From 902762039334c91813ab9e9ba8ccef5356e819e4 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 21 Apr 2026 16:46:31 +0100 Subject: [PATCH 01/10] tls13_client: fix HRR selected_group validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reject HRR selected_group unless it matches the client’s original supported_groups and is locally supported, so unadvertised groups are not accepted in the second ClientHello. Signed-off-by: Minos Galanakis --- library/ssl_tls13_client.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index b7b075cc97..167861e33a 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -404,14 +404,18 @@ static int ssl_tls13_parse_hrr_key_share_ext(mbedtls_ssl_context *ssl, * then the client MUST abort the handshake with an "illegal_parameter" alert. */ for (; *group_list != 0; group_list++) { + if (*group_list != selected_group) { + continue; + } #if defined(PSA_WANT_ALG_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list)) { - if ((mbedtls_ssl_get_psa_curve_info_from_tls_id( - *group_list, NULL, NULL) == PSA_ERROR_NOT_SUPPORTED) || - *group_list != selected_group) { - found = 1; - break; + if (mbedtls_ssl_get_psa_curve_info_from_tls_id( + *group_list, NULL, NULL) == PSA_ERROR_NOT_SUPPORTED) { + continue; } + /* Found only if psa_curve is supported and group_list == selected_group */ + found = 1; + break; } #endif /* PSA_WANT_ALG_ECDH */ #if defined(PSA_WANT_ALG_FFDH) From a9a838574748885daa01136fc56eb5fd26456b48 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 23 Apr 2026 13:53:40 +0100 Subject: [PATCH 02/10] test_suite_ssl: Introduced hrr_reject_unadvertised_group Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.data | 3 ++ tests/suites/test_suite_ssl.function | 77 ++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 6b9c73f11e..154f568d3b 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3347,6 +3347,9 @@ cookie_parsing:"16fefd0000000000000000002F010000de000000000000011efefd7b72727272 TLS 1.3 srv Certificate msg - wrong vector lengths tls13_server_certificate_msg_invalid_vector_len +TLS 1.3 cli rejects HRR selected_group not in original supported_groups +hrr_reject_unadvertised_group + EC-JPAKE set password depends_on:MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED ssl_ecjpake_set_password:0 diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index d27d959232..82bb2e1db1 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3995,6 +3995,83 @@ exit: } /* END_CASE */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_ECDH:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ +void hrr_reject_unadvertised_group(void) +{ + int ret = -1; + + mbedtls_test_ssl_endpoint client_ep, server_ep; + mbedtls_test_handshake_test_options client_options, server_options; + + uint16_t offered_group_before_hrr_parse = 0; + uint16_t offered_group_after_hrr_parse = 0; + + /* Group order is intentional: client offers secp256r1 first, while server only + * accepts secp384r1. This prevents immediate group agreement and forces HRR. */ + uint16_t client_group_list[] = { + MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, + MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1, + MBEDTLS_SSL_IANA_TLS_GROUP_NONE + }; + uint16_t server_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1, + MBEDTLS_SSL_IANA_TLS_GROUP_NONE }; + + memset(&client_ep, 0, sizeof(client_ep)); + memset(&server_ep, 0, sizeof(server_ep)); + + mbedtls_test_init_handshake_options(&client_options); + mbedtls_test_init_handshake_options(&server_options); + MD_OR_USE_PSA_INIT(); + + client_options.pk_alg = MBEDTLS_PK_ECDSA; + client_options.client_min_version = MBEDTLS_SSL_VERSION_TLS1_3; + client_options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_3; + client_options.group_list = client_group_list; + + server_options.pk_alg = MBEDTLS_PK_ECDSA; + server_options.server_min_version = MBEDTLS_SSL_VERSION_TLS1_3; + server_options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_3; + server_options.group_list = server_group_list; + + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, + &client_options), 0); + + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, + &server_options), 0); + + TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 4096), 0); + + ret = mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + MBEDTLS_SSL_HELLO_RETRY_REQUEST); + TEST_EQUAL(ret, 0); + + server_ep.ssl.handshake->hrr_selected_group = MBEDTLS_SSL_IANA_TLS_GROUP_X25519; + TEST_EQUAL(mbedtls_ssl_handshake_step(&(server_ep.ssl)), 0); + + /* Push the HRR with unadvertised group into the wire*/ + TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0); + + offered_group_before_hrr_parse = client_ep.ssl.handshake->offered_group_id; + + /* Client should reject malformed selected_group with illegal_parameter. */ + TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); + + /* The server send a non advertised group during HRR. Client shouldnt accept it as offered_group_id */ + offered_group_after_hrr_parse = client_ep.ssl.handshake->offered_group_id; + TEST_EQUAL(offered_group_after_hrr_parse, offered_group_before_hrr_parse); + + +exit: + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_free_handshake_options(&client_options); + mbedtls_test_free_handshake_options(&server_options); + MD_OR_USE_PSA_DONE(); +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ void ssl_ecjpake_set_password(int use_opaque_arg) { From 89a06061183f297ff5c9652745752fe7de53a15e Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 27 Apr 2026 12:25:32 +0100 Subject: [PATCH 03/10] Adjusted dependecies for hrr_reject_unadvertised_group Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 82bb2e1db1..aa36e36b75 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3995,7 +3995,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_ECDH:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_ECDH:PSA_WANT_ALG_ECDSA_ANY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ void hrr_reject_unadvertised_group(void) { int ret = -1; From 5936ba523da2efbb4674f585662cfa9cef8dc449 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 12 May 2026 14:59:18 +0100 Subject: [PATCH 04/10] Added ChangeLog Signed-off-by: Minos Galanakis --- ChangeLog.d/tls13-hrr-selected-group.txt | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 ChangeLog.d/tls13-hrr-selected-group.txt diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt new file mode 100644 index 0000000000..20d7a18fbd --- /dev/null +++ b/ChangeLog.d/tls13-hrr-selected-group.txt @@ -0,0 +1,5 @@ +Security + * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was + not advertised in the original ClientHello. Reported by + Din Asotić / Xiangdong Li, Beijing University of Posts and + Telecommunications (BUPT) From 848ddaaedb4133ab34f473b76bf330ecec774b47 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 13 May 2026 11:33:40 +0100 Subject: [PATCH 05/10] test_suite_ssl: doc fixes Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index aa36e36b75..91040203d5 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4058,7 +4058,7 @@ void hrr_reject_unadvertised_group(void) /* Client should reject malformed selected_group with illegal_parameter. */ TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); - /* The server send a non advertised group during HRR. Client shouldnt accept it as offered_group_id */ + /* The server sends a non-advertised group during HRR. Client shouldn't accept it as offered_group_id */ offered_group_after_hrr_parse = client_ep.ssl.handshake->offered_group_id; TEST_EQUAL(offered_group_after_hrr_parse, offered_group_before_hrr_parse); From 7a232d0822ad20da952fff4f3b3cf4f5b5e3b149 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 19 May 2026 17:31:47 +0100 Subject: [PATCH 06/10] sll_client: align TLS 1.3 supported_groups filtering with PSA curve support Signed-off-by: Minos Galanakis --- library/ssl_client.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/library/ssl_client.c b/library/ssl_client.c index 6fe6dd8fe6..7f0bb7d937 100644 --- a/library/ssl_client.c +++ b/library/ssl_client.c @@ -208,6 +208,9 @@ static int ssl_write_alpn_ext(mbedtls_ssl_context *ssl, * generalization of the TLS 1.2 supported elliptic curves extension. They both * share the same extension identifier. * + * If the TLS 1.3 logic for selecting proposed groups changes, the TLS 1.3 + * group filtering in this function must be kept in sync. + * */ #define SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_2_FLAG 1 #define SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_3_FLAG 2 @@ -251,8 +254,8 @@ static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl, if (flags & SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_3_FLAG) { #if defined(PSA_WANT_ALG_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list) && - (mbedtls_ssl_get_ecp_group_id_from_tls_id(*group_list) != - MBEDTLS_ECP_DP_NONE)) { + mbedtls_ssl_get_psa_curve_info_from_tls_id( + *group_list, NULL, NULL) == PSA_SUCCESS) { propose_group = 1; } #endif From 3d3de630dbc297378c4ae471531c3a60b4b1c2c9 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 19 May 2026 17:36:12 +0100 Subject: [PATCH 07/10] test_suite_ssl: Renamed