Merge c4a5ad3f126b6bc27b92d296c32565623b80015f into cac9589a97fb9d07a115b42fa10523bc226b5180

Add fix for -DENABLE_PROGRAMS=OFF build error

ChangeLog.d/fix-ENABLE_PROGRAMS-bug.txt

@@ -0,0 +1,2 @@
+Bugfix
+   * Fix failure of cmake -DENABLE_PROGRAMS=OFF. Fixes #10587.

ChangeLog.d/tls12-handshake-length-read-bounds.txt

@@ -0,0 +1,10 @@
+Bugfix
+   * Fix a buffer over-read when parsing a TLS 1.2 ClientHello or
+     CertificateRequest that is truncated inside the two-byte length field
+     of the ciphersuite list (server side) or of the certificate
+     authorities list (client side): the length checks preceding those
+     fields reserved too few bytes, so the length field could be read past
+     the end of the message. Such messages are now rejected before the
+     read.
+   * The TLS 1.2 client now rejects a CertificateRequest message whose
+     supported_signature_algorithms list has an odd length.

ChangeLog.d/x509-basic-constraints-integer-first.txt

@@ -0,0 +1,5 @@
+Bugfix
+   * Accept a basicConstraints extension that omits cA and contains only
+     pathLenConstraint, interpreting it as cA=FALSE as specified by RFC 5280.
+     This restores compatibility with certificates emitted by some devices
+     without accepting them as CA certificates. Fixes #11006.

ChangeLog.d/x509-empty-authority-key-id.txt

@@ -0,0 +1,7 @@
+Bugfix
+   * Accept X.509 certificates whose AuthorityKeyIdentifier extension is an
+     empty SEQUENCE. All of its fields are optional, so such certificates
+     are syntactically valid, but they were rejected with
+     MBEDTLS_ERR_X509_INVALID_EXTENSIONS. This affected, for example, the
+     root certificate that some antivirus products install for HTTPS
+     scanning. Reported by CodingMarkus. Fixes #10253.

framework

@@ -1 +1 @@
-Subproject commit 7d726d145d678aa7f5a7df3b9e7ee3dbce6ea1bf
+Subproject commit ced31491c5ec907a6be533512f19dc1779230ac1

library/ssl_tls12_client.c

@@ -2217,7 +2217,7 @@ static int ssl_parse_certificate_request(mbedtls_ssl_context *ssl)
     buf = ssl->in_msg;
 
     /* certificate_types */
-    if (ssl->in_hslen <= mbedtls_ssl_hs_hdr_len(ssl)) {
+    if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 1) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate request message"));
         mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
@@ -2227,16 +2227,10 @@ static int ssl_parse_certificate_request(mbedtls_ssl_context *ssl)
     n = cert_type_len;
 
     /*
-     * In the subsequent code there are two paths that read from buf:
-     *     * the length of the signature algorithms field (if minor version of
-     *       SSL is 3),
-     *     * distinguished name length otherwise.
-     * Both reach at most the index:
-     *    ...hdr_len + 2 + n,
-     * therefore the buffer length at this point must be greater than that
-     * regardless of the actual code path.
+     * The two-byte supported_signature_algorithms length is read next,
+     * at offset ...hdr_len + 1 + n.
      */
-    if (ssl->in_hslen <= mbedtls_ssl_hs_hdr_len(ssl) + 2 + n) {
+    if (ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 1 + n + 2) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate request message"));
         mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
@@ -2247,18 +2241,13 @@ static int ssl_parse_certificate_request(mbedtls_ssl_context *ssl)
     sig_alg_len = MBEDTLS_GET_UINT16_BE(buf, mbedtls_ssl_hs_hdr_len(ssl) + 1 + n);
 
