coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-13 14:22:19 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,736 Commits 183 Branches 286 Tags Multiple Licenses 259 MiB
Commit Graph

34736 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ben Taylor
0501e447cc Correct style of ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
c567299ee6 Add in tests for ECDHE-PSK integer overflow 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
c058818451 Improve ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
e71e49e634 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Ben Taylor
baf449db7e Added fix for Integer overflow using a large ECDHE Identity 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-04 14:22:38 +01:00
Manuel Pégourié-Gonnard
af15f6e244 Update broken link 
I believe the existing link was to the TF wiki which has been retired
for some time now.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-06-03 10:33:29 +02:00
Ronald Cron
5ca2218a28
Merge pull request #1589 from gilles-peskine-arm/ssl_tls13_prepare_new_session_ticket-psa_get_random-4.1 
Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure
 2026-05-29 16:20:27 +02:00
Ronald Cron
05bd7f6429
Merge pull request #1612 from valeriosetti/issue1569 
[development] TLS 1.3 certificate chain signature algorithm policy gap
 2026-05-29 13:35:32 +02:00
Gilles Peskine
b05434c1b1 Improve changelog wording 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-28 16:32:35 +02:00
Gilles Peskine
6c8ae1ea48 Fix lax basicConstraints parsing 
When parsing the basicConstraints extension, reject junk after the SEQUENCE
inside the extension (which is probably benign), and reject a SEQUENCE that
extends beyond the extension (could be very dangerous).

