From d7b85b76a66354fedab299c27e6a8da9e26e08fe Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 23 Jan 2026 16:22:50 +0000 Subject: [PATCH 01/21] sig_algs: fix typo in client's sig_algs check This bug caused the client accepting sig_algs used by the server that it explicitly wanted to disallow. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index ebcc0d56bb..b03859a8d6 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1910,8 +1910,8 @@ start_processing: MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); sig_alg = MBEDTLS_GET_UINT16_BE(p, 0); if (mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg( - sig_alg, &pk_alg, &md_alg) != 0 && - !mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg) && + sig_alg, &pk_alg, &md_alg) != 0 || + !mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg) || !mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("bad server key exchange message")); From 01f6ccf020485f6c29d769226c5cdd12340fb315 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 18 Feb 2026 19:39:56 +0000 Subject: [PATCH 02/21] Fix root cert prerequisites This root certificate uses SECP-384 and if we don't have it in the build, the parsing already fails even if we don't try to use it, there is no reason to have it in the build without the SECP-384. Signed-off-by: Janos Follath --- tests/src/certs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/src/certs.c b/tests/src/certs.c index c45f0628c0..3ec99cd516 100644 --- a/tests/src/certs.c +++ b/tests/src/certs.c @@ -443,7 +443,7 @@ const unsigned char *mbedtls_test_cas_der[] = { mbedtls_test_ca_crt_rsa_sha1_der, #endif /* PSA_WANT_ALG_SHA_1 */ #endif /* MBEDTLS_RSA_C */ -#if defined(PSA_HAVE_ALG_SOME_ECDSA) +#if defined(PSA_HAVE_ALG_SOME_ECDSA) && defined(PSA_WANT_ECC_SECP_R1_384) mbedtls_test_ca_crt_ec_der, #endif /* PSA_HAVE_ALG_SOME_ECDSA */ NULL From bab37f69d99cd14d64799dc6c4749d83a062e6d9 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 18 Feb 2026 14:25:41 +0000 Subject: [PATCH 03/21] Fix mbedtls_test_free_handshake_options We usually follow the pattern that a zero-initialised struct is safe to free. This wasn't the case here. Signed-off-by: Janos Follath --- tests/src/test_helpers/ssl_helpers.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c index 83dac17419..db29413de6 100644 --- a/tests/src/test_helpers/ssl_helpers.c +++ b/tests/src/test_helpers/ssl_helpers.c @@ -99,8 +99,10 @@ void mbedtls_test_free_handshake_options( mbedtls_test_handshake_test_options *opts) { #if defined(MBEDTLS_SSL_CACHE_C) - mbedtls_ssl_cache_free(opts->cache); - mbedtls_free(opts->cache); + if (opts->cache != NULL) { + mbedtls_ssl_cache_free(opts->cache); + mbedtls_free(opts->cache); + } #else (void) opts; #endif From 475ac34e1fac035792d0a49c514d34f993f368bc Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 23 Jan 2026 16:18:01 +0000 Subject: [PATCH 04/21] sig_algs: Add non-regression test Signed-off-by: Janos Follath --- tests/include/test/ssl_helpers.h | 28 +++++++ tests/suites/test_suite_ssl.data | 8 ++ tests/suites/test_suite_ssl.function | 114 +++++++++++++++++++++++++++ 3 files changed, 150 insertions(+) diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h index d019c5065e..70e4bbaae1 100644 --- a/tests/include/test/ssl_helpers.h +++ b/tests/include/test/ssl_helpers.h @@ -68,12 +68,40 @@ #define MBEDTLS_CAN_HANDLE_RSA_TEST_KEY #endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ + defined(PSA_WANT_ECC_SECP_R1_384) && \ + defined(PSA_WANT_ALG_SHA_384) +#define MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY +#endif + +#if defined(PSA_WANT_ECC_MONTGOMERY_255) || \ + defined(PSA_WANT_ECC_SECP_R1_256) || \ + defined(PSA_WANT_ECC_SECP_R1_384) || \ + defined(PSA_WANT_ECC_MONTGOMERY_448) || \ + defined(PSA_WANT_ECC_SECP_R1_521) || \ + defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) || \ + defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) || \ + defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) +#define MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP +#endif + #if defined(PSA_WANT_ALG_GCM) || \ defined(PSA_WANT_ALG_CCM) || \ defined(PSA_WANT_ALG_CHACHA20_POLY1305) #define MBEDTLS_TEST_HAS_AEAD_ALG #endif +/* + * To use the test keys we need PSA_WANT_ALG_SHA_256. Some test cases need an additional hash that + * can be used in modern TLS, but it doesn't matter which one. + */ +#if defined(PSA_WANT_ALG_SHA_512) || \ + defined(PSA_WANT_ALG_SHA_384) || \ + defined(PSA_WANT_ALG_SHA_224) || \ + defined(PSA_WANT_ALG_SHA_1) +#define MBEDTLS_TEST_HAS_ADDITIONAL_HASH +#endif + enum { #define MBEDTLS_SSL_TLS1_3_LABEL(name, string) \ tls13_label_ ## name, diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 99856e304b..da9a5e738e 