From 9063aca165efaa68c08f95159c4e84e0f17464a9 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 14 May 2026 11:27:05 +0100 Subject: [PATCH 01/35] ssl: propagate transcript-hash computation failures Signed-off-by: Ben Taylor --- library/ssl_tls.c | 1 + library/ssl_tls13_server.c | 1 + 2 files changed, 2 insertions(+) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index e8a44f834c..7ddaa12202 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -6297,6 +6297,7 @@ static int ssl_compute_master(mbedtls_ssl_handshake_params *handshake, ret = handshake->calc_verify(ssl, session_hash, &seed_len); if (ret != 0) { MBEDTLS_SSL_DEBUG_RET(1, "calc_verify", ret); + return ret; } MBEDTLS_SSL_DEBUG_BUF(3, "session hash for extended master secret", diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c index 37fdf79ee3..38f2fe9370 100644 --- a/library/ssl_tls13_server.c +++ b/library/ssl_tls13_server.c @@ -3077,6 +3077,7 @@ static int ssl_tls13_process_client_finished(mbedtls_ssl_context *ssl) if (ret != 0) { MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ssl_tls13_compute_resumption_master_secret", ret); + return ret; } mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_HANDSHAKE_WRAPUP); From 5871216afc47bbafaadc71fa3f226061ffb82f6f Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 14 May 2026 11:27:15 +0100 Subject: [PATCH 02/35] tests: ssl: add regression tests for EMS/RMS error propagation Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.data | 6 + tests/suites/test_suite_ssl.function | 185 +++++++++++++++++++++++++++ 2 files changed, 191 insertions(+) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 9bf4c1f0bf..ef6ac36909 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3378,6 +3378,12 @@ elliptic_curve_get_properties TLS 1.3 resume session with ticket tls13_resume_session_with_ticket +TLS 1.3 server propagates RMS computation error +tls13_server_propagates_rms_error + +TLS 1.2 server propagates EMS computation error +tls12_server_propagates_ems_error + TLS 1.3 read early data, early data accepted tls13_read_early_data:TEST_EARLY_DATA_ACCEPTED diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index cc73f49aaf..09cd48a525 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -55,6 +55,163 @@ static int failing_ticket_write_unset_lifetime( PSA_WANT_ALG_SHA_256 && PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY && MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */ +#if defined(MBEDTLS_SSL_CLI_C) && \ + defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_DEBUG_C) && \ + defined(PSA_HAVE_ALG_SOME_RSA_SIGN) && \ + ((defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ + defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \ + defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) && \ + defined(MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE) && \ + defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) && \ + defined(PSA_WANT_ALG_SHA_256) && \ + defined(PSA_WANT_ECC_SECP_R1_256) && \ + defined(PSA_WANT_ECC_SECP_R1_384) && \ + defined(PSA_HAVE_ALG_ECDSA_VERIFY) && \ + defined(MBEDTLS_SSL_SESSION_TICKETS)) || \ + (defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ + defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \ + defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \ + defined(PSA_WANT_ALG_SHA_256) && \ + defined(PSA_WANT_ECC_SECP_R1_384) && \ + defined(PSA_HAVE_ALG_ECDSA_VERIFY))) +typedef struct { + mbedtls_ssl_context *ssl; + const char *trigger; + int triggered; +} tls_abort_transcript_context; + +static void tls_abort_transcript(void *ctx, int level, + const char *file, int line, + const char *str) +{ + tls_abort_transcript_context *abort_ctx = ctx; + + (void) level; + (void) file; + (void) line; + + if (abort_ctx->triggered || abort_ctx->ssl == NULL || + abort_ctx->ssl->handshake == NULL || + abort_ctx->trigger == NULL || + strstr(str, abort_ctx->trigger) == NULL) { + return; + } + + abort_ctx->triggered = 1; + psa_hash_abort(&abort_ctx->ssl->handshake->fin_sha256_psa); +#if defined(PSA_WANT_ALG_SHA_384) + psa_hash_abort(&abort_ctx->ssl->handshake->fin_sha384_psa); +#endif +} + +static void tls_server_error(mbedtls_ssl_protocol_version tls_version, + const char *trigger, + int server_state, + int client_state) +{ + int ret = -1; + int max_steps = 100; + mbedtls_test_ssl_endpoint client_ep, server_ep; + mbedtls_test_handshake_test_options client_options; + mbedtls_test_handshake_test_options server_options; + tls_abort_transcript_context abort_ctx; + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + unsigned char psk[] = "abcdefghijklmnop"; + data_t psk_data = { psk, sizeof(psk) - 1 }; +#endif + + memset(&client_ep, 0, sizeof(client_ep)); + memset(&server_ep, 0, sizeof(server_ep)); + memset(&abort_ctx, 0, sizeof(abort_ctx)); + mbedtls_test_init_handshake_options(&client_options); + mbedtls_test_init_handshake_options(&server_options); + + PSA_INIT(); + + client_options.client_min_version = tls_version; + client_options.client_max_version = tls_version; + server_options.server_min_version = tls_version; + server_options.server_max_version = tls_version; + + abort_ctx.trigger = trigger; + server_options.srv_log_obj = &abort_ctx; + server_options.srv_log_fun = tls_abort_transcript; + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { + client_options.psk_str = &psk_data; + } +#endif + + mbedtls_debug_set_threshold(4); + + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, + &client_options), 0); + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, + &server_options), 0); + +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS) + if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { + TEST_EQUAL(mbedtls_ssl_conf_psk(&server_ep.conf, psk, sizeof(psk) - 1, + (const unsigned char *) "foo", + strlen("foo")), 0); + mbedtls_ssl_conf_tls13_key_exchange_modes( + &client_ep.conf, MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK); + mbedtls_ssl_conf_tls13_key_exchange_modes( + &server_ep.conf, MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK); + mbedtls_ssl_conf_session_tickets_cb(&server_ep.conf, + mbedtls_test_ticket_write, + mbedtls_test_ticket_parse, + NULL); + } +#endif + + TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 1024), 0); + + abort_ctx.ssl = &server_ep.ssl; + + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + server_state), 0); + + TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0); + + TEST_EQUAL(server_ep.ssl.state, server_state); + + TEST_EQUAL(abort_ctx.triggered, 0); + + while (client_ep.ssl.state != client_state && + --max_steps >= 0) { + ret = mbedtls_ssl_handshake_step(&(client_ep.ssl)); + TEST_ASSERT(ret == 0 || ret == MBEDTLS_ERR_SSL_WANT_READ || + ret == MBEDTLS_ERR_SSL_WANT_WRITE); + } + + TEST_ASSERT(max_steps >= 0); + + TEST_EQUAL(client_ep.ssl.state, client_state); + TEST_EQUAL(server_ep.ssl.state, server_state); + + TEST_EQUAL(abort_ctx.triggered, 0); + + ret = mbedtls_ssl_handshake_step(&(server_ep.ssl)); + TEST_ASSERT(abort_ctx.triggered); + TEST_ASSERT(ret != 0); + + TEST_EQUAL(server_ep.ssl.state, server_state); + +exit: + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_free_handshake_options(&client_options); + mbedtls_test_free_handshake_options(&server_options); + mbedtls_debug_set_threshold(0); + PSA_DONE(); +} +#endif + #if (!defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \ defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_CLI_C) && \ defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_DEBUG_C) && \ @@ -4358,6 +4515,34 @@ exit: } /* END_CASE */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_DEBUG_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_SSL_SESSION_TICKETS */ +void tls13_server_propagates_rms_error() +{ + tls_server_error(MBEDTLS_SSL_VERSION_TLS1_3, + "<= parse finished message", + MBEDTLS_SSL_CLIENT_FINISHED, + MBEDTLS_SSL_FLUSH_BUFFERS); + goto exit; + +exit: + ; +} +/* END_CASE */ + +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_DEBUG_C:MBEDTLS_SSL_EXTENDED_MASTER_SECRET:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */ +void tls12_server_propagates_ems_error() +{ + tls_server_error(MBEDTLS_SSL_VERSION_TLS1_2, + "=> derive keys", + MBEDTLS_SSL_CLIENT_KEY_EXCHANGE, + MBEDTLS_SSL_CERTIFICATE_VERIFY); + goto exit; + +exit: + ; +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_ECDSA_VERIFY:MBEDTLS_SSL_SESSION_TICKETS */ void tls13_resume_session_with_ticket() { From ae6b06ce4c4685ea14b85502c3bb46e98d592c3c Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Fri, 15 May 2026 18:42:45 +0200 Subject: [PATCH 03/35] Improve dependencies and error handling Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.data | 6 +- tests/suites/test_suite_ssl.function | 215 +++++++++------------------ 2 files changed, 72 insertions(+), 149 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index ef6ac36909..c93ff542e9 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3379,10 +3379,12 @@ TLS 1.3 resume session with ticket tls13_resume_session_with_ticket TLS 1.3 server propagates RMS computation error -tls13_server_propagates_rms_error +depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS TLS 1.2 server propagates EMS computation error -tls12_server_propagates_ems_error +depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY TLS 1.3 read early data, early data accepted tls13_read_early_data:TEST_EARLY_DATA_ACCEPTED diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 09cd48a525..a68a6fcf3f 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -55,25 +55,11 @@ static int failing_ticket_write_unset_lifetime( PSA_WANT_ALG_SHA_256 && PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY && MBEDTLS_CAN_HANDLE_RSA_TEST_KEY */ -#if defined(MBEDTLS_SSL_CLI_C) && \ - defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_DEBUG_C) && \ - defined(PSA_HAVE_ALG_SOME_RSA_SIGN) && \ - ((defined(MBEDTLS_SSL_PROTO_TLS1_3) && \ +#if defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_DEBUG_C) && \ + defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SRV_C) && \ defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \ - defined(MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED) && \ - defined(MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE) && \ - defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) && \ - defined(PSA_WANT_ALG_SHA_256) && \ - defined(PSA_WANT_ECC_SECP_R1_256) && \ - defined(PSA_WANT_ECC_SECP_R1_384) && \ - defined(PSA_HAVE_ALG_ECDSA_VERIFY) && \ - defined(MBEDTLS_SSL_SESSION_TICKETS)) || \ - (defined(MBEDTLS_SSL_PROTO_TLS1_2) && \ - defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \ - defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) && \ - defined(PSA_WANT_ALG_SHA_256) && \ - defined(PSA_WANT_ECC_SECP_R1_384) && \ - defined(PSA_HAVE_ALG_ECDSA_VERIFY))) + defined(MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP) && \ + defined(PSA_WANT_ALG_SHA_256) typedef struct { mbedtls_ssl_context *ssl; const char *trigger; @@ -103,113 +89,6 @@ static void tls_abort_transcript(void *ctx, int level, psa_hash_abort(&abort_ctx->ssl->handshake->fin_sha384_psa); #endif } - -static void tls_server_error(mbedtls_ssl_protocol_version tls_version, - const char *trigger, - int server_state, - int client_state) -{ - int ret = -1; - int max_steps = 100; - mbedtls_test_ssl_endpoint client_ep, server_ep; - mbedtls_test_handshake_test_options client_options; - mbedtls_test_handshake_test_options server_options; - tls_abort_transcript_context abort_ctx; - -#if defined(MBEDTLS_SSL_PROTO_TLS1_3) - unsigned char psk[] = "abcdefghijklmnop"; - data_t psk_data = { psk, sizeof(psk) - 1 }; -#endif - - memset(&client_ep, 0, sizeof(client_ep)); - memset(&server_ep, 0, sizeof(server_ep)); - memset(&abort_ctx, 0, sizeof(abort_ctx)); - mbedtls_test_init_handshake_options(&client_options); - mbedtls_test_init_handshake_options(&server_options); - - PSA_INIT(); - - client_options.client_min_version = tls_version; - client_options.client_max_version = tls_version; - server_options.server_min_version = tls_version; - server_options.server_max_version = tls_version; - - abort_ctx.trigger = trigger; - server_options.srv_log_obj = &abort_ctx; - server_options.srv_log_fun = tls_abort_transcript; - -#if defined(MBEDTLS_SSL_PROTO_TLS1_3) - if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { - client_options.psk_str = &psk_data; - } -#endif - - mbedtls_debug_set_threshold(4); - - TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, - &client_options), 0); - TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, - &server_options), 0); - -#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_SESSION_TICKETS) - if (tls_version == MBEDTLS_SSL_VERSION_TLS1_3) { - TEST_EQUAL(mbedtls_ssl_conf_psk(&server_ep.conf, psk, sizeof(psk) - 1, - (const unsigned char *) "foo", - strlen("foo")), 0); - mbedtls_ssl_conf_tls13_key_exchange_modes( - &client_ep.conf, MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK); - mbedtls_ssl_conf_tls13_key_exchange_modes( - &server_ep.conf, MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK); - mbedtls_ssl_conf_session_tickets_cb(&server_ep.conf, - mbedtls_test_ticket_write, - mbedtls_test_ticket_parse, - NULL); - } -#endif - - TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), - &(server_ep.socket), 1024), 0); - - abort_ctx.ssl = &server_ep.ssl; - - TEST_EQUAL(mbedtls_test_move_handshake_to_state( - &(server_ep.ssl), &(client_ep.ssl), - server_state), 0); - - TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0); - - TEST_EQUAL(server_ep.ssl.state, server_state); - - TEST_EQUAL(abort_ctx.triggered, 0); - - while (client_ep.ssl.state != client_state && - --max_steps >= 0) { - ret = mbedtls_ssl_handshake_step(&(client_ep.ssl)); - TEST_ASSERT(ret == 0 || ret == MBEDTLS_ERR_SSL_WANT_READ || - ret == MBEDTLS_ERR_SSL_WANT_WRITE); - } - - TEST_ASSERT(max_steps >= 0); - - TEST_EQUAL(client_ep.ssl.state, client_state); - TEST_EQUAL(server_ep.ssl.state, server_state); - - TEST_EQUAL(abort_ctx.triggered, 0); - - ret = mbedtls_ssl_handshake_step(&(server_ep.ssl)); - TEST_ASSERT(abort_ctx.triggered); - TEST_ASSERT(ret != 0); - - TEST_EQUAL(server_ep.ssl.state, server_state); - -exit: - mbedtls_test_ssl_endpoint_free(&client_ep); - mbedtls_test_ssl_endpoint_free(&server_ep); - mbedtls_test_free_handshake_options(&client_options); - mbedtls_test_free_handshake_options(&server_options); - mbedtls_debug_set_threshold(0); - PSA_DONE(); -} #endif #if (!defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \ @@ -4515,31 +4394,73 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_DEBUG_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_SSL_HANDSHAKE_WITH_PSK_ENABLED:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_SSL_SESSION_TICKETS */ -void tls13_server_propagates_rms_error() +/* BEGIN_CASE depends_on:MBEDTLS_SSL_TLS_C:MBEDTLS_DEBUG_C:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:PSA_WANT_ALG_SHA_256 */ +void tls_transcript_error_propagation(int endpoint, + int tls_version, + const char *trigger, + int server_state, + int client_state) { - tls_server_error(MBEDTLS_SSL_VERSION_TLS1_3, - "<= parse finished message", - MBEDTLS_SSL_CLIENT_FINISHED, - MBEDTLS_SSL_FLUSH_BUFFERS); - goto exit; + int ret = -1; + mbedtls_test_ssl_endpoint client_ep, server_ep; + mbedtls_test_handshake_test_options client_options; + mbedtls_test_handshake_test_options server_options; + tls_abort_transcript_context abort_ctx; + + mbedtls_test_init_handshake_options(&client_options); + mbedtls_test_init_handshake_options(&server_options); + memset(&abort_ctx, 0, sizeof(abort_ctx)); + + PSA_INIT(); + + client_options.client_min_version = tls_version; + client_options.client_max_version = tls_version; + server_options.server_min_version = tls_version; + server_options.server_max_version = tls_version; + + abort_ctx.trigger = trigger; + + if (endpoint == MBEDTLS_SSL_IS_CLIENT) { + client_options.cli_log_obj = &abort_ctx; + client_options.cli_log_fun = tls_abort_transcript; + } else { + server_options.srv_log_obj = &abort_ctx; + server_options.srv_log_fun = tls_abort_transcript; + } + + mbedtls_debug_set_threshold(4); + + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, + &client_options), 0); + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, + &server_options), 0); + + TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 1024), 0); + + abort_ctx.ssl = &server_ep.ssl; + + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + server_state), 0); + + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + &(client_ep.ssl), &(server_ep.ssl), + client_state), 0); + + TEST_EQUAL(abort_ctx.triggered, 0); + + ret = mbedtls_ssl_handshake_step(&(server_ep.ssl)); + TEST_ASSERT(abort_ctx.triggered); + TEST_ASSERT(ret != 0); exit: - ; -} -/* END_CASE */ - -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_DEBUG_C:MBEDTLS_SSL_EXTENDED_MASTER_SECRET:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_HAVE_ALG_SOME_RSA_SIGN:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */ -void tls12_server_propagates_ems_error() -{ - tls_server_error(MBEDTLS_SSL_VERSION_TLS1_2, - "=> derive keys", - MBEDTLS_SSL_CLIENT_KEY_EXCHANGE, - MBEDTLS_SSL_CERTIFICATE_VERIFY); - goto exit; - -exit: - ; + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_free_handshake_options(&client_options); + mbedtls_test_free_handshake_options(&server_options); + mbedtls_debug_set_threshold(0); + PSA_DONE(); } /* END_CASE */ From c7f07e92889377ec8ec7aa30d67ae846a6a5d22c Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 27 May 2026 07:56:31 +0100 Subject: [PATCH 04/35] Add ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 ChangeLog.d/1583-1584-ssl-transcript-errors.txt diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt new file mode 100644 index 0000000000..921b40b11d --- /dev/null +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -0,0 +1,5 @@ +Bugfix + * Fix a bug where errors during transcript-hash computation for TLS 1.2 + extended master secret and TLS 1.3 resumption master secret could be + ignored instead of causing the handshake to fail. Fixes #1583 and #1584. + From b35f87033178987542871d30069293343aa132b0 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 28 May 2026 15:07:08 +0100 Subject: [PATCH 05/35] Update ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index 921b40b11d..062a788788 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -1,5 +1,5 @@ -Bugfix +Security * Fix a bug where errors during transcript-hash computation for TLS 1.2 extended master secret and TLS 1.3 resumption master secret could be - ignored instead of causing the handshake to fail. Fixes #1583 and #1584. + ignored instead of causing the handshake to fail. From ceaa75b899c80ba4849fac7643279ba3fead0480 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 28 May 2026 15:18:19 +0100 Subject: [PATCH 06/35] Add security impact Signed-off-by: Ben Taylor --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index 062a788788..4b5db144c3 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -1,5 +1,12 @@ Security - * Fix a bug where errors during transcript-hash computation for TLS 1.2 - extended master secret and TLS 1.3 resumption master secret could be - ignored instead of causing the handshake to fail. - + * Fix a bug where transcript-hash computation errors during TLS 1.2 + extended master secret calculation could be ignored instead of causing the + handshake to fail. This could allow a handshake to continue with a master + secret that was not correctly bound to the handshake transcript, + undermining the security guarantees of the extended master secret + extension. + * Fix a bug where TLS 1.3 servers could ignore errors when computing the + resumption master secret instead of causing the handshake to fail. This + could allow a server to issue resumption tickets derived from an invalid + resumption secret, weakening authentication of future resumptions made + with those tickets. From e8f3c920eda967baf71788481c271c412ebbc9f0 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 29 May 2026 14:48:44 +0100 Subject: [PATCH 07/35] Improve layout of the code for debugging with breakpoints Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.function | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index a68a6fcf3f..569cb159d1 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -76,10 +76,19 @@ static void tls_abort_transcript(void *ctx, int level, (void) file; (void) line; - if (abort_ctx->triggered || abort_ctx->ssl == NULL || - abort_ctx->ssl->handshake == NULL || - abort_ctx->trigger == NULL || - strstr(str, abort_ctx->trigger) == NULL) { + if (abort_ctx->triggered){ + return; + } + if (abort_ctx->ssl == NULL) { + return; + } + if (abort_ctx->ssl->handshake == NULL) { + return; + } + if (abort_ctx->trigger == NULL) { + return; + } + if (strstr(str, abort_ctx->trigger) == NULL) { return; } From d137f35665b94b2fe8ea93b267294dbd863cf604 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 29 May 2026 15:09:34 +0100 Subject: [PATCH 08/35] Add additional guard for sha256 in tests Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.function | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 569cb159d1..2728ddc704 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -93,7 +93,9 @@ static void tls_abort_transcript(void *ctx, int level, } abort_ctx->triggered = 1; +#if defined(PSA_WANT_ALG_SHA_256) psa_hash_abort(&abort_ctx->ssl->handshake->fin_sha256_psa); +#endif #if defined(PSA_WANT_ALG_SHA_384) psa_hash_abort(&abort_ctx->ssl->handshake->fin_sha384_psa); #endif From 8e9e821ce8b001b1771db940f0dbec266c685b5a Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 29 May 2026 15:12:28 +0100 Subject: [PATCH 09/35] refactor initialisation in tls_transcript_error_propagation, so that the variables are initialised straight after they are declared Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.function | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 2728ddc704..5655be29d9 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4415,11 +4415,10 @@ void tls_transcript_error_propagation(int endpoint, int ret = -1; mbedtls_test_ssl_endpoint client_ep, server_ep; mbedtls_test_handshake_test_options client_options; - mbedtls_test_handshake_test_options server_options; - tls_abort_transcript_context abort_ctx; - mbedtls_test_init_handshake_options(&client_options); + mbedtls_test_handshake_test_options server_options; mbedtls_test_init_handshake_options(&server_options); + tls_abort_transcript_context abort_ctx; memset(&abort_ctx, 0, sizeof(abort_ctx)); PSA_INIT(); From c2a26a989f07ef4abd8a7de5269756a805bfc488 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 1 Jun 2026 07:43:48 +0100 Subject: [PATCH 10/35] Fixed code style Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 5655be29d9..8a99e93940 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -76,7 +76,7 @@ static void tls_abort_transcript(void *ctx, int level, (void) file; (void) line; - if (abort_ctx->triggered){ + if (abort_ctx->triggered) { return; } if (abort_ctx->ssl == NULL) { From 3565231081e263897619568f52b174d4ac9759ba Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 1 Jun 2026 07:59:06 +0100 Subject: [PATCH 11/35] Fix issues with hanging seed length Signed-off-by: Ben Taylor --- library/ssl_tls.