     /*
-     * The furthest access in buf is in the loop few lines below:
-     *     sig_alg[i + 1],
-     * where:
-     *     sig_alg = buf + ...hdr_len + 3 + n,
-     *     max(i) = sig_alg_len - 1.
-     * Therefore the furthest access is:
-     *     buf[...hdr_len + 3 + n + sig_alg_len - 1 + 1],
-     * which reduces to:
-     *     buf[...hdr_len + 3 + n + sig_alg_len],
-     * which is one less than we need the buf to be.
+     * The list is a sequence of two-byte values, so its length must be
+     * even. The message must have room for the list itself, plus the
+     * two-byte certificate_authorities length that follows it and is
+     * read below.
      */
-    if (ssl->in_hslen <= mbedtls_ssl_hs_hdr_len(ssl) + 3 + n + sig_alg_len) {
+    if (sig_alg_len % 2 != 0 ||
+        ssl->in_hslen < mbedtls_ssl_hs_hdr_len(ssl) + 1 + n + 2 + sig_alg_len + 2) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("bad certificate request message"));
         mbedtls_ssl_send_alert_message(
             ssl,

library/ssl_tls12_server.c

@@ -1016,7 +1016,7 @@ static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
     sess_len = buf[34];
 
     if (sess_len > sizeof(ssl->session_negotiate->id) ||
-        sess_len + 34 + 2 > msg_len) { /* 2 for cipherlist length field */
+        sess_len + 35 > msg_len) {
         MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
         mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                        MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
@@ -1037,9 +1037,16 @@ static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if (ssl->conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM) {
         cookie_offset = 35 + sess_len;
+
+        if (cookie_offset + 1 > msg_len) {
+            MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
+            mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                           MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
+            return MBEDTLS_ERR_SSL_DECODE_ERROR;
+        }
         cookie_len = buf[cookie_offset];
 
-        if (cookie_offset + 1 + cookie_len + 2 > msg_len) {
+        if (cookie_offset + 1 + cookie_len > msg_len) {
             MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
             mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
                                            MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
@@ -1085,6 +1092,16 @@ static int ssl_parse_client_hello(mbedtls_ssl_context *ssl)
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
     ciph_offset = 35 + sess_len;
 
+    /* The two-byte ciphersuite list length field must be within the
+     * message: the checks above only guarantee that the fields before it
+     * (session id, and for DTLS the cookie) are. */
+    if (ciph_offset + 2 > msg_len) {
+        MBEDTLS_SSL_DEBUG_MSG(1, ("bad client hello message"));
+        mbedtls_ssl_send_alert_message(ssl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
+                                       MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR);
+        return MBEDTLS_ERR_SSL_DECODE_ERROR;
+    }
+
     ciph_len = MBEDTLS_GET_UINT16_BE(buf, ciph_offset);
 
     if (ciph_len < 2 ||

library/x509_crt.c

@@ -518,17 +518,19 @@ static int x509_get_basic_constraints(unsigned char **p,
     }
 
     if ((ret = mbedtls_asn1_get_bool(p, end, ca_istrue)) != 0) {
-        /* If the SEQUENCE starts with an INTEGER and not a BOOLEAN,
-         * according to RFC 5280, it's syntactically valid, but it's
-         * something that a CA MUST NOT produce. So we reject it.
+        /* cA is DEFAULT FALSE. If it is absent, the first element must
+         * be pathLenConstraint. Keep cA false and let the INTEGER parser
+         * below validate the element.
          *
          * Note: historically, from XySSL 0.9 to Mbed TLS 3.6.6/4.1.0,
          * `SEQUENCE { INTEGER n }` was interpreted as cA=FALSE if n == 0
          * and cA=TRUE if n != 0. This was dangerous since
          * `SEQUENCE { INTEGER n }` should be parsed as cA=FALSE
-         * according to RFC 5280, so we stopped doing it.
+         * according to RFC 5280.
          */
-        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
+        if (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
+            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
+        }
     }
     /* `SEQUENCE { BOOLEAN FALSE }` is not DER since default-value fields
      * must be omitted in DER. But it seems harmless, and Mbed TLS has
@@ -638,6 +640,11 @@ static int x509_get_authority_key_id(unsigned char **p,
                                  MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
     }
 
