Merge fd919be981709f8fc4ac77d640b4547b3862bb01 into d8d5ea7cbc42b7800a3b030fb4341810074e7cb0

Backport 4.1: Fix resource leak in populate transform

ChangeLog.d/fix-ENABLE_PROGRAMS-bug.txt

@@ -0,0 +1,2 @@
+Bugfix
+   * Fix failure of cmake -DENABLE_PROGRAMS=OFF. Fixes #10587.

ChangeLog.d/tls13-transform-resource-leak.txt

@@ -0,0 +1,4 @@
+Bugfix
+   * Fix a resource leak in TLS 1.3 transform setup when importing the
+     decryption traffic key fails after the encryption traffic key has already
+     been imported. Fixes #10917.

library/ssl_tls13_keys.c

@@ -1034,6 +1034,8 @@ int mbedtls_ssl_tls13_populate_transform(
                                      &transform->psa_key_dec)) != PSA_SUCCESS) {
             MBEDTLS_SSL_DEBUG_RET(
                 1, "psa_import_key", PSA_TO_MBEDTLS_ERR(status));
+            psa_destroy_key(transform->psa_key_enc);
+            transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
             return PSA_TO_MBEDTLS_ERR(status);
         }
     }

programs/ssl/ssl_client2.c

@@ -258,7 +258,8 @@ int main(void)
 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
 #define USAGE_SIG_ALGS \
     "    sig_algs=a,b,c,d      default: \"default\" (library default)\n"  \
-    "                          example: \"ecdsa_secp256r1_sha256,ecdsa_secp384r1_sha384\"\n"
+    "                          example: \"ecdsa_secp256r1_sha256,ecdsa_secp384r1_sha384\"\n" \
+    "                          or a TLS 1.2 (hash,sig) pair as 4 hex digits (e.g. \"0401\")\n"
 #else
 #define USAGE_SIG_ALGS ""
 #endif
@@ -1561,73 +1562,18 @@ usage:
         }
     }
 
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
     if (opt.sig_algs != NULL) {
-        p = (char *) opt.sig_algs;
+        ret = parse_sig_algs(opt.sig_algs, sig_alg_list, SIG_ALG_LIST_SIZE);
-        i = 0;
+        if (ret != 0) {
-
-        /* Leave room for a final MBEDTLS_TLS1_3_SIG_NONE in signature algorithm list (sig_alg_list). */
-        while (i < SIG_ALG_LIST_SIZE - 1 && *p != '\0') {
-            q = p;
-
-            /* Terminate the current string */
-            while (*p != ',' && *p != '\0') {
-                p++;
-            }
-            if (*p == ',') {
-                *p++ = '\0';
-            }
-
-            if (strcmp(q, "rsa_pkcs1_sha256") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256;
-            } else if (strcmp(q, "rsa_pkcs1_sha384") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384;
-            } else if (strcmp(q, "rsa_pkcs1_sha512") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512;
-            } else if (strcmp(q, "ecdsa_secp256r1_sha256") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256;
-            } else if (strcmp(q, "ecdsa_secp384r1_sha384") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384;
-            } else if (strcmp(q, "ecdsa_secp521r1_sha512") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512;
-            } else if (strcmp(q, "rsa_pss_rsae_sha256") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256;
-            } else if (strcmp(q, "rsa_pss_rsae_sha384") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384;
-            } else if (strcmp(q, "rsa_pss_rsae_sha512") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512;
-            } else if (strcmp(q, "ed25519") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED25519;
-            } else if (strcmp(q, "ed448") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED448;
-            } else if (strcmp(q, "rsa_pss_pss_sha256") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256;
-            } else if (strcmp(q, "rsa_pss_pss_sha384") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384;
-            } else if (strcmp(q, "rsa_pss_pss_sha512") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512;
-            } else if (strcmp(q, "rsa_pkcs1_sha1") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1;
-            } else if (strcmp(q, "ecdsa_sha1") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SHA1;
-            } else {
-                ret = -1;
-                mbedtls_printf("unknown signature algorithm \"%s\"\n", q);
-                mbedtls_print_supported_sig_algs();
-                goto exit;
-            }
-        }
-
-        if (i == (SIG_ALG_LIST_SIZE - 1) && *p != '\0') {
-            mbedtls_printf("signature algorithm list too long, maximum %d",
-                           SIG_ALG_LIST_SIZE - 1);
             goto exit;
         }
-
-        sig_alg_list[i] = MBEDTLS_TLS1_3_SIG_NONE;
     }
 #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
 
