Commit graph

14162 commits

Author SHA1 Message Date
John Durkop
6dff93ff9b Ensure dependent features also included by config_psa.h
When the PSA crypto features need to be setup based on the
PSA_WANT_xxx macros, the dependent features also need to be
enabled. This change corrects that for the MBEDTLS_ECDSA_DETERMINISTIC.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-23 01:22:58 -07:00
John Durkop
28baa1f141 Fixed test_psa_want_ecdsa_disabled_software to use proper macros
Updated the test_psa_want_ecdsa_disabled_software to enable and disable
the correct macros to accomplish the desired test. The previous version
left out the disabling of additional macros to ensure items related
to MBEDTLS_ECDSA_C were also unset. The test was also missing the setting
of the accelerators MBEDTLS_PSA_ACCEL_ALG_ECDSA and DETERMINISTIC_ECDSA.

With the accelerators enabled the test portion had to be temporarily
disabled until the accelerator code is completed so the test will work
properly.

Updated the signature driver source to fix a compiler warning when
MBEDTLS_ECDSA_C is unset.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-23 00:51:52 -07:00
Janos Follath
da9f92c2b2
Merge pull request #3805 from hanno-arm/check_dtls_timers_only_once
Check presence of DTLS retransmission timers only once
2020-10-22 14:29:16 +01:00
Torstein Nesse
ce1494b6ee Update ChangeLog.d/systematically_store_bit_size_3740.txt
Signed-off-by: Torstein Nesse <torstein.nesse@silabs.com>

Co-authored-by: Gilles Peskine <gilles.peskine@arm.com>
2020-10-22 12:12:22 +02:00
Steven Cooreman
88ebb2d7d0 Include public and public-ish PSA headers in CPP check
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-22 11:55:50 +02:00
Steven Cooreman
8c31025310 Add missing bracket for CPP guard
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-22 10:43:45 +02:00
Peter Toft
70e2062218 Updated minimum cmake requirement down to 2.8.12
* As described in issue #3801 the upcoming cmake 3.19
  will not support cmake 2.6 any more
* This PR updates the mimimum required cmake version
  to 2.8.12, which will not give a warning with cmake 3.19
  but still compatible with MbedTLS support of RHEL/CentOS 7 LTS
* Adding ChangeLog.d/bugfix_PR3802.txt

Signed-off-by: Peter Toft <peter.toft@dirac.com>
2020-10-22 10:43:40 +02:00
Gilles Peskine
1b275cc5d0
Merge pull request #3772 from frestr/bugfix/ccm_add_length
Fix additional data length field check for CCM
2020-10-21 22:31:48 +02:00
Gilles Peskine
176fca03b4
Merge pull request #3793 from daverodgman/ccm_test_memory_fix
Fix memory allocation in ccm tests
2020-10-21 22:30:50 +02:00
Gilles Peskine
ec32a74024
Merge pull request #3799 from d3zd3z/fixchar
Fix ssl_context_info handling of EOF (build failure if char is unsigned)
2020-10-21 22:30:15 +02:00
Gilles Peskine
b7eaa77e2a
Merge pull request #3743 from stevew817/bugfix/use_ecdh_key_in_streamlined_derivation
Fix PSA crypto inconsistencies in agreement+derivation
2020-10-21 13:25:21 +02:00
Torstein Nesse
d9246559ca Update changelog entry, format specification, and correct test vectors
Signed-off-by: Torstein Nesse <torstein.nesse@silabs.com>
2020-10-21 11:17:09 +02:00
Ronald Cron
8bf9097872
Merge pull request #3696 from jdurkop/psa-support-data-storage-3289
PSA: support arbitrary data storage from opaque drivers
2020-10-21 09:10:47 +02:00
Ronald Cron
60ca77ca75
Merge pull request #3730 from gilles-peskine-arm/psa_generate_key-curve25519
Fix psa_generate_key on Curve25519
2020-10-21 09:03:00 +02:00
David Brown
c74441802a Add context-info.sh to linked tests
Add context-info.sh to the test scripts linked into the cmake build
directory, so that these tests are available as well.