+    /* All fields are OPTIONAL, so an empty SEQUENCE is valid. */
+    if (*p == end) {
+        return 0;
+    }
+
     ret = mbedtls_asn1_get_tag(p, end, &len,
                                MBEDTLS_ASN1_CONTEXT_SPECIFIC);
 

tests/CMakeLists.txt

@@ -66,7 +66,9 @@ if(GEN_FILES)
     add_custom_target(handshake-generated.sh
         DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/handshake-generated.sh)
     set_target_properties(handshake-generated.sh PROPERTIES EXCLUDE_FROM_ALL NO)
+if(ENABLE_PROGRAMS)
     add_dependencies(${ssl_opt_target} handshake-generated.sh)
+endif()
 
     add_custom_command(
         OUTPUT
@@ -79,10 +81,12 @@ if(GEN_FILES)
         DEPENDS
             ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_tls13_compat_tests.py
     )
+if(ENABLE_PROGRAMS)
     add_custom_target(tls13-compat.sh
         DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/tls13-compat.sh)
     set_target_properties(tls13-compat.sh PROPERTIES EXCLUDE_FROM_ALL NO)
     add_dependencies(${ssl_opt_target} tls13-compat.sh)
+endif()
 
 else()
     foreach(file ${all_generated_data_files})

tests/scripts/components-configuration-crypto.sh

@@ -34,27 +34,6 @@ component_test_psa_assume_exclusive_buffers () {
     make test
 }
 
-component_test_crypto_with_static_key_slots() {
-    msg "build: crypto full + MBEDTLS_PSA_STATIC_KEY_SLOTS"
-    scripts/config.py crypto_full
-    scripts/config.py set MBEDTLS_PSA_STATIC_KEY_SLOTS
-    # Intentionally set MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE to a value that
-    # is enough to contain:
-    # - all RSA public keys up to 4096 bits (max of PSA_VENDOR_RSA_MAX_KEY_BITS).
-    # - RSA key pairs up to 1024 bits, but not 2048 or larger.
-    # - all FFDH key pairs and public keys up to 8192 bits (max of PSA_VENDOR_FFDH_MAX_KEY_BITS).
-    # - all EC key pairs and public keys up to 521 bits (max of PSA_VENDOR_ECC_MAX_CURVE_BITS).
-    scripts/config.py set MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 1212
-    # Disable the fully dynamic key store (default on) since it conflicts
-    # with the static behavior that we're testing here.
-    scripts/config.py unset MBEDTLS_PSA_KEY_STORE_DYNAMIC
-
-    msg "test: crypto full + MBEDTLS_PSA_STATIC_KEY_SLOTS"
-    CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
-    cmake --build .
-    ctest
-}
-
 # check_renamed_symbols HEADER LIB
 # Check that if HEADER contains '#define MACRO ...' then MACRO is not a symbol
 # name in LIB.

tests/scripts/depends.py

@@ -59,6 +59,7 @@ from mbedtls_framework import c_build_helper
 from mbedtls_framework import crypto_knowledge
 from mbedtls_framework import psa_information
 
+
 class Colors: # pylint: disable=too-few-public-methods
     """Minimalistic support for colored output.
 Each field of an object of this class is either None if colored output
@@ -188,15 +189,13 @@ If what is False, announce that the job has failed.'''
             header += f'defined({option})\n'
             header += f'#error "{option}"\n'
             header += '#endif\n'
-        include_path = ['include', 'tf-psa-crypto/include',
-                        'tf-psa-crypto/drivers/builtin/include']
 
         try:
             # Generate a C file, build and run it
             c_file, c_name, exe_name = c_build_helper.create_c_file(self.name)
             c_build_helper.generate_c_file(c_file, 'depends.py', header, lambda x: '')
             c_file.close()
-            c_build_helper.compile_c_file(c_name, exe_name, include_path)
+            c_build_helper.compile_c_file(c_name, exe_name)
             return True
 