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+
 #if defined(MBEDTLS_SSL_ALPN)
     if (opt.alpn_string != NULL) {
         p = (char *) opt.alpn_string;

programs/ssl/ssl_server2.c

@@ -446,7 +446,8 @@ int main(void)
 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
 #define USAGE_SIG_ALGS \
     "    sig_algs=a,b,c,d      default: \"default\" (library default)\n"  \
-    "                          example: \"ecdsa_secp256r1_sha256,ecdsa_secp384r1_sha384\"\n"
+    "                          example: \"ecdsa_secp256r1_sha256,ecdsa_secp384r1_sha384\"\n" \
+    "                          or a TLS 1.2 (hash,sig) pair as 4 hex digits (e.g. \"0401\")\n"
 #else
 #define USAGE_SIG_ALGS ""
 #endif
@@ -2435,71 +2436,16 @@ usage:
         }
     }
 
+#if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
 #if defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED)
     if (opt.sig_algs != NULL) {
-        p = (char *) opt.sig_algs;
+        ret = parse_sig_algs(opt.sig_algs, sig_alg_list, SIG_ALG_LIST_SIZE);
-        i = 0;
+        if (ret != 0) {
-
-        /* Leave room for a final MBEDTLS_TLS1_3_SIG_NONE in signature algorithm list (sig_alg_list). */
-        while (i < SIG_ALG_LIST_SIZE - 1 && *p != '\0') {
-            q = p;
-
-            /* Terminate the current string */
-            while (*p != ',' && *p != '\0') {
-                p++;
-            }
-            if (*p == ',') {
-                *p++ = '\0';
-            }
-
-            if (strcmp(q, "rsa_pkcs1_sha256") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256;
-            } else if (strcmp(q, "rsa_pkcs1_sha384") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384;
-            } else if (strcmp(q, "rsa_pkcs1_sha512") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512;
-            } else if (strcmp(q, "ecdsa_secp256r1_sha256") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256;
-            } else if (strcmp(q, "ecdsa_secp384r1_sha384") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384;
-            } else if (strcmp(q, "ecdsa_secp521r1_sha512") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512;
-            } else if (strcmp(q, "rsa_pss_rsae_sha256") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256;
-            } else if (strcmp(q, "rsa_pss_rsae_sha384") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384;
-            } else if (strcmp(q, "rsa_pss_rsae_sha512") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512;
-            } else if (strcmp(q, "ed25519") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED25519;
-            } else if (strcmp(q, "ed448") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ED448;
-            } else if (strcmp(q, "rsa_pss_pss_sha256") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256;
-            } else if (strcmp(q, "rsa_pss_pss_sha384") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384;
-            } else if (strcmp(q, "rsa_pss_pss_sha512") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512;
-            } else if (strcmp(q, "rsa_pkcs1_sha1") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1;
-            } else if (strcmp(q, "ecdsa_sha1") == 0) {
-                sig_alg_list[i++] = MBEDTLS_TLS1_3_SIG_ECDSA_SHA1;
-            } else {
-                ret = -1;
-                mbedtls_printf("unknown signature algorithm \"%s\"\n", q);
-                mbedtls_print_supported_sig_algs();
-                goto exit;
-            }
-        }
-
-        if (i == (SIG_ALG_LIST_SIZE - 1) && *p != '\0') {
-            mbedtls_printf("signature algorithm list too long, maximum %d",
-                           SIG_ALG_LIST_SIZE - 1);
             goto exit;
         }
-
-        sig_alg_list[i] = MBEDTLS_TLS1_3_SIG_NONE;
     }
+#endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+
 #endif
 