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3530,3 +3530,11 @@ ssl_get_alert_after_fatal TLS 1.3 - HRR then TLS 1.2 second ClientHello tls13_hrr_then_tls12_second_client_hello + +Negative Test: Server using sig_alg not offered by the client #1 +depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:PSA_WANT_ALG_SHA_256 +send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER + +Negative Test: Server using sig_alg not offered by the client #2 +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_512 +send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index ca59346cc8..b447773f12 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5725,6 +5725,120 @@ exit: } /* END_CASE */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/ +void send_invalid_sig_alg(int sig, int hash, int expected_ret) +{ + // This is a test about the client behaviour in case it receives a key exchange signed with a + // sig_alg it didn't specify in the client hello. The input specifies a target_sig_alg, which we + // make sure that the client does not offer but the server does. Then we make the server beleive + // that target_sig_alg is the only one the client offered. + + // Remark: We need an additional hash algorithm offered, because if we don't have it, the server + // realises too early that there is no common ground and we don't get the chance to manipulate + // it. This is why we need MBEDTLS_TEST_HAS_ADDITIONAL_HASH in the requirements. + + enum { BUFFSIZE = 16384 }; + uint16_t *client_sig_algs = NULL; + mbedtls_test_ssl_endpoint server, client; + memset(&server, 0, sizeof(server)); + memset(&client, 0, sizeof(client)); + mbedtls_test_handshake_test_options options; + memset(&options, 0, sizeof(options)); + + uint16_t target_sig_alg = ((hash << 8) | sig); + + mbedtls_test_init_handshake_options(&options); + + // Make sure the server has credentals for target_sig_alg + if (sig == MBEDTLS_SSL_SIG_ECDSA) { + options.pk_alg = MBEDTLS_PK_ECDSA; + } else { + options.pk_alg = MBEDTLS_PK_RSA; + } + + // Force a ciphersuite where target_sig_alg is relevant + if (sig == MBEDTLS_SSL_SIG_ECDSA) { + options.cipher = "TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256"; + } else { + options.cipher = "TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256"; + } + + // Force TLS 1.2 as this test is a non-regression test for a bug in TLS 1.2 client and TLS 1.3 + // behaviour in this regard is substantially different. + options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_2; + options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_2; + + // Add loggers for easier debugging - we are not looking for any patterns. + // To turn on debug output, uncomment the threshold line and set the macro in + // the definition of mbedtls_test_ssl_log_analyzer(). +#if defined(MBEDTLS_DEBUG_C) + options.srv_log_obj = NULL; + options.srv_log_fun = mbedtls_test_ssl_log_analyzer; + options.cli_log_obj = NULL; + options.cli_log_fun = mbedtls_test_ssl_log_analyzer; + mbedtls_debug_set_threshold(3); +#endif + + int ret = -1; + + PSA_INIT(); + + ret = mbedtls_test_ssl_endpoint_init_conf(&client, MBEDTLS_SSL_IS_CLIENT, &options); + TEST_EQUAL(ret, 0); + + // Remove the target signature algorithm from the client's list + size_t client_sig_algs_len = 0; + while (client.conf.sig_algs[client_sig_algs_len++] != MBEDTLS_TLS1_3_SIG_NONE) { + ; + } + client_sig_algs_len--; + + TEST_CALLOC(client_sig_algs, client_sig_algs_len); + size_t j = 0; + for (size_t i = 0; client.conf.sig_algs[i] != MBEDTLS_TLS1_3_SIG_NONE; i++) { + if (client.conf.sig_algs[i] != target_sig_alg) { + client_sig_algs[j++] = client.conf.sig_algs[i]; + } + } + TEST_ASSERT(j < client_sig_algs_len); + client_sig_algs[j] = MBEDTLS_TLS1_3_SIG_NONE; + client.conf.sig_algs = client_sig_algs; + + ret = mbedtls_test_ssl_endpoint_init_ssl(&client, &options); + TEST_EQUAL(ret, 0); + + ret = mbedtls_test_ssl_endpoint_init(&server, MBEDTLS_SSL_IS_SERVER, + &options); + TEST_EQUAL(ret, 0); + + ret = mbedtls_test_mock_socket_connect(&server.socket, &client.socket, + BUFFSIZE); + TEST_EQUAL(ret, 0); + + // Move the connection to the point before the server sending the key exchange message + ret = mbedtls_test_move_handshake_to_state(&server.ssl, &client.ssl, + MBEDTLS_SSL_SERVER_KEY_EXCHANGE); + TEST_EQUAL(ret, 0); + + // Make the server beleive that the only sig_alg the client accepts is target_sig_alg + server.ssl.handshake->received_sig_algs[0] = target_sig_alg; + server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE; + + // Move the connection to a state where it is certain that the client has parsed the server key + // exchange + ret = mbedtls_test_move_handshake_to_state(&client.ssl, &server.ssl, + MBEDTLS_SSL_CERTIFICATE_REQUEST); + TEST_EQUAL(ret, expected_ret); + +exit: + mbedtls_test_free_handshake_options(&options); + mbedtls_test_ssl_endpoint_free(&server); + mbedtls_test_ssl_endpoint_free(&client); + mbedtls_free(client_sig_algs); + PSA_DONE(); +} +/* END_CASE */ + /* BEGIN_CASE depends_on:MBEDTLS_SSL_KEYING_MATERIAL_EXPORT:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */ void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int use_context) { From f68d402029c6fb61a73b63ba5b977ec9a8a52270 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 23 Jan 2026 16:31:53 +0000 Subject: [PATCH 05/21] sig_algs: add ChangeLog Signed-off-by: Janos Follath --- ChangeLog.d/sig_algs_check.txt | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 ChangeLog.d/sig_algs_check.txt diff --git a/ChangeLog.d/sig_algs_check.txt b/ChangeLog.d/sig_algs_check.txt new file mode 100644 index 0000000000..b0aed6dfd3 --- /dev/null +++ b/ChangeLog.d/sig_algs_check.txt @@ -0,0 +1,5 @@ +Security + * Fix a bug in the TLS 1.2 client's signature algorithm check, which caused + the client to accept server key exchange messages signed with a signature + algorithm explicitly disallowed by the client. Found and reported by + EFR-GmbH and M. Heuft of Security-Research-Consulting GmbH. CVE-2026-25834 From e8894974cbc8dc98b4ddeea0f645ce0e19ac84f5 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 11:51:30 +0000 Subject: [PATCH 06/21] Reintroduce ssl_parse_signature_algorithm The logic was easier to follow before 693a47a, which removed the ssl_parse_signature_algorithm function and introduced the bug being fixed in this PR. When validating multiple conditions, it's easier to read, easier to debug and, as we can see, easier to get right if you validate them separately. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 74 +++++++++++++++++++++++++++++++++----- 1 file changed, 66 insertions(+), 8 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index b03859a8d6..8d26562c1e 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1732,6 +1732,71 @@ static int ssl_parse_server_psk_hint(mbedtls_ssl_context *ssl, } #endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \ + defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) +MBEDTLS_CHECK_RETURN_CRITICAL +static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, + unsigned char **p, + unsigned char *end, + mbedtls_md_type_t *md_alg, + mbedtls_pk_sigalg_t *pk_alg) +{ + *md_alg = MBEDTLS_MD_NONE; + *pk_alg = MBEDTLS_PK_SIGALG_NONE; + + MBEDTLS_SSL_CHK_BUF_READ_PTR(*p, end, 2); + uint16_t sig_alg = MBEDTLS_GET_UINT16_BE(*p, 0); + + if (mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg(sig_alg, pk_alg, md_alg) != 0) { + /* + * Check hash algorithm + */ + if (*md_alg == MBEDTLS_MD_NONE) { + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", (*p)[0])); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + /* + * Check signature algorithm + */ + if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported SignatureAlgorithm %d", (*p)[1])); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + /* + * This shouldn't happen, but be robust. + */ + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + /* + * mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg() understands sig_alg code points across + * TLS versions. Make sure that the received sig_alg extension is valid in TLS 1.2. + */ + if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { + MBEDTLS_SSL_DEBUG_MSG( 1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + /* + * Check if the signature algorithm is acceptable + */ + if(!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); + return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + } + + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", (*p)[1])); + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used HashAlgorithm %d", (*p)[0])); + *p += 2; + + return 0; +} +#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED || + MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ + MBEDTLS_CHECK_RETURN_CRITICAL static int ssl_parse_server_key_exchange(mbedtls_ssl_context *ssl) { @@ -1889,7 +1954,6 @@ start_processing: unsigned char *params = ssl->in_msg + mbedtls_ssl_hs_hdr_len(ssl); size_t params_len = (size_t) (p - params); void *rs_ctx = NULL; - uint16_t sig_alg; mbedtls_pk_context *peer_pk; @@ -1907,12 +1971,7 @@ start_processing: /* * Handle the digitally-signed structure */ - MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); - sig_alg = MBEDTLS_GET_UINT16_BE(p, 0); - if (mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg( - sig_alg, &pk_alg, &md_alg) != 0 || - !mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg) || - !mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { + if (ssl_parse_signature_algorithm(ssl, &p, end, &md_alg, &pk_alg) != 0) { MBEDTLS_SSL_DEBUG_MSG(1, ("bad server key exchange message")); mbedtls_ssl_send_alert_message( @@ -1921,7 +1980,6 @@ start_processing: MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; } - p += 2; psa_hash_alg = mbedtls_md_psa_alg_from_type(md_alg); if (!mbedtls_pk_can_do_psa(peer_pk, From 25f971db8750fc87f19f9981719b35b32040b74f Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 14:02:38 +0000 Subject: [PATCH 07/21] Fix the MBEDTLS_TEST_HAS_ADDITIONAL_HASH macro It should require a hash that is configured in TLS 1.2 SSL contexts by default. Signed-off-by: Janos Follath --- tests/include/test/ssl_helpers.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h index 70e4bbaae1..2744016fa8 100644 --- a/tests/include/test/ssl_helpers.h +++ b/tests/include/test/ssl_helpers.h @@ -93,12 +93,10 @@ /* * To use the test keys we need PSA_WANT_ALG_SHA_256. Some test cases need an additional hash that - * can be used in modern TLS, but it doesn't matter which one. + * is configured by default (see mbedtls_ssl_config_defaults()), but it doesn't matter which one. */ #if defined(PSA_WANT_ALG_SHA_512) || \ - defined(PSA_WANT_ALG_SHA_384) || \ - defined(PSA_WANT_ALG_SHA_224) || \ - defined(PSA_WANT_ALG_SHA_1) + defined(PSA_WANT_ALG_SHA_384) #define MBEDTLS_TEST_HAS_ADDITIONAL_HASH #endif From 971309addfdb4f026fa86561803d732d09cd18fa Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 14:17:14 +0000 Subject: [PATCH 08/21] Use API function to set sig_alg config in test Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index b447773f12..90580b393d 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5802,7 +5802,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) } TEST_ASSERT(j < client_sig_algs_len); client_sig_algs[j] = MBEDTLS_TLS1_3_SIG_NONE; - client.conf.sig_algs = client_sig_algs; + mbedtls_ssl_conf_sig_algs(&client.conf, client_sig_algs); ret = mbedtls_test_ssl_endpoint_init_ssl(&client, &options); TEST_EQUAL(ret, 0); From 305aef1ad7b603f54152ee26874263b37daaf264 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 14:44:02 +0000 Subject: [PATCH 09/21] send_invalid_sig_alg: check logs There are other issues that can fail with the same error code. Make sure that the handshake fails exactly the way we want it to fail by analysing the client logs. Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 90580b393d..4a2ca71835 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5768,14 +5768,17 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_2; options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_2; - // Add loggers for easier debugging - we are not looking for any patterns. - // To turn on debug output, uncomment the threshold line and set the macro in - // the definition of mbedtls_test_ssl_log_analyzer(). + mbedtls_test_ssl_log_pattern cli_pattern; + cli_pattern.pattern = "that was not offered"; + cli_pattern.counter = 0; + options.cli_log_obj = &cli_pattern; + options.cli_log_fun = mbedtls_test_ssl_log_analyzer; #if defined(MBEDTLS_DEBUG_C) + // Add loggers for easier debugging - we are not looking for any patterns in the server logs. + // To turn on debug output, uncomment the threshold line and set the macro in the definition + // of mbedtls_test_ssl_log_analyzer(). options.srv_log_obj = NULL; options.srv_log_fun = mbedtls_test_ssl_log_analyzer; - options.cli_log_obj = NULL; - options.cli_log_fun = mbedtls_test_ssl_log_analyzer; mbedtls_debug_set_threshold(3); #endif @@ -5829,8 +5832,12 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) ret = mbedtls_test_move_handshake_to_state(&client.ssl, &server.ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST); TEST_EQUAL(ret, expected_ret); + TEST_EQUAL(cli_pattern.counter, 1); exit: +#if defined(MBEDTLS_DEBUG_C) + mbedtls_debug_set_threshold(0); +#endif mbedtls_test_free_handshake_options(&options); mbedtls_test_ssl_endpoint_free(&server); mbedtls_test_ssl_endpoint_free(&client); From 6cb0d86f16b4a0728bbceaafc9adc5d51769a074 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 14:58:27 +0000 Subject: [PATCH 10/21] Fix some compile time guards Signed-off-by: Janos Follath --- tests/src/certs.c | 2 +- tests/suites/test_suite_ssl.data | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/src/certs.c b/tests/src/certs.c index 3ec99cd516..b9ba13b7ee 100644 --- a/tests/src/certs.c +++ b/tests/src/certs.c @@ -458,7 +458,7 @@ const size_t mbedtls_test_cas_der_len[] = { sizeof(mbedtls_test_ca_crt_rsa_sha1_der), #endif /* PSA_WANT_ALG_SHA_1 */ #endif /* MBEDTLS_RSA_C */ -#if defined(PSA_HAVE_ALG_SOME_ECDSA) +#if