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 7ddaa12202..86bed60fd8 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -6293,12 +6293,16 @@ static int ssl_compute_master(mbedtls_ssl_handshake_params *handshake, #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) if (handshake->extended_ms == MBEDTLS_SSL_EXTENDED_MS_ENABLED) { lbl = "extended master secret"; - seed = session_hash; ret = handshake->calc_verify(ssl, session_hash, &seed_len); if (ret != 0) { MBEDTLS_SSL_DEBUG_RET(1, "calc_verify", ret); return ret; } + if (seed_len > sizeof(session_hash)) { + MBEDTLS_SSL_DEBUG_MSG(1, ("bad session hash length")); + return MBEDTLS_ERR_SSL_INTERNAL_ERROR; + } + seed = session_hash; MBEDTLS_SSL_DEBUG_BUF(3, "session hash for extended master secret", session_hash, seed_len); From ed70149de35ebc9f21bb9b4080830f37fe868882 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 1 Jun 2026 08:03:58 +0100 Subject: [PATCH 12/35] Add further documentation to tls_abort_transcript_context Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.function | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 8a99e93940..c377bcaace 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -61,6 +61,9 @@ static int failing_ticket_write_unset_lifetime( defined(MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP) && \ defined(PSA_WANT_ALG_SHA_256) typedef struct { + /* Context for tls_abort_transcript(). The debug callback watches for + * trigger in the SSL debug trace, then aborts this connection's transcript + * hash operation exactly once so the test can check error propagation. */ mbedtls_ssl_context *ssl; const char *trigger; int triggered; From e9779ccaa32f5e13713ba01adb05e2d1c811a6ce Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 1 Jun 2026 08:12:23 +0100 Subject: [PATCH 13/35] Add unsupported trigger check Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.function | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index c377bcaace..416af2141e 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -88,9 +88,6 @@ static void tls_abort_transcript(void *ctx, int level, if (abort_ctx->ssl->handshake == NULL) { return; } - if (abort_ctx->trigger == NULL) { - return; - } if (strstr(str, abort_ctx->trigger) == NULL) { return; } @@ -4432,6 +4429,7 @@ void tls_transcript_error_propagation(int endpoint, server_options.server_max_version = tls_version; abort_ctx.trigger = trigger; + TEST_ASSERT(abort_ctx.trigger != NULL); if (endpoint == MBEDTLS_SSL_IS_CLIENT) { client_options.cli_log_obj = &abort_ctx; From 1e098f3ae9a67122f728a845d1408057646c693c Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 1 Jun 2026 08:26:50 +0100 Subject: [PATCH 14/35] Add client tests for RMS computation error Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.data | 8 +++++++ tests/suites/test_suite_ssl.function | 32 ++++++++++++++++++++-------- 2 files changed, 31 insertions(+), 9 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index c93ff542e9..3dba0df18b 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3382,10 +3382,18 @@ TLS 1.3 server propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_CRYPT tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS +TLS 1.3 client propagates RMS computation error +depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:"<= write finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_CLIENT_FINISHED + TLS 1.2 server propagates EMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY +TLS 1.2 client propagates EMS computation error +depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY + TLS 1.3 read early data, early data accepted tls13_read_early_data:TEST_EARLY_DATA_ACCEPTED diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 416af2141e..fbbce164a2 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4446,22 +4446,36 @@ void tls_transcript_error_propagation(int endpoint, TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, &server_options), 0); + /* Keep enough socket capacity for setup traffic so the final step below + * exercises the target state instead of only flushing previous messages. */ TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), - &(server_ep.socket), 1024), 0); + &(server_ep.socket), 4096), 0); - abort_ctx.ssl = &server_ep.ssl; + if (endpoint == MBEDTLS_SSL_IS_CLIENT) { + /* Moving the client to its target state drives the server as needed. + * Moving the server afterwards can advance the client past that state. */ + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + &(client_ep.ssl), &(server_ep.ssl), + client_state), 0); - TEST_EQUAL(mbedtls_test_move_handshake_to_state( - &(server_ep.ssl), &(client_ep.ssl), - server_state), 0); + abort_ctx.ssl = &client_ep.ssl; + } else { + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + server_state), 0); - TEST_EQUAL(mbedtls_test_move_handshake_to_state( - &(client_ep.ssl), &(server_ep.ssl), - client_state), 0); + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + &(client_ep.ssl), &(server_ep.ssl), + client_state), 0); + abort_ctx.ssl = &server_ep.ssl; + } + TEST_EQUAL(mbedtls_ssl_flush_output(abort_ctx.ssl), 0); + TEST_EQUAL(abort_ctx.ssl->state, + endpoint == MBEDTLS_SSL_IS_CLIENT ? client_state : server_state); TEST_EQUAL(abort_ctx.triggered, 0); - ret = mbedtls_ssl_handshake_step(&(server_ep.ssl)); + ret = mbedtls_ssl_handshake_step(abort_ctx.ssl); TEST_ASSERT(abort_ctx.triggered); TEST_ASSERT(ret != 0); From f6aeb4c8e40bd3d86da9363213d64e367b2017ad Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 1 Jun 2026 09:03:29 +0100 Subject: [PATCH 15/35] Add additional fix for return with error Signed-off-by: Ben Taylor --- library/ssl_tls13_client.c | 1 + 1 file changed, 1 insertion(+) diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index 96d4d08ee0..ecdf507eab 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -2804,6 +2804,7 @@ static int ssl_tls13_parse_new_session_ticket_exts(mbedtls_ssl_context *ssl, MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_parse_new_session_ticket_early_data_ext", ret); + return ret; } break; #endif /* MBEDTLS_SSL_EARLY_DATA */ From 48593c23a03a08a3dba4b42d3585e6b2c631caf8 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 1 Jun 2026 09:19:29 +0100 Subject: [PATCH 16/35] Add fix for missing return from ssl_write_ecjpake_kkpp_ext Signed-off-by: Ben Taylor --- library/ssl_tls12_server.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 328e25aafc..5333d18c58 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -1746,7 +1746,7 @@ static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl, MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) -static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl, +static int ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl, unsigned char *buf, size_t *olen) { @@ -1760,14 +1760,14 @@ static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl, /* Skip costly computation if not needed */ if (ssl->handshake->ciphersuite_info->key_exchange != MBEDTLS_KEY_EXCHANGE_ECJPAKE) { - return; + return 0; } MBEDTLS_SSL_DEBUG_MSG(3, ("server hello, ecjpake kkpp extension")); if (end - p < 4) { MBEDTLS_SSL_DEBUG_MSG(1, ("buffer too small")); - return; + return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; } MBEDTLS_PUT_UINT16_BE(MBEDTLS_TLS_EXT_ECJPAKE_KKPP, p, 0); @@ -1780,13 +1780,14 @@ static void ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl, psa_destroy_key(ssl->handshake->psa_pake_password); psa_pake_abort(&ssl->handshake->psa_pake_ctx); MBEDTLS_SSL_DEBUG_RET(1, "psa_pake_output", ret); - return; + return ret; } MBEDTLS_PUT_UINT16_BE(kkpp_len, p, 0); p += 2; *olen = kkpp_len + 4; + return 0; } #endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ @@ -2169,7 +2170,10 @@ static int ssl_write_server_hello(mbedtls_ssl_context *ssl) #endif #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) - ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen); + if ((ret = ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen)) != 0) { + MBEDTLS_SSL_DEBUG_RET(1, "ssl_write_ecjpake_kkpp_ext", ret); + return ret; + } ext_len += olen; #endif From 1c68ca14fb3da7a70ff953bfbef13670344f4a3c Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 1 Jun 2026 14:48:09 +0100 Subject: [PATCH 17/35] Fix code style issues Signed-off-by: Ben Taylor --- library/ssl_tls12_server.