomers size-s Estimated task size: small (~2d)

Comments

@ronald-cron-arm
Copy link
Contributor

ronald-cron-arm commented Apr 22, 2021

Context

The configuration option MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE allows during TLS handshake to select the ciphersuite according to the client's preferences rather than the server's preferences.


Rationale

The capability provided by the option seems to be useful and used (see #4244 for example) but the code size reduction is marginal thus the decision to turn it to a runtime option.


Work items for 3.0

  • Remove MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE from config.h and all references to it in the code base.
  • Add a "respect client preference" SSL runtime option in mbedtls_ssl_config and the API to enable/disable it (something like void mbedtls_ssl_conf_respect_client_preference( mbedtls_ssl_config *conf, int enable ) it seems.
  • Adapt the code that is guarded by MBEDTLS_SSL_SRV_RESPECT_CLIENT_PREFERENCE.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component-tls enhancement good-first-issue Good for newcomers size-s Estimated task size: small (~2d)
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants