tests/suites/test_suite_ssl_decrypt.function - mirror/mbed-tls - TrustedFirmware Git Browser

 /* BEGIN_HEADER */
 /* Testing of mbedtls_ssl_decrypt_buf() specifically, focusing on negative
  * testing (using malformed inputs). */

 #include <mbedtls/ssl.h>
 #include <ssl_misc.h>
 #include <test/ssl_helpers.h>

 /* END_HEADER */

 /* BEGIN_DEPENDENCIES
  * depends_on:MBEDTLS_SSL_TLS_C
  * END_DEPENDENCIES
  */

 /* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_CIPHER_NULL_CIPHER */
 void ssl_decrypt_null(int hash_id)
 {
     mbedtls_ssl_transform transform_in, transform_out;
     mbedtls_ssl_transform_init(&transform_in);
     mbedtls_ssl_transform_init(&transform_out);
     const mbedtls_ssl_protocol_version version = MBEDTLS_SSL_VERSION_TLS1_2;
     const mbedtls_cipher_type_t cipher_type = MBEDTLS_CIPHER_NULL;
     mbedtls_record rec_good = {
         .ctr = { 0 },
         .type = MBEDTLS_SSL_MSG_APPLICATION_DATA,
         .ver = { 0, 0 },    /* Will be set by a function call below */
         .buf = NULL,
         .buf_len = 0,
         .data_offset = 0,
         .data_len = 0,
 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
         .cid_len = 0,
         .cid = { 0 },
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
     };
     mbedtls_ssl_write_version(rec_good.ver,
                               MBEDTLS_SSL_TRANSPORT_STREAM,
                               version);
     const char sample_plaintext[3] = "ABC";
     mbedtls_ssl_context ssl;
     mbedtls_ssl_init(&ssl);
     uint8_t *buf = NULL;

     MD_OR_USE_PSA_INIT();

     TEST_EQUAL(mbedtls_test_ssl_build_transforms(&transform_in, &transform_out,
                                                  cipher_type, hash_id, 0, 0,
                                                  version,
                                                  0, 0), 0);

     const size_t plaintext_length = sizeof(sample_plaintext);
     rec_good.buf_len = plaintext_length + transform_in.maclen;
     rec_good.data_len = plaintext_length;
     TEST_CALLOC(rec_good.buf, rec_good.buf_len);
     memcpy(rec_good.buf, sample_plaintext, plaintext_length);
     TEST_EQUAL(mbedtls_test_ssl_prepare_record_mac(&rec_good,
                                                    &transform_out), 0);

     /* Good case */
     mbedtls_record rec = rec_good;
     TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec), 0);

     /* Change any one byte of the plaintext or MAC. The MAC will be wrong. */
     TEST_CALLOC(buf, rec.buf_len);
     for (size_t i = 0; i < rec.buf_len; i++) {
         mbedtls_test_set_step(i);
         rec = rec_good;
         rec.buf = buf;
         memcpy(buf, rec_good.buf, rec.buf_len);
         buf[i] ^= 1;
         TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec),
                    MBEDTLS_ERR_SSL_INVALID_MAC);
     }
     mbedtls_free(buf);
     buf = NULL;

     /* Shorter input buffer. Either the MAC will be wrong, or there isn't
      * enough room for a MAC. */
     for (size_t n = 1; n < rec.buf_len; n++) {
         mbedtls_test_set_step(n);
         rec = rec_good;
         TEST_CALLOC(buf, n);
         rec.buf = buf;
         rec.buf_len = n;
         rec.data_len = n;
         memcpy(buf, rec_good.buf, n);
         TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec),
                    MBEDTLS_ERR_SSL_INVALID_MAC);
         mbedtls_free(buf);
         buf = NULL;
     }

