Commit graph

5815 commits

Author SHA1 Message Date
Yuto Takano
50953433a4 Bring back logging of number of files
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-09 14:54:36 +01:00
Yuto Takano
8e9a219310 Improve ease of specifying which files to look in (check_names)
- Instead of os.path.join, use glob patterns (supports Windows too)
- Instead of creating the lists beforehand (which adds messiness), pass glob
  expessions to functions and let them memoise it.
- Add support for excluding based on glob patterns, which isn't used now but
  could come in handy.

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-09 14:48:53 +01:00
Yuto Takano
f005c3369a Change variable name argparser to parser
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-09 13:56:36 +01:00
Yuto Takano
d70d446d69 Improve code style consistency in check_names.py
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-09 12:45:51 +01:00
Yuto Takano
68d241211b Create list_internal_identifiers.py
This is the equivalent of `list-identifiers.sh --internal`, which is
useful for generating an exclusion file for ABI/API checking.

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-09 12:10:31 +01:00
Yuto Takano
977e07f5c8 Use glob in get_files(), call setup_logger on init
glob is more flexible and simplifies the function arguments drastically.
It is also much more intuitive to extend in the future when the filepaths
need to be extended or changed.

setup_logger had to be called as the first thing after instantiation, so
this commit simplify makes it automatic.

Several clarification comments are added too.

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-09 11:56:15 +01:00
Yuto Takano
51efcb143d Rename check-names.py to check_names.py
This is necessary to import check_names from other scripts, which
will inevitably happen in the next few commits to implement the equivalent
of `list-identifiers.sh --internal`.

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-09 11:54:12 +01:00
Yuto Takano
6fececf192 Comment why is used
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-07 17:28:23 +01:00
Yuto Takano
fc54dfb0d6 Move check_repo_path into NameCheck as staticmethod
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-07 17:18:28 +01:00
Yuto Takano
55614b51f1 Use --quiet to hide explanations and show only minimal necessary info
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-07 01:00:18 +01:00
Yuto Takano
b47b504418 Improve comments in parse_mbed_words()
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-07 00:42:54 +01:00
Yuto Takano
12a7ecda5a Fix further pylint issues picked up by Travis CI
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-07 00:40:29 +01:00
Yuto Takano
a083d15edd Specify file open encoding as utf-8 in check-names
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-07 00:25:59 +01:00
Yuto Takano
381fda8550 Print line number next to problem in check-names
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 23:37:20 +01:00
Yuto Takano
bcc3d99cc1 Fix compatibiliy with Python 3.5 on the CI
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 23:14:58 +01:00
Yuto Takano
d93fa37aa6 Address all pylint issues to follow style
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 23:05:55 +01:00
Yuto Takano
9e0e0e9980 Fix Pylint-detected function argument syntax error
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 22:01:37 +01:00
Yuto Takano
25eeb7b935 Output subprocess stdout if it errored
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:27:59 +01:00
Yuto Takano
cfc9e4a275 Change identifier regex to better support multiline declarations
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
8f457cf222 Use enumerate() to get line numbers
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
a4e751257a Output line number, line, and position of error
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
159255ab7b Document dependency on nm
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
13ecd996fc Improve regex to adapt to flexible spaces
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
5c1acf2735 Match macros with spaces between # and define
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
d24e037dd1 Warn user if files are excluded from search
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
5939a2a4de Check environment by verifying other dirs' existence
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
201f9e85ca Make use of -v to log some debug information
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
81528c058a Add documentation, fix identifier parsing
- Add documentation to all classes and functions that were
  not self-explanatory.
- Fix the parsing of identifiers, so it now behaves identically
  to the original shell script. Detects the same amount of identifiers.
- Fix macro parsing so MBEDTLS_PSA_ACCEL didn't error out
- Reformat output to be comprehensible

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
6f38ab3bca Fix legacy troublesome regex
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
fe02684049 Python port of f6643ccd90
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
0fd48f7939 Python port of 7cc4c68eb6
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
17220988dc Parse identifiers from library headers: Python port of d9eee3b417
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
56e3a5caa6 Add test driver symbols: Python port of 7f13fa2454
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
e77f699ed5 Exclude FStar and Hacl: Python port of 9b33e7d7d7
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
062289c657 Invoke config.py instead of pl: Python port of 5d46f6a89b
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
c62b4084a2 Per-line opt-out of typo check: Python port of b683776181
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
e503d61b99 Remove 1.3 to 2.0 helpers: Python port of 7d48b28218
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
157444c24d Add library header files: Python port of 65a6fa3e26
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
c763cc368f Check for double underscores: Python port of 712f7a804e
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
fa950ae344 Look in 3rdparty: Python port of 8a0f5bb3c1
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
bb7dca495f Work with PSA constants: Python port of 03091d1114
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
ed91cf003a Remove Yotta: Python port of 3ad2efdc82
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
c1838937f1 Also check PSA: Python port of 2d9d6db60f
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
3963967ebc Restructure check-names.py with more verbose error messages
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:39 +01:00
Yuto Takano
b61f0e1151 Merge upstream 3.0 from 'development' in ARMmbed/mbedtls
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:07:34 +01:00
Darryl Green
6c79b5dce7 Keep compatibility with python versions prior to 3.5
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:04:36 +01:00
Darryl Green
a783d9c5ef Remove check-names.sh and sub-scripts it used
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:04:34 +01:00
Darryl Green
4e9b51bc18 Update scripts to use check-names.py
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:04:32 +01:00
Darryl Green
d5802926d9 Rewrite check-names.sh in python
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-08-06 21:04:26 +01:00
Gilles Peskine
80ddb991c2 Add --restore option to clean up but not necessarily run components
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-06 11:51:59 +02:00
Gilles Peskine
03af678911 Documentation improvements
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-06 11:35:17 +02:00
Gilles Peskine
86f6129067 Documentation improvement
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-05 15:11:33 +02:00
Gilles Peskine
7530163f3b Make --quiet more effective when running make generated_files
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-05 15:10:47 +02:00
Gilles Peskine
78f6f05778
Merge pull request #4695 from yutotakano/fix-ssl-opt.sh-hard-abort
ssl-opt.sh: Skip tests instead of conditional hard abort
2021-08-04 10:16:19 +02:00
Gilles Peskine
bf66e2cc8f Documentation improvements
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-03 13:44:28 +02:00
Gilles Peskine
1d475b6398 Disable wildcards when checking for unsupported components
Otherwise $COMMAND_LINE_COMPONENTS would try to expand wildcard patterns
based on files in the current directory.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-03 13:43:36 +02:00
Manuel Pégourié-Gonnard
ae505eeeed Fix missing dependency on Travis
Was getting errors like:

