From b6ef9ec78f157c0e8d4d3a7b7c111b2de6c9194f Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Thu, 5 Mar 2026 17:32:51 +0000 Subject: [PATCH 01/46] Support DESTDIR for install and add build-system test Signed-off-by: Yi Wu --- library/CMakeLists.txt | 2 +- tests/scripts/components-build-system.sh | 26 ++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 1 deletion(-) diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt index 5474e2cacf..19386ee4d4 100644 --- a/library/CMakeLists.txt +++ b/library/CMakeLists.txt @@ -362,7 +362,7 @@ foreach(target IN LISTS tf_psa_crypto_library_targets) RENAME "libmbedcrypto.so.${MBEDTLS_VERSION}" ) install(CODE " - set(_libdir \"\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}\") + set(_libdir \"\$ENV{DESTDIR}${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR}\") execute_process(COMMAND \"\${CMAKE_COMMAND}\" -E create_symlink \"libmbedcrypto.so.${MBEDTLS_VERSION}\" diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index ce923b5cc4..34b3c985dd 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -155,6 +155,32 @@ support_test_cmake_as_package_install () { support_test_cmake_out_of_source } +component_test_cmake_install_with_destdir () { + # Remove existing generated files so that we use the ones CMake + # generates + $MAKE_COMMAND neat + + msg "install: cmake with DESTDIR staging" + MBEDTLS_ROOT_DIR="$PWD" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + cmake -DGEN_FILES=ON -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=ON -DCMAKE_INSTALL_PREFIX:PATH=/usr "$MBEDTLS_ROOT_DIR" + make + + DESTDIR="$OUT_OF_SOURCE_DIR/stage" make install + + install_libdir="$(sed -n 's/^CMAKE_INSTALL_LIBDIR:PATH=//p' CMakeCache.txt)" + test -n "$install_libdir" + test -L "$OUT_OF_SOURCE_DIR/stage/usr/${install_libdir}/libmbedcrypto.so" + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" +} + +support_test_cmake_install_with_destdir () { + support_test_cmake_out_of_source +} + component_build_cmake_custom_config_file () { # Make a copy of config file to use for the in-tree test cp "$CONFIG_H" include/mbedtls_config_in_tree_copy.h From d9fa082e30ee2fa8e8f88bf01ebf5b6362e55f90 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Tue, 10 Mar 2026 11:04:06 +0000 Subject: [PATCH 02/46] Add changelog Signed-off-by: Yi Wu --- ChangeLog.d/cmake-destdir-instal.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/cmake-destdir-instal.txt diff --git a/ChangeLog.d/cmake-destdir-instal.txt b/ChangeLog.d/cmake-destdir-instal.txt new file mode 100644 index 0000000000..15892b951a --- /dev/null +++ b/ChangeLog.d/cmake-destdir-instal.txt @@ -0,0 +1,3 @@ +Bugfix + * CMake installs now honor `DESTDIR` for the compatibility + `libmbedcrypto.so` symlink during staged installs. \ No newline at end of file From 287d0a8d3c6557d46c3b6229e9965f59b4792086 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Fri, 13 Mar 2026 10:11:42 +0000 Subject: [PATCH 03/46] ChangeLog newline fix Signed-off-by: Yi Wu --- ChangeLog.d/cmake-destdir-instal.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/cmake-destdir-instal.txt b/ChangeLog.d/cmake-destdir-instal.txt index 15892b951a..5bf4c363de 100644 --- a/ChangeLog.d/cmake-destdir-instal.txt +++ b/ChangeLog.d/cmake-destdir-instal.txt @@ -1,3 +1,3 @@ -Bugfix +Changes * CMake installs now honor `DESTDIR` for the compatibility - `libmbedcrypto.so` symlink during staged installs. \ No newline at end of file + `libmbedcrypto.so` symlink during staged installs. From a8a111182703cafd00490c84f92227beb88bb731 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Fri, 13 Mar 2026 10:16:30 +0000 Subject: [PATCH 04/46] ChangeLog fix Signed-off-by: Yi Wu --- ChangeLog.d/cmake-destdir-instal.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/cmake-destdir-instal.txt b/ChangeLog.d/cmake-destdir-instal.txt index 5bf4c363de..a5471d08d7 100644 --- a/ChangeLog.d/cmake-destdir-instal.txt +++ b/ChangeLog.d/cmake-destdir-instal.txt @@ -1,3 +1,3 @@ Changes - * CMake installs now honor `DESTDIR` for the compatibility - `libmbedcrypto.so` symlink during staged installs. + * Restore DESTDIR support for CMake installs of compatibility + `libmbedcrypto` symlinks. From 72330cac94b4eb37ba367f6ed048ce6454c566e1 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 19 Mar 2026 15:25:14 +0100 Subject: [PATCH 05/46] Add 4.1 backport line to the PR template Signed-off-by: Gilles Peskine --- .github/pull_request_template.md | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index e48e44beda..b4bb9c815d 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -13,6 +13,7 @@ If the provided content is part of the present PR remove the # symbol. - [ ] **development PR** provided # | not required because: - [ ] **TF-PSA-Crypto PR** provided # | not required because: - [ ] **framework PR** provided Mbed-TLS/mbedtls-framework# | not required +- [ ] **4.1 PR** provided # | not required because: - [ ] **3.6 PR** provided # | not required because: - **tests** provided | not required because: From 10988b0477f2b8e812da911c8220f51de1e38c8b Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 19 Mar 2026 15:29:08 +0100 Subject: [PATCH 06/46] Clarify prerequisite, consuming or side PR Signed-off-by: Gilles Peskine --- .github/pull_request_template.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index b4bb9c815d..dbe8d74846 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -11,10 +11,11 @@ If the provided content is part of the present PR remove the # symbol. - [ ] **changelog** provided | not required because: - [ ] **development PR** provided # | not required because: -- [ ] **TF-PSA-Crypto PR** provided # | not required because: -- [ ] **framework PR** provided Mbed-TLS/mbedtls-framework# | not required -- [ ] **4.1 PR** provided # | not required because: -- [ ] **3.6 PR** provided # | not required because: +- [ ] **prerequisite TF-PSA-Crypto PR** provided # | not required because: +- [ ] **prerequisite framework PR** provided Mbed-TLS/mbedtls-framework# | not required +- [ ] **backport 4.1 PR** provided # | not required because: +- [ ] **prerequisite backport 1.1 PR** provided # | not required because: +- [ ] **backport 3.6 PR** provided # | not required because: - **tests** provided | not required because: From c2139f8887e76ad4215f17f9dbbdb8aab1365574 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 19 Mar 2026 16:39:08 +0100 Subject: [PATCH 07/46] Add repository shortcut suggestion Signed-off-by: Gilles Peskine --- .github/pull_request_template.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index dbe8d74846..273ccd8745 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -11,10 +11,10 @@ If the provided content is part of the present PR remove the # symbol. - [ ] **changelog** provided | not required because: - [ ] **development PR** provided # | not required because: -- [ ] **prerequisite TF-PSA-Crypto PR** provided # | not required because: +- [ ] **prerequisite TF-PSA-Crypto PR** provided Mbed-TLS/TF-PSA-Crypto# | not required because: - [ ] **prerequisite framework PR** provided Mbed-TLS/mbedtls-framework# | not required - [ ] **backport 4.1 PR** provided # | not required because: -- [ ] **prerequisite backport 1.1 PR** provided # | not required because: +- [ ] **prerequisite backport 1.1 PR** provided Mbed-TLS/TF-PSA-Crypto# | not required because: - [ ] **backport 3.6 PR** provided # | not required because: - **tests** provided | not required because: From 52379636c5ed5e0680c72d5b05abf84e030ff5e4 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Fri, 13 Mar 2026 14:06:17 +0100 Subject: [PATCH 08/46] library: check_config: remove RSA encryption requirement from ECDHE-RSA ECDHE-RSA only requires RSA signature, not encryption. This commits fixes guards in "mbedtls_check_config.h". Signed-off-by: Valerio Setti --- library/mbedtls_check_config.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/mbedtls_check_config.h b/library/mbedtls_check_config.h index f6ca813a37..e0023b6284 100644 --- a/library/mbedtls_check_config.h +++ b/library/mbedtls_check_config.h @@ -60,7 +60,7 @@ #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ ( !defined(MBEDTLS_CAN_ECDH) || !defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) || \ - !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) || !