[ros-diffs] [akhaldi] 70765: [MBEDTLS] Sync to v2.2.1. By Ismael Ferreras Morezuelas. CORE-10817

Author: akhaldi
Date: Sun Feb 21 10:56:57 2016
New Revision: 70765

URL: http://svn.reactos.org/svn/reactos?rev=70765&view=rev
Log:
[MBEDTLS] Sync to v2.2.1. By Ismael Ferreras Morezuelas. CORE-10817

Modified:
    trunk/reactos/dll/3rdparty/mbedtls/asn1write.c
    trunk/reactos/dll/3rdparty/mbedtls/bignum.c
    trunk/reactos/dll/3rdparty/mbedtls/error.c
    trunk/reactos/dll/3rdparty/mbedtls/gcm.c
    trunk/reactos/dll/3rdparty/mbedtls/rsa.c
    trunk/reactos/dll/3rdparty/mbedtls/ssl_cli.c
    trunk/reactos/dll/3rdparty/mbedtls/ssl_srv.c
    trunk/reactos/dll/3rdparty/mbedtls/ssl_tls.c
    trunk/reactos/dll/3rdparty/mbedtls/x509_crt.c
    trunk/reactos/include/reactos/libs/mbedtls/bignum.h
    trunk/reactos/include/reactos/libs/mbedtls/compat-1.3.h
    trunk/reactos/include/reactos/libs/mbedtls/config.h
    trunk/reactos/include/reactos/libs/mbedtls/ecjpake.h
    trunk/reactos/include/reactos/libs/mbedtls/error.h
    trunk/reactos/include/reactos/libs/mbedtls/md.h
    trunk/reactos/include/reactos/libs/mbedtls/md2.h
    trunk/reactos/include/reactos/libs/mbedtls/md4.h
    trunk/reactos/include/reactos/libs/mbedtls/md5.h
    trunk/reactos/include/reactos/libs/mbedtls/ripemd160.h
    trunk/reactos/include/reactos/libs/mbedtls/sha1.h
    trunk/reactos/include/reactos/libs/mbedtls/sha256.h
    trunk/reactos/include/reactos/libs/mbedtls/sha512.h
    trunk/reactos/include/reactos/libs/mbedtls/ssl.h
    trunk/reactos/include/reactos/libs/mbedtls/version.h
    trunk/reactos/include/reactos/libs/mbedtls/x509_crl.h
    trunk/reactos/include/reactos/libs/mbedtls/x509_crt.h
    trunk/reactos/include/reactos/libs/mbedtls/x509_csr.h
    trunk/reactos/media/doc/3rd Party Files.txt

Modified: trunk/reactos/dll/3rdparty/mbedtls/asn1write.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/asn1w…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/asn1write.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/asn1write.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -339,19 +339,18 @@
     }
     else if( cur->val.len < val_len )
     {
-        // Enlarge existing value buffer if needed
-        //
+        /*
+         * Enlarge existing value buffer if needed
+         * Preserve old data until the allocation succeeded, to leave list in
+         * a consistent state in case allocation fails.
+         */
+        void *p = mbedtls_calloc( 1, val_len );
+        if( p == NULL )
+            return( NULL );
+
         mbedtls_free( cur->val.p );
-        cur->val.p = NULL;
-
+        cur->val.p = p;
         cur->val.len = val_len;
-        cur->val.p = mbedtls_calloc( 1, val_len );
-        if( cur->val.p == NULL )
-        {
-            mbedtls_free( cur->oid.p );
-            mbedtls_free( cur );
-            return( NULL );
-        }
     }
 
     if( val != NULL )

Modified: trunk/reactos/dll/3rdparty/mbedtls/bignum.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/bignu…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/bignum.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/bignum.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -18,12 +18,21 @@
  *
  *  This file is part of mbed TLS (https://tls.mbed.org)
  */
-/*
- *  This MPI implementation is based on:
+
+/*
+ *  The following sources were referenced in the design of this Multi-precision
+ *  Integer library:
  *
- *  http://www.cacr.math.uwaterloo.ca/hac/about/chap14.pdf
- *  http://www.stillhq.com/extracted/gnupg-api/mpi/
- *  http://math.libtomcrypt.com/files/tommath.pdf
+ *  [1] Handbook of Applied Cryptography - 1997
+ *      Menezes, van Oorschot and Vanstone
+ *
+ *  [2] Multi-Precision Math
+ *      Tom St Denis
+ *      https://github.com/libtom/libtommath/blob/develop/tommath.pdf
+ *
+ *  [3] GNU Multi-Precision Arithmetic Library
+ *      https://gmplib.org/manual/index.html
+ *
  */
 
 #if !defined(MBEDTLS_CONFIG_FILE)
@@ -348,6 +357,24 @@
 }
 
 /*
+ * Count leading zero bits in a given integer
+ */
+static size_t mbedtls_clz( const mbedtls_mpi_uint x )
+{
+    size_t j;
+    mbedtls_mpi_uint mask = (mbedtls_mpi_uint) 1 << (biL - 1);
+
+    for( j = 0; j < biL; j++ )
+    {
+        if( x & mask ) break;
+
+        mask >>= 1;
+    }
+
+    return j;
+}
+
+/*
  * Return the number of bits
  */
 size_t mbedtls_mpi_bitlen( const mbedtls_mpi *X )
@@ -361,9 +388,7 @@
         if( X->p[i] != 0 )
             break;
 