 #if defined(MBEDTLS_SSL_ALPN)

programs/ssl/ssl_test_common_source.c

@@ -351,25 +351,4 @@ static int x509_crt_verify_info(char *buf, size_t size, const char *prefix,
 #endif /* MBEDTLS_X509_REMOVE_INFO */
 }
 
-static void mbedtls_print_supported_sig_algs(void)
-{
-    mbedtls_printf("supported signature algorithms:\n");
-    mbedtls_printf("\trsa_pkcs1_sha256 ");
-    mbedtls_printf("rsa_pkcs1_sha384 ");
-    mbedtls_printf("rsa_pkcs1_sha512\n");
-    mbedtls_printf("\tecdsa_secp256r1_sha256 ");
-    mbedtls_printf("ecdsa_secp384r1_sha384 ");
-    mbedtls_printf("ecdsa_secp521r1_sha512\n");
-    mbedtls_printf("\trsa_pss_rsae_sha256 ");
-    mbedtls_printf("rsa_pss_rsae_sha384 ");
-    mbedtls_printf("rsa_pss_rsae_sha512\n");
-    mbedtls_printf("\trsa_pss_pss_sha256 ");
-    mbedtls_printf("rsa_pss_pss_sha384 ");
-    mbedtls_printf("rsa_pss_pss_sha512\n");
-    mbedtls_printf("\ted25519 ");
-    mbedtls_printf("ed448 ");
-    mbedtls_printf("rsa_pkcs1_sha1 ");
-    mbedtls_printf("ecdsa_sha1\n");
-    mbedtls_printf("\n");
-}
 #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */

programs/ssl/ssl_test_lib.c

@@ -495,4 +495,127 @@ int parse_groups(const char *groups, uint16_t *group_list, size_t group_list_len
     return 0;
 }
 
