From 55ccd932658b933f224cc0384ab5a5197e5680e2 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 21 Apr 2026 16:46:31 +0100 Subject: [PATCH 01/12] tls13_client: fix HRR selected_group validation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reject HRR selected_group unless it matches the client’s original supported_groups and is locally supported, so unadvertised groups are not accepted in the second ClientHello. Signed-off-by: Minos Galanakis --- library/ssl_tls13_client.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index 752bc033fe..0d20db2023 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -405,14 +405,18 @@ static int ssl_tls13_parse_hrr_key_share_ext(mbedtls_ssl_context *ssl, * then the client MUST abort the handshake with an "illegal_parameter" alert. */ for (; *group_list != 0; group_list++) { + if (*group_list != selected_group) { + continue; + } #if defined(PSA_WANT_ALG_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list)) { - if ((mbedtls_ssl_get_psa_curve_info_from_tls_id( - *group_list, NULL, NULL) == PSA_ERROR_NOT_SUPPORTED) || - *group_list != selected_group) { - found = 1; - break; + if (mbedtls_ssl_get_psa_curve_info_from_tls_id( + *group_list, NULL, NULL) == PSA_ERROR_NOT_SUPPORTED) { + continue; } + /* Found only if psa_curve is supported and group_list == selected_group */ + found = 1; + break; } #endif /* PSA_WANT_ALG_ECDH */ #if defined(PSA_WANT_ALG_FFDH) From f1df3bb51d769477beae007ba507810a46a90227 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 23 Apr 2026 13:53:40 +0100 Subject: [PATCH 02/12] test_suite_ssl: Introduced hrr_reject_unadvertised_group Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.data | 3 ++ tests/suites/test_suite_ssl.function | 77 ++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 06e8b62303..8535a0a03b 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3347,6 +3347,9 @@ cookie_parsing:"16fefd0000000000000000002F010000de000000000000011efefd7b72727272 TLS 1.3 srv Certificate msg - wrong vector lengths tls13_server_certificate_msg_invalid_vector_len +TLS 1.3 cli rejects HRR selected_group not in original supported_groups +hrr_reject_unadvertised_group + EC-JPAKE set password depends_on:MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED ssl_ecjpake_set_password:0 diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index ae7ab55366..6b6f337c64 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3968,6 +3968,83 @@ exit: } /* END_CASE */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_ECDH:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ +void hrr_reject_unadvertised_group(void) +{ + int ret = -1; + + mbedtls_test_ssl_endpoint client_ep, server_ep; + mbedtls_test_handshake_test_options client_options, server_options; + + uint16_t offered_group_before_hrr_parse = 0; + uint16_t offered_group_after_hrr_parse = 0; + + /* Group order is intentional: client offers secp256r1 first, while server only + * accepts secp384r1. This prevents immediate group agreement and forces HRR. */ + uint16_t client_group_list[] = { + MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1, + MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1, + MBEDTLS_SSL_IANA_TLS_GROUP_NONE + }; + uint16_t server_group_list[] = { MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1, + MBEDTLS_SSL_IANA_TLS_GROUP_NONE }; + + memset(&client_ep, 0, sizeof(client_ep)); + memset(&server_ep, 0, sizeof(server_ep)); + + mbedtls_test_init_handshake_options(&client_options); + mbedtls_test_init_handshake_options(&server_options); + MD_OR_USE_PSA_INIT(); + + client_options.pk_alg = MBEDTLS_PK_ECDSA; + client_options.client_min_version = MBEDTLS_SSL_VERSION_TLS1_3; + client_options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_3; + client_options.group_list = client_group_list; + + server_options.pk_alg = MBEDTLS_PK_ECDSA; + server_options.server_min_version = MBEDTLS_SSL_VERSION_TLS1_3; + server_options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_3; + server_options.group_list = server_group_list; + + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, + &client_options), 0); + + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, + &server_options), 0); + + TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 4096), 0); + + ret = mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + MBEDTLS_SSL_HELLO_RETRY_REQUEST); + TEST_EQUAL(ret, 0); + + server_ep.ssl.handshake->hrr_selected_group = MBEDTLS_SSL_IANA_TLS_GROUP_X25519; + TEST_EQUAL(mbedtls_ssl_handshake_step(&(server_ep.ssl)), 0); + + /* Push the HRR with unadvertised group into the wire*/ + TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0); + + offered_group_before_hrr_parse = client_ep.ssl.handshake->offered_group_id; + + /* Client should reject malformed selected_group with illegal_parameter. */ + TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); + + /* The server send a non advertised group during HRR. Client shouldnt accept it as offered_group_id */ + offered_group_after_hrr_parse = client_ep.ssl.handshake->offered_group_id; + TEST_EQUAL(offered_group_after_hrr_parse, offered_group_before_hrr_parse); + + +exit: + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_free_handshake_options(&client_options); + mbedtls_test_free_handshake_options(&server_options); + MD_OR_USE_PSA_DONE(); +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ void ssl_ecjpake_set_password(int use_opaque_arg) { From 9dd8115f6b80eafe6825655faf71246021506b1d Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 27 Apr 2026 12:25:32 +0100 Subject: [PATCH 03/12] Adjusted dependecies for hrr_reject_unadvertised_group Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 6b6f337c64..8c69868d28 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3968,7 +3968,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_ECDH:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_ECDH:PSA_WANT_ALG_ECDSA_ANY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ void hrr_reject_unadvertised_group(void) { int ret = -1; From 86bc182d73fb642da77da76829e54917de1e9bb3 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 12 May 2026 14:59:18 +0100 Subject: [PATCH 04/12] Added ChangeLog Signed-off-by: Minos Galanakis --- ChangeLog.d/tls13-hrr-selected-group.txt | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 ChangeLog.d/tls13-hrr-selected-group.txt diff --git a/ChangeLog.d/tls13-hrr-selected-group.txt b/ChangeLog.d/tls13-hrr-selected-group.txt new file mode 100644 index 0000000000..20d7a18fbd --- /dev/null +++ b/ChangeLog.d/tls13-hrr-selected-group.txt @@ -0,0 +1,5 @@ +Security + * Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was + not advertised in the original ClientHello. Reported by + Din Asotić / Xiangdong Li, Beijing University of Posts and + Telecommunications (BUPT) From 1fe3a731632612ebe0719dc3ea9832b46e3036b9 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 13 May 2026 11:33:40 +0100 Subject: [PATCH 05/12] test_suite_ssl: doc fixes Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 8c69868d28..6c14fe6afa 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4031,7 +4031,7 @@ void hrr_reject_unadvertised_group(void) /* Client should reject malformed selected_group with illegal_parameter. */ TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); - /* The server send a non advertised group during HRR. Client shouldnt accept it as offered_group_id */ + /* The server sends a non-advertised group during HRR. Client shouldn't accept it as offered_group_id */ offered_group_after_hrr_parse = client_ep.ssl.handshake->offered_group_id; TEST_EQUAL(offered_group_after_hrr_parse, offered_group_before_hrr_parse); From 5decd98cf4065937d0372b3c24d281446e91ba0a Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 19 May 2026 17:31:47 +0100 Subject: [PATCH 06/12] sll_client: align TLS 1.3 supported_groups filtering with PSA curve support Signed-off-by: Minos Galanakis --- library/ssl_client.