-    for( j = biL; j > 0; j-- )
-        if( ( ( X->p[i] >> ( j - 1 ) ) & 1 ) != 0 )
-            break;
+    j = biL - mbedtls_clz( X->p[i] );
 
     return( ( i * biL ) + j );
 }
@@ -1187,6 +1212,102 @@
 }
 
 /*
+ * Unsigned integer divide - double mbedtls_mpi_uint dividend, u1/u0, and
+ * mbedtls_mpi_uint divisor, d
+ */
+static mbedtls_mpi_uint mbedtls_int_div_int( mbedtls_mpi_uint u1,
+            mbedtls_mpi_uint u0, mbedtls_mpi_uint d, mbedtls_mpi_uint *r )
+{
+#if defined(MBEDTLS_HAVE_UDBL)
+    mbedtls_t_udbl dividend, quotient;
+#else
+    const mbedtls_mpi_uint radix = (mbedtls_mpi_uint) 1 << biH;
+    const mbedtls_mpi_uint uint_halfword_mask = ( (mbedtls_mpi_uint) 1 << biH ) -
1;
+    mbedtls_mpi_uint d0, d1, q0, q1, rAX, r0, quotient;
+    mbedtls_mpi_uint u0_msw, u0_lsw;
+    size_t s;
+#endif
+
+    /*
+     * Check for overflow
+     */
+    if( 0 == d || u1 >= d )
+    {
+        if (r != NULL) *r = ~0;
+
+        return ( ~0 );
+    }
+
+#if defined(MBEDTLS_HAVE_UDBL)
+    dividend  = (mbedtls_t_udbl) u1 << biL;
+    dividend |= (mbedtls_t_udbl) u0;
+    quotient = dividend / d;
+    if( quotient > ( (mbedtls_t_udbl) 1 << biL ) - 1 )
+        quotient = ( (mbedtls_t_udbl) 1 << biL ) - 1;
+
+    if( r != NULL )
+        *r = (mbedtls_mpi_uint)( dividend - (quotient * d ) );
+
+    return (mbedtls_mpi_uint) quotient;
+#else
+
+    /*
+     * Algorithm D, Section 4.3.1 - The Art of Computer Programming
+     *   Vol. 2 - Seminumerical Algorithms, Knuth
+     */
+
+    /*
+     * Normalize the divisor, d, and dividend, u0, u1
+     */
+    s = mbedtls_clz( d );
+    d = d << s;
+
+    u1 = u1 << s;
+    u1 |= ( u0 >> ( biL - s ) ) & ( -(mbedtls_mpi_sint)s >> ( biL - 1 )
);
+    u0 =  u0 << s;
+
+    d1 = d >> biH;
+    d0 = d & uint_halfword_mask;
+
+    u0_msw = u0 >> biH;
+    u0_lsw = u0 & uint_halfword_mask;
+
+    /*
+     * Find the first quotient and remainder
+     */
+    q1 = u1 / d1;
+    r0 = u1 - d1 * q1;
+
+    while( q1 >= radix || ( q1 * d0 > radix * r0 + u0_msw ) )
+    {
+        q1 -= 1;
+        r0 += d1;
+
+        if ( r0 >= radix ) break;
+    }
+
+    rAX = ( u1 * radix ) + ( u0_msw - q1 * d );
+    q0 = rAX / d1;
+    r0 = rAX - q0 * d1;
+
+    while( q0 >= radix || ( q0 * d0 > radix * r0 + u0_lsw ) )
+    {
+        q0 -= 1;
+        r0 += d1;
+
+        if ( r0 >= radix ) break;
+    }
+
+    if (r != NULL)
+        *r = ( rAX * radix + u0_lsw - q0 * d ) >> s;
+
+    quotient = q1 * radix + q0;
+
+    return quotient;
+#endif
+}
+
+/*
  * Division by mbedtls_mpi: A = Q * B + R  (HAC 14.20)
  */
 int mbedtls_mpi_div_mpi( mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A, const
mbedtls_mpi *B )
@@ -1243,57 +1364,8 @@
             Z.p[i - t - 1] = ~0;
         else
         {
-#if defined(MBEDTLS_HAVE_UDBL)
-            mbedtls_t_udbl r;
-
-            r  = (mbedtls_t_udbl) X.p[i] << biL;
-            r |= (mbedtls_t_udbl) X.p[i - 1];
-            r /= Y.p[t];
-            if( r > ( (mbedtls_t_udbl) 1 << biL ) - 1 )
-                r = ( (mbedtls_t_udbl) 1 << biL ) - 1;
-
-            Z.p[i - t - 1] = (mbedtls_mpi_uint) r;
-#else
-            /*
-             * __udiv_qrnnd_c, from gmp/longlong.h
-             */
-            mbedtls_mpi_uint q0, q1, r0, r1;
-            mbedtls_mpi_uint d0, d1, d, m;
-
-            d  = Y.p[t];
-            d0 = ( d << biH ) >> biH;
-            d1 = ( d >> biH );
-
-            q1 = X.p[i] / d1;
-            r1 = X.p[i] - d1 * q1;
-            r1 <<= biH;
-            r1 |= ( X.p[i - 1] >> biH );
-
-            m = q1 * d0;
-            if( r1 < m )
-            {
-                q1--, r1 += d;
-                while( r1 >= d && r1 < m )
-                    q1--, r1 += d;
-            }
-            r1 -= m;
-
-            q0 = r1 / d1;
-            r0 = r1 - d1 * q0;
-            r0 <<= biH;
-            r0 |= ( X.p[i - 1] << biH ) >> biH;
-
-            m = q0 * d0;
-            if( r0 < m )
-            {
-                q0--, r0 += d;
-                while( r0 >= d && r0 < m )
-                    q0--, r0 += d;
-            }
-            r0 -= m;
-
-            Z.p[i - t - 1] = ( q1 << biH ) | q0;
-#endif /* MBEDTLS_HAVE_UDBL && !64-bit Apple with Clang 5.0 */
+            Z.p[i - t - 1] = mbedtls_int_div_int( X.p[i], X.p[i - 1],
+                                                            Y.p[t], NULL);
         }
 
