coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10815 from Mbed-TLS/mbedtls-3.6.7_mergeback

Browse Source 
Mbedtls 3.6.7 mergeback
This commit is contained in:
Ronald Cron 2026-07-08 13:15:28 +00:00 committed by GitHub
commit 8572c4a99b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
83 changed files with 4189 additions and 6938 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
3rdparty/everest/library/x25519.c vendored
View File

@ -131,12 +131,16 @@ int mbedtls_x25519_calc_secret( mbedtls_x25519_context *ctx, size_t *olen,
if( blen < *olen )
return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
Hacl_Curve25519_crypto_scalarmult( buf, ctx->our_secret, ctx->peer_point);
/* scalarmult modifies this input, let's make a copy... */
unsigned char secret[MBEDTLS_X25519_KEY_SIZE_BYTES];
memcpy(secret, ctx->our_secret, sizeof(secret));
/* Wipe the DH secret and don't let the peer chose a small subgroup point */
mbedtls_platform_zeroize( ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES );
Hacl_Curve25519_crypto_scalarmult( buf, secret, ctx->peer_point);
if( memcmp( buf, ctx->our_secret, MBEDTLS_X25519_KEY_SIZE_BYTES) == 0 )
/* Wipe the copy and don't let the peer choose a small subgroup point */
mbedtls_platform_zeroize( secret, MBEDTLS_X25519_KEY_SIZE_BYTES );
if( memcmp( buf, secret, MBEDTLS_X25519_KEY_SIZE_BYTES) == 0 )
return MBEDTLS_ERR_ECP_RANDOM_FAILED;
return( 0 );

4
BRANCHES.md
View File

@ -108,9 +108,9 @@ The following branches are currently maintained:
- [`development`](https://github.com/Mbed-TLS/mbedtls/)
- [`mbedtls-3.6`](https://github.com/Mbed-TLS/mbedtls/tree/mbedtls-3.6)
maintained until March 2027, see
<https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.6>.
<https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.7>.
- [`mbedtls-4.1`](https://github.com/Mbed-TLS/mbedtls/tree/mbedtls-4.1)
maintained until March 2029, see
<https://github.com/Mbed-TLS/mbedtls/releases/tag/v4.1.0>.
<https://github.com/Mbed-TLS/mbedtls/releases/tag/v4.1.1>.
Users are urged to always use the latest version of a maintained branch.

6
CMakeLists.txt
View File

@ -40,12 +40,12 @@ cmake_policy(SET CMP0012 NEW)
if(TEST_CPP)
project("Mbed TLS"
LANGUAGES C CXX
VERSION 3.6.6
VERSION 3.6.7
)
else()
project("Mbed TLS"
LANGUAGES C
VERSION 3.6.6
VERSION 3.6.7
)
endif()
@ -501,7 +501,7 @@ if(NOT DISABLE_PACKAGE_CONFIG_AND_INSTALL)
write_basic_package_version_file(
"cmake/MbedTLSConfigVersion.cmake"
COMPATIBILITY SameMajorVersion
VERSION 3.6.6)
VERSION 3.6.7)
install(
FILES "${CMAKE_CURRENT_BINARY_DIR}/cmake/MbedTLSConfig.cmake"

130
ChangeLog
View File

@ -1,5 +1,135 @@
Mbed TLS ChangeLog (Sorted per branch, date)
= Mbed TLS 3.6.7 branch released 2026-07-07
Features
* SHA3-256, SHA3-384 and SHA3-512 are now accepted in the default X.509
certificate profile.
Security
* Fix a side channel in RSA PKCS#1 v1.5 decryption: error handling in the
library would reveal through timing the difference between success,
invalid padding, or output too large for buffer, giving rise to a
Bleichenbacher attack. Note that while the library now handles sensitive
errors in constant-time, RSA PKCS#1 v1.5 decryption remains inherently
dangerous, should be avoided when possible, and otherwise requires great
care in application code. Found by zhengg. CVE-2026-50587
* Added advice about compiler options in SECURITY.md.
* Fix a bug where transcript-hash computation errors during TLS 1.2
extended master secret calculation could be ignored instead of causing the
handshake to fail. This could allow a handshake to continue with a master
secret that was not correctly bound to the handshake transcript,
undermining the security guarantees of the extended master secret
extension. Report by Mathew Gretton-Dann. CVE-2026-50581
* Fix a TLS 1.3 server-side error-handling bug affecting session ticket
generation. Under rare conditions, such as memory allocation failures
while computing the resumption master secret, the server could issue
invalid session tickets instead of failing the handshake. Clients
presented with such tickets would fail session resumption and fall back to
a full handshake. In deployments relying on session resumption, repeated
occurrences could increase the frequency of full handshakes and amplify
resource consumption during periods of resource exhaustion or other
transient failures. Reported by jjfz123.
CVE-2026-50640
* Fix renegotiation failing and potentially causing a buffer overflow
in DTLS when badmac_limit is enabled. Reported by Haruki Oyama.
CVE-2026-50713.
* Reject ChaCha20 operations that would make the 32-bit block counter wrap
around, which could otherwise reuse keystream and compromise
confidentiality. Reported by jiliang. CVE-2026-50584
* Fixed a TLS 1.3 record-boundary validation issue that could allow
unauthenticated plaintext data to be processed across a key change. In
servers with MBEDTLS_SSL_EARLY_DATA enabled, this could be exploited by a
man-in-the-middle attacker to cause loss of 0-RTT early data.
Reported by Ben Smyth.
* Fix a possible buffer overflow in mbedtls_ecdh_calc_secret(): when the
provided output buffer is too small, sometimes (depending on the value of
the computed shared secret), the function would not return an error as it
should, but instead write past the end of the buffer. Reported by Eva
Crystal (0xiviel) from XSource Security. CVE-2026-35336.
* Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when
CBC is disabled. Reported by Karnakar Reddy. CVE-ID-50580
* Fix a side channel in ECC computations that allows a powerful local
attacker (typically, untrusted OS attacking a secure enclave) to fully
recover long-term secret keys. Found and reported by Alejandro Cabrera
Aldaya from Tampere University. CVE-2026-54435
* Fix a potential information disclosure in TLS 1.2 servers using session
tickets. If the session ticket write callback failed without setting the
lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized
stack memory to the peer in the NewSessionTicket message. Fixes #1570.
Reported by James Love. CVE-2026-50586.
* Fix timing side channel in RSA key generation, prime generation and
primality testing, on platforms where division is not constant-time. At
this point this side channel is not known to be exploitable. Reported by
Bhargava Shastry, Ethereum Foundation.
* Fix a 1-byte buffer overread when parsing a malformed ECC public key
in the PK module. CVE-2026-50583
* Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange
messages. Reported-by Biniam Demissie.
CVE-2026-50588
* Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing
an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. The
function now resets the context after freeing it, ensuring stale
signed_data.signers.next pointers cannot be walked by a later free
operation. CVE-2026-50579
* PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224,
SHA3-224) on signature verification. The new configuration option
MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES allows to keep using weak hash
algorithms in PKCS7 for backward compatibility purposes.
* Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that
this function only sets signature algorithms that are enforced during
TLS key exchange and not on certificate verification. Reported by
Xiangdong Li, Beijing University of Posts and Telecommunications (BUPT).
CVE-2026-54441
* Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context'
is properly zeroized when mbedtls_ssl_session_reset() is called. This
could cause incorrect DTLS-SRTP parameter inheritance for applications
reusing an SSL context.
Reported by jjfz123. CVE-2026-50585.
* Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return
1 instead of an error code if the random generator failed when a server
called these functions before the end of a TLS 1.3 handshake.
Reported by Mohammad Seet (mhdsait101).
* Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was
not advertised in the original ClientHello. Reported independently by
Din Asotić / Xiangdong Li, Beijing University of Posts and
Telecommunications (BUPT), and NVIDIA Project Vanessa.
CVE-2026-25832.
* Fix two bugs in the X.509 certificate parser that caused some inputs
with a malformed basicConstraints extension to be accepted. This
could have dangerous results, in particular causing some certificates
to be parsed as CA certificates when other X.509 implementations would
parse them as end-entity certificates. Reported by Mohammad Seet
(mhdsait101), Pablo Ruiz García and NVIDIA Project Vanessa. CVE-2026-49300
Bugfix
* Fix a TLS 1.2 regression that caused clients to reject valid
ServerKeyExchange signatures using RSA-PSS signature algorithms.
Fixes #10668.
* Fix a problem in library/alignment.h where the Zephyr Project use
a pre-defined macro '__packed' which collides with the IAR keyword
'__packed', causing the typedefs of unaligned types to remain aligned.
Fixes mbedtls issue #10334
* Reject malformed TLS 1.3 serialized sessions instead of accepting
unterminated strings or extra trailing data.
* Reject serialized SSL contexts whose DTLS Connection ID length exceeds
the maximum supported size, instead of overflowing the internal buffer.
* Fix bug in configurations with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED that
prevented re-use of an mbedtls_ecdh_context for static ECDH: our secret key
was wiped after its first use to compute a shared secret.
* Fixed documentation of mbedtls_ssl_set_cid(): the set CID configuration
is applied to all subsequent handshakes, not just to the next one.
* Reject malformed X.509 CSRs where the extensionRequest attribute
wrappers do not exactly contain the requested extensions.
Changes
* X.509 certificates with a basicConstraints extension starting with an
INTEGER field are no longer accepted. According to RFC 5280, such
certificates are syntactically valid and the first field is the
pathLenConstraint value, but certificate authorities must not emit such
certificates. Mbed TLS interpreted it as a cA value, which was nonstandard
and dangerous.
= Mbed TLS 3.6.6 branch released 2026-03-31
Features

4
ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt
View File

@ -1,4 +0,0 @@
Bugfix
* Fix a TLS 1.2 regression that caused clients to reject valid
ServerKeyExchange signatures using RSA-PSS signature algorithms.
Fixes #10668.

6
ChangeLog.d/iar-alignment-fix.txt
View File

@ -1,6 +0,0 @@
Bugfix
* Fix a problem in library/alignment.h where the Zephyr Project use
a pre-defined macro '__packed' which collides with the IAR keyword
'__packed', causing the typedefs of unaligned types to remain aligned.
Fixes mbedtls issue #10334

2
ChangeLog.d/security-advice.txt
View File

@ -1,2 +0,0 @@
Security
* Added advice about compiler options in SECURITY.md.

5
ChangeLog.d/serialized-data-load-hardening.txt
View File

@ -1,5 +0,0 @@
Bugfix
* Reject malformed TLS 1.3 serialized sessions instead of accepting
unterminated strings or extra trailing data.
* Reject serialized SSL contexts whose DTLS Connection ID length exceeds
the maximum supported size, instead of overflowing the internal buffer.

2
doxygen/input/doc_mainpage.h
View File

@ -10,7 +10,7 @@
*/
/**
* @mainpage Mbed TLS v3.6.6 API Documentation
* @mainpage Mbed TLS v3.6.7 API Documentation
*
* This documentation describes the internal structure of Mbed TLS. It was
* automatically generated from specially formatted comment blocks in

2
doxygen/mbedtls.doxyfile
View File

@ -1,4 +1,4 @@
PROJECT_NAME = "Mbed TLS v3.6.6"
PROJECT_NAME = "Mbed TLS v3.6.7"
OUTPUT_DIRECTORY = ../apidoc/
FULL_PATH_NAMES = NO
OPTIMIZE_OUTPUT_FOR_C = YES

2
framework

@ -1 +1 @@
Subproject commit e79f4fdd4877e79a92e6b1e5965132ff0c5cc729
Subproject commit a3079552234917a9831dd70693983af5e62c70de

8
include/mbedtls/build_info.h
View File

@ -26,16 +26,16 @@
*/
#define MBEDTLS_VERSION_MAJOR 3
#define MBEDTLS_VERSION_MINOR 6
#define MBEDTLS_VERSION_PATCH 6
#define MBEDTLS_VERSION_PATCH 7
/**
* The single version number has the following structure:
* MMNNPP00
* Major version | Minor version | Patch version
*/
#define MBEDTLS_VERSION_NUMBER 0x03060600
#define MBEDTLS_VERSION_STRING "3.6.6"
#define MBEDTLS_VERSION_STRING_FULL "Mbed TLS 3.6.6"
#define MBEDTLS_VERSION_NUMBER 0x03060700
#define MBEDTLS_VERSION_STRING "3.6.7"
#define MBEDTLS_VERSION_STRING_FULL "Mbed TLS 3.6.7"
/* Macros for build-time platform detection */

9
include/mbedtls/chacha20.h
View File

@ -38,7 +38,8 @@ extern "C" {
typedef struct mbedtls_chacha20_context {
uint32_t MBEDTLS_PRIVATE(state)[16]; /*! The state (before round operations). */
uint8_t MBEDTLS_PRIVATE(keystream8)[64]; /*! Leftover keystream bytes. */
size_t MBEDTLS_PRIVATE(keystream_bytes_used); /*! Number of keystream bytes already used. */
size_t MBEDTLS_PRIVATE(keystream_bytes_used); /*! Number of keystream bytes already used,
* or an internal sentinel value. */
}
mbedtls_chacha20_context;
@ -143,6 +144,9 @@ int mbedtls_chacha20_starts(mbedtls_chacha20_context *ctx,
* This pointer can be \c NULL if `size == 0`.
*
* \return \c 0 on success.
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA
* if processing \p size bytes would make the 32-bit block
* counter wrap.
* \return A negative error code on failure.
*/
int mbedtls_chacha20_update(mbedtls_chacha20_context *ctx,
@ -176,6 +180,9 @@ int mbedtls_chacha20_update(mbedtls_chacha20_context *ctx,
* This pointer can be \c NULL if `size == 0`.
*
* \return \c 0 on success.
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA
* if processing \p size bytes would make the 32-bit block
* counter wrap.
* \return A negative error code on failure.
*/
int mbedtls_chacha20_crypt(const unsigned char key[32],

9
include/mbedtls/chachapoly.h
View File

@ -227,6 +227,9 @@ int mbedtls_chachapoly_update_aad(mbedtls_chachapoly_context *ctx,
* \return #MBEDTLS_ERR_CHACHAPOLY_BAD_STATE
* if the operation has not been started or has been
* finished.
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA
* if processing \p len bytes would make the 32-bit block
* counter wrap.
* \return Another negative error code on other kinds of failure.
*/
int mbedtls_chachapoly_update(mbedtls_chachapoly_context *ctx,
@ -280,6 +283,9 @@ int mbedtls_chachapoly_finish(mbedtls_chachapoly_context *ctx,
* is written. This must not be \c NULL.
*
* \return \c 0 on success.
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA
* if processing \p length bytes would make the 32-bit block
* counter wrap.
* \return A negative error code on failure.
*/
int mbedtls_chachapoly_encrypt_and_tag(mbedtls_chachapoly_context *ctx,
@ -314,6 +320,9 @@ int mbedtls_chachapoly_encrypt_and_tag(mbedtls_chachapoly_context *ctx,
* \return \c 0 on success.
* \return #MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED
* if the data was not authentic.
* \return #MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA
* if processing \p length bytes would make the 32-bit block
* counter wrap.
* \return Another negative error code on other kinds of failure.
*/
int mbedtls_chachapoly_auth_decrypt(mbedtls_chachapoly_context *ctx,

1
include/mbedtls/ecdh.h
View File

@ -416,6 +416,7 @@ int mbedtls_ecdh_read_public(mbedtls_ecdh_context *ctx,
* Bytes written on success. This must not be \c NULL.
* \param buf The buffer to write the generated shared key to. This
* must be a writable buffer of size \p blen Bytes.
* A sufficient size is given by #MBEDTLS_ECP_MAX_BYTES.
* \param blen The length of the destination buffer \p buf in Bytes.
* \param f_rng The RNG function to use. This must not be \c NULL.
* \param p_rng The RNG context. This may be \c NULL if \p f_rng

23
include/mbedtls/ecp.h
View File

@ -213,22 +213,11 @@ mbedtls_ecp_point;
*
* If \p modp is NULL, reduction modulo \p P is done using a generic algorithm.
* Otherwise, \p modp must point to a function that takes an \p mbedtls_mpi in the
* range of <code>0..2^(2*pbits)-1</code>, and transforms it in-place to an integer
* which is congruent mod \p P to the given MPI, and is close enough to \p pbits
* in size, so that it may be efficiently brought in the 0..P-1 range by a few
* additions or subtractions. Therefore, it is only an approximate modular
* reduction. It must return 0 on success and non-zero on failure.
*
* \note Alternative implementations of the ECP module must obey the
* following constraints.
* * Group IDs must be distinct: if two group structures have
* the same ID, then they must be identical.
* * The fields \c id, \c P, \c A, \c B, \c G, \c N,
* \c pbits and \c nbits must have the same type and semantics
* as in the built-in implementation.
* They must be available for reading, but direct modification
* of these fields does not need to be supported.
* They do not need to be at the same offset in the structure.
* range of [0, 2^(2*pbits)), and transforms it in-place to an integer which is
* congruent mod \p P to the given MPI, is in the range [0, 2P), and has no more
* non-zero limbs than P, so that it may be efficiently brought into the range
* [0, P) by a single constant-time conditional subtraction.
* It must return 0 on success and non-zero on failure.
*/
typedef struct mbedtls_ecp_group {
mbedtls_ecp_group_id id; /*!< An internal group identifier. */
@ -248,7 +237,7 @@ typedef struct mbedtls_ecp_group {
private keys. */
/* End of public fields */
unsigned int MBEDTLS_PRIVATE(h); /*!< \internal 1 if the constants are static. */
unsigned int MBEDTLS_PRIVATE(h); /*!< \internal 1 if all the constants are static, 2 if only N and P are static */
int(*MBEDTLS_PRIVATE(modp))(mbedtls_mpi *); /*!< The function for fast pseudo-reduction
mod \p P (see above).*/
int(*MBEDTLS_PRIVATE(t_pre))(mbedtls_ecp_point *, void *); /*!< Unused. */

9
include/mbedtls/mbedtls_config.h
View File

@ -3248,6 +3248,15 @@
*/
#define MBEDTLS_PKCS7_C
/**
* \def MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
*
* Allow weak signature algorithms (RIPEMD160, MD5, SHA-1) in PKCS#7.
*
* Requires: MBEDTLS_PKCS7_C
*/
// #define MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
/**
* \def MBEDTLS_PKCS12_C
*

14
include/mbedtls/pk.h
View File

@ -930,6 +930,15 @@ int mbedtls_pk_sign_restartable(mbedtls_pk_context *ctx,
/**
* \brief Decrypt message (including padding if relevant).
*
* \warning When using PKCS#1 v1.5 (see note below), this is an
* inherently dangerous function (CWE-242) and the return value
* is sensitive, see mbedtls_rsa_rsaes_pkcs1_v15_decrypt().
*
* \note For keys of type #MBEDTLS_PK_RSA, the encryption algorithm is
* either PKCS#1 v1.5 or OAEP, depending on the padding mode in
* the underlying RSA context. For a pk object constructed by
* parsing, this is PKCS#1 v1.5 by default.
*
* \param ctx The PK context to use. It must have been set up
* with a private key.
* \param input Input to decrypt
@ -940,11 +949,6 @@ int mbedtls_pk_sign_restartable(mbedtls_pk_context *ctx,
* \param f_rng RNG function, must not be \c NULL.
* \param p_rng RNG parameter
*
* \note For keys of type #MBEDTLS_PK_RSA, the signature algorithm is
* either PKCS#1 v1.5 or OAEP, depending on the padding mode in
* the underlying RSA context. For a pk object constructed by
* parsing, this is PKCS#1 v1.5 by default.
*
* \return 0 on success, or a specific error code.
*/
int mbedtls_pk_decrypt(mbedtls_pk_context *ctx,

12
include/mbedtls/pkcs7.h
View File

@ -31,6 +31,12 @@
* assumed these fields are empty.
* - The RFC allows for the signed Data type to contain contentInfo. This
* implementation assumes the type is DATA and the content is empty.
* - The RFC doesn't put any constrain on the hash algorithm to be used, but
* this implementation by default rejects weak hash algorithms (i.e. RIPEMD160,
* MD5, SHA-1, SHA-224, SHA3-224). In general accepted hash algorithms
* are the ones belonging to ::mbedtls_x509_crt_profile_default.
* #MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES can be enabled to accept all
* supported hash algorithms.
*/
#ifndef MBEDTLS_PKCS7_H
@ -190,6 +196,9 @@ int mbedtls_pkcs7_parse_der(mbedtls_pkcs7 *pkcs7, const unsigned char *buf,
* \note This function internally calculates the hash on the supplied
* plain data for signature verification.
*
* \note For limitation on the supported hash algorithms, please refer
* to the note at the top of this document.
*
* \return 0 if the signature verifies, or a negative error code on failure.
*/
int mbedtls_pkcs7_signed_data_verify(mbedtls_pkcs7 *pkcs7,
@ -219,6 +228,9 @@ int mbedtls_pkcs7_signed_data_verify(mbedtls_pkcs7 *pkcs7,
* \note This function is different from mbedtls_pkcs7_signed_data_verify()
* in that it is directly passed the hash of the data.
*
* \note For limitation on the supported hash algorithms, please refer
* to the note at the top of this document.
*
* \return 0 if the signature verifies, or a negative error code on failure.
*/
int mbedtls_pkcs7_signed_hash_verify(mbedtls_pkcs7 *pkcs7,

12
include/mbedtls/rsa.h
View File

@ -696,7 +696,9 @@ int mbedtls_rsa_rsaes_oaep_encrypt(mbedtls_rsa_context *ctx,
*
* \warning When \p ctx->padding is set to #MBEDTLS_RSA_PKCS_V15,
* mbedtls_rsa_rsaes_pkcs1_v15_decrypt() is called, which is an
* inherently dangerous function (CWE-242).
* inherently dangerous function (CWE-242). In that case, the
* return value of this function is sensitive, see the
* documentation of mbedtls_rsa_rsaes_pkcs1_v15_decrypt().
*
* \note The output buffer length \c output_max_len should be
* as large as the size \p ctx->len of \p ctx->N (for example,
@ -735,9 +737,13 @@ int mbedtls_rsa_pkcs1_decrypt(mbedtls_rsa_context *ctx,
* operation (RSAES-PKCS1-v1_5-DECRYPT).
*
* \warning This is an inherently dangerous function (CWE-242). Unless
* it is used in a side channel free and safe way (eg.
* implementing the TLS protocol as per 7.4.7.1 of RFC 5246),
* it is used in a side channel free and safe way,
* the calling code is vulnerable.
* Specifically, callers need to ensure an adversary cannot
* distinguish between success, MBEDTLS_ERR_RSA_INVALID_PADDING
* and MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE. Also, in the latter two
* cases, the values of the output bytes must be ignored, again
* without revealing whether that's the case.
*
* \note The output buffer length \c output_max_len should be
* as large as the size \p ctx->len of \p ctx->N, for example,

21
include/mbedtls/ssl.h
View File

@ -2344,7 +2344,7 @@ void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl,
/**
* \brief Configure the use of the Connection ID (CID)
* extension in the next handshake.
* extension in subsequent handshakes.
*
* Reference: RFC 9146 (or draft-ietf-tls-dtls-connection-id-05
* https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05
@ -2365,7 +2365,7 @@ void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl,
* headers of outgoing messages.
*
* This API enables or disables the use of the CID extension
* in the next handshake and sets the value of the CID to
* in subsequent handshakes and sets the value of the CID to
* be used for incoming messages.
*
* \param ssl The SSL context to configure. This must be initialized.
@ -2396,11 +2396,11 @@ void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl,
* successful call to this function to run the handshake.
*
* \note This call cannot guarantee that the use of the CID
* will be successfully negotiated in the next handshake,
* will be successfully negotiated in subsequent handshakes,
* because the peer might not support it. Specifically:
* - On the Client, enabling the use of the CID through
* this call implies that the `ClientHello` in the next
* handshake will include the CID extension, thereby
* this call implies that the `ClientHello` in subsequent
* handshakes will include the CID extension, thereby
* offering the use of the CID to the server. Only if
* the `ServerHello` contains the CID extension, too,
* the CID extension will actually be put to use.
@ -2423,7 +2423,7 @@ void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl,
* Mbed TLS.
*
* \return \c 0 on success. In this case, the CID configuration
* applies to the next handshake.
* applies to subsequent handshakes.
* \return A negative error code on failure.
*/
int mbedtls_ssl_set_cid(mbedtls_ssl_context *ssl,
@ -3594,7 +3594,7 @@ int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf, size_t len,
*
* \note The restrictions are enforced for all certificates in the
* chain. However, signatures in the handshake are not covered
* by this setting but by \b mbedtls_ssl_conf_sig_hashes().
* by this setting but by \c mbedtls_ssl_conf_sig_hashes().
*
* \param conf SSL configuration
* \param profile Profile to use
@ -4075,7 +4075,12 @@ void MBEDTLS_DEPRECATED mbedtls_ssl_conf_sig_hashes(mbedtls_ssl_config *conf,
#endif /* !MBEDTLS_DEPRECATED_REMOVED && MBEDTLS_SSL_PROTO_TLS1_2 */
/**
* \brief Configure allowed signature algorithms for use in TLS
* \brief Configure allowed signature algorithms for use in TLS key
* exchange.
*
* \note This only covers signature algorithms used in the key
* exchange. To also enforce restrictions in certificate verification
* refer to \c mbedtls_ssl_conf_cert_profile().
*
* \param conf The SSL configuration to use.
* \param sig_algs List of allowed IANA values for TLS 1.3 signature algorithms,

27
include/psa/crypto.h
View File

@ -2073,6 +2073,8 @@ psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation);
* \param[in] plaintext Data that will be authenticated and
* encrypted.
* \param plaintext_length Size of \p plaintext in bytes.
* For #PSA_ALG_CHACHA20_POLY1305, this must
* not exceed `UINT32_MAX * 64` bytes.
* \param[out] ciphertext Output buffer for the authenticated and
* encrypted data. The additional data is not
* part of this output. For algorithms where the
@ -2099,7 +2101,8 @@ psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation);
* \retval #PSA_ERROR_INVALID_HANDLE \emptydescription
* \retval #PSA_ERROR_NOT_PERMITTED \emptydescription
* \retval #PSA_ERROR_INVALID_ARGUMENT
* \p key is not compatible with \p alg.
* \p key is not compatible with \p alg, or \p plaintext_length
* is not acceptable for \p alg.
* \retval #PSA_ERROR_NOT_SUPPORTED
* \p alg is not supported or is not an AEAD algorithm.
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
@ -2150,6 +2153,10 @@ psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
* must contain the encrypted data followed
* by the authentication tag.
* \param ciphertext_length Size of \p ciphertext in bytes.
* For #PSA_ALG_CHACHA20_POLY1305, the
* encrypted data length, excluding the
* authentication tag, must not exceed
* `UINT32_MAX * 64` bytes.
* \param[out] plaintext Output buffer for the decrypted data.
* \param plaintext_size Size of the \p plaintext buffer in bytes.
* This must be appropriate for the selected
@ -2172,7 +2179,8 @@ psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
* The ciphertext is not authentic.
* \retval #PSA_ERROR_NOT_PERMITTED \emptydescription
* \retval #PSA_ERROR_INVALID_ARGUMENT
* \p key is not compatible with \p alg.
* \p key is not compatible with \p alg, or the encrypted data length
* is not acceptable for \p alg.
* \retval #PSA_ERROR_NOT_SUPPORTED
* \p alg is not supported or is not an AEAD algorithm.
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
@ -2470,6 +2478,8 @@ psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation,
* psa_aead_set_nonce() or psa_aead_generate_nonce().
*
* - For #PSA_ALG_CCM, calling this function is required.
* - For #PSA_ALG_CHACHA20_POLY1305, the plaintext length must not
* exceed `UINT32_MAX * 64` bytes.
* - For the other AEAD algorithms defined in this specification, calling
* this function is not required.
* - For vendor-defined algorithm, refer to the vendor documentation.
@ -2618,7 +2628,8 @@ psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation,
* less than the additional data length that was previously
* specified with psa_aead_set_lengths(), or
* the total input length overflows the plaintext length that
* was previously specified with psa_aead_set_lengths().
* was previously specified with psa_aead_set_lengths(), or
* the total message length is not acceptable for the algorithm.
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
* \retval #PSA_ERROR_COMMUNICATION_FAILURE \emptydescription
* \retval #PSA_ERROR_HARDWARE_FAILURE \emptydescription
@ -3125,6 +3136,16 @@ psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
/**
* \brief Decrypt a short message with a private key.
*
* \warning When \p alg is #PSA_ALG_RSA_PKCS1V15_CRYPT, this is an
* inherently dangerous function (CWE-242): unless it is used
* in a side channel free and safe way, the calling code
* is vulnerable.
* Specifically, callers need to ensure an adversary cannot
* distinguish between success, #PSA_ERROR_INVALID_PADDING and
* #PSA_ERROR_BUFFER_TOO_SMALL. Also, in the latter two cases,
* the values of the output bytes must be ignored, again
* without revealing whether that's the case.
*
* \param key Identifier of the key to use for the operation.
* It must be an asymmetric key pair. It must
* allow the usage #PSA_KEY_USAGE_DECRYPT.

