coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,686 Commits 183 Branches 286 Tags Multiple Licenses 215 MiB
Commit Graph

34686 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Minos Galanakis
d156cf4c02 Merge remote-tracking branch 'development-restricted' into mbedtls-4.2.0.rc 2026-06-26 22:23:37 +01:00
Ronald Cron
41a8bdf109
Merge pull request #1619 from valeriosetti/issue1585 
[development] Stale DTLS- SRTP negotiation state after session_reset() (ARM-RZ7EMQAA)
 2026-06-26 12:17:06 +02:00
Ronald Cron
3bb1c69f7e
Merge pull request #1685 from minosgalanakis/security/mlfbyt4c_tls13_policy_bypass_changelog 
Add Attribution CVE mbedtls:development-restricted
 2026-06-25 15:54:46 +02:00
Ronald Cron
05e0dfbe99
Merge pull request #10786 from minosgalanakis/mbedtls-release-sync 
Mbedtls 4.2.0 release sync
 2026-06-25 12:16:45 +00:00
Minos Galanakis
66e3648745 Updated tf-psa-crypto pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:50:42 +01:00
Minos Galanakis
0aaa58b438 Updated framework pointer 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-25 00:50:26 +01:00
Gilles Peskine
1a4f04b0c4
Merge pull request #10788 from bensze01/readthedocs 
Upgrade readthedocs builder to Ubuntu 26.04
 2026-06-24 18:18:42 +00:00
Gilles Peskine
9baa16385d
Merge pull request #1652 from ronald-cron-arm/hsm-do-not-span-key-change 
Hsm do not span key change
 2026-06-24 19:22:01 +02:00
Bence Szépkúti
98413e8b70 Upgrade readthedocs builder to Ubuntu 26.04 
The 20.04 runner is no longer supported.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2026-06-24 16:43:16 +02:00
Ronald Cron
b188f399f9 Check ServerHello record boundary alignment only in TLS 1.3 case 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
74b9ab2008 tls13_fetch_handshake_msg(): Remove require_record_boundary parameter 
Deduce it from the handshake message type

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
e08cea612f tls13_record_boundary_alignement: Append empty hs msg 
Append an empty handshake message to expand
the record instead of just a zero byte.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
1a58c59470 Various improvements of tls13_(drop_early_data|record_boundary_alignment)() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
6c557a70f6 tls13: Rework mbedtls_ssl_tls13_fetch_handshake_msg() 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
0c9d3d4a0f tls13: Improve argument name 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
86315b62a8 test_suite_ssl: Add initialization to all zeroes of test endpoint structs 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
c494497256 Fix typos 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
e55d0b76ed Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
2de65b79a3 test_suite_ssl: Test EndOfEarlyData on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
cbef7256ce test_suite_ssl: Test client Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
53ac018b24 test_suite_ssl: Test server Finished on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
93eb43ed4f test_suite_ssl: Test ServerHello on record boundary enforcement 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
c8fefcde05 test_suite_ssl: Test ClientHello on record boundary check 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
3861588b47 tls13: Add record boundary checks 
RFC 8446 (TLS 1.3 specification), Section 5.1, states:

Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
    ...
    -Handshake messages MUST NOT span key changes. Implementations
    MUST verify that all messages immediately preceding a key change
    align with a record boundary; if not, then they MUST terminate the
    connection with an "unexpected_message" alert. Because the
    ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
    messages can immediately precede a key change, implementations
    MUST send these messages in alignment with a record boundary.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:33 +02:00
Ronald Cron
b340e27847 test_suite_ssl: Add early data drop tests 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-06-24 15:51:30 +02:00
Valerio Setti
4f92a63e4a tests: ssl_helpers: run ssl_context reset check only when the SSL context is setup 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 15:37:00 +02:00
Minos Galanakis
f722436e46 Changelog. Added attribution/CVE for 1569 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-06-24 14:36:00 +01:00
Ronald Cron
f74ef9b3ab
Merge pull request #1599 from bjwtaylor/ssl-ignores-failure-restricted 
Fix issues in ssl where it ignores the failure return
 2026-06-24 15:02:34 +02:00
Valerio Setti
c668f4e68e framework: update reference 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:31:20 +02:00
Valerio Setti
4c8a9b7a5e tests: generate_ssl_session_reset_check: remove trailing whitespace 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
dce45a7cfe tests: generate_ssl_session_reset_check: pacify pylint 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
508e9b1ca4 tests: generate_ssl_session_reset_check: order rules as fields in the struct 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
d70169b85c tests: ssl_helpers: fix documentation of mbedtls_test_ssl_check_context_after_session_reset 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
365544616d tests: ssl_context_reset_verifier: add missing semicolon in generated file 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
b55e820fd1 tests: generate_ssl_session_reset_check: add missing semicolon in generated file 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
4b57c243bb changelog: add note for documentation fix for mbedtls_ssl_set_cid 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
3bd3e47100 include: ssl: fix documentation of mbedtls_ssl_set_cid 
Specify that the configured CID will apply to all subsequent handshakes
not just to the next one.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
931b983159 changelog: add reset for some fields of the SSL context structure 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
a2338a21fa library: ssl: reset some SSL context's fields in mbedtls_ssl_session_reset 
Following fields were not properly reset when mbedtls_ssl_session_reset
was called:

- badmac_seen
- dtls_srtp_info
- alert_reason
- alert_type

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
fbd49c0c4e tests|programs: call check_context_after_session_reset whenever mbedtls_ssl_session_reset 
Call mbedtls_test_ssl_check_context_after_session_reset both in programs
(ssl_client2 and ssl_server2) and tests to ensure that the SSL context
has been properly handled when mbedtls_ssl_session_reset was called.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
a4dbd999c0 tests: add prototype and implementation of mbedtls_test_ssl_check_context_after_session_reset 
Ideally the implementation shouldn't be checked in git, but for the time
being there is no support in building source code for tests from the
binary folder, so it's accepted as a temporary solution.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
8294a8fd67 tests: scripts: add generate_ssl_session_reset_check.py 
Togethere with the framework counterpart ('ssl_session_reset_check.py')
this script is used to automatically generate the function
'mbedtls_test_ssl_check_context_after_session_reset()'.
The goal of this function is to verify that 'mbedtls_ssl_session_reset()'
properly handled (reset or keep) all the fields of the
'mbedtls_ssl_context' structure.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
0a48608651 tests: ssl: split ssl_helpers between public and internal functions 
Move functions in "ssl_helpers.h" that depend on internal headers to
"ssl_helpers_internal.h". This allows to include "ssl_helpers.h" also
in programs (which do not have access to internal headers).

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Valerio Setti
3e191be15a include: ssl: add a typedef for unused data in mbedtls_ssl_config and mbedtls_ssl_context 
Add mbedtls_ssl_unused_data_t type instead of embedding the union inside
both structures.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-06-24 14:30:59 +02:00
Ben Taylor
c438b0b9a9 Correct error handling in mbedtls_ssl_reset_checksum 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
82bba7ef61 Fix error codes for tls_transcript_error_propagation 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 09:33:33 +01:00
Ben Taylor
e98a0a84c3 Improve tls_transcript_error_propagation testing to check for error codes 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
414d284f4a Update regression test 
Co-authored-by: Ronald Cron <ronald.cron@arm.com>
Signed-off-by: Ben Taylor <32939606+bjwtaylor@users.noreply.github.com>
 2026-06-24 09:33:33 +01:00
Ben Taylor
0bf015a43b restore missing ext_len set 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00
Ben Taylor
dc555d19ec remove trailing whitespace 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-06-24 09:33:33 +01:00