In file included from /usr/include/limits.h:25:0,
                 from /usr/lib/gcc-cross/arm-linux-gnueabi/5/include-fixed/limits.h:168,
                 from /usr/lib/gcc-cross/arm-linux-gnueabi/5/include-fixed/syslimits.h:7,
                 from /usr/lib/gcc-cross/arm-linux-gnueabi/5/include-fixed/limits.h:34,
                 from ../include/mbedtls/check_config.h:30,
                 from ../include/mbedtls/build_info.h:81,
                 from common.h:26,
                 from asn1write.c:20:
/usr/include/features.h:367:25: fatal error: sys/cdefs.h: No such file or directory

There are two packages to choose from: armhf or armel. Since the comment
in all.sh says we're trying to be close to Debian's "armel"
architecture, choose that, and fix a comment that was mentioning
gnueabihf for no apparent reason.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-08-03 11:19:59 +02:00
Manuel Pégourié-Gonnard
3a6c76937a Add arm-linux-gnueabi-gcc build to all.sh
Currently it can't be mandatory, since we can't install the required toolchain
on Jenkins right away.

Also, while at it, remove `SHELL='sh -x'` from the other arm5vte component; it
was a leftover from debugging.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-08-03 11:19:59 +02:00
Gilles Peskine
c111e24292 Improve the detection of keep-going commands
Have simpler patterns related to 'test' (the central objective being to keep
going if 'make test' or 'tests/...' fails, but not if 'make tests' fails).

Add 'cd' as a can't-keep-going command.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-02 23:29:53 +02:00
Gilles Peskine
88a7c2b32e Improve --error-test reporting
Count invocations from 1 to n instead of n to 1.

Explain how changing the loop variable would cause an error if the function
was not executed in a subshell.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-02 23:28:00 +02:00
Gilles Peskine
ec135544c8 Clarify some comments
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-08-02 23:27:42 +02:00
Gilles Peskine
8bb9b80d18
Merge pull request #4806 from hanno-arm/ssl_session_serialization_version
Store TLS version in SSL session structure
2021-08-02 12:45:55 +02:00
Hanno Becker
d7e4b2ce42 Remove duplicated test from SSL test suite
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-08-02 04:54:03 +01:00
Hanno Becker
6c53ecc01d all.sh: Run basic TLS 1.3 with and without record padding
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-08-02 04:54:03 +01:00
Hanno Becker
1f91878281 Specify padding granularity in TLS 1.3 record protection KATs
Still check that encryption and decryption are inverse to each other
if the granularity does not match the one used in the KAT.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-08-02 04:54:03 +01:00
Hanno Becker
41537452f4 Add comment regarding the wire-version used in TLS 1.3 records
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-08-02 04:54:03 +01:00
Hanno Becker
80e760e006 Fix memory leak in TLS 1.3 record protection unit test
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-08-02 04:54:02 +01:00
Hanno Becker
a77d005d39 Add known answer tests for TLS 1.3 record protection
This commit adds four known answer tests for TLS 1.3 record protection
from the following sources:

- RFC 8448 "Example Handshake Traces for TLS 1.3"
- tls13.ulfheim.net "The New Illustrated TLS Connection"

It extends the test coverage of the existing record protection tests
in the following ways:

- The existing record protection tests hand-craft record transform
  structures; the new tests use the function

     mbedtls_ssl_tls13_populate_transform()

  from library source to create an TLS 1.3 transform from raw
  key material and connection information.
- The existing record protection tests only check that encryption
  and decryption are inverse to each other; as such, they don't
  catch non-compliant implementations of encryption and decryption
  which happen to be inverse to each other. By adding a known answer
  test for TLS 1.3 record protection, can gain confidence that our
  implementation is indeed standards-compliant.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-08-02 04:53:58 +01:00
Gilles Peskine
69813477b0
Merge pull request #4758 from paul-elliott-arm/fix_cipher_output_size
Fix divide by zero if macro used with wrong key type
2021-07-30 18:56:18 +02:00
Manuel Pégourié-Gonnard
8da9dc05e8
Merge pull request #4748 from TRodziewicz/re-introduce_ext_checks_for_psa_unlock-wipe_key_slot
Re-introduction of key slot checks
2021-07-29 13:45:57 +02:00
Manuel Pégourié-Gonnard
1a515d1bc2
Merge pull request #4777 from gilles-peskine-arm/save-coverage-summary-3.0
Save the basic-build-test.sh test report summary to coverage-summary.txt
2021-07-29 10:52:35 +02:00
Manuel Pégourié-Gonnard
06672ef771
Merge pull request #4776 from gilles-peskine-arm/generate_psa_tests-robutness-202107
Fix bugs around generate_psa_tests.py invocation from tests/Makefile
2021-07-29 09:58:19 +02:00
Manuel Pégourié-Gonnard
b637150dfe
Merge pull request #4730 from TRodziewicz/finish_removing_tls_1.0_and_1.1
Remove all TLS 1.0 and 1.1 instances and add some compatibility tests
2021-07-27 09:42:53 +02:00
Paul Elliott
91b021e4c7 Add finish buffer size test
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-23 18:53:54 +01:00
Paul Elliott
43fbda648d Add test for update buffer size
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-23 18:53:53 +01:00
Paul Elliott
693bf312d9 Fix _arg argument not being cast to correct type
Also change to TEST_EQUAL, as this is now possible.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-23 18:53:53 +01:00
Paul Elliott
56e4aa6ae2 Restore accidentally deleted blank lines
Script to generate test data was missing a '\n'

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-23 18:53:53 +01:00
Paul Elliott
863864a2f7 Add multipart set nonce test
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-23 18:53:53 +01:00
Paul Elliott
0a6a5694d9 Add missing include to PSA test driver
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-23 15:30:01 +01:00
Hanno Becker
fadbdbb576 Store TLS version in SSL session structure
Instances of `mbedtls_ssl_session` represent data enabling session resumption.

With the introduction of TLS 1.3, the format of this data changes. We therefore
need TLS-version field as part of `mbedtlsl_ssl_session` which allows distinguish
1.2 and 1.3 sessions.

This commit introduces such a TLS-version field to mbedtls_ssl_session.

The change has a few ramifications:

- Session serialization/deserialization routines need to be adjusted.

  This is achieved by adding the TLS-version after the header of
  Mbed TLS version+config, and by having the subsequent structure
  of the serialized data depend on the value of this field.

  The details are described in terms of the RFC 8446 presentation language.

  The 1.2 session (de)serialization are moved into static helper functions,
  while the top-level session (de)serialization only parses the Mbed TLS
  version+config header and the TLS-version field, and dispatches according
  to the found version.

  This way, it will be easy to add support for TLS 1.3 sessions in the future.

- Tests for session serialization need to be adjusted

- Once we add support for TLS 1.3, with runtime negotiation of 1.2 vs. 1.3,
  we will need to have some logic comparing the TLS version of the proposed session
  to the negotiated TLS version. For now, however, we only support TLS 1.2,
  and no such logic is needed. Instead, we just store the TLS version in the
  session structure at the same point when we populate mbedtls_ssl_context.minor_ver.

The change introduces some overlap between `mbedtls_ssl_session.minor_ver` and
`mbedtls_ssl_context.minor_ver`, which should be studied and potentially resolved.
However, with both fields being private and explicitly marked so, this can happen
in a later change.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-07-23 06:25:48 +01:00
Paul Elliott
41ffae17b1 Fix incorrect function documentation
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-22 21:53:12 +01:00
Paul Elliott
26f4aef3a7 Remove aead_verify call from test driver
Function was removed, but missed this reference.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-22 21:53:12 +01:00
Paul Elliott
ebf91638b5 Move set nonce / set length tests to positive test
Previous test in state test was not actually making sure that the
operatioon could be completed using set lengths / set nonce in either
order, thus changed the 'normal' encrypt / decrypt tests to run in
alternating order.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-22 18:52:20 +01:00
Paul Elliott
329d5381a5 Add 0 length part tests
Add tests to do zero length part, n length part until done, to exercise
the zero length edge case.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-22 18:52:20 +01:00
Paul Elliott
243080ca7d Clarify comments on state test.
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-22 18:52:20 +01:00
Paul Elliott
97fd1bad83 Convert over to using a single internal test func
Make all encrypt/decrypt tests use the same function. Cleanup arguments
that were poorly named and document internal function. Removed one test
as I didn't want to write another test purely for it, when its already
tested in one shot.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-22 18:52:20 +01:00
Gilles Peskine
d8d19327d5 Fix mixup about the directory containing the success indicator file
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-22 12:30:14 +02:00
Ronald Cron
dfce58f32d
Merge pull request #4753 from JoeSubbiani/TestBlockSizes_dev
Test block sizes are powers of 2
2021-07-22 11:19:18 +02:00
Gilles Peskine
6ee3b7ed1f More robust failure detection for the coverage report generation
The previous implementation was hard to understand and could in principle
fail to notice if there was a test case failure and the writing of the
line "Note: $TOTAL_FAIL failures." failed. KISS.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-22 11:08:30 +02:00
Gilles Peskine
b969570650 Explain the final error checking
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-22 10:56:39 +02:00
Paul Elliott
e0fcb3b99e Add 'too big' tests for nonce generation
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-21 18:51:23 +01:00
Paul Elliott
d85f547b65 Add expected size to nonce generation test
Also add unneeded copy-paste in the test descriptions.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-21 18:51:23 +01:00
Paul Elliott
374a2be588 Add missing state test coverage
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-21 18:51:23 +01:00
Paul Elliott
481be341ef Make state tests more readable
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-21 18:51:23 +01:00
TRodziewicz
3daaea858b Changing the places of the mbedtls_test_hook_test_fail callback declaration
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-20 13:36:16 +02:00
TRodziewicz
12c77410eb Removing unneded extern declaration of a callback and including common.h where the cb is needed
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-15 16:12:54 +02:00
Joe Subbiani
5ccdc556b1 Remove trailing whitespace
Signed-off-by: Joe Subbiani <joe.subbiani@arm.com>
2021-07-15 09:03:51 +01:00
Joe Subbiani
113d80c219 Simplify the test and description
Previously the check was convoluted. This has been simplified
and given a more appropriate suggestion as per gilles suggestion

Signed-off-by: Joe Subbiani <joe.subbiani@arm.com>
2021-07-14 15:16:09 +01:00
Paul Elliott
a417f56d28 Add non regression test for cipher output size
Call the output size macros specifically with asymmetric keys, which
would cause a crash (and thus test fail) should this fix get regressed.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-14 12:39:54 +01:00
Gilles Peskine
fc70b5252b Save the coverage report to a file
Save the "Test Report Summary" to a file. This can help both CI scripts and
human readers who want the summary after the fact without having to copy the
console output.

Take care to exit with a nonzero status if there is a failure while
generating the test report summary.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-13 23:27:01 +02:00
Gilles Peskine
bbced87390 Show the udp_proxy seed in the console log
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-13 23:26:00 +02:00
Gilles Peskine
a3d2264b88 Only run an unbridled parallel make (make -j) if MAKEFLAGS is unset
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-13 23:23:23 +02:00
Gilles Peskine
6ee3bc09ed Fix typo in test dependencies
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-13 20:34:55 +02:00
Gilles Peskine
e9ad95a63c Error out if enumerating the generated data files fails
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-13 18:36:05 +02:00
Gilles Peskine
8b427c851e Use python3 when building on non-Windows for Windows
The makefiles look for python3 on Unix-like systems where python is often
Python 2. This uses sh code so it doesn't work on Windows. On Windows, the
makefiles just assume that python is Python 3.

