coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-30 19:07:48 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,700 Commits 183 Branches 286 Tags 207 MiB
Commit Graph

34700 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Yi Wu
65dbfc8e87 test: check both .data and .function 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-07-15 09:48:06 +01:00
Yi Wu
4947a45c19 fix typo 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-07-15 09:48:06 +01:00
Yi Wu
37a33ab5cc test: dependency macros order fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-07-15 09:48:06 +01:00
Yi Wu
937f006632 tests: allow RSA helper dependency macros 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-07-15 09:48:06 +01:00
Yi Wu
2965533b08 test: remove obsolete macro checks 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-07-15 09:48:05 +01:00
Manuel Pégourié-Gonnard
b157aa1fce Add test for dependencies on crypto-internal macros 
Previously this was tested indirectly by comparing driver vs reference
components in analyze-outcomes.py, but now that the number of exceptions
is low, it's much more efficient to test this directly.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-07-15 09:48:05 +01:00
Manuel Pégourié-Gonnard
e8ed43bcee tests: avoid useless use of low-level crypto deps 
Take our low-level error for test from our own side of the split.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-07-15 09:48:05 +01:00
Manuel Pégourié-Gonnard
41d0f47970 ssl-opt: rm references to !MBEDTLS_USE_PSA_CRYPTO 
Also remove the "no USE_PSA" tests: they are not executed, and are not
useful for the future - when we add support for restartable ECDH in TLS,
we can just use the existing tests and update the assertions, which
we'll have to do anyway (the tests being removed were asserting about
a legacy crypto function that no longer exists).

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-07-15 09:48:05 +01:00
Ronald Cron
8828120c8a
Merge pull request #10816 from Mbed-TLS/mbedtls-4.1.1_mergeback 
Mbedtls 4.1.1 mergeback
 2026-07-08 13:16:11 +00:00
Minos Galanakis
c8ab24b67c Updated framework 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-08 10:47:30 +01:00
Minos Galanakis
cf644361ff Updated tf-psa-crypto submodule 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-08 10:47:30 +01:00
Minos Galanakis
a0bbf7649f Merge tag 'mbedtls-4.1.1' into mbedtls-4.1.1_mergeback 
Mbed TLS 4.1.1

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-07-07 16:55:23 +01:00
Minos Galanakis
0a8fda272a ChangeLog: Removed CVE-ID 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
mbedtls-4.1.1 v4.1.1 		2026-07-01 12:02:14 +01:00
Valerio Setti
7357e4df87
Merge pull request #10770 from bjwtaylor/unused-variable-ret-4.1 
Backport 4.1: Fix variable set but not used warning
 2026-07-01 08:35:49 +00:00
Minos Galanakis
5b6dd79f67 Update BRANCHES.md 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:32:24 +01:00
Minos Galanakis
d1f3eee6b5 ChangeLog: Removed todo placeholder for CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:32:24 +01:00
Minos Galanakis
0f9f57a047 Changelog: Added reference to tf-psa-crypto update 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:32:24 +01:00
Minos Galanakis
5089e9f623 Assemble Changelog 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:28:30 +01:00
Minos Galanakis
0c5fe5c677 Bump version --version 4.1.1 
./scripts/bump_version.sh --version 4.1.1

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:28:30 +01:00
Minos Galanakis
2bab33486e Updated tf-psa-crypto submodule 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:28:30 +01:00
Minos Galanakis
b05e6e0e0a Merge remote-tracking branch 'mbedtls-4.1-restricted' into mbedtls-4.1.1.rc 2026-06-26 22:05:03 +01:00
Ronald Cron
c0dbff0cf8
Merge pull request #1683 from valeriosetti/issue1585-backport4.1 
[4.1] Stale DTLS- SRTP negotiation state after session_reset() (ARM-RZ7EMQAA)
 2026-06-26 12:17:19 +02:00
Ronald Cron
316296466b
Merge pull request #1686 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass_changelog_4.1 
Add Attribution CVE mbedtls:mbedtls4.1-restricted
 2026-06-25 15:57:24 +02:00
Ronald Cron
cc5f7bc061
Merge pull request #10785 from minosgalanakis/mbedtls-4.1-release-sync 
Mbedtls 4.1.1 release sync
 2026-06-25 12:09:50 +00:00
Minos Galanakis
caad5d95e5 Updated tf-psa-crypto pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:53:15 +01:00
Minos Galanakis
f43bdae2d2 Updated framework pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:52:36 +01:00
Gilles Peskine
fe4733b1de
Merge pull request #10790 from bensze01/readthedocs-4.1 
[Backport 4.1] Upgrade readthedocs builder to Ubuntu 26.04
 2026-06-24 18:48:16 +00:00
Gilles Peskine
f885248356
Merge pull request #1681 from ronald-cron-arm/hsm-do-not-span-key-change-4.1 
4.1: Hsm do not span key change
 2026-06-24 19:22:12 +02:00
Bence Szépkúti
a493f22738 Upgrade readthedocs builder to Ubuntu 26.04 
The 20.04 runner is no longer supported.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2026-06-24 17:02:37 +02:00
Ronald Cron
45d892ea3d Check ServerHello record boundary alignment only in TLS 1.3 case 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
0fe502312d tls13_fetch_handshake_msg(): Remove require_record_boundary parameter 
Deduce it from the handshake message type

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
1208d1cc25 tls13_record_boundary_alignement: Append empty hs msg 
Append an empty handshake message to expand
the record instead of just a zero byte.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
4165fe1dc2 Various improvements of tls13_(drop_early_data|record_boundary_alignment)() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
1235722aa1 tls13: Rework mbedtls_ssl_tls13_fetch_handshake_msg() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
7dc69f331f tls13: Improve argument name 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
d13352bc40 test_suite_ssl: Add initialization to all zeroes of test endpoint structs 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
62a9fa9f48 Fix typos 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
c4db00209a Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
0501eeb804 test_suite_ssl: Test EndOfEarlyData on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
996adce4b6 test_suite_ssl: Test client Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
d00518a2ec test_suite_ssl: Test server Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:25 +02:00
Ronald Cron
b9793ca124 test_suite_ssl: Test ServerHello on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:24 +02:00
Ronald Cron
dd97c26e9a test_suite_ssl: Test ClientHello on record boundary check 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:24 +02:00
Ronald Cron
f17c5ff90d tls13: Add record boundary checks 
RFC 8446 (TLS 1.3 specification), Section 5.1, states:

Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
    ...
    -Handshake messages MUST NOT span key changes. Implementations
    MUST verify that all messages immediately preceding a key change
    align with a record boundary; if not, then they MUST terminate the
    connection with an "unexpected_message" alert. Because the
    ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
    messages can immediately precede a key change, implementations
    MUST send these messages in alignment with a record boundary.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:24 +02:00
Ronald Cron
2aaedab1eb test_suite_ssl: Add early data drop tests 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 16:00:23 +02:00
Minos Galanakis
1d3ac2843c Changelog. Added attribution/CVE for 1569 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 14:40:53 +01:00
Valerio Setti
3b84f44c7f tests: ssl_helpers: run ssl_context reset check only when the SSL context is setup 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 15:38:32 +02:00
Ronald Cron
5aac408d2a
Merge pull request #1657 from bjwtaylor/ssl-ignores-failure-restricted-4.1 
Backport 4.1: Fix issues in ssl where it ignores the failure return
 2026-06-24 15:03:12 +02:00
Valerio Setti
8ef4559dfa framework: update reference 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00
Valerio Setti
de1f7218d5 tests: generate_ssl_session_reset_check: remove trailing whitespace 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:42:10 +02:00