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) ) + !defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) ) #error "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prerequisites" #endif From 63df2f79a418c8c6dd782dade943a406f39d7e2c Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Mon, 16 Mar 2026 23:12:51 +0100 Subject: [PATCH 09/46] tests: depends.py: fix reverse dependency for RSA Signed-off-by: Valerio Setti --- tests/scripts/depends.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/scripts/depends.py b/tests/scripts/depends.py index a9d1d09507..f83e117e1f 100755 --- a/tests/scripts/depends.py +++ b/tests/scripts/depends.py @@ -274,9 +274,9 @@ REVERSE_DEPENDENCIES = { 'PSA_WANT_ALG_JPAKE': ['MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED'], 'PSA_WANT_ALG_RSA_OAEP': ['PSA_WANT_ALG_RSA_PSS', 'MBEDTLS_X509_RSASSA_PSS_SUPPORT'], - 'PSA_WANT_ALG_RSA_PKCS1V15_CRYPT': ['PSA_WANT_ALG_RSA_PKCS1V15_SIGN', - 'MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED'], + 'PSA_WANT_ALG_RSA_PKCS1V15_SIGN': ['MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED'], 'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC': [ + 'PSA_WANT_ALG_RSA_PKCS1V15_SIGN', 'PSA_WANT_ALG_RSA_PKCS1V15_CRYPT', 'PSA_WANT_ALG_RSA_OAEP', 'PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY', From a201a74b7d2d255474d8b01d5156762c80ba9c07 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 18 Mar 2026 17:40:28 +0100 Subject: [PATCH 10/46] tests: depends.py: extend pkalgs including PSA_WANT_ALG_RSA_PKCS1V15_SIGN Signed-off-by: Valerio Setti --- tests/scripts/depends.py | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/scripts/depends.py b/tests/scripts/depends.py index f83e117e1f..24f120b05e 100755 --- a/tests/scripts/depends.py +++ b/tests/scripts/depends.py @@ -495,6 +495,7 @@ class DomainData: 'PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC', 'PSA_WANT_ALG_RSA_OAEP', 'PSA_WANT_ALG_RSA_PKCS1V15_CRYPT', + 'PSA_WANT_ALG_RSA_PKCS1V15_SIGN', 'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC', 'MBEDTLS_X509_RSASSA_PSS_SUPPORT'], build_and_test), From 532db3d49ef3ea774fb08333fca36b7a784df60d Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Thu, 26 Mar 2026 09:23:44 +0000 Subject: [PATCH 11/46] Test: add symlinks and dangling link check Signed-off-by: Yi Wu --- tests/scripts/components-build-system.sh | 34 +++++++++++++++++++++--- 1 file changed, 31 insertions(+), 3 deletions(-) diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index 34b3c985dd..e882720690 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -169,9 +169,37 @@ component_test_cmake_install_with_destdir () { DESTDIR="$OUT_OF_SOURCE_DIR/stage" make install - install_libdir="$(sed -n 's/^CMAKE_INSTALL_LIBDIR:PATH=//p' CMakeCache.txt)" - test -n "$install_libdir" - test -L "$OUT_OF_SOURCE_DIR/stage/usr/${install_libdir}/libmbedcrypto.so" + install_lib_subdir="$(sed -n 's/^CMAKE_INSTALL_LIBDIR:PATH=//p' CMakeCache.txt)" + if [ -z "$install_lib_subdir" ]; then + echo "Error: Failed to read CMAKE_INSTALL_LIBDIR from CMakeCache.txt" >&2 + exit 1 + fi + + install_lib_path="$OUT_OF_SOURCE_DIR/stage/usr/${install_lib_subdir}" + + if [ ! -L "$install_lib_path/libmbedcrypto.so" ]; then + echo "Error: Expected symlink missing: $install_lib_path/libmbedcrypto.so" >&2 + ls -l "$install_lib_path" >&2 || true + exit 1 + fi + + # Match the install(CODE) logic in library/CMakeLists.txt: + # libmbedcrypto.so.${MBEDTLS_CRYPTO_SOVERSION} -> libmbedcrypto.so.${MBEDTLS_VERSION} + # libmbedcrypto.so -> libmbedcrypto.so.${MBEDTLS_CRYPTO_SOVERSION} + symlink_count="$(find "$install_lib_path" -maxdepth 1 -type l -name 'libmbedcrypto.so*' | wc -l)" + if [ "$symlink_count" -lt 2 ]; then + echo "Error: Expected at least 2 libmbedcrypto.so* symlinks, got $symlink_count" >&2 + ls -l "$install_lib_path"/libmbedcrypto.so* >&2 || true + exit 1 + fi + + for symlink in "$install_lib_path"/libmbedcrypto.so*; do + if [ -L "$symlink" ] && [ ! -e "$symlink" ]; then + echo "Error: Dangling symlink found: $symlink -> $(readlink "$symlink")" >&2 + ls -l "$install_lib_path"/libmbedcrypto.so* >&2 || true + exit 1 + fi + done cd "$MBEDTLS_ROOT_DIR" rm -rf "$OUT_OF_SOURCE_DIR" From be18f3f4a53b87f8d981d020d835f691943dc9c7 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 20 Nov 2025 15:46:58 +0100 Subject: [PATCH 12/46] Add a section about compiler-introduced timing side channels Signed-off-by: Gilles Peskine --- SECURITY.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index e36162abd7..6f545f8fcf 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -107,6 +107,12 @@ model, they need to be mitigated by physical countermeasures. ### Caveats +#### Compiler-induced side channels + +Mbed TLS is mostly written in C. We use standard C except with known compilers, so we do not expect compilers to introduce direct vulnerabilities. However, compilers can introduce [timing side channels](#timing-attacks) in code that was intended to be constant-time. Mbed TLS includes countermeasures to try to prevent this. But given the diversity of compilers, compiler options and target platforms, this prevention may not be complete. + +We recommend compiling Mbed TLS with commonly used levels of optimizations, such as `-O2` or `-Os`. Higher levels of optimization such as `-O3` or `-Oz` are likely to be safe but are less scrutinized. We do not recommend using less vetted optimization options unless your system is physically isolated. + #### Out-of-scope countermeasures Mbed TLS has evolved organically and a well defined threat model hasn't always From 54ebb9b42db9f6e0193f2d755c04b41d21eeec8a Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 20 Nov 2025 15:49:02 +0100 Subject: [PATCH 13/46] Mention the new advice about compiler options in the changelog Signed-off-by: Gilles Peskine --- ChangeLog.d/security-advice.txt | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 ChangeLog.d/security-advice.txt diff --git a/ChangeLog.d/security-advice.txt b/ChangeLog.d/security-advice.txt new file mode 100644 index 0000000000..1f7677a882 --- /dev/null +++ b/ChangeLog.d/security-advice.txt @@ -0,0 +1,2 @@ +Security + * Added advice about compiler options in SECURITY.md. From d1f0ce8493050f983a6238b120c29a35e2243015 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 26 Feb 2026 11:44:02 +0100 Subject: [PATCH 14/46] Be more specific about what compiler options we consider legitimate Signed-off-by: Gilles Peskine --- SECURITY.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 6f545f8fcf..b485d0112e 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -111,7 +111,7 @@ model, they need to be mitigated by physical countermeasures. Mbed TLS is mostly written in C. We use standard C except with known compilers, so we do not expect compilers to introduce direct vulnerabilities. However, compilers can introduce [timing side channels](#timing-attacks) in code that was intended to be constant-time. Mbed TLS includes countermeasures to try to prevent this. But given the diversity of compilers, compiler options and target platforms, this prevention may not be complete. -We recommend compiling Mbed TLS with commonly used levels of optimizations, such as `-O2` or `-Os`. Higher levels of optimization such as `-O3` or `-Oz` are likely to be safe but are less scrutinized. We do not recommend using less vetted optimization options unless your system is physically isolated. +We recommend compiling Mbed TLS with commonly used levels of optimizations, such as `-O2` or `-Os`. We will generally treat exploitable timing side channels as a vulnerability if they appear with a common compiler at a common level of optimization. Higher levels of optimization such as `-O3` or `-Oz` are still likely to be safe but are less scrutinized. We do not recommend using individual options that might introduce data-dependent timing, and we will not try to work around such optimizations if they are not part of a commonly used level. #### Out-of-scope countermeasures From c064ba0edb86e44f3c1c8dcaf05b1139407eebd4 Mon Sep 17 00:00:00 2001 From: Viktor Sokolovskiy Date: Sat, 4 Apr 2026 03:57:04 +0300 Subject: [PATCH 15/46] ssl: accept TLS 1.2 rsa_pss_rsae signature schemes Signed-off-by: Viktor Sokolovskiy --- ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt | 3 +++ library/ssl_misc.h | 19 +++++++++++++++++++ tests/suites/test_suite_ssl.data | 12 ++++++++++++ tests/suites/test_suite_ssl.function | 8 ++++++++ 4 files changed, 42 insertions(+) create mode 100644 ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt diff --git a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt new file mode 100644 index 0000000000..29400b2c46 --- /dev/null +++ b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt @@ -0,0 +1,3 @@ +Bugfix + * Fix a TLS 1.2 regression that caused clients to reject valid + ServerKeyExchange signatures using RSA-PSS signature scheme values. diff --git a/library/ssl_misc.h b/library/ssl_misc.h index f0ca823f33..4228dc20a8 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -2428,6 +2428,25 @@ static inline int mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg( static inline int mbedtls_ssl_tls12_sig_alg_is_supported( const uint16_t sig_alg) { +#if defined(PSA_WANT_ALG_RSA_PSS) + switch (sig_alg) { +#if defined(PSA_WANT_ALG_SHA_256) + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: + return 1; +#endif +#if defined(PSA_WANT_ALG_SHA_384) + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: + return 1; +#endif +#if defined(PSA_WANT_ALG_SHA_512) + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: + return 1; +#endif + default: + break; + } +#endif /* PSA_WANT_ALG_RSA_PSS */ + /* High byte is hash */ unsigned char hash = MBEDTLS_BYTE_1(sig_alg); unsigned char sig = MBEDTLS_BYTE_0(sig_alg); diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 881d502ed5..a20d822f28 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3549,3 +3549,15 @@ send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:0 Negative Test: Server using sig_alg not offered by the client - ECDSA with SHA512 depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:PSA_WANT_ALG_SHA_512 send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER + +TLS 1.2 accepts rsa_pss_rsae_sha256 in signature_algorithm +depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_256 +ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:1 + +TLS 1.2 accepts rsa_pss_rsae_sha384 in signature_algorithm +depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_384 +ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:1 + +TLS 1.2 accepts rsa_pss_rsae_sha512 in signature_algorithm +depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_512 +ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:1 diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 39457c9047..1efd38a7fb 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5853,6 +5853,14 @@ exit: } /* END_CASE */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ +void ssl_tls12_sig_alg_supported(int sig_alg, int expected) +{ + TEST_EQUAL(mbedtls_ssl_tls12_sig_alg_is_supported((uint16_t) sig_alg), + expected); +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_SSL_KEYING_MATERIAL_EXPORT:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */ void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int use_context) { From 619f1acd75e3daa652659a0d0b6046b54be2855e Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sun, 5 Apr 2026 20:41:34 +0200 Subject: [PATCH 16/46] Update framework with UNCOVERED_TESTS in outcome analysis Signed-off-by: Gilles Peskine --- framework | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/framework b/framework index dff9da0443..80a0ea93f0 160000 --- a/framework +++ b/framework @@ -1 +1 @@ -Subproject commit dff9da04438d712f7647fd995bc90fadd0c0e2ce +Subproject commit 80a0ea93f0215bcd9030734904b4b54fb8306f07 From 68d6b072877fb99aab7c5373289912e68ef6bd46 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sun, 5 Apr 2026 20:41:58 +0200 Subject: [PATCH 17/46] Rename IGNORED_TESTS to UNCOVERED_TESTS Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index b6f18c5b88..7ca1f760cb 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -33,7 +33,7 @@ class CoverageTask(outcome_analysis.CoverageTask): r'.*\b(?:' + r'|'.join(words) + r')\b.*', re.DOTALL) - IGNORED_TESTS = { + UNCOVERED_TESTS = { 'ssl-opt': [ # We don't run ssl-opt.sh with Valgrind on the CI because # it's extremely slow. We don't intend to change this. From bb5cfbbdec43242901fe8a9d74291ed3300a622c Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sun, 5 Apr 2026 20:43:52 +0200 Subject: [PATCH 18/46] Move _has_word_re to the framework Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 7ca1f760cb..5a9b343034 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -16,23 +16,6 @@ from mbedtls_framework import outcome_analysis class CoverageTask(outcome_analysis.CoverageTask): """Justify test cases that are never executed.""" - @staticmethod - def _has_word_re(words: typing.Iterable[str], - exclude: typing.Optional[str] = None) -> typing.Pattern: - """Construct a regex that matches if any of the words appears. - - The occurrence must start and end at a word boundary. - - If exclude is specified, strings containing a match for that - regular expression will not match the returned pattern. - """ - exclude_clause = r'' - if exclude: - exclude_clause = r'(?!.*' + exclude + ')' - return re.compile(exclude_clause + - r'.*\b(?:' + r'|'.join(words) + r')\b.*', - re.DOTALL) - UNCOVERED_TESTS = { 'ssl-opt': [ # We don't run ssl-opt.sh with Valgrind on the CI because From 1978e1bd6b2181021a839c42ab7e4b0157faffdb Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 6 Apr 2026 21:51:25 +0200 Subject: [PATCH 19/46] Ignore test cases that TF-PSA-Crypto tells us to ignore If the `tf-psa-crypto` submodule has `tests/scripts/analyze_outcomes.py`, require it to define a global variable `INTERNAL_TEST_CASES`. Those test cases will be ignored in Mbed TLS's coverage analysis. Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 50 +++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 5a9b343034..1e5ab43634 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -6,11 +6,28 @@ This script can also run on outcomes from a partial run, but the results are less likely to be useful. """ +import importlib +import importlib.machinery +import importlib.util +import os import re import typing import scripts_path # pylint: disable=unused-import from mbedtls_framework import outcome_analysis +from mbedtls_framework import typing_util + + +class CryptoAnalyzeOutcomesType(typing_util.Protocol): + """Our expectations on tf-psa-crypto/tests/scripts/analyze_outcomes.py. + + See CoverageTask_load_crypto_module(). + """ + #pylint: disable=too-few-public-methods + + # Test cases that are about internal aspects of TF-PSA-Crypto, + # which Mbed TLS is therefore not required to cover. + INTERNAL_TEST_CASES: outcome_analysis.TestCaseSetDescription class CoverageTask(outcome_analysis.CoverageTask): @@ -210,6 +227,39 @@ class CoverageTask(outcome_analysis.CoverageTask): ], } + def _load_crypto_module(self) -> None: + """Try to load the tf-psa-crypto submodule's outcome analysis Python module.""" + if self.crypto_module is not None: + return + crypto_script_path = 'tf-psa-crypto/tests/scripts/analyze_outcomes.py' + if not os.path.exists(crypto_script_path): + # During a transition period, while the crypto script is not + # yet present in all branches we care about, allow it not to + # exist. + return + crypto_spec = importlib.util.spec_from_file_location( + 'tf_psa_crypto.analyze_outcomes', + crypto_script_path) + # Assertions to help mypy. + assert crypto_spec is not None + assert crypto_spec.loader is not None + self.crypto_module: typing.Optional[CryptoAnalyzeOutcomesType] = \ + importlib.util.module_from_spec(crypto_spec) + crypto_spec.loader.exec_module(self.crypto_module) + + def _load_crypto_instructions(self) -> None: + """Try to load instructions from the tf-psa-crypto submodule's outcome analysis.""" + self._load_crypto_module() + if self.crypto_module is not None: + crypto_internal_test_cases = self.crypto_module.INTERNAL_TEST_CASES + self.ignored_tests.extend(crypto_internal_test_cases) + + def __init__(self, options) -> None: + super().__init__(options) + self.crypto_module = None # declared with a type in _load_crypto_module above + self._load_crypto_instructions() + + # List of tasks with a function that can handle this task and additional arguments if required KNOWN_TASKS: typing.Dict[str, typing.Type[outcome_analysis.Task]] = { 'analyze_coverage': CoverageTask, From 667a3f6442d55231b64106d5974fbd537ed94849 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 7 Apr 2026 11:47:24 +0200 Subject: [PATCH 20/46] Move test currently covered by crypto from uncovered list to ignored list If we can't read `INTERNAL_TEST_CASES` from `tf-psa-crypto/tests/scripts/analyze_outcomes.py` because the script doesn't exist, hard-code the legacy value of that information. Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 1e5ab43634..48f00f03c4 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -71,12 +71,6 @@ class CoverageTask(outcome_analysis.CoverageTask): # https://github.com/Mbed-TLS/mbedtls/issues/9586 'Config: !MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED', ], - 'test_suite_config.crypto_combinations': [ - # New thing in crypto. Not intended to be tested separately - # in mbedtls. - # https://github.com/Mbed-TLS/mbedtls/issues/10300 - 'Config: entropy: NV seed only', - ], 'test_suite_config.psa_boolean': [ # We don't test with HMAC disabled. # https://github.com/Mbed-TLS/mbedtls/issues/9591 @@ -252,7 +246,17 @@ class CoverageTask(outcome_analysis.CoverageTask): self._load_crypto_module() if self.crypto_module is not None: crypto_internal_test_cases = self.crypto_module.INTERNAL_TEST_CASES - self.ignored_tests.extend(crypto_internal_test_cases) + else: + # Legacy set of tests covered by TF-PSA-Crypto only, + # from before Mbed TLS's outcome analysis read that information + # from TF-PSA-Crypto. This branch can be removed once + # the presence of the crypto module becomes mandatory. + crypto_internal_test_cases = { + 'test_suite_config.crypto_combinations': [ + 'Config: entropy: NV seed only', + ], + } + self.ignored_tests.extend(crypto_internal_test_cases) def __init__(self, options) -> None: super().__init__(options) From f75c033eadcea19735373dee205ad03c25e15587 Mon Sep 17 00:00:00 2001 From: Viktor Sokolovskiy Date: Tue, 7 Apr 2026 20:17:49 +0300 Subject: [PATCH 21/46] ssl: add TLS 1.2 RSA-PSS regression coverage Signed-off-by: Viktor Sokolovskiy --- ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt | 1 + library/ssl_misc.h | 3 +++ tests/ssl-opt.sh | 20 ++++++++++++++++++++ tests/suites/test_suite_ssl.data | 12 ++++++++++++ 4 files changed, 36 insertions(+) diff --git a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt index 29400b2c46..aea5593e4b 100644 --- a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt +++ b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt @@ -1,3 +1,4 @@ Bugfix * Fix a TLS 1.2 regression that caused clients to reject valid ServerKeyExchange signatures using RSA-PSS signature scheme values. + Fixes #10668. diff --git a/library/ssl_misc.h b/library/ssl_misc.h index 4228dc20a8..34d8850c90 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -2429,6 +2429,9 @@ static inline int mbedtls_ssl_tls12_sig_alg_is_supported( const uint16_t sig_alg) { #if defined(PSA_WANT_ALG_RSA_PSS) + /* RFC 8446 Section 4.2.3 requires implementations that support RSA-PSS in + * TLS 1.3 to also accept rsa_pss_rsae_* in TLS 1.2. + */ switch (sig_alg) { #if defined(PSA_WANT_ALG_SHA_256) case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 47ff800ed1..123eb72328 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -13938,6 +13938,26 @@ run_test "TLS 1.2: Check rsa_pss_rsae compatibility issue, m->O" \ -c "Protocol is TLSv1.2" \ -c "HTTP/1.0 200 [Oo][Kk]" +requires_openssl_tls1_3_with_compatible_ephemeral +requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 +requires_config_enabled MBEDTLS_DEBUG_C +requires_config_enabled MBEDTLS_SSL_CLI_C +requires_config_enabled PSA_WANT_ALG_RSA_PSS +requires_config_enabled PSA_WANT_ALG_SHA_256 +run_test "TLS 1.2: OpenSSL chooses rsa_pss_rsae_sha256 for SKE, m->O" \ + "$O_NEXT_SRV_NO_CERT -cert $DATA_FILES_PATH/server2-sha256.crt -key $DATA_FILES_PATH/server2.key + -msg -tls1_2 + -sigalgs rsa_pss_rsae_sha256 " \ + "$P_CLI debug_level=4 auth_mode=none ca_file=none ca_path=none crt_file=none key_file=none + sig_algs=rsa_pss_rsae_sha256 + min_version=tls12 max_version=tls12 " \ + 0 \ + -c "Perform .* computation of digest of ServerKeyExchange" \ + -c "got signature scheme \\[804\\] rsa_pss_rsae_sha256" \ + -c "Ciphersuite is TLS-ECDHE-RSA" \ + -c "Protocol is TLSv1.2" \ + -c "HTTP/1.0 200 [Oo][Kk]" + requires_gnutls_tls1_3 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index a20d822f28..0d8b95cc0d 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3554,10 +3554,22 @@ TLS 1.2 accepts rsa_pss_rsae_sha256 in signature_algorithm depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_256 ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:1 +TLS 1.2 rejects rsa_pss_rsae_sha256 in signature_algorithm when RSA-PSS is disabled +depends_on:!PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_256 +ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:0 + TLS 1.2 accepts rsa_pss_rsae_sha384 in signature_algorithm depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_384 ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:1 +TLS 1.2 rejects rsa_pss_rsae_sha384 in signature_algorithm when RSA-PSS is disabled +depends_on:!PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_384 +ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:0 + TLS 1.2 accepts rsa_pss_rsae_sha512 in signature_algorithm depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_512 ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:1 + +TLS 1.2 rejects rsa_pss_rsae_sha512 in signature_algorithm when RSA-PSS is disabled +depends_on:!PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_512 +ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:0 From 16a90a556e7ee045cc2633545de799ebb729e795 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 8 Apr 2026 15:31:52 +0200 Subject: [PATCH 22/46] Add copyright line Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 48f00f03c4..226ca54c14 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -6,6 +6,9 @@ This script can also run on outcomes from a partial run, but the results are less likely to be useful. """ +# Copyright The Mbed TLS Contributors +# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + import importlib import importlib.machinery import importlib.util From d25f03919a3de57dc7e3492804ad25dcbf597eb2 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 8 Apr 2026 15:47:49 +0200 Subject: [PATCH 23/46] INTERNAL_TEST_CASES moved to a separate data-only module This way, when Mbed TLS's `analyze_outcomes.py` loads the python module from TF-PSA-Crypto (because it needs to know the value of `INTERNAL_TEST_CASES`), there's no risk that the subproject and the superproject will have different requirements on auxiliary modules such as `mbedtls_framework.outcome_analysis`. Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 226ca54c14..7ce88f9921 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -22,7 +22,7 @@ from mbedtls_framework import typing_util class CryptoAnalyzeOutcomesType(typing_util.Protocol): - """Our expectations on tf-psa-crypto/tests/scripts/analyze_outcomes.py. + """Our expectations on tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py. See CoverageTask_load_crypto_module(). """ @@ -225,17 +225,19 @@ class CoverageTask(outcome_analysis.CoverageTask): } def _load_crypto_module(self) -> None: - """Try to load the tf-psa-crypto submodule's outcome analysis Python module.""" + """Try to load the information about test cases from the tf-psa-crypto submodule..""" + # All this complexity is because we don't want to add the directory + # to the import path. if self.crypto_module is not None: return - crypto_script_path = 'tf-psa-crypto/tests/scripts/analyze_outcomes.py' + crypto_script_path = 'tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py' if not os.path.exists(crypto_script_path): # During a transition period, while the crypto script is not # yet present in all branches we care about, allow it not to # exist. return crypto_spec = importlib.util.spec_from_file_location( - 'tf_psa_crypto.analyze_outcomes', + 'tf_psa_crypto_test_case_info', crypto_script_path) # Assertions to help mypy. assert crypto_spec is not None From 806e1d365b254c12ed88af6ec94f71c932aaeedb Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 8 Apr 2026 17:22:10 +0200 Subject: [PATCH 24/46] Documentation improvements Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 7ce88f9921..1a73a2a619 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -24,7 +24,7 @@ from mbedtls_framework import typing_util class CryptoAnalyzeOutcomesType(typing_util.Protocol): """Our expectations on tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py. - See CoverageTask_load_crypto_module(). + See CoverageTask._load_crypto_module(). """ #pylint: disable=too-few-public-methods @@ -239,7 +239,7 @@ class CoverageTask(outcome_analysis.CoverageTask): crypto_spec = importlib.util.spec_from_file_location( 