3
include/psa/crypto_values.h
View File

@ -1760,8 +1760,7 @@
* \warning Calling psa_asymmetric_decrypt() with this algorithm as a
* parameter is considered an inherently dangerous function
* (CWE-242). Unless it is used in a side channel free and safe
* way (eg. implementing the TLS protocol as per 7.4.7.1 of
* RFC 5246), the calling code is vulnerable.
* way, the calling code is vulnerable.
*
*/
#define PSA_ALG_RSA_PKCS1V15_CRYPT ((psa_algorithm_t) 0x07000200)

7
library/CMakeLists.txt
View File

@ -39,7 +39,6 @@ set(src_crypto
ecjpake.c
ecp.c
ecp_curves.c
ecp_curves_new.c
entropy.c
entropy_poll.c
error.c
@ -314,7 +313,7 @@ endif(USE_STATIC_MBEDTLS_LIBRARY)
if(USE_SHARED_MBEDTLS_LIBRARY)
set(CMAKE_LIBRARY_PATH ${CMAKE_CURRENT_BINARY_DIR})
add_library(${mbedcrypto_target} SHARED ${src_crypto})
set_target_properties(${mbedcrypto_target} PROPERTIES VERSION 3.6.6 SOVERSION 16)
set_target_properties(${mbedcrypto_target} PROPERTIES VERSION 3.6.7 SOVERSION 16)
target_link_libraries(${mbedcrypto_target} PUBLIC ${libs})
if(TARGET ${everest_target})
@ -326,11 +325,11 @@ if(USE_SHARED_MBEDTLS_LIBRARY)
endif()
add_library(${mbedx509_target} SHARED ${src_x509})
set_target_properties(${mbedx509_target} PROPERTIES VERSION 3.6.6 SOVERSION 7)
set_target_properties(${mbedx509_target} PROPERTIES VERSION 3.6.7 SOVERSION 7)
target_link_libraries(${mbedx509_target} PUBLIC ${libs} ${mbedcrypto_target})
add_library(${mbedtls_target} SHARED ${src_tls})
set_target_properties(${mbedtls_target} PROPERTIES VERSION 3.6.6 SOVERSION 21)
set_target_properties(${mbedtls_target} PROPERTIES VERSION 3.6.7 SOVERSION 21)
target_link_libraries(${mbedtls_target} PUBLIC ${libs} ${mbedx509_target})
if(GEN_FILES)

1
library/Makefile
View File

@ -131,7 +131,6 @@ OBJS_CRYPTO= \
ecjpake.o \
ecp.o \
ecp_curves.o \
ecp_curves_new.o \
entropy.o \
entropy_poll.o \
error.o \

95
library/bignum.c
View File

@ -2059,30 +2059,38 @@ int mbedtls_mpi_inv_mod(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
#if defined(MBEDTLS_GENPRIME)
/* Gaps between primes, starting at 3. https://oeis.org/A001223 */
static const unsigned char small_prime_gaps[] = {
2, 2, 4, 2, 4, 2, 4, 6,
2, 6, 4, 2, 4, 6, 6, 2,
6, 4, 2, 6, 4, 6, 8, 4,
2, 4, 2, 4, 14, 4, 6, 2,
10, 2, 6, 6, 4, 6, 6, 2,
10, 2, 4, 2, 12, 12, 4, 2,
4, 6, 2, 10, 6, 6, 6, 2,
6, 4, 2, 10, 14, 4, 2, 4,
14, 6, 10, 2, 4, 6, 8, 6,
6, 4, 6, 8, 4, 8, 10, 2,
10, 2, 6, 4, 6, 8, 4, 2,
4, 12, 8, 4, 8, 4, 6, 12,
2, 18, 6, 10, 6, 6, 2, 6,
10, 6, 6, 2, 6, 6, 4, 2,
12, 10, 2, 4, 6, 6, 2, 12,
4, 6, 8, 10, 8, 10, 8, 6,
6, 4, 8, 6, 4, 8, 4, 14,
10, 12, 2, 10, 2, 4, 2, 10,
14, 4, 2, 4, 14, 4, 2, 4,
20, 4, 8, 10, 8, 4, 6, 6,
14, 4, 6, 6, 8, 6, /*reaches 997*/
0 /* the last entry is effectively unused */
static const mbedtls_mpi_sint small_primes_limit = 997;
/* Product of small primes up to small_primes_limit included */
static const mbedtls_mpi_uint small_primes_product_limbs[] = {
MBEDTLS_BYTES_TO_T_UINT_8(0x4b, 0x13, 0x6a, 0x97, 0xbb, 0xd0, 0xdf, 0x95),
MBEDTLS_BYTES_TO_T_UINT_8(0xa7, 0x2c, 0x10, 0xa4, 0x20, 0xa4, 0x9f, 0x7b),
MBEDTLS_BYTES_TO_T_UINT_8(0x9d, 0x18, 0xd6, 0xdf, 0xc0, 0xf5, 0x61, 0x65),
MBEDTLS_BYTES_TO_T_UINT_8(0xfc, 0x35, 0x79, 0xfb, 0x30, 0xa8, 0xd5, 0xbf),
MBEDTLS_BYTES_TO_T_UINT_8(0xdb, 0x37, 0xba, 0x2c, 0xfb, 0xbb, 0x89, 0xfb),
MBEDTLS_BYTES_TO_T_UINT_8(0xad, 0xc2, 0x8c, 0x1d, 0x99, 0x18, 0xe8, 0xe5),
MBEDTLS_BYTES_TO_T_UINT_8(0x8d, 0x77, 0xc9, 0x5d, 0x96, 0x8a, 0x61, 0x9d),
MBEDTLS_BYTES_TO_T_UINT_8(0x39, 0x41, 0x3e, 0xf4, 0x34, 0x07, 0x57, 0xe0),
MBEDTLS_BYTES_TO_T_UINT_8(0x4a, 0xf1, 0x54, 0x3a, 0x43, 0x67, 0x46, 0xa2),
MBEDTLS_BYTES_TO_T_UINT_8(0x83, 0x0c, 0xe5, 0x31, 0xa2, 0xfc, 0x05, 0x45),
MBEDTLS_BYTES_TO_T_UINT_8(0xf0, 0x1d, 0x66, 0xfc, 0x7a, 0x85, 0x37, 0xe1),
MBEDTLS_BYTES_TO_T_UINT_8(0x17, 0xe0, 0x80, 0x62, 0x0d, 0xa2, 0xbc, 0x32),
MBEDTLS_BYTES_TO_T_UINT_8(0x6d, 0xce, 0x84, 0x68, 0x00, 0xb5, 0xe3, 0x35),
MBEDTLS_BYTES_TO_T_UINT_8(0x14, 0x19, 0x0d, 0xe4, 0x92, 0xd5, 0xd8, 0xdf),
MBEDTLS_BYTES_TO_T_UINT_8(0x20, 0x1c, 0x7d, 0x38, 0x3b, 0xe8, 0xd9, 0xa8),
MBEDTLS_BYTES_TO_T_UINT_8(0xf6, 0xac, 0x11, 0xe6, 0xb4, 0x03, 0xf7, 0x6c),
MBEDTLS_BYTES_TO_T_UINT_8(0x78, 0x3d, 0xf2, 0x3a, 0x8f, 0xf9, 0x2f, 0x6a),
MBEDTLS_BYTES_TO_T_UINT_8(0x7b, 0x72, 0x66, 0xa9, 0x48, 0xe4, 0x6d, 0x02),
MBEDTLS_BYTES_TO_T_UINT_8(0x69, 0xc7, 0x32, 0xcb, 0xf2, 0xf7, 0xa9, 0x0b),
MBEDTLS_BYTES_TO_T_UINT_8(0xd3, 0x52, 0x72, 0x9d, 0xbf, 0x54, 0xea, 0xc7),
MBEDTLS_BYTES_TO_T_UINT_8(0xf5, 0xf3, 0x8a, 0xc5, 0xf0, 0xe1, 0x21, 0x81),
MBEDTLS_BYTES_TO_T_UINT_8(0x8e, 0x61, 0x78, 0xf0, 0x05, 0x00, 0x00, 0x00),
};
/* Could make ECP_MPI_INIT_ARRAY() available outside ecp, but not doing it now
* as it would lead to conflicts with other in-flight PRs. */
static const mbedtls_mpi small_primes_product = {
.p = (mbedtls_mpi_uint *) small_primes_product_limbs,
.s = 1,
.n = sizeof(small_primes_product_limbs) / sizeof(mbedtls_mpi_uint),
};
/*
@ -2097,26 +2105,43 @@ static const unsigned char small_prime_gaps[] = {
static int mpi_check_small_factors(const mbedtls_mpi *X)
{
int ret = 0;
size_t i;
mbedtls_mpi_uint r;
unsigned p = 3; /* The first odd prime */
mbedtls_mpi g;
mbedtls_mpi_init(&g);
if ((X->p[0] & 1) == 0) {
return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE;
}
for (i = 0; i < sizeof(small_prime_gaps); p += small_prime_gaps[i], i++) {
MBEDTLS_MPI_CHK(mbedtls_mpi_mod_int(&r, X, p));
if (r == 0) {
if (mbedtls_mpi_cmp_int(X, p) == 0) {
return 1;
} else {
return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE;
}
/* The GCD test below only works if X > small_primes_limit.
* Below this limit, use trial division: numbers that small are of no
* interest for cryptography, so we don't care about performance or side
* channels. We're supporting them only for backwards compatibility, so
* let's not waste code size on those. */
if (mbedtls_mpi_cmp_int(X, small_primes_limit) <= 0) {
mbedtls_mpi_uint x = X->p[0];
mbedtls_mpi_uint d = 2;
while (x % d != 0) {
++d;
}
return x == d ? 1 : MBEDTLS_ERR_MPI_NOT_ACCEPTABLE;
}
/* We can't directly use mbedtls_mpi_gcd_modinv_odd() because we don't know
* if X is larger than prod or not (prod is 1380 bits). So, use this generic
* wrapper - it does a bit more than what we need (handles even inputs as
* well, while we know our inputs are both odd), but that's OK. */
MBEDTLS_MPI_CHK(mbedtls_mpi_gcd(&g, &small_primes_product, X));
if (mbedtls_mpi_cmp_int(&g, 1) == 0) {
/* X is not divisible by a small prime */
ret = 0;
} else {
ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE;
}
cleanup:
mbedtls_mpi_free(&g);
return ret;
}

8
library/bignum_core.h
View File

@ -4,7 +4,13 @@
* This interface should only be used by the legacy bignum module (bignum.h)
* and the modular bignum modules (bignum_mod.c, bignum_mod_raw.c). All other
* modules should use the high-level modular bignum interface (bignum_mod.h)
* or the legacy bignum interface (bignum.h).
* or the legacy bignum interface (bignum.h). The only exceptions are:
* 1. In ecp_curves.c, some mbedtls_ecp_mod_pXXX_raw() functions are using
* bignum_core functions. That's because those functions are implementing a
* part of bignum_mod: the optimized reduction in mbedtls_mpi_mod_modulus.
* 2. In ecp.c, ecp_modp() is currently using bignum_core, while the rest of
* the module is using legacy bignum. That's transitional; eventually ecp.c is
* going to use bignum_mod_raw.
*
* This module is about processing non-negative integers with a fixed upper
* bound that's of the form 2^n-1 where n is a multiple of #biL.

68
library/chacha20.c
View File

@ -20,6 +20,8 @@
#include <stddef.h>
#include <string.h>
#include "chacha20_internal.h"
#include "mbedtls/platform.h"
#if !defined(MBEDTLS_CHACHA20_ALT)
@ -31,6 +33,10 @@
#define CHACHA20_BLOCK_SIZE_BYTES (4U * 16U)
#define CHACHA20_MAX_BLOCKS UINT32_MAX
#define CHACHA20_COUNTER_EXHAUSTED (CHACHA20_BLOCK_SIZE_BYTES + 1U)
/**
* \brief ChaCha20 quarter round operation.
*
@ -183,7 +189,7 @@ int mbedtls_chacha20_starts(mbedtls_chacha20_context *ctx,
uint32_t counter)
{
/* Counter */
ctx->state[12] = counter;
ctx->state[CHACHA20_CTR_INDEX] = counter;
/* Nonce */
ctx->state[13] = MBEDTLS_GET_UINT32_LE(nonce, 0);
@ -198,12 +204,63 @@ int mbedtls_chacha20_starts(mbedtls_chacha20_context *ctx,
return 0;
}
int mbedtls_chacha20_check_counter_wrap(const mbedtls_chacha20_context *ctx,
size_t size)
{
size_t available_keystream = 0;
uint64_t needed_blocks = 0;
if (ctx->keystream_bytes_used >= CHACHA20_COUNTER_EXHAUSTED) {
return size == 0U ? 0 : MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA;
}
#if SIZE_MAX >= UINT64_MAX
if (size > UINT64_MAX / 2) {
return MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA;
}
#endif
if (ctx->keystream_bytes_used < CHACHA20_BLOCK_SIZE_BYTES) {
available_keystream =
CHACHA20_BLOCK_SIZE_BYTES - ctx->keystream_bytes_used;
if (size <= available_keystream) {
return 0;
}
if (ctx->state[CHACHA20_CTR_INDEX] == 0U) {
return MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA;
}
size -= available_keystream;
}
needed_blocks = (size / CHACHA20_BLOCK_SIZE_BYTES);
if (size % CHACHA20_BLOCK_SIZE_BYTES != 0U) {
needed_blocks++;
}
if (needed_blocks >
(uint64_t) CHACHA20_MAX_BLOCKS + 1U - ctx->state[CHACHA20_CTR_INDEX]) {
return MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA;
}
return 0;
}
int mbedtls_chacha20_update(mbedtls_chacha20_context *ctx,
size_t size,
const unsigned char *input,
unsigned char *output)
{
size_t offset = 0U;
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
ret = mbedtls_chacha20_check_counter_wrap(ctx, size);
if (ret != 0) {
return ret;
}
/* Use leftover keystream bytes, if available */
while (size > 0U && ctx->keystream_bytes_used < CHACHA20_BLOCK_SIZE_BYTES) {
@ -213,6 +270,11 @@ int mbedtls_chacha20_update(mbedtls_chacha20_context *ctx,
ctx->keystream_bytes_used++;
offset++;
size--;
if (ctx->keystream_bytes_used == CHACHA20_BLOCK_SIZE_BYTES &&
ctx->state[CHACHA20_CTR_INDEX] == 0U) {
ctx->keystream_bytes_used = CHACHA20_COUNTER_EXHAUSTED;
}
}
/* Process full blocks */
@ -225,6 +287,10 @@ int mbedtls_chacha20_update(mbedtls_chacha20_context *ctx,
offset += CHACHA20_BLOCK_SIZE_BYTES;
size -= CHACHA20_BLOCK_SIZE_BYTES;
if (ctx->state[CHACHA20_CTR_INDEX] == 0U) {
ctx->keystream_bytes_used = CHACHA20_COUNTER_EXHAUSTED;
}
}
/* Last (partial) block */

23
library/chacha20_internal.h Normal file
View File

@ -0,0 +1,23 @@
/**
* \file chacha20_internal.h
*
* \brief Internal declarations for ChaCha20.
*/
/*
* Copyright The Mbed TLS Contributors
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
*/
#ifndef MBEDTLS_CHACHA20_INTERNAL_H
#define MBEDTLS_CHACHA20_INTERNAL_H
#include "common.h"
#include "mbedtls/chacha20.h"
#if !defined(MBEDTLS_CHACHA20_ALT)
int mbedtls_chacha20_check_counter_wrap(const mbedtls_chacha20_context *ctx,
size_t size);
#endif /* !MBEDTLS_CHACHA20_ALT */
#endif /* MBEDTLS_CHACHA20_INTERNAL_H */

9
library/chachapoly.c
View File

@ -17,6 +17,8 @@
#include <string.h>
#include "chacha20_internal.h"
#include "mbedtls/platform.h"
#if !defined(MBEDTLS_CHACHAPOLY_ALT)
@ -165,6 +167,13 @@ int mbedtls_chachapoly_update(mbedtls_chachapoly_context *ctx,
return MBEDTLS_ERR_CHACHAPOLY_BAD_STATE;
}
#if !defined(MBEDTLS_CHACHA20_ALT)
ret = mbedtls_chacha20_check_counter_wrap(&ctx->chacha20_ctx, len);
if (ret != 0) {
return ret;
}
#endif /* !MBEDTLS_CHACHA20_ALT */
if (ctx->state == CHACHAPOLY_STATE_AAD) {
ctx->state = CHACHAPOLY_STATE_CIPHERTEXT;

8
library/ecdh.c
View File

@ -646,11 +646,13 @@ static int ecdh_calc_secret_internal(mbedtls_ecdh_context_mbed *ctx,
}
#endif /* MBEDTLS_ECP_RESTARTABLE */
if (mbedtls_mpi_size(&ctx->z) > blen) {
return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
size_t p_bytes = ctx->grp.pbits / 8 + ((ctx->grp.pbits % 8) != 0);
if (p_bytes > blen) {
return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
}
*olen = ctx->grp.pbits / 8 + ((ctx->grp.pbits % 8) != 0);
*olen = p_bytes;
if (mbedtls_ecp_get_type(&ctx->grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
return mbedtls_mpi_write_binary_le(&ctx->z, buf, *olen);

23
library/ecp.c
View File

@ -69,6 +69,7 @@
#include "bn_mul.h"
#include "bignum_internal.h"
#include "bignum_core.h"
#include "ecp_invasive.h"
#include <string.h>
@ -582,10 +583,10 @@ void mbedtls_ecp_group_free(mbedtls_ecp_group *grp)
mbedtls_mpi_free(&grp->B);
mbedtls_ecp_point_free(&grp->G);
#if !defined(MBEDTLS_ECP_WITH_MPI_UINT)
mbedtls_mpi_free(&grp->N);
mbedtls_mpi_free(&grp->P);
#endif
if (grp->h != 2) {
mbedtls_mpi_free(&grp->N);
mbedtls_mpi_free(&grp->P);
}
}
if (!ecp_group_is_static_comb_table(grp) && grp->T != NULL) {
@ -1013,15 +1014,11 @@ static int ecp_modp(mbedtls_mpi *N, const mbedtls_ecp_group *grp)
MBEDTLS_MPI_CHK(grp->modp(N));
/* N->s < 0 is a much faster test, which fails only if N is 0 */
while (N->s < 0 && mbedtls_mpi_cmp_int(N, 0) != 0) {
MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(N, N, &grp->P));
}
while (mbedtls_mpi_cmp_mpi(N, &grp->P) >= 0) {
/* we known P, N and the result are positive */
MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs(N, N, &grp->P));
}
/* The previous call left N in the range [0, 2P) with no more limbs than P
* (see documentation of mbedtls_ecp_mod_pXXX_raw() in ecp_invasive.h),
* so we can bring it into the range [0, P) in constant time. */
mbedtls_mpi_uint c = mbedtls_mpi_core_sub(N->p, N->p, grp->P.p, grp->P.n);
(void) mbedtls_mpi_core_add_if(N->p, grp->P.p, grp->P.n, (unsigned) c);
cleanup:
return ret;

1573
library/ecp_curves.c
View File

File diff suppressed because it is too large Load Diff

6033
library/ecp_curves_new.c
View File

File diff suppressed because it is too large Load Diff

56
library/ecp_invasive.h
View File

@ -28,21 +28,8 @@ typedef enum {
MBEDTLS_ECP_MOD_SCALAR
} mbedtls_ecp_modulus_type;
typedef enum {
MBEDTLS_ECP_VARIANT_NONE = 0,
MBEDTLS_ECP_VARIANT_WITH_MPI_STRUCT,
MBEDTLS_ECP_VARIANT_WITH_MPI_UINT
} mbedtls_ecp_variant;
#if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_ECP_LIGHT)
/** Queries the ecp variant.
*
* \return The id of the ecp variant.
*/
MBEDTLS_STATIC_TESTABLE
mbedtls_ecp_variant mbedtls_ecp_get_variant(void);
#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED)
/** Generate a private key on a Montgomery curve (Curve25519 or Curve448).
*
@ -74,7 +61,7 @@ int mbedtls_ecp_gen_privkey_mx(size_t high_bit,
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
/** Fast quasi-reduction modulo p192 (FIPS 186-3 D.2.1)
/** Fast quasi-reduction modulo p192
*
* This operation expects a 384 bit MPI and the result of the reduction
* is a 192 bit MPI.
@ -93,7 +80,7 @@ int mbedtls_ecp_mod_p192_raw(mbedtls_mpi_uint *Np, size_t Nn);
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
/** Fast quasi-reduction modulo p224 (FIPS 186-3 D.2.2)
/** Fast quasi-reduction modulo p224
*
* \param[in,out] X The address of the MPI to be converted.
* Must have exact limb size that stores a 448-bit MPI
@ -115,7 +102,7 @@ int mbedtls_ecp_mod_p224_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
/** Fast quasi-reduction modulo p256 (FIPS 186-3 D.2.3)
/** Fast quasi-reduction modulo p256
*
* \param[in,out] X The address of the MPI to be converted.
* Must have exact limb size that stores a 512-bit MPI
@ -137,7 +124,7 @@ int mbedtls_ecp_mod_p256_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
/** Fast quasi-reduction modulo p521 = 2^521 - 1 (FIPS 186-3 D.2.5)
/** Fast quasi-reduction modulo p521 = 2^521 - 1
*
* \param[in,out] X The address of the MPI to be converted.
* Must have twice as many limbs as the modulus
@ -159,7 +146,7 @@ int mbedtls_ecp_mod_p521_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
/** Fast quasi-reduction modulo p384 (FIPS 186-3 D.2.4)
/** Fast quasi-reduction modulo p384
*
* \param[in,out] X The address of the MPI to be converted.
* Must have exact limb size that stores a 768-bit MPI
@ -181,8 +168,7 @@ int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
/** Fast quasi-reduction modulo p192k1 = 2^192 - R,
* with R = 2^32 + 2^12 + 2^8 + 2^7 + 2^6 + 2^3 + 1 = 0x01000011C9
/** Fast quasi-reduction modulo p192k1 = 2^192 - 0x01000011C9
*
* \param[in,out] X The address of the MPI to be converted.
* Must have exact limb size that stores a 384-bit MPI
@ -196,7 +182,6 @@ int mbedtls_ecp_mod_p384_raw(mbedtls_mpi_uint *X, size_t X_limbs);
* \return \c 0 on success.
* \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p X does not have
* twice as many limbs as the modulus.
* \return #MBEDTLS_ERR_ECP_ALLOC_FAILED if memory allocation failed.
*/
MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_mod_p192k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
@ -205,8 +190,7 @@ int mbedtls_ecp_mod_p192k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
/** Fast quasi-reduction modulo p224k1 = 2^224 - R,
* with R = 2^32 + 2^12 + 2^11 + 2^9 + 2^7 + 2^4 + 2 + 1 = 0x0100001A93
/** Fast quasi-reduction modulo p224k1 = 2^224 - 0x0100001A93
*
* \param[in,out] X The address of the MPI to be converted.
* Must have exact limb size that stores a 448-bit MPI
@ -220,7 +204,6 @@ int mbedtls_ecp_mod_p192k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
* \return \c 0 on success.
* \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p X does not have
* twice as many limbs as the modulus.
* \return #MBEDTLS_ERR_ECP_ALLOC_FAILED if memory allocation failed.
*/
MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_mod_p224k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
@ -229,8 +212,7 @@ int mbedtls_ecp_mod_p224k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
/** Fast quasi-reduction modulo p256k1 = 2^256 - R,
* with R = 2^32 + 2^9 + 2^8 + 2^7 + 2^6 + 2^4 + 1 = 0x01000003D1
/** Fast quasi-reduction modulo p256k1 = 2^256 - 0x01000003D1
*
* \param[in,out] X The address of the MPI to be converted.
* Must have exact limb size that stores a 512-bit MPI
@ -244,7 +226,6 @@ int mbedtls_ecp_mod_p224k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
* \return \c 0 on success.
* \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p X does not have
* twice as many limbs as the modulus.
* \return #MBEDTLS_ERR_ECP_ALLOC_FAILED if memory allocation failed.
*/
MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_mod_p256k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
@ -260,12 +241,13 @@ int mbedtls_ecp_mod_p256k1_raw(mbedtls_mpi_uint *X, size_t X_limbs);
* (double the bitlength of the modulus).
* Upon return holds the reduced value which is
* in range `0 <= X < 2 * N` (where N is the modulus).
* The bitlength of the reduced value is at most 256
* (that is, 1 more than that of the modulus).
* \param[in] X_limbs The length of \p X in limbs.
*
* \return \c 0 on success.
* \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p X does not have
* twice as many limbs as the modulus.
* \return #MBEDTLS_ERR_ECP_ALLOC_FAILED if memory allocation failed.
*/
MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_mod_p255_raw(mbedtls_mpi_uint *X, size_t X_limbs);
@ -275,29 +257,26 @@ int mbedtls_ecp_mod_p255_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
/** Fast quasi-reduction modulo p448 = 2^448 - 2^224 - 1
* Write X as A0 + 2^448 A1 and A1 as B0 + 2^224 B1, and return A0 + A1 + B1 +
* (B0 + B1) * 2^224.
*
* \param[in,out] X The address of the MPI to be converted.
* Must have exact limb size that stores a 896-bit MPI
* (double the bitlength of the modulus). Upon return
* holds the reduced value which is in range `0 <= X <
* N` (where N is the modulus). The bitlength of the
* reduced value is the same as that of the modulus
* (448 bits).
* (double the bitlength of the modulus).
* Upon return holds the reduced value which is in
* range `0 <= X < 2 * N` (where N is the modulus).
* The bitlength of the reduced value is the same as
* that of the modulus (448 bits).
* \param[in] X_limbs The length of \p X in limbs.
*
* \return \c 0 on Success.
* \return #MBEDTLS_ERR_ECP_BAD_INPUT_DATA if \p X does not have
* twice as many limbs as the modulus.
* \return #MBEDTLS_ERR_ECP_ALLOC_FAILED if memory allocation
* failed.
*/
MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_mod_p448_raw(mbedtls_mpi_uint *X, size_t X_limbs);
#endif /* MBEDTLS_ECP_DP_CURVE448_ENABLED */
#if defined(MBEDTLS_ECP_WITH_MPI_UINT)
/** Initialise a modulus with hard-coded const curve data.
*
* \note The caller is responsible for the \p N modulus' memory.
@ -319,7 +298,8 @@ MBEDTLS_STATIC_TESTABLE
int mbedtls_ecp_modulus_setup(mbedtls_mpi_mod_modulus *N,
const mbedtls_ecp_group_id id,
const mbedtls_ecp_modulus_type ctype);
#endif /* MBEDTLS_ECP_WITH_MPI_UINT */
#endif /* MBEDTLS_TEST_HOOKS && MBEDTLS_ECP_C */
#endif /* MBEDTLS_TEST_HOOKS && MBEDTLS_ECP_LIGHT */
#endif /* MBEDTLS_ECP_INVASIVE_H */

8
library/pk_ecc.c
View File

@ -205,13 +205,19 @@ int mbedtls_pk_ecc_set_pubkey(mbedtls_pk_context *pk, const unsigned char *pub,
{
#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
/* We need to read the first byte to determine the format (compressed,
* uncompressed or 0). */
if (pub_len == 0) {
return MBEDTLS_ERR_PK_INVALID_PUBKEY;
}
/* Load the key */
if (!PSA_ECC_FAMILY_IS_WEIERSTRASS(pk->ec_family) || *pub == 0x04) {
/* Format directly supported by PSA:
* - non-Weierstrass curves that only have one format;
* - uncompressed format for Weierstrass curves. */
if (pub_len > sizeof(pk->pub_raw)) {
return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL;
return MBEDTLS_ERR_PK_INVALID_PUBKEY;
}
memcpy(pk->pub_raw, pub, pub_len);
pk->pub_raw_len = pub_len;

53
library/pk_wrap.c
View File

@ -34,6 +34,7 @@
#if defined(MBEDTLS_RSA_C)
#include "pkwrite.h"
#include "rsa_internal.h"
#include "constant_time_internal.h"
#endif
#if defined(MBEDTLS_PK_CAN_ECDSA_SOME)
@ -329,21 +330,33 @@ static int rsa_decrypt_wrap(mbedtls_pk_context *pk,
input, ilen,
NULL, 0,
output, osize, olen);
if (status != PSA_SUCCESS) {
ret = PSA_PK_RSA_TO_MBEDTLS_ERR(status);
goto cleanup;
}
ret = 0;
#if defined(MBEDTLS_PKCS1_V15)
/* Translate error codes from PSA to legacy
* Success vs INVALID_PADDING vs BUFFER_TOO_SMALL is sensitive
* (padding oracle attack), so we take care to translate that
* part in constant time.
*/
int problem;
status = mbedtls_rsa_decrypt_decompose_ret(
PSA_ERROR_INVALID_PADDING, MBEDTLS_ERR_RSA_INVALID_PADDING,
PSA_ERROR_BUFFER_TOO_SMALL, MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE,
status, &problem);
ret = PSA_PK_RSA_TO_MBEDTLS_ERR(status);
ret |= problem;
#else
ret = PSA_PK_RSA_TO_MBEDTLS_ERR(status);
#endif
cleanup:
mbedtls_zeroize_and_free(buf, buf_size);
status = psa_destroy_key(key_id);
if (ret == 0 && status != PSA_SUCCESS) {
ret = PSA_PK_TO_MBEDTLS_ERR(status);
}
return ret;
/* Don't branch on ret as it is a sensitive value
* (it reveals whether padding was valid).
* Instead branch on status. That means when both ret and
* status were errors, we'll return the unlock status while we would
* normally return the first error, but that's better than leaking info. */
return (status != PSA_SUCCESS) ? PSA_PK_TO_MBEDTLS_ERR(status) : ret;
}
#else /* MBEDTLS_USE_PSA_CRYPTO */
static int rsa_decrypt_wrap(mbedtls_pk_context *pk,
@ -1503,11 +1516,21 @@ static int rsa_opaque_decrypt(mbedtls_pk_context *pk,
}
status = psa_asymmetric_decrypt(pk->priv_id, alg, input, ilen, NULL, 0, output, osize, olen);
if (status != PSA_SUCCESS) {
return PSA_PK_RSA_TO_MBEDTLS_ERR(status);
}
return 0;
#if defined(MBEDTLS_PKCS1_V15)
/* Translate error codes from PSA to legacy
* Success vs INVALID_PADDING vs BUFFER_TOO_SMALL is sensitive
* (padding oracle attack), so we take care to translate that
* part in constant time.
*/
int problem;
status = mbedtls_rsa_decrypt_decompose_ret(
PSA_ERROR_INVALID_PADDING, MBEDTLS_ERR_RSA_INVALID_PADDING,
PSA_ERROR_BUFFER_TOO_SMALL, MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE,
status, &problem);
return PSA_PK_RSA_TO_MBEDTLS_ERR(status) | problem;
#else
return PSA_PK_RSA_TO_MBEDTLS_ERR(status);
#endif
}
#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC */

16
library/pkcs7.c
View File

@ -666,6 +666,20 @@ static int mbedtls_pkcs7_data_or_hash_verify(mbedtls_pkcs7 *pkcs7,
return ret;
}
#if !defined(MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES)
/* Ensure the MD alg from the PKCS#7 context and signature algorithm from
* the certificate belong to the list of secure algorithms
* (i.e. mbedtls_x509_crt_profile_default). */
ret = mbedtls_x509_profile_check_md_alg(&mbedtls_x509_crt_profile_default, md_alg);
if (ret != 0) {
return MBEDTLS_ERR_PKCS7_INVALID_ALG;
}
ret = mbedtls_x509_profile_check_pk_alg(&mbedtls_x509_crt_profile_default, cert->sig_pk);
if (ret != 0) {
return MBEDTLS_ERR_PKCS7_INVALID_ALG;
}
#endif /* MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES */
md_info = mbedtls_md_info_from_type(md_alg);
if (md_info == NULL) {
return MBEDTLS_ERR_PKCS7_VERIFY_FAIL;
@ -767,7 +781,7 @@ void mbedtls_pkcs7_free(mbedtls_pkcs7 *pkcs7)
mbedtls_free(signer_prev);
}
pkcs7->raw.p = NULL;
mbedtls_platform_zeroize(pkcs7, sizeof(*pkcs7));
}
#endif

15
library/psa_crypto.c
View File

@ -3568,7 +3568,12 @@ exit:
LOCAL_INPUT_FREE(salt_external, salt);
LOCAL_OUTPUT_FREE(output_external, output);
return (status == PSA_SUCCESS) ? unlock_status : status;
/* Don't branch on status as it is a sensitive value
* (it reveals whether padding was valid).
* Instead branch on unlock_status. That means when both status and
* unlock_status were errors, we'll return the unlock error while we would
* normally return the first error, but that's better than leaking info. */
return (unlock_status != PSA_SUCCESS) ? unlock_status : status;
}
/****************************************************************/
@ -5357,7 +5362,13 @@ psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation,
#endif /* PSA_WANT_ALG_CCM */
#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
case PSA_ALG_CHACHA20_POLY1305:
/* No length restrictions for ChaChaPoly. */
#if SIZE_MAX > UINT32_MAX
if (plaintext_length > (size_t) UINT32_MAX *
64U) {
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
#endif
break;
#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
default:

25
library/psa_crypto_rsa.c
View File

@ -25,6 +25,7 @@
#include <mbedtls/rsa.h>
#include <mbedtls/error.h>
#include "rsa_internal.h"
#include "constant_time_internal.h"
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
@ -652,14 +653,22 @@ psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attribut
if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
status = mbedtls_to_psa_error(
mbedtls_rsa_pkcs1_decrypt(rsa,
mbedtls_psa_get_random,
MBEDTLS_PSA_RANDOM_STATE,
output_length,
input,
output,
output_size));
int combined_ret = mbedtls_rsa_rsaes_pkcs1_v15_decrypt(
rsa, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE,
output_length, input, output, output_size);
/* Translate error codes from legacy to PSA.
* Success vs INVALID_PADDING vs OUTPUT_TOO_LARGE is sensitive
* (padding oracle attack), so we take care to translate that
* part in constant time.
*/
int problem;
int public_ret = mbedtls_rsa_decrypt_decompose_ret(
MBEDTLS_ERR_RSA_INVALID_PADDING, PSA_ERROR_INVALID_PADDING,
MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE, PSA_ERROR_BUFFER_TOO_SMALL,
combined_ret, &problem);
status = mbedtls_to_psa_error(public_ret);
status |= problem;
#else
status = PSA_ERROR_NOT_SUPPORTED;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */

61
library/rsa.c
View File

@ -414,37 +414,12 @@ end_of_export:
#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)
/** This function performs the unpadding part of a PKCS#1 v1.5 decryption
* operation (EME-PKCS1-v1_5 decoding).
*
* \note The return value from this function is a sensitive value
* (this is unusual). #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE shouldn't happen
* in a well-written application, but 0 vs #MBEDTLS_ERR_RSA_INVALID_PADDING
* is often a situation that an attacker can provoke and leaking which
* one is the result is precisely the information the attacker wants.
*
* \param input The input buffer which is the payload inside PKCS#1v1.5
* encryption padding, called the "encoded message EM"
* by the terminology.
* \param ilen The length of the payload in the \p input buffer.
* \param output The buffer for the payload, called "message M" by the
* PKCS#1 terminology. This must be a writable buffer of
* length \p output_max_len bytes.
* \param olen The address at which to store the length of
* the payload. This must not be \c NULL.
* \param output_max_len The length in bytes of the output buffer \p output.
*
* \return \c 0 on success.
* \return #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE
* The output buffer is too small for the unpadded payload.
* \return #MBEDTLS_ERR_RSA_INVALID_PADDING
* The input doesn't contain properly formatted padding.
/*
* EME-PKCS1-v1_5 decoding, see documentation in rsa_internal.h
*/
static int mbedtls_ct_rsaes_pkcs1_v15_unpadding(unsigned char *input,
size_t ilen,
unsigned char *output,
size_t output_max_len,
size_t *olen)
MBEDTLS_STATIC_TESTABLE int mbedtls_ct_rsaes_pkcs1_v15_unpadding(
unsigned char *input, size_t ilen,
unsigned char *output, size_t output_max_len, size_t *olen)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
size_t i, plaintext_max_size;
@ -567,6 +542,32 @@ static int mbedtls_ct_rsaes_pkcs1_v15_unpadding(unsigned char *input,
#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */
#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C)
int mbedtls_rsa_decrypt_decompose_ret(
int invalid_padding_in, int invalid_padding_out,
int output_too_large_in, int output_too_large_out,
int combined_ret,
int *problem)
{
*problem = 0;
int ret = combined_ret;
const mbedtls_ct_condition_t invalid_padding_cond =
mbedtls_ct_uint_eq((mbedtls_ct_uint_t) ret,
(mbedtls_ct_uint_t) invalid_padding_in);
*problem = mbedtls_ct_error_if(invalid_padding_cond, invalid_padding_out, *problem);
ret = mbedtls_ct_error_if(invalid_padding_cond, 0, ret);
const mbedtls_ct_condition_t output_too_large_cond =
mbedtls_ct_uint_eq((mbedtls_ct_uint_t) ret,
(mbedtls_ct_uint_t) output_too_large_in);
*problem = mbedtls_ct_error_if(output_too_large_cond, output_too_large_out, *problem);
ret = mbedtls_ct_error_if(output_too_large_cond, 0, ret);
return ret;
}
#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C */
#if !defined(MBEDTLS_RSA_ALT)
int mbedtls_rsa_import(mbedtls_rsa_context *ctx,

67
library/rsa_internal.h
View File

@ -118,4 +118,71 @@ int mbedtls_rsa_rsassa_pss_sign_no_mode_check(mbedtls_rsa_context *ctx,
unsigned char *sig);
#endif /* MBEDTLS_PKCS1_V21 */
/* This would normally be in rsa_invasive.h but it didn't exist before 3.6
* became an LTS, and I'd rather not add files in LTS if it can be avoided. */
#if defined(MBEDTLS_TEST_HOOKS)
#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C) && !defined(MBEDTLS_RSA_ALT)
/** This function performs the unpadding part of a PKCS#1 v1.5 decryption
* operation (EME-PKCS1-v1_5 decoding).
*
* \note The return value from this function is a sensitive value
* (this is unusual). #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE shouldn't happen
* in a well-written application, but 0 vs #MBEDTLS_ERR_RSA_INVALID_PADDING
* is often a situation that an attacker can provoke and leaking which
* one is the result is precisely the information the attacker wants.
*
* \param input The input buffer which is the payload inside PKCS#1v1.5
* encryption padding, called the "encoded message EM"
* by the terminology.
* \param ilen The length of the payload in the \p input buffer.
* \param output The buffer for the payload, called "message M" by the
* PKCS#1 terminology. This must be a writable buffer of
* length \p output_max_len bytes.
* \param olen The address at which to store the length of
* the payload. This must not be \c NULL.
* \param output_max_len The length in bytes of the output buffer \p output.
*
* \return \c 0 on success.
* \return #MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE
* The output buffer is too small for the unpadded payload.
* \return #MBEDTLS_ERR_RSA_INVALID_PADDING
* The input doesn't contain properly formatted padding.
*/
MBEDTLS_STATIC_TESTABLE int mbedtls_ct_rsaes_pkcs1_v15_unpadding(
unsigned char *input, size_t ilen,
unsigned char *output, size_t output_max_len, size_t *olen);
#endif /* MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C && ! MBEDTLS_RSA_ALT */
#endif /* MBEDTLS_TEST_HOOKS */
#if defined(MBEDTLS_PKCS1_V15) && defined(MBEDTLS_RSA_C)
/** Decompose sensitive return values out of a return code, in constant time.
*
* \param invalid_padding_in The value of \p combined_ret that indicates
* invalid padding.
* \param invalid_padding_out The value to set \p problem to in case of
* invalid padding.
* \param output_too_large_in The value of \p combined_ret that indicates
* an insufficient output buffer size.
* \param output_too_large_out The value to set \p problem to in case of
* an insufficient output buffer size.
* \param combined_ret The value to decompose.
* \param[out] problem On output:
* - \p invalid_padding_out,
* if \p combined_ret = \p invalid_padding_in;
* - \p output_too_large_out,
* if \p combined_ret = \p output_too_large_in;
* - otherwise \c 0.
*
* \return - \c 0 if \p combined_ret = \p invalid_padding_in
* or \p combined_ret = \p output_too_large_in;
* - otherwise \c combined_ret.
*/
int mbedtls_rsa_decrypt_decompose_ret(
int invalid_padding_in, int invalid_padding_out,
int output_too_large_in, int output_too_large_out,
int combined_ret,
int *problem);
#endif
#endif /* rsa_internal.h */

8
library/ssl_client.c
View File

@ -210,6 +210,10 @@ static int ssl_write_alpn_ext(mbedtls_ssl_context *ssl,
* generalization of the TLS 1.2 supported elliptic curves extension. They both
* share the same extension identifier.
*
* If the TLS 1.3 logic for selecting proposed groups changes, the TLS 1.3
* group filtering in the function `ssl_tls13_parse_hrr_key_share_ext()` must
* be updated accordingly.
*
*/
#define SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_2_FLAG 1
#define SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_3_FLAG 2
@ -253,8 +257,8 @@ static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl,
if (flags & SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_3_FLAG) {
#if defined(PSA_WANT_ALG_ECDH)
if (mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list) &&
(mbedtls_ssl_get_ecp_group_id_from_tls_id(*group_list) !=
MBEDTLS_ECP_DP_NONE)) {
mbedtls_ssl_get_psa_curve_info_from_tls_id(
*group_list, NULL, NULL) == PSA_SUCCESS) {
propose_group = 1;
}
#endif

93
library/ssl_misc.h
View File

@ -484,6 +484,99 @@ static inline size_t mbedtls_ssl_get_input_buflen(const mbedtls_ssl_context *ctx
}
#endif
/** Get `ssl->badmac_seen`. This field is encoded as
* mbedtls_ssl_context::badmac_seen_or_in_hsfraglen in DTLS contexts,
* and doesn't exist in TLS contexts.
*
* \param[in] ssl The SSL context to read.
*
* \return In DTLS, the value of `badmac_seen`. In TLS, 0 (there can't have
* been a record with a bad MAC in TLS, since those abort the
* connection immediately).
*/
static inline unsigned mbedtls_ssl_get_badmac_seen(const mbedtls_ssl_context *ssl)
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
return ssl->badmac_seen_or_in_hsfraglen;
}
#endif
(void) ssl;
return 0;
}
#if defined(MBEDTLS_SSL_PROTO_DTLS)
/* We shouldn't be trying to set badmac_seen if DTLS support is disabled
* at compile time. If this is called from a code block that checks for the
* DTLS protocol at run time, it should be guarded by
* defined(MBEDTLS_SSL_PROTO_DTLS). */
/** Set `ssl->badmac_seen`. This field is encoded as
* mbedtls_ssl_context::badmac_seen_or_in_hsfraglen in DTLS contexts,
* and doesn't exist in TLS contexts.
*
* \param[in,out] ssl The SSL context to modify.
* \param badmac_seen The new value of `badmac_seen`.
*
* \return 0 in DTLS, #MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED in TLS.
*/
MBEDTLS_CHECK_RETURN_CRITICAL
static inline int mbedtls_ssl_set_badmac_seen(mbedtls_ssl_context *ssl,
unsigned badmac_seen)
{
if ((ssl)->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
MBEDTLS_SSL_DEBUG_RET(1, ("Internal error: trying to set badmac_seen in TLS"),
MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED);
return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
}
ssl->badmac_seen_or_in_hsfraglen = badmac_seen;
return 0;
}
#endif
/** Get `ssl->in_hsfraglen`. This field is encoded as
* mbedtls_ssl_context::badmac_seen_or_in_hsfraglen in TLS contexts,
* and doesn't exist in DTLS contexts.
*
* \param[in] ssl The SSL context to read.
*
* \return In TLS, the value of `in_hsfraglen`. In DTLS, 0 (handshake
* message defragmentation is handled different in DTLS, and
* does not use this field).
*/
static inline unsigned mbedtls_ssl_get_in_hsfraglen(const mbedtls_ssl_context *ssl)
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
return 0;
}
#endif
return ssl->badmac_seen_or_in_hsfraglen;
}
/** Set `ssl->in_hsfraglen`. This field is encoded as
* mbedtls_ssl_context::badmac_seen_or_in_hsfraglen in TLS contexts,
* and doesn't exist in DTLS contexts.
*
* \param[in,out] ssl The SSL context to modify.
* \param in_hsfraglen The new value of `in_hsfraglen`.
*
* \return 0 in TLS, #MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED in DTLS.
*/
MBEDTLS_CHECK_RETURN_CRITICAL
static inline int mbedtls_ssl_set_in_hsfraglen(mbedtls_ssl_context *ssl,
unsigned in_hsfraglen)
{
#if defined(MBEDTLS_SSL_PROTO_DTLS)
if ((ssl)->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
MBEDTLS_SSL_DEBUG_RET(1, ("Internal error: trying to set in_hsfraglen in DTLS"),
MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED);
return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
}
#endif
ssl->badmac_seen_or_in_hsfraglen = in_hsfraglen;
return 0;
}
/*
* TLS extension flags (for extensions with outgoing ServerHello content
* that need it (e.g. for RENEGOTIATION_INFO the server already knows because

50
library/ssl_msg.c
View File

@ -3224,7 +3224,10 @@ static uint32_t ssl_get_hs_total_len(mbedtls_ssl_context const *ssl)
int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl)
{
if (ssl->badmac_seen_or_in_hsfraglen == 0) {
/* Set handshake record length if this is the first fragment.
* Do it unconditionally for DTLS, for which handshake fragmentation
* is handled completely differently. */
if (mbedtls_ssl_get_in_hsfraglen(ssl) == 0) {
/* The handshake message must at least include the header.
* We may not have the full message yet in case of fragmentation.
* To simplify the code, we insist on having the header (and in
@ -3364,9 +3367,10 @@ int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl)
ssl->in_buf + MBEDTLS_SSL_SEQUENCE_NUMBER_LEN;
unsigned char *const payload_start =
reassembled_record_start + mbedtls_ssl_in_hdr_len(ssl);
unsigned char *payload_end = payload_start + ssl->badmac_seen_or_in_hsfraglen;
unsigned in_hsfraglen = mbedtls_ssl_get_in_hsfraglen(ssl);
unsigned char *payload_end = payload_start + in_hsfraglen;
/* How many more bytes we want to have a complete handshake message. */
const size_t hs_remain = ssl->in_hslen - ssl->badmac_seen_or_in_hsfraglen;
const size_t hs_remain = ssl->in_hslen - in_hsfraglen;
/* How many bytes of the current record are part of the first
* handshake message. There may be more handshake messages (possibly
* incomplete) in the same record; if so, we leave them after the
@ -3379,15 +3383,12 @@ int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(3,
("%s handshake fragment: %" MBEDTLS_PRINTF_SIZET
", %u..%u of %" MBEDTLS_PRINTF_SIZET,
(ssl->badmac_seen_or_in_hsfraglen != 0 ?
"subsequent" :
hs_this_fragment_len == ssl->in_hslen ?
"sole" :
(in_hsfraglen != 0 ? "subsequent" :
hs_this_fragment_len == ssl->in_hslen ? "sole" :
"initial"),
ssl->in_msglen,
ssl->badmac_seen_or_in_hsfraglen,
ssl->badmac_seen_or_in_hsfraglen +
(unsigned) hs_this_fragment_len,
in_hsfraglen,
in_hsfraglen + (unsigned) hs_this_fragment_len,
ssl->in_hslen));
/* Move the received handshake fragment to have the whole message
@ -3417,20 +3418,25 @@ int mbedtls_ssl_prepare_handshake_record(mbedtls_ssl_context *ssl)
}
memmove(payload_end, ssl->in_msg, ssl->in_msglen);
ssl->badmac_seen_or_in_hsfraglen += (unsigned) ssl->in_msglen;
in_hsfraglen += (unsigned) ssl->in_msglen;
payload_end += ssl->in_msglen;
if (ssl->badmac_seen_or_in_hsfraglen < ssl->in_hslen) {
if (in_hsfraglen < ssl->in_hslen) {
MBEDTLS_SSL_DEBUG_MSG(3, ("Prepare: waiting for more handshake fragments "
"%u/%" MBEDTLS_PRINTF_SIZET,
ssl->badmac_seen_or_in_hsfraglen, ssl->in_hslen));
in_hsfraglen, ssl->in_hslen));
ssl->in_hdr = payload_end;
ssl->in_msglen = 0;
if (mbedtls_ssl_set_in_hsfraglen(ssl, in_hsfraglen) != 0) {
return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
}
mbedtls_ssl_update_in_pointers(ssl);
return MBEDTLS_ERR_SSL_CONTINUE_PROCESSING;
} else {
ssl->in_msglen = ssl->badmac_seen_or_in_hsfraglen;
ssl->badmac_seen_or_in_hsfraglen = 0;
ssl->in_msglen = in_hsfraglen;
if (mbedtls_ssl_set_in_hsfraglen(ssl, 0) != 0) {
return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
}
ssl->in_hdr = reassembled_record_start;
mbedtls_ssl_update_in_pointers(ssl);
@ -4785,11 +4791,11 @@ static int ssl_consume_current_message(mbedtls_ssl_context *ssl)
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
if (ssl->badmac_seen_or_in_hsfraglen != 0) {
if (mbedtls_ssl_get_in_hsfraglen(ssl) != 0) {
/* Not all handshake fragments have arrived, do not consume. */
MBEDTLS_SSL_DEBUG_MSG(3, ("Consume: waiting for more handshake fragments "
"%u/%" MBEDTLS_PRINTF_SIZET,
ssl->badmac_seen_or_in_hsfraglen, ssl->in_hslen));
mbedtls_ssl_get_in_hsfraglen(ssl), ssl->in_hslen));
return 0;
}
@ -5147,8 +5153,11 @@ static int ssl_get_next_record(mbedtls_ssl_context *ssl)
}
if (ssl->conf->badmac_limit != 0) {
++ssl->badmac_seen_or_in_hsfraglen;
if (ssl->badmac_seen_or_in_hsfraglen >= ssl->conf->badmac_limit) {
unsigned badmac_seen = mbedtls_ssl_get_badmac_seen(ssl) + 1;
if (mbedtls_ssl_set_badmac_seen(ssl, badmac_seen) != 0) {
return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
}
if (badmac_seen >= ssl->conf->badmac_limit) {
MBEDTLS_SSL_DEBUG_MSG(1, ("too many records with bad MAC"));
return MBEDTLS_ERR_SSL_INVALID_MAC;
}
@ -5208,8 +5217,7 @@ int mbedtls_ssl_handle_message_type(mbedtls_ssl_context *ssl)
* we don't accept any other message type. For TLS 1.3, the spec forbids
* interleaving other message types between handshake fragments. For TLS
* 1.2, the spec does not forbid it but we do. */
if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_STREAM &&
ssl->badmac_seen_or_in_hsfraglen != 0 &&
if (mbedtls_ssl_get_in_hsfraglen(ssl) != 0 &&
ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE) {
MBEDTLS_SSL_DEBUG_MSG(1, ("non-handshake message in the middle"
" of a fragmented handshake message"));

39
library/ssl_tls.c
View File

@ -31,8 +31,6 @@
#if defined(MBEDTLS_USE_PSA_CRYPTO)
#include "mbedtls/psa_util.h"
#include "md_psa.h"
#include "psa_util_internal.h"
#include "psa/crypto.h"
#endif
@ -857,11 +855,11 @@ int mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl)
#if defined(MBEDTLS_USE_PSA_CRYPTO)
status = psa_hash_abort(&ssl->handshake->fin_sha256_psa);
if (status != PSA_SUCCESS) {
return mbedtls_md_error_from_psa(status);
return PSA_TO_MBEDTLS_ERR(status);
}
status = psa_hash_setup(&ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256);
if (status != PSA_SUCCESS) {
return mbedtls_md_error_from_psa(status);
return PSA_TO_MBEDTLS_ERR(status);
}
#else
mbedtls_md_free(&ssl->handshake->fin_sha256);
@ -882,11 +880,11 @@ int mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl)
#if defined(MBEDTLS_USE_PSA_CRYPTO)
status = psa_hash_abort(&ssl->handshake->fin_sha384_psa);
if (status != PSA_SUCCESS) {
return mbedtls_md_error_from_psa(status);
return PSA_TO_MBEDTLS_ERR(status);
}
status = psa_hash_setup(&ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384);
if (status != PSA_SUCCESS) {
return mbedtls_md_error_from_psa(status);
return PSA_TO_MBEDTLS_ERR(status);
}
#else
mbedtls_md_free(&ssl->handshake->fin_sha384);
@ -924,7 +922,7 @@ static int ssl_update_checksum_start(mbedtls_ssl_context *ssl,
#if defined(MBEDTLS_USE_PSA_CRYPTO)
status = psa_hash_update(&ssl->handshake->fin_sha256_psa, buf, len);
if (status != PSA_SUCCESS) {
return mbedtls_md_error_from_psa(status);
return PSA_TO_MBEDTLS_ERR(status);
}
#else
ret = mbedtls_md_update(&ssl->handshake->fin_sha256, buf, len);
@ -937,7 +935,7 @@ static int ssl_update_checksum_start(mbedtls_ssl_context *ssl,
#if defined(MBEDTLS_USE_PSA_CRYPTO)
status = psa_hash_update(&ssl->handshake->fin_sha384_psa, buf, len);
if (status != PSA_SUCCESS) {
return mbedtls_md_error_from_psa(status);
return PSA_TO_MBEDTLS_ERR(status);
}
#else
ret = mbedtls_md_update(&ssl->handshake->fin_sha384, buf, len);
@ -954,8 +952,8 @@ static int ssl_update_checksum_sha256(mbedtls_ssl_context *ssl,
const unsigned char *buf, size_t len)
{
#if defined(MBEDTLS_USE_PSA_CRYPTO)
return mbedtls_md_error_from_psa(psa_hash_update(
&ssl->handshake->fin_sha256_psa, buf, len));
return PSA_TO_MBEDTLS_ERR(psa_hash_update(
&ssl->handshake->fin_sha256_psa, buf, len));
#else
return mbedtls_md_update(&ssl->handshake->fin_sha256, buf, len);
#endif
@ -967,8 +965,8 @@ static int ssl_update_checksum_sha384(mbedtls_ssl_context *ssl,
const unsigned char *buf, size_t len)
{
#if defined(MBEDTLS_USE_PSA_CRYPTO)
return mbedtls_md_error_from_psa(psa_hash_update(
&ssl->handshake->fin_sha384_psa, buf, len));
return PSA_TO_MBEDTLS_ERR(psa_hash_update(
&ssl->handshake->fin_sha384_psa, buf, len));
#else
return mbedtls_md_update(&ssl->handshake->fin_sha384, buf, len);
#endif
@ -1520,6 +1518,8 @@ void mbedtls_ssl_session_reset_msg_layer(mbedtls_ssl_context *ssl,
}
ssl->send_alert = 0;
ssl->alert_reason = 0;
ssl->alert_type = 0;
/* Reset outgoing message writing */
ssl->out_msgtype = 0;
@ -1593,6 +1593,10 @@ int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial)
ssl->alpn_chosen = NULL;
#endif
#if defined(MBEDTLS_SSL_DTLS_SRTP)
memset(&ssl->dtls_srtp_info, 0, sizeof(ssl->dtls_srtp_info));
#endif /* MBEDTLS_SSL_DTLS_SRTP */
#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && defined(MBEDTLS_SSL_SRV_C)
int free_cli_id = 1;
#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE)
@ -7111,11 +7115,16 @@ static int ssl_compute_master(mbedtls_ssl_handshake_params *handshake,
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
if (handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) {
lbl = "extended master secret";
seed = session_hash;
ret = handshake->calc_verify(ssl, session_hash, &seed_len);
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "calc_verify", ret);
return ret;
}
if (seed_len > sizeof(session_hash)) {
MBEDTLS_SSL_DEBUG_MSG(1, ("bad session hash length"));
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
seed = session_hash;
MBEDTLS_SSL_DEBUG_BUF(3, "session hash for extended master secret",
session_hash, seed_len);
@ -7371,7 +7380,7 @@ static int ssl_calc_verify_tls_psa(const mbedtls_ssl_context *ssl,
exit:
psa_hash_abort(&cloned_op);
return mbedtls_md_error_from_psa(status);
return PSA_TO_MBEDTLS_ERR(status);
}
#else
static int ssl_calc_verify_tls_legacy(const mbedtls_ssl_context *ssl,
@ -8270,7 +8279,7 @@ static int ssl_calc_finished_tls_generic(mbedtls_ssl_context *ssl, void *ctx,
exit:
#if defined(MBEDTLS_USE_PSA_CRYPTO)
psa_hash_abort(&cloned_op);
return mbedtls_md_error_from_psa(status);
return PSA_TO_MBEDTLS_ERR(status);
#else
mbedtls_md_free(&cloned_ctx);
return ret;

13
library/ssl_tls12_client.c
View File

@ -2325,6 +2325,8 @@ start_processing:
* However since we only support secp256r1 for now, we check only
* that TLS ID here
*/
MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 3);
uint16_t read_tls_id = MBEDTLS_GET_UINT16_BE(p, 1);
uint16_t exp_tls_id = mbedtls_ssl_get_tls_id_from_ecp_group_id(
MBEDTLS_ECP_DP_SECP256R1);
@ -2952,7 +2954,7 @@ ecdh_calc_secret:
if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx,
&ssl->handshake->pmslen,
ssl->handshake->premaster,
MBEDTLS_MPI_MAX_SIZE,
MBEDTLS_PREMASTER_SIZE,
ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret);
#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
@ -2992,11 +2994,16 @@ ecdh_calc_secret:
/* uint16 to store content length */
const size_t content_len_size = 2;
const size_t ecpoint_len_size = 1;
const size_t ecpoint_max_len =
PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(handshake->xxdh_psa_type,
handshake->xxdh_psa_bits);
header_len = 4;
if (header_len + content_len_size + ssl->conf->psk_identity_len
> MBEDTLS_SSL_OUT_CONTENT_LEN) {
if (ecpoint_max_len > MBEDTLS_SSL_OUT_CONTENT_LEN - ecpoint_len_size ||
header_len + content_len_size + ssl->conf->psk_identity_len
> MBEDTLS_SSL_OUT_CONTENT_LEN - ecpoint_len_size - ecpoint_max_len) {
MBEDTLS_SSL_DEBUG_MSG(1,
("psk identity too long or SSL buffer too short"));
return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;