+
+void mbedtls_print_supported_sig_algs(void)
+{
+    mbedtls_printf("supported signature algorithms:\n");
+    mbedtls_printf("\trsa_pkcs1_sha256 ");
+    mbedtls_printf("rsa_pkcs1_sha384 ");
+    mbedtls_printf("rsa_pkcs1_sha512\n");
+    mbedtls_printf("\tecdsa_secp256r1_sha256 ");
+    mbedtls_printf("ecdsa_secp384r1_sha384 ");
+    mbedtls_printf("ecdsa_secp521r1_sha512\n");
+    mbedtls_printf("\trsa_pss_rsae_sha256 ");
+    mbedtls_printf("rsa_pss_rsae_sha384 ");
+    mbedtls_printf("rsa_pss_rsae_sha512\n");
+    mbedtls_printf("\trsa_pss_pss_sha256 ");
+    mbedtls_printf("rsa_pss_pss_sha384 ");
+    mbedtls_printf("rsa_pss_pss_sha512\n");
+    mbedtls_printf("\ted25519 ");
+    mbedtls_printf("ed448 ");
+    mbedtls_printf("rsa_pkcs1_sha1 ");
+    mbedtls_printf("ecdsa_sha1\n");
+    mbedtls_printf("\n");
+}
+
+static int sig_alg_hex_digit(char c)
+{
+    if (c >= '0' && c <= '9') {
+        return c - '0';
+    }
+    if (c >= 'a' && c <= 'f') {
+        return c - 'a' + 10;
+    }
+    if (c >= 'A' && c <= 'F') {
+        return c - 'A' + 10;
+    }
+    return -1;
+}
+
+int parse_sig_algs(const char *sig_algs, uint16_t *sig_alg_list,
+                   size_t sig_alg_list_len)
+{
+    typedef struct {
+        const char *name;
+        uint16_t id;
+    } sig_alg_name_t;
+
+    static const sig_alg_name_t sig_alg_names[] = {
+        { "rsa_pkcs1_sha256", MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256 },
+        { "rsa_pkcs1_sha384", MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384 },
+        { "rsa_pkcs1_sha512", MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512 },
+        { "ecdsa_secp256r1_sha256", MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256 },
+        { "ecdsa_secp384r1_sha384", MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384 },
+        { "ecdsa_secp521r1_sha512", MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512 },
+        { "rsa_pss_rsae_sha256", MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256 },
+        { "rsa_pss_rsae_sha384", MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384 },
+        { "rsa_pss_rsae_sha512", MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512 },
+        { "ed25519", MBEDTLS_TLS1_3_SIG_ED25519 },
+        { "ed448", MBEDTLS_TLS1_3_SIG_ED448 },
+        { "rsa_pss_pss_sha256", MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256 },
+        { "rsa_pss_pss_sha384", MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384 },
+        { "rsa_pss_pss_sha512", MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512 },
+        { "rsa_pkcs1_sha1", MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1 },
+        { "ecdsa_sha1", MBEDTLS_TLS1_3_SIG_ECDSA_SHA1 },
+    };
+
+    const char *p = sig_algs;
+    size_t i = 0;
+
+    /* Leave room for a final MBEDTLS_TLS1_3_SIG_NONE in sig_alg_list. */
+    while (i < sig_alg_list_len - 1 && *p != '\0') {
+        size_t name_len = strcspn(p, ",");
+        uint16_t sig_alg = 0;
+        size_t j;
+        int found = 0;
+
+        if (name_len == 4) {
+            /* A TLS 1.2 (hash, signature) pair given as 4 hex digits. */
+            int d0 = sig_alg_hex_digit(p[0]);
+            int d1 = sig_alg_hex_digit(p[1]);
+            int d2 = sig_alg_hex_digit(p[2]);
+            int d3 = sig_alg_hex_digit(p[3]);
+
+            if (d0 >= 0 && d1 >= 0 && d2 >= 0 && d3 >= 0) {
+                sig_alg = (uint16_t) ((d0 << 12) | (d1 << 8) |
+                                      (d2 << 4) | d3);
+                found = 1;
+            }
+        }
+
+        if (!found) {
+            for (j = 0; j < ARRAY_LENGTH(sig_alg_names); j++) {
+                if (strlen(sig_alg_names[j].name) == name_len &&
+                    strncmp(p, sig_alg_names[j].name, name_len) == 0) {
+                    sig_alg = sig_alg_names[j].id;
+                    found = 1;
+                    break;
+                }
+            }
+        }
+
+        if (!found) {
+            mbedtls_printf("unknown signature algorithm \"%.*s\"\n",
+                           (int) name_len, p);
+            mbedtls_print_supported_sig_algs();
+            return -1;
+        }
+
+        sig_alg_list[i++] = sig_alg;
+        p += name_len;
+        if (*p == ',') {
+            p++;
+        }
+    }
+
+    if (i == sig_alg_list_len - 1 && *p != '\0') {
+        mbedtls_printf("signature algorithm list too long, maximum %u",
+                       (unsigned int) (sig_alg_list_len - 1));
+        return -1;
+    }
+
+    sig_alg_list[i] = MBEDTLS_TLS1_3_SIG_NONE;
+    return 0;
+}
+
 #endif /* !defined(MBEDTLS_SSL_TEST_IMPOSSIBLE) */

programs/ssl/ssl_test_lib.h

@@ -268,5 +268,25 @@ void test_hooks_free(void);
 /* Helper functions for FFDH groups. */
 int parse_groups(const char *groups, uint16_t *group_list, size_t group_list_len);
 