         Z.p[i - t - 1]++;

Modified: trunk/reactos/dll/3rdparty/mbedtls/error.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/error…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/error.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/error.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -430,6 +430,8 @@
             mbedtls_snprintf( buf, buflen, "SSL - The operation timed out" );
         if( use_ret == -(MBEDTLS_ERR_SSL_CLIENT_RECONNECT) )
             mbedtls_snprintf( buf, buflen, "SSL - The client initiated a reconnect
from the same port" );
+        if( use_ret == -(MBEDTLS_ERR_SSL_UNEXPECTED_RECORD) )
+            mbedtls_snprintf( buf, buflen, "SSL - Record header looks valid but is
not expected" );
 #endif /* MBEDTLS_SSL_TLS_C */
 
 #if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C)

Modified: trunk/reactos/dll/3rdparty/mbedtls/gcm.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/gcm.c…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/gcm.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/gcm.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -362,7 +362,7 @@
     /* Total length is restricted to 2^39 - 256 bits, ie 2^36 - 2^5 bytes
      * Also check for possible overflow */
     if( ctx->len + length < ctx->len ||
-        (uint64_t) ctx->len + length > 0x03FFFFE0ull )
+        (uint64_t) ctx->len + length > 0xFFFFFFFE0ull )
     {
         return( MBEDTLS_ERR_GCM_BAD_INPUT );
     }

Modified: trunk/reactos/dll/3rdparty/mbedtls/rsa.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/rsa.c…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/rsa.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/rsa.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -1086,9 +1086,15 @@
      * temporary buffer and check it before returning it.
      */
     sig_try = mbedtls_calloc( 1, ctx->len );
+    if( sig_try == NULL )
+        return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+
     verif   = mbedtls_calloc( 1, ctx->len );
-    if( sig_try == NULL || verif == NULL )
+    if( verif == NULL )
+    {
+        mbedtls_free( sig_try );
         return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
+    }
 
     MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
     MBEDTLS_MPI_CHK( mbedtls_rsa_public( ctx, sig_try, verif ) );

Modified: trunk/reactos/dll/3rdparty/mbedtls/ssl_cli.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/ssl_c…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/ssl_cli.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/ssl_cli.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -2096,7 +2096,7 @@
      */
     if( ( *md_alg = mbedtls_ssl_md_alg_from_hash( (*p)[0] ) ) == MBEDTLS_MD_NONE )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 2, ( "Server used unsupported "
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "Server used unsupported "
                             "HashAlgorithm %d", *(p)[0] ) );
         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
     }
@@ -2106,7 +2106,7 @@
      */
     if( ( *pk_alg = mbedtls_ssl_pk_alg_from_sig( (*p)[1] ) ) == MBEDTLS_PK_NONE )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 2, ( "server used unsupported "
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used unsupported "
                             "SignatureAlgorithm %d", (*p)[1] ) );
         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
     }
@@ -2116,7 +2116,7 @@
      */
     if( mbedtls_ssl_check_sig_hash( ssl, *md_alg ) != 0 )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 2, ( "server used HashAlgorithm "
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "server used HashAlgorithm "
                                     "that was not offered" ) );
         return( MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE );
     }

Modified: trunk/reactos/dll/3rdparty/mbedtls/ssl_srv.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/ssl_s…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/ssl_srv.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/ssl_srv.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -2584,7 +2584,9 @@
     {
         dn_size = crt->subject_raw.len;
 
-        if( end < p || (size_t)( end - p ) < 2 + dn_size )
+        if( end < p ||
+            (size_t)( end - p ) < dn_size ||
+            (size_t)( end - p ) < 2 + dn_size )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
             break;