28
library/ssl_tls12_server.c
View File

@ -1790,9 +1790,9 @@ static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl,
MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
unsigned char *buf,
size_t *olen)
static int ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
unsigned char *buf,
size_t *olen)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
unsigned char *p = buf;
@ -1804,14 +1804,14 @@ static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
/* Skip costly computation if not needed */
if (ssl->handshake->ciphersuite_info->key_exchange !=
MBEDTLS_KEY_EXCHANGE_ECJPAKE) {
return;
return 0;
}
MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, ecjpake kkpp extension"));
if (end - p < 4) {
MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small"));
return;
return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
}
MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ECJPAKE_KKPP, p, 0);
@ -1825,7 +1825,7 @@ static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
psa_destroy_key(ssl->handshake->psa_pake_password);
psa_pake_abort(&ssl->handshake->psa_pake_ctx);
MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret);
return;
return ret;
}
#else
ret = mbedtls_ecjpake_write_round_one(&ssl->handshake->ecjpake_ctx,
@ -1833,7 +1833,7 @@ static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
ssl->conf->f_rng, ssl->conf->p_rng);
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecjpake_write_round_one", ret);
return;
return ret;
}
#endif /* MBEDTLS_USE_PSA_CRYPTO */
@ -1841,6 +1841,7 @@ static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl,
p += 2;
*olen = kkpp_len + 4;
return 0;
}
#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
@ -2223,7 +2224,11 @@ static int ssl_write_server_hello(mbedtls_ssl_context *ssl)
#endif
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen);
ret = ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen);
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "ssl_write_ecjpake_kkpp_ext", ret);
return ret;
}
ext_len += olen;
#endif
@ -3675,7 +3680,7 @@ static int ssl_parse_client_key_exchange(mbedtls_ssl_context *ssl)
if ((ret = mbedtls_ecdh_calc_secret(&ssl->handshake->ecdh_ctx,
&ssl->handshake->pmslen,
ssl->handshake->premaster,
MBEDTLS_MPI_MAX_SIZE,
MBEDTLS_PREMASTER_SIZE,
ssl->conf->f_rng, ssl->conf->p_rng)) != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ecdh_calc_secret", ret);
return MBEDTLS_ERR_SSL_DECODE_ERROR;
@ -4132,8 +4137,8 @@ MBEDTLS_CHECK_RETURN_CRITICAL
static int ssl_write_new_session_ticket(mbedtls_ssl_context *ssl)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
size_t tlen;
uint32_t lifetime;
size_t tlen = 0;
uint32_t lifetime = 0;
MBEDTLS_SSL_DEBUG_MSG(2, ("=> write new session ticket"));
@ -4160,7 +4165,6 @@ static int ssl_write_new_session_ticket(mbedtls_ssl_context *ssl)
ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN,
&tlen, &lifetime)) != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_ticket_write", ret);
tlen = 0;
}
MBEDTLS_PUT_UINT32_BE(lifetime, ssl->out_msg, 4);

28
library/ssl_tls13_client.c
View File

@ -405,14 +405,18 @@ static int ssl_tls13_parse_hrr_key_share_ext(mbedtls_ssl_context *ssl,
* then the client MUST abort the handshake with an "illegal_parameter" alert.
*/
for (; *group_list != 0; group_list++) {
if (*group_list != selected_group) {
continue;
}
#if defined(PSA_WANT_ALG_ECDH)
if (mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list)) {
if ((mbedtls_ssl_get_psa_curve_info_from_tls_id(
*group_list, NULL, NULL) == PSA_ERROR_NOT_SUPPORTED) ||
*group_list != selected_group) {
found = 1;
break;
if (mbedtls_ssl_get_psa_curve_info_from_tls_id(
*group_list, NULL, NULL) == PSA_ERROR_NOT_SUPPORTED) {
continue;
}
/* Found only if psa_curve is supported and group_list == selected_group */
found = 1;
break;
}
#endif /* PSA_WANT_ALG_ECDH */
#if defined(PSA_WANT_ALG_FFDH)
@ -2018,6 +2022,19 @@ static int ssl_tls13_process_server_hello(mbedtls_ssl_context *ssl)
goto cleanup;
}
/*
* TLS 1.3 is negotiated. Check that ServerHello/HRR ends at a record
* boundary. For HRR, which does not trigger a key update, this checks
* that HRR terminates the server flight.
*/
if (ssl->in_hslen != ssl->in_msglen) {
MBEDTLS_SSL_DEBUG_MSG(1, ("ServerHello end not aligned with a record boundary"));
ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
goto cleanup;
}
MBEDTLS_SSL_PROC_CHK(ssl_tls13_parse_server_hello(ssl, buf,
buf + buf_len,
is_hrr));
@ -2806,6 +2823,7 @@ static int ssl_tls13_parse_new_session_ticket_exts(mbedtls_ssl_context *ssl,
MBEDTLS_SSL_DEBUG_RET(
1, "ssl_tls13_parse_new_session_ticket_early_data_ext",
ret);
return ret;
}
break;
#endif /* MBEDTLS_SSL_EARLY_DATA */

61
library/ssl_tls13_generic.c
View File

@ -59,20 +59,55 @@ int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
unsigned char **buf,
size_t *buf_len)
{
int ret;
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
int require_record_boundary;
if ((ret = mbedtls_ssl_read_record(ssl, 0)) != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
goto cleanup;
/* Require record-boundary alignment by default. The exceptions below are
* handshake messages that may legitimately be followed by additional
* handshake messages in the same record. Using the default behaviour for a
* message that should be exempt is an interoperability bug; exempting a
* message that should not be exempt may have security implications.
*/
switch (hs_type) {
case MBEDTLS_SSL_HS_NEW_SESSION_TICKET:
case MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS:
case MBEDTLS_SSL_HS_CERTIFICATE:
case MBEDTLS_SSL_HS_CERTIFICATE_REQUEST:
case MBEDTLS_SSL_HS_CERTIFICATE_VERIFY:
/*
* For TLS 1.3, ServerHello (including HelloRetryRequest) must end at a
* record boundary, but not for TLS 1.2. At this point the ServerHello
* has not yet been processed, so we do not know whether it negotiates
* TLS 1.3 or TLS 1.2. Defer the boundary check until the protocol
* version is known to be TLS 1.3.
*/
case MBEDTLS_SSL_HS_SERVER_HELLO:
require_record_boundary = 0;
break;
default:
/* ClientHello, EndOfEarlyData, Finished, and KeyUpdate.
*/
require_record_boundary = 1;
}
ret = mbedtls_ssl_read_record(ssl, 0);
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_read_record", ret);
goto error;
}
ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
if (ssl->in_msgtype != MBEDTLS_SSL_MSG_HANDSHAKE ||
ssl->in_msg[0] != hs_type) {
MBEDTLS_SSL_DEBUG_MSG(1, ("Receive unexpected handshake message."));
MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
ret = MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE;
goto cleanup;
goto error;
}
if (require_record_boundary && (ssl->in_hslen != ssl->in_msglen)) {
MBEDTLS_SSL_DEBUG_MSG(1, ("Handshake message %s end not aligned with a record boundary",
mbedtls_ssl_get_hs_msg_name(hs_type)));
goto error;
}
/*
@ -82,11 +117,15 @@ int mbedtls_ssl_tls13_fetch_handshake_msg(mbedtls_ssl_context *ssl,
* uint24 length;
* ...
*/
*buf = ssl->in_msg + 4;
*buf = ssl->in_msg + 4;
*buf_len = ssl->in_hslen - 4;
return 0;
cleanup:
error:
if (ret == MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE) {
MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_UNEXPECTED_MESSAGE,
MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
}
return ret;
}

8
library/ssl_tls13_server.c
View File

@ -3098,6 +3098,7 @@ static int ssl_tls13_process_client_finished(mbedtls_ssl_context *ssl)
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(
1, "mbedtls_ssl_tls13_compute_resumption_master_secret", ret);
return ret;
}
mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP);
@ -3204,9 +3205,10 @@ static int ssl_tls13_prepare_new_session_ticket(mbedtls_ssl_context *ssl,
#endif
/* Generate ticket_age_add */
if ((ret = ssl->conf->f_rng(ssl->conf->p_rng,
(unsigned char *) &session->ticket_age_add,
sizeof(session->ticket_age_add)) != 0)) {
ret = ssl->conf->f_rng(ssl->conf->p_rng,
(unsigned char *) &session->ticket_age_add,
sizeof(session->ticket_age_add));
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "generate_ticket_age_add", ret);
return ret;
}

69
library/x509_crt.c
View File

@ -88,11 +88,13 @@ typedef struct {
* concerns. */
const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_default =
{
/* Hashes from SHA-256 and above. Note that this selection
* should be aligned with ssl_preset_default_hashes in ssl_tls.c. */
/* Hashes from SHA-256 and above. */
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA256) |
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA384) |
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512),
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA512) |
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_256) |
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_384) |
MBEDTLS_X509_ID_FLAG(MBEDTLS_MD_SHA3_512),
0xFFFFFFF, /* Any PK alg */
#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
/* Curves at or above 128-bit security level. Note that this selection
@ -166,12 +168,8 @@ const mbedtls_x509_crt_profile mbedtls_x509_crt_profile_none =
(uint32_t) -1,
};
/*
* Check md_alg against profile
* Return 0 if md_alg is acceptable for this profile, -1 otherwise
*/
static int x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile,
mbedtls_md_type_t md_alg)
int mbedtls_x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile,
mbedtls_md_type_t md_alg)
{
if (md_alg == MBEDTLS_MD_NONE) {
return -1;
@ -184,12 +182,8 @@ static int x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile,
return -1;
}
/*
* Check pk_alg against profile
* Return 0 if pk_alg is acceptable for this profile, -1 otherwise
*/
static int x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile,
mbedtls_pk_type_t pk_alg)
int mbedtls_x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile,
mbedtls_pk_type_t pk_alg)
{
if (pk_alg == MBEDTLS_PK_NONE) {
return -1;
@ -513,23 +507,34 @@ static int x509_get_basic_constraints(unsigned char **p,
}
if (*p == end) {
/* Empty basicConstraints: valid, not a CA. */
return 0;
}
if ((ret = mbedtls_asn1_get_bool(p, end, ca_istrue)) != 0) {
if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
ret = mbedtls_asn1_get_int(p, end, ca_istrue);
}
if (ret != 0) {
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
}
if (*ca_istrue != 0) {
*ca_istrue = 1;
}
if ((size_t) (end - *p) != len) {
/* Reject junk after the SEQUENCE inside the extension (which is
* probably benign), and reject a SEQUENCE that extends beyond
* the extension (could be very dangerous). */
return MBEDTLS_ERR_X509_INVALID_EXTENSIONS;
}
if ((ret = mbedtls_asn1_get_bool(p, end, ca_istrue)) != 0) {
/* If the SEQUENCE starts with an INTEGER and not a BOOLEAN,
* according to RFC 5280, it's syntactically valid, but it's
* something that a CA MUST NOT produce. So we reject it.
*
* Note: historically, from XySSL 0.9 to Mbed TLS 3.6.6/4.1.0,
* `SEQUENCE { INTEGER n }` was interpreted as cA=FALSE if n == 0
* and cA=TRUE if n != 0. This was dangerous since
* `SEQUENCE { INTEGER n }` should be parsed as cA=FALSE
* according to RFC 5280, so we stopped doing it.
*/
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
}
/* `SEQUENCE { BOOLEAN FALSE }` is not DER since default-value fields
* must be omitted in DER. But it seems harmless, and Mbed TLS has
* always accepted it, so we continue to accept it. */
if (*p == end) {
return 0;
}
@ -2044,11 +2049,11 @@ static int x509_crt_verifycrl(mbedtls_x509_crt *crt, mbedtls_x509_crt *ca,
/*
* Check if CRL is correctly signed by the trusted CA
*/
if (x509_profile_check_md_alg(profile, crl_list->sig_md) != 0) {
if (mbedtls_x509_profile_check_md_alg(profile, crl_list->sig_md) != 0) {
flags |= MBEDTLS_X509_BADCRL_BAD_MD;
}
if (x509_profile_check_pk_alg(profile, crl_list->sig_pk) != 0) {
if (mbedtls_x509_profile_check_pk_alg(profile, crl_list->sig_pk) != 0) {
flags |= MBEDTLS_X509_BADCRL_BAD_PK;
}
@ -2579,11 +2584,11 @@ static int x509_crt_verify_chain(
}
/* Check signature algorithm: MD & PK algs */
if (x509_profile_check_md_alg(profile, child->sig_md) != 0) {
if (mbedtls_x509_profile_check_md_alg(profile, child->sig_md) != 0) {
*flags |= MBEDTLS_X509_BADCERT_BAD_MD;
}
if (x509_profile_check_pk_alg(profile, child->sig_pk) != 0) {
if (mbedtls_x509_profile_check_pk_alg(profile, child->sig_pk) != 0) {
*flags |= MBEDTLS_X509_BADCERT_BAD_PK;
}
@ -3091,7 +3096,7 @@ static int x509_crt_verify_restartable_ca_cb(mbedtls_x509_crt *crt,
/* Check the type and size of the key */
pk_type = mbedtls_pk_get_type(&crt->pk);
if (x509_profile_check_pk_alg(profile, pk_type) != 0) {
if (mbedtls_x509_profile_check_pk_alg(profile, pk_type) != 0) {
ee_flags |= MBEDTLS_X509_BADCERT_BAD_PK;
}

23
library/x509_csr.c
View File

@ -227,25 +227,34 @@ static int x509_csr_parse_attributes(mbedtls_x509_csr *csr,
/* Check that this is an extension-request attribute */
if (MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS9_CSR_EXT_REQ, &attr_oid) == 0) {
if ((ret = mbedtls_asn1_get_tag(p, end, &len,
if ((ret = mbedtls_asn1_get_tag(p, end_attr_data, &len,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET)) != 0) {
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
}
if ((ret = mbedtls_asn1_get_tag(p, end, &len,
const unsigned char *end_set = *p + len;
if (end_set != end_attr_data) {
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
}
if ((ret = mbedtls_asn1_get_tag(p, end_set, &len,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) !=
0) {
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
}
if ((ret = x509_csr_parse_extensions(csr, p, *p + len, cb, p_ctx)) != 0) {
return ret;
}
if (*p != end_attr_data) {
const unsigned char *end_exts = *p + len;
if (end_exts != end_set) {
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
}
if ((ret = x509_csr_parse_extensions(csr, p, end_exts, cb, p_ctx)) != 0) {
return ret;
}
/* x509_csr_parse_extensions() guarantees *p == end_exts
* on success */
}
*p = end_attr_data;

15
library/x509_internal.h
View File

@ -14,6 +14,7 @@
#include "mbedtls/build_info.h"
#include "mbedtls/x509.h"
#include "mbedtls/x509_crt.h"
#include "mbedtls/asn1.h"
#include "pk_internal.h"
@ -83,4 +84,18 @@ int mbedtls_x509_info_key_usage(char **buf, size_t *size,
int mbedtls_x509_write_set_san_common(mbedtls_asn1_named_data **extensions,
const mbedtls_x509_san_list *san_list);
/*
* Check md_alg against profile
* Return 0 if md_alg is acceptable for this profile, -1 otherwise
*/
int mbedtls_x509_profile_check_md_alg(const mbedtls_x509_crt_profile *profile,
mbedtls_md_type_t md_alg);
/*
* Check pk_alg against profile
* Return 0 if pk_alg is acceptable for this profile, -1 otherwise
*/
int mbedtls_x509_profile_check_pk_alg(const mbedtls_x509_crt_profile *profile,
mbedtls_pk_type_t pk_alg);
#endif /* MBEDTLS_X509_INTERNAL_H */

61
programs/ssl/ssl_client2.c
View File

@ -92,6 +92,7 @@ int main(void)
#define DFL_HS_TO_MIN 0
#define DFL_HS_TO_MAX 0
#define DFL_DTLS_MTU -1
#define DFL_BADMAC_LIMIT -1
#define DFL_DGRAM_PACKING 1
#define DFL_FALLBACK -1
#define DFL_EXTENDED_MS -1
@ -287,7 +288,8 @@ int main(void)
" mtu=%%d default: (library default: unlimited)\n" \
" dgram_packing=%%d default: 1 (allowed)\n" \
" allow or forbid packing of multiple\n" \
" records within a single datgram.\n"
" records within a single datagram.\n" \
" badmac_limit=%%d default: (library default: disabled)\n"
#else
#define USAGE_DTLS ""
#endif
@ -312,7 +314,7 @@ int main(void)
#if defined(MBEDTLS_SSL_RENEGOTIATION)
#define USAGE_RENEGO \
" renegotiation=%%d default: 0 (disabled)\n" \
" renegotiate=%%d default: 0 (disabled)\n" \
" renegotiate=%%d default: 0 (disabled), 1 immediately, 2 after first exchange\n" \
" renego_delay=%%d default: -2 (library default)\n"
#else
#define USAGE_RENEGO ""
@ -519,7 +521,7 @@ struct options {
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
int renegotiation; /* enable / disable renegotiation */
int allow_legacy; /* allow legacy renegotiation */
int renegotiate; /* attempt renegotiation? */
int renegotiate; /* attempt renegotiation? 1: before data, 2: after first exchange */
int renego_delay; /* delay before enforcing renegotiation */
int exchanges; /* number of data exchanges */
int min_version; /* minimum protocol version accepted */
@ -548,6 +550,7 @@ struct options {
int dtls_mtu; /* UDP Maximum transport unit for DTLS */
int fallback; /* is this a fallback connection? */
int dgram_packing; /* allow/forbid datagram packing */
int badmac_limit; /* Limit of records with bad MAC */
int extended_ms; /* negotiate extended master secret? */
int etm; /* negotiate encrypt then mac? */
int context_crt_cb; /* use context-specific CRT verify callback */
@ -1012,6 +1015,7 @@ int main(int argc, char *argv[])
opt.extended_ms = DFL_EXTENDED_MS;
opt.etm = DFL_ETM;
opt.dgram_packing = DFL_DGRAM_PACKING;
opt.badmac_limit = DFL_BADMAC_LIMIT;
opt.serialize = DFL_SERIALIZE;
opt.context_file = DFL_CONTEXT_FILE;
opt.eap_tls = DFL_EAP_TLS;
@ -1224,7 +1228,7 @@ usage:
opt.renego_delay = (atoi(q));
} else if (strcmp(p, "renegotiate") == 0) {
opt.renegotiate = atoi(q);
if (opt.renegotiate < 0 || opt.renegotiate > 1) {
if (opt.renegotiate < 0 || opt.renegotiate > 2) {
goto usage;
}
} else if (strcmp(p, "exchanges") == 0) {
@ -1437,6 +1441,11 @@ usage:
opt.dgram_packing != 1) {
goto usage;
}
} else if (strcmp(p, "badmac_limit") == 0) {
opt.badmac_limit = atoi(q);
if (opt.badmac_limit < 0) {
goto usage;
}
} else if (strcmp(p, "recsplit") == 0) {
opt.recsplit = atoi(q);
if (opt.recsplit < 0 || opt.recsplit > 1) {
@ -1911,6 +1920,10 @@ usage:
if (opt.dgram_packing != DFL_DGRAM_PACKING) {
mbedtls_ssl_set_datagram_packing(&ssl, opt.dgram_packing);
}
if (opt.badmac_limit != DFL_BADMAC_LIMIT) {
mbedtls_ssl_conf_dtls_badmac_limit(&conf, opt.badmac_limit);
}
#endif /* MBEDTLS_SSL_PROTO_DTLS */
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
@ -2536,7 +2549,7 @@ usage:
#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
#if defined(MBEDTLS_SSL_RENEGOTIATION)
if (opt.renegotiate) {
if (opt.renegotiate == 1) {
/*
* Perform renegotiation (this must be done when the server is waiting
* for input from our side).
@ -2911,6 +2924,44 @@ send_request:
goto send_request;
}
#if defined(MBEDTLS_SSL_RENEGOTIATION)
if (opt.renegotiate == 2) {
/* Perform renegotiation after the first data exchange.
* This is a one-time thing, we won't renegotiate even if there are
* more data exchanges that cause a `goto send_request` later.
*/
opt.renegotiate = 0;
mbedtls_printf(" . Performing renegotiation...");
fflush(stdout);
while ((ret = mbedtls_ssl_renegotiate(&ssl)) != 0) {
if (ret != MBEDTLS_ERR_SSL_WANT_READ &&
ret != MBEDTLS_ERR_SSL_WANT_WRITE &&
ret != MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) {
mbedtls_printf(" failed\n ! mbedtls_ssl_renegotiate returned %d\n\n",
ret);
goto exit;
}
#if defined(MBEDTLS_ECP_RESTARTABLE)
if (ret == MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) {
continue;
}
#endif
/* For event-driven IO, wait for socket to become available */
if (opt.event == 1 /* level triggered IO */) {
#if defined(MBEDTLS_TIMING_C)
idle(&server_fd, &timer, ret);
#else
idle(&server_fd, ret);
#endif
}
}
mbedtls_printf(" ok\n");
}
#endif /* MBEDTLS_SSL_RENEGOTIATION */
/*
* 7c. Simulate serialize/deserialize and go back to data exchange
*/

7
programs/ssl/ssl_server2.c
View File

@ -374,9 +374,6 @@ int main(void)
#define USAGE_ANTI_REPLAY ""
#endif
#define USAGE_BADMAC_LIMIT \
" badmac_limit=%%d default: (library default: disabled)\n"
#if defined(MBEDTLS_SSL_PROTO_DTLS)
#define USAGE_DTLS \
" dtls=%%d default: 0 (TLS)\n" \
@ -385,7 +382,8 @@ int main(void)
" mtu=%%d default: (library default: unlimited)\n" \
" dgram_packing=%%d default: 1 (allowed)\n" \
" allow or forbid packing of multiple\n" \
" records within a single datgram.\n"
" records within a single datagram.\n" \
" badmac_limit=%%d default: (library default: disabled)\n"
#else
#define USAGE_DTLS ""
#endif
@ -536,7 +534,6 @@ int main(void)
USAGE_SRTP \
USAGE_COOKIES \
USAGE_ANTI_REPLAY \
USAGE_BADMAC_LIMIT \
"\n"
#define USAGE2 \
" auth_mode=%%s default: (library default: none)\n" \

101
programs/test/udp_proxy.c
View File

@ -108,6 +108,12 @@ int main(void)
" May be used multiple times, even for the same\n" \
" message, in which case the respective message\n" \
" gets delayed multiple times.\n" \
" delay_encrypted_hs_cli=%%d default: 0 (don't delay)\n" \
" delay the Nth encrypted handshake message from\n" \
" client to server.\n" \
" delay_encrypted_hs_srv=%%d default: 0 (don't delay)\n" \
" delay the Nth encrypted handshake message from\n" \
" server to client.\n" \
" delay_srv=%%s Handshake message from server that should be\n" \
" delayed. Possible values are 'HelloRequest',\n" \
" 'ServerHello', 'ServerHelloDone', 'Certificate'\n" \
@ -121,6 +127,12 @@ int main(void)
" mtu=%%d default: 0 (unlimited)\n" \
" drop packets larger than N bytes\n" \
" bad_ad=0/1 default: 0 (don't add bad ApplicationData)\n" \
" bad_ad_cli_once=%%d default: 0 (don't add bad ApplicationData)\n" \
" add bad ApplicationData before the Nth\n" \
" ApplicationData from client to server.\n" \
" bad_ad_srv_once=%%d default: 0 (don't add bad ApplicationData)\n" \
" add bad ApplicationData before the Nth\n" \
" ApplicationData from server to client.\n" \
" bad_cid=%%d default: 0 (don't corrupt Connection IDs)\n" \
" duplicate 1:N packets containing a CID,\n" \
" modifying CID in first instance of the packet.\n" \
@ -153,9 +165,13 @@ static struct options {
char *delay_srv[MAX_DELAYED_HS]; /* handshake types of messages from
* server that should be delayed. */
uint8_t delay_srv_cnt; /* Number of entries in delay_srv. */
int delay_encrypted_hs_cli; /* Delay Nth encrypted HS from client. */
int delay_encrypted_hs_srv; /* Delay Nth encrypted HS from server. */
int drop; /* drop 1 packet in N (none if 0) */
int mtu; /* drop packets larger than this */
int bad_ad; /* inject corrupted ApplicationData record */
int bad_ad_cli_once; /* Inject corrupted Nth AD from client. */
int bad_ad_srv_once; /* Inject corrupted Nth AD from server. */
unsigned bad_cid; /* inject corrupted CID record */
int protect_hvr; /* never drop or delay HelloVerifyRequest */
int protect_len; /* never drop/delay packet of the given size*/
@ -224,6 +240,16 @@ static void get_options(int argc, char *argv[])
if (opt.delay_ccs < 0 || opt.delay_ccs > 1) {
exit_usage(p, q);
}
} else if (strcmp(p, "delay_encrypted_hs_cli") == 0) {
opt.delay_encrypted_hs_cli = atoi(q);
if (opt.delay_encrypted_hs_cli < 0) {
exit_usage(p, q);
}
} else if (strcmp(p, "delay_encrypted_hs_srv") == 0) {
opt.delay_encrypted_hs_srv = atoi(q);
if (opt.delay_encrypted_hs_srv < 0) {
exit_usage(p, q);
}
} else if (strcmp(p, "delay_cli") == 0 ||
strcmp(p, "delay_srv") == 0) {
uint8_t *delay_cnt;
@ -276,6 +302,16 @@ static void get_options(int argc, char *argv[])
if (opt.bad_ad < 0 || opt.bad_ad > 1) {
exit_usage(p, q);
}
} else if (strcmp(p, "bad_ad_cli_once") == 0) {
opt.bad_ad_cli_once = atoi(q);
if (opt.bad_ad_cli_once < 0) {
exit_usage(p, q);
}
} else if (strcmp(p, "bad_ad_srv_once") == 0) {
opt.bad_ad_srv_once = atoi(q);
if (opt.bad_ad_srv_once < 0) {
exit_usage(p, q);
}
}
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
else if (strcmp(p, "bad_cid") == 0) {
@ -531,6 +567,35 @@ typedef enum {
static inject_clihlo_state_t inject_clihlo_state;
static packet initial_clihlo;
static unsigned bad_ad_cli_seen;
static unsigned bad_ad_srv_seen;
static int bad_ad_once(const packet *p)
{
unsigned *seen;
int bad_ad_at;
if (strcmp(p->type, "ApplicationData") != 0) {
return 0;
}
if (strcmp(p->way, "S <- C") == 0) {
seen = &bad_ad_cli_seen;
bad_ad_at = opt.bad_ad_cli_once;
} else {
seen = &bad_ad_srv_seen;
bad_ad_at = opt.bad_ad_srv_once;
}
if (bad_ad_at <= 0) {
return 0;
}
++*seen;
return *seen == (unsigned) bad_ad_at;
}
static int send_packet(const packet *p, const char *why)
{
int ret;
@ -562,7 +627,7 @@ static int send_packet(const packet *p, const char *why)
}
/* insert corrupted ApplicationData record? */
if (opt.bad_ad &&
if ((bad_ad_once(p) || opt.bad_ad) &&
strcmp(p->type, "ApplicationData") == 0) {
unsigned char buf[MAX_MSG_SIZE];
memcpy(buf, p->buf, p->len);
@ -667,6 +732,31 @@ static int send_delayed(void)
static unsigned char held[2048] = { 0 };
#define HOLD_MAX 2
static unsigned encrypted_hs_cli_seen;
static unsigned encrypted_hs_srv_seen;
static int delay_encrypted_hs(const packet *p)
{
unsigned *seen;
int delay_at;
if (strcmp(p->type, "Encrypted handshake") != 0) {
return 0;
}
if (strcmp(p->way, "S <- C") == 0) {
seen = &encrypted_hs_cli_seen;
delay_at = opt.delay_encrypted_hs_cli;
} else {
seen = &encrypted_hs_srv_seen;
delay_at = opt.delay_encrypted_hs_srv;
}
++*seen;
return delay_at > 0 && *seen == (unsigned) delay_at;
}
static int handle_message(const char *way,
mbedtls_net_context *dst,
mbedtls_net_context *src)
@ -720,6 +810,11 @@ static int handle_message(const char *way,
}
}
if (delay_encrypted_hs(&cur)) {
delay_packet(&cur);
return 0;
}
/* do we want to drop, delay, or forward it? */
if ((opt.mtu != 0 &&
cur.len > (unsigned) opt.mtu) ||
@ -854,6 +949,10 @@ accept:
*/
clear_pending();
memset(held, 0, sizeof(held));
encrypted_hs_cli_seen = 0;
encrypted_hs_srv_seen = 0;
bad_ad_cli_seen = 0;
bad_ad_srv_seen = 0;
nb_fds = client_fd.fd;
if (nb_fds < server_fd.fd) {

32
tests/include/test/ssl_helpers.h
View File

@ -115,6 +115,9 @@ enum {
#define MBEDTLS_TEST_MAX_ALPN_LIST_SIZE 10
#endif
/* Forward declaration. Defined below. */
struct mbedtls_test_ssl_endpoint;
typedef struct mbedtls_test_ssl_log_pattern {
const char *pattern;
size_t counter;
@ -145,6 +148,35 @@ typedef struct mbedtls_test_handshake_test_options {
int expected_srv_fragments;
int renegotiate;
int legacy_renegotiation;
/** Hook that mbedtls_test_ssl_perform_handshake() runs just before
* the initial handshake. */
void (*pre_handshake_fun)(struct mbedtls_test_ssl_endpoint *client,
struct mbedtls_test_ssl_endpoint *server,
void *param);
/** Value passed to ::pre_handshake_fun. */
void *pre_handshake_param;
/** Hook that mbedtls_test_ssl_perform_handshake() runs after
* the initial handshake succeeds. */
void (*post_handshake_fun)(struct mbedtls_test_ssl_endpoint *client,
struct mbedtls_test_ssl_endpoint *server,
void *param);
/** Value passed to ::post_handshake_fun. */
void *post_handshake_param;
/** Hook that mbedtls_test_ssl_perform_handshake() runs after
* exchanging some data, before testing additional features such as
* serialization and renegotiation. */
void (*post_data_fun)(struct mbedtls_test_ssl_endpoint *client,
struct mbedtls_test_ssl_endpoint *server,
void *param);
/** Value passed to ::post_data_fun. */
void *post_data_param;
/** Hook that mbedtls_test_ssl_perform_handshake() runs after a successful
* connection, just before closing down. */
void (*pre_shutdown_fun)(struct mbedtls_test_ssl_endpoint *client,
struct mbedtls_test_ssl_endpoint *server,
void *param);
/** Value passed to ::pre_shutdown_fun. */
void *pre_shutdown_param;
void *srv_log_obj;
void *cli_log_obj;
void (*srv_log_fun)(void *, int, const char *, int, const char *);

