TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-04-12 07:07:58 +02:00
Code Issues Packages Projects Releases Wiki Activity
32,740 Commits 179 Branches 280 Tags
168ac780349dd04dcd552a2bbf24dfe164b0e901
Commit Graph

1730 Commits

Author SHA1 Message Date
Gilles Peskine
778ea0af9b Mention the new advice about compiler options in the changelog 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-04-01 10:08:28 +02:00
Minos Galanakis
69454b4bfe Assemble ChangeLog 
./framework/scripts/assemble_changelog.py

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 21:50:06 +00:00
Gilles Peskine
77b1a22bc3 Merge pull request #1536 from ronald-cron-arm/3.6-context_load_and_session_load_documentation 
3.6 backport: Tighten context/session load and save APIs documentation
 2026-03-26 21:32:09 +01:00
Ronald Cron
86b6812003 Update change log. 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-26 18:25:06 +01:00
Minos Galanakis
860cde63e6 MOufa 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 16:43:03 +00:00
Minos Galanakis
e4c6f6819e Added attribution for ffdh-peerkey-check 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 16:42:23 +00:00
Minos Galanakis
441beaeeac Extended attributions & CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 14:51:36 +00:00
Ronald Cron
f45d735826 Improve change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-26 13:18:10 +01:00
Ronald Cron
e7076b1639 Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-26 13:18:10 +01:00
Minos Galanakis
0205ff782b Added attributions & CVE 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-26 11:11:12 +00:00
Manuel Pégourié-Gonnard
3746d7bbe0 Merge pull request #1531 from minosgalanakis/bugfix/ccm_finish_boundary_check_3.6_accr 
Added attribution to fix-ccm-finish changelog entry (mbedtls3.6)
 2026-03-26 09:36:56 +01:00
Minos Galanakis
17c19f9782 Added attribution to fix-ccm-finish changelog entry 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-25 16:14:18 +00:00
Manuel Pégourié-Gonnard
38fe3d463e Remove attribution that wasn't agreed on 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-03-25 13:36:01 +01:00
Ronald Cron
707c8c34ec Merge remote-tracking branch 'mbedtls-restricted/mbedtls-3.6-release-sync' into 'mbedtls-restricted/mbedtls-3.6-restricted' 2026-03-23 12:08:25 +01:00
Bence Szépkúti
8530b5e708 Merge pull request #1504 from gilles-peskine-arm/psa-rng-fork-3.6 
Backport 3.6: PSA RNG fork protection
 2026-03-19 17:26:52 +01:00
Gilles Peskine
f6118b40e1 Merge pull request #1492 from minosgalanakis/bugfix/ccm_finish_boundary_check_3.6 
Bugfix/ccm finish boundary check 3.6
 2026-03-17 21:57:28 +01:00
Ronald Cron
c1cd21d854 Merge pull request #1510 from yanesca/1445_fix_signature_algorithm_injection-backport 
Fix signature algorithm injection [3.6 Backport]
 2026-03-17 17:09:51 +01:00
Bence Szépkúti
444d0ac2c1 Merge pull request #10443 from davidhorstmann-arm/verify-result-default-failure-3.6 
[Backport 3.6] Hardening: Make `mbedtls_ssl_get_verify_result()` default to failure
 2026-03-17 12:14:48 +00:00
Manuel Pégourié-Gonnard
b48ddb3f4e Merge pull request #1485 from gilles-peskine-arm/dev-random-config-3.6 
Backport 3.6: Use /dev/random and make it configurable
 2026-03-17 10:54:46 +01:00
Gilles Peskine
0b93865aed Protect the PSA RNG from duplication on fork 
If a process forks with the PSA subsystem active, the PSA RNG state is
duplicated. This led to the parent process and the child process generating
the same sequence of random numbers.