     /* For robustness, check a 0-length buffer (non-null, then null).
      * This should not reach mbedtls_ssl_decrypt_buf() as used in the library,
      * so the exact error doesn't matter, but we don't want a crash. */
     {
         const uint8_t buf1[1] = { 'a' };
         rec = rec_good;
         /* We won't write to buf1[0] since it's out of range, so we can cast
          * the const away. */
         rec.buf = (uint8_t *) buf1;
         rec.buf_len = 0;
         TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec),
                    MBEDTLS_ERR_SSL_INTERNAL_ERROR);
     }
     rec = rec_good;
     rec.buf = NULL;
     rec.buf_len = 0;
     TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec),
                MBEDTLS_ERR_SSL_INTERNAL_ERROR);

 exit:
     mbedtls_ssl_transform_free(&transform_in);
     mbedtls_ssl_transform_free(&transform_out);
     mbedtls_free(rec_good.buf);
     mbedtls_ssl_free(&ssl);
     mbedtls_free(buf);
     MD_OR_USE_PSA_DONE();
 }
 /* END_CASE */

 /* BEGIN_CASE depends_on:MBEDTLS_SSL_HAVE_CBC:MBEDTLS_SSL_HAVE_AES:MBEDTLS_SSL_PROTO_TLS1_2 */
 void ssl_decrypt_non_etm_cbc(int cipher_type, int hash_id, int trunc_hmac,
                              int length_selector)
 {
     /*
      * Test record decryption for CBC without EtM, focused on the verification
      * of padding and MAC.
      *
      * Actually depends on TLS 1.2 and either AES, ARIA or Camellia, but since
      * the test framework doesn't support alternation in dependency statements,
      * just depend on AES.
      *
      * The length_selector argument is interpreted as follows:
      * - if it's -1, the plaintext length is 0 and minimal padding is applied
      * - if it's -2, the plaintext length is 0 and maximal padding is applied
      * - otherwise it must be in [0, 255] and is padding_length from RFC 5246:
      *   it's the length of the rest of the padding, that is, excluding the
      *   byte that encodes the length. The minimal non-zero plaintext length
      *   that gives this padding_length is automatically selected.
      */
     mbedtls_ssl_context ssl; /* ONLY for debugging */
     mbedtls_ssl_transform t0, t1;
     mbedtls_record rec, rec_save;
     unsigned char *buf = NULL, *buf_save = NULL;
     size_t buflen, olen = 0;
     size_t plaintext_len, block_size, i;
     unsigned char padlen; /* excluding the padding_length byte */
     int exp_ret;
     int ret;
     const unsigned char pad_max_len = 255; /* Per the standard */

     mbedtls_ssl_init(&ssl);
     mbedtls_ssl_transform_init(&t0);
     mbedtls_ssl_transform_init(&t1);
     MD_OR_USE_PSA_INIT();

     /* Set up transforms with dummy keys */
     ret = mbedtls_test_ssl_build_transforms(&t0, &t1, cipher_type, hash_id,
                                             0, trunc_hmac,
                                             MBEDTLS_SSL_VERSION_TLS1_2,
                                             0, 0);

     TEST_ASSERT(ret == 0);

     /* Determine padding/plaintext length */
     TEST_ASSERT(length_selector >= -2 && length_selector <= 255);
     block_size = t0.ivlen;
     if (length_selector < 0) {
         plaintext_len = 0;

         /* Minimal padding
          * The +1 is for the padding_length byte, not counted in padlen. */
         padlen = block_size - (t0.maclen + 1) % block_size;

         /* Maximal padding? */
         if (length_selector == -2) {
             padlen += block_size * ((pad_max_len - padlen) / block_size);
         }
     } else {
         padlen = length_selector;

         /* Minimal non-zero plaintext_length giving desired padding.
          * The +1 is for the padding_length byte, not counted in padlen. */
         plaintext_len = block_size - (padlen + t0.maclen + 1) % block_size;
     }

     /* Prepare a buffer for record data */
     buflen = block_size
              + plaintext_len
              + t0.maclen
              + padlen + 1;
     TEST_CALLOC(buf, buflen);
     TEST_CALLOC(buf_save, buflen);

     /* Prepare a dummy record header */
     memset(rec.ctr, 0, sizeof(rec.ctr));
     rec.type    = MBEDTLS_SSL_MSG_APPLICATION_DATA;
     mbedtls_ssl_write_version(rec.ver, MBEDTLS_SSL_TRANSPORT_STREAM,
                               MBEDTLS_SSL_VERSION_TLS1_2);
 #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
     rec.cid_len = 0;
 #endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */

     /* Prepare dummy record content */
     rec.buf     = buf;
     rec.buf_len = buflen;
     rec.data_offset = block_size;
     rec.data_len = plaintext_len;
     memset(rec.buf + rec.data_offset, 42, rec.data_len);

     /* Set dummy IV */
     memset(t0.iv_enc, 0x55, t0.ivlen);
     memcpy(rec.buf, t0.iv_enc, t0.ivlen);

     /*
      * Prepare a pre-encryption record (with MAC and padding), and save it.
      */
     TEST_EQUAL(0, mbedtls_test_ssl_prepare_record_mac(&rec, &t0));

     /* Pad */
     memset(rec.buf + rec.data_offset + rec.data_len, padlen, padlen + 1);
     rec.data_len += padlen + 1;

     /* Save correct pre-encryption record */
     rec_save = rec;
     rec_save.buf = buf_save;
     memcpy(buf_save, buf, buflen);

     /*
      * Encrypt and decrypt the correct record, expecting success
      */
     TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
                    &t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
                    rec.data_len, rec.buf + rec.data_offset, &olen));
     rec.data_offset -= t0.ivlen;
     rec.data_len    += t0.ivlen;

     TEST_EQUAL(0, mbedtls_ssl_decrypt_buf(&ssl, &t1, &rec));

     /*
      * Modify each byte of the pre-encryption record before encrypting and
      * decrypting it, expecting failure every time.
      */
     for (i = block_size; i < buflen; i++) {
         mbedtls_test_set_step(i);

         /* Restore correct pre-encryption record */
         rec = rec_save;
         rec.buf = buf;
         memcpy(buf, buf_save, buflen);

         /* Corrupt one byte of the data (could be plaintext, MAC or padding) */
         rec.buf[i] ^= 0x01;

         /* Encrypt */
         TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
                        &t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
                        rec.data_len, rec.buf + rec.data_offset, &olen));
         rec.data_offset -= t0.ivlen;
         rec.data_len    += t0.ivlen;

         /* Decrypt and expect failure */
         TEST_EQUAL(MBEDTLS_ERR_SSL_INVALID_MAC,
                    mbedtls_ssl_decrypt_buf(&ssl, &t1, &rec));
     }

     /*
      * Use larger values of the padding bytes - with small buffers, this tests
      * the case where the announced padlen would be larger than the buffer
      * (and before that, than the buffer minus the size of the MAC), to make
      * sure our padding checking code does not perform any out-of-bounds reads
      * in this case. (With larger buffers, ie when the plaintext is long or
      * maximal length padding is used, this is less relevant but still doesn't
      * hurt to test.)
      *
      * (Start the loop with correct padding, just to double-check that record
      * saving did work, and that we're overwriting the correct bytes.)
      */
     for (i = padlen; i <= pad_max_len; i++) {
         mbedtls_test_set_step(i);

         /* Restore correct pre-encryption record */
         rec = rec_save;
         rec.buf = buf;
         memcpy(buf, buf_save, buflen);

         /* Set padding bytes to new value */
         memset(buf + buflen - padlen - 1, i, padlen + 1);

         /* Encrypt */
         TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
                        &t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
                        rec.data_len, rec.buf + rec.data_offset, &olen));
         rec.data_offset -= t0.ivlen;
         rec.data_len    += t0.ivlen;

         /* Decrypt and expect failure except the first time */
         exp_ret = (i == padlen) ? 0 : MBEDTLS_ERR_SSL_INVALID_MAC;
         TEST_EQUAL(exp_ret, mbedtls_ssl_decrypt_buf(&ssl, &t1, &rec));
     }

 exit:
     mbedtls_ssl_free(&ssl);
     mbedtls_ssl_transform_free(&t0);
     mbedtls_ssl_transform_free(&t1);
     mbedtls_free(buf);
     mbedtls_free(buf_save);
     MD_OR_USE_PSA_DONE();
 }
 /* END_CASE */
	/* BEGIN_HEADER */
	/* Testing of mbedtls_ssl_decrypt_buf() specifically, focusing on negative
	* testing (using malformed inputs). */