         except c_build_helper.CompileError as e:

tests/suites/test_suite_ssl.tls-defrag.data

@@ -63,6 +63,26 @@ Inject ClientHello - TLS 1.2 unknown ciphersuite (for reference)
 depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_GCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_1
 inject_client_content_on_the_wire:MBEDTLS_PK_ECDSA:MBEDTLS_SSL_CLIENT_HELLO:"160303002f0100002b03030123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef000002cccc01000000":"got no ciphersuites in common":MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE
 
+# See "ClientHello breakdown" above
+# ClientHello body ending right after the session id: version (2) +
+# random (32) + session id length (1) + session id (3) = 38 bytes, the
+# minimum accepted, with the ciphersuite list length field missing
+# entirely. Only run in TLS 1.2-only builds: when TLS 1.3 is enabled,
+# the TLS 1.3 code parses the ClientHello first and rejects it itself.
+Inject ClientHello - TLS 1.2 truncated after session id
+depends_on:MBEDTLS_SSL_PROTO_TLS1_2:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_GCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_1
+inject_client_content_on_the_wire:MBEDTLS_PK_ECDSA:MBEDTLS_SSL_CLIENT_HELLO:"160303002a0100002603030123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef035f5f5f":"bad client hello message":MBEDTLS_ERR_SSL_DECODE_ERROR
+
+# See "ClientHello breakdown" above
+# ClientHello body ending inside the ciphersuite list length: version (2) +
+# random (32) + session id length (1) + session id (2) + first length
+# byte (1) = 38 bytes. Reading the full two-byte length field used to
+# over-read one byte past the end of the message.
+# Only run in TLS 1.2-only builds, see above.
+Inject ClientHello - TLS 1.2 truncated inside ciphersuite list length
+depends_on:MBEDTLS_SSL_PROTO_TLS1_2:!MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED:PSA_WANT_KEY_TYPE_AES:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_GCM:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_1
+inject_client_content_on_the_wire:MBEDTLS_PK_ECDSA:MBEDTLS_SSL_CLIENT_HELLO:"160303002a0100002603030123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef025f5f00":"bad client hello message":MBEDTLS_ERR_SSL_DECODE_ERROR
+
 # See "ClientHello breakdown" above
 # ephemeral with secp256r1 + MBEDTLS_TLS1_3_AES_128_GCM_SHA256
 Inject ClientHello - TLS 1.3 good (for reference)

tests/suites/test_suite_x509parse.data

@@ -2062,11 +2062,27 @@ mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-c
 
 X509 CRT ASN1: basicConstraints: no cA but pathLenConstraint (bad signature)
 depends_on:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):0
+mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt":0:1
+
+X509 CRT ASN1: basicConstraints: no cA, pathLenConstraint=1
+depends_on:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+mbedtls_x509_get_ca_istrue:"../framework/data_files/parse_input/server5.basic-constraints-integer-first.badsign.crt":0
 