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 5333d18c58..7ff2833121 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -1747,8 +1747,8 @@ static void ssl_write_supported_point_formats_ext(mbedtls_ssl_context *ssl, #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) static int ssl_write_ecjpake_kkpp_ext(mbedtls_ssl_context *ssl, - unsigned char *buf, - size_t *olen) + unsigned char *buf, + size_t *olen) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; unsigned char *p = buf; From 795eb3ee95da7d201cc194b34418f60cd58ae83a Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 4 Jun 2026 10:29:43 +0100 Subject: [PATCH 18/35] Add Reported by to ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index 4b5db144c3..75d6969501 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -10,3 +10,4 @@ Security could allow a server to issue resumption tickets derived from an invalid resumption secret, weakening authentication of future resumptions made with those tickets. + * Reported by jjfz123 / https://github.com/jjfz123 / https://www.linkedin.com/in/jjfdzcastro1/ From f487bd2e07db7292778dda24865ff071301fbf06 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 4 Jun 2026 10:32:03 +0100 Subject: [PATCH 19/35] Tidy up ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index 75d6969501..6d20d958b2 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -4,10 +4,10 @@ Security handshake to fail. This could allow a handshake to continue with a master secret that was not correctly bound to the handshake transcript, undermining the security guarantees of the extended master secret - extension. + extension. Reported by jjfz123 / https://github.com/jjfz123 / + https://www.linkedin.com/in/jjfdzcastro1/ * Fix a bug where TLS 1.3 servers could ignore errors when computing the resumption master secret instead of causing the handshake to fail. This could allow a server to issue resumption tickets derived from an invalid resumption secret, weakening authentication of future resumptions made with those tickets. - * Reported by jjfz123 / https://github.com/jjfz123 / https://www.linkedin.com/in/jjfdzcastro1/ From f63a0058d314e8793c4d88927071b4dc17ecfd35 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 4 Jun 2026 10:33:07 +0100 Subject: [PATCH 20/35] Remove check for NULL pointer Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.function | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index fbbce164a2..d0a7f25980 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4429,7 +4429,6 @@ void tls_transcript_error_propagation(int endpoint, server_options.server_max_version = tls_version; abort_ctx.trigger = trigger; - TEST_ASSERT(abort_ctx.trigger != NULL); if (endpoint == MBEDTLS_SSL_IS_CLIENT) { client_options.cli_log_obj = &abort_ctx; From d32397563e69cd3fbfb18608d62cc7a179aa15de Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 4 Jun 2026 12:12:00 +0100 Subject: [PATCH 21/35] Fix reporters in ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index 6d20d958b2..c8b6aa696c 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -4,10 +4,10 @@ Security handshake to fail. This could allow a handshake to continue with a master secret that was not correctly bound to the handshake transcript, undermining the security guarantees of the extended master secret - extension. Reported by jjfz123 / https://github.com/jjfz123 / - https://www.linkedin.com/in/jjfdzcastro1/ + extension. Report by Mathew Gretton-Dann * Fix a bug where TLS 1.3 servers could ignore errors when computing the resumption master secret instead of causing the handshake to fail. This could allow a server to issue resumption tickets derived from an invalid resumption secret, weakening authentication of future resumptions made - with those tickets. + with those tickets. Reported by jjfz123 / https://github.com/jjfz123 / + https://www.linkedin.com/in/jjfdzcastro1/ From 835226c59aa974452f55bebdb8555fd0f6e3aeca Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 5 Jun 2026 07:54:38 +0100 Subject: [PATCH 22/35] Update ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index c8b6aa696c..e21c52cfde 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -4,10 +4,9 @@ Security handshake to fail. This could allow a handshake to continue with a master secret that was not correctly bound to the handshake transcript, undermining the security guarantees of the extended master secret - extension. Report by Mathew Gretton-Dann + extension. Report by Mathew Gretton-Dann. * Fix a bug where TLS 1.3 servers could ignore errors when computing the resumption master secret instead of causing the handshake to fail. This could allow a server to issue resumption tickets derived from an invalid resumption secret, weakening authentication of future resumptions made - with those tickets. Reported by jjfz123 / https://github.com/jjfz123 / - https://www.linkedin.com/in/jjfdzcastro1/ + with those tickets. Reported by jjfz123. From 629df9f5fbd0bd1edc562f9309d1e252a96c59d6 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 5 Jun 2026 08:33:11 +0100 Subject: [PATCH 23/35] Improve testing Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.data | 22 ++-- tests/suites/test_suite_ssl.function | 150 +++++++++++++-------------- 2 files changed, 86 insertions(+), 86 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 3dba0df18b..24e9ae9033 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3378,21 +3378,21 @@ elliptic_curve_get_properties TLS 1.3 resume session with ticket tls13_resume_session_with_ticket -TLS 1.3 server propagates RMS computation error +TLS 1.3 server propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_CRYPT tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS - -TLS 1.3 client propagates RMS computation error + +TLS 1.3 client propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_CRYPT -tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:"<= write finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_CLIENT_FINISHED - -TLS 1.2 server propagates EMS computation error -depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:"<= write finished message":MBEDTLS_SSL_CLIENT_FINISHED:-1 + +TLS 1.2 server propagates EMS computation error +depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY - -TLS 1.2 client propagates EMS computation error -depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED -tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY + +TLS 1.2 client propagates EMS computation error +depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CERTIFICATE_VERIFY:-1 TLS 1.3 read early data, early data accepted tls13_read_early_data:TEST_EARLY_DATA_ACCEPTED diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index d0a7f25980..09b8ac8230 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4406,85 +4406,85 @@ exit: /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_TLS_C:MBEDTLS_DEBUG_C:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:PSA_WANT_ALG_SHA_256 */ -void tls_transcript_error_propagation(int endpoint, - int tls_version, - const char *trigger, - int server_state, - int client_state) -{ - int ret = -1; - mbedtls_test_ssl_endpoint client_ep, server_ep; - mbedtls_test_handshake_test_options client_options; - mbedtls_test_init_handshake_options(&client_options); - mbedtls_test_handshake_test_options server_options; - mbedtls_test_init_handshake_options(&server_options); - tls_abort_transcript_context abort_ctx; - memset(&abort_ctx, 0, sizeof(abort_ctx)); - - PSA_INIT(); - - client_options.client_min_version = tls_version; - client_options.client_max_version = tls_version; - server_options.server_min_version = tls_version; - server_options.server_max_version = tls_version; - - abort_ctx.trigger = trigger; - - if (endpoint == MBEDTLS_SSL_IS_CLIENT) { - client_options.cli_log_obj = &abort_ctx; - client_options.cli_log_fun = tls_abort_transcript; - } else { - server_options.srv_log_obj = &abort_ctx; - server_options.srv_log_fun = tls_abort_transcript; - } - - mbedtls_debug_set_threshold(4); - +void tls_transcript_error_propagation(int endpoint, + int tls_version, + const char *trigger, + int target_state, + int peer_target_state) +{ + int ret = -1; + mbedtls_test_ssl_endpoint client_ep, server_ep; + mbedtls_test_handshake_test_options client_options; + mbedtls_test_init_handshake_options(&client_options); + mbedtls_test_handshake_test_options server_options; + mbedtls_test_init_handshake_options(&server_options); + tls_abort_transcript_context abort_ctx; + memset(&abort_ctx, 0, sizeof(abort_ctx)); + mbedtls_ssl_context *peer_ssl_context = NULL; + + PSA_INIT(); + + client_options.client_min_version = tls_version; + client_options.client_max_version = tls_version; + server_options.server_min_version = tls_version; + server_options.server_max_version = tls_version; + + abort_ctx.trigger = trigger; + TEST_ASSERT(abort_ctx.trigger != NULL); + + if (endpoint == MBEDTLS_SSL_IS_CLIENT) { + client_options.cli_log_obj = &abort_ctx; + client_options.cli_log_fun = tls_abort_transcript; + abort_ctx.ssl = &client_ep.ssl; + peer_ssl_context = &server_ep.ssl; + } else { + server_options.srv_log_obj = &abort_ctx; + server_options.srv_log_fun = tls_abort_transcript; + abort_ctx.ssl = &server_ep.ssl; + peer_ssl_context = &client_ep.ssl; + } + + mbedtls_debug_set_threshold(4); + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, - &client_options), 0); + &client_options), 0); TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, &server_options), 0); - - /* Keep enough socket capacity for setup traffic so the final step below + + /* Keep enough socket capacity for setup traffic so the final step below * exercises the target state instead of only flushing previous messages. */ - TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), - &(server_ep.socket), 4096), 0); - - if (endpoint == MBEDTLS_SSL_IS_CLIENT) { - /* Moving the client to its target state drives the server as needed. - * Moving the server afterwards can advance the client past that state. */ - TEST_EQUAL(mbedtls_test_move_handshake_to_state( - &(client_ep.ssl), &(server_ep.ssl), - client_state), 0); - - abort_ctx.ssl = &client_ep.ssl; - } else { - TEST_EQUAL(mbedtls_test_move_handshake_to_state( - &(server_ep.ssl), &(client_ep.ssl), - server_state), 0); - - TEST_EQUAL(mbedtls_test_move_handshake_to_state( - &(client_ep.ssl), &(server_ep.ssl), - client_state), 0); - abort_ctx.ssl = &server_ep.ssl; - } - - TEST_EQUAL(mbedtls_ssl_flush_output(abort_ctx.ssl), 0); - TEST_EQUAL(abort_ctx.ssl->state, - endpoint == MBEDTLS_SSL_IS_CLIENT ? client_state : server_state); - TEST_EQUAL(abort_ctx.triggered, 0); - - ret = mbedtls_ssl_handshake_step(abort_ctx.ssl); - TEST_ASSERT(abort_ctx.triggered); - TEST_ASSERT(ret != 0); - -exit: - mbedtls_test_ssl_endpoint_free(&client_ep); - mbedtls_test_ssl_endpoint_free(&server_ep); - mbedtls_test_free_handshake_options(&client_options); - mbedtls_test_free_handshake_options(&server_options); - mbedtls_debug_set_threshold(0); - PSA_DONE(); + TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 4096), 0); + + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + abort_ctx.ssl, peer_ssl_context, + target_state), 0); + /* + * Advance the peer further through the handshake so that it emits the + * messages needed by the endpoint under test to proceed through its next + * step. + */ + if (peer_target_state != -1) { + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + peer_ssl_context, abort_ctx.ssl, + peer_target_state), 0); + } + + TEST_EQUAL(mbedtls_ssl_flush_output(abort_ctx.ssl), 0); + TEST_EQUAL(abort_ctx.ssl->state, target_state); + TEST_EQUAL(abort_ctx.triggered, 0); + + ret = mbedtls_ssl_handshake_step(abort_ctx.ssl); + TEST_ASSERT(abort_ctx.triggered); + TEST_ASSERT(ret != 0); + +exit: + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_free_handshake_options(&client_options); + mbedtls_test_free_handshake_options(&server_options); + mbedtls_debug_set_threshold(0); + PSA_DONE(); } /* END_CASE */ From 2e95cb7baacb047351ae0460bf1e6912dc0ded73 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 5 Jun 2026 08:39:39 +0100 Subject: [PATCH 24/35] Update error handling of return from ssl_write_ecjpake_kkpp_ext Signed-off-by: Ben Taylor --- library/ssl_tls12_server.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 7ff2833121..03ef8fd5f9 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -2170,11 +2170,11 @@ static int ssl_write_server_hello(mbedtls_ssl_context *ssl) #endif #if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) - if ((ret = ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen)) != 0) { + ret = ssl_write_ecjpake_kkpp_ext(ssl, p + 2 + ext_len, &olen); + if (ret != 0) { MBEDTLS_SSL_DEBUG_RET(1, "ssl_write_ecjpake_kkpp_ext", ret); return ret; } - ext_len += olen; #endif #if defined(MBEDTLS_SSL_ALPN) From 86b94d411cb74d5a364d5d0b76f9f2f10c5ef977 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 5 Jun 2026 08:42:19 +0100 Subject: [PATCH 25/35] Improve ChangeLog Signed-off-by: Ben Taylor --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index e21c52cfde..3a18c76df9 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -5,8 +5,12 @@ Security secret that was not correctly bound to the handshake transcript, undermining the security guarantees of the extended master secret extension. Report by Mathew Gretton-Dann. - * Fix a bug where TLS 1.3 servers could ignore errors when computing the - resumption master secret instead of causing the handshake to fail. This - could allow a server to issue resumption tickets derived from an invalid - resumption secret, weakening authentication of future resumptions made - with those tickets. Reported by jjfz123. + * Fix a TLS 1.3 server-side error-handling bug affecting session ticket + generation. Under rare conditions, such as memory allocation failures + while computing the resumption master secret, the server could issue + invalid session tickets instead of failing the handshake. Clients + presented with such tickets would fail session resumption and fall back to + a full handshake. In deployments relying on session resumption, repeated + occurrences could increase the frequency of full handshakes and amplify + resource consumption during periods of resource exhaustion or other + transient failures. Reported by jjfz123. From 14b2bdc8cebb51b81d50082d8c54ec23cdeff36a Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Fri, 5 Jun 2026 09:21:09 +0100 Subject: [PATCH 26/35] fix code style Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.function | 150 +++++++++++++-------------- 1 file changed, 75 insertions(+), 75 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 09b8ac8230..40041210ed 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4406,85 +4406,85 @@ exit: /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_TLS_C:MBEDTLS_DEBUG_C:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:PSA_WANT_ALG_SHA_256 */ -void tls_transcript_error_propagation(int endpoint, - int tls_version, - const char *trigger, - int target_state, - int peer_target_state) -{ - int ret = -1; - mbedtls_test_ssl_endpoint client_ep, server_ep; - mbedtls_test_handshake_test_options client_options; - mbedtls_test_init_handshake_options(&client_options); - mbedtls_test_handshake_test_options server_options; - mbedtls_test_init_handshake_options(&server_options); - tls_abort_transcript_context abort_ctx; - memset(&abort_ctx, 0, sizeof(abort_ctx)); - mbedtls_ssl_context *peer_ssl_context = NULL; - - PSA_INIT(); - - client_options.client_min_version = tls_version; - client_options.client_max_version = tls_version; - server_options.server_min_version = tls_version; - server_options.server_max_version = tls_version; - - abort_ctx.trigger = trigger; - TEST_ASSERT(abort_ctx.trigger != NULL); - - if (endpoint == MBEDTLS_SSL_IS_CLIENT) { - client_options.cli_log_obj = &abort_ctx; - client_options.cli_log_fun = tls_abort_transcript; - abort_ctx.ssl = &client_ep.ssl; - peer_ssl_context = &server_ep.ssl; - } else { - server_options.srv_log_obj = &abort_ctx; - server_options.srv_log_fun = tls_abort_transcript; - abort_ctx.ssl = &server_ep.ssl; - peer_ssl_context = &client_ep.ssl; - } - - mbedtls_debug_set_threshold(4); - +void tls_transcript_error_propagation(int endpoint, + int tls_version, + const char *trigger, + int target_state, + int peer_target_state) +{ + int ret = -1; + mbedtls_test_ssl_endpoint client_ep, server_ep; + mbedtls_test_handshake_test_options client_options; + mbedtls_test_init_handshake_options(&client_options); + mbedtls_test_handshake_test_options server_options; + mbedtls_test_init_handshake_options(&server_options); + tls_abort_transcript_context abort_ctx; + memset(&abort_ctx, 0, sizeof(abort_ctx)); + mbedtls_ssl_context *peer_ssl_context = NULL; + + PSA_INIT(); + + client_options.client_min_version = tls_version; + client_options.client_max_version = tls_version; + server_options.server_min_version = tls_version; + server_options.server_max_version = tls_version; + + abort_ctx.trigger = trigger; + TEST_ASSERT(abort_ctx.trigger != NULL); + + if (endpoint == MBEDTLS_SSL_IS_CLIENT) { + client_options.cli_log_obj = &abort_ctx; + client_options.cli_log_fun = tls_abort_transcript; + abort_ctx.ssl = &client_ep.ssl; + peer_ssl_context = &server_ep.ssl; + } else { + server_options.srv_log_obj = &abort_ctx; + server_options.srv_log_fun = tls_abort_transcript; + abort_ctx.ssl = &server_ep.ssl; + peer_ssl_context = &client_ep.ssl; + } + + mbedtls_debug_set_threshold(4); + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, - &client_options), 0); + &client_options), 0); TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, &server_options), 0); - - /* Keep enough socket capacity for setup traffic so the final step below + + /* Keep enough socket capacity for setup traffic so the final step below * exercises the target state instead of only flushing previous messages. */ - TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), - &(server_ep.socket), 4096), 0); - - TEST_EQUAL(mbedtls_test_move_handshake_to_state( - abort_ctx.ssl, peer_ssl_context, - target_state), 0); - /* - * Advance the peer further through the handshake so that it emits the - * messages needed by the endpoint under test to proceed through its next - * step. - */ - if (peer_target_state != -1) { - TEST_EQUAL(mbedtls_test_move_handshake_to_state( - peer_ssl_context, abort_ctx.ssl, - peer_target_state), 0); - } - - TEST_EQUAL(mbedtls_ssl_flush_output(abort_ctx.ssl), 0); - TEST_EQUAL(abort_ctx.ssl->state, target_state); - TEST_EQUAL(abort_ctx.triggered, 0); - - ret = mbedtls_ssl_handshake_step(abort_ctx.ssl); - TEST_ASSERT(abort_ctx.triggered); - TEST_ASSERT(ret != 0); - -exit: - mbedtls_test_ssl_endpoint_free(&client_ep); - mbedtls_test_ssl_endpoint_free(&server_ep); - mbedtls_test_free_handshake_options(&client_options); - mbedtls_test_free_handshake_options(&server_options); - mbedtls_debug_set_threshold(0); - PSA_DONE(); + TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 4096), 0); + + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + abort_ctx.ssl, peer_ssl_context, + target_state), 0); + /* + * Advance the peer further through the handshake so that it emits the + * messages needed by the endpoint under test to proceed through its next + * step. + */ + if (peer_target_state != -1) { + TEST_EQUAL(mbedtls_test_move_handshake_to_state( + peer_ssl_context, abort_ctx.ssl, + peer_target_state), 0); + } + + TEST_EQUAL(mbedtls_ssl_flush_output(abort_ctx.ssl), 0); + TEST_EQUAL(abort_ctx.ssl->state, target_state); + TEST_EQUAL(abort_ctx.triggered, 0); + + ret = mbedtls_ssl_handshake_step(abort_ctx.ssl); + TEST_ASSERT(abort_ctx.triggered); + TEST_ASSERT(ret != 0); + +exit: + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_free_handshake_options(&client_options); + mbedtls_test_free_handshake_options(&server_options); + mbedtls_debug_set_threshold(0); + PSA_DONE(); } /* END_CASE */ From fc2f108dfbfb3240d7ae5380f968e774ca3a369d Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 8 Jun 2026 13:26:35 +0100 Subject: [PATCH 27/35] Update dependencies for skipped test Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.data | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 24e9ae9033..f5fc712b3f 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3379,11 +3379,11 @@ TLS 1.3 resume session with ticket tls13_resume_session_with_ticket TLS 1.3 server propagates RMS computation error -depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_SIGN tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS TLS 1.3 client propagates RMS computation error -depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_SIGN tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:"<= write finished message":MBEDTLS_SSL_CLIENT_FINISHED:-1 TLS 1.2 server propagates EMS computation error From 75bdaa35c39d2700795dc30808ee766ca518baae Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Mon, 8 Jun 2026 13:28:07 +0100 Subject: [PATCH 28/35] Update ChangeLog to add CVE Co-authored-by: Gilles Peskine Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index 3a18c76df9..ef092386a9 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -4,7 +4,7 @@ Security handshake to fail. This could allow a handshake to continue with a master secret that was not correctly bound to the handshake transcript, undermining the security guarantees of the extended master secret - extension. Report by Mathew Gretton-Dann. + extension. Report by Mathew Gretton-Dann. CVE-2026-50581 * Fix a TLS 1.3 server-side error-handling bug affecting session ticket generation. Under rare conditions, such as memory allocation failures while computing the resumption master secret, the server could issue From fa003af2049463b6214b68cc61955010ece8fefa Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Mon, 8 Jun 2026 13:28:42 +0100 Subject: [PATCH 29/35] Update ChangeLog with CVE number Co-authored-by: Ronald Cron Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- ChangeLog.d/1583-1584-ssl-transcript-errors.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt index ef092386a9..f259bd711e 100644 --- a/ChangeLog.d/1583-1584-ssl-transcript-errors.txt +++ b/ChangeLog.d/1583-1584-ssl-transcript-errors.txt @@ -14,3 +14,4 @@ Security occurrences could increase the frequency of full handshakes and amplify resource consumption during periods of resource exhaustion or other transient failures. Reported by jjfz123. + CVE-2026-50640 From dc555d19eca0e3b4e7fc2b9c21a67a577f481572 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Mon, 8 Jun 2026 14:19:23 +0100 Subject: [PATCH 30/35] remove trailing whitespace Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.data | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index f5fc712b3f..1bdfa68def 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3378,20 +3378,20 @@ elliptic_curve_get_properties TLS 1.3 resume session with ticket tls13_resume_session_with_ticket -TLS 1.3 server propagates RMS computation error +TLS 1.3 server propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_SIGN tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS - -TLS 1.3 client propagates RMS computation error + +TLS 1.3 client propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_SIGN tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:"<= write finished message":MBEDTLS_SSL_CLIENT_FINISHED:-1 - -TLS 1.2 server propagates EMS computation error -depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + +TLS 1.2 server propagates EMS computation error +depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY - -TLS 1.2 client propagates EMS computation error -depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED + +TLS 1.2 client propagates EMS computation error +depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CERTIFICATE_VERIFY:-1 TLS 1.3 read early data, early data accepted From 0bf015a43b42acf777a43cf7520215174cded2b7 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Wed, 10 Jun 2026 08:11:37 +0100 Subject: [PATCH 31/35] restore missing ext_len set Signed-off-by: Ben Taylor --- library/ssl_tls12_server.c | 1 + 1 file changed, 1 insertion(+) diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 03ef8fd5f9..2a825e07b1 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -2175,6 +2175,7 @@ static int ssl_write_server_hello(mbedtls_ssl_context *ssl) MBEDTLS_SSL_DEBUG_RET(1, "ssl_write_ecjpake_kkpp_ext", ret); return ret; } + ext_len += olen; #endif #if defined(MBEDTLS_SSL_ALPN) From 414d284f4afba19d38aa4655f6307b4f6fae1265 Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Thu, 11 Jun 2026 09:43:59 +0100 Subject: [PATCH 32/35] Update regression test Co-authored-by: Ronald Cron Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- tests/suites/test_suite_ssl.function | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 40041210ed..3d9dc85aed 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4468,6 +4468,7 @@ void tls_transcript_error_propagation(int endpoint, TEST_EQUAL(mbedtls_test_move_handshake_to_state( peer_ssl_context, abort_ctx.ssl, peer_target_state), 0); + TEST_EQUAL(mbedtls_ssl_flush_output(peer_ssl_context), 0); } TEST_EQUAL(mbedtls_ssl_flush_output(abort_ctx.ssl), 0); From e98a0a84c3aad666a7e268d539d8247154a4d8f1 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 11 Jun 2026 10:30:44 +0100 Subject: [PATCH 33/35] Improve tls_transcript_error_propagation testing to check for error codes Signed-off-by: Ben Taylor --- tests/suites/test_suite_ssl.data | 8 ++++---- tests/suites/test_suite_ssl.function | 4 +++- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 1bdfa68def..79206899f2 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3380,19 +3380,19 @@ tls13_resume_session_with_ticket TLS 1.3 server propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_SIGN -tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS +tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS:MBEDTLS_ERR_SSL_WANT_READ TLS 1.3 client propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_SIGN -tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:"<= write finished message":MBEDTLS_SSL_CLIENT_FINISHED:-1 +tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_3:"<= write finished message":MBEDTLS_SSL_CLIENT_FINISHED:-1:MBEDTLS_ERR_SSL_INTERNAL_ERROR TLS 1.2 server propagates EMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED -tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY +tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY:PSA_ERROR_GENERIC_ERROR TLS 1.2 client propagates EMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED -tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CERTIFICATE_VERIFY:-1 +tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CERTIFICATE_VERIFY:-1:PSA_ERROR_GENERIC_ERROR TLS 1.3 read early data, early data accepted tls13_read_early_data:TEST_EARLY_DATA_ACCEPTED diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 3d9dc85aed..aba395a8ce 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4410,7 +4410,8 @@ void tls_transcript_error_propagation(int endpoint, int tls_version, const char *trigger, int target_state, - int peer_target_state) + int peer_target_state, + int expected_ret) { int ret = -1; mbedtls_test_ssl_endpoint client_ep, server_ep; @@ -4478,6 +4479,7 @@ void tls_transcript_error_propagation(int endpoint, ret = mbedtls_ssl_handshake_step(abort_ctx.ssl); TEST_ASSERT(abort_ctx.triggered); TEST_ASSERT(ret != 0); + TEST_EQUAL(ret, expected_ret); exit: mbedtls_test_ssl_endpoint_free(&client_ep); From 82bba7ef612bae6a0babcb252bba11c66c72f9b2 Mon Sep 17 00:00:00 2001 From: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> Date: Thu, 11 Jun 2026 10:37:00 +0100 Subject: [PATCH 34/35] Fix error codes for tls_transcript_error_propagation Co-authored-by: Ronald Cron Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com> --- tests/suites/test_suite_ssl.data | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 79206899f2..fe279334a0 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3380,7 +3380,7 @@ tls13_resume_session_with_ticket TLS 1.3 server propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_SIGN -tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS:MBEDTLS_ERR_SSL_WANT_READ +tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_3:"<= parse finished message":MBEDTLS_SSL_CLIENT_FINISHED:MBEDTLS_SSL_FLUSH_BUFFERS:MBEDTLS_ERR_SSL_INTERNAL_ERROR TLS 1.3 client propagates RMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_X509_RSASSA_PSS_SUPPORT:PSA_WANT_ALG_RSA_PKCS1V15_SIGN From c438b0b9a92d81fd7ec8aa9148d0272299815155 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 11 Jun 2026 11:12:10 +0100 Subject: [PATCH 35/35] Correct error handling in mbedtls_ssl_reset_checksum Signed-off-by: Ben Taylor --- library/ssl_tls.c | 25 ++++++++++++------------- tests/suites/test_suite_ssl.data | 4 ++-- 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 86bed60fd8..a1117ed123 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -29,7 +29,6 @@ #include #include "mbedtls/psa_util.h" -#include "md_psa.h" // for mbedtls_md_error_from_psa() #include "psa/crypto.h" #if defined(MBEDTLS_X509_CRT_PARSE_C) @@ -846,21 +845,21 @@ int mbedtls_ssl_reset_checksum(mbedtls_ssl_context *ssl) #if defined(PSA_WANT_ALG_SHA_256) status = psa_hash_abort(&ssl->handshake->fin_sha256_psa); if (status != PSA_SUCCESS) { - return mbedtls_md_error_from_psa(status); + return PSA_TO_MBEDTLS_ERR(status); } status = psa_hash_setup(&ssl->handshake->fin_sha256_psa, PSA_ALG_SHA_256); if (status != PSA_SUCCESS) { - return mbedtls_md_error_from_psa(status); + return PSA_TO_MBEDTLS_ERR(status); } #endif #if defined(PSA_WANT_ALG_SHA_384) status = psa_hash_abort(&ssl->handshake->fin_sha384_psa); if (status != PSA_SUCCESS) { - return mbedtls_md_error_from_psa(status); + return PSA_TO_MBEDTLS_ERR(status); } status = psa_hash_setup(&ssl->handshake->fin_sha384_psa, PSA_ALG_SHA_384); if (status != PSA_SUCCESS) { - return mbedtls_md_error_from_psa(status); + return PSA_TO_MBEDTLS_ERR(status); } #endif return 0; @@ -880,13 +879,13 @@ static int ssl_update_checksum_start(mbedtls_ssl_context *ssl, #if defined(PSA_WANT_ALG_SHA_256) status = psa_hash_update(&ssl->handshake->fin_sha256_psa, buf, len); if (status != PSA_SUCCESS) { - return mbedtls_md_error_from_psa(status); + return PSA_TO_MBEDTLS_ERR(status); } #endif #if defined(PSA_WANT_ALG_SHA_384) status = psa_hash_update(&ssl->handshake->fin_sha384_psa, buf, len); if (status != PSA_SUCCESS) { - return mbedtls_md_error_from_psa(status); + return PSA_TO_MBEDTLS_ERR(status); } #endif return 0; @@ -896,8 +895,8 @@ static int ssl_update_checksum_start(mbedtls_ssl_context *ssl, static int ssl_update_checksum_sha256(mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len) { - return mbedtls_md_error_from_psa(psa_hash_update( - &ssl->handshake->fin_sha256_psa, buf, len)); + return PSA_TO_MBEDTLS_ERR(psa_hash_update( + &ssl->handshake->fin_sha256_psa, buf, len)); } #endif @@ -905,8 +904,8 @@ static int ssl_update_checksum_sha256(mbedtls_ssl_context *ssl, static int ssl_update_checksum_sha384(mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len) { - return mbedtls_md_error_from_psa(psa_hash_update( - &ssl->handshake->fin_sha384_psa, buf, len)); + return PSA_TO_MBEDTLS_ERR(psa_hash_update( + &ssl->handshake->fin_sha384_psa, buf, len)); } #endif @@ -6569,7 +6568,7 @@ static int ssl_calc_verify_tls_psa(const mbedtls_ssl_context *ssl, exit: psa_hash_abort(&cloned_op); - return mbedtls_md_error_from_psa(status); + return PSA_TO_MBEDTLS_ERR(status); } #if defined(PSA_WANT_ALG_SHA_256) @@ -7262,7 +7261,7 @@ static int ssl_calc_finished_tls_generic(mbedtls_ssl_context *ssl, void *ctx, exit: psa_hash_abort(&cloned_op); - return mbedtls_md_error_from_psa(status); + return PSA_TO_MBEDTLS_ERR(status); } #if defined(PSA_WANT_ALG_SHA_256) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index fe279334a0..dbe0dfe44c 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3388,11 +3388,11 @@ tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_ TLS 1.2 server propagates EMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED -tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY:PSA_ERROR_GENERIC_ERROR +tls_transcript_error_propagation:MBEDTLS_SSL_IS_SERVER:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CLIENT_KEY_EXCHANGE:MBEDTLS_SSL_CERTIFICATE_VERIFY:MBEDTLS_ERR_SSL_INTERNAL_ERROR TLS 1.2 client propagates EMS computation error depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED -tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CERTIFICATE_VERIFY:-1:PSA_ERROR_GENERIC_ERROR +tls_transcript_error_propagation:MBEDTLS_SSL_IS_CLIENT:MBEDTLS_SSL_VERSION_TLS1_2:"=> derive keys":MBEDTLS_SSL_CERTIFICATE_VERIFY:-1:MBEDTLS_ERR_SSL_INTERNAL_ERROR TLS 1.3 read early data, early data accepted tls13_read_early_data:TEST_EARLY_DATA_ACCEPTED