coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Test DTLS renegotiation when badmac_seen_or_in_hsfraglen != 0

Browse Source 
Non-regression test for a bug introduced with TLS handshake defragmentation
support in Mbed TLS 3.6.3, whereby the confusion between the `badmac_seen`
meaning and the `in_hsfraglen` meaning of `ssl->badmac_seen_or_in_hsfraglen`
causes renegotiation to be processed incorrectly after receiving a message
with a bad MAC.

The bug doesn't affect Mbed TLS 4.0.0 and above, but it's still good to have
more testing.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2026-06-03 15:44:08 +02:00
parent 21df158961
commit 3e76e77ee2
2 changed files with 36 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
tests/suites/test_suite_ssl.data
View File

@ -548,13 +548,19 @@ Sending app data via DTLS, without MFL and with fragmentation
app_data_dtls:MBEDTLS_SSL_MAX_FRAG_LEN_NONE:16385:100000:0:0
DTLS renegotiation: no legacy renegotiation
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:-1
DTLS renegotiation: legacy renegotiation
renegotiation:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION
renegotiation:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION:-1
DTLS renegotiation: legacy break handshake
renegotiation:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE
renegotiation:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE:-1
DTLS renegotiation: after bad MAC on client
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:MBEDTLS_SSL_IS_CLIENT
DTLS renegotiation: after bad MAC on server
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:MBEDTLS_SSL_IS_SERVER
DTLS serialization with MFL=512
resize_buffers_serialize_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_512

28
tests/suites/test_suite_ssl.function
View File

@ -109,6 +109,30 @@ static void resize_buffers(int mfl, int renegotiation, int legacy_renegotiation,
#define TEST_GCM_OR_CHACHAPOLY_ENABLED
#endif
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \
defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
defined(PSA_HAVE_ALG_SOME_RSA_SIGN) && \
defined(PSA_WANT_ECC_SECP_R1_384) && \
defined(MBEDTLS_SSL_PROTO_DTLS) && \
defined(MBEDTLS_SSL_RENEGOTIATION) && \
defined(PSA_WANT_ALG_SHA_256) && \
defined(MBEDTLS_CAN_HANDLE_RSA_TEST_KEY)
static void simulate_badmac_seen_on(mbedtls_test_ssl_endpoint *client,
mbedtls_test_ssl_endpoint *server,
void *param)
{
int on = *(int *) param;
switch (on) {
case MBEDTLS_SSL_IS_CLIENT:
client->ssl.badmac_seen = 1;
break;
case MBEDTLS_SSL_IS_SERVER:
server->ssl.badmac_seen = 1;
break;
}
}
#endif
typedef enum {
RECOMBINE_NOMINAL, /* param: ignored */
RECOMBINE_SPLIT_FIRST, /* param: offset of split (<=0 means from end) */
@ -3333,7 +3357,7 @@ exit:
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_PROTO_TLS1_2:PSA_HAVE_ALG_SOME_RSA_SIGN:PSA_WANT_ECC_SECP_R1_384:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:PSA_WANT_ALG_SHA_256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void renegotiation(int legacy_renegotiation)
void renegotiation(int legacy_renegotiation, int badmac_seen_on)
{
mbedtls_test_handshake_test_options options;
mbedtls_test_init_handshake_options(&options);
@ -3342,6 +3366,8 @@ void renegotiation(int legacy_renegotiation)
options.legacy_renegotiation = legacy_renegotiation;
options.dtls = 1;
options.expected_negotiated_version = MBEDTLS_SSL_VERSION_TLS1_2;
options.post_data_fun = &simulate_badmac_seen_on;
options.post_data_param = &badmac_seen_on;
mbedtls_test_ssl_perform_handshake(&options);