hrr_reject_selecting_unoffered_group Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.data | 4 ++-- tests/suites/test_suite_ssl.function | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 154f568d3b..8d762bc801 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3347,8 +3347,8 @@ cookie_parsing:"16fefd0000000000000000002F010000de000000000000011efefd7b72727272 TLS 1.3 srv Certificate msg - wrong vector lengths tls13_server_certificate_msg_invalid_vector_len -TLS 1.3 cli rejects HRR selected_group not in original supported_groups -hrr_reject_unadvertised_group +TLS 1.3 cli rejects HRR selecting an un-offered group +reject_hrr_selecting_unoffered_group EC-JPAKE set password depends_on:MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 91040203d5..3d53cbb414 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3996,7 +3996,7 @@ exit: /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_ECDH:PSA_WANT_ALG_ECDSA_ANY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ -void hrr_reject_unadvertised_group(void) +void reject_hrr_selecting_unoffered_group(void) { int ret = -1; From 95ad8b45ed23f17a28e39ae4aa6819cc6e5fa0c7 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 19 May 2026 22:12:05 +0100 Subject: [PATCH 08/10] test_suite_ssl: Restructured reject_hrr_selecting_unoffered_group Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 75 ++++++++++++++++++---------- 1 file changed, 49 insertions(+), 26 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 3d53cbb414..7547b60ebb 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4002,9 +4002,7 @@ void reject_hrr_selecting_unoffered_group(void) mbedtls_test_ssl_endpoint client_ep, server_ep; mbedtls_test_handshake_test_options client_options, server_options; - - uint16_t offered_group_before_hrr_parse = 0; - uint16_t offered_group_after_hrr_parse = 0; + mbedtls_test_ssl_log_pattern cli_pattern = { .pattern = "Invalid key share in HRR" }; /* Group order is intentional: client offers secp256r1 first, while server only * accepts secp384r1. This prevents immediate group agreement and forces HRR. */ @@ -4027,47 +4025,72 @@ void reject_hrr_selecting_unoffered_group(void) client_options.client_min_version = MBEDTLS_SSL_VERSION_TLS1_3; client_options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_3; client_options.group_list = client_group_list; + client_options.cli_log_obj = &cli_pattern; + client_options.cli_log_fun = mbedtls_test_ssl_log_analyzer; + mbedtls_debug_set_threshold(1); server_options.pk_alg = MBEDTLS_PK_ECDSA; server_options.server_min_version = MBEDTLS_SSL_VERSION_TLS1_3; server_options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_3; server_options.group_list = server_group_list; - TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, - &client_options), 0); + for (int round = 0; round < 2; round++) { + int select_unoffered_group = (round != 0); + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, + MBEDTLS_SSL_IS_CLIENT, + &client_options), 0); - TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, - &server_options), 0); + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, + MBEDTLS_SSL_IS_SERVER, + &server_options), 0); - TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), - &(server_ep.socket), 4096), 0); + TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 4096), 0); - ret = mbedtls_test_move_handshake_to_state( - &(server_ep.ssl), &(client_ep.ssl), - MBEDTLS_SSL_HELLO_RETRY_REQUEST); - TEST_EQUAL(ret, 0); + ret = mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + MBEDTLS_SSL_HELLO_RETRY_REQUEST); + TEST_EQUAL(ret, 0); + TEST_EQUAL(client_ep.ssl.handshake->offered_group_id, + MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1); - server_ep.ssl.handshake->hrr_selected_group = MBEDTLS_SSL_IANA_TLS_GROUP_X25519; - TEST_EQUAL(mbedtls_ssl_handshake_step(&(server_ep.ssl)), 0); + if (!select_unoffered_group) { + TEST_EQUAL(server_ep.ssl.handshake->hrr_selected_group, + MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1); + } else { + server_ep.ssl.handshake->hrr_selected_group = MBEDTLS_SSL_IANA_TLS_GROUP_X25519; + } - /* Push the HRR with unadvertised group into the wire*/ - TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0); - - offered_group_before_hrr_parse = client_ep.ssl.handshake->offered_group_id; - - /* Client should reject malformed selected_group with illegal_parameter. */ - TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); - - /* The server sends a non-advertised group during HRR. Client shouldn't accept it as offered_group_id */ - offered_group_after_hrr_parse = client_ep.ssl.handshake->offered_group_id; - TEST_EQUAL(offered_group_after_hrr_parse, offered_group_before_hrr_parse); + /* Write and send the HRR */ + TEST_EQUAL(mbedtls_ssl_handshake_step(&(server_ep.ssl)), 0); + TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0); + if (!select_unoffered_group) { + /* Valid HRR, the client accepts the group MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 + * and goes ahead with the handshake. + */ + TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), 0); + TEST_ASSERT(client_ep.ssl.state != MBEDTLS_SSL_SERVER_HELLO); + TEST_EQUAL(cli_pattern.counter, 0); + } else { + /* Invalid HRR selecting MBEDTLS_SSL_IANA_TLS_GROUP_X25519 group. + * The client rejects it and aborts the handshake. + */ + TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), + MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); + TEST_EQUAL(client_ep.ssl.state, MBEDTLS_SSL_SERVER_HELLO); + TEST_EQUAL(cli_pattern.counter, 1); + } + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + } exit: mbedtls_test_ssl_endpoint_free(&client_ep); mbedtls_test_ssl_endpoint_free(&server_ep); mbedtls_test_free_handshake_options(&client_options); mbedtls_test_free_handshake_options(&server_options); + mbedtls_debug_set_threshold(0); MD_OR_USE_PSA_DONE(); } /* END_CASE */ From 84667a048f2d9d85402c8f8c75b90c8a169a0c3e Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 20 May 2026 12:25:42 +0100 Subject: [PATCH 09/10] test_suite_ssl: Added MBEDTLS_DEBUG_C guards to logs Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 7547b60ebb..0c176f1224 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4002,7 +4002,9 @@ void reject_hrr_selecting_unoffered_group(void) mbedtls_test_ssl_endpoint client_ep, server_ep; mbedtls_test_handshake_test_options client_options, server_options; +#if defined(MBEDTLS_DEBUG_C) mbedtls_test_ssl_log_pattern cli_pattern = { .pattern = "Invalid key share in HRR" }; +#endif /* MBEDTLS_DEBUG_C */ /* Group order is intentional: client offers secp256r1 first, while server only * accepts secp384r1. This prevents immediate group agreement and forces HRR. */ @@ -4025,9 +4027,11 @@ void reject_hrr_selecting_unoffered_group(void) client_options.client_min_version = MBEDTLS_SSL_VERSION_TLS1_3; client_options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_3; client_options.group_list = client_group_list; +#if defined(MBEDTLS_DEBUG_C) client_options.cli_log_obj = &cli_pattern; client_options.cli_log_fun = mbedtls_test_ssl_log_analyzer; mbedtls_debug_set_threshold(1); +#endif /* MBEDTLS_DEBUG_C */ server_options.pk_alg = MBEDTLS_PK_ECDSA; server_options.server_min_version = MBEDTLS_SSL_VERSION_TLS1_3; @@ -4071,7 +4075,9 @@ void reject_hrr_selecting_unoffered_group(void) */ TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), 0); TEST_ASSERT(client_ep.ssl.state != MBEDTLS_SSL_SERVER_HELLO); +#if defined(MBEDTLS_DEBUG_C) TEST_EQUAL(cli_pattern.counter, 0); +#endif /* MBEDTLS_DEBUG_C */ } else { /* Invalid HRR selecting MBEDTLS_SSL_IANA_TLS_GROUP_X25519 group. * The client rejects it and aborts the handshake. @@ -4079,7 +4085,9 @@ void reject_hrr_selecting_unoffered_group(void) TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); TEST_EQUAL(client_ep.ssl.state, MBEDTLS_SSL_SERVER_HELLO); +#if defined(MBEDTLS_DEBUG_C) TEST_EQUAL(cli_pattern.counter, 1); +#endif /* MBEDTLS_DEBUG_C */ } mbedtls_test_ssl_endpoint_free(&client_ep); mbedtls_test_ssl_endpoint_free(&server_ep); @@ -4090,7 +4098,9 @@ exit: mbedtls_test_ssl_endpoint_free(&server_ep); mbedtls_test_free_handshake_options(&client_options); mbedtls_test_free_handshake_options(&server_options); +#if defined(MBEDTLS_DEBUG_C) mbedtls_debug_set_threshold(0); +#endif /* MBEDTLS_DEBUG_C */ MD_OR_USE_PSA_DONE(); } /* END_CASE */ From e2a6f05640528b1eff715824f3d931b81e7c911d Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 26 May 2026 10:17:11 +0100 Subject: [PATCH 10/10] ssl_write_supported_groups_ext: Updated documentation Signed-off-by: Minos Galanakis --- library/ssl_client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/library/ssl_client.c b/library/ssl_client.c index 7f0bb7d937..354fe9b72b 100644 --- a/library/ssl_client.c +++ b/library/ssl_client.c @@ -209,7 +209,8 @@ static int ssl_write_alpn_ext(mbedtls_ssl_context *ssl, * share the same extension identifier. * * If the TLS 1.3 logic for selecting proposed groups changes, the TLS 1.3 - * group filtering in this function must be kept in sync. + * group filtering in the function `ssl_tls13_parse_hrr_key_share_ext()` must + * be updated accordingly. * */ #define SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_2_FLAG 1