 X509 CRT ASN1: basicConstraints: no cA but pathLenConstraint (good self signature)
 depends_on:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
-mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):0
+mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server5.basic-constraints-integer-first.selfsigned.crt":0:1
+
+X509 CRT ASN1: basicConstraints: no cA but pathLenConstraint=0
+depends_on:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+x509_crt_parse_basic_constraints:"308201573081fea003020102020c53a2cb4b124ead837da894b2300a06082a8648ce3d040302300e310c300a06035504030c03457665301e170d3236303531323039353330345a170d3336303531323039353330345a300e310c300a06035504030c034576653059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa3423040300f0603551d130101ff04053003020100300e0603551d0f0101ff040403020780301d0603551d0e041604145061a58fd407d9d782010ce5657f8c6346a713be300a06082a8648ce3d0403020348003045022100d67d572af0aa540cd0f9d86d43788c178ca9501d8c0f4f6690c773f4b82c4b9a022011620feee62aca3944b8321636849030014ef80604550031312bb707b7f2bf04":0:0:0
+
+X509 CRT ASN1: basicConstraints: invalid cA BOOLEAN length
+depends_on:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+x509_crt_parse_basic_constraints:"308201573081fea003020102020c53a2cb4b124ead837da894b2300a06082a8648ce3d040302300e310c300a06035504030c03457665301e170d3236303531323039353330345a170d3336303531323039353330345a300e310c300a06035504030c034576653059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa3423040300f0603551d130101ff040530030100ff300e0603551d0f0101ff040403020780301d0603551d0e041604145061a58fd407d9d782010ce5657f8c6346a713be300a06082a8648ce3d0403020348003045022100d67d572af0aa540cd0f9d86d43788c178ca9501d8c0f4f6690c773f4b82c4b9a022011620feee62aca3944b8321636849030014ef80604550031312bb707b7f2bf04":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_INVALID_LENGTH):0:0
+
+X509 CRT ASN1: basicConstraints: neither cA nor pathLenConstraint
+depends_on:PSA_HAVE_ALG_ECDSA_VERIFY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+x509_crt_parse_basic_constraints:"308201573081fea003020102020c53a2cb4b124ead837da894b2300a06082a8648ce3d040302300e310c300a06035504030c03457665301e170d3236303531323039353330345a170d3336303531323039353330345a300e310c300a06035504030c034576653059301306072a8648ce3d020106082a8648ce3d0301070342000437cc56d976091e5a723ec7592dff206eee7cf9069174d0ad14b5f768225962924ee500d82311ffea2fd2345d5d16bd8a88c26b770d55cd8a2a0efa01c8b4edffa3423040300f0603551d130101ff04053003050100300e0603551d0f0101ff040403020780301d0603551d0e041604145061a58fd407d9d782010ce5657f8c6346a713be300a06082a8648ce3d0403020348003045022100d67d572af0aa540cd0f9d86d43788c178ca9501d8c0f4f6690c773f4b82c4b9a022011620feee62aca3944b8321636849030014ef80604550031312bb707b7f2bf04":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):0:0
 
 X509 CRT ASN1 (TBS, inv extBasicConstraint, no pathlen length)
 depends_on:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY:PSA_WANT_ALG_SHA_256
@@ -3471,6 +3487,30 @@ X509 CRT parse Authority Key Id - Wrong Issuer sequence
 depends_on:PSA_WANT_ALG_MD5:PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY
 x509_crt_parse_authoritykeyid:"../framework/data_files/clusterfuzz-testcase-minimized-fuzz_x509crt-6666050834661376.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA)
 
