This is a manual backport, not a direct cherry-pick, because 3.6 can build TLS without PSA-backed transforms. Gate the regression on MBEDTLS_USE_PSA_CRYPTO.
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit 95e95268a4c26608612f34f2bb76ff1dfa9ded0a)
Backport the ssl_context_load_rejects_oob_length test function from
development in its final form, with cases for the serialized in_cid,
out_cid and ALPN lengths.
mbedtls_test_ssl_dtls_join_endpoints() and
mbedtls_test_ssl_perform_connection() do not exist on this branch, so
set up the DTLS endpoints and run the handshake with the helpers that
do: mbedtls_test_ssl_endpoint_init() with message queues,
mbedtls_test_mock_socket_connect() and
mbedtls_test_move_handshake_to_state(). Exchange application data
explicitly before saving the context, as
mbedtls_test_ssl_perform_connection() does on development: the server
keeps its handshake structure until then, and
mbedtls_ssl_context_save() refuses to run while it exists.
Signed-off-by: Naveed <naveed@bugqore.com>
The serialized ALPN length was passed to memcmp() against each configured protocol without checking it against the remaining serialized data, so a malformed context could read past the end of the buffer. Bound it before the comparison, like the adjacent CID fields.
Signed-off-by: Naveed <naveed@bugqore.com>
Backport the final approved implementation from Mbed-TLS/TF-PSA-Crypto#843
to mbedtls-3.6.
Enable the existing Linux getrandom syscall path when sys/syscall.h
is available and defines SYS_getrandom. Preserve the existing
glibc/Midipix detection and runtime ENOSYS fallback.
Apply the platform change to library/entropy_poll.c in this branch.
Signed-off-by: Ning Xia <hi@nosec.me>
Change the documentation of mbedtls_sha3_finish() and mbedtls_sha3()
to state that olen must be at least the digest size (28, 32, 48, or 64
for SHA3-224/256/384/512) rather than must equal it.
The implementation accepts olen larger than the digest size — it
silently writes the digest and ignores the excess. The previous docs
incorrectly suggested that olen larger than the digest size would be
an error.
Fixes#10844
Signed-off-by: AaryanCdry <AaryanCdry@users.noreply.github.com>
Make SSL test helper code potentially available to sample programs. This is
notably useful for `ssl_client2` and `ssl_server2`, which may reasonably use
some test helper code even in the default configuration.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
In terms of CMake, we want it to be part of the mbedtls_test_helpers
object collection, which as the name does not suggest, is actually for
SSL, and not part of mbedtls_test which is generic.
The easiest way to achieve that is to move the source file to
test_helpers which again as the name does not reflect is for SSL.
Then we just need ssl_server2 and ssl_client2 to link to
mbedtls_test_helpers.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
Call mbedtls_test_ssl_check_context_after_session_reset both in programs
(ssl_client2 and ssl_server2) and tests to ensure that the SSL context
has been properly handled when mbedtls_ssl_session_reset was called.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Ideally the implementation shouldn't be checked in git, but for the time
being there is no support in building source code for tests from the
binary folder, so it's accepted as a temporary solution.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
