RFC 5280 defines cA as BOOLEAN DEFAULT FALSE, so a basicConstraints
extension containing only pathLenConstraint (SEQUENCE { INTEGER n })
is syntactically valid and must be interpreted as cA=FALSE. The fix
for CVE-2026-49300 rejected this encoding outright, breaking
compatibility with certificates emitted by devices such as
Eaton/CODESYS PLCs.
Tolerate MBEDTLS_ERR_ASN1_UNEXPECTED_TAG from the cA BOOLEAN parse,
keeping cA FALSE and letting the existing INTEGER parser validate
pathLenConstraint. The INTEGER value is never used to determine cA,
so the CVE fix is preserved.
Fixes#11006
Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
(cherry picked from commit 62dd8a556c01cc289d4fb3f19352a78ede90dac2)
This is a manual backport, not a direct cherry-pick, because 3.6 can build TLS without PSA-backed transforms. Gate the regression on MBEDTLS_USE_PSA_CRYPTO.
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
(cherry picked from commit 95e95268a4c26608612f34f2bb76ff1dfa9ded0a)
Backport of f79eac885dec294d6e441bada15be1605dcb75b0. Adapt the check and tests to the 3.6 OID parser.
Refs Mbed-TLS/mbedtls#10911.
Signed-off-by: subotac <73706465+subotac@users.noreply.github.com>
Backport the ssl_context_load_rejects_oob_length test function from
development in its final form, with cases for the serialized in_cid,
out_cid and ALPN lengths.
mbedtls_test_ssl_dtls_join_endpoints() and
mbedtls_test_ssl_perform_connection() do not exist on this branch, so
set up the DTLS endpoints and run the handshake with the helpers that
do: mbedtls_test_ssl_endpoint_init() with message queues,
mbedtls_test_mock_socket_connect() and
mbedtls_test_move_handshake_to_state(). Exchange application data
explicitly before saving the context, as
mbedtls_test_ssl_perform_connection() does on development: the server
keeps its handshake structure until then, and
mbedtls_ssl_context_save() refuses to run while it exists.
Signed-off-by: Naveed <naveed@bugqore.com>
An empty AuthorityKeyIdentifier SEQUENCE must parse. A [0] tag without
a length must still be rejected; that case already passed before the
fix and guards against loosening the check too much.
Backport to 3.6: the dependencies use the legacy configuration macros
(MBEDTLS_PK_CAN_ECDSA_SOME, MBEDTLS_ECP_HAVE_SECP256R1,
MBEDTLS_MD_CAN_SHA256) instead of PSA_WANT_*, and the expected error is
written as a sum, like the neighbouring AuthorityKeyIdentifier tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Christopher Müller <chris@mechatronikmonkey.de>
ClientHello: narrow the session-id check to the session id itself, check
the cookie length byte before reading it, and let the ciphersuite-list
length check cover both transports.
CertificateRequest: make the signature-algorithms check also reserve the
two certificate-authorities length bytes instead of adding a separate
check, use the available < needed pattern throughout, and reject an
odd-length signature-algorithms list.
Add injected truncated-ClientHello test cases (TLS 1.2-only builds).
Signed-off-by: Naveed <naveed@bugqore.com>
In terms of CMake, we want it to be part of the mbedtls_test_helpers
object collection, which as the name does not suggest, is actually for
SSL, and not part of mbedtls_test which is generic.
The easiest way to achieve that is to move the source file to
test_helpers which again as the name does not reflect is for SSL.
Then we just need ssl_server2 and ssl_client2 to link to
mbedtls_test_helpers.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
Call mbedtls_test_ssl_check_context_after_session_reset both in programs
(ssl_client2 and ssl_server2) and tests to ensure that the SSL context
has been properly handled when mbedtls_ssl_session_reset was called.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Ideally the implementation shouldn't be checked in git, but for the time
being there is no support in building source code for tests from the
binary folder, so it's accepted as a temporary solution.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Togethere with the framework counterpart ('ssl_session_reset_check.py')
this script is used to automatically generate the function
'mbedtls_test_ssl_check_context_after_session_reset()'.
The goal of this function is to verify that 'mbedtls_ssl_session_reset()'
properly handled (reset or keep) all the fields of the
'mbedtls_ssl_context' structure.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Move functions in "ssl_helpers.h" that depend on internal headers to
"ssl_helpers_internal.h". This allows to include "ssl_helpers.h" also
in programs (which do not have access to internal headers).
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
This is a manual backport, not a direct cherry-pick, because the 3.6 branch uses different file paths and keeps a direct PSA_ALG_JPAKE comparison in the PAKE size macros.
(cherry picked from commit ebda5da117af7e57bad47bc3337e364365a8f357)
