coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity
33,025 Commits 183 Branches 286 Tags 220 MiB
Commit Graph

33025 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ben Taylor
0ef63355f1 Add additional fix for return with error 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
2c4d8ad682 Add client tests for RMS computation error 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
355eae4d9c Add unsupported trigger check 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
1aeb46adb9 Add further documentation to tls_abort_transcript_context 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
bc250f0bba Fix issues with hanging seed length 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
3d6379aa61 Fixed code style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
f0f708eade refactor initialisation in tls_transcript_error_propagation, so that the variables are initialised straight after they are declared 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
9c3cd1a5d4 Add additional guard for sha256 in tests 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
167a754c0d Improve layout of the code for debugging with breakpoints 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
8d083042a4 Add security impact 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
ca8eab3d69 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
84de9770cf Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ronald Cron
d0e7136ec3 Improve dependencies and error handling 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Backport note: adapted from upstream commit 24e67fd9039dcd57d65d1c043baa80697ce05fe8; not a direct cherry-pick.
 2026-06-24 10:48:58 +01:00
Ben Taylor
710d5efac9 tests: ssl: add regression tests for EMS/RMS error propagation 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Backport note: adapted from upstream commit e1241ef8bb5890dd47753f888cf6b3d18c9df8c4; not a direct cherry-pick.
 2026-06-24 10:48:02 +01:00
Ben Taylor
f595df4569 ssl: propagate transcript-hash computation failures 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:46:57 +01:00
Gilles Peskine
338572c1d8
Merge pull request #1659 from bjwtaylor/info-leak-in-ssl_write_new_session_ticket-3.6 
3.6 backport for Info leak in ssl write new session ticket
 2026-06-24 09:42:19 +02:00
Gilles Peskine
d558c59371
Merge pull request #1636 from mpg/restricted-rsa-padding-3.6 
[3.6] Fix side-channel in PSA_ALG_RSA_PKCS1V15_CRYPT
 2026-06-24 09:34:57 +02:00
Gilles Peskine
13020769a4
Merge pull request #1675 from valeriosetti/issue1598-backport3.6 
[3.6] PKCS7 accepts weak hashes
 2026-06-23 16:40:40 +02:00
Ben Taylor
6bf3204e64 Migrate patched symbols to 3.6 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:47 +01:00
Ben Taylor
2c550a2958 Correct syntax of MBEDTLS_GET_UINT32_BE in write_new_session_ticket_mem 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ben Taylor
caf5b9484e Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ben Taylor
aa290176fd Improve test of non-initilisation of lifetime 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ben Taylor
548ed19f70 Improve robustness of tlen and lifetime variables 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ben Taylor
99ccd257e2 Add fix for leak 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ben Taylor
02451dcc65 Add test for leak 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ronald Cron
6c8f300620
Merge pull request #1674 from bjwtaylor/pkcs-free-stale-pointers-3.6 
Pkcs free stale pointers 3.6
 2026-06-22 17:56:23 +02:00
Gilles Peskine
a2ede7033f
Merge pull request #1637 from bjwtaylor/chacha20-counter-overflow-restricted-3.6 
Chacha20 counter overflow restricted 3.6
 2026-06-22 12:49:53 +02:00
Valerio Setti
16415a66b4 pkcs7: do not mention PK algorithms in the documentation 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:55:14 +02:00
Valerio Setti
f3a69ab32a pkcs7: improve documentation and changelog for MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:55:14 +02:00
Valerio Setti
745fe11c86 pkcs7: mention MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES in pkcs7.h documentation 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:55:14 +02:00
Valerio Setti
544721407e pkcs7: add MBEDTLS_PKCS7_ALLOW_WEAK_SIGNATURES build symbol 
It allows weak hash algorithms to be used in PKCS7. It's only added in the
LTS branch for backward compatibility, but it's disabled by default because
that's the safest choice.

This commit also updates test data in order to test the new build symbol.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:55:14 +02:00
Valerio Setti
ba1c4a5ae0 framework: update reference 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:55:13 +02:00
Valerio Setti
04aacf1fa5 tests: pkcs7: adjust test dependencies 
Newly added tests for RIPEMD160 and MD5 still require SHA-256 for the
certificate being used. SHA-1 is instead useless in this case.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
fecdad9b0c pkcs7: update documentation adding a note about rejecting weak hash algs 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
c8390f51ad changelog: update documentation for PKCS7 changes 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
3d44f0fcc0 test_suite_pkcs7: adjust numbering of tests 
Some newly added tests had duplicate numbers with what was already there.
This commit fixes the duplication problem.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
dee86762dd pkcs7: replace MBEDTLS_ERR_PKCS7_VERIFY_FAIL with MBEDTLS_ERR_PKCS7_VERIFY_FAIL 
This also updates test data.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
b1e22ce9d5 pkcs7: split MD/PK check in mbedtls_pkcs7_data_or_hash_verify 
Follow the default Mbed TLS coding style and ease debugging (i.e. placing
of breakpoints).

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
48c0911bc8 tests: pkcs7: add negative tests using MD5 and RIPEMD160 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
c6f5f2547d changelog: add note for PKCS7 rejecting weak hash algorithms 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
42471969d1 tests: pkcs7: adjust return code in SHA-1 based PKCS7 test 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
a38ea44d97 pkcs7: fail verification if MD alg or sig_alg are not secure 
Add a check on mbedtls_pkcs7_data_or_hash_verify() so that the verification
fails if the MD alg specified in PKCS7 structure or the signature
algorithm specified in the X.509 certificate are not in the list of
secure algorithms (i.e. mbedtls_x509_crt_profile_default).

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
3215f53789 x509: make profile checking functions internally available 
Following functions

- x509_profile_check_md_alg
- x509_profile_check_pk_alg

are made non-static and moved to x509_internal.h so that other library
files can used them.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
9da2709411 x509_crt: add SHA3 algs to mbedtls_x509_crt_profile_default 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Valerio Setti
cfd6fb4a58 x509_crt: remove old invalid comment 
ssl_preset_default_hashes was removed in
f0cda410a4bca0f45f66bdbf0714cd0eb2ea4718 but the comment in 'x509_crt.c'
wasn't updated.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:49:45 +02:00
Ronald Cron
f6f6492228
Merge pull request #1641 from gilles-peskine-arm/badmac_seen_or_in_hsfraglen-fix 
3.6 only: Fix and test badmac_seen_or_in_hsfraglen confusion
 2026-06-22 10:30:00 +02:00
Gilles Peskine
d3b43bcbc1
Merge pull request #1596 from gilles-peskine-arm/basic-constaints-sequence-check-3.6 
Backport 3.6: Fix CA bit forgery through invalid basicConstraints
 2026-06-18 15:36:50 +02:00
Ben Taylor
12717ec8f4 Add in the two additional checks that were dropped. 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
(cherry picked from commit 377aa4eff16cd0aa5e7440a41de59847e3a789a0)
 2026-06-18 13:15:58 +01:00
Ben Taylor
7457580790 Remove pkcs7_parse_free_resets_context as it duplicates pkcs7_parse_reuse 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit 10afc1ed5c8e9c47caf1ad8ee6241fd99e43f945)

Backport note: resolved the redundant-test removal conflict by deleting the temporary reset test while keeping the 3.6 pkcs7_verify dependency expression.
 2026-06-18 13:15:58 +01:00
Ben Taylor
2ce44c5b1d Add CVE ID to ChangeLog 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
(cherry picked from commit a798b5804ef8571bcfd6609019758014325162c4)
 2026-06-18 13:13:59 +01:00