	#include <mbedtls/ssl.h>
	#include <ssl_misc.h>
	#include <test/ssl_helpers.h>

	/* END_HEADER */

	/* BEGIN_DEPENDENCIES
	* depends_on:MBEDTLS_SSL_TLS_C
	* END_DEPENDENCIES
	*/

	/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_CIPHER_NULL_CIPHER */
	void ssl_decrypt_null(int hash_id)
	{
	mbedtls_ssl_transform transform_in, transform_out;
	mbedtls_ssl_transform_init(&transform_in);
	mbedtls_ssl_transform_init(&transform_out);
	const mbedtls_ssl_protocol_version version = MBEDTLS_SSL_VERSION_TLS1_2;
	const mbedtls_cipher_type_t cipher_type = MBEDTLS_CIPHER_NULL;
	mbedtls_record rec_good = {
	.ctr = { 0 },
	.type = MBEDTLS_SSL_MSG_APPLICATION_DATA,
	.ver = { 0, 0 }, /* Will be set by a function call below */
	.buf = NULL,
	.buf_len = 0,
	.data_offset = 0,
	.data_len = 0,
	#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
	.cid_len = 0,
	.cid = { 0 },
	#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */
	};
	mbedtls_ssl_write_version(rec_good.ver,
	MBEDTLS_SSL_TRANSPORT_STREAM,
	version);
	const char sample_plaintext[3] = "ABC";
	mbedtls_ssl_context ssl;
	mbedtls_ssl_init(&ssl);
	uint8_t *buf = NULL;

	MD_OR_USE_PSA_INIT();

	TEST_EQUAL(mbedtls_test_ssl_build_transforms(&transform_in, &transform_out,
	cipher_type, hash_id, 0, 0,
	version,
	0, 0), 0);

	const size_t plaintext_length = sizeof(sample_plaintext);
	rec_good.buf_len = plaintext_length + transform_in.maclen;
	rec_good.data_len = plaintext_length;
	TEST_CALLOC(rec_good.buf, rec_good.buf_len);
	memcpy(rec_good.buf, sample_plaintext, plaintext_length);
	TEST_EQUAL(mbedtls_test_ssl_prepare_record_mac(&rec_good,
	&transform_out), 0);

	/* Good case */
	mbedtls_record rec = rec_good;
	TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec), 0);

	/* Change any one byte of the plaintext or MAC. The MAC will be wrong. */
	TEST_CALLOC(buf, rec.buf_len);
	for (size_t i = 0; i < rec.buf_len; i++) {
	mbedtls_test_set_step(i);
	rec = rec_good;
	rec.buf = buf;
	memcpy(buf, rec_good.buf, rec.buf_len);
	buf[i] ^= 1;
	TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec),
	MBEDTLS_ERR_SSL_INVALID_MAC);
	}
	mbedtls_free(buf);
	buf = NULL;

	/* Shorter input buffer. Either the MAC will be wrong, or there isn't
	* enough room for a MAC. */
	for (size_t n = 1; n < rec.buf_len; n++) {
	mbedtls_test_set_step(n);
	rec = rec_good;
	TEST_CALLOC(buf, n);
	rec.buf = buf;
	rec.buf_len = n;
	rec.data_len = n;
	memcpy(buf, rec_good.buf, n);
	TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec),
	MBEDTLS_ERR_SSL_INVALID_MAC);
	mbedtls_free(buf);
	buf = NULL;
	}