+# Self-signed certificate whose AuthorityKeyIdentifier is an empty SEQUENCE (30 00).
+# All fields of AuthorityKeyIdentifier are OPTIONAL in the ASN.1 module (RFC 5280,
+# Appendix A.2), so this is syntactically valid; some antivirus products install
+# such a root for HTTPS scanning. Generated with Python cryptography:
+#   key = ec.generate_private_key(ec.SECP256R1())
+#   name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "Test")])
+#   cert = (x509.CertificateBuilder().subject_name(name).issuer_name(name)
+#           .public_key(key.public_key()).serial_number(1)
+#           .not_valid_before(datetime.datetime(2025, 1, 1))
+#           .not_valid_after(datetime.datetime(2035, 1, 1))
+#           .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+#           .add_extension(x509.UnrecognizedExtension(ObjectIdentifier("2.5.29.35"),
+#                                                     b"\x30\x00"), critical=False)
+#           .sign(key, hashes.SHA256()))
+X509 CRT parse Authority Key Id - Empty sequence
+depends_on:PSA_HAVE_ALG_SOME_ECDSA:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+x509parse_crt:"3082012b3081d1a003020102020101300a06082a8648ce3d040302300f310d300b06035504030c0454657374301e170d3235303130313030303030305a170d3335303130313030303030305a300f310d300b06035504030c04546573743059301306072a8648ce3d020106082a8648ce3d03010703420004f8cf6bd9eb57f5fdc8771103e9f75becb6a865b1a5de8492b3233170f49e1ff388d25d24376d130c86a8acb5b0478d7c49b83f07ffbd0684c26a0da42c752256a31e301c300f0603551d130101ff040530030101ff30090603551d2304023000300a06082a8648ce3d0403020349003046022100cffb50bdb73287649de96d4c48fcbb5d6e1eb468c72c5016776a9fdf0dc3d295022100e1b4b7ecba9ca1b43882a688c6fd93ffc99112247cf3ebb852b07f09d7c76be2":"cert. version     \: 3\nserial number     \: 01\nissuer name       \: CN=Test\nsubject name      \: CN=Test\nissued  on        \: 2025-01-01 00\:00\:00\nexpires on        \: 2035-01-01 00\:00\:00\nsigned using      \: ECDSA with SHA256\nEC key size       \: 256 bits\nbasic constraints \: CA=true\n":0
+
+# Generated the same way as above, with extension value b"\x30\x01\x80":
+# a [0] tag without a length. This must still be rejected.
+X509 CRT parse Authority Key Id - Truncated keyIdentifier
+depends_on:PSA_HAVE_ALG_SOME_ECDSA:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256
+x509parse_crt:"3082012b3081d2a003020102020101300a06082a8648ce3d040302300f310d300b06035504030c0454657374301e170d3235303130313030303030305a170d3335303130313030303030305a300f310d300b06035504030c04546573743059301306072a8648ce3d020106082a8648ce3d03010703420004eba1e439f91038837190c4da3703001dff24411b90bf6998f56cba76c753c19ca9158f3c243ccb2118f8b6a78b6eb507962e855bf7c13dbafc314dc56d5d27d8a31f301d300f0603551d130101ff040530030101ff300a0603551d230403300180300a06082a8648ce3d040302034800304502205443c61342f55d3d4cec26df92b7614a5e67177f057efd4f6fb9d7a1a47f5d110221008f05c4c193e203d78a322455132f1b4428388904874dd329fc60a68a37a559b4":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA)
+
 OID get numeric string - hardware module name
 oid_get_numeric_string:"2B06010505070804":0:"1.3.6.1.5.5.7.8.4"
 

tests/suites/test_suite_x509parse.function

@@ -1127,6 +1127,28 @@ exit:
 }
 /* END_CASE */
 
+/* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
+void x509_crt_parse_basic_constraints(data_t *buf, int result,
+                                      int ca_istrue, int path_len_constraint)
+{
+    mbedtls_x509_crt crt;
+
+    mbedtls_x509_crt_init(&crt);
+    USE_PSA_INIT();
+
+    TEST_EQUAL(mbedtls_x509_crt_parse_der(&crt, buf->x, buf->len), result);
+    if (result == 0) {
+        TEST_EQUAL(mbedtls_x509_crt_get_ca_istrue(&crt), ca_istrue);
+        /* max_pathlen is 1 higher than pathLenConstraint. */
+        TEST_EQUAL(crt.max_pathlen, path_len_constraint + 1);
+    }
+
+exit:
+    mbedtls_x509_crt_free(&crt);
+    USE_PSA_DONE();
+}
+/* END_CASE */
+
 /* BEGIN_CASE depends_on:MBEDTLS_X509_CRT_PARSE_C */
 void x509parse_crt(data_t *buf, char *result_str, int result)
 {

tf-psa-crypto

@@ -1 +1 @@
-Subproject commit a22ae75f6f09a9b395454e1182547fa06710f0b3
+Subproject commit 607ef78f93568d15d8f9b56d09401b4b9e177f93