Mbed-TLS/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-06-05 21:15:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10442 from davidhorstmann-arm/verify-result-default-failure

Browse Source 
Hardening: Make `mbedtls_ssl_get_verify_result()` default to failure
This commit is contained in:
Ronald Cron
2026-03-17 10:36:38 +00:00
committed by GitHub
parent d7f2a4cdc6 937c70ac90
commit cb0b594a9d
8 changed files with 182 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
library/ssl_tls.c
+7
View File
@@ -962,6 +962,8 @@ void mbedtls_ssl_transform_init(mbedtls_ssl_transform *transform)
void mbedtls_ssl_session_init(mbedtls_ssl_session *session)
{
memset(session, 0, sizeof(mbedtls_ssl_session));
/* Set verify_result to -1u to indicate 'result not available'. */
session->verify_result = 0xFFFFFFFF;
}
MBEDTLS_CHECK_RETURN_CRITICAL
@@ -4570,6 +4572,9 @@ void mbedtls_ssl_session_free(mbedtls_ssl_session *session)
#endif
mbedtls_platform_zeroize(session, sizeof(mbedtls_ssl_session));
/* Set verify_result to -1u to indicate 'result not available'. */
session->verify_result = 0xFFFFFFFF;
}
#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION)
@@ -6977,6 +6982,7 @@ static int ssl_parse_certificate_coordinate(mbedtls_ssl_context *ssl,
ssl->handshake->ciphersuite_info;
if (!mbedtls_ssl_ciphersuite_uses_srv_cert(ciphersuite_info)) {
ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
return SSL_CERTIFICATE_SKIP;
}
@@ -8692,6 +8698,7 @@ int mbedtls_ssl_verify_certificate(mbedtls_ssl_context *ssl,
void *rs_ctx)
{
if (authmode == MBEDTLS_SSL_VERIFY_NONE) {
ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
return 0;
}
library/ssl_tls13_client.c
+3
View File
@@ -2264,6 +2264,9 @@ static int ssl_tls13_process_encrypted_extensions(mbedtls_ssl_context *ssl)
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
if (mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
/* Since we're not using a certificate, set verify_result to skipped */
ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
} else {
mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST);
}
library/ssl_tls13_server.c
+3
View File
@@ -2616,6 +2616,9 @@ static int ssl_tls13_write_encrypted_extensions(mbedtls_ssl_context *ssl)
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
if (mbedtls_ssl_tls13_key_exchange_mode_with_psk(ssl)) {
mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_SERVER_FINISHED);
/* Since we're not using a certificate, set verify_result to skipped */
ssl->session_negotiate->verify_result = MBEDTLS_X509_BADCERT_SKIP_VERIFY;
} else {
mbedtls_ssl_handshake_set_state(ssl, MBEDTLS_SSL_CERTIFICATE_REQUEST);
}