12
tests/scripts/analyze_outcomes.py
View File

@ -449,8 +449,8 @@ class DriverVSReference_no_ecp_at_all(outcome_analysis.DriverVSReference):
# consequence compressed points are supported in the reference
# component but not in the accelerated one, so they should be skipped
# while checking driver's coverage.
re.compile(r'Parse EC Key .*compressed\)'),
re.compile(r'Parse Public EC Key .*compressed\)'),
re.compile(r'Parse EC Key .*(?<!un)compressed\)'),
re.compile(r'Parse Public EC Key.*(?<!un)compressed.*'),
],
# See ecp_light_only
'test_suite_ssl': [
@ -487,8 +487,8 @@ class DriverVSReference_ecc_no_bignum(outcome_analysis.DriverVSReference):
],
# See no_ecp_at_all
'test_suite_pkparse': [
re.compile(r'Parse EC Key .*compressed\)'),
re.compile(r'Parse Public EC Key .*compressed\)'),
re.compile(r'Parse EC Key .*(?<!un)compressed\)'),
re.compile(r'Parse Public EC Key.*(?<!un)compressed.*'),
],
'test_suite_asn1parse': [
'INTEGER too large for mpi',
@ -542,8 +542,8 @@ class DriverVSReference_ecc_ffdh_no_bignum(outcome_analysis.DriverVSReference):
],
# See no_ecp_at_all
'test_suite_pkparse': [
re.compile(r'Parse EC Key .*compressed\)'),
re.compile(r'Parse Public EC Key .*compressed\)'),
re.compile(r'Parse EC Key .*(?<!un)compressed\)'),
re.compile(r'Parse Public EC Key.*(?<!un)compressed.*'),
],
'test_suite_asn1parse': [
'INTEGER too large for mpi',

17
tests/src/test_helpers/ssl_helpers.c
View File

@ -2252,6 +2252,10 @@ void mbedtls_test_ssl_perform_handshake(
expected_handshake_result = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
}
if (options->pre_handshake_fun != NULL) {
options->pre_handshake_fun(&client, &server, options->pre_handshake_param);
}
TEST_ASSERT(mbedtls_test_move_handshake_to_state(&(client.ssl),
&(server.ssl),
MBEDTLS_SSL_HANDSHAKE_OVER)
@ -2289,6 +2293,10 @@ void mbedtls_test_ssl_perform_handshake(
options->expected_ciphersuite);
}
if (options->post_handshake_fun != NULL) {
options->post_handshake_fun(&client, &server, options->post_handshake_param);
}
#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH)
if (options->resize_buffers != 0) {
/* A server, when using DTLS, might delay a buffer resize to happen
@ -2315,6 +2323,11 @@ void mbedtls_test_ssl_perform_handshake(
options->expected_srv_fragments)
== 0);
}
if (options->post_data_fun != NULL) {
options->post_data_fun(&client, &server, options->post_data_param);
}
#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
if (options->serialize == 1) {
TEST_ASSERT(options->dtls == 1);
@ -2449,6 +2462,10 @@ void mbedtls_test_ssl_perform_handshake(
TEST_ASSERT(mbedtls_ssl_conf_get_user_data_p(&server.conf) == &server);
TEST_ASSERT(mbedtls_ssl_get_user_data_p(&server.ssl) == &server);
if (options->pre_shutdown_fun != NULL) {
options->pre_shutdown_fun(&client, &server, options->pre_shutdown_param);
}
exit:
mbedtls_test_ssl_endpoint_free(&client,
options->dtls != 0 ? &client_context : NULL);

178
tests/ssl-opt.sh
View File

@ -5568,6 +5568,7 @@ run_test "Renegotiation: client-initiated, server-rejected" \
-c "=> renegotiate" \
-S "=> renegotiate" \
-S "write hello request" \
-s "refusing renegotiation" \
-c "SSL - Unexpected message at ServerHello in renegotiation" \
-c "failed"
@ -5584,6 +5585,7 @@ run_test "Renegotiation: server-initiated, client-rejected, default" \
-C "=> renegotiate" \
-S "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-S "SSL - An unexpected message was received from our peer" \
-S "failed"
@ -5601,6 +5603,7 @@ run_test "Renegotiation: server-initiated, client-rejected, not enforced" \
-C "=> renegotiate" \
-S "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-S "SSL - An unexpected message was received from our peer" \
-S "failed"
@ -5619,6 +5622,7 @@ run_test "Renegotiation: server-initiated, client-rejected, delay 2" \
-C "=> renegotiate" \
-S "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-S "SSL - An unexpected message was received from our peer" \
-S "failed"
@ -5636,6 +5640,7 @@ run_test "Renegotiation: server-initiated, client-rejected, delay 0" \
-C "=> renegotiate" \
-S "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-s "SSL - An unexpected message was received from our peer"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
@ -5652,6 +5657,7 @@ run_test "Renegotiation: server-initiated, client-accepted, delay 0" \
-c "=> renegotiate" \
-s "=> renegotiate" \
-s "write hello request" \
-C "refusing renegotiation" \
-S "SSL - An unexpected message was received from our peer" \
-S "failed"
@ -8922,6 +8928,37 @@ run_test "DHM size: server default, client 2049, rejected" \
1 \
-c "DHM prime too short:"
# Miscellaneous PSK-related tests
psk_identity_max_minus_10=a$(printf "%$((MAX_OUT_LEN - 11))s" z | tr ' ' .)
run_test "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 7)" \
"$P_SRV debug_level=3 \
psk_identity=${psk_identity_max_minus_10}987 psk=73776f726466697368" \
"$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \
psk_identity=${psk_identity_max_minus_10}987 psk=73776f726466697368" \
1 \
-s "! mbedtls_ssl_handshake returned" \
-c "! mbedtls_ssl_handshake returned"
run_test "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 6)" \
"$P_SRV debug_level=3 \
psk_identity=${psk_identity_max_minus_10}9876 psk=73776f726466697368" \
"$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \
psk_identity=${psk_identity_max_minus_10}9876 psk=73776f726466697368" \
1 \
-s "! mbedtls_ssl_handshake returned" \
-c "! mbedtls_ssl_handshake returned"
run_test "Large PSK identity (MBEDTLS_SSL_OUT_CONTENT_LEN - 5)" \
"$P_SRV debug_level=3 \
psk_identity=${psk_identity_max_minus_10}98765 psk=73776f726466697368" \
"$P_CLI force_ciphersuite=TLS-ECDHE-PSK-WITH-AES-128-CBC-SHA256 debug_level=3 \
psk_identity=${psk_identity_max_minus_10}98765 psk=73776f726466697368" \
1 \
-s "! mbedtls_ssl_handshake returned" \
-c "! mbedtls_ssl_handshake returned"
# Tests for PSK callback
run_test "PSK callback: psk, no callback" \
@ -12763,6 +12800,147 @@ run_test "DTLS proxy: inject invalid AD record, badmac_limit 2, exchanges 2"\
-s "too many records with bad MAC" \
-s "Verification of the message MAC failed"
# The next few tests exercise renegotiation in DTLS when `ssl->badmac_seen != 0`.
#
# This seems unrelated, but was the location of a bug in Mbed TLS 3.6.3 to
# 3.6.6 (CVE-2026-50713) due to `ssl->badmac_seen` being unified with
# `ssl->in_hsfraglen` (to preserve the ABI when adding support for handshake
# defragmentation in TLS in 3.6.3), with some mistakes in using the unified
# field that were fixed in 3.6.7.
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then reject renego" \
-p "$P_PXY bad_ad_srv_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "write hello request" \
-c "refusing renegotiation" \
-S "=> renegotiate" \
-C "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-c "discarding invalid record (mac)" \
-C "too many records with bad MAC" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then reject renego" \
-p "$P_PXY bad_ad_cli_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=0 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \
1 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
-S "=> renegotiate" \
-s "refusing renegotiation" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then accept renego" \
-p "$P_PXY bad_ad_srv_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "=> renegotiate" \
-c "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-c "discarding invalid record (mac)" \
-C "too many records with bad MAC" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: server: get invalid AD record then accept renego" \
-p "$P_PXY bad_ad_cli_once=1" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 \
badmac_limit=99 debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 renegotiate=2 exchanges=4 debug_level=3" \
0 \
-s "discarding invalid record (mac)" \
-c "=> renegotiate" \
-s "=> renegotiate" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-S "too many records with bad MAC" \
-S "Verification of the message MAC failed" \
-S "Consume: waiting for more handshake fragments"
# The next few tests have "early renego". A DTLS handshake message is delayed
# past another handshake message. From the perspective of the recipient,
# this means that a DTLS handshake arrives early (its epoch number is still
# in the future) and needs to be queued.
#
# In Mbed TLS 3.6.3 through 3.6.6, due to the fields `ssl->badmac_seen`
# and `ssl->in_hsfraglen` being unified, the early message was parsed
# incorrectly, leading to heap corruption.
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then reject early renego" \
-p "$P_PXY bad_ad_srv_once=1 delay_encrypted_hs_srv=3" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-S "=> renegotiate" \
-C "=> renegotiate" \
-s "write hello request" \
-c "refusing renegotiation" \
-C "=> ssl_buffer_message" \
-C "initialize reassembly, total length = 0" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-c "discarding invalid record (mac)" \
-C "too many records with bad MAC" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
# Delay the third encrypted handshake message from the server:
# 1. Finished message of the initial handshake.
# 2. HelloRequest to request renegotiation.
# 3. ServerHello of renegotiation, delayed.
# 4. Subsequent handshake message, which the client receives and enqueues.
#
# In Mbed TLS 3.6.3 though 3.6.6, the processing of (4) caused heap corruption.
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
run_test "DTLS proxy: client: get invalid AD record then accept early renego" \
-p "$P_PXY bad_ad_srv_once=1 delay_encrypted_hs_srv=3" \
"$P_SRV dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiate=1 renegotiation=1 exchanges=4 \
debug_level=3" \
"$P_CLI dtls=1 dgram_packing=0 hs_timeout=500-10000 \
renegotiation=1 exchanges=4 badmac_limit=99 debug_level=3" \
0 \
-s "=> renegotiate" \
-c "=> renegotiate" \
-c "=> ssl_buffer_message" \
-C "initialize reassembly, total length = 0" \
-s "Extra-header:" \
-c "HTTP/1.0 200 OK" \
-c "discarding invalid record (mac)" \
-C "too many records with bad MAC" \
-C "Verification of the message MAC failed" \
-C "Consume: waiting for more handshake fragments"
requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
run_test "DTLS proxy: delay ChangeCipherSpec" \
-p "$P_PXY delay_ccs=1" \

3
tests/suites/test_suite_chacha20.data
View File

@ -22,5 +22,8 @@ chacha20_crypt:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0
ChaCha20 RFC 7539 Test Vector #3 (Decrypt)
chacha20_crypt:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc207075c0":"000000000000000000000002":42:"62e6347f95ed87a45ffae7426f27a1df5fb69110044c0d73118effa95b01e5cf166d3df2d721caf9b21e5fb14c616871fd84c54f9d65b283196c7fe4f60553ebf39c6402c42234e32a356b3e764312a61a5532055716ead6962568f87d3f3f7704c6a8d1bcd1bf4d50d6154b6da731b187b58dfd728afa36757a797ac188d1":"2754776173206272696c6c69672c20616e642074686520736c6974687920746f7665730a446964206779726520616e642067696d626c6520696e2074686520776162653a0a416c6c206d696d737920776572652074686520626f726f676f7665732c0a416e6420746865206d6f6d65207261746873206f757467726162652e"
ChaCha20 Counter Overflow
chacha20_input_len_too_long:
ChaCha20 Selftest
chacha20_self_test:

46
tests/suites/test_suite_chacha20.function
View File

@ -67,6 +67,52 @@ void chacha20_crypt(data_t *key_str,
}
/* END_CASE */
/* BEGIN_CASE */
void chacha20_input_len_too_long(void)
{
mbedtls_chacha20_context ctx;
unsigned char key[32] = { 0 };
unsigned char nonce[12] = { 0 };
unsigned char input[65] = { 0 };
unsigned char output[65] = { 0 };
size_t i;
mbedtls_chacha20_init(&ctx);
TEST_ASSERT(mbedtls_chacha20_setkey(&ctx, key) == 0);
TEST_ASSERT(mbedtls_chacha20_starts(&ctx, nonce, UINT32_MAX) == 0);
/*
* An overlong call must fail before consuming buffered keystream bytes,
* writing partial output, or advancing the context.
*/
TEST_EQUAL(mbedtls_chacha20_update(&ctx, 1, input, output), 0);
memset(output, 0x2a, sizeof(output));
TEST_EQUAL(mbedtls_chacha20_update(&ctx, 64, input, output),
MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA);
for (i = 0; i < sizeof(output); i++) {
TEST_EQUAL(output[i], 0x2a);
}
/* Consume the rest of the final counter block, then reject more input. */
TEST_EQUAL(mbedtls_chacha20_update(&ctx, 63, input, output), 0);
TEST_EQUAL(mbedtls_chacha20_update(&ctx, 0, NULL, NULL), 0);
/*Test that zero length update does not break an exhausted context */
TEST_EQUAL(mbedtls_chacha20_update(&ctx, 0, NULL, NULL), 0);
TEST_EQUAL(mbedtls_chacha20_update(&ctx, 1, input, output),
MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA);
/* The final counter block is valid, but generating another block is not. */
TEST_EQUAL(mbedtls_chacha20_crypt(key, nonce, UINT32_MAX,
64U, input, output), 0);
TEST_EQUAL(mbedtls_chacha20_crypt(key, nonce, UINT32_MAX,
sizeof(input), input, output),
MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA);
mbedtls_chacha20_free(&ctx);
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SELF_TEST */
void chacha20_self_test()
{

3
tests/suites/test_suite_chachapoly.data
View File

@ -19,6 +19,9 @@ mbedtls_chachapoly_dec:"1c9240a5eb55d38af333888604f6b5f0473917c1402b80099dca5cbc
ChaCha20-Poly1305 State Flow
chachapoly_state:
ChaCha20-Poly1305 overlong generates the appropriate error
chachapoly_update_too_long:
ChaCha20-Poly1305 Selftest
depends_on:MBEDTLS_SELF_TEST
chachapoly_selftest:

33
tests/suites/test_suite_chachapoly.function
View File

@ -76,6 +76,39 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE */
void chachapoly_update_too_long()
{
unsigned char key[32] = { 0 };
unsigned char nonce[12] = { 0 };
unsigned char input[65] = { 0 };
unsigned char output[65] = { 0 };
mbedtls_chachapoly_context ctx;
size_t i;
mbedtls_chachapoly_init(&ctx);
TEST_EQUAL(mbedtls_chachapoly_setkey(&ctx, key), 0);
TEST_EQUAL(mbedtls_chachapoly_starts(&ctx, nonce,
MBEDTLS_CHACHAPOLY_ENCRYPT), 0);
/* Force the next update to be too long without processing a huge buffer. */
ctx.chacha20_ctx.state[12] = UINT32_MAX;
/* Test that the failed update does not modify the output. This is a
* defense in depth assertion, however is not currently gauranteed by
* the API */
memset(output, 0x2a, sizeof(output));
TEST_EQUAL(mbedtls_chachapoly_update(&ctx, sizeof(input), input, output),
MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA);
for (i = 0; i < sizeof(output); i++) {
TEST_EQUAL(output[i], 0x2a);
}
exit:
mbedtls_chachapoly_free(&ctx);
}
/* END_CASE */
/* BEGIN_CASE */
void chachapoly_state()
{

36
tests/suites/test_suite_ecdh.data
View File

@ -81,6 +81,16 @@ ECDH calc_secret: theirs first, SECP256R1 (RFC 5903)
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
ecdh_exchange_calc_secret:MBEDTLS_ECP_DP_SECP256R1:"c6ef9c5d78ae012a011164acb397ce2088685d8f06bf9be0b283ab46476bee53":"04dad0b65394221cf9b051e1feca5787d098dfe637fc90b9ef945d0c37725811805271a0461cdb8252d61f1c456fa3e59ab1f45b33accf5f58389e0577b8990bb3":1:"d6840f6b42f6edafd13116e0e12565202fef8e9ece7dce03812464d04b9442de"
# see generating script in previous commit message
ECDH calc_secret: leading zero, SECP256R1
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
ecdh_exchange_calc_secret:MBEDTLS_ECP_DP_SECP256R1:"800000000000000000000000000000000000000000000000000000000000000e":"046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5":0:"0054fe92ec56ef5ad8bf4d9c46d2ca773af76c2e8c8b00e20ab772cf8b34348f"
# see generating script in previous commit message
ECDH calc_secret: leading zero, SECP521R1
depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED
ecdh_exchange_calc_secret:MBEDTLS_ECP_DP_SECP521R1:"010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"0400c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650":0:"002da7db02840f023a36e1fffeaee16d3c47bb435bec6a231d4aab1ec5412f56fb90fcc4eaab9fd8571084cb9da252466c052d21913ce0fda47e61829972ce8f9a17"
ecdh calc_secret: ours first (Alice), curve25519 (rfc 7748)
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
ecdh_exchange_calc_secret:MBEDTLS_ECP_DP_CURVE25519:"77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a":"de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f":0:"4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742"
@ -93,6 +103,32 @@ ecdh calc_secret: ours first (Bob), curve25519 (rfc 7748)
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
ecdh_exchange_calc_secret:MBEDTLS_ECP_DP_CURVE25519:"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a":0:"4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742"
# see generating script in previous commit message
ecdh calc_secret: MSB zero, curve25519
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
ecdh_exchange_calc_secret:MBEDTLS_ECP_DP_CURVE25519:"8813000000000000000000000000000000000000000000000000000000000040":"0900000000000000000000000000000000000000000000000000000000000000":0:"9ec15224edbe326c5b40fa30311421f1fb309fdd0fcaf472b5d0ad2067b7db00"
# see generating script in previous commit message
ecdh calc_secret: MSB zero, curve448
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
ecdh_exchange_calc_secret:MBEDTLS_ECP_DP_CURVE448:"d805000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080":"0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":0:"517b6be2c2edd157319082d4ddc688add71297284b6da74b050170035d764c19b8a14da4600715b18d8a3320a8e18a1d80fc9e6f7ea85600"
ECDH context re-use: secp256r1
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED
ecdh_context_reuse:MBEDTLS_ECP_DP_SECP256R1:"8000000000000000000000000000000000000000000000000000000000000000":"046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5":"77b20a912e6b23135066e911891524bc4efe3560e3e92350b52dec8f375f2b54":"047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d1":"0b197a2e1e67a44b5afb62de48adde6400b60867487cab5739912513c420924a"
ECDH context re-use: secp521r1
depends_on:MBEDTLS_ECP_DP_SECP521R1_ENABLED
ecdh_context_reuse:MBEDTLS_ECP_DP_SECP521R1:"010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"0400c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650":"002da7db02840f023a36e1fffeaee16d3c47bb435bec6a231d4aab1ec5412f56fb90fcc4eaab9fd8571084cb9da252466c052d21913ce0fda47e61829972ce8f9a17":"0400433c219024277e7e682fcb288148c282747403279b1ccc06352c6e5505d769be97b3b204da6ef55507aa104a3a35c5af41cf2fa364d60fd967f43e3933ba6d783d00f4bb8cc7f86db26700a7f3eceeeed3f0b5c6b5107c4da97740ab21a29906c42dbbb3e377de9f251f6b93937fa99a3248f4eafcbe95edc0f4f71be356d661f41b02":"0033ffb964e05d5f6799c7865c906e2a0bd0c9b131eef6bf6453c960bca9bf06dea4650bd0df069416992b17027d972d1c60830492593fc3431582e051426b4c3f67"
ECDH context re-use: x25519
depends_on:MBEDTLS_ECP_DP_CURVE25519_ENABLED
ecdh_context_reuse:MBEDTLS_ECP_DP_CURVE25519:"0000000000000000000000000000000000000000000000000000000000000040":"0900000000000000000000000000000000000000000000000000000000000000":"2fe57da347cd62431528daac5fbb290730fff684afc4cfc2ed90995f58cb3b74":"fb4e68dd9c46ae5c5c0b351eed5c3f8f1471157d680c75d9b7f17318d542d320":"9d8e35e77dfa6c16ed6df587251ee0d6379bd2556344aecf8f85d83fb6fa6476"
ECDH context re-use: x448
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
ecdh_context_reuse:MBEDTLS_ECP_DP_CURVE448:"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080":"0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"e9b820a44dba3bc569bee7214b62b09ee239b50978a7a1c69a9ade46858cc37c48eb03fd88c289badd708fc635c7d863cc40e4dfdd6d5d40":"b63c741cbca4327d0808125a25f0e82571ed00daf14737bfc16f261666763c5fd7831e51fbbe9aaccc5cbdd86546ef9ad4e3ca5722329163":"b23511da3c119e32b7b146122b59d1f122f22008f02715326e62d6ca162b4f20188a95a52dd9e40cb5b729f1f153da0d51c3acfc4c81944c"
ECDH get_params with mismatched groups: our BP256R1, their SECP256R1
depends_on:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ECP_DP_BP256R1_ENABLED
ecdh_exchange_get_params_fail:MBEDTLS_ECP_DP_BP256R1:"1234567812345678123456781234567812345678123456781234567812345678":MBEDTLS_ECP_DP_SECP256R1:"04dad0b65394221cf9b051e1feca5787d098dfe637fc90b9ef945d0c37725811805271a0461cdb8252d61f1c456fa3e59ab1f45b33accf5f58389e0577b8990bb3":0:MBEDTLS_ERR_ECP_BAD_INPUT_DATA

127
tests/suites/test_suite_ecdh.function
View File

@ -363,6 +363,79 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE */
void ecdh_context_reuse(int grp_id, data_t *our_private_key,
data_t *their_point1, data_t *shared1,
data_t *their_point2, data_t *shared2)
{
/* This test exercises re-using the context for static ECDH */
mbedtls_test_rnd_pseudo_info rnd_info;
mbedtls_ecp_keypair our_key;
mbedtls_ecp_keypair their_key1;
mbedtls_ecp_keypair their_key2;
mbedtls_ecdh_context ecdh;
unsigned char *buf = NULL;
size_t min_buf_size = 0;
size_t shared_secret_length = 0;
memset(&rnd_info, 0x00, sizeof(mbedtls_test_rnd_pseudo_info));
mbedtls_ecdh_init(&ecdh);
mbedtls_ecp_keypair_init(&our_key);
mbedtls_ecp_keypair_init(&their_key1);
mbedtls_ecp_keypair_init(&their_key2);
if (!load_private_key(grp_id, our_private_key, &our_key, &rnd_info)) {
goto exit;
}
if (!load_public_key(grp_id, their_point1, &their_key1)) {
goto exit;
}
if (!load_public_key(grp_id, their_point2, &their_key2)) {
goto exit;
}
/* Import our long-term private key */
TEST_ASSERT(mbedtls_ecdh_get_params(
&ecdh, &our_key, MBEDTLS_ECDH_OURS) == 0);
/* Allocate output buffer of minimal size */
min_buf_size = (our_key.grp.pbits + 7) / 8;
TEST_LE_U(min_buf_size, MBEDTLS_ECP_MAX_BYTES);
TEST_CALLOC(buf, min_buf_size);
/* Import first peer key and perform first ECDH calculation */
TEST_ASSERT(mbedtls_ecdh_get_params(
&ecdh, &their_key1, MBEDTLS_ECDH_THEIRS) == 0);
TEST_EQUAL(0,
mbedtls_ecdh_calc_secret(
&ecdh, &shared_secret_length,
buf, min_buf_size,
&mbedtls_test_rnd_pseudo_rand, &rnd_info));
TEST_MEMORY_COMPARE(shared1->x, shared1->len,
buf, shared_secret_length);
shared_secret_length = 0;
/* Import 2nd peer key and perform 2nd ECDH calculation */
TEST_ASSERT(mbedtls_ecdh_get_params(
&ecdh, &their_key2, MBEDTLS_ECDH_THEIRS) == 0);
TEST_EQUAL(0,
mbedtls_ecdh_calc_secret(
&ecdh, &shared_secret_length,
buf, min_buf_size,
&mbedtls_test_rnd_pseudo_rand, &rnd_info));
TEST_MEMORY_COMPARE(shared2->x, shared2->len,
buf, shared_secret_length);
exit:
mbedtls_free(buf);
mbedtls_ecdh_free(&ecdh);
mbedtls_ecp_keypair_free(&our_key);
mbedtls_ecp_keypair_free(&their_key1);
mbedtls_ecp_keypair_free(&their_key2);
}
/* END_CASE */
/* BEGIN_CASE */
void ecdh_exchange_calc_secret(int grp_id,
data_t *our_private_key,
@ -374,7 +447,8 @@ void ecdh_exchange_calc_secret(int grp_id,
mbedtls_ecp_keypair our_key;
mbedtls_ecp_keypair their_key;
mbedtls_ecdh_context ecdh;
unsigned char shared_secret[MBEDTLS_ECP_MAX_BYTES];
unsigned char *buf = NULL;
size_t min_buf_size = 0;
size_t shared_secret_length = 0;
memset(&rnd_info, 0x00, sizeof(mbedtls_test_rnd_pseudo_info));
@ -402,17 +476,50 @@ void ecdh_exchange_calc_secret(int grp_id,
&ecdh, &our_key, MBEDTLS_ECDH_OURS) == 0);
}
/* Perform the ECDH calculation. */
TEST_ASSERT(mbedtls_ecdh_calc_secret(
&ecdh,
&shared_secret_length,
shared_secret, sizeof(shared_secret),
&mbedtls_test_rnd_pseudo_rand, &rnd_info) == 0);
TEST_ASSERT(shared_secret_length == expected->len);
TEST_ASSERT(memcmp(expected->x, shared_secret,
shared_secret_length) == 0);
/* Compute minimal size of output buffer */
min_buf_size = (our_key.grp.pbits + 7) / 8;
TEST_LE_U(min_buf_size, MBEDTLS_ECP_MAX_BYTES);
/* Perform the ECDH calculation with exact size output buffer */
TEST_CALLOC(buf, min_buf_size);
TEST_EQUAL(0,
mbedtls_ecdh_calc_secret(
&ecdh, &shared_secret_length,
buf, min_buf_size,
&mbedtls_test_rnd_pseudo_rand, &rnd_info));
TEST_MEMORY_COMPARE(expected->x, expected->len,
buf, shared_secret_length);
mbedtls_free(buf);
buf = NULL;
shared_secret_length = 0;
/* Try again with an output buffer that's larger. */
/* Note: this doubles as a weak test for re-using a context.
* For a proper test, see ecdh_context_reuse(). */
TEST_CALLOC(buf, min_buf_size + 1);
TEST_EQUAL(0,
mbedtls_ecdh_calc_secret(
&ecdh, &shared_secret_length,
buf, min_buf_size + 1,
&mbedtls_test_rnd_pseudo_rand, &rnd_info));
TEST_MEMORY_COMPARE(expected->x, expected->len,
buf, shared_secret_length);
mbedtls_free(buf);
buf = NULL;
shared_secret_length = 0;
/* Try again with an output buffer that's too short. */
TEST_CALLOC(buf, min_buf_size - 1);
TEST_EQUAL(MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL,
mbedtls_ecdh_calc_secret(
&ecdh, &shared_secret_length,
buf, min_buf_size - 1,
&mbedtls_test_rnd_pseudo_rand, &rnd_info));
exit:
mbedtls_free(buf);
mbedtls_ecdh_free(&ecdh);
mbedtls_ecp_keypair_free(&our_key);
mbedtls_ecp_keypair_free(&their_key);

3
tests/suites/test_suite_ecp.data
View File

@ -2268,6 +2268,3 @@ ecp_mod_random:MBEDTLS_ECP_DP_SECP256K1:MBEDTLS_ECP_MOD_SCALAR
ecp_random #25 MBEDTLS_ECP_MOD_COORDINATE(MBEDTLS_ECP_DP_CURVE448)
depends_on:MBEDTLS_ECP_DP_CURVE448_ENABLED
ecp_mod_random:MBEDTLS_ECP_DP_CURVE448:MBEDTLS_ECP_MOD_COORDINATE
ecp variant check
check_variant:

35
tests/suites/test_suite_ecp.function
View File

@ -1551,7 +1551,7 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_WITH_MPI_UINT */
/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS */
void ecp_mod_p_generic_raw(int curve_id,
char *input_N,
char *input_X,
@ -1569,8 +1569,10 @@ void ecp_mod_p_generic_raw(int curve_id,
size_t curve_bits;
int (*curve_func)(mbedtls_mpi_uint *X, size_t X_limbs);
#if defined(MBEDTLS_ECP_WITH_MPI_UINT)
mbedtls_mpi_mod_modulus m;
mbedtls_mpi_mod_modulus_init(&m);
#endif
TEST_EQUAL(mbedtls_test_read_mpi_core(&X, &limbs_X, input_X), 0);
TEST_EQUAL(mbedtls_test_read_mpi_core(&N, &limbs_N, input_N), 0);
@ -1656,20 +1658,34 @@ void ecp_mod_p_generic_raw(int curve_id,
TEST_EQUAL(limbs_X, limbs);
TEST_EQUAL(limbs_res, limbs_N);
TEST_EQUAL(mbedtls_mpi_mod_modulus_setup(
&m, N, limbs_N), 0);
TEST_EQUAL((*curve_func)(X, limbs_X), 0);
#if defined(MBEDTLS_ECP_WITH_MPI_UINT)
/* This is what we'll do in the future, based on bignum_mod_raw */
TEST_EQUAL(mbedtls_mpi_mod_modulus_setup(&m, N, limbs_N), 0);
mbedtls_mpi_mod_raw_fix_quasi_reduction(X, &m);
#else
/* This is what we're doing now, based on bignum_core,
* see ecp_modp() in ecp.c */
mbedtls_mpi_uint c = mbedtls_mpi_core_sub(X, X, N, limbs_N);
(void) mbedtls_mpi_core_add_if(X, N, limbs_N, (unsigned) c);
#endif
/* Checking that the result is equal to the expected value is enough,
* but in case of failures, it's useful to know if the incorrect result
* had the correct bitlength or not / was in the correct range or not. */
TEST_LE_U(mbedtls_mpi_core_bitlen(X, limbs_X), curve_bits);
/* This only works because we know from above the top limbs of X are 0. */
TEST_EQUAL(MBEDTLS_CT_TRUE, mbedtls_mpi_core_lt_ct(X, N, limbs_N));
TEST_MEMORY_COMPARE(X, bytes, res, bytes);
exit:
mbedtls_free(X);
mbedtls_free(res);
#if defined(MBEDTLS_ECP_WITH_MPI_UINT)
mbedtls_mpi_mod_modulus_free(&m);
#endif
mbedtls_free(N);
}
/* END_CASE */
@ -1914,16 +1930,3 @@ exit:
mbedtls_free(rX_raw);
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_TEST_HOOKS:MBEDTLS_ECP_LIGHT */
void check_variant()
{
mbedtls_ecp_variant variant = mbedtls_ecp_get_variant();
#if defined(MBEDTLS_ECP_WITH_MPI_UINT)
TEST_EQUAL(variant, MBEDTLS_ECP_VARIANT_WITH_MPI_UINT);
#else
TEST_EQUAL(variant, MBEDTLS_ECP_VARIANT_WITH_MPI_STRUCT);
#endif
}
/* END_CASE */

