Merge tag 'mbedtls-4.1.0' into mbedtls-4.1.0_mergeback

Mbed TLS 4.1.0 Signed-off-by: Minos Galanakis <[email protected]>
2026-08-31 15:29:57 +00:00 · 2026-03-31 15:35:49 +01:00
parent 32a3d5209c 0fe989b6b5
commit 6804c92d7d
39 changed files with 725 additions and 181 deletions
@@ -557,7 +557,6 @@ setup_arguments()
    # with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes
    if is_dtls "$MODE"; then
        O_SERVER_ARGS="$O_SERVER_ARGS"
-        M_SERVER_ARGS="$M_SERVER_ARGS read_timeout=1000"
    else
        O_SERVER_ARGS="$O_SERVER_ARGS -www"
    fi
@@ -68,12 +68,44 @@
 #define MBEDTLS_CAN_HANDLE_RSA_TEST_KEY
 #endif

+#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
+    defined(PSA_WANT_ECC_SECP_R1_384) && \
+    defined(PSA_WANT_ALG_SHA_384)
+#define MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY
+#endif
+
+#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
+    defined(PSA_WANT_ECC_SECP_R1_256) && \
+    defined(PSA_WANT_ALG_SHA_256)
+#define MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY
+#endif
+
+#if defined(PSA_WANT_ECC_MONTGOMERY_255)        || \
+    defined(PSA_WANT_ECC_SECP_R1_256)           || \
+    defined(PSA_WANT_ECC_SECP_R1_384)           || \
+    defined(PSA_WANT_ECC_MONTGOMERY_448)        || \
+    defined(PSA_WANT_ECC_SECP_R1_521)           || \
+    defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)    || \
+    defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)    || \
+    defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
+#define MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP
+#endif
+
 #if defined(PSA_WANT_ALG_GCM) || \
    defined(PSA_WANT_ALG_CCM) || \
    defined(PSA_WANT_ALG_CHACHA20_POLY1305)
 #define MBEDTLS_TEST_HAS_AEAD_ALG
 #endif

+/*
+ * To use the test keys we need PSA_WANT_ALG_SHA_256. Some test cases need an additional hash that
+ * is configured by default (see mbedtls_ssl_config_defaults()), but it doesn't matter which one.
+ */
+#if defined(PSA_WANT_ALG_SHA_512) || \
+    defined(PSA_WANT_ALG_SHA_384)
+#define MBEDTLS_TEST_HAS_ADDITIONAL_HASH
+#endif
+
 enum {
 #define MBEDTLS_SSL_TLS1_3_LABEL(name, string)          \
    tls13_label_ ## name,
@@ -50,6 +50,15 @@ class CoverageTask(outcome_analysis.CoverageTask):
            # TLS doesn't use restartable ECDH yet.
            # https://github.com/Mbed-TLS/mbedtls/issues/7294
            re.compile(r'EC restart:.*no USE_PSA.*'),
+            # The following test fails intermittently on the CI with a frequency
+            # that significantly impacts CI throughput. They are thus disabled
+            # for the time being. See
+            # https://github.com/Mbed-TLS/mbedtls/issues/10652 for more
+            # information.
+            'DTLS proxy: 3d, openssl client, fragmentation',
+            'DTLS proxy: 3d, openssl client, fragmentation, nbio',
+            'DTLS proxy: 3d, gnutls client, fragmentation',
+            'DTLS proxy: 3d, gnutls client, fragmentation, nbio=2',
        ],
        'test_suite_config.mbedtls_boolean': [
            # Missing coverage of test configurations.
@@ -165,7 +165,6 @@ component_test_tls1_2_ccm_psk_dtls () {
    msg "build: configs/config-ccm-psk-dtls1_2.h"
    MBEDTLS_CONFIG="configs/config-ccm-psk-dtls1_2.h"
    CRYPTO_CONFIG="configs/crypto-config-ccm-psk-tls1_2.h"
-    tf-psa-crypto/scripts/config.py -f "$CRYPTO_CONFIG" set MBEDTLS_HAVE_TIME
    CC=$ASAN_CC cmake -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
    make