Modified: trunk/reactos/dll/3rdparty/mbedtls/ssl_tls.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/ssl_t…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/ssl_tls.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/ssl_tls.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -3465,6 +3465,18 @@
  * uint16 epoch;            // DTLS only
  * uint48 sequence_number;  // DTLS only
  * uint16 length;
+ *
+ * Return 0 if header looks sane (and, for DTLS, the record is expected)
+ * MBEDTLS_ERR_SSL_INVALID_RECORD if the header looks bad,
+ * MBEDTLS_ERR_SSL_UNEXPECTED_RECORD (DTLS only) if sane but unexpected.
+ *
+ * With DTLS, mbedtls_ssl_read_record() will:
+ * 1. proceed with the record if this function returns 0
+ * 2. drop only the current record if this function returns UNEXPECTED_RECORD
+ * 3. return CLIENT_RECONNECT if this function return that value
+ * 4. drop the whole datagram if this function returns anything else.
+ * Point 2 is needed when the peer is resending, and we have already received
+ * the first record from a datagram but are still waiting for the others.
  */
 static int ssl_parse_record_header( mbedtls_ssl_context *ssl )
 {
@@ -3500,16 +3512,86 @@
         return( MBEDTLS_ERR_SSL_INVALID_RECORD );
     }
 
+    /* Check version */
+    if( major_ver != ssl->major_ver )
+    {
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
+        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+    }
+
+    if( minor_ver > ssl->conf->max_minor_ver )
+    {
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
+        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+    }
+
+    /* Check length against the size of our buffer */
+    if( ssl->in_msglen > MBEDTLS_SSL_BUFFER_LEN
+                         - (size_t)( ssl->in_msg - ssl->in_buf ) )
+    {
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
+        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+    }
+
+    /* Check length against bounds of the current transform and version */
+    if( ssl->transform_in == NULL )
+    {
+        if( ssl->in_msglen < 1 ||
+            ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
+        {
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
+            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        }
+    }
+    else
+    {
+        if( ssl->in_msglen < ssl->transform_in->minlen )
+        {
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
+            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        }
+
+#if defined(MBEDTLS_SSL_PROTO_SSL3)
+        if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
+            ssl->in_msglen > ssl->transform_in->minlen +
MBEDTLS_SSL_MAX_CONTENT_LEN )
+        {
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
+            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        }
+#endif
+#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
+    defined(MBEDTLS_SSL_PROTO_TLS1_2)
+        /*
+         * TLS encrypted messages can have up to 256 bytes of padding
+         */
+        if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 &&
+            ssl->in_msglen > ssl->transform_in->minlen +
+                             MBEDTLS_SSL_MAX_CONTENT_LEN + 256 )
+        {
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
+            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+        }
+#endif
+    }
+
+    /*
+     * DTLS-related tests done last, because most of them may result in
+     * silently dropping the record (but not the whole datagram), and we only
+     * want to consider that after ensuring that the "basic" fields (type,
+     * version, length) are sane.
+     */
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
     {
+        unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
+
         /* Drop unexpected ChangeCipherSpec messages */
         if( ssl->in_msgtype == MBEDTLS_SSL_MSG_CHANGE_CIPHER_SPEC &&
             ssl->state != MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC &&
             ssl->state != MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ChangeCipherSpec"
) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
         }
 
         /* Drop unexpected ApplicationData records,
@@ -3523,30 +3605,10 @@
             )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "dropping unexpected ApplicationData" )
);
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-        }
-    }
-#endif
-
-    /* Check version */
-    if( major_ver != ssl->major_ver )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "major version mismatch" ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-    }
-
-    if( minor_ver > ssl->conf->max_minor_ver )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "minor version mismatch" ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-    }
-
-    /* Check epoch (and sequence number) with DTLS */
-#if defined(MBEDTLS_SSL_PROTO_DTLS)
-    if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
-    {
-        unsigned int rec_epoch = ( ssl->in_ctr[0] << 8 ) | ssl->in_ctr[1];
-
+            return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
+        }
+
+        /* Check epoch (and sequence number) with DTLS */
         if( rec_epoch != ssl->in_epoch )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "record from another epoch: "
@@ -3573,7 +3635,7 @@
             }
             else
 #endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE && MBEDTLS_SSL_SRV_C */
-                return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+                return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
         }
 