+/** Parse command-line option: sig_algs
+ *
+ * \param sig_algs          Comma-separated list of signature algorithms.
+ *                          Each element is either a TLS 1.3 signature
+ *                          algorithm name (e.g. "rsa_pkcs1_sha256"), or a
+ *                          TLS 1.2 (hash, signature) pair given as 4 hex
+ *                          digits (e.g. "0401" for SHA-256 with RSA).
+ * \param sig_alg_list      Array to fill with the parsed list.
+ * \param sig_alg_list_len  Length of \p sig_alg_list. Room is left for a
+ *                          terminating MBEDTLS_TLS1_3_SIG_NONE.
+ *
+ * \return                  \c 0 on success.
+ * \return                  \c -1 on parse error.
+ */
+int parse_sig_algs(const char *sig_algs, uint16_t *sig_alg_list,
+                   size_t sig_alg_list_len);
+
+void mbedtls_print_supported_sig_algs(void);
+
+
 #endif /* MBEDTLS_SSL_TEST_IMPOSSIBLE conditions: else */
 #endif /* MBEDTLS_PROGRAMS_SSL_SSL_TEST_LIB_H */

tests/CMakeLists.txt

@@ -66,7 +66,9 @@ if(GEN_FILES)
     add_custom_target(handshake-generated.sh
         DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/handshake-generated.sh)
     set_target_properties(handshake-generated.sh PROPERTIES EXCLUDE_FROM_ALL NO)
+if(ENABLE_PROGRAMS)
     add_dependencies(${ssl_opt_target} handshake-generated.sh)
+endif()
 
     add_custom_command(
         OUTPUT
@@ -79,10 +81,12 @@ if(GEN_FILES)
         DEPENDS
             ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_tls13_compat_tests.py
     )
+if(ENABLE_PROGRAMS)
     add_custom_target(tls13-compat.sh
         DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/tls13-compat.sh)
     set_target_properties(tls13-compat.sh PROPERTIES EXCLUDE_FROM_ALL NO)
     add_dependencies(${ssl_opt_target} tls13-compat.sh)
+endif()
 
 else()
     foreach(file ${all_generated_data_files})

tests/ssl-opt.sh

@@ -2589,6 +2589,63 @@ run_test    "Single supported algorithm sending: openssl client" \
                     -key $DATA_FILES_PATH/server6.key" \
             0
 
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
+requires_config_enabled PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
+requires_hash_alg SHA_256
+run_test    "TLS 1.2: sig_algs (hash,sig) hex pair accepted with RSA server cert" \
+            "$P_SRV force_version=tls12 \
+             crt_file=$DATA_FILES_PATH/server2-sha256.crt key_file=$DATA_FILES_PATH/server2.key" \
+            "$P_CLI force_version=tls12 sig_algs=0401" \
+            0 \
+            -s "Ciphersuite is" \
+            -c "Ciphersuite is"
+
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
+requires_config_enabled PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
+requires_hash_alg SHA_256
+run_test    "TLS 1.2: sig_algs policy - hash accepted but signature rejected (client)" \
+            "$P_SRV force_version=tls12 \
+             crt_file=$DATA_FILES_PATH/server2-sha256.crt key_file=$DATA_FILES_PATH/server2.key" \
+            "$P_CLI force_version=tls12 sig_algs=0403" \
+            1 \
+            -s "The handshake negotiation failed" \
+            -c "Last error was: -0x7780 - SSL - A fatal alert message was received from our peer"
+
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
+requires_config_enabled PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
+requires_hash_alg SHA_256
+requires_hash_alg SHA_384
+run_test    "TLS 1.2: sig_algs policy - signature accepted but hash rejected (server)" \
+            "$P_SRV force_version=tls12 sig_algs=0501 \
+             crt_file=$DATA_FILES_PATH/server2-sha256.crt key_file=$DATA_FILES_PATH/server2.key" \
+            "$P_CLI force_version=tls12 sig_algs=0401" \
+            1 \
+            -s "The handshake negotiation failed" \
+            -c "Last error was: -0x7780 - SSL - A fatal alert message was received from our peer"
+
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+requires_config_enabled MBEDTLS_SSL_CLI_C
+requires_config_enabled MBEDTLS_SSL_SRV_C
+requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
+requires_config_enabled PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC
+requires_hash_alg SHA_256
+run_test    "TLS 1.2: sig_algs policy - server rejects its certificate's signature type" \
+            "$P_SRV force_version=tls12 sig_algs=0403 \
+             crt_file=$DATA_FILES_PATH/server2-sha256.crt key_file=$DATA_FILES_PATH/server2.key" \
+            "$P_CLI force_version=tls12" \
+            1 \
+            -s "The handshake negotiation failed" \
+            -c "Last error was: -0x7780 - SSL - A fatal alert message was received from our peer"
+
 # Tests for certificate verification callback
 run_test    "Configuration-specific CRT verification callback" \
             "$P_SRV debug_level=3" \