Signed-off-by: David Brown <david.brown@linaro.org>
2020-10-20 13:35:21 -06:00
David Brown
3bea9f61e6 Add a context-info.sh test for 0xFF chars
Add a non-regression test for ssl_context_info to ensure the base64
decoder doesn't stop processing when it encounters a 0xFF character.

Signed-off-by: David Brown <david.brown@linaro.org>
2020-10-20 13:35:21 -06:00
Nayna Jain
d696e7d91e programs/ssl: Fix incorrect EOF check in ssl_context_info.c
In `read_next_b64_code()`, the result of fgetc() is stored into a char,
but later compared against EOF, which is generally -1.  On platforms
where char is unsigned, this generates a compiler warning/error that the
comparison will never be true (causing a build failure).  The value will
never match, with the function ultimately bailing with a "Too many bad
symbols are detected" error.

On platforms with signed char, EOF is detected, but a file containing a
0xFF character will causes a premature end of file exit of the loop.

Fix this by changing the result to an int.

Fixes #3794.

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: David Brown <david.brown@linaro.org>
2020-10-20 13:31:32 -06:00
Hanno Becker
a817ea449a Check presence of DTLS timers only once
Mbed TLS requires users of DTLS to configure timer callbacks
needed to implement the wait-and-retransmit logic of DTLS.

Previously, the presence of these timer callbacks was checked
at every invocation of `mbedtls_ssl_fetch_input()`, so lowest
layer of the messaging stack interfacing with the underlying
transport.

This commit removes this recurring check and instead checks the
presence of timers once at the beginning of the handshake.

The main rationale for this change is that it is a step towards
separating the various layers of the messaging stack more cleanly:
datagram layer, record layer, message layer, retransmission layer.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-10-20 15:29:14 +01:00
Raef Coles
4762eddfb3 Build: Use new-style syntax in link-libraries
Migrate to new syntax where the PUBLIC attribute is explicitly defined.
Avoids issues caused sometimes where cmake does not allow the mixing of
old-style and new-style syntax

Signed-off-by: Raef Coles <raef.coles@arm.com>
2020-10-20 13:44:44 +01:00
Raef Coles
995c66f702 Build: Add MBEDTLS_TARGET_PREFIX
Allows required targets to have prefixes added to them, so that external
projects can avoid target names clashing.

Signed-off-by: Raef Coles <raef.coles@arm.com>
2020-10-20 13:44:44 +01:00
John Durkop
135ce69361 Updated value of expected key size when not using test_size_function
The calculation of the expected key size when not using the test_size_function
was not correct. The function has now been updated to handle all cases
properly to ensure the expected key size is correct for key pairs, public
keys, and symmetric keys.

Cleaned up some comments and removed unused includes.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-19 07:12:28 -07:00
John Durkop
ac93e3b43c Fix guard for test_size_function()
Previous guard was using original naming and did not
get updated to the new name. Guard is now using correct
definition of TEST_DRIVER_KEY_CONTEXT_SIZE_FUNCTION.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-16 06:48:55 -07:00
John Durkop
badd89f525 Added specific key size values for a test driver
Replaced generic values for the test driver with specific
ones for a 256-bit ECC private/public key pair.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-15 12:16:43 -07:00
John Durkop
750d0e4b72 Remove obsolete comment
Removed TBD comment that is no longer relevant since
that portion of the code has been updated.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-15 12:16:42 -07:00
John Durkop
9a689844f4 Add new size.h to vs2010 project
New file is needed for vs2010 project.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-15 12:16:42 -07:00
John Durkop
2c61835ec8 Add support for PSA crypto driver size_function
Updated get_expected_key_size in psa_crypto_driver_wrappers to properly
handle using the new size_function from PSA crypto drivers. Created
initial infrastructure to support size_function for the PSA crypto
drivers.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-15 12:15:20 -07:00
Steven Cooreman
fa5e631d23 Apply review feedback
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-15 17:07:12 +02:00
John Durkop
0ea39e0ee4 Correct use of MBEDTLS_PSA_BUILTIN_ALG_xxx in crypto library
The psa crypto library was generically using PSA_WANT_ALG_xxx, but
should have been using the correct MBEDTLS_PSA_BUILTIN_ALG_xxx
definition since that code is the builtin version. There were also
a couple of spots that needed to ensure the code block was enabled
for either ECDSA or DETERMINISTIC_ECDSA, not just one of them.