23
tests/suites/test_suite_pk.function
View File

@ -1546,6 +1546,14 @@ void pk_rsa_decrypt_test_vec(data_t *cipher, int mod, int padding, int md_alg,
if (ret == 0) {
TEST_ASSERT(olen == clear->len);
TEST_ASSERT(memcmp(output, clear->x, olen) == 0);
if (clear->len != 0) {
/* Try again with an output buffer that's too small */
TEST_EQUAL(mbedtls_pk_decrypt(&pk, cipher->x, cipher->len,
output, &olen, clear->len - 1,
mbedtls_test_rnd_pseudo_rand, &rnd_info),
MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE);
}
}
exit:
@ -1618,6 +1626,14 @@ void pk_wrap_rsa_decrypt_test_vec(data_t *cipher, int mod,
if (ret == 0) {
TEST_EQUAL(olen, clear->len);
TEST_EQUAL(memcmp(output, clear->x, olen), 0);
if (clear->len != 0) {
/* Try again with an output buffer that's too small */
TEST_EQUAL(mbedtls_pk_decrypt(&pk, cipher->x, cipher->len,
output, &olen, clear->len - 1,
mbedtls_test_rnd_pseudo_rand, &rnd_info),
MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE);
}
}
TEST_EQUAL(PSA_SUCCESS, psa_destroy_key(key_id));
@ -1789,6 +1805,13 @@ void pk_rsa_alt()
TEST_ASSERT(test_len == sizeof(msg));
TEST_ASSERT(memcmp(test, msg, test_len) == 0);
/* Try again with an output buffer that's too small */
TEST_EQUAL(mbedtls_pk_decrypt(&alt, ciph, ciph_len,
test, &test_len, sizeof(msg) - 1,
mbedtls_test_rnd_std_rand, NULL),
MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE);
/* Test forbidden operations */
TEST_ASSERT(mbedtls_pk_encrypt(&alt, msg, sizeof(msg),
ciph, &ciph_len, sizeof(ciph),

53
tests/suites/test_suite_pkcs1_v15.constant_time.data Normal file
View File

@ -0,0 +1,53 @@
RSA sensitive ret: 0
rsa_decrypt_decompose_ret:0:0:0
RSA sensitive ret: sensitive 1
rsa_decrypt_decompose_ret:-1:0:-11
RSA sensitive ret: sensitive 2
rsa_decrypt_decompose_ret:-2:0:-12
RSA sensitive ret: public
rsa_decrypt_decompose_ret:-3:-3:0
RSAES-V15 decoding: good, payload=max, tight output buffer
pkcs1_v15_decode:"0002505152535455565700":117:117:0
RSAES-V15 decoding: good, payload=max, larger output buffer
pkcs1_v15_decode:"0002505152535455565700":117:128:0
RSAES-V15 decoding: good, payload=max-1, tight output buffer
pkcs1_v15_decode:"000250515253545556575800":116:116:0
RSAES-V15 decoding: good, payload=max-1, larger output buffer
pkcs1_v15_decode:"000250515253545556575800":116:117:0
RSAES-V15 decoding: good, payload=1
pkcs1_v15_decode:"00025050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505000":1:1:0
RSAES-V15 decoding: good, empty payload
pkcs1_v15_decode:"0002505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505000":0:0:0
RSAES-V15 decoding: payload=max, output too large
pkcs1_v15_decode:"0002505152535455565700":117:116:MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE
RSAES-V15 decoding: payload=max-1, output too large
pkcs1_v15_decode:"000250515253545556575800":116:115:MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE
RSAES-V15 decoding: bad first byte
pkcs1_v15_decode:"0102505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: bad second byte (0 instead of 2)
pkcs1_v15_decode:"0000505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: bad second byte (1 instead of 2)
pkcs1_v15_decode:"0001505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: padding too short (0)
pkcs1_v15_decode:"000200":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: padding too short (7)
pkcs1_v15_decode:"0002505050505050500000ffffffffffffffffff00":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: unfinished padding
pkcs1_v15_decode:"0002505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING

42
tests/suites/test_suite_pkcs1_v15.data
View File

@ -51,45 +51,3 @@ pkcs1_rsassa_v15_sign:1024:"d17f655bf27c8b16d35462c905cc04a26f37e2a67fa9c0ce0dce
RSASSA-V15 Verification Test Vector Int
depends_on:MBEDTLS_MD_CAN_SHA1
pkcs1_rsassa_v15_verify:1024:"a2ba40ee07e3b2bd2f02ce227f36a195024486e49c19cb41bbbdfbba98b22b0e577c2eeaffa20d883a76e65e394c69d4b3c05a1e8fadda27edb2a42bc000fe888b9b32c22d15add0cd76b3e7936e19955b220dd17d4ea904b1ec102b2e4de7751222aa99151024c7cb41cc5ea21d00eeb41f7c800834d2c6e06bce3bce7ea9a5":"010001":MBEDTLS_MD_SHA1:MBEDTLS_MD_SHA1:"37b66ae0445843353d47ecb0b4fd14c110e62d6a":"e3b5d5d002c1bce50c2b65ef88a188d83bce7e61":"2154f928615e5101fcdeb57bc08fc2f35c3d5996403861ae3efb1d0712f8bb05cc21f7f5f11f62e5b6ea9f0f2b62180e5cbe7ba535032d6ac8068fff7f362f73d2c3bf5eca6062a1723d7cfd5abb6dcf7e405f2dc560ffe6fc37d38bee4dc9e24fe2bece3e3b4a3f032701d3f0947b42930083dd4ad241b3309b514595482d42":0
RSAES-V15 decoding: good, payload=max, tight output buffer
pkcs1_v15_decode:"0002505152535455565700":117:117:0
RSAES-V15 decoding: good, payload=max, larger output buffer
pkcs1_v15_decode:"0002505152535455565700":117:128:0
RSAES-V15 decoding: good, payload=max-1, tight output buffer
pkcs1_v15_decode:"000250515253545556575800":116:116:0
RSAES-V15 decoding: good, payload=max-1, larger output buffer
pkcs1_v15_decode:"000250515253545556575800":116:117:0
RSAES-V15 decoding: good, payload=1
pkcs1_v15_decode:"00025050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505000":1:1:0
RSAES-V15 decoding: good, empty payload
pkcs1_v15_decode:"0002505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505000":0:0:0
RSAES-V15 decoding: payload=max, output too large
pkcs1_v15_decode:"0002505152535455565700":117:116:MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE
RSAES-V15 decoding: payload=max-1, output too large
pkcs1_v15_decode:"000250515253545556575800":116:115:MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE
RSAES-V15 decoding: bad first byte
pkcs1_v15_decode:"0102505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: bad second byte (0 instead of 2)
pkcs1_v15_decode:"0000505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: bad second byte (1 instead of 2)
pkcs1_v15_decode:"0001505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: padding too short (0)
pkcs1_v15_decode:"000200":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: padding too short (7)
pkcs1_v15_decode:"0002505050505050500000ffffffffffffffffff00":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING
RSAES-V15 decoding: unfinished padding
pkcs1_v15_decode:"0002505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050505050":0:42:MBEDTLS_ERR_RSA_INVALID_PADDING

80
tests/suites/test_suite_pkcs1_v15.function
View File

@ -1,6 +1,39 @@
/* BEGIN_HEADER */
#include "mbedtls/rsa.h"
#include "mbedtls/md.h"
#include "rsa_internal.h"
#include <test/constant_flow.h>
#if defined(MBEDTLS_TEST_HOOKS) && !defined(MBEDTLS_RSA_ALT)
static void pkcs1_v15_decode_raw(const unsigned char *input,
size_t input_size,
size_t output_size,
int expected_result,
size_t expected_plaintext_length)
{
unsigned char *input_buf = NULL;
unsigned char *output_buf = NULL;
size_t olen = 0;
TEST_CALLOC(output_buf, output_size);
TEST_CALLOC(input_buf, input_size);
memcpy(input_buf, input, input_size);
TEST_CF_SECRET(input_buf, input_size);
TEST_EQUAL(expected_result,
mbedtls_ct_rsaes_pkcs1_v15_unpadding(
input_buf, input_size,
output_buf, output_size, &olen));
if (expected_result == 0) {
TEST_EQUAL(expected_plaintext_length, olen);
}
exit:
mbedtls_free(input_buf);
mbedtls_free(output_buf);
}
#endif /* MBEDTLS_TEST_HOOKS && !MBEDTLS_RSA_ALT */
/* END_HEADER */
/* BEGIN_DEPENDENCIES
@ -124,6 +157,47 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE */
void rsa_decrypt_decompose_ret(int input,
int expected_ret, int expected_problem)
{
const int sensitive_in_1 = -1;
const int sensitive_in_2 = -2;
const int problem_1 = -11;
const int problem_2 = -12;
int combined_ret = input;
TEST_CF_SECRET(&combined_ret, sizeof(combined_ret));
int actual_problem = 42;
TEST_CF_SECRET(&actual_problem, sizeof(actual_problem));
int actual_ret = mbedtls_rsa_decrypt_decompose_ret(sensitive_in_1, problem_1,
sensitive_in_2, problem_2,
combined_ret,
&actual_problem);
TEST_EQUAL(actual_problem, expected_problem);
TEST_EQUAL(actual_ret, expected_ret);
/* Check invariant when there's no translation, only separation */
actual_ret = mbedtls_rsa_decrypt_decompose_ret(sensitive_in_1, sensitive_in_1,
sensitive_in_2, sensitive_in_2,
combined_ret,
&actual_problem);
TEST_EQUAL(actual_ret, expected_ret);
if (expected_problem == problem_1) {
TEST_EQUAL(actual_problem, sensitive_in_1);
} else if (expected_problem == problem_2) {
TEST_EQUAL(actual_problem, sensitive_in_2);
} else {
TEST_EQUAL(actual_problem, 0);
}
TEST_CF_PUBLIC(&actual_problem, sizeof(actual_problem));
TEST_CF_PUBLIC(&combined_ret, sizeof(combined_ret));
TEST_EQUAL(actual_problem | actual_ret, combined_ret);
}
/* END_CASE */
/* BEGIN_CASE */
void pkcs1_v15_decode(data_t *input,
int expected_plaintext_length_arg,
@ -257,6 +331,11 @@ void pkcs1_v15_decode(data_t *input,
TEST_ASSERT(count < 16);
}
#if defined(MBEDTLS_TEST_HOOKS) && !defined(MBEDTLS_RSA_ALT)
pkcs1_v15_decode_raw(original, sizeof(original), output_size,
expected_result, expected_plaintext_length);
#endif
exit:
mbedtls_mpi_free(&Nmpi); mbedtls_mpi_free(&Empi);
mbedtls_mpi_free(&Pmpi); mbedtls_mpi_free(&Qmpi);
@ -264,6 +343,7 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE */
void pkcs1_rsassa_v15_sign(int mod, char *input_P,
char *input_Q, char *input_N,

30
tests/suites/test_suite_pkcs7.data
View File

@ -14,6 +14,14 @@ PKCS7 Signed Data Parse with zero signers
depends_on:MBEDTLS_MD_CAN_SHA256
pkcs7_parse:"../framework/data_files/pkcs7_data_no_signers.der":MBEDTLS_PKCS7_SIGNED_DATA
PKCS7 Signed Data Parse reused object after multiple signers
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
pkcs7_parse_reuse:"../framework/data_files/pkcs7_data_multiple_signed.der":"../framework/data_files/pkcs7_data_no_signers.der":MBEDTLS_PKCS7_SIGNED_DATA
PKCS7 Signed Data Parse reused object from multiple signers to one signer
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
pkcs7_parse_reuse:"../framework/data_files/pkcs7_data_multiple_signed.der":"../framework/data_files/pkcs7_data_cert_signed_sha256.der":MBEDTLS_PKCS7_SIGNED_DATA
PKCS7 Signed Data Parse Fail with multiple certs #4
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
pkcs7_parse:"../framework/data_files/pkcs7_data_multiple_certs_signed.der":MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE
@ -86,10 +94,30 @@ PKCS7 Signed Data Verification Pass SHA256 #9.1
depends_on:MBEDTLS_MD_CAN_SHA256
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha256.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":MBEDTLS_MD_SHA256:0
PKCS7 Signed Data Verification Fail SHA1 #10
depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
PKCS7 Signed Data Verification Pass SHA1 #10
depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256
depends_on:MBEDTLS_MD_CAN_SHA1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha1.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
PKCS7 Signed Data Verification Fail MD5 #10.1
depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
PKCS7 Signed Data Verification Pass MD5 #10.1
depends_on:MBEDTLS_MD_CAN_MD5:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_md5.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
PKCS7 Signed Data Verification Fail RIPEMD160 #10.2
depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:MBEDTLS_ERR_PKCS7_INVALID_ALG
PKCS7 Signed Data Verification Pass RIPEMD160 #10.2
depends_on:MBEDTLS_MD_CAN_RIPEMD160:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_ripemd160.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0
PKCS7 Signed Data Verification Pass SHA512 #11
depends_on:MBEDTLS_MD_CAN_SHA512:MBEDTLS_MD_CAN_SHA256
pkcs7_verify:"../framework/data_files/pkcs7_data_cert_signed_sha512.der":"../framework/data_files/pkcs7-rsa-sha256-1.der":"../framework/data_files/pkcs7_data.bin":0:0

44
tests/suites/test_suite_pkcs7.function
View File

@ -25,8 +25,10 @@ static int pkcs7_parse_buffer(unsigned char *pkcs7_buf, int buflen)
mbedtls_pkcs7_init(&pkcs7);
res = mbedtls_pkcs7_parse_der(&pkcs7, pkcs7_buf, buflen);
mbedtls_pkcs7_free(&pkcs7);
return res;
}
/* END_SUITE_HELPERS */
/* BEGIN_CASE */
@ -57,6 +59,48 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_FS_IO */
void pkcs7_parse_reuse(char *first_pkcs7_file, char *second_pkcs7_file,
int res_expect)
{
unsigned char *first_pkcs7_buf = NULL;
unsigned char *second_pkcs7_buf = NULL;
mbedtls_pkcs7 pkcs7;
size_t first_buflen;
size_t second_buflen;
mbedtls_pkcs7_init(&pkcs7);
/* PKCS7 uses X509 which itself relies on PK under the hood and the latter
* can use PSA to store keys and perform operations so psa_crypto_init()
* must be called before. */
USE_PSA_INIT();
TEST_EQUAL(mbedtls_pk_load_file(first_pkcs7_file, &first_pkcs7_buf,
&first_buflen), 0);
TEST_EQUAL(mbedtls_pk_load_file(second_pkcs7_file, &second_pkcs7_buf,
&second_buflen), 0);
TEST_EQUAL(mbedtls_pkcs7_parse_der(&pkcs7, first_pkcs7_buf,
first_buflen),
MBEDTLS_PKCS7_SIGNED_DATA);
mbedtls_pkcs7_free(&pkcs7);
TEST_ASSERT(pkcs7.raw.p == NULL);
TEST_ASSERT(pkcs7.signed_data.signers.next == NULL);
TEST_EQUAL(mbedtls_pkcs7_parse_der(&pkcs7, second_pkcs7_buf,
second_buflen),
res_expect);
exit:
mbedtls_free(first_pkcs7_buf);
mbedtls_free(second_pkcs7_buf);
mbedtls_pkcs7_free(&pkcs7);
USE_PSA_DONE();
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_X509_CRT_PARSE_C:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C */
void pkcs7_verify(char *pkcs7_file,
char *crt_files,

109
tests/suites/test_suite_pkparse.data
View File

@ -2002,6 +2002,115 @@ pk_parse_public_keyfile_rsa:"../framework/data_files/rsa_pkcs1_2048_public.pem":
Parse Public RSA Key #4 (PKCS#1 wrapped, DER)
pk_parse_public_keyfile_rsa:"../framework/data_files/rsa_pkcs1_2048_public.der":0
Parse Public EC Key: secp256r1, nominal, DER (RFC 5480)
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"3059301306072a8648ce3d020106082a8648ce3d030107034200047772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b572590cdaf8f769361bcf34acfc11e5e074e8426bdde04be6e653945449617de45":0:0
Parse Public EC Key: secp256r1, compressed (supported)
depends_on:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3039301306072a8648ce3d020106082a8648ce3d030107032200037772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b57":0:0
Parse Public EC Key: secp256r1, compressed (not supported)
depends_on:PSA_WANT_ECC_SECP_R1_256:!MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3039301306072a8648ce3d020106082a8648ce3d030107032200037772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b57":MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE
# Odd length of (x,y) coordinate pair
Parse Public EC Key: secp256r1, truncated BIT STRING (-1, uncompressed)
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"3058301306072a8648ce3d020106082a8648ce3d030107034100047772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b572590cdaf8f769361bcf34acfc11e5e074e8426bdde04be6e653945449617de":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
# Even length of (x,y) coordinate pair
Parse Public EC Key: secp256r1, truncated BIT STRING (-2, uncompressed)
depends_on:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_RSA_C
pk_parse_public_key_ec:"3057301306072a8648ce3d020106082a8648ce3d030107034000047772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b572590cdaf8f769361bcf34acfc11e5e074e8426bdde04be6e653945449617de":MBEDTLS_ERR_RSA_BAD_INPUT_DATA:MBEDTLS_ERR_RSA_BAD_INPUT_DATA
# Single coordinate too short
Parse Public EC Key: secp256r1, truncated BIT STRING (-1, compressed)
depends_on:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3038301306072a8648ce3d020106082a8648ce3d030107032100037772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b":MBEDTLS_ERR_ECP_BAD_INPUT_DATA:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: secp256r1, 1-byte BIT STRING (00, compressed supported)
depends_on:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3019301306072a8648ce3d020106082a8648ce3d03010703020000":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_INVALID_KEY
Parse Public EC Key: secp256r1, 1-byte BIT STRING (01, compressed supported)
depends_on:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3019301306072a8648ce3d020106082a8648ce3d03010703020001":MBEDTLS_ERR_ECP_BAD_INPUT_DATA:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: secp256r1, 1-byte BIT STRING (02, compressed supported)
depends_on:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3019301306072a8648ce3d020106082a8648ce3d03010703020002":MBEDTLS_ERR_ECP_BAD_INPUT_DATA:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: secp256r1, 1-byte BIT STRING (03, compressed supported)
depends_on:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3019301306072a8648ce3d020106082a8648ce3d03010703020003":MBEDTLS_ERR_ECP_BAD_INPUT_DATA:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: secp256r1, 1-byte BIT STRING (04)
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"3019301306072a8648ce3d020106082a8648ce3d03010703020004":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: secp256r1, 1-byte BIT STRING (00, unsupported)
depends_on:PSA_WANT_ECC_SECP_R1_256:!MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3019301306072a8648ce3d020106082a8648ce3d03010703020000":MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE
Parse Public EC Key: secp256r1, empty BIT STRING
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"3018301306072a8648ce3d020106082a8648ce3d030107030100":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
# Odd length of (x,y) coordinate pair
Parse Public EC Key: secp256r1, overly long BIT STRING (+1, uncompressed)
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"305a301306072a8648ce3d020106082a8648ce3d030107034300047772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b572590cdaf8f769361bcf34acfc11e5e074e8426bdde04be6e653945449617de4543":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
# Even length of (x,y) coordinate pair
Parse Public EC Key: secp256r1, overly long BIT STRING (+2, uncompressed)
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"305b301306072a8648ce3d020106082a8648ce3d030107034400047772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b572590cdaf8f769361bcf34acfc11e5e074e8426bdde04be6e653945449617de454343":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: secp256r1, extremely long BIT STRING (uncompressed)
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"3081da301306072a8648ce3d020106082a8648ce3d0301070381c20004787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878787878797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979797979":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: secp256r1, uncompressed, X out of range
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"3059301306072a8648ce3d020106082a8648ce3d03010703420004ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff2590cdaf8f769361bcf34acfc11e5e074e8426bdde04be6e653945449617de45":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_INVALID_KEY
Parse Public EC Key: secp256r1, uncompressed, Y out of range
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"3059301306072a8648ce3d020106082a8648ce3d030107034200047772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b57ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_INVALID_KEY
Parse Public EC Key: secp256r1, uncompressed, not on curve
depends_on:PSA_WANT_ECC_SECP_R1_256
pk_parse_public_key_ec:"3059301306072a8648ce3d020106082a8648ce3d030107034200047772656f814b399279d5e1f1781fac6f099a3c5ca1b0e35351834b08b65e0b572590cdaf8f769361bcf34acfc11e5e074e8426bdde04be6e653945449617de46":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_INVALID_KEY
Parse Public EC Key: secp256r1, compressed, X out of range
depends_on:PSA_WANT_ECC_SECP_R1_256:MBEDTLS_PK_PARSE_EC_COMPRESSED
pk_parse_public_key_ec:"3039301306072a8648ce3d020106082a8648ce3d03010703220003ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_INVALID_KEY
Parse Public EC Key: X25519, nominal, DER (RFC 8410)
depends_on:PSA_WANT_ECC_MONTGOMERY_255
pk_parse_public_key_ec:"302a300506032b656e0321009bc3b0e93d8233fe6a8ba6138948cc12a91362d5c2ed81584db05ab5419c9d11":0:0
Parse Public EC Key: X25519, truncated BIT STRING (-1)
depends_on:PSA_WANT_ECC_MONTGOMERY_255
pk_parse_public_key_ec:"3029300506032b656e0320009bc3b0e93d8233fe6a8ba6138948cc12a91362d5c2ed81584db05ab5419c9d":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: X25519, 1-byte BIT STRING
depends_on:PSA_WANT_ECC_MONTGOMERY_255
pk_parse_public_key_ec:"300b300506032b656e0302009b":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: X25519, empty BIT STRING
depends_on:PSA_WANT_ECC_MONTGOMERY_255
pk_parse_public_key_ec:"300a300506032b656e030100":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: X25519, overly long BIT STRING (+1)
depends_on:PSA_WANT_ECC_MONTGOMERY_255
pk_parse_public_key_ec:"302b300506032b656e0322009bc3b0e93d8233fe6a8ba6138948cc12a91362d5c2ed81584db05ab5419c9d1143":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key: X25519, extremely long BIT STRING
depends_on:PSA_WANT_ECC_MONTGOMERY_255
pk_parse_public_key_ec:"3081cc300506032b656e0381c20065656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565656565":MBEDTLS_ERR_PK_INVALID_PUBKEY:MBEDTLS_ERR_ECP_BAD_INPUT_DATA
Parse Public EC Key #1 (RFC 5480, DER)
depends_on:MBEDTLS_ECP_HAVE_SECP192R1
pk_parse_public_keyfile_ec:"../framework/data_files/ec_pub.der":0

49
tests/suites/test_suite_pkparse.function
View File

@ -4,6 +4,7 @@
#include "mbedtls/oid.h"
#include "mbedtls/ecp.h"
#include "mbedtls/psa_util.h"
#include "mbedtls/rsa.h"
#include "pk_internal.h"
#if defined(MBEDTLS_PSA_CRYPTO_C)
@ -14,7 +15,7 @@
#define HAVE_mbedtls_pk_parse_key_pkcs8_encrypted_der
#endif
#if defined(MBEDTLS_PSA_CRYPTO_C) && defined(MBEDTLS_FS_IO)
#if defined(MBEDTLS_PSA_CRYPTO_C)
static int test_psa_bridge(const mbedtls_pk_context *ctx,
psa_key_usage_t usage_flag)
{
@ -101,7 +102,7 @@ static int pk_can_ecdsa(const mbedtls_pk_context *ctx)
#endif
}
#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
#endif /* MBEDTLS_PSA_CRYPTO_C && && MBEDTLS_FS_IO */
#endif /* MBEDTLS_PSA_CRYPTO_C */
/* END_HEADER */
@ -194,6 +195,50 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
void pk_parse_public_key_ec(data_t *key_data,
int result_psa,
int result_legacy)
{
mbedtls_pk_context ctx;
mbedtls_pk_init(&ctx);
int res;
#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
int result = result_psa;
(void) result_legacy;
#else
int result = result_legacy;
(void) result_psa;
#endif
unsigned char *key_copy = NULL;
MD_OR_USE_PSA_INIT();
TEST_CALLOC(key_copy, key_data->len);
memcpy(key_copy, key_data->x, key_data->len);
res = mbedtls_pk_parse_public_key(&ctx, key_copy, key_data->len);
TEST_EQUAL(res, result);
if (res == 0) {
TEST_ASSERT(mbedtls_pk_can_do(&ctx, MBEDTLS_PK_ECKEY));
#if defined(MBEDTLS_PSA_CRYPTO_C)
PSA_INIT();
if (pk_can_ecdsa(&ctx)) {
TEST_ASSERT(test_psa_bridge(&ctx, PSA_KEY_USAGE_VERIFY_HASH));
TEST_ASSERT(test_psa_bridge(&ctx, PSA_KEY_USAGE_VERIFY_MESSAGE));
}
#endif
}
exit:
mbedtls_pk_free(&ctx);
PSA_DONE();
mbedtls_free(key_copy);
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_FS_IO:MBEDTLS_PK_HAVE_ECC_KEYS */
void pk_parse_public_keyfile_ec(char *key_file, int result)
{