tests/suites/test_suite_ssl.data

@@ -2856,6 +2856,9 @@ SSL TLS 1.3 Record Encryption RFC 8448 Example #2
 depends_on:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_GCM:PSA_WANT_ALG_SHA_256
 ssl_tls13_record_protection:MBEDTLS_TLS1_3_AES_128_GCM_SHA256:MBEDTLS_SSL_IS_SERVER:1:1:"9f02283b6c9c07efc26bb9f2ac92e356":"cf782b88dd83549aadf1e984":"17422dda596ed5d9acd890e3c63f5051":"5b78923dee08579033e523d9":"000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f3031":"2e937e11ef4ac740e538ad36005fc4a46932fc3225d05f82aa1b36e30efaf97d90e6dffc602dcb501a59a8fcc49c4bf2e5f0a21c0047c2abf332540dd032e167c2955d"
 
+TLS 1.3 transform frees encryption key if decryption key import fails
+ssl_tls13_populate_transform_second_key_import_failure
+
 SSL TLS 1.3 Key schedule: Application secrets derivation helper
 # Vector from RFC 8448
 depends_on:PSA_WANT_ALG_SHA_256

tests/suites/test_suite_ssl.function

@@ -8,6 +8,7 @@
 #endif /* MBEDTLS_PK_HAVE_PRIVATE_HEADER */
 #include <ssl_tls13_keys.h>
 #include <ssl_tls13_invasive.h>
+#include <psa_crypto_slot_management.h>
 #include <test/ssl_helpers.h>
 #include <test/ssl_helpers_internal.h>
 
@@ -114,6 +115,36 @@ static void tls_abort_transcript(void *ctx, int level,
 }
 #endif
 
+#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC)
+#if defined(MBEDTLS_TEST_HOOKS) && defined(MBEDTLS_SSL_CLI_C) && \
+    defined(MBEDTLS_PSA_CRYPTO_C)
+#define SSL_TEST_KEY_SLICE_1_LENGTH 4
+#define SSL_TEST_KEY_SLICE_2_LENGTH 10
+static size_t ssl_test_tiny_key_slice_length(size_t slice_idx)
+{
+    switch (slice_idx) {
+        case 1: return SSL_TEST_KEY_SLICE_1_LENGTH;
+        case 2: return SSL_TEST_KEY_SLICE_2_LENGTH;
+        default: return 1;
+    }
+}
+
+/* In the below definition SSL_TEST_KEY_SLICE_1_LENGTH has 4 slots and
+ * SSL_TEST_KEY_SLICE_2_LENGTH has 10 all other slices have 1.
+ * psa_key_slot_volatile_slice_count() returns the total number of slices.
+ * However we have already countes slices 1 and 2, so we mustr subtract 2 from
+ * this number to avoid double counting.
+ */
+
+#define SSL_TEST_MAX_VOLATILE_KEYS                         \
+    (SSL_TEST_KEY_SLICE_1_LENGTH +                         \
+     SSL_TEST_KEY_SLICE_2_LENGTH +                         \
+     psa_key_slot_volatile_slice_count() - 2)
+#endif /* MBEDTLS_TEST_HOOKS && MBEDTLS_SSL_CLI_C */
+#else /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */
+#define SSL_TEST_MAX_VOLATILE_KEYS MBEDTLS_PSA_KEY_SLOT_COUNT
+#endif /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */
+
 #if (!defined(MBEDTLS_SSL_PROTO_TLS1_2)) && \
     defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_CLI_C) && \
     defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_DEBUG_C) && \
@@ -2489,6 +2520,85 @@ exit:
 }
 /* END_CASE */
 