defined(PSA_HAVE_ALG_SOME_ECDSA) && defined(PSA_WANT_ECC_SECP_R1_384) sizeof(mbedtls_test_ca_crt_ec_der), #endif /* PSA_HAVE_ALG_SOME_ECDSA */ 0 diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index da9a5e738e..7a6999687f 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3536,5 +3536,5 @@ depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:PSA_WANT_ALG_SHA_256 send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER Negative Test: Server using sig_alg not offered by the client #2 -depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_512 +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:PSA_WANT_ALG_SHA_512 send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER From c139e44935a7086cef5697ba9580cadc92a8e125 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Tue, 10 Mar 2026 15:01:11 +0000 Subject: [PATCH 11/21] Fix typos Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 4a2ca71835..3149668e99 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5749,7 +5749,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) mbedtls_test_init_handshake_options(&options); - // Make sure the server has credentals for target_sig_alg + // Make sure the server has credentials for target_sig_alg if (sig == MBEDTLS_SSL_SIG_ECDSA) { options.pk_alg = MBEDTLS_PK_ECDSA; } else { @@ -5823,7 +5823,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) MBEDTLS_SSL_SERVER_KEY_EXCHANGE); TEST_EQUAL(ret, 0); - // Make the server beleive that the only sig_alg the client accepts is target_sig_alg + // Make the server believe that the only sig_alg the client accepts is target_sig_alg server.ssl.handshake->received_sig_algs[0] = target_sig_alg; server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE; From 6394676a741b4b7fc42a25509a26d9b12eafa50a Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 09:21:32 +0000 Subject: [PATCH 12/21] Fix test case dependency Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 3149668e99..c00acd755b 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5725,7 +5725,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:MBEDTLS_DEBUG_C*/ void send_invalid_sig_alg(int sig, int hash, int expected_ret) { // This is a test about the client behaviour in case it receives a key exchange signed with a @@ -5773,14 +5773,12 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) cli_pattern.counter = 0; options.cli_log_obj = &cli_pattern; options.cli_log_fun = mbedtls_test_ssl_log_analyzer; -#if defined(MBEDTLS_DEBUG_C) // Add loggers for easier debugging - we are not looking for any patterns in the server logs. // To turn on debug output, uncomment the threshold line and set the macro in the definition // of mbedtls_test_ssl_log_analyzer(). options.srv_log_obj = NULL; options.srv_log_fun = mbedtls_test_ssl_log_analyzer; mbedtls_debug_set_threshold(3); -#endif int ret = -1; @@ -5835,9 +5833,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) TEST_EQUAL(cli_pattern.counter, 1); exit: -#if defined(MBEDTLS_DEBUG_C) mbedtls_debug_set_threshold(0); -#endif mbedtls_test_free_handshake_options(&options); mbedtls_test_ssl_endpoint_free(&server); mbedtls_test_ssl_endpoint_free(&client); From 75092c82620cb6d9ecda5dbda32ca3bda80b435f Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 09:57:04 +0000 Subject: [PATCH 13/21] send_invalid_sig_alg: add baseline test Add a test case with a successful handshake for each test case that causes the desired handshake failure, with minimal differences between the two. The reason is to have more assurance that the handshake is failing for the desired reason (as opposed to not having done something correctly in the test code). Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.data | 12 ++++++++++-- tests/suites/test_suite_ssl.function | 13 +++++++++---- 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 7a6999687f..15b986a805 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3531,10 +3531,18 @@ ssl_get_alert_after_fatal TLS 1.3 - HRR then TLS 1.2 second ClientHello tls13_hrr_then_tls12_second_client_hello -Negative Test: Server using sig_alg not offered by the client #1 +Baseline for: Server using sig_alg not offered by the client - RSA with SHA256 +depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:PSA_WANT_ALG_SHA_256 +send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:0 + +Negative Test: Server using sig_alg not offered by the client - RSA with SHA256 depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:PSA_WANT_ALG_SHA_256 send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER -Negative Test: Server using sig_alg not offered by the client #2 +Baseline for: Server using sig_alg not offered by the client - ECDSA with SHA512 +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:PSA_WANT_ALG_SHA_512 +send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:0 + +Negative Test: Server using sig_alg not offered by the client - ECDSA with SHA512 depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:PSA_WANT_ALG_SHA_512 send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index c00acd755b..6d37b908c4 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5821,16 +5821,21 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) MBEDTLS_SSL_SERVER_KEY_EXCHANGE); TEST_EQUAL(ret, 0); - // Make the server believe that the only sig_alg the client accepts is target_sig_alg - server.ssl.handshake->received_sig_algs[0] = target_sig_alg; - server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE; + if (expected_ret != 0) { + // Make the server believe that the only sig_alg the client accepts is target_sig_alg + server.ssl.handshake->received_sig_algs[0] = target_sig_alg; + server.ssl.handshake->received_sig_algs[1] = MBEDTLS_TLS1_3_SIG_NONE; + } // Move the connection to a state where it is certain that the client has parsed the server key // exchange ret = mbedtls_test_move_handshake_to_state(&client.ssl, &server.ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST); TEST_EQUAL(ret, expected_ret); - TEST_EQUAL(cli_pattern.counter, 1); + + if (expected_ret != 0) { + TEST_EQUAL(cli_pattern.counter, 1); + } exit: mbedtls_debug_set_threshold(0); From 3d0235328123a77321a7ec90f94bf9652aa11f29 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 11:35:44 +0000 Subject: [PATCH 14/21] Fix code style Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 8d26562c1e..4673827557 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1776,14 +1776,14 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, * TLS versions. Make sure that the received sig_alg extension is valid in TLS 1.2. */ if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { - MBEDTLS_SSL_DEBUG_MSG( 1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } /* * Check if the signature algorithm is acceptable */ - if(!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { + if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } From 8d21dbf8e899f5ae501c2b6bc23550a21bac685f Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 16:09:37 +0000 Subject: [PATCH 15/21] Fix dependencies The unit test framework always loads the client key as well, which requires a different curve and a hash than the server key. Signed-off-by: Janos Follath --- tests/include/test/ssl_helpers.h | 6 ++++++ tests/suites/test_suite_ssl.data | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h index 2744016fa8..a653c9643e 100644 --- a/tests/include/test/ssl_helpers.h +++ b/tests/include/test/ssl_helpers.h @@ -74,6 +74,12 @@ #define MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY #endif +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ + defined(PSA_WANT_ECC_SECP_R1_256) && \ + defined(PSA_WANT_ALG_SHA_256) +#define MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY +#endif + #if defined(PSA_WANT_ECC_MONTGOMERY_255) || \ defined(PSA_WANT_ECC_SECP_R1_256) || \ defined(PSA_WANT_ECC_SECP_R1_384) || \ diff --git a/tests/suites/test_suite_ssl.data b/tests/suites/test_suite_ssl.data index 15b986a805..53c1c035a8 100644 --- a/tests/suites/test_suite_ssl.data +++ b/tests/suites/test_suite_ssl.data @@ -3540,9 +3540,9 @@ depends_on:MBEDTLS_CAN_HANDLE_RSA_TEST_KEY:PSA_WANT_ALG_SHA_256 send_invalid_sig_alg:MBEDTLS_SSL_SIG_RSA:MBEDTLS_SSL_HASH_SHA256:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER Baseline for: Server using sig_alg not offered by the client - ECDSA with SHA512 -depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:PSA_WANT_ALG_SHA_512 +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:PSA_WANT_ALG_SHA_512 send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:0 Negative Test: Server using sig_alg not offered by the client - ECDSA with SHA512 -depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:PSA_WANT_ALG_SHA_512 +depends_on:MBEDTLS_CAN_HANDLE_ECDSA_TEST_KEY:MBEDTLS_CAN_HANDLE_ECDSA_CLIENT_TEST_KEY:PSA_WANT_ALG_SHA_512 send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECDSA:MBEDTLS_SSL_HASH_SHA512:MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER From c46eccf6ef0df8e54e50cc19eaaa3c90142d3c7a Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 16:40:02 +0000 Subject: [PATCH 16/21] ssl_parse_signature_algorithm: caller to get bytes After the recent refactoring ssl_parse_signature_algorithm() sends an alert on failure, but the caller also sends an alert on failure. Sending two alerts is at least a protocol violation, and might not leave the SSL context in a good state. It is simpler to have the caller read the two bytes, and pass them to this function. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 4673827557..0bcbc7a5e1 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1736,23 +1736,19 @@ static int ssl_parse_server_psk_hint(mbedtls_ssl_context *ssl, defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) MBEDTLS_CHECK_RETURN_CRITICAL static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, - unsigned char **p, - unsigned char *end, + uint16_t sig_alg, mbedtls_md_type_t *md_alg, mbedtls_pk_sigalg_t *pk_alg) { *md_alg = MBEDTLS_MD_NONE; *pk_alg = MBEDTLS_PK_SIGALG_NONE; - MBEDTLS_SSL_CHK_BUF_READ_PTR(*p, end, 2); - uint16_t sig_alg = MBEDTLS_GET_UINT16_BE(*p, 0); - if (mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg(sig_alg, pk_alg, md_alg) != 0) { /* * Check hash algorithm */ if (*md_alg == MBEDTLS_MD_NONE) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", (*p)[0])); + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", sig_alg >> 8)); return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } @@ -1760,7 +1756,8 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, * Check signature algorithm */ if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported SignatureAlgorithm %d", (*p)[1])); + MBEDTLS_SSL_DEBUG_MSG(1, + ("Server used unsupported SignatureAlgorithm %d", sig_alg & 0x00FF)); return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } @@ -1788,9 +1785,8 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; } - MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", (*p)[1])); - MBEDTLS_SSL_DEBUG_MSG(2, ("Server used HashAlgorithm %d", (*p)[0])); - *p += 2; + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", sig_alg & 0x00FF)); + MBEDTLS_SSL_DEBUG_MSG(2, ("Server used HashAlgorithm %d", sig_alg >> 8)); return 0; } @@ -1971,7 +1967,9 @@ start_processing: /* * Handle the digitally-signed structure */ - if (ssl_parse_signature_algorithm(ssl, &p, end, &md_alg, &pk_alg) != 0) { + MBEDTLS_SSL_CHK_BUF_READ_PTR(p, end, 2); + uint16_t sig_alg = MBEDTLS_GET_UINT16_BE(p, 0); + if (ssl_parse_signature_algorithm(ssl, sig_alg, &md_alg, &pk_alg) != 0) { MBEDTLS_SSL_DEBUG_MSG(1, ("bad server key exchange message")); mbedtls_ssl_send_alert_message( @@ -1980,6 +1978,7 @@ start_processing: MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER); return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER; } + p += 2; psa_hash_alg = mbedtls_md_psa_alg_from_type(md_alg); if (!mbedtls_pk_can_do_psa(peer_pk, From 862c191f4f004de89702c86e38049694fd52a7f0 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 16:55:28 +0000 Subject: [PATCH 17/21] send_invalid_sig_alg: reduce debug dependency Run as much of the test as we can even in the abscence of MBEDTLS_DEBUG_C. Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 6d37b908c4..6b3bca6edd 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5768,6 +5768,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) options.client_max_version = MBEDTLS_SSL_VERSION_TLS1_2; options.server_max_version = MBEDTLS_SSL_VERSION_TLS1_2; +#if defined(MBEDTLS_DEBUG_C) mbedtls_test_ssl_log_pattern cli_pattern; cli_pattern.pattern = "that was not offered"; cli_pattern.counter = 0; @@ -5779,6 +5780,7 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) options.srv_log_obj = NULL; options.srv_log_fun = mbedtls_test_ssl_log_analyzer; mbedtls_debug_set_threshold(3); +#endif int ret = -1; @@ -5833,12 +5835,16 @@ void send_invalid_sig_alg(int sig, int hash, int expected_ret) MBEDTLS_SSL_CERTIFICATE_REQUEST); TEST_EQUAL(ret, expected_ret); +#if defined(MBEDTLS_DEBUG_C) if (expected_ret != 0) { TEST_EQUAL(cli_pattern.counter, 1); } +#endif exit: +#if defined(MBEDTLS_DEBUG_C) mbedtls_debug_set_threshold(0); +#endif mbedtls_test_free_handshake_options(&options); mbedtls_test_ssl_endpoint_free(&server); mbedtls_test_ssl_endpoint_free(&client); From 7b255e3a12a93fc87e3170ee2230a95550ba3df6 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 17:02:56 +0000 Subject: [PATCH 18/21] ssl_parse_signature_algorithm: match error codes The caller is returning MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER if ssl_parse_signature_algorithm() fails, but ssl_parse_signature_algorithm() returns MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE upon failure. There is no good reason for this mismatch and better to be aligned. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 0bcbc7a5e1..841f911e66 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1749,7 +1749,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (*md_alg == MBEDTLS_MD_NONE) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", sig_alg >> 8)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -1758,14 +1758,14 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported SignatureAlgorithm %d", sig_alg & 0x00FF)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* * This shouldn't happen, but be robust. */ MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -1774,7 +1774,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -1782,7 +1782,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", sig_alg & 0x00FF)); From 5ffef2897161abf432d957442a7ddc5d96b1e87d Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Thu, 12 Mar 2026 12:12:30 +0000 Subject: [PATCH 19/21] Fix code style Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 841f911e66..76ec4b6c4b 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1757,7 +1757,8 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { MBEDTLS_SSL_DEBUG_MSG(1, - ("Server used unsupported SignatureAlgorithm %d", sig_alg & 0x00FF)); + ("Server used unsupported SignatureAlgorithm %d", + sig_alg & 0x00FF)); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } From 703c2a6d7c7ead396d170dfe5e1df28c6c074b2a Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 13 Mar 2026 11:13:29 +0000 Subject: [PATCH 20/21] Fix a typo and an oversight DEBUG_C supposed to have been removed from the test dependencies, still being there is an oversight. Removing it was the sole purpose of 3e58109fbd. Signed-off-by: Janos Follath --- tests/suites/test_suite_ssl.function | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 6b3bca6edd..a283b65e53 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -5725,12 +5725,12 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP:MBEDTLS_DEBUG_C*/ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ALG_CHACHA20_POLY1305:PSA_WANT_ALG_SHA_256:MBEDTLS_TEST_HAS_ADDITIONAL_HASH:MBEDTLS_TEST_HAS_DEFAULT_EC_GROUP*/ void send_invalid_sig_alg(int sig, int hash, int expected_ret) { // This is a test about the client behaviour in case it receives a key exchange signed with a // sig_alg it didn't specify in the client hello. The input specifies a target_sig_alg, which we - // make sure that the client does not offer but the server does. Then we make the server beleive + // make sure that the client does not offer but the server does. Then we make the server believe // that target_sig_alg is the only one the client offered. // Remark: We need an additional hash algorithm offered, because if we don't have it, the server From 6714b3901775978bd6ed6681cc65b957f9c9966f Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Fri, 13 Mar 2026 11:26:57 +0000 Subject: [PATCH 21/21] Improve ssl_parse_signature_algorithm Simplify and improve error reporting and remove unnecessary initialisation (the caller is responsible for initialising those values). Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 34 +++++++--------------------------- 1 file changed, 7 insertions(+), 27 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 76ec4b6c4b..a0170d51f6 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1740,32 +1740,10 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, mbedtls_md_type_t *md_alg, mbedtls_pk_sigalg_t *pk_alg) { - *md_alg = MBEDTLS_MD_NONE; - *pk_alg = MBEDTLS_PK_SIGALG_NONE; - if (mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg(sig_alg, pk_alg, md_alg) != 0) { - /* - * Check hash algorithm - */ - if (*md_alg == MBEDTLS_MD_NONE) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", sig_alg >> 8)); - return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; - } - - /* - * Check signature algorithm - */ - if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { - MBEDTLS_SSL_DEBUG_MSG(1, - ("Server used unsupported SignatureAlgorithm %d", - sig_alg & 0x00FF)); - return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; - } - - /* - * This shouldn't happen, but be robust. - */ - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, + ("Server used unsupported value in SigAlg extension 0x%04x", + sig_alg)); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } @@ -1774,7 +1752,9 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, * TLS versions. Make sure that the received sig_alg extension is valid in TLS 1.2. */ if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, + ("Server used unsupported value in SigAlg extension 0x%04x", + sig_alg)); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } @@ -1782,7 +1762,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, * Check if the signature algorithm is acceptable */ if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { - MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); + MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value 0x%04x that was not offered", sig_alg)); return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; }