	/* For robustness, check a 0-length buffer (non-null, then null).
	* This should not reach mbedtls_ssl_decrypt_buf() as used in the library,
	* so the exact error doesn't matter, but we don't want a crash. */
	{
	const uint8_t buf1[1] = { 'a' };
	rec = rec_good;
	/* We won't write to buf1[0] since it's out of range, so we can cast
	* the const away. */
	rec.buf = (uint8_t *) buf1;
	rec.buf_len = 0;
	TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec),
	MBEDTLS_ERR_SSL_INTERNAL_ERROR);
	}
	rec = rec_good;
	rec.buf = NULL;
	rec.buf_len = 0;
	TEST_EQUAL(mbedtls_ssl_decrypt_buf(&ssl, &transform_in, &rec),
	MBEDTLS_ERR_SSL_INTERNAL_ERROR);

	exit:
	mbedtls_ssl_transform_free(&transform_in);
	mbedtls_ssl_transform_free(&transform_out);
	mbedtls_free(rec_good.buf);
	mbedtls_ssl_free(&ssl);
	mbedtls_free(buf);
	MD_OR_USE_PSA_DONE();
	}
	/* END_CASE */

	/* BEGIN_CASE depends_on:MBEDTLS_SSL_HAVE_CBC:MBEDTLS_SSL_HAVE_AES:MBEDTLS_SSL_PROTO_TLS1_2 */
	void ssl_decrypt_non_etm_cbc(int cipher_type, int hash_id, int trunc_hmac,
	int length_selector)
	{
	/*
	* Test record decryption for CBC without EtM, focused on the verification
	* of padding and MAC.
	*
	* Actually depends on TLS 1.2 and either AES, ARIA or Camellia, but since
	* the test framework doesn't support alternation in dependency statements,
	* just depend on AES.
	*
	* The length_selector argument is interpreted as follows:
	* - if it's -1, the plaintext length is 0 and minimal padding is applied
	* - if it's -2, the plaintext length is 0 and maximal padding is applied
	* - otherwise it must be in [0, 255] and is padding_length from RFC 5246:
	* it's the length of the rest of the padding, that is, excluding the
	* byte that encodes the length. The minimal non-zero plaintext length
	* that gives this padding_length is automatically selected.
	*/
	mbedtls_ssl_context ssl; /* ONLY for debugging */
	mbedtls_ssl_transform t0, t1;
	mbedtls_record rec, rec_save;
	unsigned char buf = NULL, buf_save = NULL;
	size_t buflen, olen = 0;
	size_t plaintext_len, block_size, i;
	unsigned char padlen; /* excluding the padding_length byte */
	int exp_ret;
	int ret;
	const unsigned char pad_max_len = 255; /* Per the standard */

	mbedtls_ssl_init(&ssl);
	mbedtls_ssl_transform_init(&t0);
	mbedtls_ssl_transform_init(&t1);
	MD_OR_USE_PSA_INIT();

	/* Set up transforms with dummy keys */
	ret = mbedtls_test_ssl_build_transforms(&t0, &t1, cipher_type, hash_id,
	0, trunc_hmac,
	MBEDTLS_SSL_VERSION_TLS1_2,
	0, 0);

	TEST_ASSERT(ret == 0);

	/* Determine padding/plaintext length */
	TEST_ASSERT(length_selector >= -2 && length_selector <= 255);
	block_size = t0.ivlen;
	if (length_selector < 0) {
	plaintext_len = 0;

	/* Minimal padding
	* The +1 is for the padding_length byte, not counted in padlen. */
	padlen = block_size - (t0.maclen + 1) % block_size;

	/* Maximal padding? */
	if (length_selector == -2) {
	padlen += block_size * ((pad_max_len - padlen) / block_size);
	}
	} else {
	padlen = length_selector;

	/* Minimal non-zero plaintext_length giving desired padding.
	* The +1 is for the padding_length byte, not counted in padlen. */
	plaintext_len = block_size - (padlen + t0.maclen + 1) % block_size;
	}

	/* Prepare a buffer for record data */
	buflen = block_size
	+ plaintext_len
	+ t0.maclen
	+ padlen + 1;
	TEST_CALLOC(buf, buflen);
	TEST_CALLOC(buf_save, buflen);

	/* Prepare a dummy record header */
	memset(rec.ctr, 0, sizeof(rec.ctr));
	rec.type = MBEDTLS_SSL_MSG_APPLICATION_DATA;
	mbedtls_ssl_write_version(rec.ver, MBEDTLS_SSL_TRANSPORT_STREAM,
	MBEDTLS_SSL_VERSION_TLS1_2);
	#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
	rec.cid_len = 0;
	#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */

	/* Prepare dummy record content */
	rec.buf = buf;
	rec.buf_len = buflen;
	rec.data_offset = block_size;
	rec.data_len = plaintext_len;
	memset(rec.buf + rec.data_offset, 42, rec.data_len);

	/* Set dummy IV */
	memset(t0.iv_enc, 0x55, t0.ivlen);
	memcpy(rec.buf, t0.iv_enc, t0.ivlen);

	/*
	* Prepare a pre-encryption record (with MAC and padding), and save it.
	*/
	TEST_EQUAL(0, mbedtls_test_ssl_prepare_record_mac(&rec, &t0));

	/* Pad */
	memset(rec.buf + rec.data_offset + rec.data_len, padlen, padlen + 1);
	rec.data_len += padlen + 1;

	/* Save correct pre-encryption record */
	rec_save = rec;
	rec_save.buf = buf_save;
	memcpy(buf_save, buf, buflen);

	/*
	* Encrypt and decrypt the correct record, expecting success
	*/
	TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
	&t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
	rec.data_len, rec.buf + rec.data_offset, &olen));
	rec.data_offset -= t0.ivlen;
	rec.data_len += t0.ivlen;

	TEST_EQUAL(0, mbedtls_ssl_decrypt_buf(&ssl, &t1, &rec));

	/*
	* Modify each byte of the pre-encryption record before encrypting and
	* decrypting it, expecting failure every time.
	*/
	for (i = block_size; i < buflen; i++) {
	mbedtls_test_set_step(i);

	/* Restore correct pre-encryption record */
	rec = rec_save;
	rec.buf = buf;
	memcpy(buf, buf_save, buflen);

	/* Corrupt one byte of the data (could be plaintext, MAC or padding) */
	rec.buf[i] ^= 0x01;

	/* Encrypt */
	TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
	&t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
	rec.data_len, rec.buf + rec.data_offset, &olen));
	rec.data_offset -= t0.ivlen;
	rec.data_len += t0.ivlen;

	/* Decrypt and expect failure */
	TEST_EQUAL(MBEDTLS_ERR_SSL_INVALID_MAC,
	mbedtls_ssl_decrypt_buf(&ssl, &t1, &rec));
	}

	/*
	* Use larger values of the padding bytes - with small buffers, this tests
	* the case where the announced padlen would be larger than the buffer
	* (and before that, than the buffer minus the size of the MAC), to make
	* sure our padding checking code does not perform any out-of-bounds reads
	* in this case. (With larger buffers, ie when the plaintext is long or
	* maximal length padding is used, this is less relevant but still doesn't
	* hurt to test.)
	*
	* (Start the loop with correct padding, just to double-check that record
	* saving did work, and that we're overwriting the correct bytes.)
	*/
	for (i = padlen; i <= pad_max_len; i++) {
	mbedtls_test_set_step(i);

	/* Restore correct pre-encryption record */
	rec = rec_save;
	rec.buf = buf;
	memcpy(buf, buf_save, buflen);

	/* Set padding bytes to new value */
	memset(buf + buflen - padlen - 1, i, padlen + 1);

	/* Encrypt */
	TEST_EQUAL(0, mbedtls_test_psa_cipher_encrypt_helper(
	&t0, t0.iv_enc, t0.ivlen, rec.buf + rec.data_offset,
	rec.data_len, rec.buf + rec.data_offset, &olen));
	rec.data_offset -= t0.ivlen;
	rec.data_len += t0.ivlen;

	/* Decrypt and expect failure except the first time */
	exp_ret = (i == padlen) ? 0 : MBEDTLS_ERR_SSL_INVALID_MAC;
	TEST_EQUAL(exp_ret, mbedtls_ssl_decrypt_buf(&ssl, &t1, &rec));
	}

	exit:
	mbedtls_ssl_free(&ssl);
	mbedtls_ssl_transform_free(&t0);
	mbedtls_ssl_transform_free(&t1);
	mbedtls_free(buf);
	mbedtls_free(buf_save);
	MD_OR_USE_PSA_DONE();
	}
	/* END_CASE */