 #if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
@@ -3582,60 +3644,11 @@
             mbedtls_ssl_dtls_replay_check( ssl ) != 0 )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "replayed record" ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
+            return( MBEDTLS_ERR_SSL_UNEXPECTED_RECORD );
         }
 #endif
     }
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
-
-    /* Check length against the size of our buffer */
-    if( ssl->in_msglen > MBEDTLS_SSL_BUFFER_LEN
-                         - (size_t)( ssl->in_msg - ssl->in_buf ) )
-    {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
-        return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-    }
-
-    /* Check length against bounds of the current transform and version */
-    if( ssl->transform_in == NULL )
-    {
-        if( ssl->in_msglen < 1 ||
-            ssl->in_msglen > MBEDTLS_SSL_MAX_CONTENT_LEN )
-        {
-            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-        }
-    }
-    else
-    {
-        if( ssl->in_msglen < ssl->transform_in->minlen )
-        {
-            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-        }
-
-#if defined(MBEDTLS_SSL_PROTO_SSL3)
-        if( ssl->minor_ver == MBEDTLS_SSL_MINOR_VERSION_0 &&
-            ssl->in_msglen > ssl->transform_in->minlen +
MBEDTLS_SSL_MAX_CONTENT_LEN )
-        {
-            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-        }
-#endif
-#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
-    defined(MBEDTLS_SSL_PROTO_TLS1_2)
-        /*
-         * TLS encrypted messages can have up to 256 bytes of padding
-         */
-        if( ssl->minor_ver >= MBEDTLS_SSL_MINOR_VERSION_1 &&
-            ssl->in_msglen > ssl->transform_in->minlen +
-                             MBEDTLS_SSL_MAX_CONTENT_LEN + 256 )
-        {
-            MBEDTLS_SSL_DEBUG_MSG( 1, ( "bad message length" ) );
-            return( MBEDTLS_ERR_SSL_INVALID_RECORD );
-        }
-#endif
-    }
 
     return( 0 );
 }
@@ -3762,13 +3775,26 @@
         if( ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM &&
             ret != MBEDTLS_ERR_SSL_CLIENT_RECONNECT )
         {
-            /* Ignore bad record and get next one; drop the whole datagram
-             * since current header cannot be trusted to find the next record
-             * in current datagram */
-            ssl->next_record_offset = 0;
-            ssl->in_left = 0;
-
-            MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record (header)" )
);
+            if( ret == MBEDTLS_ERR_SSL_UNEXPECTED_RECORD )
+            {
+                /* Skip unexpected record (but not whole datagram) */
+                ssl->next_record_offset = ssl->in_msglen
+                                        + mbedtls_ssl_hdr_len( ssl );
+
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding unexpected record "
+                                            "(header)" ) );
+            }
+            else
+            {
+                /* Skip invalid record and the rest of the datagram */
+                ssl->next_record_offset = 0;
+                ssl->in_left = 0;
+
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "discarding invalid record "
+                                            "(header)" ) );
+            }
+
+            /* Get next record */
             goto read_record_header;
         }
 #endif
@@ -7071,6 +7097,23 @@
     memset( conf, 0, sizeof( mbedtls_ssl_config ) );
 }
 
+#if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
+static int ssl_preset_default_hashes[] = {
+#if defined(MBEDTLS_SHA512_C)
+    MBEDTLS_MD_SHA512,
+    MBEDTLS_MD_SHA384,
+#endif
+#if defined(MBEDTLS_SHA256_C)
+    MBEDTLS_MD_SHA256,
+    MBEDTLS_MD_SHA224,
+#endif
+#if defined(MBEDTLS_SHA1_C)
+    MBEDTLS_MD_SHA1,
+#endif
+    MBEDTLS_MD_NONE
+};
+#endif
+
 static int ssl_preset_suiteb_ciphersuites[] = {
     MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
     MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
@@ -7227,7 +7270,7 @@
 #endif
 
 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
-            conf->sig_hashes = mbedtls_md_list();
+            conf->sig_hashes = ssl_preset_default_hashes;
 #endif
 
 #if defined(MBEDTLS_ECP_C)

Modified: trunk/reactos/dll/3rdparty/mbedtls/x509_crt.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/dll/3rdparty/mbedtls/x509_…
==============================================================================
--- trunk/reactos/dll/3rdparty/mbedtls/x509_crt.c	[iso-8859-1] (original)
+++ trunk/reactos/dll/3rdparty/mbedtls/x509_crt.c	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -2253,18 +2253,8 @@
     {
         /* Look for a parent upwards the chain */
         for( parent = crt->next; parent != NULL; parent = parent->next )
-        {
-            /* +2 because the current step is not yet accounted for
-             * and because max_pathlen is one higher than it should be */
-            if( parent->max_pathlen > 0 &&
-                parent->max_pathlen < 2 + pathlen )
-            {
-                continue;
-            }
-
             if( x509_crt_check_parent( crt, parent, 0, pathlen == 0 ) == 0 )
                 break;
-        }
 
         /* Are we part of the chain or at the top? */
         if( parent != NULL )

Modified: trunk/reactos/include/reactos/libs/mbedtls/bignum.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/bignum.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/bignum.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -122,6 +122,7 @@
      #define MBEDTLS_HAVE_INT64
      typedef  int64_t mbedtls_mpi_sint;
      typedef uint64_t mbedtls_mpi_uint;
+     /* mbedtls_t_udbl defined as 128-bit unsigned int */
      typedef unsigned int mbedtls_t_udbl __attribute__((mode(TI)));
      #define MBEDTLS_HAVE_UDBL
   #else

