coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,694 Commits 183 Branches 286 Tags Multiple Licenses 215 MiB
Commit Graph

34694 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
David Horstmann
aff0185563
Merge pull request #10822 from minosgalanakis/tools/fix-auto-generated-files-4.1 
[4.1 backport]Fix generate_errors.pl
 2026-07-20 09:57:25 +00:00
Minos Galanakis
b736ab022d Fix generate_errors.pl 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-09 15:59:21 +01:00
Ronald Cron
8828120c8a
Merge pull request #10816 from Mbed-TLS/mbedtls-4.1.1_mergeback 
Mbedtls 4.1.1 mergeback
 2026-07-08 13:16:11 +00:00
Minos Galanakis
c8ab24b67c Updated framework 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-08 10:47:30 +01:00
Minos Galanakis
cf644361ff Updated tf-psa-crypto submodule 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-08 10:47:30 +01:00
Minos Galanakis
a0bbf7649f Merge tag 'mbedtls-4.1.1' into mbedtls-4.1.1_mergeback 
Mbed TLS 4.1.1

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-07 16:55:23 +01:00
Minos Galanakis
0a8fda272a ChangeLog: Removed CVE-ID 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
mbedtls-4.1.1 v4.1.1 		2026-07-01 12:02:14 +01:00
Valerio Setti
7357e4df87
Merge pull request #10770 from bjwtaylor/unused-variable-ret-4.1 
Backport 4.1: Fix variable set but not used warning
 2026-07-01 08:35:49 +00:00
Minos Galanakis
5b6dd79f67 Update BRANCHES.md 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:32:24 +01:00
Minos Galanakis
d1f3eee6b5 ChangeLog: Removed todo placeholder for CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:32:24 +01:00
Minos Galanakis
0f9f57a047 Changelog: Added reference to tf-psa-crypto update 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:32:24 +01:00
Minos Galanakis
5089e9f623 Assemble Changelog 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:28:30 +01:00
Minos Galanakis
0c5fe5c677 Bump version --version 4.1.1 
./scripts/bump_version.sh --version 4.1.1

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:28:30 +01:00
Minos Galanakis
2bab33486e Updated tf-psa-crypto submodule 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:28:30 +01:00
Minos Galanakis
b05e6e0e0a Merge remote-tracking branch 'mbedtls-4.1-restricted' into mbedtls-4.1.1.rc 2026-06-26 22:05:03 +01:00
Ronald Cron
c0dbff0cf8
Merge pull request #1683 from valeriosetti/issue1585-backport4.1 
[4.1] Stale DTLS- SRTP negotiation state after session_reset() (ARM-RZ7EMQAA)
 2026-06-26 12:17:19 +02:00
Ronald Cron
316296466b
Merge pull request #1686 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass_changelog_4.1 
Add Attribution CVE mbedtls:mbedtls4.1-restricted
 2026-06-25 15:57:24 +02:00
Ronald Cron
cc5f7bc061
Merge pull request #10785 from minosgalanakis/mbedtls-4.1-release-sync 
Mbedtls 4.1.1 release sync
 2026-06-25 12:09:50 +00:00
Minos Galanakis
caad5d95e5 Updated tf-psa-crypto pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:53:15 +01:00
Minos Galanakis
f43bdae2d2 Updated framework pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:52:36 +01:00
Gilles Peskine
fe4733b1de
Merge pull request #10790 from bensze01/readthedocs-4.1 
[Backport 4.1] Upgrade readthedocs builder to Ubuntu 26.04
 2026-06-24 18:48:16 +00:00
Gilles Peskine
f885248356
Merge pull request #1681 from ronald-cron-arm/hsm-do-not-span-key-change-4.1 
4.1: Hsm do not span key change
 2026-06-24 19:22:12 +02:00
Bence Szépkúti
a493f22738 Upgrade readthedocs builder to Ubuntu 26.04 
The 20.04 runner is no longer supported.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2026-06-24 17:02:37 +02:00
Ronald Cron
45d892ea3d Check ServerHello record boundary alignment only in TLS 1.3 case 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
0fe502312d tls13_fetch_handshake_msg(): Remove require_record_boundary parameter 
Deduce it from the handshake message type

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
1208d1cc25 tls13_record_boundary_alignement: Append empty hs msg 
Append an empty handshake message to expand
the record instead of just a zero byte.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
4165fe1dc2 Various improvements of tls13_(drop_early_data|record_boundary_alignment)() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
1235722aa1 tls13: Rework mbedtls_ssl_tls13_fetch_handshake_msg() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
7dc69f331f tls13: Improve argument name 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
d13352bc40 test_suite_ssl: Add initialization to all zeroes of test endpoint structs 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
62a9fa9f48 Fix typos 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
c4db00209a Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
0501eeb804 test_suite_ssl: Test EndOfEarlyData on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
996adce4b6 test_suite_ssl: Test client Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
d00518a2ec test_suite_ssl: Test server Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
b9793ca124 test_suite_ssl: Test ServerHello on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:24 +02:00
Ronald Cron
dd97c26e9a test_suite_ssl: Test ClientHello on record boundary check 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:24 +02:00
Ronald Cron
f17c5ff90d tls13: Add record boundary checks 
RFC 8446 (TLS 1.3 specification), Section 5.1, states:

Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
    ...
    -Handshake messages MUST NOT span key changes. Implementations
    MUST verify that all messages immediately preceding a key change
    align with a record boundary; if not, then they MUST terminate the
    connection with an "unexpected_message" alert. Because the
    ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
    messages can immediately precede a key change, implementations
    MUST send these messages in alignment with a record boundary.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:24 +02:00
Ronald Cron
2aaedab1eb test_suite_ssl: Add early data drop tests 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:23 +02:00
Minos Galanakis
1d3ac2843c Changelog. Added attribution/CVE for 1569 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 14:40:53 +01:00
Valerio Setti
3b84f44c7f tests: ssl_helpers: run ssl_context reset check only when the SSL context is setup 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 15:38:32 +02:00
Ronald Cron
5aac408d2a
Merge pull request #1657 from bjwtaylor/ssl-ignores-failure-restricted-4.1 
Backport 4.1: Fix issues in ssl where it ignores the failure return
 2026-06-24 15:03:12 +02:00
Valerio Setti
8ef4559dfa framework: update reference 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
de1f7218d5 tests: generate_ssl_session_reset_check: remove trailing whitespace 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
7a2a3179e2 tests: generate_ssl_session_reset_check: pacify pylint 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
fd072d7103 tests: generate_ssl_session_reset_check: order rules as fields in the struct 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
57b2f5d4aa tests: ssl_helpers: fix documentation of mbedtls_test_ssl_check_context_after_session_reset 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
b291d59927 tests: ssl_context_reset_verifier: add missing semicolon in generated file 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
673568a6a1 tests: generate_ssl_session_reset_check: add missing semicolon in generated file 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
f4dcb5c692 changelog: add note for documentation fix for mbedtls_ssl_set_cid 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00