Fixed all the new ALG_ECDSA_DETERMINISTIC names to be
ALG_DETERMINISTIC_ECDSA instead.

Fixed test to use correct definitions.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-15 07:39:02 -07:00
Dave Rodgman
2e680348ad Fix memory allocation in ccm tests
The ccm tests were previously relying on unspecified behaviour in
the underlying implementation (i.e. that it rejects certain buffer
sizes without reading the buffer).

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2020-10-15 15:02:54 +01:00
Ronald Cron
8f24a8bb34
Merge pull request #3595 from gilles-peskine-arm/cert-gen-cleanup-202008-development
Minor cleanups in certificate generation
2020-10-15 13:32:53 +02:00
Peter Toft
fdf337965c Add fix for cmake control of CMAKE_BUILD_TYPE only if mbedtls is the root project
Signed-off-by: Peter Toft <peter.toft@dirac.com>
2020-10-14 19:55:25 +02:00
Gilles Peskine
48584b589f Editorial fixes
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-10-13 19:07:02 +02:00
John Durkop
7b453130e2 Updates to fix check-names and all.sh tests after review
Need to make sure the new MBEDTLS_PSA_ACCEL_XXX defines are not checked
since they should be defined by the PSA driver. Updated the list-macros.sh
script to modify the instances of those found to match the corresponding
MBEDTLS_PSA_BUILTIN_XXX that are defined in config_psa.h

Fixed definition of MBEDTLS_PSA_BUILTIN_ALG_ECDSA_DETERMINISTIC, name was
incorrect. Also fixed a missing space in the comments of crypto_config.h

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:56:26 -07:00
John Durkop
dd544e1463 Fixed comments and test message output for new PSA tests
Provided a clearer comment for the description for ignoring
MBEDTLS_PSA_CRYPTO_CONFIG for full build setting.

Updated message output for test_psa_crypto_config_basic and
test_psa_want_ecdsa_disabled_software so it is more clear and
concise in what the test is doing. Removed inclusion of the
MBEDTLS_PSA_ACCEL_ALG_ECDSA since it should not have been used
for that particular tests.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:47:19 -07:00
John Durkop
c7c03b7d17 Enhanced documentation for crypto_config.h
Provided more detailed documentation for crypto_config.h file so it
is clear to users can enable cryptographic mechanisms using
PSA_WANT_XXX. If MBEDTLS_PSA_CRYPTO_CONFIG is not set the settings in
this file are not used.

Ensure that defines used in this file are set to 1 and not simply defined
per the specification. Also removed the __cplusplus guards since they are
not needed for this file.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:42:03 -07:00
John Durkop
348188229a Correct inclusion of MBEDTLS_XXX based on PSA_WANT_XXX
Provied a more detailed description for the config_psa.h header file.
This new description makes it clear that the file should not be edited
by users or integrators. Relevant changes should be made to
psa/crypto_config.h instead.

Fixed the logic for the inclusion of MBEDTLS_PSA_BUILTIN_XXX to be set
when PSA_WANT_ALG_XXX and MBEDTLS_PSA_ACCEL_ALG_XXX is not defined,
otherwise the MBEDTLS_XXX should be set.