'tf_psa_crypto_test_case_info', crypto_script_path) - # Assertions to help mypy. + # Assertions and type annotation to help mypy. assert crypto_spec is not None assert crypto_spec.loader is not None self.crypto_module: typing.Optional[CryptoAnalyzeOutcomesType] = \ From 9248af96b1cfddc4901dd6e5be8e3034d0bab96c Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 31 Mar 2026 15:01:08 +0200 Subject: [PATCH 25/46] Create a directory for maintainer-only Python scripts This directory is currently excluded from `check-python-files.sh`, because we run it on the CI in an old Python version that doesn't support some of our new maintainer scripts. There are no such scripts in mbedtls for now (only in TF-PSA-Crypto), but be ready if we want to add some. Signed-off-by: Gilles Peskine --- scripts/maintainer/maintainer_scripts_path.py | 20 +++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 scripts/maintainer/maintainer_scripts_path.py diff --git a/scripts/maintainer/maintainer_scripts_path.py b/scripts/maintainer/maintainer_scripts_path.py new file mode 100644 index 0000000000..0ea13110cc --- /dev/null +++ b/scripts/maintainer/maintainer_scripts_path.py @@ -0,0 +1,20 @@ +"""Add our Python library directories for maintainer scripts to the module search path. + +Usage: + + import maintainer_scripts_path # pylint: disable=unused-import +""" + +# Copyright The Mbed TLS Contributors +# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later +# + +import os +import sys + +sys.path.append(os.path.join(os.path.dirname(__file__), + os.path.pardir, os.path.pardir, + 'framework', 'scripts')) +sys.path.append(os.path.join(os.path.dirname(__file__), + os.path.pardir, os.path.pardir, + 'framework', 'util')) From f14f28ce75a8943e2d1ddfc15a00f3fbda358df5 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Fri, 10 Apr 2026 10:27:09 +0100 Subject: [PATCH 26/46] ChangeLog padding space fix Signed-off-by: Yi Wu --- ChangeLog.d/cmake-destdir-instal.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/cmake-destdir-instal.txt b/ChangeLog.d/cmake-destdir-instal.txt index a5471d08d7..3dd2d167b1 100644 --- a/ChangeLog.d/cmake-destdir-instal.txt +++ b/ChangeLog.d/cmake-destdir-instal.txt @@ -1,3 +1,3 @@ Changes * Restore DESTDIR support for CMake installs of compatibility - `libmbedcrypto` symlinks. + `libmbedcrypto` symlinks. From cc134b0b94836a6044c76c2d7d362848811d0855 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 10 Apr 2026 14:49:14 +0200 Subject: [PATCH 27/46] Update crypto submodule with analyze_outcomes.py Update framework to match. Signed-off-by: Gilles Peskine --- framework | 2 +- tf-psa-crypto | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/framework b/framework index 80a0ea93f0..c6610dde67 160000 --- a/framework +++ b/framework @@ -1 +1 @@ -Subproject commit 80a0ea93f0215bcd9030734904b4b54fb8306f07 +Subproject commit c6610dde67ffd2a3a81cc204a73572b9c31a5775 diff --git a/tf-psa-crypto b/tf-psa-crypto index 426f86031a..8c29e401e9 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 426f86031a37bf317fbf0fee9251eb6e612ae58e +Subproject commit 8c29e401e9c1a3180a1eca6aed13958453276550 From 15be9e904863f4edd46c4b3b45f7d441e098334f Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Fri, 10 Apr 2026 14:33:39 +0100 Subject: [PATCH 28/46] ChangeLog fixes Signed-off-by: Yi Wu --- ChangeLog.d/cmake-destdir-instal.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/cmake-destdir-instal.txt b/ChangeLog.d/cmake-destdir-instal.txt index 3dd2d167b1..6d6e4dc1a7 100644 --- a/ChangeLog.d/cmake-destdir-instal.txt +++ b/ChangeLog.d/cmake-destdir-instal.txt @@ -1,3 +1,3 @@ -Changes +Feature * Restore DESTDIR support for CMake installs of compatibility - `libmbedcrypto` symlinks. + libmbedcrypto symlinks. Fixes #10627. From e9e0409b11e4c204c6a09a50b26709fab5a741cb Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Mon, 13 Apr 2026 12:48:01 +0100 Subject: [PATCH 29/46] tests: fix DESTDIR install checks and add macOS compatibility Signed-off-by: Yi Wu --- tests/scripts/components-build-system.sh | 50 ++++++++++-------------- 1 file changed, 21 insertions(+), 29 deletions(-) diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index e882720690..0aba7f7f3b 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -170,39 +170,31 @@ component_test_cmake_install_with_destdir () { DESTDIR="$OUT_OF_SOURCE_DIR/stage" make install install_lib_subdir="$(sed -n 's/^CMAKE_INSTALL_LIBDIR:PATH=//p' CMakeCache.txt)" - if [ -z "$install_lib_subdir" ]; then - echo "Error: Failed to read CMAKE_INSTALL_LIBDIR from CMakeCache.txt" >&2 - exit 1 - fi + [ -n "$install_lib_subdir" ] # Failed to read CMAKE_INSTALL_LIBDIR from CMakeCache.txt install_lib_path="$OUT_OF_SOURCE_DIR/stage/usr/${install_lib_subdir}" - if [ ! -L "$install_lib_path/libmbedcrypto.so" ]; then - echo "Error: Expected symlink missing: $install_lib_path/libmbedcrypto.so" >&2 - ls -l "$install_lib_path" >&2 || true - exit 1 + if [[ "$OSTYPE" == linux* ]]; then + # library/CMakeLists.txt installs libmbedcrypto.so with a versioned + # symlink chain on Linux. + for lib in tfpsacrypto mbedcrypto mbedx509 mbedtls; do + [ -f "$install_lib_path/lib${lib}.a" ] + [ -L "$install_lib_path/lib${lib}.so" ] + [ -e "$install_lib_path/lib${lib}.so" ] + versioned=( "$install_lib_path/lib${lib}.so".* ) + [ -L "${versioned[0]}" ] + [ -e "${versioned[0]}" ] + done + elif [[ "$OSTYPE" == darwin* ]]; then + # On macOS the custom install logic installs libmbedcrypto.dylib + # directly without a versioned symlink chain. + for lib in tfpsacrypto mbedcrypto mbedx509 mbedtls; do + [ -f "$install_lib_path/lib${lib}.a" ] + [ -e "$install_lib_path/lib${lib}.dylib" ] + done + else + echo "Unsupported platform for DESTDIR shared library checks" fi - - # Match the install(CODE) logic in library/CMakeLists.txt: - # libmbedcrypto.so.${MBEDTLS_CRYPTO_SOVERSION} -> libmbedcrypto.so.${MBEDTLS_VERSION} - # libmbedcrypto.so -> libmbedcrypto.so.${MBEDTLS_CRYPTO_SOVERSION} - symlink_count="$(find "$install_lib_path" -maxdepth 1 -type l -name 'libmbedcrypto.so*' | wc -l)" - if [ "$symlink_count" -lt 2 ]; then - echo "Error: Expected at least 2 libmbedcrypto.so* symlinks, got $symlink_count" >&2 - ls -l "$install_lib_path"/libmbedcrypto.so* >&2 || true - exit 1 - fi - - for symlink in "$install_lib_path"/libmbedcrypto.so*; do - if [ -L "$symlink" ] && [ ! -e "$symlink" ]; then - echo "Error: Dangling symlink found: $symlink -> $(readlink "$symlink")" >&2 - ls -l "$install_lib_path"/libmbedcrypto.so* >&2 || true - exit 1 - fi - done - - cd "$MBEDTLS_ROOT_DIR" - rm -rf "$OUT_OF_SOURCE_DIR" } support_test_cmake_install_with_destdir () { From 6b31bc6885142bfd6e51c955c53163d1856ef260 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 13 Apr 2026 14:57:07 +0200 Subject: [PATCH 30/46] Unify TF-PSA-Crypto and mbedtls templates Following the team discussion, don't suggest "prerequisite" or "consuming" in the template. Suggest linking all the pull requests in a group everywhere. Signed-off-by: Gilles Peskine --- .github/pull_request_template.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 273ccd8745..2259b1d1eb 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -9,15 +9,14 @@ Please write a few sentences describing the overall goals of the pull request's Please remove the segment/s on either side of the | symbol as appropriate, and add any relevant link/s to the end of the line. If the provided content is part of the present PR remove the # symbol. -- [ ] **changelog** provided | not required because: -- [ ] **development PR** provided # | not required because: -- [ ] **prerequisite TF-PSA-Crypto PR** provided Mbed-TLS/TF-PSA-Crypto# | not required because: -- [ ] **prerequisite framework PR** provided Mbed-TLS/mbedtls-framework# | not required -- [ ] **backport 4.1 PR** provided # | not required because: -- [ ] **prerequisite backport 1.1 PR** provided Mbed-TLS/TF-PSA-Crypto# | not required because: -- [ ] **backport 3.6 PR** provided # | not required because: -- **tests** provided | not required because: - +- [ ] **changelog** provided | not required because: +- [ ] **framework PR** provided Mbed-TLS/mbedtls-framework# | not required +- [ ] **TF-PSA-Crypto development PR** provided Mbed-TLS/TF-PSA-Crypto# | not required because: +- [ ] **TF-PSA-Crypto 1.1 PR** provided Mbed-TLS/TF-PSA-Crypto# | not required because: +- [ ] **mbedtls development PR** provided # | not required because: +- [ ] **mbedtls 4.1 PR** provided # | not required because: +- [ ] **mbedtls 3.6 PR** provided # | not required because: +- **tests** provided | not required because: ## Notes for the submitter From 6fb557c31a0327f86a8a0dc281d98171931e4762 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Mon, 13 Apr 2026 15:00:44 +0100 Subject: [PATCH 31/46] ChangeLog fix Signed-off-by: Yi Wu --- ChangeLog.d/cmake-destdir-instal.