ClientHello: narrow the session-id check to the session id itself, check
the cookie length byte before reading it, and let the ciphersuite-list
length check cover both transports.
CertificateRequest: make the signature-algorithms check also reserve the
two certificate-authorities length bytes instead of adding a separate
check, use the available < needed pattern throughout, and reject an
odd-length signature-algorithms list.
Add injected truncated-ClientHello test cases (TLS 1.2-only builds).
Signed-off-by: Naveed <naveed@bugqore.com>
Change the documentation of mbedtls_sha3_finish() and mbedtls_sha3()
to state that olen must be at least the digest size (28, 32, 48, or 64
for SHA3-224/256/384/512) rather than must equal it.
The implementation accepts olen larger than the digest size — it
silently writes the digest and ignores the excess. The previous docs
incorrectly suggested that olen larger than the digest size would be
an error.
Fixes#10844
Signed-off-by: AaryanCdry <AaryanCdry@users.noreply.github.com>
Make SSL test helper code potentially available to sample programs. This is
notably useful for `ssl_client2` and `ssl_server2`, which may reasonably use
some test helper code even in the default configuration.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
In terms of CMake, we want it to be part of the mbedtls_test_helpers
object collection, which as the name does not suggest, is actually for
SSL, and not part of mbedtls_test which is generic.
The easiest way to achieve that is to move the source file to
test_helpers which again as the name does not reflect is for SSL.
Then we just need ssl_server2 and ssl_client2 to link to
mbedtls_test_helpers.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
Call mbedtls_test_ssl_check_context_after_session_reset both in programs
(ssl_client2 and ssl_server2) and tests to ensure that the SSL context
has been properly handled when mbedtls_ssl_session_reset was called.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Ideally the implementation shouldn't be checked in git, but for the time
being there is no support in building source code for tests from the
binary folder, so it's accepted as a temporary solution.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Togethere with the framework counterpart ('ssl_session_reset_check.py')
this script is used to automatically generate the function
'mbedtls_test_ssl_check_context_after_session_reset()'.
The goal of this function is to verify that 'mbedtls_ssl_session_reset()'
properly handled (reset or keep) all the fields of the
'mbedtls_ssl_context' structure.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Move functions in "ssl_helpers.h" that depend on internal headers to
"ssl_helpers_internal.h". This allows to include "ssl_helpers.h" also
in programs (which do not have access to internal headers).
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
This is a manual backport, not a direct cherry-pick, because the 3.6 PAKE macros retain a direct PSA_ALG_JPAKE comparison where the source branch adjusted a PSA_ALG_IS_JPAKE call.
(cherry picked from commit 733ed07f29144ee9b99165e36eaf9b9b69317834)
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
This is a manual backport, not a direct cherry-pick, because the 3.6 branch uses different file paths and keeps a direct PSA_ALG_JPAKE comparison in the PAKE size macros.
(cherry picked from commit ebda5da117af7e57bad47bc3337e364365a8f357)
