From c2f9cf34161b3b4fc429ef3e9601f6e16f26600e Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Mon, 15 Jun 2026 13:58:49 +0200 Subject: [PATCH] Explain the "get invalid AD record .*renego" tests better Signed-off-by: Gilles Peskine --- programs/ssl/ssl_client2.c | 5 ++++- tests/ssl-opt.sh | 24 ++++++++++++++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-) diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c index be1d2a8e2e..9dc99c3e0b 100644 --- a/programs/ssl/ssl_client2.c +++ b/programs/ssl/ssl_client2.c @@ -2832,9 +2832,12 @@ send_request: #if defined(MBEDTLS_SSL_RENEGOTIATION) if (opt.renegotiate == 2) { + /* Perform renegotiation after the first data exchange. + * This is a one-time thing, we won't renegotiate even if there are + * more data exchanges that cause a `goto send_request` later. + */ opt.renegotiate = 0; - /* Perform renegotiation after the first data exchange. */ mbedtls_printf(" . Performing renegotiation..."); fflush(stdout); while ((ret = mbedtls_ssl_renegotiate(&ssl)) != 0) { diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index ff620aca99..1657729be9 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -11806,6 +11806,14 @@ run_test "DTLS proxy: inject invalid AD record, badmac_limit 2, exchanges 2"\ -s "too many records with bad MAC" \ -s "Verification of the message MAC failed" +# The next few tests exercise renegotiation in DTLS when `ssl->badmac_seen != 0`. +# +# This seems unrelated, but was the location of a bug in Mbed TLS 3.6.3 to +# 3.6.6 (CVE-2026-50713) due to `ssl->badmac_seen` being unified with +# `ssl->in_hsfraglen` (to preserve the ABI when adding support for handshake +# defragmentation in TLS in 3.6.3), with some mistakes in using the unified +# field that were fixed in 3.6.7. + requires_config_enabled MBEDTLS_SSL_RENEGOTIATION run_test "DTLS proxy: client: get invalid AD record then reject renego" \ -p "$P_PXY bad_ad_srv_once=1" \ @@ -11899,6 +11907,15 @@ run_test "DTLS proxy: server: get invalid AD record then accept renego (cli)" -S "Verification of the message MAC failed" \ -S "Consume: waiting for more handshake fragments" +# The next few tests have "early renego". A DTLS handshake message is delayed +# past another handshake message. From the perspective of the recipient, +# this means that a DTLS handshake arrives early (its epoch number is still +# in the future) and needs to be queued. +# +# In Mbed TLS 3.6.3 through 3.6.6, due to the fields `ssl->badmac_seen` +# and `ssl->in_hsfraglen` being unified, the early message was parsed +# incorrectly, leading to heap corruption. + requires_config_enabled MBEDTLS_SSL_RENEGOTIATION run_test "DTLS proxy: client: get invalid AD record then reject early renego" \ -p "$P_PXY bad_ad_srv_once=1 delay_encrypted_hs_srv=3" \ @@ -11921,6 +11938,13 @@ run_test "DTLS proxy: client: get invalid AD record then reject early renego" -C "Verification of the message MAC failed" \ -C "Consume: waiting for more handshake fragments" +# Delay the third encrypted handshake message from the server: +# 1. Finished message of the initial handshake. +# 2. HelloRequest to request renegotiation. +# 3. ServerHello of renegotiation, delayed. +# 4. Subsequent handshake message, which the client receives and enqueues. +# +# In Mbed TLS 3.6.3 though 3.6.6, the processing of (4) caused heap corruption. requires_config_enabled MBEDTLS_SSL_RENEGOTIATION run_test "DTLS proxy: client: get invalid AD record then accept early renego" \ -p "$P_PXY bad_ad_srv_once=1 delay_encrypted_hs_srv=3" \