From ad736991bb59211118a29fe115367c24495300c2 Mon Sep 17 00:00:00 2001
From: Janos Follath <janos.follath@arm.com>
Date: Fri, 9 Feb 2024 16:04:59 +0000
Subject: [PATCH] Merge pull request #1177 from
 ronald-cron-arm/tls-max-version-reset

Reset properly the TLS maximum negotiable version

CVE: CVE-2024-28755
CVE: CVE-2024-28836
Upstream-Status: Backport [https://github.com/Mbed-TLS/mbedtls/commit/ad736991bb59211118a29fe115367c24495300c2]

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
---
 library/ssl_tls.c |  1 +
 tests/ssl-opt.sh  | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index cfb2798182..f3c701818b 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -1539,6 +1539,7 @@ int mbedtls_ssl_session_reset_int(mbedtls_ssl_context *ssl, int partial)
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;

     ssl->state = MBEDTLS_SSL_HELLO_REQUEST;
+    ssl->tls_version = ssl->conf->max_tls_version;

     mbedtls_ssl_session_reset_msg_layer(ssl, partial);

diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 48b3c0cb26..448bd3825f 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -11307,6 +11307,30 @@ run_test    "TLS 1.3: Default" \
             -s "ECDH/FFDH group: " \
             -s "selected signature algorithm ecdsa_secp256r1_sha256"

+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
+requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
+run_test    "Establish TLS 1.2 then TLS 1.3 session" \
+            "$P_SRV" \
+            "( $P_CLI force_version=tls12; \
+               $P_CLI force_version=tls13 )" \
+            0 \
+            -s "Protocol is TLSv1.2" \
+            -s "Protocol is TLSv1.3" \
+
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
+requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
+requires_any_configs_enabled $TLS1_2_KEY_EXCHANGES_WITH_CERT
+run_test    "Establish TLS 1.3 then TLS 1.2 session" \
+            "$P_SRV" \
+            "( $P_CLI force_version=tls13; \
+               $P_CLI force_version=tls12 )" \
+            0 \
+            -s "Protocol is TLSv1.3" \
+            -s "Protocol is TLSv1.2" \
+
 requires_openssl_tls1_3_with_compatible_ephemeral
 requires_config_enabled MBEDTLS_DEBUG_C
 requires_config_enabled MBEDTLS_SSL_CLI_C
--
2.40.0