@@ -28,8 +28,9 @@ component_test_sw_inet_pton () {

    # MBEDTLS_TEST_HOOKS required for x509_crt_parse_cn_inet_pton
    scripts/config.py set MBEDTLS_TEST_HOOKS
-    $MAKE_COMMAND CFLAGS="-DMBEDTLS_TEST_SW_INET_PTON"
+    CC=$ASAN_CC CFLAGS="-DMBEDTLS_TEST_SW_INET_PTON" cmake -D CMAKE_BUILD_TYPE:String=Asan .
+    make

    msg "test: default plus MBEDTLS_TEST_SW_INET_PTON"
-    $MAKE_COMMAND test
+    make test
 }
@@ -443,7 +443,7 @@ const unsigned char *mbedtls_test_cas_der[] = {
    mbedtls_test_ca_crt_rsa_sha1_der,
 #endif /* PSA_WANT_ALG_SHA_1 */
 #endif /* MBEDTLS_RSA_C */
-#if defined(PSA_HAVE_ALG_SOME_ECDSA)
+#if defined(PSA_HAVE_ALG_SOME_ECDSA) && defined(PSA_WANT_ECC_SECP_R1_384)
    mbedtls_test_ca_crt_ec_der,
 #endif /* PSA_HAVE_ALG_SOME_ECDSA */
    NULL
@@ -458,7 +458,7 @@ const size_t mbedtls_test_cas_der_len[] = {
    sizeof(mbedtls_test_ca_crt_rsa_sha1_der),
 #endif /* PSA_WANT_ALG_SHA_1 */
 #endif /* MBEDTLS_RSA_C */
-#if defined(PSA_HAVE_ALG_SOME_ECDSA)
+#if defined(PSA_HAVE_ALG_SOME_ECDSA) && defined(PSA_WANT_ECC_SECP_R1_384)
    sizeof(mbedtls_test_ca_crt_ec_der),
 #endif /* PSA_HAVE_ALG_SOME_ECDSA */
    0
@@ -99,8 +99,10 @@ void mbedtls_test_free_handshake_options(
    mbedtls_test_handshake_test_options *opts)
 {
 #if defined(MBEDTLS_SSL_CACHE_C)
-    mbedtls_ssl_cache_free(opts->cache);
-    mbedtls_free(opts->cache);
+    if (opts->cache != NULL) {
+        mbedtls_ssl_cache_free(opts->cache);
+        mbedtls_free(opts->cache);
+    }
 #else
    (void) opts;
 #endif
@@ -9992,7 +9992,7 @@ run_test    "DTLS reassembly: no fragmentation (gnutls client)" \
            "$G_NEXT_CLI -u --mtu 2048 --insecure 127.0.0.1" \
            0 \
            -S "found fragmented DTLS handshake message" \
-            -S "error"
+            -s "HTTP/1.0 200 OK"

 requires_gnutls
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
@@ -10002,7 +10002,7 @@ run_test    "DTLS reassembly: some fragmentation (gnutls client)" \
            0 \
            -s "found fragmented DTLS handshake message" \
            -s "Certificate handshake message has been buffered and reassembled" \
-            -S "error"
+            -s "HTTP/1.0 200 OK"

 # Set the MTU to 128 bytes. The minimum size of a DTLS 1.2 record
 # containing a ClientHello handshake message is 69 bytes, without any cookie,
@@ -10017,7 +10017,7 @@ run_test    "DTLS reassembly: more fragmentation (gnutls client)" \
            "$G_NEXT_CLI -u --mtu 103 --insecure 127.0.0.1" \
            0 \
            -s "ClientHello handshake message has been buffered and reassembled" \
-            -S "error"
+            -s "HTTP/1.0 200 OK"

 requires_gnutls
 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
@@ -10026,7 +10026,7 @@ run_test    "DTLS reassembly: more fragmentation, nbio (gnutls client)" \
            "$G_NEXT_CLI -u --mtu 103 --insecure 127.0.0.1" \
            0 \
            -s "ClientHello handshake message has been buffered and reassembled" \
-            -S "error"
+            -s "HTTP/1.0 200 OK"

