Skip to content

Commit af14b89

Browse files
mpgmpg
authored
Merge pull request Mbed-TLS#8932 from ronald-cron-arm/enable-tls13-by-default
Enable TLS 1.3 by default
2 parents 92152dc + d2cb7f4 commit af14b89

File tree

3 files changed

+44
-18
lines changed

3 files changed

+44
-18
lines changed

‎ChangeLog.d/enable-tls13-by-default.txt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Changes
2+
* The TLS 1.3 protocol is now enabled in the default configuration.

‎include/mbedtls/mbedtls_config.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1774,7 +1774,7 @@
17741774
*
17751775
* Uncomment this macro to enable the support for TLS 1.3.
17761776
*/
1777-
//#define MBEDTLS_SSL_PROTO_TLS1_3
1777+
#define MBEDTLS_SSL_PROTO_TLS1_3
17781778

17791779
/**
17801780
* \def MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
@@ -1796,7 +1796,7 @@
17961796
* effect on the build.
17971797
*
17981798
*/
1799-
//#define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
1799+
#define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
18001800

18011801
/**
18021802
* \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED

‎tests/scripts/all.sh

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1305,6 +1305,7 @@ component_test_default_psa_crypto_client_without_crypto_provider () {
13051305
scripts/config.py unset MBEDTLS_PSA_CRYPTO_C
13061306
scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C
13071307
scripts/config.py unset MBEDTLS_PSA_ITS_FILE_C
1308+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
13081309
scripts/config.py set MBEDTLS_PSA_CRYPTO_CLIENT
13091310
scripts/config.py unset MBEDTLS_LMS_C
13101311
@@ -1843,6 +1844,8 @@ component_test_tls1_2_default_stream_cipher_only () {
18431844
scripts/config.py unset MBEDTLS_GCM_C
18441845
scripts/config.py unset MBEDTLS_CCM_C
18451846
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1847+
#Disable TLS 1.3 (as no AEAD)
1848+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
18461849
# Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
18471850
scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
18481851
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
@@ -1869,6 +1872,8 @@ component_test_tls1_2_default_stream_cipher_only_use_psa () {
18691872
scripts/config.py unset MBEDTLS_GCM_C
18701873
scripts/config.py unset MBEDTLS_CCM_C
18711874
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1875+
#Disable TLS 1.3 (as no AEAD)
1876+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
18721877
# Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
18731878
scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
18741879
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
@@ -1894,6 +1899,8 @@ component_test_tls1_2_default_cbc_legacy_cipher_only () {
18941899
scripts/config.py unset MBEDTLS_GCM_C
18951900
scripts/config.py unset MBEDTLS_CCM_C
18961901
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1902+
#Disable TLS 1.3 (as no AEAD)
1903+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
18971904
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
18981905
scripts/config.py set MBEDTLS_CIPHER_MODE_CBC
18991906
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
@@ -1921,6 +1928,8 @@ component_test_tls1_2_deafult_cbc_legacy_cipher_only_use_psa () {
19211928
scripts/config.py unset MBEDTLS_GCM_C
19221929
scripts/config.py unset MBEDTLS_CCM_C
19231930
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1931+
#Disable TLS 1.3 (as no AEAD)
1932+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
19241933
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
19251934
scripts/config.py set MBEDTLS_CIPHER_MODE_CBC
19261935
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
@@ -1947,6 +1956,8 @@ component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only () {
19471956
scripts/config.py unset MBEDTLS_GCM_C
19481957
scripts/config.py unset MBEDTLS_CCM_C
19491958
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1959+
#Disable TLS 1.3 (as no AEAD)
1960+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
19501961
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
19511962
scripts/config.py set MBEDTLS_CIPHER_MODE_CBC
19521963
# Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
@@ -1974,6 +1985,8 @@ component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only_use_psa () {
19741985
scripts/config.py unset MBEDTLS_GCM_C
19751986
scripts/config.py unset MBEDTLS_CCM_C
19761987
scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1988+
#Disable TLS 1.3 (as no AEAD)
1989+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
19771990
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
19781991
scripts/config.py set MBEDTLS_CIPHER_MODE_CBC
19791992
# Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
@@ -2609,7 +2622,6 @@ component_test_psa_crypto_config_accel_ecdsa () {
26092622
26102623
# Start from default config (no USE_PSA) + TLS 1.3
26112624
helper_libtestdriver1_adjust_config "default"
2612-
scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3
26132625
26142626
# Disable the module that's accelerated
26152627