Fix this by forcing a reseed if the value of `getpid()` changes. This is the
same technique used in OpenSSL ≥1.1.1d.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-16 17:50:06 +01:00
Bence Szépkúti
c5f0f738ed Merge pull request #1497 from gilles-peskine-arm/psa-rng-reseed-3.6 
Backport 3.6: API to reseed the PSA RNG
 2026-03-16 13:53:53 +01:00
Janos Follath
238976c73a sig_algs: add ChangeLog 
Signed-off-by: Janos Follath <janos.follath@arm.com>
 2026-03-16 12:38:20 +00:00
Manuel Pégourié-Gonnard
0d48c34169 Merge pull request #1490 from ronald-cron-arm/tls12-2nd-client-hello-3.6 
Backport 3.6: Fix TLS 1.2 client hello after HRR
 2026-03-16 10:58:44 +01:00
Manuel Pégourié-Gonnard
2d0aa97f81 Merge pull request #1501 from mpg/restricted-ffdh-peerkey-checks 
[Backport 3.6] FFDH peer key checks
 2026-03-13 12:44:30 +01:00
Manuel Pégourié-Gonnard
01b04ab723 Merge pull request #1489 from davidhorstmann-arm/fix-psa-ffdh-buffer-overflow-3.6 
[Backport 3.6] Fix buffer overflow in FFDH public key export
 2026-03-13 09:56:43 +01:00
Manuel Pégourié-Gonnard
e24f1e5c2c Merge pull request #10609 from mpg/pk-psa-large-stack-buffers 
[3.6] PK: avoid large stack buffers in "to/from PSA" functions
 2026-03-13 08:53:48 +00:00
Gilles Peskine
7cf7a85008 Add missing parenthetical remark 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-11 10:31:58 +01:00
Ronald Cron
0be90b44e2 Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-03-10 19:26:14 +01:00
Ronald Cron
828e3817ac Merge pull request #10623 from ronald-cron-arm/dtls-client-hello-defragmentation-3.6 
Backport 3.6: Add support for (D)TLS 1.2 client hello defragmentation
 2026-03-10 14:46:41 +00:00
David Horstmann
97c4e3f69b Add missing full stop in ChangeLog entry 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:09:56 +00:00
David Horstmann
23e688b3ab Add credit to the ChangeLog entry 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
1ecd0c1ea6 Simplify ChangeLog entry 
Improve readability of the ChangeLog by including only the strictly
necessary information.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
David Horstmann
a749c3a5f8 Add ChangeLog entry for FFDH buffer overflow fix 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-03-10 09:05:37 +00:00
Gilles Peskine
fc38b65561 Add advice to reseed the RNG if the application is cloned 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-09 18:06:38 +01:00
Manuel Pégourié-Gonnard
4704b6b4bd Merge pull request #1488 from davidhorstmann-arm/fix-null-pointer-dereference-3.6 
[Backport 3.6] Fix null pointer dereference in `mbedtls_x509_string_to_names()`
 2026-03-09 12:42:56 +01:00
Gilles Peskine
8f8b70aff1 Merge remote-tracking branch 'mbedtls-3.6' into merge-3.6-restricted-20260309 2026-03-08 20:26:08 +01:00
Minos Galanakis
e54d769fe8 Updated Changelog 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-05 14:20:15 +00:00
Manuel Pégourié-Gonnard
35aec41600 Add Changelog entry for FFDH missing peerkey check 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2026-03-05 13:07:23 +01:00
Gilles Peskine
7147da8783 Update attribution to conform to contributor's request 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-05 12:11:08 +01:00
Gilles Peskine
a863415205 New API psa_random_set_prediction_resistance() 
Let applications configure prediction resistance at runtime.

Prediction resistance is always considered disabled when there is no actual
entropy source, only a nonvolatile seed.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
5093f08415 New API psa_random_deplete(): force a reseed on the next RNG query 
In some scenarios, application or integration code knows that the random
generator should be reseeded, but the reseed cannot or must not happen
immediately and there is no way to report errors. In such scenarios, users
can call the new function `psa_random_deplete()`, which just marks the DRBG
as needing a reseed.

This change requires DRBG modules to treat `reseed_counter == reseed_interval`
as a condition that requires a reseed. Historically they reseeded when
`reseed_counter > reseed_interval`, but that made it impossible to require
a reseed when `reseed_interval == MAX_INT`. Note that this edge case is not
tested.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
ccfb7357a3 New function psa_random_reseed() 
Explicit reseed of the PSA random generator.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-04 17:54:56 +01:00
Gilles Peskine
685a1ce6f4 Merge remote-tracking branch 'mbedtls-3.6' into merge-3.6-restricted-20260304 2026-03-04 14:39:06 +01:00
Gilles Peskine
31934f47c5 Note platforms with known improvements 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-03 15:19:58 +01:00
Gilles Peskine
168461a3a9 Unify the detection of Unix-like platforms 
We were using slightly different guards to decide whether to include
`<unistd.h>` in different places. Unify those.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-03-03 15:19:58 +01:00
Minos Galanakis
24081fe484 Added Changelog 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2026-03-03 11:24:35 +00:00
Gilles Peskine
6f63121a00 Change the default from /dev/urandom to /dev/random 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-02-27 20:37:28 +01:00
David Horstmann
0d48251122 Add ChangeLog entry for NULL dereference fix 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2026-02-26 14:05:13 +00:00
Gilles Peskine
8f962c1b22 Add MBEDTLS_PLATFORM_DEV_RANDOM as a compile-time option 
Document when this is not used. This was the case in TF-PSA-Crypto 1.0.0,
but not yet in Mbed TLS 3.6.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2026-02-25 22:43:19 +01:00
Ronald Cron
38213a7856 Add change log 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2026-02-24 15:37:30 +01:00