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:SSL_TEST_MAX_VOLATILE_KEYS:MBEDTLS_PSA_CRYPTO_C */
+void ssl_tls13_populate_transform_second_key_import_failure(void)
+{
+    mbedtls_ssl_key_set traffic_keys;
+    mbedtls_ssl_transform transform;
+    mbedtls_svc_key_id_t *keys = NULL;
+    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
+    mbedtls_psa_stats_t stats_before, stats_after;
+    psa_status_t status = PSA_SUCCESS;
+    size_t i = 0;
+
+    memset(&traffic_keys, 0, sizeof(traffic_keys));
+    mbedtls_ssl_transform_init(&transform);
+
+#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) && defined(MBEDTLS_TEST_HOOKS)
+    mbedtls_test_hook_psa_volatile_key_slice_length =
+        ssl_test_tiny_key_slice_length;
+#endif
+
+    PSA_INIT();
+    TEST_CALLOC(keys, SSL_TEST_MAX_VOLATILE_KEYS + 1);
+
+    psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT);
+    psa_set_key_type(&attributes, PSA_KEY_TYPE_RAW_DATA);
+
+    /* Allow one more attempt than the maximum number of volatile keys so
+     * that the loop ends because the key store is full. */
+    while (i <= SSL_TEST_MAX_VOLATILE_KEYS) {
+        status = psa_import_key(&attributes,
+                                (const uint8_t *) &i, sizeof(i),
+                                &keys[i]);
+        if (status == PSA_ERROR_INSUFFICIENT_MEMORY) {
+            break;
+        }
+        PSA_ASSERT(status);
+        i++;
+    }
+    TEST_EQUAL(status, PSA_ERROR_INSUFFICIENT_MEMORY);
+    TEST_ASSERT(i > 0);
+
+    /* Leave exactly one slot free: the encryption key import consumes it,
+     * then the decryption key import fails. */
+    PSA_ASSERT(psa_destroy_key(keys[--i]));
+    keys[i] = MBEDTLS_SVC_KEY_ID_INIT;
+    mbedtls_psa_get_stats(&stats_before);
+
+    traffic_keys.key_len = 16;
+    traffic_keys.iv_len = 12;
+    TEST_ASSERT(mbedtls_ssl_tls13_populate_transform(
+                    &transform, MBEDTLS_SSL_IS_CLIENT,
+                    MBEDTLS_TLS1_3_AES_128_GCM_SHA256,
+                    &traffic_keys, NULL) != 0);
+
+    /* The first import must be rolled back when the second one fails. */
+    TEST_ASSERT(mbedtls_svc_key_id_is_null(transform.psa_key_enc));
+
+    /* Also check the key store itself: the failed operation must neither
+     * consume a slot nor leave the only free slot unusable. */
+    mbedtls_psa_get_stats(&stats_after);
+    TEST_EQUAL(stats_after.volatile_slots, stats_before.volatile_slots);
+    TEST_EQUAL(stats_after.empty_slots, stats_before.empty_slots);
+    PSA_ASSERT(psa_import_key(&attributes,
+                              (const uint8_t *) &i, sizeof(i),
+                              &keys[i]));
+    i++;
+
+exit:
+    mbedtls_ssl_transform_free(&transform);
+    while (i > 0) {
+        psa_destroy_key(keys[--i]);
+    }
+    mbedtls_free(keys);
+    PSA_DONE();
+#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) && defined(MBEDTLS_TEST_HOOKS)
+    mbedtls_test_hook_psa_volatile_key_slice_length = NULL;
+#endif
+}
+/* END_CASE */
+
 /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */
 void ssl_tls13_key_evolution(int hash_alg,
                              data_t *secret,