coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity
33,052 Commits 183 Branches 286 Tags 220 MiB
Commit Graph

33052 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ronald Cron
3f55bb6998 test_suite_ssl: Test ClientHello on record boundary check 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
27c489be62 tls13: Add record boundary checks 
RFC 8446 (TLS 1.3 specification), Section 5.1, states:

Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
    ...
    -Handshake messages MUST NOT span key changes. Implementations
    MUST verify that all messages immediately preceding a key change
    align with a record boundary; if not, then they MUST terminate the
    connection with an "unexpected_message" alert. Because the
    ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
    messages can immediately precede a key change, implementations
    MUST send these messages in alignment with a record boundary.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:07 +02:00
Ronald Cron
399a28c76a test_suite_ssl: Add early data drop tests 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:16:06 +02:00
Ronald Cron
46069c6127
Merge pull request #1658 from bjwtaylor/ssl-ignores-failure-restricted-3.6 
Backport 3.6: Fix issues in ssl where it ignores the failure return
 2026-06-24 15:03:43 +02:00
Ben Taylor
27065ceb64 Fix code style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
8e756e3ee3 remove md_psa.h 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
ea00a9ee70 replace mbedtls_md_error_from_psa with PSA_TO_MBEDTLS_ERR 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
7c007f49f7 Correct error handling in mbedtls_ssl_reset_checksum 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Backport note: adapted from upstream commit 35da56b4c749cb066bddfd328731fb1c493228dc; not a direct cherry-pick.
 2026-06-24 10:48:59 +01:00
Ben Taylor
6cb957324e Fix error codes for tls_transcript_error_propagation 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 10:48:59 +01:00
Ben Taylor
e100cbcc2d Improve tls_transcript_error_propagation testing to check for error codes 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
34338f9aa9 Update regression test 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 10:48:59 +01:00
Ben Taylor
e4e52d233e restore missing ext_len set 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
76c60fe603 remove trailing whitespace 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
9b1549a0cb Update ChangeLog with CVE number 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 10:48:59 +01:00
Ben Taylor
a893b52bad Update ChangeLog to add CVE 
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 10:48:59 +01:00
Ben Taylor
814732a600 Update dependencies for skipped test 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
54d7ac4d3a fix code style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
17160e402e Improve ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
491243442a Update error handling of return from ssl_write_ecjpake_kkpp_ext 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
d550895075 Improve testing 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
f1bac693c6 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
b8ed7d81c7 Fix reporters in ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
7d0e7f889e Remove check for NULL pointer 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
84e9ec5339 Tidy up ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
eb01ebddab Add Reported by to ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
b4981f3e9c Fix code style issues 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
61087eb79d Add fix for missing return from ssl_write_ecjpake_kkpp_ext 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Backport note: adapted from upstream commit dc45235ca3faa5b1fe1df2b8967b019ccef2839d; not a direct cherry-pick.
 2026-06-24 10:48:59 +01:00
Ben Taylor
0ef63355f1 Add additional fix for return with error 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
2c4d8ad682 Add client tests for RMS computation error 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
355eae4d9c Add unsupported trigger check 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
1aeb46adb9 Add further documentation to tls_abort_transcript_context 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
bc250f0bba Fix issues with hanging seed length 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
3d6379aa61 Fixed code style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
f0f708eade refactor initialisation in tls_transcript_error_propagation, so that the variables are initialised straight after they are declared 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
9c3cd1a5d4 Add additional guard for sha256 in tests 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
167a754c0d Improve layout of the code for debugging with breakpoints 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
8d083042a4 Add security impact 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
ca8eab3d69 Update ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ben Taylor
84de9770cf Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:48:59 +01:00
Ronald Cron
d0e7136ec3 Improve dependencies and error handling 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Backport note: adapted from upstream commit 24e67fd9039dcd57d65d1c043baa80697ce05fe8; not a direct cherry-pick.
 2026-06-24 10:48:58 +01:00
Ben Taylor
710d5efac9 tests: ssl: add regression tests for EMS/RMS error propagation 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Backport note: adapted from upstream commit e1241ef8bb5890dd47753f888cf6b3d18c9df8c4; not a direct cherry-pick.
 2026-06-24 10:48:02 +01:00
Ben Taylor
f595df4569 ssl: propagate transcript-hash computation failures 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 10:46:57 +01:00
Gilles Peskine
338572c1d8
Merge pull request #1659 from bjwtaylor/info-leak-in-ssl_write_new_session_ticket-3.6 
3.6 backport for Info leak in ssl write new session ticket
 2026-06-24 09:42:19 +02:00
Gilles Peskine
d558c59371
Merge pull request #1636 from mpg/restricted-rsa-padding-3.6 
[3.6] Fix side-channel in PSA_ALG_RSA_PKCS1V15_CRYPT
 2026-06-24 09:34:57 +02:00
Gilles Peskine
13020769a4
Merge pull request #1675 from valeriosetti/issue1598-backport3.6 
[3.6] PKCS7 accepts weak hashes
 2026-06-23 16:40:40 +02:00
Ben Taylor
6bf3204e64 Migrate patched symbols to 3.6 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:47 +01:00
Ben Taylor
2c550a2958 Correct syntax of MBEDTLS_GET_UINT32_BE in write_new_session_ticket_mem 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ben Taylor
caf5b9484e Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ben Taylor
aa290176fd Improve test of non-initilisation of lifetime 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00
Ben Taylor
548ed19f70 Improve robustness of tlen and lifetime variables 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-23 13:38:46 +01:00