120
tests/suites/test_suite_psa_crypto.data
View File

@ -7256,6 +7256,11 @@ PSA (raw) key agreement: ECDH SECP256R1 (RFC 5903)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_SECP_R1_256
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"c88f01f510d9ac3f70a292daa2316de544e9aab8afe84049c62a9c57862d1433":"04d12dfb5289c8d4f81208b70270398c342296970a0bccb74c736fc7554494bf6356fbf3ca366cc23e8157854c13c58d6aac23f046ada30f8353e74f33039872ab":"d6840f6b42f6edafd13116e0e12565202fef8e9ece7dce03812464d04b9442de":PSA_SUCCESS
# see generating script in commit message
PSA (raw) key agreement: ECDH SECP256R1 (shared secret with leading 0)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_SECP_R1_256
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"800000000000000000000000000000000000000000000000000000000000000e":"046b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2964fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5":"0054fe92ec56ef5ad8bf4d9c46d2ca773af76c2e8c8b00e20ab772cf8b34348f":PSA_SUCCESS
PSA (raw) key agreement: ECDH SECP384R1 (RFC 5903)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_SECP_R1_384
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"099f3c7034d4a2c699884d73a375a67f7624ef7c6b3c0f160647b67414dce655e35b538041e649ee3faef896783ab194":"04e558dbef53eecde3d3fccfc1aea08a89a987475d12fd950d83cfa41732bc509d0d1ac43a0336def96fda41d0774a3571dcfbec7aacf3196472169e838430367f66eebe3c6e70c416dd5f0c68759dd1fff83fa40142209dff5eaad96db9e6386c":"11187331c279962d93d604243fd592cb9d0a926f422e47187521287e7156c5c4d603135569b9e9d09cf5d4a270f59746":PSA_SUCCESS
@ -7264,6 +7269,11 @@ PSA (raw) key agreement: ECDH SECP521R1 (RFC 5903)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_SECP_R1_521
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"0037ade9319a89f4dabdb3ef411aaccca5123c61acab57b5393dce47608172a095aa85a30fe1c2952c6771d937ba9777f5957b2639bab072462f68c27a57382d4a52":"0400d0b3975ac4b799f5bea16d5e13e9af971d5e9b984c9f39728b5e5739735a219b97c356436adc6e95bb0352f6be64a6c2912d4ef2d0433ced2b6171640012d9460f015c68226383956e3bd066e797b623c27ce0eac2f551a10c2c724d9852077b87220b6536c5c408a1d2aebb8e86d678ae49cb57091f4732296579ab44fcd17f0fc56a":"01144c7d79ae6956bc8edb8e7c787c4521cb086fa64407f97894e5e6b2d79b04d1427e73ca4baa240a34786859810c06b3c715a3a8cc3151f2bee417996d19f3ddea":PSA_SUCCESS
# see generating script in commit message
PSA (raw) key agreement: ECDH SECP521R1 (shared secret with leading 0)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_SECP_R1_521
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"0400c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650":"002da7db02840f023a36e1fffeaee16d3c47bb435bec6a231d4aab1ec5412f56fb90fcc4eaab9fd8571084cb9da252466c052d21913ce0fda47e61829972ce8f9a17":PSA_SUCCESS
PSA (raw) key agreement: ECDH brainpoolP256r1 (RFC 7027)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_BRAINPOOL_P_R1_256
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_BRAINPOOL_P_R1):"81db1ee100150ff2ea338d708271be38300cb54241d79950f77b063039804f1d":"048d2d688c6cf93e1160ad04cc4429117dc2c41825e1e9fca0addd34e6f1b39f7b990c57520812be512641e47034832106bc7d3e8dd0e4c7f1136d7006547cec6a":"89afc39d41d3b327814b80940b042590f96556ec91e6ae7939bce31f3a18bf2b":PSA_SUCCESS
@ -7284,6 +7294,88 @@ PSA (raw) key agreement: X25519 (RFC 7748: Bob)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a":"4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742":PSA_SUCCESS
# RFC 7748 says we need clip the input to 255 bits, see decodeUCoordinate().
# Check we indeed do that: same inputs as above except the MSB is set in the
# peer's public key (little endian, so that's the MSB of the last byte).
PSA (raw) key agreement: X25519 (RFC 7748: Alice with MSB set)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a":"de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882bcf":"4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742":PSA_SUCCESS
PSA (raw) key agreement: X25519 (RFC 7748: Bob with MSB set)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4eea":"4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742":PSA_SUCCESS
# BEGIN list from https://cr.yp.to/ecdh.html#validate
PSA (raw) key agreement: X25519 (peer key is 0)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"0000000000000000000000000000000000000000000000000000000000000000":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X25519 (peer key is 1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"0100000000000000000000000000000000000000000000000000000000000000":"":PSA_ERROR_INVALID_ARGUMENT
# this is x25519_bad_point_1 in ecp.c
PSA (raw) key agreement: X25519 (peer key is bad_point_1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b800":"":PSA_ERROR_INVALID_ARGUMENT
# this is x25519_bad_point_2 in ecp.c
PSA (raw) key agreement: X25519 (peer key is bad_point_2)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f1157":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X25519 (peer key is p-1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X25519 (peer key is p)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X25519 (peer key is p+1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f":"":PSA_ERROR_INVALID_ARGUMENT
# END list from https://cr.yp.to/ecdh.html#validate
# Further values in that list are larger that 2^255, and per RFC 7748
# we clip the input to 255 bits, that is, set bit 255 to zero.
# So, what's actually useful to test is 2^255 + x (aka x | (1 << 255))
# where x is any of the values above. (Reminder: little-endian.)
PSA (raw) key agreement: X25519 (peer key is 2^255 + 0)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"0000000000000000000000000000000000000000000000000000000000000080":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X25519 (peer key is 2^255 + 1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"0100000000000000000000000000000000000000000000000000000000000080":"":PSA_ERROR_INVALID_ARGUMENT
# this is x25519_bad_point_1 in ecp.c
PSA (raw) key agreement: X25519 (peer key is 2^255 + bad_point_1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"e0eb7a7c3b41b8ae1656e3faf19fc46ada098deb9c32b1fd866205165f49b880":"":PSA_ERROR_INVALID_ARGUMENT
# this is x25519_bad_point_2 in ecp.c
PSA (raw) key agreement: X25519 (peer key is 2^255 + bad_point_2)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"5f9c95bca3508c24b1d0b1559c83ef5b04445cc4581c8e86d8224eddd09f11d7":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X25519 (peer key is 2^255 + p-1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X25519 (peer key is 2^255 + p)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"edffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X25519 (peer key is 2^255 + p+1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb":"eeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff":"":PSA_ERROR_INVALID_ARGUMENT
# see generating script in commit message
PSA (raw) key agreement: X25519 (shared secret with MSB 0)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_255
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"8813000000000000000000000000000000000000000000000000000000000040":"0900000000000000000000000000000000000000000000000000000000000000":"9ec15224edbe326c5b40fa30311421f1fb309fdd0fcaf472b5d0ad2067b7db00":PSA_SUCCESS
PSA (raw) key agreement: X448 (RFC 7748: Alice)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_448
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"9a8f4925d1519f5775cf46b04b5800d4ee9ee8bae8bc5565d498c28dd9c9baf574a9419744897391006382a6f127ab1d9ac2d8c0a598726b":"3eb7a829b0cd20f5bcfc0b599b6feccf6da4627107bdb0d4f345b43027d8b972fc3e34fb4232a13ca706dcb57aec3dae07bdc1c67bf33609":"07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d":PSA_SUCCESS
@ -7292,6 +7384,34 @@ PSA (raw) key agreement: X448 (RFC 7748: Bob)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_448
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d":"9b08f7cc31b7e3e67d22d5aea121074a273bd2b83de09c63faa73d2c22c5d9bbc836647241d953d40c5b12da88120d53177f80e532c41fa0":"07fff4181ac6cc95ec1c16a94a0f74d12da232ce40a77552281d282bb60c0b56fd2464c335543936521c24403085d59a449a5037514a879d":PSA_SUCCESS
# curve448 only has 4 low-order points, whose X coordinates are 0, 1, -1.
# https://elligator.org/formulas -> search "Curve 448 has 4 low order points"
# Since the input is 448-bit, test 0, 1, p-1, p (= 0 mod p), p+1 (= 1 mod p).
PSA (raw) key agreement: X448 (RFC 7748: peer key is 0)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_448
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d":"0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X448 (RFC 7748: peer key is 1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_448
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d":"0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X448 (RFC 7748: peer key is p-1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_448
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d":"fefffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X448 (RFC 7748: peer key is p)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_448
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d":"fffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffff":"":PSA_ERROR_INVALID_ARGUMENT
PSA (raw) key agreement: X448 (RFC 7748: peer key is p+1)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_448
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"1c306a7ac2a0e2e0990b294470cba339e6453772b075811d8fad0d1d6927c120bb5ee8972b0d3e21374c9c921b09d1b0366f10b65173992d":"00000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff":"":PSA_ERROR_INVALID_ARGUMENT
# see generating script in commit message
PSA (raw) key agreement: X448 (shared secret with MSB 0)
depends_on:PSA_WANT_ALG_ECDH:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE:PSA_WANT_ECC_MONTGOMERY_448
key_agreement:PSA_ALG_ECDH:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_MONTGOMERY):"d805000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080":"0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"517b6be2c2edd157319082d4ddc688add71297284b6da74b050170035d764c19b8a14da4600715b18d8a3320a8e18a1d80fc9e6f7ea85600":PSA_SUCCESS
PSA (raw) key agreement: FFDH 2048 bits
depends_on:PSA_WANT_ALG_FFDH:PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC:PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT:PSA_WANT_DH_RFC7919_2048
key_agreement:PSA_ALG_FFDH:PSA_KEY_TYPE_DH_KEY_PAIR(PSA_DH_FAMILY_RFC7919):"4bd2bd426bda18aa94501942095ffe5a9affed1535b942f3449bce8e90f9e57f512c8fdda496c3ac051d951be206365fb5dd03a7d7db5236b98ddfa68237a45ef4513b381a82863cdb6521b44e10aa45de28d040326c5d95e9399ae25f6cad681f1cbf8c71934b91d5c8765f56d3978544784f297aa60afadd824e4b9525867fea33d873c379e3e7bd48528ec89aa01691b57df1c87c871b955331697e6a64db0837e1d24c80e2770179a98cae9da54d21cc5af4cc7b713b04554e2cdf417d78f12e8c749a2669e036a5b89eda7b087eb911c629f16128ab04f0ee7a3a9bec5772cfc68bbd0b492a781b36d26c2ec1f83953e192247e52714c3f32f0635f698c":"6d34e084b8d0e253a894237be9977e1a821b556ed4bc01cda691a927885979b59e55a30daa2a707769474b760e9f1c10544b2ce74b26efa4f069e05ce70471bf6b7e6c08a16fa880930790204e8b482478de0682ce3f58450a4e15abc14d05e13ef773a10a3e8bf2219f8ab556c88dc2a301b362c2d4e94bf2f0006bb36d15a5096ed1342f3f111ccf123ceae9bdc7bc0cde5edc9f0203f35f8a98aff6d75975357733a429364ed3aca32acaf9f857ef751e0e246140eebdfc2b403b644e42c48922f7f6cdaa6a2ef9ddfa54fb83657492f9f9a2c8aa4831601f9b11663e94d968d8be6e121aee2c79156e44aaa650bb26083983a76cc5883538d4794855ded1":"718ab2b5da3bc6e7767a98fb2c172bd74003fae2acffbc9a53d9b358401c1c748da36cab277e9397bc5eeec3010321d0f882d959eb097adddc99745526b213e30dc0df9fb1e4cd3fc27bfb1d6e89c715373439a66b9a13aa1334c84799827c17be1c36c1bc02fe60ea698da790fe4d2af710a435a1aae7fb11cd2a90a17ad87dde4f154b325dc47d8ea107a29d10a3bfa17149a1f9e8a1f7b680bfdca90fb0913c0b681670d904de49d7d000d24060330d4d2e4a2381d78c49e272d313174218561ceeb37e2ef824905d0fa42d13d49a73018411aeb749f7f4fc765bdc6db58bcebd995d4c949b0061f20759e1263d8f9ba3fd56afda07c178997256bb7d5230":PSA_SUCCESS

62
tests/suites/test_suite_psa_crypto.function
View File

@ -6363,13 +6363,20 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data,
psa_aead_abort(&operation);
/* Test for setting nonce after calling set lengths with plaintext length of SIZE_MAX */
/* Test for setting nonce after calling set lengths with plaintext length above the
* algorithm limit. */
#if SIZE_MAX > UINT32_MAX
PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg));
if (operation.alg == PSA_ALG_GCM) {
TEST_EQUAL(psa_aead_set_lengths(&operation, additional_data->len,
SIZE_MAX),
(size_t) 0xfffffffe * 16 + 1),
PSA_ERROR_INVALID_ARGUMENT);
TEST_EQUAL(psa_aead_set_nonce(&operation, nonce->x, nonce->len),
PSA_ERROR_BAD_STATE);
} else if (operation.alg == PSA_ALG_CHACHA20_POLY1305) {
TEST_EQUAL(psa_aead_set_lengths(&operation, additional_data->len,
(size_t) UINT32_MAX * 64 + 1),
PSA_ERROR_INVALID_ARGUMENT);
TEST_EQUAL(psa_aead_set_nonce(&operation, nonce->x, nonce->len),
PSA_ERROR_BAD_STATE);
@ -6382,7 +6389,8 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data,
psa_aead_abort(&operation);
#endif
/* Test for calling set lengths with a plaintext length of SIZE_MAX, after setting nonce */
/* Test for calling set lengths with a plaintext length above the algorithm limit,
* after setting nonce. */
#if SIZE_MAX > UINT32_MAX
PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg));
@ -6390,7 +6398,11 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data,
if (operation.alg == PSA_ALG_GCM) {
TEST_EQUAL(psa_aead_set_lengths(&operation, additional_data->len,
SIZE_MAX),
(size_t) 0xfffffffe * 16 + 1),
PSA_ERROR_INVALID_ARGUMENT);
} else if (operation.alg == PSA_ALG_CHACHA20_POLY1305) {
TEST_EQUAL(psa_aead_set_lengths(&operation, additional_data->len,
(size_t) UINT32_MAX * 64 + 1),
PSA_ERROR_INVALID_ARGUMENT);
} else if (operation.alg != PSA_ALG_CCM) {
PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len,
@ -8744,6 +8756,14 @@ void asymmetric_encrypt_decrypt(int key_type_arg,
TEST_LE_U(output_size, PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE);
TEST_CALLOC(output, output_size);
/* We want the function to work with an output buffer that's just the size
* of the actual plaintext. The PSA spec requires portable callers to pass
* a buffer that's the maximum possible plaintext size, given by
* PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(). When the buffer is smaller than
* that but large enough for the actual plaintext, implementations may either
* return PSA_ERROR_BUFFER_TOO_SMALL or success. Historically we've done the
* latter. Even though we never promised it, people might depend on this
* (our TLS code does), so let's test this behaviour in LTS branches. */
output2_size = input_data->len;
TEST_LE_U(output2_size,
PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg));
@ -8770,6 +8790,16 @@ void asymmetric_encrypt_decrypt(int key_type_arg,
TEST_MEMORY_COMPARE(input_data->x, input_data->len,
output2, output2_length);
/* Try again with an output buffer that's one byte too small */
if (output2_size != 0) {
TEST_EQUAL(PSA_ERROR_BUFFER_TOO_SMALL,
psa_asymmetric_decrypt(key, alg,
output, output_length,
label->x, label->len,
output2, output2_size - 1,
&output2_length));
}
exit:
/*
* Key attributes may have been returned by psa_get_key_attributes()
@ -8813,8 +8843,17 @@ void asymmetric_decrypt(int key_type_arg,
PSA_ASSERT(psa_get_key_attributes(key, &attributes));
key_bits = psa_get_key_bits(&attributes);
/* Determine the maximum ciphertext length */
output_size = PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg);
/* We want the function to work with an output buffer that's just the size
* of the actual plaintext. The PSA spec requires portable callers to pass
* a buffer that's the maximum possible plaintext size, given by
* PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(). When the buffer is smaller than
* that but large enough for the actual plaintext, implementations may either
* return PSA_ERROR_BUFFER_TOO_SMALL or success. Historically we've done the
* latter. Even though we never promised it, people might depend on this
* (our TLS code does), so let's test this behaviour in LTS branches. */
output_size = expected_data->len;
TEST_LE_U(output_size,
PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg));
TEST_LE_U(output_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE);
TEST_CALLOC(output, output_size);
@ -8844,6 +8883,17 @@ void asymmetric_decrypt(int key_type_arg,
output, output_length);
}
/* Try again with an output buffer that's one byte too small */
if (output_size != 0) {
TEST_EQUAL(PSA_ERROR_BUFFER_TOO_SMALL,
psa_asymmetric_decrypt(key, alg,
input_data->x, input_data->len,
label->x, label->len,
output,
output_size - 1,
&output_length));
}
exit:
psa_reset_key_attributes(&attributes);
psa_destroy_key(key);

65
tests/suites/test_suite_ssl.data
View File

@ -592,6 +592,14 @@ Handshake, select ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384, opaque, missing usage
depends_on:MBEDTLS_MD_CAN_SHA384:MBEDTLS_SSL_HAVE_CAMELLIA:MBEDTLS_SSL_HAVE_CBC:MBEDTLS_ECP_HAVE_SECP256R1:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED:MBEDTLS_USE_PSA_CRYPTO
handshake_ciphersuite_select:"TLS-ECDH-ECDSA-WITH-CAMELLIA-256-CBC-SHA384":MBEDTLS_PK_ECDSA:"":PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_ALG_ECDH:PSA_KEY_USAGE_SIGN_HASH:MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE:0
Handshake: DTLS 1.2, badmac_seen on client
depends_on:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_PROTO_TLS1_2
handshake_with_forced_context:1:MBEDTLS_SSL_VERSION_TLS1_2:PRE_HANDSHAKE_BADMAC_SEEN:0
Handshake: DTLS 1.2, badmac_seen on server
depends_on:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_PROTO_TLS1_2
handshake_with_forced_context:1:MBEDTLS_SSL_VERSION_TLS1_2:0:PRE_HANDSHAKE_BADMAC_SEEN
Sending app data via TLS, MFL=512 without fragmentation
depends_on:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
app_data_tls:MBEDTLS_SSL_MAX_FRAG_LEN_512:400:512:1:1
@ -669,13 +677,19 @@ Sending app data via DTLS, without MFL and with fragmentation
app_data_dtls:MBEDTLS_SSL_MAX_FRAG_LEN_NONE:16385:100000:0:0
DTLS renegotiation: no legacy renegotiation
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:-1
DTLS renegotiation: legacy renegotiation
renegotiation:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION
renegotiation:MBEDTLS_SSL_LEGACY_ALLOW_RENEGOTIATION:-1
DTLS renegotiation: legacy break handshake
renegotiation:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE
renegotiation:MBEDTLS_SSL_LEGACY_BREAK_HANDSHAKE:-1
DTLS renegotiation: after bad MAC on client
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:MBEDTLS_SSL_IS_CLIENT
DTLS renegotiation: after bad MAC on server
renegotiation:MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION:MBEDTLS_SSL_IS_SERVER
DTLS serialization with MFL=512
resize_buffers_serialize_mfl:MBEDTLS_SSL_MAX_FRAG_LEN_512
@ -3360,6 +3374,9 @@ cookie_parsing:"16fefd0000000000000000002F010000de000000000000011efefd7b72727272
TLS 1.3 srv Certificate msg - wrong vector lengths
tls13_server_certificate_msg_invalid_vector_len
TLS 1.3 cli rejects HRR selecting an un-offered group
reject_hrr_selecting_unoffered_group
EC-JPAKE set password
depends_on:MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
ssl_ecjpake_set_password:0
@ -3374,6 +3391,22 @@ elliptic_curve_get_properties
TLS 1.3 resume session with ticket
tls13_resume_session_with_ticket
TLS 1.3 server propagates RMS computation error
depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS:MBEDTLS_ERR_SSL_INTERNAL_ERROR
TLS 1.3 client propagates RMS computation error
depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:MBEDTLS_RSA_C:MBEDTLS_PKCS1_V15
tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:"<= write finished message":MBEDTLS_SSL_CLIENT_FINISHED:-1:MBEDTLS_ERR_SSL_INTERNAL_ERROR
TLS 1.2 server propagates EMS computation error
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY:MBEDTLS_ERR_SSL_INTERNAL_ERROR
TLS 1.2 client propagates EMS computation error
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CERTIFICATE_VERIFY:-1:MBEDTLS_ERR_SSL_INTERNAL_ERROR
TLS 1.3 read early data, early data accepted
tls13_read_early_data:TEST_EARLY_DATA_ACCEPTED
@ -3559,3 +3592,29 @@ send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_S
Default verify_result before doing a handshake
verify_result_without_handshake
TLS 1.2 NewSessionTicket: failing ticket callback leaves lifetime unset
depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
write_new_session_ticket_mem
TLS 1.3 drop early data
tls13_drop_early_data:0
TLS 1.3 drop early data and insert an EndOfEarlyData
tls13_drop_early_data:1
TLS 1.3 ClientHello record boundary alignment enforcement
tls13_record_boundary_alignment:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_HS_CLIENT_HELLO
TLS 1.3 ServerHello record boundary alignment enforcement
tls13_record_boundary_alignment:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_HS_SERVER_HELLO
TLS 1.3 server Finished record boundary alignment enforcement
tls13_record_boundary_alignment:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_HS_FINISHED
TLS 1.3 client Finished record boundary alignment enforcement
tls13_record_boundary_alignment:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_HS_FINISHED
TLS 1.3 EndOfEarlyData record boundary alignment enforcement
depends_on:MBEDTLS_SSL_EARLY_DATA:MBEDTLS_SSL_SESSION_TICKETS
tls13_record_boundary_alignment:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_HS_END_OF_EARLY_DATA

