Add functions for replay protection
diff --git a/include/polarssl/config.h b/include/polarssl/config.h
index b13a407..20f104d 100644
--- a/include/polarssl/config.h
+++ b/include/polarssl/config.h
@@ -914,6 +914,15 @@
#define POLARSSL_SSL_PROTO_DTLS
/**
+ * \def POLARSSL_SSL_DTLS_ANTI_REPLAY
+ *
+ * Enable support for the anti-replay mechanism in DTLS.
+ *
+ * Comment this to disable anti-replay in DTLS.
+ */
+#define POLARSSL_SSL_DTLS_ANTI_REPLAY
+
+/**
* \def POLARSSL_SSL_ALPN
*
* Enable support for Application Layer Protocol Negotiation.
diff --git a/include/polarssl/ssl.h b/include/polarssl/ssl.h
index 63a7528..5946799 100644
--- a/include/polarssl/ssl.h
+++ b/include/polarssl/ssl.h
@@ -822,6 +822,10 @@
size_t next_record_offset; /*!< offset of the next record in datagram
(equal to in_left if none) */
#endif
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+ uint64_t in_window_top; /*!< last validated record seq_num */
+ uint64_t in_window; /*!< bitmask for replay detection */
+#endif
size_t in_hslen; /*!< current handshake message length,
including the handshake header */
@@ -2043,6 +2047,12 @@
int ssl_resend( ssl_context *ssl );
#endif
+/* Visible for testing purposes only */
+#if defined(POLARSSL_SSL_DTLS_ANTI_REPLAY)
+int ssl_dtls_replay_check( ssl_context *ssl );
+void ssl_dtls_replay_update( ssl_context *ssl );
+#endif
+
/* constant-time buffer comparison */
static inline int safer_memcmp( const void *a, const void *b, size_t n )
{