RFC 5280 defines cA as BOOLEAN DEFAULT FALSE, so a basicConstraints
extension containing only pathLenConstraint (SEQUENCE { INTEGER n })
is syntactically valid and must be interpreted as cA=FALSE. The fix
for CVE-2026-49300 rejected this encoding outright, breaking
compatibility with certificates emitted by devices such as
Eaton/CODESYS PLCs.
Tolerate MBEDTLS_ERR_ASN1_UNEXPECTED_TAG from the cA BOOLEAN parse,
keeping cA FALSE and letting the existing INTEGER parser validate
pathLenConstraint. The INTEGER value is never used to determine cA,
so the CVE fix is preserved.
Fixes#11006
Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
All fields of AuthorityKeyIdentifier are OPTIONAL, so an empty SEQUENCE
(30 00) is syntactically valid. It was rejected with
MBEDTLS_ERR_X509_INVALID_EXTENSIONS + MBEDTLS_ERR_ASN1_OUT_OF_DATA,
because mbedtls_asn1_get_tag() reports OUT_OF_DATA rather than
UNEXPECTED_TAG when there is nothing left to parse.
Check for the empty sequence explicitly instead of treating OUT_OF_DATA
as an absent keyIdentifier: OUT_OF_DATA is also returned for a [0] tag
with a missing or truncated length, which must still be rejected.
Fixes#10253.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Christopher Müller <chris@mechatronikmonkey.de>
The serialized ALPN length was passed to memcmp() against each configured protocol without checking it against the remaining serialized data, so a malformed context could read past the end of the buffer. Bound it before the comparison, like the adjacent CID fields.
Signed-off-by: Naveed <naveed@bugqore.com>
OAEP is for RSA encryption and therefore is not the correct check when
we want to test for signatures with PSS.
Additionally, we can use RSA PSS when we only have public key support
(not key pairs) so check for PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY (which is
auto-enabled when we have key pairs enabled anyway).
Signed-off-by: David Horstmann <david.horstmann@arm.com>
ClientHello: narrow the session-id check to the session id itself, check
the cookie length byte before reading it, and let the ciphersuite-list
length check cover both transports.
CertificateRequest: make the signature-algorithms check also reserve the
two certificate-authorities length bytes instead of adding a separate
check, use the available < needed pattern throughout, and reject an
odd-length signature-algorithms list.
Add injected truncated-ClientHello test cases (TLS 1.2-only builds).
Signed-off-by: Naveed <naveed@bugqore.com>
The intent on these lines was to get 'psa_key_type_t' for which
'mbedtls_pk_get_key_type' should clearly be used, not
'mbedtls_pk_get_type'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
MBEDTLS_ECP_DP_MAX is defined in 'ecp.h' which is a tf-psa-crypto private
header. Instead of relying on that value define a new function named
'mbedtls_ssl_get_supported_tls_id_count' which returns the number of
entries in 'tls_id_match_table'.
Rationale: it does not have too much sense to allocate an array for TLS
IDs which is larger than the list of supported TLS IDs in the current
build.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Its main functionality was to get a TLS ID from 'mbedtls_ecp_group_id' and
then call 'mbedtls_ssl_check_curve_tls_id'. The same can be achieved
with public PK functions and 'mbedtls_ssl_get_tls_id_from_curve_info',
then calling into 'mbedtls_ssl_check_curve_tls_id' as before.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Instead of retrieving the TLS ID using 'mbedtls_ecp_group_id', which
creates a dependency on the (now tf-psa-crypto private) 'ecp.h' header,
use PSA info to get the same result. Therefore rename the function as
'mbedtls_ssl_get_tls_id_from_curve_info'.
This new function has basically the opposite behavior than
'mbedtls_ssl_get_psa_curve_info_from_tls_id'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
All the usages of 'mbedtls_ssl_get_ecp_group_id_from_tls_id' basically
reduce to checking if a specific TLS ID is supported or not. Therefore
the function is replaced with 'mbedtls_ssl_is_tls_id_supported'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
RFC 8446 (TLS 1.3 specification), Section 5.1, states:
Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
...
-Handshake messages MUST NOT span key changes. Implementations
MUST verify that all messages immediately preceding a key change
align with a record boundary; if not, then they MUST terminate the
connection with an "unexpected_message" alert. Because the
ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
messages can immediately precede a key change, implementations
MUST send these messages in alignment with a record boundary.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Following fields were not properly reset when mbedtls_ssl_session_reset
was called:
- badmac_seen
- dtls_srtp_info
- alert_reason
- alert_type
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Add a check on mbedtls_pkcs7_data_or_hash_verify() so that the verification
fails if the MD alg specified in PKCS7 structure or the signature
algorithm specified in the X.509 certificate are not in the list of
secure algorithms (i.e. mbedtls_x509_crt_profile_default).
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Following functions
- x509_profile_check_md_alg
- x509_profile_check_pk_alg
are made non-static and moved to x509_internal.h so that other library
files can used them.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
ssl_preset_default_hashes was removed in
f0cda410a4bca0f45f66bdbf0714cd0eb2ea4718 but the comment in 'x509_crt.c'
wasn't updated.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