The code was incorrectly deciding not to try python3 based on WINDOWS_BUILD,
which indicates that the build is *for* Windows. Switch to checking WINDOWS,
which indicates that the build is *on* Windows.

Fix #4774

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-13 18:26:08 +02:00
Gilles Peskine
5df77c63fb Fix race condition when running generate_psa_tests.py
Fix a race condition in parallel builds: when generating *.data files with
generate_psa_tests.py, make instantiated the recipe once per output file,
potentially resulting in multiple instances of generate_psa_tests.py running
in parallel. This not only was inefficient, but occasionally caused the
output to be corrupted (https://github.com/ARMmbed/mbedtls/issues/4773). Fix
this by ensuring the recipe only runs once.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-13 18:02:27 +02:00
Gilles Peskine
bf4d0ce88d Remove obsolete MBEDTLS_xxx dependencies
This file had temporary MBEDTLS_xxx dependencies because it was created when
support for PSA_WANT_xxx was still incomplete. Switch to the PSA_WANT_xxx
dependencies

This fixes the bug that "PSA storage read: AES-GCM+CTR" was never executed
because there was a typo in a dependency.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-13 17:12:53 +02:00
TRodziewicz
829fe7038d Correction to callback declaration and usage
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-13 12:23:12 +02:00
Gilles Peskine
568f53a9d8 Don't unconditionally restore **/Makefile
all.sh restores **/Makefile from git in case the version in the worktree was
from doing a cmake in-tree build. Instead of doing this unconditionally, do
it only if the toplevel Makefile seems to have been automatically
generated (by cmake or otherwise, e.g. by mbedtls-prepare-build). This way
all.sh no longer silently wipes changes made to Makefile but not committed yet.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-12 18:19:39 +02:00
Gilles Peskine
f83eb82a4d Don't restore *config.h before backing it up
Back up the config files at the beginning of all.sh, rather than before each
component. In particular, create the backup before running cleanup for the
first time. This fixes #3139 (all.sh using a config.h.bak from a previous
job), and makes all.sh more robust against accidentally using a modified
config.h midway through because a component messed with the backup.

Use a different extension (*.all.bak rather than *.bak) for the backups.
This is necessary to ensure that auxiliary scripts such as depends*.pl that
make their own backup don't remove all.sh's backup, which the code from this
commit does not support.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-12 18:19:31 +02:00
Gilles Peskine
03ab544832 Generate cpp_cummy_build.cpp dynamically
Generate programs/test/cpp_dummy_build.cpp dynamically instead of
maintaining it manually. This removes the need to update it when the list of
headers changes.

Include all the headers unconditionally except for the ones that cannot be
included directly.

Support this dynamic generation both with make and with cmake.

Adapt all.sh accordingly. Remove the redundant C build from
component_build_default_make_gcc_and_cxx (it was also done in
component_test_default_out_of_box), leaving a component_test_make_cxx. Also
run the C++ program, because why not. Do this in the full configuration
which may catch a bit more problems in headers.

Fixes #2570 for good.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-12 18:19:31 +02:00
Gilles Peskine
7238503642 Heed --quiet when running make generated_files
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-12 18:19:31 +02:00
Gilles Peskine
88a07457c7 Remove barely-used redirect functions
redirect_out was no longer used and redirect_err was only used to
quiet dd. Change the dd invocation to only print diagnostics on
error (on platforms where this is possible).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-12 18:19:31 +02:00
Gilles Peskine
aca0b32132 Keep going after a shell "[" a.k.a. "test" fails
This is necessary to actually keep going and finish the
component-specific cleanup in component_test_cmake_out_of_source if
ssl-opt.err is non-empty.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-12 18:19:31 +02:00
Archana
c590611e97
Add requested montgomery curve tests
* Add tests to validate MSB not ok for Curve25519 and
  Curve448.
* Add a test to generate key for for Curve448.

Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-12 20:47:11 +05:30
Archana
8584f5b68b
test: psa: Improve description of curve 448 tests
Improve the description of some curve 448 tests

Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-12 20:11:08 +05:30
Archana
ef6aa5c46d Support Curve448 via the PSA API
Enable Curve448 support
Add test vectors to evaluate
* RFC 7748
* a known-answer public key export test.
* a known-answer ECDH (X448) test.

Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-12 08:07:14 +05:30
Archana
1d2e2bb8cc Add missing Curve448 support for PSA keys
mbedtls_ecp_read_key and mbedtls_ecp_write_key are updated to include
support for Curve448 as prescribed by RFC 7748 §5.

Test suites have been updated to validate curve448 under Montgomery
curves.

Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-12 08:02:54 +05:30
TRodziewicz
c3366a4185 Added mis-removed test and removed unneeded tests
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-09 16:57:20 +02:00
TRodziewicz
299510e889 Correction to comments and changelog removed
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-09 16:55:11 +02:00
TRodziewicz
7871c2e736 Adding new macro for tests failing
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-09 14:27:04 +02:00
Joe Subbiani
da36c9f2ce Improve Code Style
add space between bracket and a newline that had occured
through changes but do not match the original file style

Signed-off-by: Joe Subbiani <joe.subbiani@arm.com>
2021-07-09 12:03:06 +01:00
Yuto Takano
3fa1673cf6 Fix grammar suggesting an upper bound on MAX_CONTENT_LEN
Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-09 11:23:40 +01:00
Gilles Peskine
c2e22ee271 Remove code that is useless now that components run in a subshell
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 18:49:19 +02:00
Gilles Peskine
b80f0d20ea Complain if an unsupported component is explicitly requested
In all.sh, when an explicit list of components is specified, error out
if one of the components is not known or not supported. Patterns that
happen to match zero components are still effectively ignored.

