* Remove stale putative MD2 support
This hasn't worked in a while, presumably since one of our upstream
merges. Don't bother making it work, since MD2 is generally considered
insecure.
* Land mbedtls 2.16.3-77-gf02988e57
* TLS: remove some dead code from espconn_mbedtls
There was some... frankly kind of scary buffer and data shuffling if
ESP8266_PLATFORM was defined. Since we don't, in fact, define that
preprocessor symbol, just drop the code lest anyone (possibly future-me)
be scared.
* TLS: espconn_mbedtls: run through astyle
No functional changes
* TLS: espconn_mbedtls: put the file_params on the stack
There's no need to malloc a structure that's used only locally.
* TLS: Further minor tidying of mbedtls glue
What an absolute shitshow this is. mbedtls should absolutely not
be mentioned inside sys/socket.h and app/mbedtls/app/lwIPSocket.c is not
so much glue as it as a complete copy of a random subset of lwIP; it
should go, but we aren't there yet.
Get rid of the mysterious "mbedlts_record" struct, which housed merely a
length of bytes sent solely for gating the "record sent" callback.
Remove spurious __attribute__((weak)) from symbols not otherwise
defined and rename them to emphasize that they are not actually part of
mbedtls proper.
* TLS: Rampage esp mbedtls glue and delete unused code
This at least makes the shitshow smaller
* TLS: lwip: fix some memp definitions
I presume these also need the new arguments
* TLS: Remove more non-NodeMCU code from our mbedtls
* TLS: drop support for 1.1
Depending on who you ask it's either EOL already or EOL soon, so
we may as well get rid of it now.
* Update TLS protocol support
TLS1.0 is past PCI's EOL; BEAST is no more
Enable elliptic curve key exchanges
Do not enable the smallest ECs for security
Do not enable the largest ECs for computational time
Do not enable 25519 (sad) because it doesn't go across the wire
Drop non-PFS key exchanges
Drop ARC4, Blowfish, DES, genprime, XTEA code
Drop renegotiation support completely
It takes so much heap that it's not likely to work out well
Tidy handling of SSL_BUFFER_SIZE
Update docs
Drop mention of startcom, since they are no more, for letsencrypt
* Update mbedtls to 2.7.7
Preserve our vsnprintf and platform hacks
* Introduce TLS maximum fragment size knob
Reduce buffer size to 4Ki by default and advertize that. That's the
largest we can advertize with the TLS MFL extension, so there's no
point in making them larger. The truly adventurous can re-raise
SSL_BUFFER_SIZE and undefine the SSL_MAX_FRAGMENT_LENGTH_CODE and get
back to the earlier behavior.
* Default to mbedTLS debug with DEVELOP_VERSION
* mbedtls 2.7.0 (mbedtls-2.7.0-0-g32605dc8)
Wholesale import, with a few changes from earlier preserved through.
Ideally we would soon get to the point of having no divergences from
upstream.
* tls: add function to adjust mbedTLS debug level
* mbedTLS update
* mbedtls: vsnprintf macroification
* Further update mbedTLS to 2.6.1
* mbedtls: make debugging work again
* Silence SSL messages on normal teardown
* Drop DTLS support from mbedtls
Nathaniel Wesley Filardo
Nathaniel Wesley Filardo