scripts/config.py unset MBEDTLS_ECDSA_C
@@ -2650,7 +2662,7 @@ component_test_psa_crypto_config_accel_ecdh () {
26502662
# Configure
26512663
# ---------
26522664
2653-
# Start from default config (no TLS 1.3, no USE_PSA)
2665+
# Start from default config (no USE_PSA)
26542666
helper_libtestdriver1_adjust_config "default"
26552667
26562668
# Disable the module that's accelerated
@@ -3643,7 +3655,7 @@ component_test_psa_crypto_config_accel_hash () {
36433655
# Configure
36443656
# ---------
36453657
3646-
# Start from default config (no TLS 1.3, no USE_PSA)
3658+
# Start from default config (no USE_PSA)
36473659
helper_libtestdriver1_adjust_config "default"
36483660
36493661
# Disable the things that are being accelerated
@@ -3687,7 +3699,7 @@ component_test_psa_crypto_config_accel_hash_keep_builtins () {
36873699
ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
36883700
ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
36893701
3690-
# Start from default config (no TLS 1.3, no USE_PSA)
3702+
# Start from default config (no USE_PSA)
36913703
helper_libtestdriver1_adjust_config "default"
36923704
36933705
helper_libtestdriver1_make_drivers "$loc_accel_list"
@@ -4182,7 +4194,6 @@ component_build_psa_accel_alg_hkdf() {
41824194
msg "build: full - MBEDTLS_USE_PSA_CRYPTO + PSA_WANT_ALG_HKDF without MBEDTLS_HKDF_C"
41834195
scripts/config.py full
41844196
scripts/config.py unset MBEDTLS_USE_PSA_CRYPTO
4185-
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
41864197
scripts/config.py unset MBEDTLS_HKDF_C
41874198
# Make sure to unset TLS1_3 since it requires HKDF_C and will not build properly without it.
41884199
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
@@ -4645,6 +4656,7 @@ component_test_no_max_fragment_length () {
46454656
component_test_asan_remove_peer_certificate () {
46464657
msg "build: default config with MBEDTLS_SSL_KEEP_PEER_CERTIFICATE disabled (ASan build)"
46474658
scripts/config.py unset MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
4659+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
46484660
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
46494661
make
46504662
@@ -5860,8 +5872,24 @@ support_build_armcc () {
58605872
(check_tools "$armc5_cc" "$armc6_cc" > /dev/null 2>&1)
58615873
}
58625874
5875+
component_test_tls12_only () {
5876+
msg "build: default config without MBEDTLS_SSL_PROTO_TLS1_3, cmake, gcc, ASan"
5877+
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
5878+
CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
5879+
make
5880+
5881+
msg "test: main suites (inc. selftests) (ASan build)"
5882+
make test
5883+
5884+
msg "test: ssl-opt.sh (ASan build)"
5885+
tests/ssl-opt.sh
5886+
5887+
msg "test: compat.sh (ASan build)"
5888+
tests/compat.sh
5889+
}
5890+
58635891
component_test_tls13_only () {
5864-
msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3, without MBEDTLS_SSL_PROTO_TLS1_2"
5892+
msg "build: default config without MBEDTLS_SSL_PROTO_TLS1_2"
58655893
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
58665894
scripts/config.py set MBEDTLS_SSL_RECORD_SIZE_LIMIT
58675895
make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/tls13-only.h\"'"
@@ -5998,29 +6026,25 @@ component_test_tls13_only_ephemeral_all () {
59986026
tests/ssl-opt.sh
59996027
}
60006028
6001-
component_test_tls13 () {
6002-
msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, without padding"
6003-
scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3
6004-
scripts/config.py set MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
6029+
component_test_tls13_no_padding () {
6030+
msg "build: default config plus early data minus padding"
60056031
scripts/config.py set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 1
60066032
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
60076033
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
60086034
make
6009-
msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, without padding"
6035+
msg "test: default config plus early data minus padding"
60106036
make test
6011-
msg "ssl-opt.sh (TLS 1.3)"
6037+
msg "ssl-opt.sh (TLS 1.3 no padding)"
60126038
tests/ssl-opt.sh
60136039
}
60146040
60156041
component_test_tls13_no_compatibility_mode () {
6016-
msg "build: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, without padding"
6017-
scripts/config.py set MBEDTLS_SSL_PROTO_TLS1_3
6042+
msg "build: default config plus early data minus middlebox compatibility mode"
60186043
scripts/config.py unset MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
6019-
scripts/config.py set MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 1
60206044
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
60216045
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
60226046
make
6023-
msg "test: default config with MBEDTLS_SSL_PROTO_TLS1_3 enabled, without padding"
6047+
msg "test: default config plus early data minus middlebox compatibility mode"
60246048
make test
60256049
msg "ssl-opt.sh (TLS 1.3 no compatibility mode)"
60266050
tests/ssl-opt.sh

0 commit comments

Comments
 (0)