Fix #2783

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 18:49:11 +02:00
Gilles Peskine
a681c59d34 Better not function
In the `not` function, in keep-going mode, arrange to report the
failing command (rather than `"$@"`).

Note that the `!` keyword should not be used, because failures with
`!` are not reported properly.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 18:48:26 +02:00
Gilles Peskine
fec30cbe8c Fix double reporting when the last command of a function fails
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 18:44:46 +02:00
Gilles Peskine
1f0cdaf3af Stop dispatching through obsolete functions
Remove the obsolete functions record_status and if_build_succeeded.
They didn't affect error detection, but they made error reporting
worse since $BASH_COMMAND would be the unexpanded "$@".

Keep the function definitions for the sake of pull requests using them
that may still be in flight.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 18:44:36 +02:00
Gilles Peskine
f7e956c85c component_test_cmake_out_of_source: simplify and fix error handling
Remove ssl-opt.err even if it's empty.

Call cat unconditionally: it'll have no visible effect if the file is
empty.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 18:07:44 +02:00
Gilles Peskine
3664780f98 Detect errors on the left-hand side of a pipeline
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 18:07:36 +02:00
Gilles Peskine
ce266c48bb Run each component in a subshell and handle errors more robustly
This commit completely rewrites keep-going mode. Instead of relying
solely on "set -e", which has some subtle limitations (such as being
off anywhere inside a conditional), use an ERR trap to record errors.

Run each component in a subshell. This way a component can set
environment variables, change the current directory, etc., without
affecting other components.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 18:07:20 +02:00
Gilles Peskine
5d99682a8c Add --error-test option to test error detection and reporting
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 17:35:19 +02:00
Gilles Peskine
62cf2e8e9f Switch all.sh to bash
This will let us use bash features that are not found in some other sh
implementations, such as DEBUG and ERR traps, "set -o pipefail", etc.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-08 17:35:19 +02:00
Yuto Takano
9c09d5513e Raise max_content_len constraint by one in Connection ID tests
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-08 16:03:44 +01:00
Yuto Takano
bc87b1ddf3 Add content length constraint to tests that use max_frag_len
Includes:
- handshake memory tests
- Connection ID (MFL) tests
- DTLS fragmenting tests

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-08 15:56:33 +01:00
Joe Subbiani
93213f6649 Remove test cases and update power 2 check
The power 2 check now uses a looping bit shift to try match
with the block sizes and will escape the loop when appropriate

The test cases, as pointed out by Gilles, could be harmful in
the future and testing a test case is not generally necessary

Signed-off-by: Joe Subbiani <joe.subbiani@arm.com>
2021-07-08 15:32:52 +01:00
Gilles Peskine
45f2a40fa4 Speed up the generation of storage format test cases
Restore the optimization done in
 HEAD^{/Speed up the generation of storage format test cases}
which was lost during refactoring made when adding support for
implicit usage flags.

There are still more than one call to the C compiler, but the extra
calls are only for some key usage test cases.

This is an internal refactoring. This commit does not change the
output of generate_psa_tests.py

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-07 12:47:47 +02:00
Dave Rodgman
45419c1ee5 Revert "Add auto-generated files"
This reverts commit 3e84187132.
2021-07-06 20:44:59 +01:00
Dave Rodgman
8a3b232f57 Revert "Add additional generated files"
This reverts commit 2a9c783625.
2021-07-06 20:44:54 +01:00
Joe Subbiani
fc46318792 Change test suite duplicate descriptions
tests/scripts/check_test_cases.py located duplicate descriptions
for the negative tests checking that the check fails when a block
size is not a power of 2

Signed-off-by: Joe Subbiani <joe.subbiani@arm.com>
2021-07-06 14:44:20 +01:00
Joe Subbiani
f37bbe53a0 Extend psa_crypto_metadata tests to check for powers of 2
Add a check to ensure the block_size is or is not a power of 2

Add a new parameter to verify the expected pass/fail when a block_size
is or is not a power of 2.

Add new sets of input data to verify these tests

Fixes #4228

Signed-off-by: Joe Subbiani <joe.subbiani@arm.com>
2021-07-06 10:42:54 +01:00
TRodziewicz
d9be65277d Corrections to the new functions names and error message wording
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-05 15:16:00 +02:00
TRodziewicz
053b99b90b Re-introduction of key slot chekcs
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-05 12:06:03 +02:00
Yuto Takano
6f6574381e Move repetitive equality check to requires_config_value_equals
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-02 15:37:19 +01:00
Yuto Takano
0248582033 Reword and add explanatory comments for MAX_IM_CA tests
- Reword the comment on config.h to suggest that
  `MAX_INTERMEDIATE_CA` may not exist in the config.
- Add a comment explaining why the tests are more restrictive
  than necessary.

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-02 15:37:19 +01:00
Yuto Takano
b0a1c5b021 Use requires_max_content_len, add check in Renegotiation
- Abstract out repetitive checks for IN and OUT content lens
- Remove unclear comment and redundant echo
- Add content length constraints in Renegotiation with fragment length test

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-02 15:37:19 +01:00
Yuto Takano
2be6f1ac5b Add space between command substitution braces and content
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-02 15:37:19 +01:00
Yuto Takano
73e7dcbdfc Add MAX_IM_CA requirement to int_max+1 chain as well
Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-02 15:37:19 +01:00
Yuto Takano
e43556b6bf Remove hard exit with MAX_INTERMEDIATE_CA in ssl-opt.sh
- Replace last remaining dependency on config.py with query_config
- Replace hard exit with `requires_config_value_at_least` and
  `requires_config_value_at_most` to maintain the same effect

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-02 15:37:19 +01:00
Yuto Takano
0509fea3b2 Remove hard exit in ssh-opt.sh, replace with requires functions
- Replace calls to config.py for MAX_IN_LEN and MAX_OUT_LEN with
  `get_config_value_or_default`
- Remove hard exit when MAX_IN/OUT_LEN < 4096, replace with
  `requires_config_value_at_least`