 # No fragmentation and renegotiation tests with GnuTLS client as the feature
 # does not work properly.
@@ -10067,7 +10067,7 @@ run_test    "DTLS reassembly: no fragmentation (openssl client)" \
            "$O_NEXT_CLI -dtls -mtu 2048 -cert $DATA_FILES_PATH/server5.crt -key $DATA_FILES_PATH/server5.key" \
            0 \
            -S "found fragmented DTLS handshake message" \
-            -S "error"
+            -s "HTTP/1.0 200 OK"

 # Minimum possible MTU for OpenSSL server: 256 bytes.
 # We expect the client Certificate handshake message to be fragmented and
@@ -10082,7 +10082,7 @@ run_test    "DTLS reassembly: some fragmentation (openssl client)" \
            0 \
            -s "found fragmented DTLS handshake message" \
            -s "Certificate handshake message has been buffered and reassembled" \
-            -S "error"
+            -s "HTTP/1.0 200 OK"

 requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
 run_test    "DTLS reassembly: fragmentation, nbio (openssl client)" \
@@ -10091,7 +10091,7 @@ run_test    "DTLS reassembly: fragmentation, nbio (openssl client)" \
            0 \
            -s "found fragmented DTLS handshake message" \
            -s "Certificate handshake message has been buffered and reassembled" \
-            -S "error"
+            -s "HTTP/1.0 200 OK"

 # Tests for sending fragmented handshake messages with DTLS
 #
@@ -12183,6 +12183,10 @@ run_test    "DTLS proxy: 3d, openssl client" \
            0 \
            -s "HTTP/1.0 200 OK"

+# The following test fails intermittently on the CI with a frequency that
+# significantly impacts CI throughput. Disable it for the time being.
+# See https://github.com/Mbed-TLS/mbedtls/issues/10652 for more information.
+skip_next_test
 requires_openssl_next
 client_needs_more_time 8
 not_with_valgrind # risk of non-mbedtls peer timing out
@@ -12196,6 +12200,10 @@ run_test    "DTLS proxy: 3d, openssl client, fragmentation" \
            -s "found fragmented DTLS handshake message" \
            -s "Certificate handshake message has been buffered and reassembled"

+# The following test fails intermittently on the CI with a frequency that
+# significantly impacts CI throughput. Disable it for the time being.
+# See https://github.com/Mbed-TLS/mbedtls/issues/10652 for more information.
+skip_next_test
 requires_openssl_next
 client_needs_more_time 8
 not_with_valgrind # risk of non-mbedtls peer timing out
@@ -12264,6 +12272,11 @@ run_test    "DTLS proxy: 3d, gnutls client" \
 # fragmentation to remain the case across GnuTLS version updates. Avoid using a
 # smaller MTU, as the smaller the MTU, the more likely the handshake is to fail
 # in this very unreliable connection emulation.
+
+# The following test fails intermittently on the CI with a frequency that
+# significantly impacts CI throughput. Disable it for the time being.
+# See https://github.com/Mbed-TLS/mbedtls/issues/10652 for more information.
+skip_next_test
 requires_gnutls
 client_needs_more_time 8
 not_with_valgrind # risk of non-mbedtls peer timing out
@@ -12276,6 +12289,10 @@ run_test    "DTLS proxy: 3d, gnutls client, fragmentation" \
            -s "HTTP/1.0 200 OK" \
            -s "ClientHello handshake message has been buffered and reassembled"

+# The following test fails intermittently on the CI with a frequency that
+# significantly impacts CI throughput. Disable it for the time being.
+# See https://github.com/Mbed-TLS/mbedtls/issues/10652 for more information.
+skip_next_test
 requires_gnutls
 client_needs_more_time 8
 not_with_valgrind # risk of non-mbedtls peer timing out
@@ -3530,3 +3530,22 @@ ssl_get_alert_after_fatal