Add a non-regression test where a certificate that is technically malformed,
but accepted as a leaf certificate by OpenSSL and other X.509
implementations, to be accepted as a CA certificate by Mbed TLS.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 21:07:09 +02:00
Gilles Peskine
22dccc1d83 Update framework with test certificate with basicConstraints overflow 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 21:07:09 +02:00
Janos Follath
545d1b77a2
Merge pull request #10741 from valeriosetti/fix-mbedtls_config 
mbedtls_config.c missing mbedtls_platform_requirements.h
 2026-05-26 09:24:54 +00:00
Minos Galanakis
e2a6f05640 ssl_write_supported_groups_ext: Updated documentation 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-26 10:17:11 +01:00
Nadav0077
fc34e72fc2
Address review: symbolic mutation constants and CID bounds-check test 
Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>
 2026-05-21 13:58:17 +03:00
Minos Galanakis
84667a048f test_suite_ssl: Added MBEDTLS_DEBUG_C guards to logs 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 12:25:42 +01:00
Minos Galanakis
95ad8b45ed test_suite_ssl: Restructured reject_hrr_selecting_unoffered_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-19 22:28:56 +01:00
Minos Galanakis
3d3de630db test_suite_ssl: Renamed hrr_reject_selecting_unoffered_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-19 17:36:12 +01:00
Minos Galanakis
7a232d0822 sll_client: align TLS 1.3 supported_groups filtering with PSA curve support 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-19 17:31:47 +01:00
Nadav0077
72f767da31
Address review comments on serialized data hardening 
Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>
 2026-05-19 14:15:02 +03:00
Nadav0077
fea00c3e51
Reject out-of-bounds DTLS CID length in ssl_context_load 
Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>
 2026-05-19 14:15:01 +03:00
Valerio Setti
147ad72669 changelog: fix typos 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-19 12:37:30 +02:00
Valerio Setti
c53e78796a changelog: add note about issue 1569 resolution 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-18 11:08:23 +02:00
Valerio Setti
a3ae8be611 ssl: improve documentation of mbedtls_ssl_conf_sig_algs() 
Clarify that the 'sig_algs' set through this function are only enforced
during the key exchange and that 'mbedtls_ssl_conf_cert_profile()' should
instead be used to enforce the same algorithms when verifying certificates.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-18 11:04:59 +02:00
minosgalanakis
701132e5b3
Merge pull request #10663 from yiwu0b11/remove_unused_ffdh_code 
Remove FFDH-specific code from compat.sh
 2026-05-13 16:49:20 +00:00
Minos Galanakis
848ddaaedb test_suite_ssl: doc fixes 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-13 11:33:40 +01:00
Ben Taylor
ea9dc9c396 Add ChangeLog 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-13 11:16:49 +01:00
Nadav0077
3f972d014d
Use block-local ret to avoid unused-variable in restricted configs 
Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>
 2026-05-12 19:32:50 +03:00
Minos Galanakis
5936ba523d Added ChangeLog 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 14:59:18 +01:00
Ronald Cron
00be9c9b67
Merge pull request #10700 from gilles-peskine-arm/python-project-knowledge-directory-mbedtls-dev 
Create Python project knowledge directory
 2026-05-12 13:38:23 +00:00
Manuel Pégourié-Gonnard
4a1d150cdf
Merge pull request #1600 from mpg/development-restricted 
Merge public development into -restricted
 2026-05-12 08:59:49 +02:00
Ben Taylor
08e3e3f81e Add fix for OOB key exchange error 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-11 15:22:09 +01:00
Manuel Pégourié-Gonnard
00dfa64627 Merge branch 'development' into development-restricted 
* development: (46 commits)
  Update tf-psa-crypto pointer to bring in fix for python imports
  Update framework pointer to bring in fix for python imports
  check_config: fix error message for missing TLS 1.2 key exchanges
  check_config: add check for TLS 1.3 key exchanges
  update ChangeLog
  Pacify uncrustify
  ChangeLog: Fixed a reference to TF-PSA-Crypto
  ssl: add TLS 1.2 RSA-PSS debug trace
  add ChangeLog
  Fix build warning/error using llvm-mingw
  ssl: narrow TLS 1.2 RSA-PSS handling and add interop coverage
  test: improve symlink checks
  test: versioned symlink order fix
  test: reorder if-else structure
  test: add debug output and fix for win config
  ChangeLog fix
  Unify TF-PSA-Crypto and mbedtls templates
  tests: fix DESTDIR install checks and add macOS compatibility
  ChangeLog fixes
  Update crypto submodule with analyze_outcomes.py
  ...
 2026-05-11 12:04:15 +02:00
Manuel Pégourié-Gonnard
902b012537
Merge pull request #10749 from bjwtaylor/broken-build 
Update framework pointer to bring in fix for python imports
 2026-05-07 19:13:19 +00:00
Ben Taylor
954e236500 Update tf-psa-crypto pointer to bring in fix for python imports 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-07 14:17:54 +01:00
Ben Taylor
02fb4c75cb Update framework pointer to bring in fix for python imports 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-07 08:14:43 +01:00
Minos Galanakis
89a0606118 Adjusted dependecies for hrr_reject_unadvertised_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-06 11:19:39 +01:00
Yi Wu
75aa62742c test: dependency macros order fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-05-05 15:11:44 +01:00
Yi Wu
00eb64a9d3 tests: allow RSA helper dependency macros 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-05-05 11:05:46 +01:00
Gilles Peskine
465d6e9669 Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-04 18:44:05 +02:00
Yi Wu
ee36ad9f39 test: remove obsolete macro checks 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-30 09:12:27 +01:00
Manuel Pégourié-Gonnard
e0086863ed Add test for dependencies on crypto-internal macros 
Previously this was tested indirectly by comparing driver vs reference
components in analyze-outcomes.py, but now that the number of exceptions
is low, it's much more efficient to test this directly.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-04-30 02:05:48 +01:00
Manuel Pégourié-Gonnard
bfeea315b7 tests: avoid useless use of low-level crypto deps 
Take our low-level error for test from our own side of the split.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-04-30 02:05:48 +01:00
Manuel Pégourié-Gonnard
ba6533c87a ssl-opt: rm references to !MBEDTLS_USE_PSA_CRYPTO 
Also remove the "no USE_PSA" tests: they are not executed, and are not
useful for the future - when we add support for restartable ECDH in TLS,
we can just use the existing tests and update the assertions, which
we'll have to do anyway (the tests being removed were asserting about
a legacy crypto function that no longer exists).

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-04-30 02:05:18 +01:00
Valerio Setti
cd8b3878c5 changelog: add note about fix of issue 10740 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-29 17:05:51 +02:00
Valerio Setti
b155a58ab5 include mbedtls_platform_requirements.h in mbedtls_config.c 
This is required because if the user defined configuration file (not the
default one provided by mbedtls) includes files from the standard
C library then __STDC_WANT_LIB_EXT1__ won't be defined there which
cause weird build failures.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-29 16:57:55 +02:00
minosgalanakis
d12fbb991c
Merge pull request #10695 from valord577/patch-1 
Fix build warning/error using llvm-mingw
 2026-04-29 14:52:00 +00:00
Gilles Peskine
a314ada082
Merge pull request #10631 from yiwu0b11/destdir_install_env_support 
Support DESTDIR for install and add build-system test
 2026-04-29 14:37:29 +00:00
Nadav0077
3ab4fce1a0
Harden TLS 1.3 serialized session loading 
Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>
 2026-04-25 15:19:30 +03:00
Valerio Setti
ae8579f2a2
Merge pull request #10650 from valeriosetti/fix-tls13-guard 
check_config: add missing check for TLS 1.3 key exchanges
 2026-04-24 14:32:36 +00:00
Minos Galanakis
a9a8385747 test_suite_ssl: Introduced hrr_reject_unadvertised_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-04-24 12:04:36 +01:00