commit 7f376f4ece7a3e71a51c91f094fe99981ca6f46f
author Hanno Becker <hanno.becker@arm.com> Wed Jun 12 16:20:48 2019 +0100
committer Hanno Becker <hanno.becker@arm.com> Tue Jun 25 08:43:31 2019 +0100
tree c98a972eedc0169732f9c79ae67979aaaee588b8
parent af5ab918d92313c938a5628aa6e24fd3a288353c

Allow compile-time configuration of DTLS anti replay

Introduce MBEDTLS_SSL_CONF_ANTI_REPLAY to allow configuring
the use/nonuse of DTLS anti replay protection at compile-time.

Impact on code-size, measured with
> ./scripts/baremetal.sh --rom --gcc --armc5 --armc6

|  | GCC | ARMC5 | ARMC6 |
| --- | --- | --- | --- |
| `libmbedtls.a` before | 23559 | 24089 | 27921 |
| `libmbedtls.a` after  | 23511 | 24049 | 27903 |
| gain in Bytes | 48 | 40 | 18 |

programs/ssl/ssl_server2.c

diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 5d751b6..b76473f 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -317,7 +317,8 @@
 #define USAGE_COOKIES ""
 #endif
 
-#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
+#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
+    !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
 #define USAGE_ANTI_REPLAY \
     "    anti_replay=0/1     default: (library default: enabled)\n"
 #else
@@ -1889,12 +1890,14 @@
             if( opt.cookies < -1 || opt.cookies > 1)
                 goto usage;
         }
+#if !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
         else if( strcmp( p, "anti_replay" ) == 0 )
         {
             opt.anti_replay = atoi( q );
             if( opt.anti_replay < 0 || opt.anti_replay > 1)
                 goto usage;
         }
+#endif /* !MBEDTLS_SSL_CONF_ANTI_REPLAY */
         else if( strcmp( p, "badmac_limit" ) == 0 )
         {
             opt.badmac_limit = atoi( q );
@@ -2580,7 +2583,8 @@
             ; /* Nothing to do */
         }
 
-#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY)
+#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
+    !defined(MBEDTLS_SSL_CONF_ANTI_REPLAY)
         if( opt.anti_replay != DFL_ANTI_REPLAY )
             mbedtls_ssl_conf_dtls_anti_replay( &conf, opt.anti_replay );
 #endif