Ensure that MBEDTLS_PSA_BUILTIN_XXX is set to 1 and not simply defined
per specification.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:36:22 -07:00
John Durkop
185764f5f4 Enhance description for MBEDTLS_PSA_CRYPTO_CONFIG
Provided detailed description for MBEDTLS_PSA_CRYPTO_CONFIG so that it is
more clear to the user when the feature should be enabled or disabled.
It also mentions where to look for PSA crypto config settings;
include/psa/crypto_config.h. Removed some other related comments that
were not necessary.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-12 21:32:12 -07:00
Gilles Peskine
55687646c8 PSA_WANT_xxx needs to be defined in the old-style config mechanism
Without MBEDTLS_PSA_CRYPTO_CONFIG, PSA_WANT_xxx needs to be defined,
for the sake of code that calls the PSA API (TLS code, tests, sample
apps).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-10-12 23:23:52 +02:00
Fredrik Strupe
5e940c6068 Fix additional data length field check for CCM
The CCM specification (NIST SP 800-38C) mandates that the formatting of
the additional data length l(a) changes when it is greater _or equal_ to
2^16 - 2^8 (>= 0xFF00). Since such lengths are not supported in mbed TLS,
the operation should fail in such cases.

This commit fixes an off-by-one error which allowed encryption/decryption
to be executed when l(a) was equal to 0xFF00, resulting in an
incorrect/non-standard length format being used.

Fixes #3719.

Signed-off-by: Fredrik Strupe <fredrik.strupe@silabs.com>
2020-10-08 12:09:44 +02:00
Torstein Nesse
162a1104be Changes PSA key storage format to include key bits
* Stores bits in psa_persistent_key_storage_format.
* psa_load_persistent_key_into_slot still imports plaintext keys which
  ensures that the bits value gets set.
* Updates key specification to match new implementation.
* Expands persistent store and load tests with to check for bits
  attribute.
* Removes bits storage from psa_se_key_data_storage_t.

Signed-off-by: Torstein Nesse <torstein.nesse@silabs.com>
2020-10-07 10:54:24 +02:00
Janos Follath
72ca39737f
Merge pull request #3723 from frestr/bugfix/invalid_argument_on_invalid_input
Use PSA_ERROR_INVALID_ARGUMENT for invalid cipher input sizes
2020-10-07 09:21:01 +01:00
Gilles Peskine
ef94c4fcf4
Merge pull request #3474 from ronald-cron-arm/common-mbedtls_param_failed
Common mbedtls_param_failed()
2020-10-06 22:15:42 +02:00
Gilles Peskine
3c9bc7e9d8
Merge pull request #3638 from ARMmbed/better-cf-padding-checks
Better constant-flow idioms for TLS-CBC padding checks
2020-10-06 12:01:36 +02:00
John Durkop
816e043805 Update how test sets PSA_WANT_ALG_*
With the introduction of new tests for PSA crypto config features
the test needs to now be able to set and unset values from the
psa/crypto_config.h file. This change updates from passing the defines
as a build arguement to modifying the header files using config.py.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-05 21:18:06 -07:00
Gilles Peskine
d4d1ab1746
Merge pull request #3282 from gabor-mezei-arm/2905_missing_cleanup_in_ssl_tests
Force cleanup by using goto exit instead of direct return
2020-10-05 17:39:28 +02:00
Gilles Peskine
0dfcefb8e9
Merge pull request #3734 from gilles-peskine-arm/entropy_poll-_gnu_source-development
Don't redefine _GNU_SOURCE if it's already defined
2020-10-05 17:25:34 +02:00
Steven Cooreman
949cde682e Add changelog entries for #3741 and #3742
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-05 16:24:15 +02:00
Steven Cooreman
0ee0d52967 Fix PSA crypto inconsistencies in agreement+derivation
* #3742 After input of a key as SECRET in the derivation, allow the
        derivation result to be used as key.

Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-05 16:08:18 +02:00
Steven Cooreman
ce48e85db9 Fix PSA crypto inconsistencies in agreement+derivation
* #3741 Allow key agreement inside derivation with a key that's allowed
        for the relevant agreement.

Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-05 16:02:45 +02:00
John Durkop
814dca7069 Fix unit tests when MBEDTLS_PSA_CRYPTO_CONFIG is enabled
This change fixes the decrypt cipher setup function to return the
appropriate error code of PSA_ERROR_NOT_SUPPORTED instead of
PSA_ERROR_BAD_STATE for invalid locations when the setup call is made.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-05 06:31:12 -07:00