coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
33,099 Commits 183 Branches 286 Tags Multiple Licenses 215 MiB
Commit Graph

33099 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Minos Galanakis
451c1b12a2 Updated framework pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-08 10:48:23 +01:00
Minos Galanakis
d5b20d4a1e Revert "Added generated files" 
This reverts commit 3b42ba863ee7cd0bcd14bb57156af0961f8febd9.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-07 17:26:50 +01:00
Minos Galanakis
ab18cc38f1 Merge tag 'mbedtls-3.6.7' into mbedtls-3.6.7_mergeback-2 
Mbed TLS mbedtls-3.6.7

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-07 17:25:52 +01:00
Minos Galanakis
068ff080b3 ChangeLog: Removed CVE-ID 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
v3.6.7 mbedtls-3.6.7 		2026-07-01 12:03:41 +01:00
Valerio Setti
52beeef988
Merge pull request #10657 from bjwtaylor/unused-variable-ret-3.6 
Backport 3.6: Fix variable set but not used warning
 2026-07-01 08:26:39 +00:00
David Horstmann
a065f0b0db
Merge pull request #10731 from AmyChan-Intel/mbedtls-3.6 
library/alignment.h: Fix 'MBEDTLS_GCC_VERSION' is not defined error
 2026-06-30 09:34:49 +00:00
Minos Galanakis
fb50b4cd1b ChangeLog: Removed todo placeholder for CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:35:23 +01:00
Minos Galanakis
3b42ba863e Added generated files 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-26 21:18:01 +01:00
Minos Galanakis
2901266764 Update BRANCHES.md 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-26 21:18:01 +01:00
Minos Galanakis
71c6e06676 Assemble ChangeLog 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-26 21:18:01 +01:00
Minos Galanakis
b767964cef Bump version --version 3.6.7 
./scripts/bump_version.sh --version 3.6.7

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-26 15:32:38 +01:00
Minos Galanakis
ea1cb6d14f Updated framework submodule 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-26 15:21:14 +01:00
Minos Galanakis
4476f02593 Merge remote-tracking branch 'restricted/mbedtls-3.6-restricted' into mbedtls-3.6.7.rc 2026-06-26 15:19:55 +01:00
Ronald Cron
4259a7aa63
Merge pull request #1699 from valeriosetti/issue1585-backport3.6-only-fix 
[3.6] [minimal] Stale DTLS- SRTP negotiation state after session_reset() (ARM-RZ7EMQAA)
 2026-06-26 12:17:27 +02:00
Ronald Cron
9020195c1e
Merge pull request #1687 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass_changelog_3.6 
Add Attribution CVE mbedtls:mbedtls-3.6-restricted
 2026-06-25 15:58:22 +02:00
Ronald Cron
823f79b88d
Merge pull request #10784 from minosgalanakis/mbedtls-3.6-release-sync 
MbedTLS 3.6.7 release sync
 2026-06-25 12:07:06 +00:00
Valerio Setti
e093798e77 changelog: add note for documentation fix for mbedtls_ssl_set_cid 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-25 14:01:15 +02:00
Valerio Setti
a60a318f63 include: ssl: fix documentation of mbedtls_ssl_set_cid 
Specify that the configured CID will apply to all subsequent handshakes
not just to the next one.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-25 14:01:15 +02:00
Valerio Setti
890c8a1d69 changelog: add reset for some fields of the SSL context structure 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-25 14:01:15 +02:00
Valerio Setti
2c33afacd5 library: ssl: reset some SSL context's fields in mbedtls_ssl_session_reset 
Following fields were not properly reset when mbedtls_ssl_session_reset
was called:

- badmac_seen
- dtls_srtp_info
- alert_reason
- alert_type

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-25 14:01:15 +02:00
Minos Galanakis
677ed44d5e Added attribution to chacha20-counter-overflow.txt 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 10:16:13 +01:00
Minos Galanakis
70c55db4cc Updated framework pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:54:31 +01:00
Gilles Peskine
8cef139002
Merge pull request #10789 from bensze01/readthedocs-3.6 
[Backport 3.6] Upgrade readthedocs builder to Ubuntu 26.04
 2026-06-24 18:23:01 +00:00
Gilles Peskine
0f5bad281e
Merge pull request #1666 from ronald-cron-arm/hsm-do-not-span-key-change-3.6 
3.6: Hsm do not span key change
 2026-06-24 19:22:21 +02:00
Bence Szépkúti
895a4aaa61 Upgrade readthedocs builder to Ubuntu 26.04 
The 20.04 runner is no longer supported.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2026-06-24 16:51:12 +02:00
Minos Galanakis
dccf53b9a5 Changelog: Added cve/attrib issue 67 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 15:29:13 +01:00
Minos Galanakis
2018448bfe Changelog: Added cve/attrib issue 1506 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 15:28:12 +01:00
Ronald Cron
26eb6a36cf Check ServerHello record boundary alignment only in TLS 1.3 case 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:08 +02:00
Ronald Cron
b71ec46f4f tls13_fetch_handshake_msg(): Remove require_record_boundary parameter 
Deduce it from the handshake message type

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:08 +02:00
Ronald Cron
4303dc6136 tls13_record_boundary_alignement: Append empty hs msg 
Append an empty handshake message to expand
the record instead of just a zero byte.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:08 +02:00
Ronald Cron
13ab16f1ef Various improvements of tls13_(drop_early_data|record_boundary_alignment)() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:08 +02:00
Ronald Cron
8f1e330f20 tls13: Rework mbedtls_ssl_tls13_fetch_handshake_msg() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
835ffb3a7c tls13: Improve argument name 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
1d0ff13c89 test_suite_ssl: Add initialization to all zeroes of test endpoint structs 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
c277ffddc9 Fix typos 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
9d6da5abcd Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
70918ab425 test_suite_ssl: Test EndOfEarlyData on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
a441e4666b test_suite_ssl: Test client Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
d157fa7ae2 test_suite_ssl: Test server Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
ee2cb8abce test_suite_ssl: Test ServerHello on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
3f55bb6998 test_suite_ssl: Test ClientHello on record boundary check 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
27c489be62 tls13: Add record boundary checks 
RFC 8446 (TLS 1.3 specification), Section 5.1, states:

Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
    ...
    -Handshake messages MUST NOT span key changes. Implementations
    MUST verify that all messages immediately preceding a key change
    align with a record boundary; if not, then they MUST terminate the
    connection with an "unexpected_message" alert. Because the
    ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
    messages can immediately precede a key change, implementations
    MUST send these messages in alignment with a record boundary.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
399a28c76a test_suite_ssl: Add early data drop tests 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:06 +02:00
Minos Galanakis
5d39fcb958 Changelog. Added attribution/CVE for 1569 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 14:40:44 +01:00
Ronald Cron
46069c6127
Merge pull request #1658 from bjwtaylor/ssl-ignores-failure-restricted-3.6 
Backport 3.6: Fix issues in ssl where it ignores the failure return
 2026-06-24 15:03:43 +02:00
Ben Taylor
27065ceb64 Fix code style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
8e756e3ee3 remove md_psa.h 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
ea00a9ee70 replace mbedtls_md_error_from_psa with PSA_TO_MBEDTLS_ERR 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
7c007f49f7 Correct error handling in mbedtls_ssl_reset_checksum 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Backport note: adapted from upstream commit 35da56b4c749cb066bddfd328731fb1c493228dc; not a direct cherry-pick.
 2026-06-24 10:48:59 +01:00
Ben Taylor
6cb957324e Fix error codes for tls_transcript_error_propagation 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 10:48:59 +01:00