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/library/ssl_client.c b/library/ssl_client.c index 0bd00cd91a..c9d190e01d 100644 --- a/library/ssl_client.c +++ b/library/ssl_client.c @@ -210,6 +210,9 @@ static int ssl_write_alpn_ext(mbedtls_ssl_context *ssl, * generalization of the TLS 1.2 supported elliptic curves extension. They both * share the same extension identifier. * + * If the TLS 1.3 logic for selecting proposed groups changes, the TLS 1.3 + * group filtering in this function must be kept in sync. + * */ #define SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_2_FLAG 1 #define SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_3_FLAG 2 @@ -253,8 +256,8 @@ static int ssl_write_supported_groups_ext(mbedtls_ssl_context *ssl, if (flags & SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_3_FLAG) { #if defined(PSA_WANT_ALG_ECDH) if (mbedtls_ssl_tls13_named_group_is_ecdhe(*group_list) && - (mbedtls_ssl_get_ecp_group_id_from_tls_id(*group_list) != - MBEDTLS_ECP_DP_NONE)) { + mbedtls_ssl_get_psa_curve_info_from_tls_id( + *group_list, NULL, NULL) == PSA_SUCCESS) { propose_group = 1; } #endif From e42c6d79373c52a6a153bb6d60432caa20e863f0 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 19 May 2026 17:36:12 +0100 Subject: [PATCH 07/12] test_suite_ssl: Renamed hrr_reject_selecting_unoffered_group Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.data | 4 ++-- tests/suites/test_suite_ssl.function | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 8535a0a03b..ca8984c90a 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3347,8 +3347,8 @@ cookie_parsing:"16fefd0000000000000000002F010000de000000000000011efefd7b72727272 TLS 1.3 srv Certificate msg - wrong vector lengths tls13_server_certificate_msg_invalid_vector_len -TLS 1.3 cli rejects HRR selected_group not in original supported_groups -hrr_reject_unadvertised_group +TLS 1.3 cli rejects HRR selecting an un-offered group +reject_hrr_selecting_unoffered_group EC-JPAKE set password depends_on:MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 6c14fe6afa..f9872c8d07 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3969,7 +3969,7 @@ exit: /* END_CASE */ /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_ECDH:PSA_WANT_ALG_ECDSA_ANY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ -void hrr_reject_unadvertised_group(void) +void reject_hrr_selecting_unoffered_group(void) { int ret = -1; From b82b797b2ce70d4aa1a2e855b0148476f713bfa9 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 19 May 2026 22:12:05 +0100 Subject: [PATCH 08/12] test_suite_ssl: Restructured reject_hrr_selecting_unoffered_group Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 75 ++++++++++++++++++---------- 1 file changed, 49 insertions(+), 26 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index f9872c8d07..ec1d051f28 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3975,9 +3975,7 @@ void reject_hrr_selecting_unoffered_group(void) mbedtls_test_ssl_endpoint client_ep, server_ep; mbedtls_test_handshake_test_options client_options, server_options; - - uint16_t offered_group_before_hrr_parse = 0; - uint16_t offered_group_after_hrr_parse = 0; + mbedtls_test_ssl_log_pattern cli_pattern = { .pattern = "Invalid key share in HRR" }; /* Group order is intentional: client offers secp256r1 first, while server only * accepts secp384r1. This prevents immediate group agreement and forces HRR. */ @@ -4000,47 +3998,72 @@ void reject_hrr_selecting_unoffered_group(void) client_options.client_min_version = MBEDTLS_SSL_VERSION_TLS1_3; client_options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_3; client_options.group_list = client_group_list; + client_options.cli_log_obj = &cli_pattern; + client_options.cli_log_fun = mbedtls_test_ssl_log_analyzer; + mbedtls_debug_set_threshold(1); server_options.pk_alg = MBEDTLS_PK_ECDSA; server_options.server_min_version = MBEDTLS_SSL_VERSION_TLS1_3; server_options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_3; server_options.group_list = server_group_list; - TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, - &client_options), 0); + for (int round = 0; round < 2; round++) { + int select_unoffered_group = (round != 0); + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, + MBEDTLS_SSL_IS_CLIENT, + &client_options), 0); - TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, - &server_options), 0); + TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, + MBEDTLS_SSL_IS_SERVER, + &server_options), 0); - TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), - &(server_ep.socket), 