coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity
33,046 Commits 183 Branches 286 Tags 220 MiB
Commit Graph

33046 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Janos Follath
0165a8d763 sig_algs: fix typo in client's sig_algs check 
This bug caused the client accepting sig_algs used by the server that
it explicitly wanted to disallow.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2026-03-16 12:37:49 +00:00
Minos Galanakis
ebe26fd095 test_suite_psa_crypto: Fixed a typo in documentation 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-16 11:54:39 +00:00
David Horstmann
611f3fb072 Configure the RNG in 3.6 testcase 
In Mbed TLS 3.6 we still need to manually configure the RNG for TLS. Add
this to the testcase for default verify_result.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-16 11:15:01 +00:00
Manuel Pégourié-Gonnard
0d48c34169
Merge pull request #1490 from ronald-cron-arm/tls12-2nd-client-hello-3.6 
Backport 3.6: Fix TLS 1.2 client hello after HRR
 2026-03-16 10:58:44 +01:00
Gilles Peskine
d05d789316 grammar 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-15 19:53:48 +01:00
Gilles Peskine
e6efd3e406 Match macro definition order with order in mbedtls_entropy_init 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-15 19:52:16 +01:00
Gilles Peskine
900b7dc5ac Test that the compile-time and run-time entropy source counts match 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-15 19:52:16 +01:00
Gilles Peskine
909055d760 Fix negation that broke psa_random_set_prediction_resistance 
Platform entropy is available when `MBEDTLS_NO_PLATFORM_ENTROPY` is _not_
defined.

This caused the ok/not-supported behavior of `broke
psa_random_set_prediction_resistance() to be inverted, and the unit tests
checking that behavior to be similarly inverted, so the unit tests didn't
catch it.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-15 19:32:39 +01:00
Manuel Pégourié-Gonnard
2d0aa97f81
Merge pull request #1501 from mpg/restricted-ffdh-peerkey-checks 
[Backport 3.6] FFDH peer key checks
 2026-03-13 12:44:30 +01:00
Manuel Pégourié-Gonnard
01b04ab723
Merge pull request #1489 from davidhorstmann-arm/fix-psa-ffdh-buffer-overflow-3.6 
[Backport 3.6] Fix buffer overflow in FFDH public key export
 2026-03-13 09:56:43 +01:00
Manuel Pégourié-Gonnard
e24f1e5c2c
Merge pull request #10609 from mpg/pk-psa-large-stack-buffers 
[3.6] PK: avoid large stack buffers in "to/from PSA" functions
 2026-03-13 08:53:48 +00:00
Minos Galanakis
fa284db5a1 test_suite_psa_crypto: Updated multipart tests 
- Added checks for calling `finish()`, `verify()` after
  `set_len()` without calling `update()` & `update_ad()`

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-12 16:23:24 +00:00
Minos Galanakis
5311a6e220 Updated mbedtls_ccm_finish_boundary to handle zero len tags 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-12 12:00:23 +00:00
Gilles Peskine
9d17d28dda More documentation improvements 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-12 12:39:16 +01:00
Minos Galanakis
e8a2499d4e ccm: Fixed a missing error flag assertion. 
In ccm_calculate_first_block_if_ready when using ccm
tag_len==0 is invalid. When it fails, it will now also
assert the CCM_STATE__ERROR in the state machine's
context.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-12 11:09:31 +00:00
Minos Galanakis
8b50733a73 ccm: Re-ordered len checks in mbedtls_ccm_finish. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-12 11:09:31 +00:00
Minos Galanakis
66d57b0d7b test_suite_psa_crypto: Updated multipart tests 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-12 11:09:31 +00:00
Gilles Peskine
f05a711011 Minor documentation improvements 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 12:58:22 +01:00
Gilles Peskine
43afaa5343 Fix Doxygen warning in realfull config 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 12:21:18 +01:00
Minos Galanakis
e96de33867 psa_core: Added a retval in psa_aead_final_checks() 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-11 10:30:57 +00:00
Minos Galanakis
0004fe7e96 test_suite_ccm: Updated input arguments 
Key and iv are now test function internal arguments.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-11 10:30:56 +00:00
Gilles Peskine
d8ce52df19 Fix Doxygen comment start 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 10:48:58 +01:00
Gilles Peskine
409427eac4 Fix grammar 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 10:31:59 +01:00
Gilles Peskine
7cf7a85008 Add missing parenthetical remark 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 10:31:58 +01:00
Minos Galanakis
32caf3bad0 ccm: Fail when calling finish without ccm_starts 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-10 22:04:27 +00:00
Minos Galanakis
27069c6be6 test_suite_ccm.function: Fixed typo in docs 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-10 22:04:27 +00:00
Minos Galanakis
f447b0264a test_suite_psa_crypto: Extended aead_multipart_state_test(2) 
This patch adds psa_aead_decrypt_setup() & psa_aead_finish()
path to the multipart_state_testing.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-10 22:04:27 +00:00
Ronald Cron
0be90b44e2 Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 19:26:14 +01:00
Ronald Cron
668e677faf tls13_hrr_then_tls12_second_client_hello: Improve client and server state checks 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 19:26:14 +01:00
Ronald Cron
7b3af46c40 tls13_hrr_then_tls12_second_client_hello: Improve some comments 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 19:26:08 +01:00
Ronald Cron
a76e7c65bc tls13_hrr_then_tls12_second_client_hello: Various improvements 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 17:08:22 +01:00
Ronald Cron
828e3817ac
Merge pull request #10623 from ronald-cron-arm/dtls-client-hello-defragmentation-3.6 
Backport 3.6: Add support for (D)TLS 1.2 client hello defragmentation
 2026-03-10 14:46:41 +00:00
Manuel Pégourié-Gonnard
199d4d9380 FFDH: fix wrong word in comment 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-03-10 11:40:14 +01:00
Ronald Cron
7476e4067d Restore seq number check of post-handshake ClientHello msg 
The check was wrongly removed by the commit
"ssl_tls12_server.c: Move ClientHello message_seq adjustment".

