coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,605 Commits 183 Branches 286 Tags 220 MiB
Commit Graph

34605 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Valerio Setti
bd57fb5e8a changelog: fix typos 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-28 13:07:51 +02:00
Valerio Setti
f0ed933ca8 changelog: add note about issue 1569 resolution 
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-28 13:07:51 +02:00
Valerio Setti
271bf18193 ssl: improve documentation of mbedtls_ssl_conf_sig_algs() 
Clarify that the 'sig_algs' set through this function are only enforced
during the key exchange and that 'mbedtls_ssl_conf_cert_profile()' should
instead be used to enforce the same algorithms when verifying certificates.

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
 2026-05-28 13:07:51 +02:00
Gilles Peskine
9007fc4b9b Fix lax basicConstraints parsing 
When parsing the basicConstraints extension, reject junk after the SEQUENCE
inside the extension (which is probably benign), and reject a SEQUENCE that
extends beyond the extension (could be very dangerous).

Add a non-regression test where a certificate that is technically malformed,
but accepted as a leaf certificate by OpenSSL and other X.509
implementations, to be accepted as a CA certificate by Mbed TLS.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 20:51:52 +02:00
Gilles Peskine
1af2443a38 Update framework with test certificate with basicConstraints overflow 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-26 20:51:49 +02:00
Minos Galanakis
e16f0e0b01 ssl_write_supported_groups_ext: Updated documentation 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-26 10:31:03 +01:00
Janos Follath
a4f79350ac
Merge pull request #10742 from valeriosetti/backport-pr10741 
[backport 4.1] mbedtls_config.c missing mbedtls_platform_requirements.h
 2026-05-26 09:24:50 +00:00
Minos Galanakis
2e2087d246 test_suite_ssl: Added MBEDTLS_DEBUG_C guards to logs 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 15:01:43 +01:00
Minos Galanakis
c4461967af test_suite_ssl: Restructured reject_hrr_selecting_unoffered_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 15:01:21 +01:00
Minos Galanakis
d3931632fa test_suite_ssl: Renamed hrr_reject_selecting_unoffered_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 15:01:00 +01:00
Minos Galanakis
f8adf74988 sll_client: align TLS 1.3 supported_groups filtering with PSA curve support 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-20 15:00:52 +01:00
minosgalanakis
e862725edd
Merge pull request #10709 from yiwu0b11/remove_unused_ffdh_code-4.1 
Backport 4.1: tests: remove remaining FFDH code in compat.sh
 2026-05-13 16:49:07 +00:00
Minos Galanakis
be84be5d9a test_suite_ssl: doc fixes 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-13 11:45:44 +01:00
Minos Galanakis
45ca9e1e06 Added ChangeLog 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 15:02:05 +01:00
Minos Galanakis
2c164902ea Adjusted dependecies for hrr_reject_unadvertised_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 15:02:05 +01:00
Minos Galanakis
bac133ffcb test_suite_ssl: Introduced hrr_reject_unadvertised_group 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 15:02:05 +01:00
Minos Galanakis
cec2cef6b5 tls13_client: fix HRR selected_group validation 
Reject HRR selected_group unless it matches the client’s original
supported_groups and is locally supported, so unadvertised groups are not
accepted in the second ClientHello.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-05-12 15:02:05 +01:00
Ronald Cron
123216ea40
Merge pull request #10751 from gilles-peskine-arm/python-project-knowledge-directory-mbedtls-4.1 
Backport 4.1: Create Python project knowledge directory
 2026-05-12 13:38:11 +00:00
minosgalanakis
b2e36d7d7a
Merge pull request #1601 from mpg/mbedtls-4.1-restricted 
Merge public 4.1 into -restricted
 2026-05-12 09:46:03 +01:00
Manuel Pégourié-Gonnard
def1fe66ca Merge branch 'mbedtls-4.1' into mbedtls-4.1-restricted 
* mbedtls-4.1:
  Update framework pointer to bring in fix for python imports
  Update tf-psa-crypto to bring in python fix
 2026-05-12 09:03:27 +02:00
Manuel Pégourié-Gonnard
10ff2fc1d9
Merge pull request #10750 from bjwtaylor/broken-build-1.1 
Update framework pointer to bring in fix for python imports
 2026-05-11 10:50:47 +00:00
Manuel Pégourié-Gonnard
e292284ddb Merge branch 'mbedtls-4.1' into mbedtls-4.1-restricted 
* mbedtls-4.1: (37 commits)
  check_config: fix error message for missing TLS 1.2 key exchanges
  check_config: add check for TLS 1.3 key exchanges
  tests: depends.py: extend pkalgs including PSA_WANT_ALG_RSA_PKCS1V15_SIGN
  tests: depends.py: fix reverse dependency for RSA
  library: check_config: remove RSA encryption requirement from ECDHE-RSA
  update ChangeLog
  add ChangeLog
  Fix build warning/error using llvm-mingw
  test: improve symlink checks
  test: versioned symlink order fix
  test: reorder if-else structure
  test: add debug output and fix for win config
  ChangeLog fix
  tests: fix DESTDIR install checks and add macOS compatibility
  ChangeLog fixes
  ChangeLog padding space fix
  Test: add symlinks and dangling link check
  ChangeLog fix
  ChangeLog newline fix
  Add changelog
  ...
 2026-05-11 12:12:10 +02:00
Gilles Peskine
4f149ffc02 Update comment 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-08 18:00:45 +02:00
Gilles Peskine
c7b1c86e6b Prefer to load tf_psa_crypto_test_case_info from project_knowledge 
Try to load the list of tests that TF-PSA-Crypto wants us to ignore in three
ways, depending on the age of the tf-psa-crypto submodule:

* Modern: import `tf_psa_crypto_test_case_info` as an ordinary module,
  expected to be found in `tf-psa-crypto/scripts/project_knowledge`.
* First location, quickly superseded: load
  `tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py`,
  in a hackish way because we don't want to put that directory on the
  load path.
* Oldest: there is no `tf_psa_crypto_test_case_info.py`. Use a hard-coded
  list.