Modified: trunk/reactos/include/reactos/libs/mbedtls/compat-1.3.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/compat-1.3.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/compat-1.3.h	[iso-8859-1] Sun Feb 21
10:56:57 2016
@@ -1,7 +1,8 @@
 /**
- * \file config.h
+ * \file compat-1.3.h
  *
- * \brief Compatibility names (set of defines)
+ * \brief Compatibility definitions for using mbed TLS with client code written
+ *  for the PolarSSL naming conventions.
  *
  * \deprecated Use the new names directly instead
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/config.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/config.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/config.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -2,6 +2,10 @@
  * \file config.h
  *
  * \brief Configuration options (set of defines)
+ *
+ *  This set of compile-time options may be used to enable
+ *  or disable features selectively, and reduce the global
+ *  memory footprint.
  *
  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  *  SPDX-License-Identifier: Apache-2.0
@@ -21,19 +25,8 @@
  *  This file is part of mbed TLS (https://tls.mbed.org)
  */
 
-/*
- * This set of compile-time options may be used to enable
- * or disable features selectively, and reduce the global
- * memory footprint.
- */
 #ifndef MBEDTLS_CONFIG_H
 #define MBEDTLS_CONFIG_H
-
-#ifndef __REACTOS__
-#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
-#define _CRT_SECURE_NO_DEPRECATE 1
-#endif
-#endif
 
 /**
  * \name SECTION: System support
@@ -134,10 +127,10 @@
 //#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
 
 /**
- * \def MBEDTLS_PLATFORM_XXX_ALT
- *
- * Uncomment a macro to let mbed TLS support the function in the platform
- * abstraction layer.
+ * \def MBEDTLS_PLATFORM_EXIT_ALT
+ *
+ * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the
+ * function in the platform abstraction layer.
  *
  * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will
  * provide a function "mbedtls_platform_set_printf()" that allows you to set
an
@@ -210,12 +203,12 @@
 //#define MBEDTLS_TIMING_ALT
 
 /**
- * \def MBEDTLS__MODULE_NAME__ALT
- *
- * Uncomment a macro to let mbed TLS use your alternate core implementation of
- * a symmetric crypto or hash module (e.g. platform specific assembly
- * optimized implementations). Keep in mind that the function prototypes
- * should remain the same.
+ * \def MBEDTLS_AES_ALT
+ *
+ * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your
+ * alternate core implementation of a symmetric crypto or hash module (e.g.
+ * platform specific assembly optimized implementations). Keep in mind that
+ * the function prototypes should remain the same.
  *
  * This replaces the whole module. If you only want to replace one of the
  * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags.
@@ -243,11 +236,11 @@
 //#define MBEDTLS_SHA512_ALT
 
 /**
- * \def MBEDTLS__FUNCTION_NAME__ALT
- *
- * Uncomment a macro to let mbed TLS use you alternate core implementation of
- * symmetric crypto or hash function. Keep in mind that function prototypes
- * should remain the same.
+ * \def MBEDTLS_MD2_PROCESS_ALT
+ *
+ * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you
+ * alternate core implementation of symmetric crypto or hash function. Keep in
+ * mind that function prototypes should remain the same.
  *
  * This replaces only one function. The header file from mbed TLS is still
  * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags.
@@ -366,10 +359,11 @@
 //#define MBEDTLS_CIPHER_NULL_CIPHER
 
 /**
- * \def MBEDTLS_CIPHER_PADDING_XXX
- *
- * Uncomment or comment macros to add support for specific padding modes
- * in the cipher layer with cipher modes that support padding (e.g. CBC)
+ * \def MBEDTLS_CIPHER_PADDING_PKCS7
+ *
+ * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for
+ * specific padding modes in the cipher layer with cipher modes that support
+ * padding (e.g. CBC)
  *
  * If you disable all padding modes, only full blocks can be used with CBC.
  *
@@ -409,10 +403,10 @@
 #define MBEDTLS_REMOVE_ARC4_CIPHERSUITES
 
 /**
- * \def MBEDTLS_ECP_XXXX_ENABLED
- *
- * Enables specific curves within the Elliptic Curve module.
- * By default all supported curves are enabled.
+ * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED
+ *
+ * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve
+ * module.  By default all supported curves are enabled.
  *
  * Comment macros to disable the curve and functions for it
  */

Modified: trunk/reactos/include/reactos/libs/mbedtls/ecjpake.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/ecjpake.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/ecjpake.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -64,7 +64,7 @@
  *
  * In order to benefit from this symmetry, we choose a different naming
  * convetion from the Thread v1.0 spec. Correspondance is indicated in the
- * description as a pair C: <client name>, S: <server name>
+ * description as a pair C: client name, S: server name
  */
 typedef struct
 {

Modified: trunk/reactos/include/reactos/libs/mbedtls/error.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/error.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/error.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -79,7 +79,7 @@
  * ECP       4   8 (Started from top)
  * MD        5   4
  * CIPHER    6   6
- * SSL       6   16 (Started from top)
+ * SSL       6   17 (Started from top)
  * SSL       7   31
  *
  * Module dependent error code (5 bits 0x.00.-0x.F8.)