Signed-off-by: Yuto Takano <yuto.takano@arm.com>
2021-07-02 15:37:19 +01:00
Gilles Peskine
1fe01acfc3 Add option to list the generated files and exit
This is useful during the release process, when we want to commit the
generated files.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-07-01 11:13:29 +02:00
Dave Rodgman
2a9c783625 Add additional generated files
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-07-01 09:57:20 +01:00
Dave Rodgman
3e84187132 Add auto-generated files
Add files generated by running make generated_files

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-07-01 09:45:38 +01:00
Dave Rodgman
7601657418 Bump library version numbers
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-30 23:09:51 +01:00
Dave Rodgman
34d8cd2892 Merge remote-tracking branch 'restricted/development-restricted' into mbedtls-3.0.0rc0-pr 2021-06-30 22:51:02 +01:00
Dave Rodgman
9f5774f56d
Merge pull request #4739 from gabor-mezei-arm/3258_fp30_implement_one-shot_MAC_and_cipher
Implement one-shot cipher
2021-06-30 17:04:23 +01:00
Dave Rodgman
0a7ff4a4e2
Merge pull request #4741 from gabor-mezei-arm/3267_fp30_sign_verify_key_policies
Key policy extension for PSA_KEY_USAGE_SIGN/VERIFY_HASH
2021-06-30 14:50:57 +01:00
Dave Rodgman
dc1a3b2d70
Merge pull request #4724 from hanno-arm/ssl_hs_parse_error_3_0
Cleanup SSL error code space
2021-06-30 09:02:55 +01:00
Dave Rodgman
c42409820b Change exceptional case for running negative tests
Update maybe_requires_ciphersuite_enabled so that it will not skip the
ciphersuite requirement when running a test case where the test expects
a ciphersuite mismatch

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-29 19:53:16 +01:00
gabor-mezei-arm
2c9e54a063
Fix pylint issue
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 20:40:31 +02:00
Dave Rodgman
e5b828cb32 Fix error string checked for by ssl-opt.sh negative tests
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-29 19:37:52 +01:00
Dave Rodgman
bec7cafbe1 Correct required config flag in ECJPAKE tests
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-29 19:10:46 +01:00
Dave Rodgman
737237fe37 Fix ECJPAKE test failures
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-29 19:08:33 +01:00
gabor-mezei-arm
2bd5799df0
Fix test case dependency
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:55:25 +02:00
gabor-mezei-arm
ff0da72d52
Restoring the multi-part cipher_verify_output() testing
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:55:25 +02:00
gabor-mezei-arm
95aad8378c
Unify multipart cipher operation tester functions
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:55:24 +02:00
gabor-mezei-arm
a56756ed45
Rename test functions
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:55:24 +02:00
gabor-mezei-arm
50c86cfe79
Remove duplicated tests
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:49:01 +02:00
gabor-mezei-arm
2b231fc81b
Test struct initialization
Modify tests to test mbedtls_psa_cipher_operation_t,
mbedtls_transparent_test_driver_cipher_operation_t and
mbedtls_opaque_test_driver_cipher_operation_t struct initialization macros.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:49:00 +02:00
gabor-mezei-arm
93ad276c29
Add test for one-shot cipher driver wrapper functions
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:48:59 +02:00
gabor-mezei-arm
a9449a0b07
Dispatch cipher functions through the driver interface
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:48:59 +02:00
gabor-mezei-arm
f494bcd313
Add tests for one-shot hash cipher functions
Tests for psa_cipher_encrypt and psa_cipher_decrypt functions.
The psa_cipher_encrypt function takes no parameter for IV and always generates
it therefore there will be a randomness in the calculation and cannot be
validated by comparing the actual output with the expected output.
The function is tested by:
 - doing a prtially randomized test with an encryption then a decryption
   and validating the input with output of the decryption
 - validating against the multipart encryption
The combination of this two methods provides enough coverage like a
known answer test.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 19:48:59 +02:00
gabor-mezei-arm
0c24edd56a
Return iterator instead of list
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:07:01 +02:00
gabor-mezei-arm
6385780f54
Rename function
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:07:00 +02:00
gabor-mezei-arm
2a499c0cc5
Refactor handlibg of the key usage flags
Move implicit usage flags handling to the StorageKey class.
Create a subclass for test case data.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:07:00 +02:00
gabor-mezei-arm
335e55647e
Update key policy testing test cases
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:07:00 +02:00
gabor-mezei-arm
db4522ca83
Rename test cases
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:59 +02:00
gabor-mezei-arm
40d5cd8571
Remove unneeded test case parameter
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:59 +02:00
gabor-mezei-arm
2784bfe226
Move key type validation to crypto_knowledge
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:59 +02:00
gabor-mezei-arm
340fbf3735 Refactor key generation
Remove the key builder and use iterator instead of lists.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:56 +02:00
gabor-mezei-arm
5df1dee0c6
Rename variables and funcions
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:47 +02:00
gabor-mezei-arm
2710bb1d82
Use string in dict instead of Expr object
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:47 +02:00
gabor-mezei-arm
d9050a53ac Remove unnecessary test cases
It is enough only one test case for a key type, algorithm pair when
testing the implicit usage flags.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:43 +02:00
gabor-mezei-arm
8f40510a92
Add better name for variables
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:34 +02:00
gabor-mezei-arm
35929ebb72
Simplify code
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:33 +02:00
gabor-mezei-arm
d851d6872a
Remove unneeded test case parameter
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:33 +02:00
gabor-mezei-arm
ff8264c348
Simplify test function
Use the updated usage flags as expected.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:33 +02:00
gabor-mezei-arm
98a3435a10
Rename function to conform to the library
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:33 +02:00
gabor-mezei-arm
c8720c4857
Give better name for test cases
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:32 +02:00
gabor-mezei-arm
11e4838ef3
Fix generated file modification
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:32 +02:00
gabor-mezei-arm
49d6ea9c9a Fix test case duplication
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:30 +02:00
gabor-mezei-arm
0f8136af79
Fix pylint issues
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:22 +02:00
gabor-mezei-arm
060fdce536
Fix tests
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:22 +02:00
gabor-mezei-arm
672e376ba5 Add test case generation for usage extensions when loading keys
Add test cases validating that if a stored key only had the hash policy,
then after loading it psa_get_key_attributes reports that it also has the
message policy, and the key can be used with message functions.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:20 +02:00
gabor-mezei-arm
7748b6f24b Add key usage policy extension support for key generation
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:06:08 +02:00
gabor-mezei-arm
a4102cb57d
Use different subslasses for the test data files
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:05:53 +02:00
gabor-mezei-arm
780cf9da72
Create a function for gather all the keys.
Prepare for using subclasses.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:05:53 +02:00
gabor-mezei-arm
6ee7253df2
Extend description generation
Add an extra optional parameter to generate a more detailed description
for test cases.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:05:53 +02:00
gabor-mezei-arm
68c030a76c
Use builder method pattern to generate a key
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:05:53 +02:00
gabor-mezei-arm
b5db2c480f
Convert iterators to lists to remove late binding
Remove late binding of iterators to enable the creation of an object
with an actual state of a variable.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:05:52 +02:00
gabor-mezei-arm
7b5c4e2db3
Add type annotations
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:05:52 +02:00
gabor-mezei-arm
edf2df84ba
Add test for extended key usage policies
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:03:39 +02:00
gabor-mezei-arm
4ff73037f9 Update tests for extended key usage policies
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-29 17:03:35 +02:00
Dave Rodgman
6ce10be0ce Fix test failure
The test was checking for an obsolete error.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-29 14:23:47 +01:00
Ronald Cron
8682faeb09
Merge pull request #4694 from gilles-peskine-arm/out_size-3.0
Add output size parameter to signature functions
2021-06-29 09:43:17 +02:00
Bence Szépkúti
414d6bd424 Fix pre-existing typo in comment
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-06-28 14:11:11 +01:00
TRodziewicz
2abf03c551 Remove all TLS 1.0 and 1.1 instances and add some compatibility tests
Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-06-28 14:36:37 +02:00
Hanno Becker
bc00044279 Rename MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION
New name is MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-06-28 12:35:07 +01:00
Bence Szépkúti
fc04aa2be5 Remove MBEDTLS_USER_CONFIG_VERSION handling
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-06-28 09:28:48 +01:00
Bence Szépkúti
ba7248abc4 Introduce versioning in the config files
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-06-28 09:28:47 +01:00
Bence Szépkúti
bb0cfeb2d4 Rename config.h to mbedtls_config.h
This commit was generated using the following script:

