From 0165a8d7637a458f49cfe01be1f21aa0f91143d7 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 23 Jan 2026 16:22:50 +0000 Subject: [PATCH 01/24] sig_algs: fix typo in client's sig_algs check This bug caused the client accepting sig_algs used by the server that it explicitly wanted to disallow. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index b19c2d7786..8cd313a47c 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2321,8 +2321,8 @@ start_processing: MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); sig_alg = MBEDTLS_GET_UINT16_BE(p, 0); if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg( - sig_alg, &pk_alg, &md_alg) != 0 && - !mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg) && + sig_alg, &pk_alg, &md_alg) != 0 || + !mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg) || !mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("bad server key exchange message")); From a51506b3f09e6543ec055f9e8c936ed7ff40661a Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 18 Feb 2026 19:39:56 +0000 Subject: [PATCH 02/24] Fix root cert prerequisites This root certificate uses SECP-384 and if we don't have it in the build, the parsing already fails even if we don't try to use it, there is no reason to have it in the build without the SECP-384. Signed-off-by: Janos Follath --- tests/src/certs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/src/certs.c b/tests/src/certs.c index 6a01893f4a..23beb7beee 100644 --- a/tests/src/certs.c +++ b/tests/src/certs.c @@ -440,7 +440,7 @@ const unsigned char *mbedtls_test_cas_der[] = { mbedtls_test_ca_crt_rsa_sha1_der, #endif /* MBEDTLS_MD_CAN_SHA1 */ #endif /* MBEDTLS_RSA_C */ -#if defined(MBEDTLS_PK_CAN_ECDSA_SOME) +#if defined(MBEDTLS_PK_CAN_ECDSA_SOME) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) mbedtls_test_ca_crt_ec_der, #endif /* MBEDTLS_PK_CAN_ECDSA_SOME */ NULL From 94116eddb846e9f72d3b3b73b1a282f8ca17272a Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 18 Feb 2026 14:25:41 +0000 Subject: [PATCH 03/24] Fix mbedtls_test_free_handshake_options We usually follow the pattern that a zero-initialised struct is safe to free. This wasn't the case here. Signed-off-by: Janos Follath --- tests/src/test_helpers/ssl_helpers.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c index 7fb23ab829..e3c0aa1cbf 100644 --- a/tests/src/test_helpers/ssl_helpers.c +++ b/tests/src/test_helpers/ssl_helpers.c @@ -97,8 +97,10 @@ void mbedtls_test_free_handshake_options( mbedtls_test_handshake_test_options *opts) { #if defined(MBEDTLS_SSL_CACHE_C) - mbedtls_ssl_cache_free(opts->cache); - mbedtls_free(opts->cache); + if (opts->cache != NULL) { + mbedtls_ssl_cache_free(opts->cache); + mbedtls_free(opts->cache); + } #else (void) opts; #endif From 27c0aa0b3e0bae841f9dbd3de2a6f07513e4674f Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 23 Jan 2026 16:18:01 +0000 Subject: [PATCH 04/24] sig_algs: Add non-regression test Signed-off-by: Janos Follath --- tests/include/test/ssl_helpers.h | 29 +++++++ tests/suites/test_suite_ssl.data | 8 ++ tests/suites/test_suite_ssl.function | 112 +++++++++++++++++++++++++++ 3 files changed, 149 insertions(+) diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h index 33ed2a883d..0af9f7bc38 100644 --- a/tests/include/test/ssl_helpers.h +++ b/tests/include/test/ssl_helpers.h @@ -71,6 +71,35 @@ defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) #define MBEDTLS_CAN_HANDLE_RSA_TEST_KEY #endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ + defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) && \ + defined(MBEDTLS_SHA384_C) +#define MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY +#endif + +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) || \ + defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \ + defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#define MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP +#endif + +/* + * To use the test keys we need PSA_WANT_ALG_SHA_256. Some test cases need an additional hash that + * can be used in modern TLS, but it doesn't matter which one. + */ +#if defined(MBEDTLS_SHA512_C) || \ + defined(MBEDTLS_SHA384_C) || \ + defined(MBEDTLS_SHA256) || \ + defined(MBEDTLS_SHA1_C) +#define MBEDTLS_TEST_HAS_ADDITIONAL_HASH +#endif + enum { #define MBEDTLS_SSL_TLS1_3_LABEL(name, string) \ tls13_label_ ## name, diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 1e57420a77..4b5e16ff6b 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3527,3 +3527,11 @@ ssl_tls_exporter_too_early:MBEDTLS_SSL_VERSION_TLS1_3:1:MBEDTLS_SSL_SERVER_CERTI TLS 1.3 - HRR then TLS 1.2 second ClientHello tls13_hrr_then_tls12_second_client_hello + +Negative Test: Server using sig_alg not offered by the client #1 +depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_SHA256_C +send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER + +Negative Test: Server using sig_alg not offered by the client #2 +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA512_C +send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 875b48c426..3f42922a09 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5727,6 +5727,118 @@ exit: } /* END_CASE */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/ +void send_invalid_sig_alg(int sig, int hash, int expected_ret) +{ + // This is a test about the client behaviour in case it receives a key exchange signed with a + // sig_alg it didn't specify in the client hello. The input specifies a target_sig_alg, which we + // make sure that the client does not offer but the server does. Then we make the server beleive + // that target_sig_alg is the only one the client offered. + + // Remark: We need an additional hash algorithm offered, because if we don't have it, the server + // realises too early that there is no common ground and we