807
tests/suites/test_suite_ssl.function
View File

@ -27,6 +27,85 @@
#define TEST_TLS13_SESSION_LOAD_HOSTNAME_NO_NUL 1
#define TEST_TLS13_SESSION_LOAD_ALPN_NO_NUL 2
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
defined(MBEDTLS_SSL_SESSION_TICKETS) && \
defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SRV_C) && \
defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \
defined(MBEDTLS_PKCS1_V15) && \
defined(MBEDTLS_RSA_C) && \
defined(MBEDTLS_ECP_HAVE_SECP384R1) && \
defined(MBEDTLS_MD_CAN_SHA256) && \
defined(MBEDTLS_PK_HAVE_ECC_KEYS) && \
defined(MBEDTLS_CAN_HANDLE_RSA_TEST_KEY)
static int failing_ticket_write_unset_lifetime(
void *p_ticket, const mbedtls_ssl_session *session,
unsigned char *start, const unsigned char *end,
size_t *tlen, uint32_t *lifetime)
{
((void) p_ticket);
((void) session);
((void) start);
((void) end);
((void) tlen);
((void) lifetime);
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 && MBEDTLS_SSL_SESSION_TICKETS &&
MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SRV_C &&
MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED &&
MBEDTLS_PKCS1_V15 && MBEDTLS_RSA_C &&
MBEDTLS_ECP_HAVE_SECP384R1 && MBEDTLS_MD_CAN_SHA256 &&
MBEDTLS_PK_HAVE_ECC_KEYS && MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
#if defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_DEBUG_C) && \
defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SRV_C) && \
defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \
defined(MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP) && \
defined(MBEDTLS_USE_PSA_CRYPTO) && \
defined(MBEDTLS_MD_CAN_SHA256)
typedef struct {
/* Context for tls_abort_transcript(). The debug callback watches for
* trigger in the SSL debug trace, then aborts this connection's transcript
* hash operation exactly once so the test can check error propagation. */
mbedtls_ssl_context *ssl;
const char *trigger;
int triggered;
} tls_abort_transcript_context;
static void tls_abort_transcript(void *ctx, int level,
const char *file, int line,
const char *str)
{
tls_abort_transcript_context *abort_ctx = ctx;
(void) level;
(void) file;
(void) line;
if (abort_ctx->triggered) {
return;
}
if (abort_ctx->ssl == NULL) {
return;
}
if (abort_ctx->ssl->handshake == NULL) {
return;
}
if (strstr(str, abort_ctx->trigger) == NULL) {
return;
}
abort_ctx->triggered = 1;
#if defined(MBEDTLS_MD_CAN_SHA256)
psa_hash_abort(&abort_ctx->ssl->handshake->fin_sha256_psa);
#endif
#if defined(MBEDTLS_MD_CAN_SHA384)
psa_hash_abort(&abort_ctx->ssl->handshake->fin_sha384_psa);
#endif
}
#endif
#if (!defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \
defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_CLI_C) && \
defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_DEBUG_C) && \
@ -68,6 +147,65 @@ exit:
}
#endif
typedef enum {
PRE_HANDSHAKE_BADMAC_SEEN = 1u << 0,
} pre_handshake_tweaks_t;
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \
defined(MBEDTLS_PKCS1_V15) && \
defined(MBEDTLS_RSA_C) && \
defined(MBEDTLS_ECP_HAVE_SECP384R1) && \
defined(MBEDTLS_MD_CAN_SHA256) && \
defined(MBEDTLS_PK_HAVE_ECC_KEYS) && \
defined(MBEDTLS_CAN_HANDLE_RSA_TEST_KEY)
typedef struct {
uint32_t client;
uint32_t server;
} pre_handshake_tweak_spec_t;
static void pre_handshake_tweak_context(mbedtls_ssl_context *ssl,
int tweaks)
{
if (tweaks & PRE_HANDSHAKE_BADMAC_SEEN) {
ssl->badmac_seen_or_in_hsfraglen = 1;
}
}
static void pre_handshake_tweak_contexts(mbedtls_test_ssl_endpoint *client,
mbedtls_test_ssl_endpoint *server,
void *param)
{
const pre_handshake_tweak_spec_t *tweaks = param;
pre_handshake_tweak_context(&client->ssl, tweaks->client);
pre_handshake_tweak_context(&server->ssl, tweaks->server);
}
#endif
#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \
defined(MBEDTLS_PKCS1_V15) && \
defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
defined(MBEDTLS_RSA_C) && \
defined(MBEDTLS_ECP_HAVE_SECP384R1) && \
defined(MBEDTLS_SSL_PROTO_DTLS) && \
defined(MBEDTLS_SSL_RENEGOTIATION) && \
defined(MBEDTLS_MD_CAN_SHA256) && \
defined(MBEDTLS_CAN_HANDLE_RSA_TEST_KEY)
static void simulate_badmac_seen_on(mbedtls_test_ssl_endpoint *client,
mbedtls_test_ssl_endpoint *server,
void *param)
{
int on = *(int *) param;
switch (on) {
case MBEDTLS_SSL_IS_CLIENT:
client->ssl.badmac_seen_or_in_hsfraglen = 1;
break;
case MBEDTLS_SSL_IS_SERVER:
server->ssl.badmac_seen_or_in_hsfraglen = 1;
break;
}
}
#endif
typedef enum {
RECOMBINE_NOMINAL, /* param: ignored */
RECOMBINE_SPLIT_FIRST, /* param: offset of split (<=0 means from end) */
@ -377,6 +515,51 @@ exit:
#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED etc */
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_DEBUG_C) && \
defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SRV_C) && \
defined(MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE) && \
defined(MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP) && \
defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) && \
defined(PSA_WANT_ALG_SHA_256) && \
defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN)
typedef struct {
/* Context for `tls_tweak_in_msglen()`. The debug callback
* watches for "<= read record" in the SSL debug trace. When the pattern is
* detected, it increases by `nb_bytes` the 'in_msglen' field of the
* associated SSL context.
*/
mbedtls_ssl_context *ssl;
int armed;
int nb_bytes;
int triggered;
} tls_tweak_in_msglen_context;
static void tls_tweak_in_msglen(void *ctx, int level,
const char *file, int line,
const char *str)
{
tls_tweak_in_msglen_context *tweak_in_msglen_ctx = ctx;
(void) level;
(void) file;
(void) line;
if (!tweak_in_msglen_ctx->armed) {
return;
}
if (strstr(str, "<= read record") == NULL) {
return;
}
tweak_in_msglen_ctx->ssl->in_msglen += tweak_in_msglen_ctx->nb_bytes;
tweak_in_msglen_ctx->armed = 0;
tweak_in_msglen_ctx->triggered++;
}
#endif
/* END_HEADER */
/* BEGIN_DEPENDENCIES
@ -2914,7 +3097,7 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_MD_CAN_SHA256 */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_PKCS1_V15:MBEDTLS_MD_CAN_SHA256 */
void mbedtls_endpoint_sanity(int endpoint_type)
{
enum { BUFFSIZE = 1024 };
@ -3111,6 +3294,40 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
/* Test a handshake in forced conditions.
*
* This can be used for defense in depths for scenarios that we think
* can't happen, but might actually happen due to a bug, or due to
* a new feature that is insufficiently tested.
*
* This can also be a proxy for testing aspects of renegotiation or
* session resumption in circumstances that are hard to arrange.
*/
void handshake_with_forced_context(int dtls, int version,
int client_tweaks, int server_tweaks)
{
pre_handshake_tweak_spec_t tweaks = { client_tweaks, server_tweaks };
mbedtls_test_handshake_test_options options;
mbedtls_test_init_handshake_options(&options);
options.dtls = dtls;
options.client_min_version = version;
options.client_max_version = version;
options.expected_negotiated_version = version;
options.pre_handshake_fun = &pre_handshake_tweak_contexts;
options.pre_handshake_param = &tweaks;
mbedtls_test_ssl_perform_handshake(&options);
/* The goto below is used to avoid an "unused label" warning.*/
goto exit;
exit:
mbedtls_test_free_handshake_options(&options);
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_MD_CAN_SHA256 */
void app_data(int mfl, int cli_msg_len, int srv_msg_len,
int expected_cli_fragments,
@ -3152,7 +3369,7 @@ void app_data_tls(int mfl, int cli_msg_len, int srv_msg_len,
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_MD_CAN_SHA256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_MD_CAN_SHA256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void app_data_dtls(int mfl, int cli_msg_len, int srv_msg_len,
int expected_cli_fragments,
int expected_srv_fragments)
@ -3181,7 +3398,7 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_SSL_HAVE_AES:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:MBEDTLS_SSL_HAVE_CBC */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_SSL_HAVE_AES:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_DEBUG_C:MBEDTLS_SSL_MAX_FRAGMENT_LENGTH:MBEDTLS_SSL_HAVE_CBC */
void handshake_fragmentation(int mfl,
int expected_srv_hs_fragmentation,
int expected_cli_hs_fragmentation,
@ -3381,8 +3598,8 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_MD_CAN_SHA256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void renegotiation(int legacy_renegotiation)
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_MD_CAN_SHA256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void renegotiation(int legacy_renegotiation, int badmac_seen_on)
{
mbedtls_test_handshake_test_options options;
mbedtls_test_init_handshake_options(&options);
@ -3391,6 +3608,8 @@ void renegotiation(int legacy_renegotiation)
options.legacy_renegotiation = legacy_renegotiation;
options.dtls = 1;
options.expected_negotiated_version = MBEDTLS_SSL_VERSION_TLS1_2;
options.post_data_fun = &simulate_badmac_seen_on;
options.post_data_param = &badmac_seen_on;
mbedtls_test_ssl_perform_handshake(&options);
@ -3428,7 +3647,7 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_CONTEXT_SERIALIZATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_MD_CAN_SHA256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_CONTEXT_SERIALIZATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_SSL_PROTO_DTLS:MBEDTLS_MD_CAN_SHA256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void resize_buffers_serialize_mfl(int mfl)
{
test_resize_buffers(mfl, 0, MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION, 1, 1,
@ -3438,7 +3657,7 @@ void resize_buffers_serialize_mfl(int mfl)
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH:MBEDTLS_SSL_RENEGOTIATION:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void resize_buffers_renegotiate_mfl(int mfl, int legacy_renegotiation,
char *cipher)
{
@ -4047,6 +4266,118 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_ECDH:MBEDTLS_PK_CAN_ECDSA_SIGN:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */
void reject_hrr_selecting_unoffered_group(void)
{
int ret = -1;
mbedtls_test_ssl_endpoint client_ep, server_ep;
mbedtls_test_handshake_test_options client_options, server_options;
#if defined(MBEDTLS_DEBUG_C)
mbedtls_test_ssl_log_pattern cli_pattern = { .pattern = "Invalid key share in HRR" };
#endif /* MBEDTLS_DEBUG_C */
/* Group order is intentional: client offers secp256r1 first, while server only
* accepts secp384r1. This prevents immediate group agreement and forces HRR. */
uint16_t client_group_list[] = {
MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
MBEDTLS_SSL_IANA_TLS_GROUP_NONE
};
uint16_t server_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
MBEDTLS_SSL_IANA_TLS_GROUP_NONE };
memset(&client_ep, 0, sizeof(client_ep));
memset(&server_ep, 0, sizeof(server_ep));
mbedtls_test_init_handshake_options(&client_options);
mbedtls_test_init_handshake_options(&server_options);
MD_OR_USE_PSA_INIT();
client_options.pk_alg = MBEDTLS_PK_ECDSA;
client_options.client_min_version = MBEDTLS_SSL_VERSION_TLS1_3;
client_options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_3;
client_options.group_list = client_group_list;
#if defined(MBEDTLS_DEBUG_C)
client_options.cli_log_obj = &cli_pattern;
client_options.cli_log_fun = mbedtls_test_ssl_log_analyzer;
mbedtls_debug_set_threshold(1);
#endif /* MBEDTLS_DEBUG_C */
server_options.pk_alg = MBEDTLS_PK_ECDSA;
server_options.server_min_version = MBEDTLS_SSL_VERSION_TLS1_3;
server_options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_3;
server_options.group_list = server_group_list;
for (int round = 0; round < 2; round++) {
int select_unoffered_group = (round != 0);
TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep,
MBEDTLS_SSL_IS_CLIENT,
&client_options, NULL, NULL,
NULL), 0);
TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep,
MBEDTLS_SSL_IS_SERVER,
&server_options, NULL, NULL,
NULL), 0);
TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket),
&(server_ep.socket), 4096), 0);
ret = mbedtls_test_move_handshake_to_state(
&(server_ep.ssl), &(client_ep.ssl),
MBEDTLS_SSL_HELLO_RETRY_REQUEST);
TEST_EQUAL(ret, 0);
TEST_EQUAL(client_ep.ssl.handshake->offered_group_id,
MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1);
if (!select_unoffered_group) {
TEST_EQUAL(server_ep.ssl.handshake->hrr_selected_group,
MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1);
} else {
server_ep.ssl.handshake->hrr_selected_group = MBEDTLS_SSL_IANA_TLS_GROUP_X25519;
}
/* Write and send the HRR */
TEST_EQUAL(mbedtls_ssl_handshake_step(&(server_ep.ssl)), 0);
TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0);
if (!select_unoffered_group) {
/* Valid HRR, the client accepts the group MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1
* and goes ahead with the handshake.
*/
TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), 0);
TEST_ASSERT(client_ep.ssl.state != MBEDTLS_SSL_SERVER_HELLO);
#if defined(MBEDTLS_DEBUG_C)
TEST_EQUAL(cli_pattern.counter, 0);
#endif /* MBEDTLS_DEBUG_C */
} else {
/* Invalid HRR selecting MBEDTLS_SSL_IANA_TLS_GROUP_X25519 group.
* The client rejects it and aborts the handshake.
*/
TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)),
MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
TEST_EQUAL(client_ep.ssl.state, MBEDTLS_SSL_SERVER_HELLO);
#if defined(MBEDTLS_DEBUG_C)
TEST_EQUAL(cli_pattern.counter, 1);
#endif /* MBEDTLS_DEBUG_C */
}
mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
}
exit:
mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
mbedtls_test_free_handshake_options(&client_options);
mbedtls_test_free_handshake_options(&server_options);
#if defined(MBEDTLS_DEBUG_C)
mbedtls_debug_set_threshold(0);
#endif /* MBEDTLS_DEBUG_C */
MD_OR_USE_PSA_DONE();
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */
void ssl_ecjpake_set_password(int use_opaque_arg)
{
@ -4206,6 +4537,94 @@ exit:
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_TLS_C:MBEDTLS_DEBUG_C:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_MD_CAN_SHA256 */
void tls_transcript_error_propagation(int endpoint,
int tls_version,
const char *trigger,
int target_state,
int peer_target_state,
int expected_ret)
{
int ret = -1;
mbedtls_test_ssl_endpoint client_ep, server_ep;
memset(&client_ep, 0, sizeof(client_ep));
memset(&server_ep, 0, sizeof(server_ep));
mbedtls_test_handshake_test_options client_options;
mbedtls_test_init_handshake_options(&client_options);
mbedtls_test_handshake_test_options server_options;
mbedtls_test_init_handshake_options(&server_options);
tls_abort_transcript_context abort_ctx;
memset(&abort_ctx, 0, sizeof(abort_ctx));
mbedtls_ssl_context *peer_ssl_context = NULL;
PSA_INIT();
client_options.client_min_version = tls_version;
client_options.client_max_version = tls_version;
server_options.server_min_version = tls_version;
server_options.server_max_version = tls_version;
abort_ctx.trigger = trigger;
TEST_ASSERT(abort_ctx.trigger != NULL);
if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
client_options.cli_log_obj = &abort_ctx;
client_options.cli_log_fun = tls_abort_transcript;
abort_ctx.ssl = &client_ep.ssl;
peer_ssl_context = &server_ep.ssl;
} else {
server_options.srv_log_obj = &abort_ctx;
server_options.srv_log_fun = tls_abort_transcript;
abort_ctx.ssl = &server_ep.ssl;
peer_ssl_context = &client_ep.ssl;
}
mbedtls_debug_set_threshold(4);
TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT,
&client_options, NULL, NULL, NULL), 0);
TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER,
&server_options, NULL, NULL, NULL), 0);
/* Keep enough socket capacity for setup traffic so the final step below
* exercises the target state instead of only flushing previous messages. */
TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket),
&(server_ep.socket), 4096), 0);
TEST_EQUAL(mbedtls_test_move_handshake_to_state(
abort_ctx.ssl, peer_ssl_context,
target_state), 0);
/*
* Advance the peer further through the handshake so that it emits the
* messages needed by the endpoint under test to proceed through its next
* step.
*/
if (peer_target_state != -1) {
TEST_EQUAL(mbedtls_test_move_handshake_to_state(
peer_ssl_context, abort_ctx.ssl,
peer_target_state), 0);
TEST_EQUAL(mbedtls_ssl_flush_output(peer_ssl_context), 0);
}
TEST_EQUAL(mbedtls_ssl_flush_output(abort_ctx.ssl), 0);
TEST_EQUAL(abort_ctx.ssl->state, target_state);
TEST_EQUAL(abort_ctx.triggered, 0);
ret = mbedtls_ssl_handshake_step(abort_ctx.ssl);
TEST_ASSERT(abort_ctx.triggered);
TEST_ASSERT(ret != 0);
TEST_EQUAL(ret, expected_ret);
exit:
mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
mbedtls_test_free_handshake_options(&client_options);
mbedtls_test_free_handshake_options(&server_options);
mbedtls_debug_set_threshold(0);
PSA_DONE();
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED:MBEDTLS_MD_CAN_SHA256:MBEDTLS_ECP_HAVE_SECP256R1:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_PK_CAN_ECDSA_VERIFY:MBEDTLS_SSL_SESSION_TICKETS */
void tls13_resume_session_with_ticket()
{
@ -6395,3 +6814,377 @@ exit:
PSA_DONE();
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_ECP_HAVE_SECP384R1:MBEDTLS_MD_CAN_SHA256:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */
void write_new_session_ticket_mem()
{
enum { BUFFSIZE = 1024 };
mbedtls_test_ssl_endpoint server_ep, client_ep;
mbedtls_test_handshake_test_options options;
int ret = -1;
memset(&server_ep, 0, sizeof(server_ep));
memset(&client_ep, 0, sizeof(client_ep));
mbedtls_test_init_handshake_options(&options);
options.pk_alg = MBEDTLS_PK_RSA;
options.client_min_version = MBEDTLS_SSL_VERSION_TLS1_2;
options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_2;
options.server_min_version = MBEDTLS_SSL_VERSION_TLS1_2;
options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_2;
MD_OR_USE_PSA_INIT();
ret = mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER,
&options, NULL, NULL, NULL);
TEST_EQUAL(ret, 0);
mbedtls_ssl_conf_session_tickets_cb(&server_ep.conf,
failing_ticket_write_unset_lifetime,
mbedtls_test_ticket_parse,
NULL);
ret = mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT,
&options, NULL, NULL, NULL);
TEST_EQUAL(ret, 0);
ret = mbedtls_test_mock_socket_connect(&(server_ep.socket),
&(client_ep.socket),
BUFFSIZE);
TEST_EQUAL(ret, 0);
ret = mbedtls_test_move_handshake_to_state(&(server_ep.ssl),
&(client_ep.ssl),
MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC);
TEST_EQUAL(ret, 0);
ret = mbedtls_ssl_handshake_step(&(server_ep.ssl));
TEST_EQUAL(ret, 0);
/* Force a read of the lifetime value from the outgoing message.
* This is a non-regression test for a bug where the lifetime was set from
* uninitialized memory.
* The read here causes MSan and Valgrind to complain if the bug isn't fixed.
*/
volatile uint32_t lifetime = MBEDTLS_GET_UINT32_BE(server_ep.ssl.out_msg, 4);
(void) lifetime;
exit:
mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
mbedtls_test_free_handshake_options(&options);
MD_OR_USE_PSA_DONE();
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_EARLY_DATA:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:MBEDTLS_MD_CAN_SHA256:MBEDTLS_X509_RSASSA_PSS_SUPPORT:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C:MBEDTLS_SSL_SESSION_TICKETS */
void tls13_drop_early_data(int insert_end_of_early_data)
{
int ret = -1;
mbedtls_test_ssl_endpoint client_ep, server_ep;
memset(&client_ep, 0, sizeof(client_ep));
memset(&server_ep, 0, sizeof(server_ep));
mbedtls_test_handshake_test_options client_options, server_options;
mbedtls_test_init_handshake_options(&client_options);
mbedtls_test_init_handshake_options(&server_options);
mbedtls_ssl_session saved_session;
mbedtls_ssl_session_init(&saved_session);
const char *early_data = "This is early data.";
size_t early_data_len = strlen(early_data);
unsigned char buf[256];
PSA_INIT();
/*
* Run first handshake to get a ticket from the server.
*/
client_options.early_data = MBEDTLS_SSL_EARLY_DATA_ENABLED;
server_options.early_data = MBEDTLS_SSL_EARLY_DATA_ENABLED;
ret = mbedtls_test_get_tls13_ticket(&client_options, &server_options,
&saved_session);
TEST_EQUAL(ret, 0);
/*
* Prepare for handshake with the ticket.
*/
ret = mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT,
&client_options, NULL, NULL, NULL);
TEST_EQUAL(ret, 0);
ret = mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER,
&server_options, NULL, NULL, NULL);
TEST_EQUAL(ret, 0);
mbedtls_ssl_conf_session_tickets_cb(&server_ep.conf,
mbedtls_test_ticket_write,
mbedtls_test_ticket_parse,
NULL);
ret = mbedtls_test_mock_socket_connect(&(client_ep.socket),
&(server_ep.socket), 1024);
TEST_EQUAL(ret, 0);
ret = mbedtls_ssl_set_session(&(client_ep.ssl), &saved_session);
TEST_EQUAL(ret, 0);
/*
* Initiate handshake with ticket, up to the point where the client has
* written the ClientHello and only the ClientHello in its output socket
* buffer.
*/
#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
TEST_EQUAL(mbedtls_test_move_handshake_to_state(
&(client_ep.ssl), &(server_ep.ssl),
MBEDTLS_SSL_CLIENT_CCS_AFTER_CLIENT_HELLO), 0);
#else
TEST_EQUAL(mbedtls_test_move_handshake_to_state(
&(client_ep.ssl), &(server_ep.ssl),
MBEDTLS_SSL_SERVER_HELLO), 0);
#endif
TEST_EQUAL(mbedtls_ssl_flush_output(&client_ep.ssl), 0);
if (insert_end_of_early_data) {
/*
* Append an EndOfEarlyData message at the end of the record, just
* after the ClientHello message.
*/
unsigned char *client_output_buffer = client_ep.socket.output->buffer;
size_t record_size = MBEDTLS_GET_UINT16_BE(client_output_buffer, 3);
MBEDTLS_PUT_UINT16_BE(record_size + 4, client_output_buffer, 3);
unsigned char end_of_early_data[] = { 0x05, 0x00, 0x00, 0x00 };
ret = mbedtls_test_ssl_buffer_put(client_ep.socket.output,
end_of_early_data,
sizeof(end_of_early_data));
TEST_EQUAL(ret, (int) sizeof(end_of_early_data));
}
/* The server read the record containing the ClientHello. */
ret = mbedtls_test_move_handshake_to_state(&(server_ep.ssl),
&(client_ep.ssl),
MBEDTLS_SSL_SERVER_HELLO);
if (insert_end_of_early_data) {
/*
* If an EndOfEarlyData message was appended to the record containing
* the ClientHello then the end of the ClientHello does not align with
* the record boundary and the handshake fails.
*/
TEST_EQUAL(ret, MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
goto exit;
}
TEST_EQUAL(ret, 0);
/* The client application writes early data */
ret = mbedtls_ssl_write_early_data(&(client_ep.ssl),
(unsigned char *) early_data,
early_data_len);
TEST_EQUAL(ret, early_data_len);
/* Drop early data */
TEST_ASSERT(client_ep.socket.output->content_length <= sizeof(buf));
mbedtls_test_ssl_buffer_get(client_ep.socket.output, buf, sizeof(buf));
TEST_EQUAL(server_ep.socket.input->content_length, 0);
/* Resume the handshake */
ret = mbedtls_test_move_handshake_to_state(&(server_ep.ssl),
&(client_ep.ssl),
MBEDTLS_SSL_HANDSHAKE_OVER);
/*
* The early data were dropped. The EndOfEarlyData message is encrypted
* with the record number 1, but the server expects it to be encrypted
* with record number 0. Thus the handshake fails with
* MBEDTLS_ERR_SSL_INVALID_MAC.
*/
TEST_EQUAL(ret, MBEDTLS_ERR_SSL_INVALID_MAC);
exit:
mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
mbedtls_test_free_handshake_options(&client_options);
mbedtls_test_free_handshake_options(&server_options);
mbedtls_ssl_session_free(&saved_session);
PSA_DONE();
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_DEBUG_C:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_MD_CAN_SHA256:MBEDTLS_X509_RSASSA_PSS_SUPPORT:MBEDTLS_PKCS1_V15:MBEDTLS_RSA_C */
void tls13_record_boundary_alignment(int endpoint, int handshake_message)
{
int ret = -1;
int target_state, peer_target_state, encrypted;
mbedtls_test_ssl_endpoint client_ep, server_ep;
memset(&client_ep, 0, sizeof(client_ep));
memset(&server_ep, 0, sizeof(server_ep));
mbedtls_test_handshake_test_options client_options, server_options;
mbedtls_test_init_handshake_options(&client_options);
mbedtls_test_init_handshake_options(&server_options);
mbedtls_ssl_session saved_session;
mbedtls_ssl_session_init(&saved_session);
tls_tweak_in_msglen_context tweak_in_msglen_ctx;
memset(&tweak_in_msglen_ctx, 0, sizeof(tweak_in_msglen_ctx));
mbedtls_test_mock_socket *socket = NULL;
mbedtls_ssl_context *ssl_ctx = NULL;
mbedtls_ssl_context *peer_ssl_ctx = NULL;
unsigned char additional_empty_hs_msg[4] = { 0, 0, 0, 0 };
PSA_INIT();
switch (handshake_message) {
case MBEDTLS_SSL_HS_CLIENT_HELLO:
TEST_EQUAL(endpoint, MBEDTLS_SSL_IS_SERVER);
target_state = MBEDTLS_SSL_CLIENT_HELLO;
peer_target_state = MBEDTLS_SSL_SERVER_HELLO;
additional_empty_hs_msg[0] = MBEDTLS_SSL_HS_CERTIFICATE;
encrypted = 0;
break;
case MBEDTLS_SSL_HS_SERVER_HELLO:
TEST_EQUAL(endpoint, MBEDTLS_SSL_IS_CLIENT);
target_state = MBEDTLS_SSL_SERVER_HELLO;
peer_target_state = MBEDTLS_SSL_ENCRYPTED_EXTENSIONS;
additional_empty_hs_msg[0] = MBEDTLS_SSL_HS_ENCRYPTED_EXTENSIONS;
encrypted = 0;
break;
case MBEDTLS_SSL_HS_FINISHED:
if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
target_state = MBEDTLS_SSL_SERVER_FINISHED;
peer_target_state = MBEDTLS_SSL_CLIENT_CERTIFICATE;
} else {
target_state = MBEDTLS_SSL_CLIENT_FINISHED;
peer_target_state = MBEDTLS_SSL_FLUSH_BUFFERS;
}
/* Finished messages are not followed by any handshake message,
* insert an empty Finished message at the end of the record.
*/
additional_empty_hs_msg[0] = MBEDTLS_SSL_HS_FINISHED;
encrypted = 1;
break;
#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_SESSION_TICKETS)
case MBEDTLS_SSL_HS_END_OF_EARLY_DATA:
TEST_EQUAL(endpoint, MBEDTLS_SSL_IS_SERVER);
target_state = MBEDTLS_SSL_END_OF_EARLY_DATA;
peer_target_state = MBEDTLS_SSL_CLIENT_CERTIFICATE;
additional_empty_hs_msg[0] = MBEDTLS_SSL_HS_FINISHED;
encrypted = 1;
client_options.early_data = MBEDTLS_SSL_EARLY_DATA_ENABLED;
server_options.early_data = MBEDTLS_SSL_EARLY_DATA_ENABLED;
ret = mbedtls_test_get_tls13_ticket(&client_options, &server_options,
&saved_session);
TEST_EQUAL(ret, 0);
break;
#endif
default:
TEST_FAIL("Handshake message type not supported");
}
if (endpoint == MBEDTLS_SSL_IS_CLIENT) {
ssl_ctx = &client_ep.ssl;
peer_ssl_ctx = &server_ep.ssl;
socket = &client_ep.socket;
client_options.cli_log_obj = &tweak_in_msglen_ctx;
client_options.cli_log_fun = tls_tweak_in_msglen;
} else {
ssl_ctx = &server_ep.ssl;
peer_ssl_ctx = &client_ep.ssl;
socket = &server_ep.socket;
server_options.srv_log_obj = &tweak_in_msglen_ctx;
server_options.srv_log_fun = tls_tweak_in_msglen;
}
mbedtls_debug_set_threshold(2);
tweak_in_msglen_ctx.ssl = ssl_ctx;
TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT,
&client_options, NULL, NULL, NULL), 0);
TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER,
&server_options, NULL, NULL, NULL), 0);
#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_SESSION_TICKETS)
if (handshake_message == MBEDTLS_SSL_HS_END_OF_EARLY_DATA) {
mbedtls_ssl_conf_session_tickets_cb(&server_ep.conf,
mbedtls_test_ticket_write,
mbedtls_test_ticket_parse,
NULL);
ret = mbedtls_ssl_set_session(&(client_ep.ssl), &saved_session);
TEST_EQUAL(ret, 0);
}
#endif
TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket),
&(server_ep.socket), 1024), 0);
TEST_EQUAL(mbedtls_test_move_handshake_to_state(
ssl_ctx, peer_ssl_ctx, target_state), 0);
TEST_EQUAL(mbedtls_ssl_flush_output(ssl_ctx), 0);
/*
* Advance the peer further through the handshake so that it emits the
* messages needed by the endpoint under test to proceed through its next
* step.
*/
TEST_ASSERT(peer_target_state != -1);
TEST_EQUAL(mbedtls_test_move_handshake_to_state(
peer_ssl_ctx, ssl_ctx, peer_target_state), 0);
TEST_EQUAL(mbedtls_ssl_flush_output(peer_ssl_ctx), 0);
TEST_EQUAL(ssl_ctx->state, target_state);
if (encrypted) {
/*
* If the message we want to test the record boundary enforcement is
* encrypted, we cannot manipulate easily the record that contains it.
* In that case, we tamper with the record size after the record has been
* fetched from the socket buffer and decrypted by
* `mbedtls_ssl_read_record()`.
*/
tweak_in_msglen_ctx.armed = 1;
tweak_in_msglen_ctx.nb_bytes = sizeof(additional_empty_hs_msg);
} else {
/*
* In case of the unencrypted ClientHello or ServerHello, add an
* additional byte to the record that contains the handshake message.
* The byte is added in the socket buffer, before to be fetched by
* `mbedtls_ssl_read_record()`, simulating a man-in-the-middle tampering
* with the record.
*/
unsigned char *input_buffer = socket->input->buffer;
size_t record_size = MBEDTLS_GET_UINT16_BE(input_buffer, 3);
ret = mbedtls_test_ssl_buffer_put(socket->input, additional_empty_hs_msg,
sizeof(additional_empty_hs_msg));
TEST_EQUAL(ret, (int) sizeof(additional_empty_hs_msg));
MBEDTLS_PUT_UINT16_BE(record_size + sizeof(additional_empty_hs_msg),
input_buffer, 3);
}
ret = mbedtls_ssl_handshake_step(ssl_ctx);
TEST_EQUAL(ret, MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE);
TEST_EQUAL(ssl_ctx->in_msglen,
ssl_ctx->in_hslen + sizeof(additional_empty_hs_msg));
TEST_EQUAL(ssl_ctx->in_msgtype, MBEDTLS_SSL_MSG_HANDSHAKE);
TEST_EQUAL(ssl_ctx->in_msg[0], handshake_message);
if (encrypted) {
TEST_EQUAL(tweak_in_msglen_ctx.triggered, 1);
}
exit:
mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
mbedtls_test_free_handshake_options(&client_options);
mbedtls_test_free_handshake_options(&server_options);
mbedtls_debug_set_threshold(0);
mbedtls_ssl_session_free(&saved_session);
PSA_DONE();
}
/* END_CASE */

4
tests/suites/test_suite_version.data
View File

@ -1,8 +1,8 @@
Check compile time library version
check_compiletime_version:"3.6.6"
check_compiletime_version:"3.6.7"
Check runtime library version
check_runtime_version:"3.6.6"
check_runtime_version:"3.6.7"
Check for MBEDTLS_VERSION_C
check_feature:"MBEDTLS_VERSION_C":0

38
tests/suites/test_suite_x509parse.data
View File

@ -2060,9 +2060,25 @@ X509 CRT ASN1 (TBSCertificate v3, inv CertificatePolicies, policy qualifier leng
depends_on:MBEDTLS_RSA_C:MBEDTLS_MD_CAN_SHA256
x509parse_crt:"3081b030819aa0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092a864886f70d010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a314301230100603551d200409300730050601003001300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA
X509 CRT ASN1: basicConstraints overflow would make CA=1 (bad signature)
depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_HAVE_SECP256R1:MBEDTLS_MD_CAN_SHA256
mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-constraints-sequence-overflow.badsign.crt":MBEDTLS_ERR_X509_INVALID_EXTENSIONS:0
X509 CRT ASN1: basicConstraints overflow would make CA=1 (good self signature)
depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_HAVE_SECP256R1:MBEDTLS_MD_CAN_SHA256
mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-constraints-sequence-overflow.selfsigned.crt":MBEDTLS_ERR_X509_INVALID_EXTENSIONS:0
X509 CRT ASN1: basicConstraints: no cA but pathLenConstraint (bad signature)
depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_HAVE_SECP256R1:MBEDTLS_MD_CAN_SHA256
mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):0
X509 CRT ASN1: basicConstraints: no cA but pathLenConstraint (good self signature)
depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_HAVE_SECP256R1:MBEDTLS_MD_CAN_SHA256
mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):0
X509 CRT ASN1 (TBS, inv extBasicConstraint, no pathlen length)
depends_on:MBEDTLS_RSA_C:MBEDTLS_MD_CAN_SHA256
x509parse_crt:"3081b030819aa0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a314301230100603551d130101010406300402010102300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA
x509parse_crt:"3081b030819aa0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a314301230100603551d13010101040630040101ff02300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA
X509 CRT ASN1 (inv extBasicConstraint, pathlen is INT_MAX)
depends_on:MBEDTLS_RSA_C:MBEDTLS_MD_CAN_SHA256:MBEDTLS_MD_CAN_SHA1
@ -2074,19 +2090,19 @@ mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server1_pathlen
X509 CRT ASN1 (TBS, inv extBasicConstraint, pathlen inv length encoding)
depends_on:MBEDTLS_RSA_C:MBEDTLS_MD_CAN_SHA256
x509parse_crt:"3081b130819ba0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a315301330110603551d13010101040730050201010285300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_INVALID_LENGTH
x509parse_crt:"3081b130819ba0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a315301330110603551d13010101040730050101ff0285300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_INVALID_LENGTH
X509 CRT ASN1 (TBS, inv extBasicConstraint, pathlen length out of bounds)
depends_on:MBEDTLS_RSA_C:MBEDTLS_MD_CAN_SHA256
x509parse_crt:"3081b130819ba0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a315301330110603551d13010101040730050201010201300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA
x509parse_crt:"3081b130819ba0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a315301330110603551d13010101040730050101ff0201300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA
X509 CRT ASN1 (TBS, inv extBasicConstraint, pathlen empty)
depends_on:MBEDTLS_RSA_C:MBEDTLS_MD_CAN_SHA256
x509parse_crt:"3081b130819ba0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a315301330110603551d13010101040730050201010200300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_INVALID_LENGTH
x509parse_crt:"3081b130819ba0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a315301330110603551d13010101040730050101ff0200300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_INVALID_LENGTH
X509 CRT ASN1 (TBS, inv extBasicConstraint, pathlen length mismatch)
depends_on:MBEDTLS_RSA_C:MBEDTLS_MD_CAN_SHA256
x509parse_crt:"3081b430819ea0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a318301630140603551d13010101040a30080201010201010500300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH
x509parse_crt:"3081b430819ea0030201028204deadbeef300d06092a864886f70d01010b0500300c310a30080600130454657374301c170c303930313031303030303030170c303931323331323335393539300c310a30080600130454657374302a300d06092A864886F70D010101050003190030160210ffffffffffffffffffffffffffffffff0202ffffa100a200a318301630140603551d13010101040a30080101ff0201010500300d06092a864886f70d01010b0500030200ff":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH
X509 CRT ASN1 (TBS, inv v3Ext, ExtKeyUsage bad second tag)
depends_on:MBEDTLS_RSA_C:MBEDTLS_MD_CAN_SHA256
@ -2943,6 +2959,10 @@ X509 CSR ASN.1 (OK)
depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_HAVE_SECP256R1:MBEDTLS_MD_CAN_SHA1:!MBEDTLS_X509_REMOVE_INFO
mbedtls_x509_csr_parse:"308201183081bf0201003034310b3009060355040613024e4c3111300f060355040a1308506f6c617253534c31123010060355040313096c6f63616c686f73743059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa029302706092a864886f70d01090e311a301830090603551d1304023000300b0603551d0f0404030205e0300906072a8648ce3d04010349003046022100b49fd8c8f77abfa871908dfbe684a08a793d0f490a43d86fcf2086e4f24bb0c2022100f829d5ccd3742369299e6294394717c4b723a0f68b44e831b6e6c3bcabf97243":"CSR version \: 1\nsubject name \: C=NL, O=PolarSSL, CN=localhost\nsigned using \: ECDSA with SHA1\nEC key size \: 256 bits\n\nkey usage \: Digital Signature, Non Repudiation, Key Encipherment\n":0
X509 CSR ASN.1 (extensionRequest SET length too short)
depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_HAVE_SECP256R1
mbedtls_x509_csr_parse:"308201183081bf0201003034310b3009060355040613024e4c3111300f060355040a1308506f6c617253534c31123010060355040313096c6f63616c686f73743059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa029302706092a864886f70d01090e3119301830090603551d1304023000300b0603551d0f0404030205e0300906072a8648ce3d04010349003046022100b49fd8c8f77abfa871908dfbe684a08a793d0f490a43d86fcf2086e4f24bb0c2022100f829d5ccd3742369299e6294394717c4b723a0f68b44e831b6e6c3bcabf97243":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_LENGTH_MISMATCH
X509 CSR ASN.1 (Unsupported critical extension, critical=true)
depends_on:MBEDTLS_PK_CAN_ECDSA_SOME:MBEDTLS_ECP_HAVE_SECP256R1:MBEDTLS_MD_CAN_SHA256:!MBEDTLS_X509_REMOVE_INFO
mbedtls_x509_csr_parse:"308201233081cb02010030413119301706035504030c1053656c66207369676e65642074657374310b300906035504061302444531173015060355040a0c0e41757468437274444220546573743059301306072a8648ce3d020106082a8648ce3d03010703420004c11ebb9951848a436ca2c8a73382f24bbb6c28a92e401d4889b0c361f377b92a8b0497ff2f5a5f6057ae85f704ab1850bef075914f68ed3aeb15a1ff1ebc0dc6a028302606092a864886f70d01090e311930173015060b2b0601040183890c8622020101ff0403010101300a06082a8648ce3d040302034700304402200c4108fd098525993d3fd5b113f0a1ead8750852baf55a2f8e670a22cabc0ba1022034db93a0fcb993912adcf2ea8cb4b66389af30e264d43c0daea03255e45d2ccc":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG
@ -3078,17 +3098,17 @@ X509 CSR ASN.1 (attributes: invalid len (len > data))
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_len1.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA
X509 CSR ASN.1 (attributes: invalid len (len < data))
X509 CSR ASN.1 (attributes: extensionRequest SET extends past attribute)
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_len2.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_LENGTH_MISMATCH
mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_len2.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA
X509 CSR ASN.1 (attributes: extension request invalid len (len > data))
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len1.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA
X509 CSR ASN.1 (attributes: extension request invalid len (len < data))
X509 CSR ASN.1 (attributes: extensionRequest sequence shorter than SET)
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len2.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA
mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len2.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_LENGTH_MISMATCH
X509 CSR ASN.1 (extensions: invalid sequence tag)
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C