# ========================
#!/bin/sh
git ls-files | grep -v '^ChangeLog' | xargs sed -b -E -i '
s/((check|crypto|full|mbedtls|query)_config)\.h/\1\nh/g
s/config\.h/mbedtls_config.h/g
y/\n/./
'
mv include/mbedtls/config.h include/mbedtls/mbedtls_config.h
# ========================

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-06-28 09:28:33 +01:00
Bence Szépkúti
c5c9eb4741 Move preprocessor logic to build_info.h
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-06-28 09:24:42 +01:00
Bence Szépkúti
c662b36af2 Replace all inclusions of config.h
Also remove preprocessor logic for MBEDTLS_CONFIG_FILE, since
build_info.h alreadyy handles it.

This commit was generated using the following script:

# ========================
#!/bin/sh
git ls-files | grep -v '^include/mbedtls/build_info\.h$' | xargs sed -b -E -i '
/^#if !?defined\(MBEDTLS_CONFIG_FILE\)/i#include "mbedtls/build_info.h"
//,/^#endif/d
'
# ========================

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-06-28 09:24:07 +01:00
Dave Rodgman
10bda58b49
Merge pull request #4259 from CJKay/cmake-config
Add CMake package config file
2021-06-25 20:32:13 +01:00
Dave Rodgman
63ad854de8
Merge pull request #4712 from daverodgman/psa_cipher_and_mac_abort_on_error
Psa cipher and mac abort on error
2021-06-25 15:39:59 +01:00
Janos Follath
d910305856 Fix ecp_check_pub() test cases
Negative x coordinate was tested with the value -1. It happens to be one
of the low order points both for Curve25519 and Curve448 and might be
rejected because of that and not because it is negative. Make sure that
x < 0 is the only plausible reason for the point to be rejected.

Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-25 12:28:49 +01:00
Paul Elliott
e57dd2d450 Fix potential free of uninitialised pointer
A test was added in that could cause a jump to exit prior to
initialisation of a pointer that would get freed if that test failed.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-25 11:17:12 +01:00
Ronald Cron
3698fa1043
Merge pull request #4673 from gilles-peskine-arm/psa_crypto_spm-from_platform_h
Fix and test the MBEDTLS_PSA_CRYPTO_SPM build
2021-06-25 09:01:08 +02:00
Gilles Peskine
f00f152444 Add output size parameter to signature functions
The functions mbedtls_pk_sign(), mbedtls_pk_sign_restartable(),
mbedtls_ecdsa_write_signature() and mbedtls_ecdsa_write_signature_restartable()
now take an extra parameter indicating the size of the output buffer for the
signature.

No change to RSA because for RSA, the output size is trivial to calculate.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-25 00:46:22 +02:00
Paul Elliott
87c909a8c5 Make auxiliary function static
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 20:40:47 +01:00
Gilles Peskine
1fed4b8324
Merge pull request #4720 from gilles-peskine-arm/gcm-finish-outlen
Add output_length parameter to mbedtls_gcm_finish
2021-06-24 20:02:40 +02:00
Dave Rodgman
6f7105818c Improve psa_hash_update negative test
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 18:15:23 +01:00
Janos Follath
59e7aac4d1 Add ecp_check_pub tests for Curve 448
Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-24 16:08:40 +01:00
Janos Follath
45af039682 Add DoS test case for ecp_check_pub
A test case for which the loop would take practically forever if it was
reached. The point would be to validate that the loop is not reached.
The test case should cause the CI to time out if starting with the
current code, ecp_check_pubkey_mx() was changed to call
ecp_check_pubkey_x25519() first and run the mbedtls_mpi_size(() test
afterwards, which would make no semantic difference in terms of memory
contents when the function returns, but would open the way for a DoS.

Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-24 15:10:15 +01:00
Paul Elliott
e24f1a1a9d Fix missed driver wrapper tests
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 14:39:05 +01:00
Paul Elliott
16906f9011 Add missing frees to generate nonce test
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 14:39:05 +01:00
Janos Follath
2f1d7f9deb Remove redundant ecp_check_pub() tests
Signed-off-by: Janos Follath <janos.follath@arm.com>
2021-06-24 14:38:14 +01:00
Dave Rodgman
5ae6f7547c Add negative tests for psa_abort in hash functions
Various functions for PSA hash operations call abort
on failure; test that this is done. The PSA spec does not require
this behaviour, but it makes our implementation more robust in
case the user does not abort the operation as required by the
PSA spec.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 11:41:05 +01:00
Gilles Peskine
fedd52ca19
Merge pull request #4707 from gilles-peskine-arm/require-matching-hashlen-rsa-implementation
Require matching hashlen in RSA functions: implementation
2021-06-24 10:28:20 +02:00
Gilles Peskine
5a7be10419 Add output_length parameter to mbedtls_gcm_finish
Without this parameter, it would be hard for callers to know how many bytes
of output the function wrote into the output buffer. It would be possible,
since the cumulated output must have the same length as the cumulated input,
but it would be cumbersome for the caller to keep track.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-23 21:51:32 +02:00
Dave Rodgman
647791da5b Add negative tests for psa_abort in cipher and mac functions
Various functions for PSA cipher and mac operations call abort
on failure; test that this is done. The PSA spec does not require
this behaviour, but it makes our implementation more robust in
case the user does not abort the operation as required by the
PSA spec.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 18:59:17 +01:00
Gilles Peskine
f06b92d724
Merge pull request #4567 from mstarzyk-mobica/gcm_ad
Enable multiple calls to mbedtls_gcm_update_ad
2021-06-23 19:36:23 +02:00
Paul Elliott
0187651647 Test all set lengths and set/generate nonce orders
Test that the two are completely interchangeable in order.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 18:30:20 +01:00
Paul Elliott
3bd5dbacc1 Improve generate nonce test
Make sure the generated nonce works to encrypt test data if the
generated nonce is valid.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 18:30:20 +01:00
Paul Elliott
8fc45169f1 Fix compiler errors on many platforms.
Also added comment to explain why I added a seemingly pointless goto

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 16:06:59 +01:00
Ronald Cron
4f7cc1bb63
Merge pull request #4713 from gilles-peskine-arm/psa-storage-format-test-lifetimes-3.0
PSA storage format: test lifetimes
Almost straightforward of #4392 thus merging with only one approval.
2021-06-23 15:22:03 +02:00
Janos Follath
aa5938edb3
Merge pull request #4703 from gilles-peskine-arm/mpi_montmul-null-3.0
Fix several bugs with the value 0 in bignum
2021-06-23 13:40:14 +01:00
Mateusz Starzyk
939a54cda3 Fix typos and style issues.
Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-06-23 14:30:15 +02:00
Mateusz Starzyk
469c9f35f6 Add GCM tests for empty ciphertext/plaintext and empty AD.
Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-06-23 14:30:15 +02:00
Mateusz Starzyk
58d3a7ef97 Add GCM tests with vectors lengths non-dividable by 16.
Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-06-23 14:30:15 +02:00
Mateusz Starzyk
032a1ceaf3 Remove init_result check from custom gcm test functions.
Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-06-23 14:30:15 +02:00
Mateusz Starzyk
f8a0d4d3bf Fix nested loops set_step in gcm test suite.
Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-06-23 14:30:15 +02:00
Mateusz Starzyk
fc60622710 Add customized test functions for GCM update and update_ad.
New functions are used to cover corner cases:
* authentication data is fed to gcm with 0, 1 or 2 calls to gcm_update
* ciphertext is fed to gcm with 0, 1 or 2 calls to gcm_update_ad

AES-GCM NIST test vectors downloaded at 16.06.2021 from:
csrc.nist.gov/groups/STM/cavp/documents/mac/gcmtestvectors.zip

Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-06-23 14:30:03 +02:00
Dave Rodgman
095dadc5bc Fix error in psa_crypto test suite
The cipher_bad_order test happened to pass, but was not testing the
failure case it intended to test.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:52:11 +01:00
Gilles Peskine
56949f6b63 Make immediate constants unsigned
PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION shifts the location
value (location << 8). This can go outside the range of a 32-bit int
if the location value is above 2^23 as is the case here. Asan
rightfully complained about it. Make the value unsigned to avoid the
integer overflow.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-23 13:44:35 +02:00
Gilles Peskine
576464873a Check that attempting to destroy a read-only key fails
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-23 13:44:35 +02:00
Gilles Peskine
eb7bdaa177 Add storage tests for lifetimes
Test keys with various persistence levels, enumerated from the
metadata tests.

For read-only keys, do not attempt to create or destroy the key
through the API, only to read a key that has been injected into
storage directly through filesystem access.

Do not test keys with a non-default location, since they require a
driver and we do not yet have a dependency mechanism to require the
presence of a driver for a specific location value.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-23 13:44:35 +02:00
Gilles Peskine
fbb914f6e6 Add negative tests for psa_destroy_key
Test a non-existent key identifier in a valid range. Test identifiers
outside the valid range.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-23 13:43:08 +02:00
Gilles Peskine
ad2ddfe874 Add negative tests for key creation with an invalid lifetime
Attempting to create a key with an invalid location or with read-only
persistence must be rejected.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-23 13:43:08 +02:00
Gilles Peskine
1e1eca3233 Add persistent key tests with a non-default persistence
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-23 13:43:08 +02:00