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/cmake-destdir-instal.txt b/ChangeLog.d/cmake-destdir-instal.txt index 6d6e4dc1a7..1638a4bea9 100644 --- a/ChangeLog.d/cmake-destdir-instal.txt +++ b/ChangeLog.d/cmake-destdir-instal.txt @@ -1,3 +1,3 @@ -Feature +Features * Restore DESTDIR support for CMake installs of compatibility libmbedcrypto symlinks. Fixes #10627. From 331ad77fe24c5756e9b3bc658cb5b24e55254148 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Mon, 13 Apr 2026 15:13:52 +0100 Subject: [PATCH 32/46] test: add debug output and fix for win config Signed-off-by: Yi Wu --- tests/scripts/components-build-system.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index 0aba7f7f3b..d901f98090 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -174,15 +174,22 @@ component_test_cmake_install_with_destdir () { install_lib_path="$OUT_OF_SOURCE_DIR/stage/usr/${install_lib_subdir}" - if [[ "$OSTYPE" == linux* ]]; then + if [[ "$OSTYPE" != darwin* ]]; then # library/CMakeLists.txt installs libmbedcrypto.so with a versioned # symlink chain on Linux. for lib in tfpsacrypto mbedcrypto mbedx509 mbedtls; do + if [ "$QUIET" -eq 0 ]; then + echo "Checking lib=$lib" + fi [ -f "$install_lib_path/lib${lib}.a" ] [ -L "$install_lib_path/lib${lib}.so" ] [ -e "$install_lib_path/lib${lib}.so" ] versioned=( "$install_lib_path/lib${lib}.so".* ) - [ -L "${versioned[0]}" ] + if [ "$QUIET" -eq 0 ]; then + declare -p versioned + fi + [ "${#versioned[@]}" -ge 1 ] + # [ -L "${versioned[0]}" ] [ -e "${versioned[0]}" ] done elif [[ "$OSTYPE" == darwin* ]]; then From f38b17e7a0a0e88bd29fccc125ff56f5dfd48d64 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Tue, 14 Apr 2026 10:12:44 +0100 Subject: [PATCH 33/46] test: reorder if-else structure Signed-off-by: Yi Wu --- tests/scripts/components-build-system.sh | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index d901f98090..37764bc1b8 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -174,7 +174,14 @@ component_test_cmake_install_with_destdir () { install_lib_path="$OUT_OF_SOURCE_DIR/stage/usr/${install_lib_subdir}" - if [[ "$OSTYPE" != darwin* ]]; then + if [[ "$OSTYPE" == darwin* ]]; then + # On macOS the custom install logic installs libmbedcrypto.dylib + # directly without a versioned symlink chain. + for lib in tfpsacrypto mbedcrypto mbedx509 mbedtls; do + [ -f "$install_lib_path/lib${lib}.a" ] + [ -e "$install_lib_path/lib${lib}.dylib" ] + done + else # library/CMakeLists.txt installs libmbedcrypto.so with a versioned # symlink chain on Linux. for lib in tfpsacrypto mbedcrypto mbedx509 mbedtls; do @@ -188,19 +195,10 @@ component_test_cmake_install_with_destdir () { if [ "$QUIET" -eq 0 ]; then declare -p versioned fi - [ "${#versioned[@]}" -ge 1 ] - # [ -L "${versioned[0]}" ] + # [ "${#versioned[@]}" -ge 1 ] + [ -L "${versioned[0]}" ] [ -e "${versioned[0]}" ] done - elif [[ "$OSTYPE" == darwin* ]]; then - # On macOS the custom install logic installs libmbedcrypto.dylib - # directly without a versioned symlink chain. - for lib in tfpsacrypto mbedcrypto mbedx509 mbedtls; do - [ -f "$install_lib_path/lib${lib}.a" ] - [ -e "$install_lib_path/lib${lib}.dylib" ] - done - else - echo "Unsupported platform for DESTDIR shared library checks" fi } From 0c02d74a483b9f0e18c04a9fc4186cb243829b09 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Tue, 14 Apr 2026 11:06:16 +0100 Subject: [PATCH 34/46] test: versioned symlink order fix Signed-off-by: Yi Wu --- tests/scripts/components-build-system.sh | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index 37764bc1b8..86519fcd89 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -191,13 +191,21 @@ component_test_cmake_install_with_destdir () { [ -f "$install_lib_path/lib${lib}.a" ] [ -L "$install_lib_path/lib${lib}.so" ] [ -e "$install_lib_path/lib${lib}.so" ] + + # do not assume a fixed match ordering. versioned=( "$install_lib_path/lib${lib}.so".* ) if [ "$QUIET" -eq 0 ]; then declare -p versioned fi - # [ "${#versioned[@]}" -ge 1 ] - [ -L "${versioned[0]}" ] - [ -e "${versioned[0]}" ] + versioned_symlink= + for candidate in "${versioned[@]}"; do + if [ -L "$candidate" ]; then + versioned_symlink="$candidate" + break + fi + done + [ -n "$versioned_symlink" ] + [ -e "$versioned_symlink" ] done fi } From 970df30a8f23b2d0e26a77072bcf08ce6bff017d Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Wed, 15 Apr 2026 11:58:23 +0100 Subject: [PATCH 35/46] test: improve symlink checks Signed-off-by: Yi Wu --- tests/scripts/components-build-system.sh | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index 86519fcd89..bf0262484e 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -192,20 +192,15 @@ component_test_cmake_install_with_destdir () { [ -L "$install_lib_path/lib${lib}.so" ] [ -e "$install_lib_path/lib${lib}.so" ] - # do not assume a fixed match ordering. - versioned=( "$install_lib_path/lib${lib}.so".* ) + # Match ABI-version names such as libxxx.so.17 + # and check that symlink. + versioned=( "$install_lib_path/lib${lib}.so".+([0-9]) ) if [ "$QUIET" -eq 0 ]; then declare -p versioned fi - versioned_symlink= - for candidate in "${versioned[@]}"; do - if [ -L "$candidate" ]; then - versioned_symlink="$candidate" - break - fi - done - [ -n "$versioned_symlink" ] - [ -e "$versioned_symlink" ] + [ "${#versioned[@]}" -eq 1 ] + [ -L "${versioned[0]}" ] + [ -e "${versioned[0]}" ] done fi } From 2168fe9cdaeda70d545307aa60f6f2fc5a43d8fb Mon Sep 17 00:00:00 2001 From: Viktor Sokolovskiy Date: Wed, 15 Apr 2026 20:58:11 +0300 Subject: [PATCH 36/46] ssl: narrow TLS 1.2 RSA-PSS handling and add interop coverage Signed-off-by: Viktor Sokolovskiy --- ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt | 2 +- library/ssl_misc.h | 22 -------- library/ssl_tls12_client.c | 64 +++++++++++++++++++---- tests/ssl-opt.sh | 58 ++++++++++++-------- tests/suites/test_suite_ssl.data | 24 --------- tests/suites/test_suite_ssl.function | 8 --- 6 files changed, 91 insertions(+), 87 deletions(-) diff --git a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt index aea5593e4b..34296b602e 100644 --- a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt +++ b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt @@ -1,4 +1,4 @@ Bugfix * Fix a TLS 1.2 regression that caused clients to reject valid - ServerKeyExchange signatures using RSA-PSS signature scheme values. + ServerKeyExchange signatures using RSA-PSS signature algorithms. Fixes #10668. diff --git a/library/ssl_misc.h b/library/ssl_misc.h index 34d8850c90..f0ca823f33 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -2428,28 +2428,6 @@ static inline int mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg( static inline int mbedtls_ssl_tls12_sig_alg_is_supported( const uint16_t sig_alg) { -#if defined(PSA_WANT_ALG_RSA_PSS) - /* RFC 8446 Section 4.2.3 requires implementations that support RSA-PSS in - * TLS 1.3 to also accept rsa_pss_rsae_* in TLS 1.2. - */ - switch (sig_alg) { -#if defined(PSA_WANT_ALG_SHA_256) - case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA_384) - case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA_512) - case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: - return 1; -#endif - default: - break; - } -#endif /* PSA_WANT_ALG_RSA_PSS */ - /* High byte is hash */ unsigned char hash = MBEDTLS_BYTE_1(sig_alg); unsigned char sig = MBEDTLS_BYTE_0(sig_alg); diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index a0170d51f6..ddd2ad6e44 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -12,6 +12,7 @@ #include "mbedtls/platform.h" #include "mbedtls/ssl.h" +#include "ssl_debug_helpers.h" #include "ssl_client.h" #include "debug_internal.h" #include "mbedtls/error.h" @@ -1742,32 +1743,73 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, { if (mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg(sig_alg, pk_alg, md_alg) != 0) { MBEDTLS_SSL_DEBUG_MSG(1, - ("Server used unsupported value in SigAlg extension 0x%04x", - sig_alg)); + ("Server used unsupported %s signature