Modified: trunk/reactos/include/reactos/libs/mbedtls/md.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/md.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/md.h	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_md.h
+ * \file md.h
  *
  * \brief Generic message digest wrapper
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/md2.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/md2.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/md2.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_md2.h
+ * \file md2.h
  *
  * \brief MD2 message digest algorithm (hash function)
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/md4.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/md4.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/md4.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_md4.h
+ * \file md4.h
  *
  * \brief MD4 message digest algorithm (hash function)
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/md5.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/md5.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/md5.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_md5.h
+ * \file md5.h
  *
  * \brief MD5 message digest algorithm (hash function)
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/ripemd160.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/ripemd160.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/ripemd160.h	[iso-8859-1] Sun Feb 21
10:56:57 2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_ripemd160.h
+ * \file ripemd160.h
  *
  * \brief RIPE MD-160 message digest
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/sha1.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/sha1.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/sha1.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_sha1.h
+ * \file sha1.h
  *
  * \brief SHA-1 cryptographic hash function
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/sha256.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/sha256.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/sha256.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_sha256.h
+ * \file sha256.h
  *
  * \brief SHA-224 and SHA-256 cryptographic hash function
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/sha512.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/sha512.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/sha512.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_sha512.h
+ * \file sha512.h
  *
  * \brief SHA-384 and SHA-512 cryptographic hash function
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/ssl.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/ssl.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/ssl.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -106,6 +106,7 @@
 #define MBEDTLS_ERR_SSL_WANT_WRITE                        -0x6880  /**< Connection
requires a write call. */
 #define MBEDTLS_ERR_SSL_TIMEOUT                           -0x6800  /**< The operation
timed out. */
 #define MBEDTLS_ERR_SSL_CLIENT_RECONNECT                  -0x6780  /**< The client
initiated a reconnect from the same port. */
+#define MBEDTLS_ERR_SSL_UNEXPECTED_RECORD                 -0x6700  /**< Record header
looks valid but is not expected. */
 
 /*
  * Various constants
@@ -1610,7 +1611,7 @@
 #if defined(MBEDTLS_KEY_EXCHANGE__WITH_CERT__ENABLED)
 /**
  * \brief          Set the allowed hashes for signatures during the handshake.
- *                 (Default: all available hashes.)
+ *                 (Default: all available hashes except MD5.)
  *
  * \note           This only affects which hashes are offered and can be used
  *                 for signatures during the handshake. Hashes for message
@@ -2167,7 +2168,8 @@
  * \note           If this function returns something other than 0 or
  *                 MBEDTLS_ERR_SSL_WANT_READ/WRITE, then the ssl context
  *                 becomes unusable, and you should either free it or call
- *                 \c mbedtls_ssl_session_reset() on it before re-using it.
+ *                 \c mbedtls_ssl_session_reset() on it before re-using it for
+ *                 a new connection; the current connection must be closed.
  *
  * \note           If DTLS is in use, then you may choose to handle
  *                 MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED specially for logging
@@ -2183,6 +2185,12 @@
  *                 the following state after execution of this function.
  *                 Do not call this function if state is MBEDTLS_SSL_HANDSHAKE_OVER.
  *
+ * \note           If this function returns something other than 0 or
+ *                 MBEDTLS_ERR_SSL_WANT_READ/WRITE, then the ssl context
+ *                 becomes unusable, and you should either free it or call
+ *                 \c mbedtls_ssl_session_reset() on it before re-using it for
+ *                 a new connection; the current connection must be closed.
+ *
  * \param ssl      SSL context
  *
  * \return         0 if successful, or
@@ -2201,6 +2209,12 @@
  * \param ssl      SSL context
  *
  * \return         0 if successful, or any mbedtls_ssl_handshake() return value.
+ *
+ * \note           If this function returns something other than 0 or
+ *                 MBEDTLS_ERR_SSL_WANT_READ/WRITE, then the ssl context
+ *                 becomes unusable, and you should either free it or call
+ *                 \c mbedtls_ssl_session_reset() on it before re-using it for
+ *                 a new connection; the current connection must be closed.
  */
 int mbedtls_ssl_renegotiate( mbedtls_ssl_context *ssl );
 #endif /* MBEDTLS_SSL_RENEGOTIATION */
@@ -2217,6 +2231,13 @@
  *                 MBEDTLS_ERR_SSL_WANT_READ or MBEDTLS_ERR_SSL_WANT_WRITE, or
  *                 MBEDTLS_ERR_SSL_CLIENT_RECONNECT (see below), or
  *                 another negative error code.
+ *
+ * \note           If this function returns something other than a positive
+ *                 value or MBEDTLS_ERR_SSL_WANT_READ/WRITE or
+ *                 MBEDTLS_ERR_SSL_CLIENT_RECONNECT, then the ssl context
+ *                 becomes unusable, and you should either free it or call
+ *                 \c mbedtls_ssl_session_reset() on it before re-using it for
+ *                 a new connection; the current connection must be closed.
  *
  * \note           When this function return MBEDTLS_ERR_SSL_CLIENT_RECONNECT
  *                 (which can only happen server-side), it means that a client
@@ -2251,6 +2272,12 @@
  *                 or MBEDTLS_ERR_SSL_WANT_WRITE of MBEDTLS_ERR_SSL_WANT_READ,
  *                 or another negative error code.
  *
+ * \note           If this function returns something other than a positive
+ *                 value or MBEDTLS_ERR_SSL_WANT_READ/WRITE, the ssl context
+ *                 becomes unusable, and you should either free it or call
+ *                 \c mbedtls_ssl_session_reset() on it before re-using it for
+ *                 a new connection; the current connection must be closed.
+ *
  * \note           When this function returns MBEDTLS_ERR_SSL_WANT_WRITE/READ,
  *                 it must be called later with the *same* arguments,
  *                 until it returns a positive value.
@@ -2274,6 +2301,12 @@
  * \param message   The alert message (SSL_ALERT_MSG_*)
  *
  * \return          0 if successful, or a specific SSL error code.
+ *
+ * \note           If this function returns something other than 0 or
+ *                 MBEDTLS_ERR_SSL_WANT_READ/WRITE, then the ssl context
+ *                 becomes unusable, and you should either free it or call
+ *                 \c mbedtls_ssl_session_reset() on it before re-using it for
+ *                 a new connection; the current connection must be closed.
  */
 int mbedtls_ssl_send_alert_message( mbedtls_ssl_context *ssl,
                             unsigned char level,
@@ -2282,6 +2315,14 @@
  * \brief          Notify the peer that the connection is being closed
  *
  * \param ssl      SSL context
+ *
+ * \return          0 if successful, or a specific SSL error code.
+ *
+ * \note           If this function returns something other than 0 or
+ *                 MBEDTLS_ERR_SSL_WANT_READ/WRITE, then the ssl context
+ *                 becomes unusable, and you should either free it or call
+ *                 \c mbedtls_ssl_session_reset() on it before re-using it for
+ *                 a new connection; the current connection must be closed.
  */
 int mbedtls_ssl_close_notify( mbedtls_ssl_context *ssl );
 