don't get the chance to manipulate + // it. This is why we need MBEDTLS_TEST_HAS_ADDITIONAL_HASH in the requirements. + + enum { BUFFSIZE = 16384 }; + uint16_t *client_sig_algs = NULL; + mbedtls_test_ssl_endpoint server, client; + memset(&server, 0, sizeof(server)); + memset(&client, 0, sizeof(client)); + mbedtls_test_handshake_test_options options; + memset(&options, 0, sizeof(options)); + + uint16_t target_sig_alg = ((hash << 8) | sig); + + mbedtls_test_init_handshake_options(&options); + + // Make sure the server has credentals for target_sig_alg + if (sig == MBEDTLS_SSL_SIG_ECDSA) { + options.pk_alg = MBEDTLS_PK_ECDSA; + } else { + options.pk_alg = MBEDTLS_PK_RSA; + } + + // Force a ciphersuite where target_sig_alg is relevant + if (sig == MBEDTLS_SSL_SIG_ECDSA) { + options.cipher = "TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256"; + } else { + options.cipher = "TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256"; + } + + // Force TLS 1.2 as this test is a non-regression test for a bug in TLS 1.2 client and TLS 1.3 + // behaviour in this regard is substantially different. + options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_2; + options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_2; + + // Add loggers for easier debugging - we are not looking for any patterns. + // To turn on debug output, uncomment the threshold line and set the macro in + // the definition of mbedtls_test_ssl_log_analyzer(). +#if defined(MBEDTLS_DEBUG_C) + options.srv_log_obj = NULL; + options.srv_log_fun = mbedtls_test_ssl_log_analyzer; + options.cli_log_obj = NULL; + options.cli_log_fun = mbedtls_test_ssl_log_analyzer; + mbedtls_debug_set_threshold(3); +#endif + + int ret = -1; + + PSA_INIT(); + + ret = mbedtls_test_ssl_endpoint_init(&client, MBEDTLS_SSL_IS_CLIENT, + &options, NULL, NULL, NULL); + TEST_EQUAL(ret, 0); + + // Remove the target signature algorithm from the client's list + size_t client_sig_algs_len = 0; + while (client.conf.sig_algs[client_sig_algs_len++] != MBEDTLS_TLS1_3_SIG_NONE) { + ; + } + client_sig_algs_len--; + + TEST_CALLOC(client_sig_algs, client_sig_algs_len); + size_t j = 0; + for (size_t i = 0; client.conf.sig_algs[i] != MBEDTLS_TLS1_3_SIG_NONE; i++) { + if (client.conf.sig_algs[i] != target_sig_alg) { + client_sig_algs[j++] = client.conf.sig_algs[i]; + } + } + TEST_ASSERT(j < client_sig_algs_len); + client_sig_algs[j] = MBEDTLS_TLS1_3_SIG_NONE; + client.conf.sig_algs = client_sig_algs; + + ret = mbedtls_test_ssl_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER, + &options, NULL, NULL, NULL); + TEST_EQUAL(ret, 0); + + ret = mbedtls_test_mock_socket_connect(&server.socket, &client.socket, + BUFFSIZE); + TEST_EQUAL(ret, 0); + + // Move the connection to the point before the server sending the key exchange message + ret = mbedtls_test_move_handshake_to_state(&server.ssl, &client.ssl, + MBEDTLS_SSL_SERVER_KEY_EXCHANGE); + TEST_EQUAL(ret, 0); + + // Make the server beleive that the only sig_alg the client accepts is target_sig_alg + server.ssl.handshake->received_sig_algs[0] = target_sig_alg; + server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE; + + // Move the connection to a state where it is certain that the client has parsed the server key + // exchange + ret = mbedtls_test_move_handshake_to_state(&client.ssl, &server.ssl, + MBEDTLS_SSL_CERTIFICATE_REQUEST); + TEST_EQUAL(ret, expected_ret); + +exit: + mbedtls_test_free_handshake_options(&options); + mbedtls_test_ssl_endpoint_free(&server, NULL); + mbedtls_test_ssl_endpoint_free(&client, NULL); + mbedtls_free(client_sig_algs); + PSA_DONE(); +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_SSL_KEYING_MATERIAL_EXPORT:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */ void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int use_context) { From 238976c73af4baa60c8970d645cfa944c1c419a4 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 23 Jan 2026 16:31:53 +0000 Subject: [PATCH 05/24] sig_algs: add ChangeLog Signed-off-by: Janos Follath --- ChangeLog.d/sig_algs_check.txt | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 ChangeLog.d/sig_algs_check.txt diff --git a/ChangeLog.d/sig_algs_check.txt b/ChangeLog.d/sig_algs_check.txt new file mode 100644 index 0000000000..b0aed6dfd3 --- /dev/null +++ b/ChangeLog.d/sig_algs_check.txt @@ -0,0 +1,5 @@ +Security + * Fix a bug in the TLS 1.2 client's signature algorithm check, which caused + the client to accept server key exchange messages signed with a signature + algorithm explicitly disallowed by the client. Found and reported by + EFR-GmbH and M. Heuft of Security-Research-Consulting GmbH. CVE-2026-25834 From fcb70427f8f43a16fbc9b88207448d630bf6cd59 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 11:51:30 +0000 Subject: [PATCH 06/24] Reintroduce ssl_parse_signature_algorithm The logic was easier to follow before 693a47a, which removed the ssl_parse_signature_algorithm function and introduced the bug being fixed in this PR. When validating multiple conditions, it's easier to read, easier to debug and, as we can see, easier to get right if you validate them separately. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 74 +++++++++++++++++++++++++++++++++----- 1 file changed, 66 insertions(+), 8 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 8cd313a47c..f6d8724db0 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2078,6 +2078,71 @@ static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl) #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +MBEDTLS_CHECK_RETURN_CRITICAL +static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, + unsigned char **p, + unsigned char *end, + mbedtls_md_type_t *md_alg, + mbedtls_pk_type_t *pk_alg) +{ + *md_alg = MBEDTLS_MD_NONE; + *pk_alg = MBEDTLS_PK_SIGALG_NONE; + + MBEDTLS_SSL_CHK_BUF_READ_PTR(*p, end, 2); + uint16_t sig_alg = MBEDTLS_GET_UINT16_BE(*p, 0); + + if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(sig_alg, pk_alg, md_alg) != 0) { + /* + * Check hash algorithm + */ + if (*md_alg == MBEDTLS_MD_NONE) { + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", (*p)[0])); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + /* + * Check signature algorithm + */ + if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported SignatureAlgorithm %d", (*p)[1])); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + /* + * This shouldn't happen, but be robust. + */ + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + /* + * mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg() understands sig_alg code points across + * TLS versions. Make sure that the received sig_alg extension is valid in TLS 1.2. + */ + if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { + MBEDTLS_SSL_DEBUG_MSG( 1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + /* + * Check if the signature algorithm is acceptable + */ + if(!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", (*p)[1])); + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used HashAlgorithm %d", (*p)[0])); + *p += 2; + + return 0; +} +#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || + MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ + MBEDTLS_CHECK_RETURN_CRITICAL static int ssl_parse_server_key_exchange(mbedtls_ssl_context *ssl) { @@ -2300,7 +2365,6 @@ start_processing: unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl); size_t params_len = (size_t) (p - params); void *rs_ctx = NULL; - uint16_t sig_alg; mbedtls_pk_context *peer_pk; @@ -2318,12 +2382,7 @@ start_processing: /* * Handle the digitally-signed structure */ - MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); - sig_alg = MBEDTLS_GET_UINT16_BE(p, 0); - if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg( - sig_alg, &pk_alg, &md_alg) != 0 || - !mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg) || - !mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { + if (ssl_parse_signature_algorithm(ssl, &p, end, &md_alg, &pk_alg) != 0) { MBEDTLS_SSL_DEBUG_MSG(1, ("bad server key exchange message")); mbedtls_ssl_send_alert_message( @@ -2332,7 +2391,6 @@ start_processing: MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; } - p += 2; if (!mbedtls_pk_can_do(peer_pk, pk_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, From 3549b6f4a88b5e5ebd2bd16ff7e36668582618e6 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 14:02:38 +0000 Subject: [PATCH 07/24] Fix the MBEDTLS_TEST_HAS_ADDITIONAL_HASH macro It should require a hash that is configured in TLS 1.2 SSL contexts by default. Signed-off-by: Janos Follath --- tests/include/test/ssl_helpers.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h index 0af9f7bc38..f49cceca15 100644 --- a/tests/include/test/ssl_helpers.h +++ b/tests/include/test/ssl_helpers.h @@ -91,12 +91,10 @@ /* * To use the test keys we need PSA_WANT_ALG_SHA_256. Some test cases need an additional hash that - * can be used in modern TLS, but it doesn't matter which one. + * is configured by default (see mbedtls_ssl_config_defaults()), but it doesn't matter which one. */ #if defined(MBEDTLS_SHA512_C) || \ - defined(MBEDTLS_SHA384_C) || \ - defined(MBEDTLS_SHA256) || \ - defined(MBEDTLS_SHA1_C) + defined(MBEDTLS_SHA384_C) #define MBEDTLS_TEST_HAS_ADDITIONAL_HASH #endif From b34279950df1659751fee0d9d427eef5d4d8126c Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 14:17:14 +0000 Subject: [PATCH 08/24] Use API function to set sig_alg config in test Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 3f42922a09..66ba164b47 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5805,7 +5805,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) } TEST_ASSERT(j < client_sig_algs_len); client_sig_algs[j] = MBEDTLS_TLS1_3_SIG_NONE; - client.conf.sig_algs = client_sig_algs; + mbedtls_ssl_conf_sig_algs(&client.conf, client_sig_algs); ret = mbedtls_test_ssl_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER, &options, NULL, NULL, NULL); From cd0b3f34b6813377a5a23da865d07047203046ff Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 14:44:02 +0000 Subject: [PATCH 09/24] send_invalid_sig_alg: check logs There are other issues that can fail with the same error code. Make sure that the handshake fails exactly the way we want it to fail by analysing the client logs. Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 66ba164b47..3f1e78bfcd 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5770,14 +5770,17 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_2; options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_2; - // Add loggers for easier debugging - we are not looking for any patterns. - // To turn on debug output, uncomment the threshold line and set the macro in - // the definition of mbedtls_test_ssl_log_analyzer(). + mbedtls_test_ssl_log_pattern cli_pattern; + cli_pattern.pattern = "that was not offered"; + cli_pattern.counter = 0; + options.cli_log_obj = &cli_pattern; + options.cli_log_fun = mbedtls_test_ssl_log_analyzer; #if defined(MBEDTLS_DEBUG_C) + // Add loggers for easier debugging - we are not looking for any patterns in the server logs. + // To turn on debug output, uncomment the threshold line and set the macro in the definition + // of mbedtls_test_ssl_log_analyzer(). options.srv_log_obj = NULL; options.srv_log_fun = mbedtls_test_ssl_log_analyzer; - options.cli_log_obj = NULL; - options.cli_log_fun = mbedtls_test_ssl_log_analyzer; mbedtls_debug_set_threshold(3); #endif @@ -5829,8 +5832,12 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) ret = mbedtls_test_move_handshake_to_state(&client.ssl, &server.ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST); TEST_EQUAL(ret, expected_ret); + TEST_EQUAL(cli_pattern.counter, 1); exit: +#if defined(MBEDTLS_DEBUG_C) + mbedtls_debug_set_threshold(0); +#endif mbedtls_test_free_handshake_options(&options); mbedtls_test_ssl_endpoint_free(&server, NULL); mbedtls_test_ssl_endpoint_free(&client, NULL); From 2b696cd84f814a1f1bef857a0cd4be8de0ce0823 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 14:58:27 +0000 Subject: [PATCH 10/24] Fix some compile time guards Signed-off-by: Janos Follath --- tests/src/certs.c | 2 +- tests/suites/test_suite_ssl.data | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/src/certs.c b/tests/src/certs.c index 23beb7beee..f60a672b7d 100644 --- a/tests/src/certs.c +++ b/tests/src/certs.c @@ -455,7 +455,7 @@ const size_t mbedtls_test_cas_der_len[] = { sizeof(mbedtls_test_ca_crt_rsa_sha1_der), #endif /* MBEDTLS_MD_CAN_SHA1 */ #endif /* MBEDTLS_RSA_C */ -#if defined(MBEDTLS_PK_CAN_ECDSA_SOME) +#if defined(MBEDTLS_PK_CAN_ECDSA_SOME) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) sizeof(mbedtls_test_ca_crt_ec_der), #endif /* MBEDTLS_PK_CAN_ECDSA_SOME */ 0 diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 4b5e16ff6b..f26a211799 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3533,5 +3533,5 @@ depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_SHA256_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER Negative Test: Server using sig_alg not offered by the client #2 -depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA512_C +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_SHA512_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER From 0ab0d7c170ad6f9371ee4c4e51ee98f050a9aa68 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 15:01:11 +0000 Subject: [PATCH 11/24] Fix typos Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 3f1e78bfcd..d9af8e4268 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5751,7 +5751,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) mbedtls_test_init_handshake_options(&options); - // Make sure the server has credentals for target_sig_alg + // Make sure the server has credentials for target_sig_alg if (sig == MBEDTLS_SSL_SIG_ECDSA) { options.pk_alg = MBEDTLS_PK_ECDSA; } else { @@ -5823,7 +5823,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) MBEDTLS_SSL_SERVER_KEY_EXCHANGE); TEST_EQUAL(ret, 0); - // Make the server beleive that the only sig_alg the client accepts is target_sig_alg + // Make the server believe that the only sig_alg the client accepts is target_sig_alg server.ssl.handshake->received_sig_algs[0] = target_sig_alg; server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE; From 4d2027b2715e57474581a47d98d200c371f0983d Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 09:21:32 +0000 Subject: [PATCH 12/24] Fix test case dependency Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index d9af8e4268..d6c16b3ad2 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5727,7 +5727,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:MBEDTLS_DEBUG_C*/ void send_invalid_sig_alg(int sig, int hash, int expected_ret) { // This is a test about the client behaviour in case it receives a key exchange signed with a @@ -5775,14 +5775,12 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) cli_pattern.counter = 0; options.cli_log_obj = &cli_pattern; options.cli_log_fun = mbedtls_test_ssl_log_analyzer; -#if defined(MBEDTLS_DEBUG_C) // Add loggers for easier debugging - we are not looking for any patterns in the server logs. // To turn on debug output, uncomment the threshold line and set the macro in the definition // of mbedtls_test_ssl_log_analyzer(). options.srv_log_obj = NULL; options.srv_log_fun = mbedtls_test_ssl_log_analyzer; mbedtls_debug_set_threshold(3); -#endif int ret = -1; @@ -5835,9 +5833,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) TEST_EQUAL(cli_pattern.counter, 1); exit: -#if defined(MBEDTLS_DEBUG_C) mbedtls_debug_set_threshold(0); -#endif mbedtls_test_free_handshake_options(&options); mbedtls_test_ssl_endpoint_free(&server, NULL); mbedtls_test_ssl_endpoint_free(&client, NULL); From 03a9c87895749a8d8da53ade567e336d5e986f72 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 09:57:04 +0000 Subject: [PATCH 13/24] send_invalid_sig_alg: add baseline test Add a test case with a successful handshake for each test case that causes the desired handshake failure, with minimal differences between the two. The reason is to have more assurance that the handshake is failing for the desired reason (as opposed to not having done something correctly in the test code). Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.data | 12 ++++++++++-- tests/suites/test_suite_ssl.function | 13 +++++++++---- 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index f26a211799..f1d53a74eb 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3528,10 +3528,18 @@ ssl_tls_exporter_too_early:MBEDTLS_SSL_VERSION_TLS1_3:1:MBEDTLS_SSL_SERVER_CERTI TLS 1.3 - HRR then TLS 1.2 second ClientHello tls13_hrr_then_tls12_second_client_hello -Negative Test: Server using sig_alg not offered by the client #1 +Baseline for: Server using sig_alg not offered by the client - RSA with SHA256 +depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_SHA256_C +send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:0 + +Negative Test: Server using sig_alg not offered by the client - RSA with SHA256 depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_SHA256_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER -Negative Test: Server using sig_alg not offered by the client #2 +Baseline for: Server using sig_alg not offered by the client - ECDSA with SHA512 +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_SHA512_C +send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:0 + +Negative Test: Server using sig_alg not offered by the client - ECDSA with SHA512 depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_SHA512_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index d6c16b3ad2..0cd8c1cfbc 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5821,16 +5821,21 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) MBEDTLS_SSL_SERVER_KEY_EXCHANGE); TEST_EQUAL(ret, 0); - // Make the server believe that the only sig_alg the client accepts is target_sig_alg - server.ssl.handshake->received_sig_algs[0] = target_sig_alg; - server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE; + if (expected_ret != 0) { + // Make the server believe that the only sig_alg the client accepts is target_sig_alg + server.ssl.handshake->received_sig_algs[0] = target_sig_alg; + server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE; + } // Move the connection to a state where it is certain that the client has parsed the server key // exchange ret = mbedtls_test_move_handshake_to_state(&client.ssl, &server.ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST); TEST_EQUAL(ret, expected_ret); - TEST_EQUAL(cli_pattern.counter, 1); + + if (expected_ret != 0) { + TEST_EQUAL(cli_pattern.counter, 1); + } exit: mbedtls_debug_set_threshold(0); From e50420a2ddf894f5226eb81ea7a2ff2b6c956a95 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 11:35:44 +0000 Subject: [PATCH 14/24] Fix code style Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index f6d8724db0..7fde1efecb 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2122,14 +2122,14 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, * TLS versions. Make sure that the received sig_alg extension is valid in TLS 1.2. */ if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { - MBEDTLS_SSL_DEBUG_MSG( 1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } /* * Check if the signature algorithm is acceptable */ - if(!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { + if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } From 51ea7aca6f61a78e59ec20fe5054dda553db34e2 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 16:09:37 +0000 Subject: [PATCH 15/24] Fix dependencies The unit test framework always loads the client key as well, which requires a different curve and a hash than the server key. Signed-off-by: Janos Follath --- tests/include/test/ssl_helpers.h | 6 ++++++ tests/suites/test_suite_ssl.data | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h index f49cceca15..2c1828eea8 100644 --- a/tests/include/test/ssl_helpers.h +++ b/tests/include/test/ssl_helpers.h @@ -78,6 +78,12 @@ #define MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY #endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ + defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \ + defined(MBEDTLS_SHA256_C) +#define MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY +#endif + #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \ defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index f1d53a74eb..54c0e319fe 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3537,9 +3537,9 @@ depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_SHA256_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER Baseline for: Server using sig_alg not offered by the client - ECDSA with SHA512 -depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_SHA512_C +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:MBEDTLS_SHA512_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:0 Negative Test: Server using sig_alg not offered by the client - ECDSA with SHA512 -depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_SHA512_C +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:MBEDTLS_SHA512_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER From 4d70ce2f13ba1ba45eab7ee6e400ce10c9204ab2 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 16:40:02 +0000 Subject: [PATCH 16/24] ssl_parse_signature_algorithm: caller to get bytes After the recent refactoring ssl_parse_signature_algorithm() sends an alert on failure, but the caller also sends an alert on failure. Sending two alerts is at least a protocol violation, and might not leave the SSL context in a good state. It is simpler to have the caller read the two bytes, and pass them to this function. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 7fde1efecb..aca7ba77a1 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2082,23 +2082,19 @@ static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl) defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) MBEDTLS_CHECK_RETURN_CRITICAL static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, - unsigned char **p, - unsigned char *end, + uint16_t sig_alg, mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg) { *md_alg = MBEDTLS_MD_NONE; *pk_alg = MBEDTLS_PK_SIGALG_NONE; - MBEDTLS_SSL_CHK_BUF_READ_PTR(*p, end, 2); - uint16_t sig_alg = MBEDTLS_GET_UINT16_BE(*p, 0); - if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(sig_alg, pk_alg, md_alg) != 0) { /* * Check hash algorithm */ if (*md_alg == MBEDTLS_MD_NONE) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", (*p)[0])); + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", sig_alg >> 8)); return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } @@ -2106,7 +2102,8 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, * Check signature algorithm */ if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported SignatureAlgorithm %d", (*p)[1])); + MBEDTLS_SSL_DEBUG_MSG(1, + ("Server used unsupported SignatureAlgorithm %d", sig_alg & 0x00FF)); return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } @@ -2134,9 +2131,8 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } - MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", (*p)[1])); - MBEDTLS_SSL_DEBUG_MSG(2, ("Server used HashAlgorithm %d", (*p)[0])); - *p += 2; + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", sig_alg & 0x00FF)); + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used HashAlgorithm %d", sig_alg >> 8)); return 0; } @@ -2382,7 +2378,9 @@ start_processing: /* * Handle the digitally-signed structure */ - if (ssl_parse_signature_algorithm(ssl, &p, end, &md_alg, &pk_alg) != 0) { + MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); + uint16_t sig_alg = MBEDTLS_GET_UINT16_BE(p, 0); + if (ssl_parse_signature_algorithm(ssl, sig_alg, &md_alg, &pk_alg) != 0) { MBEDTLS_SSL_DEBUG_MSG(1, ("bad server key exchange message")); mbedtls_ssl_send_alert_message( @@ -2391,6 +2389,7 @@ start_processing: MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; } + p += 2; if (!mbedtls_pk_can_do(peer_pk, pk_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, From d91902c9d6e86ce316f3775535a07f55c451ded4 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 16:55:28 +0000 Subject: [PATCH 17/24] send_invalid_sig_alg: reduce debug dependency Run as much of the test as we can even in the abscence of MBEDTLS_DEBUG_C. Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 0cd8c1cfbc..497dff79df 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5770,6 +5770,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_2; options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_2; +#if defined(MBEDTLS_DEBUG_C) mbedtls_test_ssl_log_pattern cli_pattern; cli_pattern.pattern = "that was not offered"; cli_pattern.counter = 0; @@ -5781,6 +5782,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) options.srv_log_obj = NULL; options.srv_log_fun = mbedtls_test_ssl_log_analyzer; mbedtls_debug_set_threshold(3); +#endif int ret = -1; @@ -5833,12 +5835,16 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) MBEDTLS_SSL_CERTIFICATE_REQUEST); TEST_EQUAL(ret, expected_ret); +#if defined(MBEDTLS_DEBUG_C) if (expected_ret != 0) { TEST_EQUAL(cli_pattern.counter, 1); } +#endif exit: +#if defined(MBEDTLS_DEBUG_C) mbedtls_debug_set_threshold(0); +#endif mbedtls_test_free_handshake_options(&options); mbedtls_test_ssl_endpoint_free(&server, NULL); mbedtls_test_ssl_endpoint_free(&client, NULL); From 28886c543ecfbeb124e895072674d5a3f62c55a9 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 17:02:56 +0000 Subject: [PATCH 18/24] ssl_parse_signature_algorithm: match error codes The caller is returning MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER if ssl_parse_signature_algorithm() fails, but ssl_parse_signature_algorithm() returns MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE upon failure. There is no good reason for this mismatch and better to be aligned. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index aca7ba77a1..e3a8a1d126 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2095,7 +2095,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (*md_alg == MBEDTLS_MD_NONE) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", sig_alg >> 8)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -2104,14 +2104,14 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported SignatureAlgorithm %d", sig_alg & 0x00FF)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* * This shouldn't happen, but be robust. */ MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -2120,7 +2120,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -2128,7 +2128,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", sig_alg & 0x00FF)); From 1f938bc20f0dfae49cd5bbd186807088b8e7053c Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Thu, 12 Mar 2026 12:12:30 +0000 Subject: [PATCH 19/24] Fix code style Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index e3a8a1d126..12186ebba1 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2103,7 +2103,8 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { MBEDTLS_SSL_DEBUG_MSG(1, - ("Server used unsupported SignatureAlgorithm %d", sig_alg & 0x00FF)); + ("Server used unsupported SignatureAlgorithm %d", + sig_alg & 0x00FF)); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } From c07cc0e36bca2b7c132a215b7ed4deebfe88955b Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 13 Mar 2026 11:13:29 +0000 Subject: [PATCH 20/24] Fix a typo and an oversight DEBUG_C supposed to have been removed from the test dependencies, still being there is an oversight. Removing it was the sole purpose of 3e58109fbd. Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 497dff79df..6eba9c7eed 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5727,12 +5727,12 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:MBEDTLS_DEBUG_C*/ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/ void send_invalid_sig_alg(int sig, int hash, int expected_ret) { // This is a test about the client behaviour in case it receives a key exchange signed with a // sig_alg it didn't specify in the client hello. The input specifies a target_sig_alg, which we - // make sure that the client does not offer but the server does. Then we make the server beleive + // make sure that the client does not offer but the server does. Then we make the server believe // that target_sig_alg is the only one the client offered. // Remark: We need an additional hash algorithm offered, because if we don't have it, the server From b353e92c2bb6eecc27217fb2b62dcb436650c55b Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 13 Mar 2026 11:26:57 +0000 Subject: [PATCH 21/24] Improve ssl_parse_signature_algorithm Simplify and improve error reporting and remove unnecessary initialisation (the caller is responsible for initialising those values). Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 34 +++++++--------------------------- 1 file changed, 7 insertions(+), 27 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 12186ebba1..03c1673ae6 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2086,32 +2086,10 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg) { - *md_alg = MBEDTLS_MD_NONE; - *pk_alg = MBEDTLS_PK_SIGALG_NONE; - if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(sig_alg, pk_alg, md_alg) != 0) { - /* - * Check hash algorithm - */ - if (*md_alg == MBEDTLS_MD_NONE) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", sig_alg >> 8)); - return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; - } - - /* - * Check signature algorithm - */ - if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { - MBEDTLS_SSL_DEBUG_MSG(1, - ("Server used unsupported SignatureAlgorithm %d", - sig_alg & 0x00FF)); - return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; - } - - /* - * This shouldn't happen, but be robust. - */ - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, + ("Server used unsupported value in SigAlg extension 0x%04x", + sig_alg)); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } @@ -2120,7 +2098,9 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, * TLS versions. Make sure that the received sig_alg extension is valid in TLS 1.2. */ if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, + ("Server used unsupported value in SigAlg extension 0x%04x", + sig_alg)); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } @@ -2128,7 +2108,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, * Check if the signature algorithm is acceptable */ if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value 0x%04x that was not offered", sig_alg)); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } From 5b5e3ba75b25e1eadf6771509aaf3368e6262eba Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 13 Mar 2026 17:23:02 +0000 Subject: [PATCH 22/24] Fix ssl_parse_signature_algorithm guards In 3.6 we still have RSA key exchange and the existing preprocessor guards are insufficient. Use the same macro to guard the definition that guards the call. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 03c1673ae6..0196c0cc53 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -2078,8 +2078,7 @@ static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl) #endif /* MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) || MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED */ -#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ - defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +#if defined(MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) MBEDTLS_CHECK_RETURN_CRITICAL static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, uint16_t sig_alg, @@ -2117,8 +2116,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, return 0; } -#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || - MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ +#endif /* MBEDTLS_KEY_EXCHANGE_WITH_SERVER_SIGNATURE_ENABLED) */ MBEDTLS_CHECK_RETURN_CRITICAL static int ssl_parse_server_key_exchange(mbedtls_ssl_context *ssl) From 52cf5d884e8d818a54435cc6478a6ad673f65e39 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 13 Mar 2026 17:38:35 +0000 Subject: [PATCH 23/24] Fix send_invalid_sig_alg() test This commit fixes two problems: 1. In 3.6 the SSL unit test framework ignores option.cipher, we need to enforce it manually 2. In 3.6 we still have RSA key exchange and we need to condition the RSA test on the presence of ECDHE_RSA key exchange modes as well Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.data | 4 ++-- tests/suites/test_suite_ssl.function | 12 ++++++++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 54c0e319fe..f0d3cbdd92 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3529,11 +3529,11 @@ TLS 1.3 - HRR then TLS 1.2 second ClientHello tls13_hrr_then_tls12_second_client_hello Baseline for: Server using sig_alg not offered by the client - RSA with SHA256 -depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_SHA256_C +depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:MBEDTLS_SHA256_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:0 Negative Test: Server using sig_alg not offered by the client - RSA with SHA256 -depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_SHA256_C +depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:MBEDTLS_SHA256_C send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER Baseline for: Server using sig_alg not offered by the client - ECDSA with SHA512 diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 6eba9c7eed..1e65ab2dce 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5746,6 +5746,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) memset(&client, 0, sizeof(client)); mbedtls_test_handshake_test_options options; memset(&options, 0, sizeof(options)); + int forced_ciphersuite[2] = { 0, 0 }; uint16_t target_sig_alg = ((hash << 8) | sig); @@ -5760,10 +5761,13 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) // Force a ciphersuite where target_sig_alg is relevant if (sig == MBEDTLS_SSL_SIG_ECDSA) { - options.cipher = "TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256"; + forced_ciphersuite[0] = + mbedtls_ssl_get_ciphersuite_id("TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256"); } else { - options.cipher = "TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256"; + forced_ciphersuite[0] = + mbedtls_ssl_get_ciphersuite_id("TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256"); } + TEST_ASSERT(forced_ciphersuite[0] != 0); // Force TLS 1.2 as this test is a non-regression test for a bug in TLS 1.2 client and TLS 1.3 // behaviour in this regard is substantially different. @@ -5792,6 +5796,8 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) &options, NULL, NULL, NULL); TEST_EQUAL(ret, 0); + mbedtls_ssl_conf_ciphersuites(&client.conf, forced_ciphersuite); + // Remove the target signature algorithm from the client's list size_t client_sig_algs_len = 0; while (client.conf.sig_algs[client_sig_algs_len++] != MBEDTLS_TLS1_3_SIG_NONE) { @@ -5814,6 +5820,8 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) &options, NULL, NULL, NULL); TEST_EQUAL(ret, 0); + mbedtls_ssl_conf_ciphersuites(&server.conf, forced_ciphersuite); + ret = mbedtls_test_mock_socket_connect(&server.socket, &client.socket, BUFFSIZE); TEST_EQUAL(ret, 0); From 562326e4915f448406abd381c0bc23bd01e4159f Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Mon, 16 Mar 2026 19:16:13 +0000 Subject: [PATCH 24/24] send_invalid_sig_alg: use driver friendly guards The compile time guards were too restrictive, excluding builds with drivers, updating them will allow driver tests to run as well. Signed-off-by: Janos Follath --- tests/include/test/ssl_helpers.h | 28 ++++++++++++++-------------- tests/src/certs.c | 4 ++-- tests/suites/test_suite_ssl.data | 8 ++++---- tests/suites/test_suite_ssl.function | 2 +- 4 files changed, 21 insertions(+), 21 deletions(-) diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h index 2c1828eea8..84b847b203 100644 --- a/tests/include/test/ssl_helpers.h +++ b/tests/include/test/ssl_helpers.h @@ -73,25 +73,25 @@ #endif #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ - defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) && \ - defined(MBEDTLS_SHA384_C) + defined(MBEDTLS_ECP_HAVE_SECP384R1) && \ + defined(MBEDTLS_MD_CAN_SHA384) #define MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY #endif #if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ - defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && \ - defined(MBEDTLS_SHA256_C) + defined(MBEDTLS_ECP_HAVE_SECP256R1) && \ + defined(MBEDTLS_MD_CAN_SHA256) #define MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY #endif -#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) || \ - defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) || \ - defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) || \ - defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) || \ - defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) || \ - defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) || \ - defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) || \ - defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +#if defined(MBEDTLS_ECP_HAVE_CURVE25519) || \ + defined(MBEDTLS_ECP_HAVE_SECP256R1) || \ + defined(MBEDTLS_ECP_HAVE_SECP384R1) || \ + defined(MBEDTLS_ECP_HAVE_CURVE448) || \ + defined(MBEDTLS_ECP_HAVE_SECP521R1) || \ + defined(MBEDTLS_ECP_HAVE_BP256R1) || \ + defined(MBEDTLS_ECP_HAVE_BP384R1) || \ + defined(MBEDTLS_ECP_HAVE_BP512R1) #define MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP #endif @@ -99,8 +99,8 @@ * To use the test keys we need PSA_WANT_ALG_SHA_256. Some test cases need an additional hash that * is configured by default (see mbedtls_ssl_config_defaults()), but it doesn't matter which one. */ -#if defined(MBEDTLS_SHA512_C) || \ - defined(MBEDTLS_SHA384_C) +#if defined(MBEDTLS_MD_CAN_SHA512) || \ + defined(MBEDTLS_MD_CAN_SHA384) #define MBEDTLS_TEST_HAS_ADDITIONAL_HASH #endif diff --git a/tests/src/certs.c b/tests/src/certs.c index f60a672b7d..e7f4d3553b 100644 --- a/tests/src/certs.c +++ b/tests/src/certs.c @@ -440,7 +440,7 @@ const unsigned char *mbedtls_test_cas_der[] = { mbedtls_test_ca_crt_rsa_sha1_der, #endif /* MBEDTLS_MD_CAN_SHA1 */ #endif /* MBEDTLS_RSA_C */ -#if defined(MBEDTLS_PK_CAN_ECDSA_SOME) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#if defined(MBEDTLS_PK_CAN_ECDSA_SOME) && defined(MBEDTLS_ECP_HAVE_SECP384R1) mbedtls_test_ca_crt_ec_der, #endif /* MBEDTLS_PK_CAN_ECDSA_SOME */ NULL @@ -455,7 +455,7 @@ const size_t mbedtls_test_cas_der_len[] = { sizeof(mbedtls_test_ca_crt_rsa_sha1_der), #endif /* MBEDTLS_MD_CAN_SHA1 */ #endif /* MBEDTLS_RSA_C */ -#if defined(MBEDTLS_PK_CAN_ECDSA_SOME) && defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +#if defined(MBEDTLS_PK_CAN_ECDSA_SOME) && defined(MBEDTLS_ECP_HAVE_SECP384R1) sizeof(mbedtls_test_ca_crt_ec_der), #endif /* MBEDTLS_PK_CAN_ECDSA_SOME */ 0 diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index f0d3cbdd92..827636df35 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3529,17 +3529,17 @@ TLS 1.3 - HRR then TLS 1.2 second ClientHello tls13_hrr_then_tls12_second_client_hello Baseline for: Server using sig_alg not offered by the client - RSA with SHA256 -depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:MBEDTLS_SHA256_C +depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:MBEDTLS_MD_CAN_SHA256 send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:0 Negative Test: Server using sig_alg not offered by the client - RSA with SHA256 -depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:MBEDTLS_SHA256_C +depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED:MBEDTLS_MD_CAN_SHA256 send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER Baseline for: Server using sig_alg not offered by the client - ECDSA with SHA512 -depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:MBEDTLS_SHA512_C +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:MBEDTLS_MD_CAN_SHA512 send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:0 Negative Test: Server using sig_alg not offered by the client - ECDSA with SHA512 -depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:MBEDTLS_SHA512_C +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:MBEDTLS_MD_CAN_SHA512 send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 1e65ab2dce..b9b459635f 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5727,7 +5727,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_HAVE_CHACHAPOLY:MBEDTLS_MD_CAN_SHA256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/ void send_invalid_sig_alg(int sig, int hash, int expected_ret) { // This is a test about the client behaviour in case it receives a key exchange signed with a