TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-03-20 19:21:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10442 from davidhorstmann-arm/verify-result-default-failure

Browse Source 
Hardening: Make `mbedtls_ssl_get_verify_result()` default to failure
This commit is contained in:
Ronald Cron
2026-03-17 10:36:38 +00:00
committed by GitHub
parent d7f2a4cdc6 937c70ac90
commit cb0b594a9d
8 changed files with 182 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
tests/suites/test_suite_ssl.data
View File

@@ -3527,3 +3527,6 @@ ssl_tls_exporter_too_early:MBEDTLS_SSL_VERSION_TLS1_3:1:MBEDTLS_SSL_SERVER_CERTI
TLS fatal alert getter
ssl_get_alert_after_fatal
Default verify_result before doing a handshake
verify_result_without_handshake

43
tests/suites/test_suite_ssl.function
View File

@@ -6040,3 +6040,46 @@ exit:
USE_PSA_DONE();
}
/* END_CASE */
/* BEGIN_CASE depends_on:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
void verify_result_without_handshake(void)
{
/* Test the result of verification before we perform a handshake. */
mbedtls_ssl_context ssl;
mbedtls_ssl_config conf;
PSA_INIT();
mbedtls_ssl_init(&ssl);
mbedtls_ssl_config_init(&conf);
TEST_EQUAL(mbedtls_ssl_config_defaults(&conf,
MBEDTLS_SSL_IS_CLIENT,
MBEDTLS_SSL_TRANSPORT_STREAM,
MBEDTLS_SSL_PRESET_DEFAULT), 0);
mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
mbedtls_ssl_conf_ca_chain(&conf, NULL, NULL);
TEST_EQUAL(mbedtls_ssl_setup(&ssl, &conf), 0);
uint32_t verify_result = mbedtls_ssl_get_verify_result(&ssl);
TEST_EQUAL(verify_result, 0xFFFFFFFF);
/* Set the verify result manually and check that session_free resets it. */
/* Set the verify result to 0. */
ssl.session_negotiate->verify_result = 0;
mbedtls_ssl_session_free(ssl.session_negotiate);
verify_result = mbedtls_ssl_get_verify_result(&ssl);
TEST_EQUAL(verify_result, 0xFFFFFFFF);
exit:
mbedtls_ssl_config_free(&conf);
mbedtls_ssl_free(&ssl);
PSA_DONE();
}
/* END_CASE */