Modified: trunk/reactos/include/reactos/libs/mbedtls/version.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/version.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/version.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -39,16 +39,16 @@
  */
 #define MBEDTLS_VERSION_MAJOR  2
 #define MBEDTLS_VERSION_MINOR  2
-#define MBEDTLS_VERSION_PATCH  0
+#define MBEDTLS_VERSION_PATCH  1
 
 /**
  * The single version number has the following structure:
  *    MMNNPP00
  *    Major version | Minor version | Patch version
  */
-#define MBEDTLS_VERSION_NUMBER         0x02020000
-#define MBEDTLS_VERSION_STRING         "2.2.0"
-#define MBEDTLS_VERSION_STRING_FULL    "mbed TLS 2.2.0"
+#define MBEDTLS_VERSION_NUMBER         0x02020100
+#define MBEDTLS_VERSION_STRING         "2.2.1"
+#define MBEDTLS_VERSION_STRING_FULL    "mbed TLS 2.2.1"
 
 #if defined(MBEDTLS_VERSION_C)
 

Modified: trunk/reactos/include/reactos/libs/mbedtls/x509_crl.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/x509_crl.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/x509_crl.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_x509_crl.h
+ * \file x509_crl.h
  *
  * \brief X.509 certificate revocation list parsing
  *
@@ -100,6 +100,7 @@
  *
  * \param chain    points to the start of the chain
  * \param buf      buffer holding the CRL data in DER format
+ * \param buflen   size of the buffer
  *                 (including the terminating null byte for PEM data)
  *
  * \return         0 if successful, or a specific X509 or PEM error code

Modified: trunk/reactos/include/reactos/libs/mbedtls/x509_crt.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/x509_crt.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/x509_crt.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_x509_crt.h
+ * \file x509_crt.h
  *
  * \brief X.509 certificate parsing and writing
  *

Modified: trunk/reactos/include/reactos/libs/mbedtls/x509_csr.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/include/reactos/libs/mbedt…
==============================================================================
--- trunk/reactos/include/reactos/libs/mbedtls/x509_csr.h	[iso-8859-1] (original)
+++ trunk/reactos/include/reactos/libs/mbedtls/x509_csr.h	[iso-8859-1] Sun Feb 21 10:56:57
2016
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls_x509_csr.h
+ * \file x509_csr.h
  *
  * \brief X.509 certificate signing request parsing and writing
  *

Modified: trunk/reactos/media/doc/3rd Party Files.txt
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/media/doc/3rd%20Party%20Fi…
==============================================================================
--- trunk/reactos/media/doc/3rd Party Files.txt	[iso-8859-1] (original)
+++ trunk/reactos/media/doc/3rd Party Files.txt	[iso-8859-1] Sun Feb 21 10:56:57 2016
@@ -83,7 +83,7 @@
 Website: http://www.ijg.org/
 
 Title: mbed TLS
-Used Version: 2.2.0
+Used Version: 2.2.1
 Website: https://tls.mbed.org/
 
 Title: libpng