coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-09-13 14:22:19 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,707 Commits 183 Branches 286 Tags Multiple Licenses 259 MiB
Commit Graph

6822 Commits

Author SHA1 Message Date
Valerio Setti
795e7e6fd4
Merge pull request #10791 from nvxbug/tls12-session-id-bounds 
Reject out-of-bounds session ID length in ssl_tls12_session_load
 2026-08-03 14:24:15 +00:00
David Horstmann
12556bc2a2
Merge pull request #10804 from valeriosetti/improve-rsa-pubkey-import-err-code 
pk: improve error code failure reporting when RSA public key parsing fails (1/2)
 2026-07-15 11:09:33 +00:00
Naveed
852c6bee29 Force sentinel session ID length in serialized-load test 
Signed-off-by: Naveed <naveed@bugqore.com>
 2026-07-09 13:16:14 +05:30
Naveed
c099994dca Reject out-of-bounds session ID length in ssl_tls12_session_load 
Signed-off-by: Naveed <naveed@bugqore.com>
 2026-07-09 13:07:44 +05:30
Valerio Setti
a5b83aea58 tests: x509parse: add temporary fallback mechanism for PK error codes 
Add a temporary fallback mechanism in 'x509parse_crt' while crypto#827
is merged.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-07-07 22:56:30 +02:00
Valerio Setti
8607628249 tests: x509parse: adjust some PK related error codes 
After crypto#827 some PK error codes changed from
MBEDTLS_ERR_PK_INVALID_PUBKEY to MBEDTLS_ERR_PK_INVALID_ALG.
This commit adjusts failing test cases.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-07-02 14:05:15 +02:00
Minos Galanakis
b11a07f274 Bump version --version 4.2.0 
./scripts/bump_version.sh --version 4.2.0

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-29 18:12:41 +01:00
Minos Galanakis
d156cf4c02 Merge remote-tracking branch 'development-restricted' into mbedtls-4.2.0.rc 2026-06-26 22:23:37 +01:00
Ronald Cron
41a8bdf109
Merge pull request #1619 from valeriosetti/issue1585 
[development] Stale DTLS- SRTP negotiation state after session_reset() (ARM-RZ7EMQAA)
 2026-06-26 12:17:06 +02:00
Ronald Cron
74b9ab2008 tls13_fetch_handshake_msg(): Remove require_record_boundary parameter 
Deduce it from the handshake message type

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
e08cea612f tls13_record_boundary_alignement: Append empty hs msg 
Append an empty handshake message to expand
the record instead of just a zero byte.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
1a58c59470 Various improvements of tls13_(drop_early_data|record_boundary_alignment)() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
86315b62a8 test_suite_ssl: Add initialization to all zeroes of test endpoint structs 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
c494497256 Fix typos 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
2de65b79a3 test_suite_ssl: Test EndOfEarlyData on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
cbef7256ce test_suite_ssl: Test client Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
53ac018b24 test_suite_ssl: Test server Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
93eb43ed4f test_suite_ssl: Test ServerHello on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
c8fefcde05 test_suite_ssl: Test ClientHello on record boundary check 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
3861588b47 tls13: Add record boundary checks 
RFC 8446 (TLS 1.3 specification), Section 5.1, states:

Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
    ...
    -Handshake messages MUST NOT span key changes. Implementations
    MUST verify that all messages immediately preceding a key change
    align with a record boundary; if not, then they MUST terminate the
    connection with an "unexpected_message" alert. Because the
    ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
    messages can immediately precede a key change, implementations
    MUST send these messages in alignment with a record boundary.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
b340e27847 test_suite_ssl: Add early data drop tests 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:30 +02:00
Valerio Setti
0a48608651 tests: ssl: split ssl_helpers between public and internal functions 
Move functions in "ssl_helpers.h" that depend on internal headers to
"ssl_helpers_internal.h". This allows to include "ssl_helpers.h" also
in programs (which do not have access to internal headers).

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Ben Taylor
c438b0b9a9 Correct error handling in mbedtls_ssl_reset_checksum 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
82bba7ef61 Fix error codes for tls_transcript_error_propagation 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 09:33:33 +01:00
Ben Taylor
e98a0a84c3 Improve tls_transcript_error_propagation testing to check for error codes 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
414d284f4a Update regression test 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 09:33:33 +01:00
Ben Taylor
dc555d19ec remove trailing whitespace 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
fc2f108dfb Update dependencies for skipped test 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
14b2bdc8ce fix code style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
629df9f5fb Improve testing 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
f63a0058d3 Remove check for NULL pointer 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
1e098f3ae9 Add client tests for RMS computation error 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
e9779ccaa3 Add unsupported trigger check 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
ed70149de3 Add further documentation to tls_abort_transcript_context 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
c2a26a989f Fixed code style 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Ben Taylor
8e9e821ce8 refactor initialisation in tls_transcript_error_propagation, so that the variables are initialised straight after they are declared 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Ben Taylor
d137f35665 Add additional guard for sha256 in tests 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Ben Taylor
e8f3c920ed Improve layout of the code for debugging with breakpoints 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:32 +01:00
Ronald Cron
ae6b06ce4c Improve dependencies and error handling 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:30 +01:00
Ben Taylor
5871216afc tests: ssl: add regression tests for EMS/RMS error propagation 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:30:05 +01:00
Gilles Peskine
98e4a7b02a
Merge pull request #1595 from bjwtaylor/info-leak-in-ssl_write_new_session_ticket 
Info leak in ssl write new session ticket
 2026-06-24 09:42:13 +02:00
Gilles Peskine
8300fd0a65
Merge pull request #1638 from valeriosetti/issue1598 
[development] PKCS7 accepts weak hashes
 2026-06-23 16:40:47 +02:00
Ronald Cron
27fcc8e3a0
Merge pull request #1582 from bjwtaylor/pkcs-free-stale-pointers 
Add fix for stale pointer after mbedtls_pkcs7_free
 2026-06-22 17:54:17 +02:00
Valerio Setti
869bd519fb tests: pkcs7: adjust test dependencies 
Newly added tests for RIPEMD160 and MD5 still require SHA-256 for the
certificate being used. SHA-1 is instead useless in this case.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Valerio Setti
00a2677b1e test_suite_pkcs7: adjust numbering of tests 
Some newly added tests had duplicate numbers with what was already there.
This commit fixes the duplication problem.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Valerio Setti
64d8776ea9 pkcs7: replace MBEDTLS_ERR_PKCS7_VERIFY_FAIL with MBEDTLS_ERR_PKCS7_VERIFY_FAIL 
This also updates test data.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Valerio Setti
930b87a87e tests: pkcs7: add negative tests using MD5 and RIPEMD160 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Valerio Setti
632c4fce0e tests: pkcs7: adjust return code in SHA-1 based PKCS7 test 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-22 11:39:49 +02:00
Ronald Cron
2beeff6a8e
Merge pull request #1671 from gilles-peskine-arm/badmac_seen_or_in_hsfraglen-test-dev 
test badmac_seen with renegotiation #1667
 2026-06-22 10:29:05 +02:00
Gilles Peskine
55bd327bad
Merge pull request #1630 from gilles-peskine-arm/basic-constaints-sequence-check-dev 
Fix CA bit forgery through invalid basicConstraints
 2026-06-18 15:36:41 +02:00