coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-10-28 18:07:34 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,795 Commits 183 Branches 286 Tags Multiple Licenses 206 MiB
Commit Graph

34795 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Minos Galanakis
2c164902ea Adjusted dependecies for hrr_reject_unadvertised_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 15:02:05 +01:00
Minos Galanakis
bac133ffcb test_suite_ssl: Introduced hrr_reject_unadvertised_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 15:02:05 +01:00
Minos Galanakis
cec2cef6b5 tls13_client: fix HRR selected_group validation 
Reject HRR selected_group unless it matches the client’s original
supported_groups and is locally supported, so unadvertised groups are not
accepted in the second ClientHello.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 15:02:05 +01:00
Ronald Cron
123216ea40
Merge pull request #10751 from gilles-peskine-arm/python-project-knowledge-directory-mbedtls-4.1 
Backport 4.1: Create Python project knowledge directory
 2026-05-12 13:38:11 +00:00
minosgalanakis
b2e36d7d7a
Merge pull request #1601 from mpg/mbedtls-4.1-restricted 
Merge public 4.1 into -restricted
 2026-05-12 09:46:03 +01:00
Manuel Pégourié-Gonnard
def1fe66ca Merge branch 'mbedtls-4.1' into mbedtls-4.1-restricted 
* mbedtls-4.1:
  Update framework pointer to bring in fix for python imports
  Update tf-psa-crypto to bring in python fix
 2026-05-12 09:03:27 +02:00
Manuel Pégourié-Gonnard
10ff2fc1d9
Merge pull request #10750 from bjwtaylor/broken-build-1.1 
Update framework pointer to bring in fix for python imports
 2026-05-11 10:50:47 +00:00
Manuel Pégourié-Gonnard
e292284ddb Merge branch 'mbedtls-4.1' into mbedtls-4.1-restricted 
* mbedtls-4.1: (37 commits)
  check_config: fix error message for missing TLS 1.2 key exchanges
  check_config: add check for TLS 1.3 key exchanges
  tests: depends.py: extend pkalgs including PSA_WANT_ALG_RSA_PKCS1V15_SIGN
  tests: depends.py: fix reverse dependency for RSA
  library: check_config: remove RSA encryption requirement from ECDHE-RSA
  update ChangeLog
  add ChangeLog
  Fix build warning/error using llvm-mingw
  test: improve symlink checks
  test: versioned symlink order fix
  test: reorder if-else structure
  test: add debug output and fix for win config
  ChangeLog fix
  tests: fix DESTDIR install checks and add macOS compatibility
  ChangeLog fixes
  ChangeLog padding space fix
  Test: add symlinks and dangling link check
  ChangeLog fix
  ChangeLog newline fix
  Add changelog
  ...
 2026-05-11 12:12:10 +02:00
Gilles Peskine
4f149ffc02 Update comment 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-08 18:00:45 +02:00
Gilles Peskine
c7b1c86e6b Prefer to load tf_psa_crypto_test_case_info from project_knowledge 
Try to load the list of tests that TF-PSA-Crypto wants us to ignore in three
ways, depending on the age of the tf-psa-crypto submodule:

* Modern: import `tf_psa_crypto_test_case_info` as an ordinary module,
  expected to be found in `tf-psa-crypto/scripts/project_knowledge`.
* First location, quickly superseded: load
  `tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py`,
  in a hackish way because we don't want to put that directory on the
  load path.
* Oldest: there is no `tf_psa_crypto_test_case_info.py`. Use a hard-coded
  list.