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 10:15:42 +01:00
David Horstmann
97c4e3f69b Add missing full stop in ChangeLog entry 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:09:56 +00:00
David Horstmann
89f132d3fa Add buffer-too-small case for FFDH-8192 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:07:20 +00:00
David Horstmann
14b37ec1c4 Add small buffer case for P521 import/export 
Specifically for the simple import/export case and also the
import/export-public case.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
cc4e191d4f Add missing buffer-too-small tests 
Add tests for key import-export and key import followed by public-key
export when the output buffer is too small. Add these tests for the
following curves:
* p256 as an example of a Weierstrass curve
* Curve25519
* Curve448

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
23e688b3ab Add credit to the ChangeLog entry 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
1ecd0c1ea6 Simplify ChangeLog entry 
Improve readability of the ChangeLog by including only the strictly
necessary information.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
a749c3a5f8 Add ChangeLog entry for FFDH buffer overflow fix 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
01bcc1f754 Add missing FFDH public key buffer length check 
When exporting an FFDH public key we were not properly checking the
length of the output buffer and would write the full length of the key
in all cases. Fix this by checking the size of the output buffer before
we write to it.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
443300e700 Add testcase for FFDH buffer overflow 
This testcase calls psa_export_public_key() on an FFDH key with an
output buffer that is too small. Since the size is calculated based on
the required key size but not checked against the available buffer size,
we overflow the buffer.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
Ronald Cron
d6977afbd8 ssl_tls12_server.c: Move back the digest update 
Move back the digest update just after
the call to mbedtls_ssl_read_record().
It fits well here as we explain in the
comment associated to the call to
mbedtls_ssl_read_record() that we
update it manually.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 09:47:29 +01:00
Ronald Cron
1222d8cbf4 Improve comments 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 09:47:28 +01:00
Gilles Peskine
fc38b65561 Add advice to reseed the RNG if the application is cloned 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-09 18:06:38 +01:00
Gilles Peskine
855e10c108
Merge pull request #10068 from gilles-peskine-arm/pk-0e-prototype-3.6 
Minor documentation fixes in pk.h
 2026-03-09 13:57:34 +00:00
Gilles Peskine
0306be2cb5
Merge pull request #10465 from bensze01/abicheck-port-3.6 
[Backport 3.6] Move abi_check.py to the framework
 2026-03-09 13:57:08 +00:00
Manuel Pégourié-Gonnard
4704b6b4bd
Merge pull request #1488 from davidhorstmann-arm/fix-null-pointer-dereference-3.6 
[Backport 3.6] Fix null pointer dereference in `mbedtls_x509_string_to_names()`
 2026-03-09 12:42:56 +01:00
Manuel Pégourié-Gonnard
6a5d54b73d
Merge pull request #1503 from gilles-peskine-arm/merge-3.6-restricted-20260309 
Merge 3.6 public into restricted (ready for fork fix)
 2026-03-09 10:11:32 +01:00