4096), 0); + TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), + &(server_ep.socket), 4096), 0); - ret = mbedtls_test_move_handshake_to_state( - &(server_ep.ssl), &(client_ep.ssl), - MBEDTLS_SSL_HELLO_RETRY_REQUEST); - TEST_EQUAL(ret, 0); + ret = mbedtls_test_move_handshake_to_state( + &(server_ep.ssl), &(client_ep.ssl), + MBEDTLS_SSL_HELLO_RETRY_REQUEST); + TEST_EQUAL(ret, 0); + TEST_EQUAL(client_ep.ssl.handshake->offered_group_id, + MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1); - server_ep.ssl.handshake->hrr_selected_group = MBEDTLS_SSL_IANA_TLS_GROUP_X25519; - TEST_EQUAL(mbedtls_ssl_handshake_step(&(server_ep.ssl)), 0); + if (!select_unoffered_group) { + TEST_EQUAL(server_ep.ssl.handshake->hrr_selected_group, + MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1); + } else { + server_ep.ssl.handshake->hrr_selected_group = MBEDTLS_SSL_IANA_TLS_GROUP_X25519; + } - /* Push the HRR with unadvertised group into the wire*/ - TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0); - - offered_group_before_hrr_parse = client_ep.ssl.handshake->offered_group_id; - - /* Client should reject malformed selected_group with illegal_parameter. */ - TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); - - /* The server sends a non-advertised group during HRR. Client shouldn't accept it as offered_group_id */ - offered_group_after_hrr_parse = client_ep.ssl.handshake->offered_group_id; - TEST_EQUAL(offered_group_after_hrr_parse, offered_group_before_hrr_parse); + /* Write and send the HRR */ + TEST_EQUAL(mbedtls_ssl_handshake_step(&(server_ep.ssl)), 0); + TEST_EQUAL(mbedtls_ssl_flush_output(&(server_ep.ssl)), 0); + if (!select_unoffered_group) { + /* Valid HRR, the client accepts the group MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1 + * and goes ahead with the handshake. + */ + TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), 0); + TEST_ASSERT(client_ep.ssl.state != MBEDTLS_SSL_SERVER_HELLO); + TEST_EQUAL(cli_pattern.counter, 0); + } else { + /* Invalid HRR selecting MBEDTLS_SSL_IANA_TLS_GROUP_X25519 group. + * The client rejects it and aborts the handshake. + */ + TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), + MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); + TEST_EQUAL(client_ep.ssl.state, MBEDTLS_SSL_SERVER_HELLO); + TEST_EQUAL(cli_pattern.counter, 1); + } + mbedtls_test_ssl_endpoint_free(&client_ep); + mbedtls_test_ssl_endpoint_free(&server_ep); + } exit: mbedtls_test_ssl_endpoint_free(&client_ep); mbedtls_test_ssl_endpoint_free(&server_ep); mbedtls_test_free_handshake_options(&client_options); mbedtls_test_free_handshake_options(&server_options); + mbedtls_debug_set_threshold(0); MD_OR_USE_PSA_DONE(); } /* END_CASE */ From 89c0c7da25ff29fe3215520b5f8970be1d1cd92c Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 20 May 2026 12:25:42 +0100 Subject: [PATCH 09/12] test_suite_ssl: Added MBEDTLS_DEBUG_C guards to logs Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index ec1d051f28..f7ffb72c2a 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3975,7 +3975,9 @@ void reject_hrr_selecting_unoffered_group(void) mbedtls_test_ssl_endpoint client_ep, server_ep; mbedtls_test_handshake_test_options client_options, server_options; +#if defined(MBEDTLS_DEBUG_C) mbedtls_test_ssl_log_pattern cli_pattern = { .pattern = "Invalid key share in HRR" }; +#endif /* MBEDTLS_DEBUG_C */ /* Group order is intentional: client offers secp256r1 first, while server only * accepts secp384r1. This prevents immediate group agreement and forces HRR. */ @@ -3998,9 +4000,11 @@ void reject_hrr_selecting_unoffered_group(void) client_options.client_min_version = MBEDTLS_SSL_VERSION_TLS1_3; client_options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_3; client_options.group_list = client_group_list; +#if defined(MBEDTLS_DEBUG_C) client_options.cli_log_obj = &cli_pattern; client_options.cli_log_fun = mbedtls_test_ssl_log_analyzer; mbedtls_debug_set_threshold(1); +#endif /* MBEDTLS_DEBUG_C */ server_options.pk_alg = MBEDTLS_PK_ECDSA; server_options.server_min_version = MBEDTLS_SSL_VERSION_TLS1_3; @@ -4044,7 +4048,9 @@ void reject_hrr_selecting_unoffered_group(void) */ TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), 0); TEST_ASSERT(client_ep.ssl.state != MBEDTLS_SSL_SERVER_HELLO); +#if defined(MBEDTLS_DEBUG_C) TEST_EQUAL(cli_pattern.counter, 0); +#endif /* MBEDTLS_DEBUG_C */ } else { /* Invalid HRR selecting MBEDTLS_SSL_IANA_TLS_GROUP_X25519 group. * The client rejects it and aborts the handshake. @@ -4052,7 +4058,9 @@ void reject_hrr_selecting_unoffered_group(void) TEST_EQUAL(mbedtls_ssl_handshake_step(&(client_ep.ssl)), MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER); TEST_EQUAL(client_ep.ssl.state, MBEDTLS_SSL_SERVER_HELLO); +#if defined(MBEDTLS_DEBUG_C) TEST_EQUAL(cli_pattern.counter, 1); +#endif /* MBEDTLS_DEBUG_C */ } mbedtls_test_ssl_endpoint_free(&client_ep); mbedtls_test_ssl_endpoint_free(&server_ep); @@ -4063,7 +4071,9 @@ exit: mbedtls_test_ssl_endpoint_free(&server_ep); mbedtls_test_free_handshake_options(&client_options); mbedtls_test_free_handshake_options(&server_options); +#if defined(MBEDTLS_DEBUG_C) mbedtls_debug_set_threshold(0); +#endif /* MBEDTLS_DEBUG_C */ MD_OR_USE_PSA_DONE(); } /* END_CASE */ From c8187a51d0784c4038e5448bfe793821552eced3 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 26 May 2026 10:17:11 +0100 Subject: [PATCH 10/12] ssl_write_supported_groups_ext: Updated documentation Signed-off-by: Minos Galanakis --- library/ssl_client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/library/ssl_client.c b/library/ssl_client.c index c9d190e01d..fb5fe57181 100644 --- a/library/ssl_client.c +++ b/library/ssl_client.c @@ -211,7 +211,8 @@ static int ssl_write_alpn_ext(mbedtls_ssl_context *ssl, * share the same extension identifier. * * If the TLS 1.3 logic for selecting proposed groups changes, the TLS 1.3 - * group filtering in this function must be kept in sync. + * group filtering in the function `ssl_tls13_parse_hrr_key_share_ext()` must + * be updated accordingly. * */ #define SSL_WRITE_SUPPORTED_GROUPS_EXT_TLS1_2_FLAG 1 From c3f90ec54d25f5a0b579e04a830e518804dfb870 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Fri, 5 Jun 2026 15:16:19 +0100 Subject: [PATCH 11/12] test_suite_ssl: use 3.6 endpoint helper signatures in HRR test Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index f7ffb72c2a..2cca520bce 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4015,11 +4015,13 @@ void reject_hrr_selecting_unoffered_group(void) int select_unoffered_group = (round != 0); TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT, - &client_options), 0); + &client_options, NULL, NULL, + NULL), 0); TEST_EQUAL(mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER, - &server_options), 0); + &server_options, NULL, NULL, + NULL), 0); TEST_EQUAL(mbedtls_test_mock_socket_connect(&(client_ep.socket), &(server_ep.socket), 4096), 0); @@ -4062,13 +4064,13 @@ void reject_hrr_selecting_unoffered_group(void) TEST_EQUAL(cli_pattern.counter, 1); #endif /* MBEDTLS_DEBUG_C */ } - mbedtls_test_ssl_endpoint_free(&client_ep); - mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_ssl_endpoint_free(&client_ep, NULL); + mbedtls_test_ssl_endpoint_free(&server_ep, NULL); } exit: - mbedtls_test_ssl_endpoint_free(&client_ep); - mbedtls_test_ssl_endpoint_free(&server_ep); + mbedtls_test_ssl_endpoint_free(&client_ep, NULL); + mbedtls_test_ssl_endpoint_free(&server_ep, NULL); mbedtls_test_free_handshake_options(&client_options); mbedtls_test_free_handshake_options(&server_options); #if defined(MBEDTLS_DEBUG_C) From 8c458b8cca4c4a55142efd65348e93595ec71723 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 8 Jun 2026 09:51:55 +0100 Subject: [PATCH 12/12] test_suite_ssl: Updated reject_hrr_selecting_unoffered_group dependencies Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 2cca520bce..5d8340853c 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3968,7 +3968,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_ECDH:PSA_WANT_ALG_ECDSA_ANY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_AT_LEAST_ONE_TLS1_3_CIPHERSUITE:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ALG_ECDH:MBEDTLS_PK_CAN_ECDSA_SIGN:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384 */ void reject_hrr_selecting_unoffered_group(void) { int ret = -1;