 Default verify_result before doing a handshake
 verify_result_without_handshake
+
+TLS 1.3 - HRR then TLS 1.2 second ClientHello
+tls13_hrr_then_tls12_second_client_hello
+
+Baseline for: Server using sig_alg not offered by the client - RSA with SHA256
+depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:PSA_WANT_ALG_SHA_256
+send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:0
+
+Negative Test: Server using sig_alg not offered by the client - RSA with SHA256
+depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:PSA_WANT_ALG_SHA_256
+send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER
+
+Baseline for: Server using sig_alg not offered by the client - ECDSA with SHA512
+depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:PSA_WANT_ALG_SHA_512
+send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:0
+
+Negative Test: Server using sig_alg not offered by the client - ECDSA with SHA512
+depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:PSA_WANT_ALG_SHA_512
+send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER
@@ -5725,6 +5725,134 @@ exit:
 }
 /* END_CASE */

+/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/
+void send_invalid_sig_alg(int sig, int hash, int expected_ret)
+{
+    // This is a test about the client behaviour in case it receives a key exchange signed with a
+    // sig_alg it didn't specify in the client hello. The input specifies a target_sig_alg, which we
+    // make sure that the client does not offer but the server does. Then we make the server believe
+    // that target_sig_alg is the only one the client offered.
+
+    // Remark: We need an additional hash algorithm offered, because if we don't have it, the server
+    // realises too early that there is no common ground and we don't get the chance to manipulate
+    // it. This is why we need MBEDTLS_TEST_HAS_ADDITIONAL_HASH in the requirements.
+
+    enum { BUFFSIZE = 16384 };
+    uint16_t *client_sig_algs = NULL;
+    mbedtls_test_ssl_endpoint server, client;
+    memset(&server, 0, sizeof(server));
+    memset(&client, 0, sizeof(client));
+    mbedtls_test_handshake_test_options options;
+    memset(&options, 0, sizeof(options));
+
+    uint16_t target_sig_alg = ((hash << 8) | sig);
+
+    mbedtls_test_init_handshake_options(&options);
+
+    // Make sure the server has credentials for target_sig_alg
+    if (sig == MBEDTLS_SSL_SIG_ECDSA) {
+        options.pk_alg = MBEDTLS_PK_ECDSA;
+    } else {
+        options.pk_alg = MBEDTLS_PK_RSA;
+    }
+
+    // Force a ciphersuite where target_sig_alg is relevant
+    if (sig == MBEDTLS_SSL_SIG_ECDSA) {
+        options.cipher = "TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256";
+    } else {
+        options.cipher = "TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256";
+    }
+
+    // Force TLS 1.2 as this test is a non-regression test for a bug in TLS 1.2 client and TLS 1.3
+    // behaviour in this regard is substantially different.
+    options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_2;
+    options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_2;
+
+#if defined(MBEDTLS_DEBUG_C)
+    mbedtls_test_ssl_log_pattern cli_pattern;
+    cli_pattern.pattern = "that was not offered";
+    cli_pattern.counter = 0;
+    options.cli_log_obj = &cli_pattern;
+    options.cli_log_fun = mbedtls_test_ssl_log_analyzer;
+    // Add loggers for easier debugging - we are not looking for any patterns in the server logs.
+    // To turn on debug output, uncomment the threshold line and set the macro in the definition
+    // of mbedtls_test_ssl_log_analyzer().
+    options.srv_log_obj = NULL;
+    options.srv_log_fun = mbedtls_test_ssl_log_analyzer;
+    mbedtls_debug_set_threshold(3);
+#endif
+
+    int ret = -1;
+
+    PSA_INIT();
+
+    ret = mbedtls_test_ssl_endpoint_init_conf(&client, MBEDTLS_SSL_IS_CLIENT, &options);
+    TEST_EQUAL(ret, 0);
+
+    // Remove the target signature algorithm from the client's list
+    size_t client_sig_algs_len = 0;
+    while (client.conf.sig_algs[client_sig_algs_len++] != MBEDTLS_TLS1_3_SIG_NONE) {
+        ;
+    }
+    client_sig_algs_len--;
+
+    TEST_CALLOC(client_sig_algs, client_sig_algs_len);