Once all the TF-PSA-Crypto branches we care about (e.g. pull requests
in progress) are updated with
`tf-psa-crypto/scripts/project_knowledge/tf_psa_crypto_test_case_info.py`,
we can drop the backward compatibilty hacks and simply
`import tf_psa_crypto_test_case_info` unconditionally and use
`tf_psa_crypto_test_case_info.INTERNAL_TEST_CASES` unconditionally.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-08 18:00:45 +02:00
Gilles Peskine
da2b5d6f42 Add tf-psa-crypto/scripts/project_knowledge to Python load path 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-08 18:00:45 +02:00
Ben Taylor
e18c52e93d Update framework pointer to bring in fix for python imports 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-08 11:01:05 +01:00
Ben Taylor
ce8c6708dd Update tf-psa-crypto to bring in python fix 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-08 11:00:50 +01:00
Gilles Peskine
465d6e9669 Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-04 18:44:05 +02:00
Valerio Setti
cfb07a923d changelog: add note about fix of issue 10740 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-29 17:10:04 +02:00
Valerio Setti
23538fd562 include mbedtls_platform_requirements.h in mbedtls_config.c 
This is required because if the user defined configuration file (not the
default one provided by mbedtls) includes files from the standard
C library then __STDC_WANT_LIB_EXT1__ won't be defined there which
cause weird build failures.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-29 17:10:04 +02:00
minosgalanakis
8f8b35b41c
Merge pull request #10711 from valord577/patch-1-backport-v4 
[backport 4.1 #10695] Fix build warning/error using llvm-mingw
 2026-04-29 14:52:04 +00:00
Gilles Peskine
ded271a8c4
Merge pull request #10696 from yiwu0b11/destdir_install_env_support-4.1 
Backport 4.1: Support DESTDIR for install and add build-system test
 2026-04-29 14:37:40 +00:00
Valerio Setti
5875ffa6fc
Merge pull request #10713 from valeriosetti/backport-pr10650 
[backport 4.1] check_config: add missing check for TLS 1.3 key exchanges
 2026-04-24 14:32:42 +00:00
Valerio Setti
b4df7bb14d
Merge pull request #10712 from valeriosetti/backport-pr10639 
[backport 4.1] library: check_config: remove RSA encryption requirement from ECDHE-RSA
 2026-04-24 07:30:58 +00:00
Valerio Setti
f2ab107392 check_config: fix error message for missing TLS 1.2 key exchanges 
Align the error message to the one used for the same check in TLS 1.3.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-23 14:51:52 +02:00
Valerio Setti
1caa7db5e8 check_config: add check for TLS 1.3 key exchanges 
When MBEDTLS_SSL_PROTO_TLS1_3 is enabled ensure that at least one of the
related key exchanges is also enabled.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-23 14:51:48 +02:00
Valerio Setti
377cbb2055 tests: depends.py: extend pkalgs including PSA_WANT_ALG_RSA_PKCS1V15_SIGN 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-22 17:17:41 +02:00
Valerio Setti
9d4447fdc5 tests: depends.py: fix reverse dependency for RSA 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-22 17:17:41 +02:00
Valerio Setti
2882b73697 library: check_config: remove RSA encryption requirement from ECDHE-RSA 
ECDHE-RSA only requires RSA signature, not encryption. This commits fixes
guards in "mbedtls_check_config.h".

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-22 17:17:41 +02:00
valord577
fce010911c update ChangeLog 
Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:09:29 +08:00
valord577
3bf4af0838 add ChangeLog 
Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:09:21 +08:00
valord577
fb43ea9278 Fix build warning/error using llvm-mingw 
error logs refs: https://github.com/valord577/nativepkgs/actions/runs/24490614774/job/71574726128

Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:09:16 +08:00
Yi Wu
c7b630ffa1 tests: remove remaining FFDH code in compat.sh 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-21 10:33:54 +01:00
Ronald Cron
6a5e0139f8
Merge pull request #10703 from minosgalanakis/docs/4.1.0_changelog_fixes_bp 
ChangeLog 4.1 Fixed references to TF-PSA-Crypto
 2026-04-20 09:49:28 +00:00
Yi Wu
7c63e641e3 test: improve symlink checks 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
6c63f39eeb test: versioned symlink order fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
5bddf62a69 test: reorder if-else structure 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
9d88e0b200 test: add debug output and fix for win config 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
0dc58e196d ChangeLog fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
ee0f8cbc11 tests: fix DESTDIR install checks and add macOS compatibility 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
f645b06c38 ChangeLog fixes 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
9ffdbe5bf3 ChangeLog padding space fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
291fb02523 Test: add symlinks and dangling link check 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
ff66c4efb9 ChangeLog fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
f2d35a04ed ChangeLog newline fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
c839d60443 Add changelog 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
897daf3ea1 Support DESTDIR for install and add build-system test 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Ronald Cron
f9990f3289
Merge pull request #10704 from Maokaman1/fix/tls12-rsa-pss-sigalgs-4.1 
Backport 4.1: ssl: accept TLS 1.2 rsa_pss_rsae signature algorithms
 2026-04-20 08:03:21 +00:00
Viktor Sokolovskiy
4302c8dffb Pacify uncrustify 
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
 2026-04-18 02:02:15 +03:00
Minos Galanakis
f9610844e6 ChangeLog: Fixed a reference to TF-PSA-Crypto 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-04-17 17:17:48 +01:00
Viktor Sokolovskiy
5fc28f4016 ssl: accept TLS 1.2 rsa_pss_rsae in client SKE 
Fix a TLS 1.2 client regression that caused valid ServerKeyExchange signatures using rsa_pss_rsae_* to be rejected.

Allow rsa_pss_rsae_* in the TLS 1.2 client ServerKeyExchange parse path when the algorithm is supported and was offered by the client. Add OpenSSL and GnuTLS interoperability coverage for TLS 1.2 servers that force rsa_pss_rsae_sha256.

Fixes #10668.

Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
 2026-04-17 19:16:20 +03:00
Gilles Peskine
e589739db1
Merge pull request #10685 from gilles-peskine-arm/maintainer-scripts-create-directory-4.1 
Backport 4.1: Create a directory for maintainer-only Python scripts
 2026-04-15 08:19:31 +00:00
Gilles Peskine
b116c4deff
Merge pull request #10688 from gilles-peskine-arm/analyze_outcomes-read_crypto-4.1 
Backport 4.1: Let TF-PSA-Crypto define test cases that Mbed TLS does not need to cover
 2026-04-13 09:24:12 +00:00
Gilles Peskine
635d64362f Update crypto submodule with analyze_outcomes.py 
Update framework to match.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-04-10 14:48:05 +02:00