Once all the TF-PSA-Crypto branches we care about (e.g. pull requests
in progress) are updated with
`tf-psa-crypto/scripts/project_knowledge/tf_psa_crypto_test_case_info.py`,
we can drop the backward compatibilty hacks and simply
`import tf_psa_crypto_test_case_info` unconditionally and use
`tf_psa_crypto_test_case_info.INTERNAL_TEST_CASES` unconditionally.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-08 18:00:45 +02:00
Gilles Peskine
da2b5d6f42 Add tf-psa-crypto/scripts/project_knowledge to Python load path 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-08 18:00:45 +02:00
Ben Taylor
e18c52e93d Update framework pointer to bring in fix for python imports 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-08 11:01:05 +01:00
Ben Taylor
ce8c6708dd Update tf-psa-crypto to bring in python fix 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2026-05-08 11:00:50 +01:00
Gilles Peskine
465d6e9669 Fix ssl_tls13_prepare_new_session_ticket returning 1 on an RNG failure 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-05-04 18:44:05 +02:00
Valerio Setti
cfb07a923d changelog: add note about fix of issue 10740 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-29 17:10:04 +02:00
Valerio Setti
23538fd562 include mbedtls_platform_requirements.h in mbedtls_config.c 
This is required because if the user defined configuration file (not the
default one provided by mbedtls) includes files from the standard
C library then __STDC_WANT_LIB_EXT1__ won't be defined there which
cause weird build failures.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-29 17:10:04 +02:00
minosgalanakis
8f8b35b41c
Merge pull request #10711 from valord577/patch-1-backport-v4 
[backport 4.1 #10695] Fix build warning/error using llvm-mingw
 2026-04-29 14:52:04 +00:00
Gilles Peskine
ded271a8c4
Merge pull request #10696 from yiwu0b11/destdir_install_env_support-4.1 
Backport 4.1: Support DESTDIR for install and add build-system test
 2026-04-29 14:37:40 +00:00
Valerio Setti
5875ffa6fc
Merge pull request #10713 from valeriosetti/backport-pr10650 
[backport 4.1] check_config: add missing check for TLS 1.3 key exchanges
 2026-04-24 14:32:42 +00:00
Valerio Setti
b4df7bb14d
Merge pull request #10712 from valeriosetti/backport-pr10639 
[backport 4.1] library: check_config: remove RSA encryption requirement from ECDHE-RSA
 2026-04-24 07:30:58 +00:00
Valerio Setti
f2ab107392 check_config: fix error message for missing TLS 1.2 key exchanges 
Align the error message to the one used for the same check in TLS 1.3.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-23 14:51:52 +02:00
Valerio Setti
1caa7db5e8 check_config: add check for TLS 1.3 key exchanges 
When MBEDTLS_SSL_PROTO_TLS1_3 is enabled ensure that at least one of the
related key exchanges is also enabled.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-23 14:51:48 +02:00
Valerio Setti
377cbb2055 tests: depends.py: extend pkalgs including PSA_WANT_ALG_RSA_PKCS1V15_SIGN 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-22 17:17:41 +02:00
Valerio Setti
9d4447fdc5 tests: depends.py: fix reverse dependency for RSA 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-22 17:17:41 +02:00
Valerio Setti
2882b73697 library: check_config: remove RSA encryption requirement from ECDHE-RSA 
ECDHE-RSA only requires RSA signature, not encryption. This commits fixes
guards in "mbedtls_check_config.h".

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2026-04-22 17:17:41 +02:00
valord577
fce010911c update ChangeLog 
Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:09:29 +08:00
valord577
3bf4af0838 add ChangeLog 
Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:09:21 +08:00
valord577
fb43ea9278 Fix build warning/error using llvm-mingw 
error logs refs: https://github.com/valord577/nativepkgs/actions/runs/24490614774/job/71574726128

Signed-off-by: valord577 <valord577@gmail.com>
 2026-04-22 11:09:16 +08:00
Yi Wu
c7b630ffa1 tests: remove remaining FFDH code in compat.sh 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-21 10:33:54 +01:00
Ronald Cron
6a5e0139f8
Merge pull request #10703 from minosgalanakis/docs/4.1.0_changelog_fixes_bp 
ChangeLog 4.1 Fixed references to TF-PSA-Crypto
 2026-04-20 09:49:28 +00:00
Yi Wu
7c63e641e3 test: improve symlink checks 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
6c63f39eeb test: versioned symlink order fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
5bddf62a69 test: reorder if-else structure 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
9d88e0b200 test: add debug output and fix for win config 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
0dc58e196d ChangeLog fix 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00
Yi Wu
ee0f8cbc11 tests: fix DESTDIR install checks and add macOS compatibility 
Signed-off-by: Yi Wu <yi.wu2@arm.com>
 2026-04-20 10:48:29 +01:00