+    size_t j = 0;
+    for (size_t i = 0; client.conf.sig_algs[i] != MBEDTLS_TLS1_3_SIG_NONE; i++) {
+        if (client.conf.sig_algs[i] != target_sig_alg) {
+            client_sig_algs[j++] = client.conf.sig_algs[i];
+        }
+    }
+    TEST_ASSERT(j < client_sig_algs_len);
+    client_sig_algs[j] = MBEDTLS_TLS1_3_SIG_NONE;
+    mbedtls_ssl_conf_sig_algs(&client.conf, client_sig_algs);
+
+    ret = mbedtls_test_ssl_endpoint_init_ssl(&client, &options);
+    TEST_EQUAL(ret, 0);
+
+    ret = mbedtls_test_ssl_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER,
+                                         &options);
+    TEST_EQUAL(ret, 0);
+
+    ret = mbedtls_test_mock_socket_connect(&server.socket, &client.socket,
+                                           BUFFSIZE);
+    TEST_EQUAL(ret, 0);
+
+    // Move the connection to the point before the server sending the key exchange message
+    ret = mbedtls_test_move_handshake_to_state(&server.ssl, &client.ssl,
+                                               MBEDTLS_SSL_SERVER_KEY_EXCHANGE);
+    TEST_EQUAL(ret, 0);
+
+    if (expected_ret != 0) {
+        // Make the server believe that the only sig_alg the client accepts is target_sig_alg
+        server.ssl.handshake->received_sig_algs[0] = target_sig_alg;
+        server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE;
+    }
+
+    // Move the connection to a state where it is certain that the client has parsed the server key
+    // exchange
+    ret = mbedtls_test_move_handshake_to_state(&client.ssl, &server.ssl,
+                                               MBEDTLS_SSL_CERTIFICATE_REQUEST);
+    TEST_EQUAL(ret, expected_ret);
+
+#if defined(MBEDTLS_DEBUG_C)
+    if (expected_ret != 0) {
+        TEST_EQUAL(cli_pattern.counter, 1);
+    }
+#endif
+
+exit:
+#if defined(MBEDTLS_DEBUG_C)
+    mbedtls_debug_set_threshold(0);
+#endif
+    mbedtls_test_free_handshake_options(&options);
+    mbedtls_test_ssl_endpoint_free(&server);
+    mbedtls_test_ssl_endpoint_free(&client);
+    mbedtls_free(client_sig_algs);
+    PSA_DONE();
+}
+/* END_CASE */
+
 /* BEGIN_CASE depends_on:MBEDTLS_SSL_KEYING_MATERIAL_EXPORT:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */
 void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int use_context)
 {
@@ -6083,3 +6211,142 @@ exit:
    PSA_DONE();
 }
 /* END_CASE */
+
+/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_CLI_C:MBEDTLS_SSL_SRV_C:MBEDTLS_TEST_HAS_TLS1_3_CHACHA20_POLY1305_SHA256:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED:PSA_WANT_ALG_SHA_256:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ECC_SECP_R1_384:PSA_HAVE_ALG_ECDSA_VERIFY:MBEDTLS_SSL_SESSION_TICKETS:MBEDTLS_DEBUG_C */
+void tls13_hrr_then_tls12_second_client_hello()
+{
+    int ret = -1;
+    mbedtls_test_ssl_endpoint client_ep, server_ep;
+    memset(&client_ep, 0, sizeof(client_ep));
+    memset(&server_ep, 0, sizeof(server_ep));
+    mbedtls_test_handshake_test_options client_options;
+    mbedtls_test_handshake_test_options server_options;
+    mbedtls_ssl_session saved_session;
+    mbedtls_test_ssl_log_pattern server_pattern =
+    { "Non compliant 2nd ClientHello, TLS 1.2 version", 0 };
+    uint16_t group_list[3] = {
+        MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1,
+        MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1,
+        MBEDTLS_SSL_IANA_TLS_GROUP_NONE
+    };
+    const int tls12_ciphersuite_list[2] = {
+        MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
+        0
+    };
+
+    mbedtls_test_init_handshake_options(&client_options);
+    mbedtls_test_init_handshake_options(&server_options);
+    mbedtls_ssl_session_init(&saved_session);
+
+    PSA_INIT();
+
+    /*
+     * Run first handshake to get a ticket from the server.
+     */
+    client_options.pk_alg = MBEDTLS_PK_ECDSA;
+    client_options.group_list = group_list;
+    client_options.cipher = "TLS1-3-CHACHA20-POLY1305-SHA256";
+    server_options.pk_alg = MBEDTLS_PK_ECDSA;
+    server_options.group_list = group_list;
+
+    ret = mbedtls_test_get_tls13_ticket(&client_options, &server_options,
+                                        &saved_session);
+    TEST_EQUAL(ret, 0);