algorithm", + mbedtls_ssl_sig_alg_to_str(sig_alg))); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* - * mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg() understands sig_alg code points across - * TLS versions. Make sure that the received sig_alg extension is valid in TLS 1.2. + * mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg() understands + * signature algorithm code points from both TLS 1.2 and TLS 1.3. Make sure + * that the selected signature algorithm is acceptable when TLS 1.2 is + * negotiated. + * + * In TLS 1.2, RSA-PSS signature algorithms (rsa_pss_rsae_*) are not + * defined by RFC 5246. However, RFC 8446 Section 4.2.3 requires that + * implementations which advertise support for RSASSA-PSS must be + * prepared to accept such signatures even when TLS 1.2 is negotiated, + * provided they were offered in the signature_algorithms extension. + * + * Therefore, we allow rsa_pss_rsae_* here if: + * - the implementation supports them, and + * - they were offered in the signature_algorithms extension (checked by + * `mbedtls_ssl_sig_alg_is_offered()` below). + * + * If we were to add full support for rsa_pss_rsae_* signature algorithms + * in TLS 1.2 (not defined by RFC 5246; RFC 8446 requires implementations + * that advertise RSASSA-PSS to accept such signatures even when TLS 1.2 + * is negotiated; in practice, several TLS implementations also offer and + * use these algorithms in TLS 1.2-only configurations), we should then + * integrate RSA-PSS into the TLS 1.2 signature algorithm support logic + * (`mbedtls_ssl_tls12_sig_alg_is_supported()`) instead of handling it as a + * special case here. */ if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { - MBEDTLS_SSL_DEBUG_MSG(1, - ("Server used unsupported value in SigAlg extension 0x%04x", - sig_alg)); - return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; + switch (sig_alg) { +#if defined(PSA_WANT_ALG_RSA_PSS) +#if defined(PSA_WANT_ALG_SHA_256) + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: + break; +#endif +#if defined(PSA_WANT_ALG_SHA_384) + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: + break; +#endif +#if defined(PSA_WANT_ALG_SHA_512) + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: + break; +#endif +#endif /* PSA_WANT_ALG_RSA_PSS */ + default: + MBEDTLS_SSL_DEBUG_MSG(1, + ("Server used unsupported %s signature algorithm", + mbedtls_ssl_sig_alg_to_str(sig_alg))); + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; + } } /* * Check if the signature algorithm is acceptable */ if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value 0x%04x that was not offered", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, + ("Server used the signature algorithm %s that was not offered", + mbedtls_ssl_sig_alg_to_str(sig_alg))); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } - MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", sig_alg & 0x00FF)); - MBEDTLS_SSL_DEBUG_MSG(2, ("Server used HashAlgorithm %d", sig_alg >> 8)); + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used the signature algorithm %s", + mbedtls_ssl_sig_alg_to_str(sig_alg))); return 0; } diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 123eb72328..4a4ee4d1ef 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -13938,27 +13938,6 @@ run_test "TLS 1.2: Check rsa_pss_rsae compatibility issue, m->O" \ -c "Protocol is TLSv1.2" \ -c "HTTP/1.0 200 [Oo][Kk]" -requires_openssl_tls1_3_with_compatible_ephemeral -requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 -requires_config_enabled MBEDTLS_DEBUG_C -requires_config_enabled MBEDTLS_SSL_CLI_C -requires_config_enabled PSA_WANT_ALG_RSA_PSS -requires_config_enabled PSA_WANT_ALG_SHA_256 -run_test "TLS 1.2: OpenSSL chooses rsa_pss_rsae_sha256 for SKE, m->O" \ - "$O_NEXT_SRV_NO_CERT -cert $DATA_FILES_PATH/server2-sha256.crt -key $DATA_FILES_PATH/server2.key - -msg -tls1_2 - -sigalgs rsa_pss_rsae_sha256 " \ - "$P_CLI debug_level=4 auth_mode=none ca_file=none ca_path=none crt_file=none key_file=none - sig_algs=rsa_pss_rsae_sha256 - min_version=tls12 max_version=tls12 " \ - 0 \ - -c "Perform .* computation of digest of ServerKeyExchange" \ - -c "got signature scheme \\[804\\] rsa_pss_rsae_sha256" \ - -c "Ciphersuite is TLS-ECDHE-RSA" \ - -c "Protocol is TLSv1.2" \ - -c "HTTP/1.0 200 [Oo][Kk]" - - requires_gnutls_tls1_3 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 requires_config_enabled MBEDTLS_DEBUG_C @@ -13974,6 +13953,43 @@ run_test "TLS 1.2: Check rsa_pss_rsae compatibility issue, m->G" \ -c "Protocol is TLSv1.2" \ -c "HTTP/1.0 200 [Oo][Kk]" +requires_openssl_tls1_3_with_compatible_ephemeral +requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 +requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 +requires_config_enabled MBEDTLS_DEBUG_C +requires_config_enabled MBEDTLS_SSL_CLI_C +requires_config_enabled PSA_WANT_ALG_RSA_PSS +requires_config_enabled PSA_WANT_ALG_SHA_256 +run_test "TLS 1.2: Server forces TLS 1.2 and rsa_pss_rsae_sha256, m->O" \ + "$O_NEXT_SRV_NO_CERT -cert $DATA_FILES_PATH/server2-sha256.crt -key $DATA_FILES_PATH/server2.key + -tls1_2 -sigalgs rsa_pss_rsae_sha256 " \ + "$P_CLI debug_level=3" \ + 0 \ + -c "sent signature scheme \\[804\\] rsa_pss_rsae_sha256" \ + -c "Perform .* computation of digest of ServerKeyExchange" \ + -c "Server used the signature algorithm rsa_pss_rsae_sha256" \ + -c "Protocol is TLSv1.2" \ + -c "HTTP/1.0 200 [Oo][Kk]" + +requires_gnutls_tls1_3 +requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2 +requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 +requires_config_enabled MBEDTLS_DEBUG_C +requires_config_enabled MBEDTLS_SSL_CLI_C +requires_config_enabled PSA_WANT_ALG_RSA_PSS +requires_config_enabled PSA_WANT_ALG_SHA_256 +run_test "TLS 1.2: Server forces TLS 1.2 and rsa_pss_rsae_sha256, m->G" \ + "$G_NEXT_SRV_NO_CERT --x509certfile $DATA_FILES_PATH/server2-sha256.crt --x509keyfile $DATA_FILES_PATH/server2.key + --disable-client-cert + --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:-SIGN-ALL:+SIGN-RSA-PSS-RSAE-SHA256" \ + "$P_CLI debug_level=3" \ + 0 \ + -c "sent signature scheme \\[804\\] rsa_pss_rsae_sha256" \ + -c "Perform .* computation of digest of ServerKeyExchange" \ + -c "Server used the signature algorithm rsa_pss_rsae_sha256" \ + -c "Protocol is TLSv1.2" \ + -c "HTTP/1.0 200 [Oo][Kk]" + requires_config_enabled MBEDTLS_SSL_SRV_C requires_config_enabled MBEDTLS_DEBUG_C requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 0d8b95cc0d..881d502ed5 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3549,27 +3549,3 @@ send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:0 Negative Test: Server using sig_alg not offered by the client - ECDSA with SHA512 depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:PSA_WANT_ALG_SHA_512 send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER - -TLS 1.2 accepts rsa_pss_rsae_sha256 in signature_algorithm -depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_256 -ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:1 - -TLS 1.2 rejects rsa_pss_rsae_sha256 in signature_algorithm when RSA-PSS is disabled -depends_on:!PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_256 -ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:0 - -TLS 1.2 accepts rsa_pss_rsae_sha384 in signature_algorithm -depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_384 -ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:1 - -TLS 1.2 rejects rsa_pss_rsae_sha384 in signature_algorithm when RSA-PSS is disabled -depends_on:!PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_384 -ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:0 - -TLS 1.2 accepts rsa_pss_rsae_sha512 in signature_algorithm -depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_512 -ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:1 - -TLS 1.2 rejects rsa_pss_rsae_sha512 in signature_algorithm when RSA-PSS is disabled -depends_on:!PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_512 -ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:0 diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 1efd38a7fb..39457c9047 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5853,14 +5853,6 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */ -void ssl_tls12_sig_alg_supported(int sig_alg, int expected) -{ - TEST_EQUAL(mbedtls_ssl_tls12_sig_alg_is_supported((uint16_t) sig_alg), - expected); -} -/* END_CASE */ - /* BEGIN_CASE depends_on:MBEDTLS_SSL_KEYING_MATERIAL_EXPORT:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */ void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int use_context) { From a3d3ede9d635ac18b59c069ed0472b8880f34609 Mon Sep 17 00:00:00 2001 From: valord577 Date: Thu, 16 Apr 2026 14:31:55 +0800 Subject: [PATCH 37/46] Fix build warning/error using llvm-mingw error logs refs: https://github.com/valord577/nativepkgs/actions/runs/24490614774/job/71574726128 Signed-off-by: valord577 --- include/mbedtls/debug.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/mbedtls/debug.h b/include/mbedtls/debug.h index b8273bc757..8cd101cbf4 100644 --- a/include/mbedtls/debug.h +++ b/include/mbedtls/debug.h @@ -59,7 +59,7 @@ */ #if defined(__has_attribute) #if __has_attribute(format) -#if defined(__MINGW32__) +#if defined(__MINGW32__) && !defined(__clang__) #define MBEDTLS_PRINTF_ATTRIBUTE(string_index, first_to_check) \ __attribute__((__format__(gnu_printf, string_index, first_to_check))) #else /* defined(__MINGW32__) */ From 37b81f13c736d89dbd66672cc102e780d000a7a1 Mon Sep 17 00:00:00 2001 From: valord577 Date: Thu, 16 Apr 2026 15:17:32 +0800 Subject: [PATCH 38/46] add ChangeLog Signed-off-by: valord577 --- ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt diff --git a/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt b/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt new file mode 100644 index 0000000000..1ea2e6af29 --- /dev/null +++ b/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt @@ -0,0 +1,4 @@ +Bugfix + * Fix a build error using the LLVM based MinGW toolchain. + Bug reported and fix contributed by valord577. + Fixes #10695. From 3d61c38ea0e5b4584672f6b33fb75b4176f0bc01 Mon Sep 17 00:00:00 2001 From: Viktor Sokolovskiy Date: Fri, 17 Apr 2026 17:11:12 +0300 Subject: [PATCH 39/46] ssl: add TLS 1.2 RSA-PSS debug trace Signed-off-by: Viktor Sokolovskiy --- library/ssl_tls12_client.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index ddd2ad6e44..6d4b0f2149 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1779,14 +1779,17 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, #if defined(PSA_WANT_ALG_RSA_PSS) #if defined(PSA_WANT_ALG_SHA_256) case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: - break; #endif #if defined(PSA_WANT_ALG_SHA_384) case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: - break; #endif #if defined(PSA_WANT_ALG_SHA_512) case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: +#endif +#if defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA_384) || defined(PSA_WANT_ALG_SHA_512) + MBEDTLS_SSL_DEBUG_MSG(3, + ("Accepting TLS 1.2 RSA-PSS signature algorithm %s via compatibility exception", + mbedtls_ssl_sig_alg_to_str(sig_alg))); break; #endif #endif /* PSA_WANT_ALG_RSA_PSS */ From 935eb1a53ba8840e5025495db305cbffb4944900 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Fri, 17 Apr 2026 16:59:05 +0100 Subject: [PATCH 40/46] ChangeLog: Fixed a reference to TF-PSA-Crypto Signed-off-by: Minos Galanakis --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 12191e1116..b7a79ce348 100644 --- a/ChangeLog +++ b/ChangeLog @@ -143,7 +143,7 @@ Removals in favour of mbedtls_ssl_conf_groups() since Mbed TLS 3.1. * Remove support for the DHE-PSK key exchange in TLS 1.2. * Remove support for the DHE-RSA key exchange in TLS 1.2. - * Following the removal of DHM module (#9972 and TF-PSA-Crypto#175) the + * Following the removal of DHM module (#9972 and Mbed-TLS/TF-PSA-Crypto#175) the following SSL functions are removed: - mbedtls_ssl_conf_dh_param_bin - mbedtls_ssl_conf_dh_param_ctx From f90e81c7f883bfdf0a68dc50d781d19f25136921 Mon Sep 17 00:00:00 2001 From: Viktor Sokolovskiy Date: Sat, 18 Apr 2026 01:48:35 +0300 Subject: [PATCH 41/46] Pacify uncrustify Signed-off-by: Viktor Sokolovskiy --- library/ssl_tls12_client.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 6d4b0f2149..c101ccd91e 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1787,10 +1787,11 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: #endif #if defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA_384) || defined(PSA_WANT_ALG_SHA_512) - MBEDTLS_SSL_DEBUG_MSG(3, - ("Accepting TLS 1.2 RSA-PSS signature algorithm %s via compatibility exception", - mbedtls_ssl_sig_alg_to_str(sig_alg))); - break; + MBEDTLS_SSL_DEBUG_MSG(3, + ( + "Accepting TLS 1.2 RSA-PSS signature algorithm %s via compatibility exception", + mbedtls_ssl_sig_alg_to_str(sig_alg))); + break; #endif #endif /* PSA_WANT_ALG_RSA_PSS */ default: From 68319cbc80bff1a29221de05a7c4dd210a0ead41 Mon Sep 17 00:00:00 2001 From: valord577 Date: Wed, 22 Apr 2026 11:05:04 +0800 Subject: [PATCH 42/46] update ChangeLog Signed-off-by: valord577 --- ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt | 1 - 1 file changed, 1 deletion(-) diff --git a/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt b/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt index 1ea2e6af29..3fed87143f 100644 --- a/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt +++ b/ChangeLog.d/pr_10695__fix_build_llvm_mingw.txt @@ -1,4 +1,3 @@ Bugfix * Fix a build error using the LLVM based MinGW toolchain. Bug reported and fix contributed by valord577. - Fixes #10695. From 5ea77200d9321ff72c96d17adbd475131b37440a Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 21 Apr 2026 12:12:17 +0200 Subject: [PATCH 43/46] check_config: add check for TLS 1.3 key exchanges When MBEDTLS_SSL_PROTO_TLS1_3 is enabled ensure that at least one of the related key exchanges is also enabled. Signed-off-by: Valerio Setti --- library/mbedtls_check_config.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/library/mbedtls_check_config.h b/library/mbedtls_check_config.h index f6ca813a37..bf0e35787c 100644 --- a/library/mbedtls_check_config.h +++ b/library/mbedtls_check_config.h @@ -142,6 +142,15 @@ "but no key exchange methods defined with MBEDTLS_KEY_EXCHANGE_xxxx" #endif +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ + !(defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) || \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) ) +#error "TLS 1.3 protocol is enabled but no key exchange method is defined" \ + "with MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_xxxx" +#endif + + #if defined(MBEDTLS_SSL_EARLY_DATA) && \ ( !defined(MBEDTLS_SSL_SESSION_TICKETS) || \ ( !defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) && \ From c3d52b905b6b8cf58f248088a19aaa61a27c6a97 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Tue, 21 Apr 2026 12:14:01 +0200 Subject: [PATCH 44/46] check_config: fix error message for missing TLS 1.2 key exchanges Align the error message to the one used for the same check in TLS 1.3. Signed-off-by: Valerio Setti --- library/mbedtls_check_config.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/mbedtls_check_config.h b/library/mbedtls_check_config.h index bf0e35787c..629e6a1909 100644 --- a/library/mbedtls_check_config.h +++ b/library/mbedtls_check_config.h @@ -138,8 +138,8 @@ defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \ defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \ defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) ) -#error "One or more versions of the TLS protocol are enabled " \ - "but no key exchange methods defined with MBEDTLS_KEY_EXCHANGE_xxxx" +#error "TLS 1.2 protocol is enabled but no key exchange method is defined" \ + "with MBEDTLS_KEY_EXCHANGE_xxxx" #endif #if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ From 02fb4c75cb4e363437f3ed6d938680868b007a4c Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 7 May 2026 08:10:23 +0100 Subject: [PATCH 45/46] Update framework pointer to bring in fix for python imports Signed-off-by: Ben Taylor --- framework | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/framework b/framework index c6610dde67..e92a819966 160000 --- a/framework +++ b/framework @@ -1 +1 @@ -Subproject commit c6610dde67ffd2a3a81cc204a73572b9c31a5775 +Subproject commit e92a81996656d82941a9afce843453c57e1d51f5 From 954e2365004667468ea7dcff42c5f05b55af661b Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 7 May 2026 14:17:54 +0100 Subject: [PATCH 46/46] Update tf-psa-crypto pointer to bring in fix for python imports Signed-off-by: Ben Taylor --- tf-psa-crypto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tf-psa-crypto b/tf-psa-crypto index 8c29e401e9..93fa04691f 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 8c29e401e9c1a3180a1eca6aed13958453276550 +Subproject commit 93fa04691f6d5628f51a369953856bf5bf75d31f