+
+    /*
+     * Prepare for handshake with the ticket.
+     */
+    /* Remove the group SECP256R1 from the list of groups supported by the
+     * server. Since it is the client's preferred group, the client will
+     * send a key share only for SECP256R1, forcing the server to send a HRR.
+     */
+    server_options.group_list = group_list + 1;
+
+    ret = mbedtls_test_ssl_endpoint_init(&client_ep, MBEDTLS_SSL_IS_CLIENT,
+                                         &client_options);
+    TEST_EQUAL(ret, 0);
+
+    server_options.srv_log_fun = mbedtls_test_ssl_log_analyzer;
+    server_options.srv_log_obj = &server_pattern;
+    ret = mbedtls_test_ssl_endpoint_init(&server_ep, MBEDTLS_SSL_IS_SERVER,
+                                         &server_options);
+    TEST_EQUAL(ret, 0);
+
+    mbedtls_ssl_conf_session_tickets_cb(&server_ep.conf,
+                                        mbedtls_test_ticket_write,
+                                        mbedtls_test_ticket_parse,
+                                        NULL);
+
+    ret = mbedtls_test_mock_socket_connect(&(client_ep.socket),
+                                           &(server_ep.socket), 1024);
+    TEST_EQUAL(ret, 0);
+
+    ret = mbedtls_ssl_set_session(&(client_ep.ssl), &saved_session);
+    TEST_EQUAL(ret, 0);
+
+    /*
+     * Progress the handshake up to the point where the server has sent the
+     * HRR and the client has received and processed the server HRR but not
+     * written the second ClientHello in response to the HRR.
+     */
+    ret = mbedtls_test_move_handshake_to_state(
+        &(server_ep.ssl), &(client_ep.ssl),
+        MBEDTLS_SSL_HELLO_RETRY_REQUEST);
+    TEST_EQUAL(ret, 0);
+    TEST_EQUAL(client_ep.ssl.state, MBEDTLS_SSL_SERVER_HELLO);
+
+    ret = mbedtls_test_move_handshake_to_state(
+        &(client_ep.ssl), &(server_ep.ssl),
+        MBEDTLS_SSL_CLIENT_HELLO);
+    TEST_EQUAL(ret, 0);
+    TEST_EQUAL(server_ep.ssl.state, MBEDTLS_SSL_CLIENT_HELLO);
+
+    #if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE)
+    /* If the compatibility mode is enabled, filter the dummy change_cipher_spec
+     * record sent by the server after the HRR. Otherwise, as we have switched
+     * the client to TLS 1.2 it would fail when reading this record.
+     */
+    ret = mbedtls_ssl_read_record(&(client_ep.ssl), 0);
+    TEST_EQUAL(ret, MBEDTLS_ERR_SSL_WANT_READ);
+    #endif
+
+    /*
+     * The client has just received the server's HRR and is expected to send a
+     * second ClientHello. Instead of sending a compliant second TLS 1.3
+     * ClientHello, we want it to send a TLS 1.2-only ClientHello. To achieve
+     * this, we reset the client with a TLS 1.2-only configuration before
+     * resuming the handshake with the server.
+     */
+    client_ep.ssl.tls_version = MBEDTLS_SSL_VERSION_TLS1_2;
+    mbedtls_ssl_conf_min_tls_version(&client_ep.conf, MBEDTLS_SSL_VERSION_TLS1_2);
+    mbedtls_ssl_conf_max_tls_version(&client_ep.conf, MBEDTLS_SSL_VERSION_TLS1_2);
+    mbedtls_ssl_conf_ciphersuites(&client_ep.conf, tls12_ciphersuite_list);
+
+    ret = mbedtls_ssl_session_reset(&(client_ep.ssl));
+    TEST_EQUAL(ret, 0);
+
+    /*
+     * Restart and try to complete the handshake on server side which is
+     * expected to fail early.
+     */
+
+    mbedtls_debug_set_threshold(1);
+    ret = mbedtls_test_move_handshake_to_state(
+        &(server_ep.ssl), &(client_ep.ssl),
+        MBEDTLS_SSL_HANDSHAKE_OVER);
+    TEST_EQUAL(ret, MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
+
+    TEST_EQUAL(server_pattern.counter, 1);
+    TEST_EQUAL(client_ep.ssl.state, MBEDTLS_SSL_SERVER_HELLO);
+    TEST_EQUAL(server_ep.ssl.state, MBEDTLS_SSL_CLIENT_HELLO);
+
+exit:
+    mbedtls_test_ssl_endpoint_free(&client_ep);
+    mbedtls_test_ssl_endpoint_free(&server_ep);
+    mbedtls_test_free_handshake_options(&client_options);
+    mbedtls_test_free_handshake_options(&server_options);
+    mbedtls_ssl_session_free(&saved_session);
+    mbedtls_debug_set_threshold(0);
+    PSA_DONE();
+}
+/* END_CASE */
@@ -1,8 +1,8 @@
 Check compile time library version
-check_compiletime_version:"4.0.0"
+check_compiletime_version:"4.1.0"

 Check runtime library version
-check_runtime_version:"4.0.0"
+check_runtime_version:"4.1.0"

 Check for MBEDTLS_VERSION_C
 check_feature:"MBEDTLS_VERSION_C":0
@@ -1170,6 +1170,9 @@ x509_crt_parse_cn_inet_pton:"\:\:ffff\:1111.2.3.4":"":0
 X509 CRT parse CN: IPv6 invalid address IPv4-mapped #3
 x509_crt_parse_cn_inet_pton:"\:\:1.2.3.4\:ffff":"":0

+X509 CRT parse CN: IPv6 invalid address IPv4-mapped #4
+x509_crt_parse_cn_inet_pton:"1.2.3.4\:":"":0
+
 X509 CRT verification with ca callback: failure
 depends_on:MBEDTLS_PEM_PARSE_C:PSA_WANT_ALG_SHA_1:PSA_HAVE_ALG_SOME_RSA_VERIFY:MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
 x509_verify_ca_cb_failure:"../framework/data_files/server1.crt":"../framework/data_files/test-ca.crt":"NULL":MBEDTLS_ERR_X509_FATAL_ERROR
@@ -488,12 +488,22 @@ exit:
 void x509_crt_parse_cn_inet_pton(const char *cn, data_t *exp, int ref_ret)
 {
    uint32_t addr[4];
-    size_t addrlen = mbedtls_x509_crt_parse_cn_inet_pton(cn, addr);
+
+    char *cn_local = NULL;
+    size_t cn_local_len = strlen(cn) + 1;
+    TEST_CALLOC(cn_local, cn_local_len);
+    memcpy(cn_local, cn, cn_local_len);
+
+    size_t addrlen = mbedtls_x509_crt_parse_cn_inet_pton(cn_local, addr);
    TEST_EQUAL(addrlen, (size_t) ref_ret);

    if (addrlen) {
        TEST_MEMORY_COMPARE(exp->x, exp->len, addr, addrlen);
    }
+
+exit:
+    mbedtls_free(cn_local);
+
 }
 /* END_CASE */