Commit graph

12503 commits

Author SHA1 Message Date
Gilles Peskine
aebf0027c0 Test script for config.py
Run config.py with various options and store the results in files.

This script also supports the now-removed config.pl.

This is a framework to run non-regression tests on config.py: run it
with the old version, run it with the new version, and compare the
output.

This is deliberately not a functional test suite so that we don't need
to maintain a set of known outputs. When something changes in
config.py (or config.h), run the script before, run it after, and
check manually whether any differences in the output are acceptable.
2019-11-13 14:33:34 +00:00
Gilles Peskine
7f04013099 Documentation improvements 2019-11-13 14:33:34 +00:00
Gilles Peskine
2552bc73d4 Fix "#define ... not found" error when using the default file name
Also make that error message end with a newline.
2019-11-13 14:33:34 +00:00
Gilles Peskine
63cdb2855f Fix "--force set" without a value sneaking a None in 2019-11-13 14:33:34 +00:00
Gilles Peskine
a52f97d5a5 Fix --force requiring an argument 2019-11-13 14:33:34 +00:00
Gilles Peskine
b6fa7970a6 Fix Config.unset() making the name known 2019-11-13 14:33:34 +00:00
Gilles Peskine
812f185bc8 Also search config.h near the script
By default, this script looks for include/mbedtls/config.h relative to
the current directory. This allows running config.py from outside the
build tree.

To support out-of-tree builds where config.h and config.py are in the
source tree and the current directory is in the build tree, also try
DIRECTORY_CONTAINING_SCRIPT/../include/mbedtls/config.h, and the
equivalent with symbolic links traversed.
2019-11-13 14:33:34 +00:00
Gilles Peskine
1854ec45af Report an error if switching to Python fails 2019-11-13 14:33:34 +00:00
Gilles Peskine
5d650c86b4 Fix 'config.py set' without --force
The `set` command can act on any known symbol.
2019-11-13 14:33:34 +00:00
Gilles Peskine
a26ea87dde Fix encoding errors
config.h is encoded in UTF-8.
2019-11-13 14:33:34 +00:00
Gilles Peskine
a47ab22852 Print help when invoked with no arguments 2019-11-13 14:33:34 +00:00
Gilles Peskine
04362a0ad6 Replace config.pl by a redirection to config.py
Keep config.pl in Perl in case people are running "perl config.pl".
2019-11-13 14:33:34 +00:00
Gilles Peskine
3bdd412d09 Invoke config.py instead of config.pl
git grep -Fl /config.pl | xargs sed -i -e 's!/config\.pl!/config.py!g'

Also:
* Change one comment in include/mbedtls/check_config.h.
* Change PERL to PYTHON in CMakeLists.txt.
2019-11-13 14:33:33 +00:00
Gilles Peskine
2e86a206f7 Remove component designed to test MAX_SIGNATURE_SIZE
MBEDTLS_PK_SIGNATURE_MAX_SIZE is tested in Mbed Crypto. Its effect on
Mbed TLS is also tested via the X.509 tests. The case of
MBEDTLS_MPI_MAX_SIZE < MBEDTLS_ECDSA_MAX_LEN, for which this component
was added as a regression test, is covered by config-suite-b.h which
is tested via test-ref-configs.pl.
2019-11-13 15:32:11 +01:00
Gilles Peskine
96a7cd1759 Use MBEDTLS_PK_SIGNATURE_MAX_SIZE in pkey sample programs
Use the constant that is now provided by the crypto submodule instead
of rolling our own definition which is not correct in all cases.
2019-11-13 15:32:11 +01:00
Gilles Peskine
bf88780e64 Use MBEDTLS_PK_SIGNATURE_MAX_SIZE in X.509
Use the constant that is now provided by the crypto submodule instead
of rolling our own definition which is not correct in all cases.
2019-11-13 15:32:11 +01:00
Gilles Peskine
4efaeba48b Support writing to a different file 2019-11-13 14:32:04 +00:00
Gilles Peskine
651a64de7d Sort symbol lists in alphabetical order
They're easier to maintain that way. The old lists were partly
alphabetized, partly based on config.h order, and partly in the order
in which symbols had been added to config.pl.
2019-11-13 14:32:04 +00:00
Gilles Peskine
f6f5ea21b5 Remove obsolete options from config.py
These options haven't existed for a long time.
2019-11-13 14:32:04 +00:00
Gilles Peskine
61f3c0ce85 Implement the 'full' and 'baremetal' configurations
Also fix 'realfull' to only affect the appropriate sections.

Tested to produce the same results as config.pl on the default
configuration. This commit deliberately contains a direct copy the
lists of symbol names from config.pl.
2019-11-13 14:32:04 +00:00
Gilles Peskine
39bd5e7f9e Mbed TLS configuration file manipulation library and tool
This is meant to be a drop-in replacement for config.pl which can
additionally be used as a library in a Python script.

So far this script supports the commands 'get', 'set' and 'realfull'
but not the other built-in configurations.
2019-11-13 14:32:04 +00:00
Gilles Peskine
e1853a2b3e Update crypto submodule
* #292: Make psa_close_key(0) and psa_destroy_key(0) succeed
* #299: Allow xxx_drbg_set_entropy_len before xxx_drbg_seed
* #259: Check `len` against buffers size upper bound in PSA tests
* #288: Add ECDSA tests with hash and key of different lengths
* #305: CTR_DRBG: grab a nonce from the entropy source if needed
* #316: Stop transactions from being reentrant
* #317: getting_started: Make it clear that keys are passed in
* #314: Fix pk_write with EC key to use a constant size for the private value
* #298: Test a build without any asymmetric cryptography
* #284: Fix some possibly-undefined variable warnings
* #315: Define MBEDTLS_PK_SIGNATURE_MAX_SIZE
* #318: Finish side-porting commits from mbedtls-restricted that missed the split
2019-11-13 15:32:00 +01:00
Gilles Peskine
0b3dd8d024
Merge pull request #318 from gilles-peskine-arm/prr_573-remainder-crypto
Finish side-porting commits from mbedtls-restricted that missed the split
2019-11-13 15:31:34 +01:00
Jaeden Amero
6ffac75995 x509write_csr: Reduce stack usage of mbedtls_x509write_csr_pem()
Using 4096 bytes of stack for the temporary buffer used for holding a
throw-away DER-formatted CSR limits the portability of generating
certificate signing requests to only devices with lots of stack space.
To increase portability, use the mbedtls_pem_write_buffer() in-place
capability instead, using the same buffer for input and output. This
works since the DER encoding for some given data is always smaller than
that same data PEM-encoded.

PEM format is desirable to use even on stack-constrained devices as the
format is easy to work with (for example, copy-pasting from a tiny
device's serial console output, for CSRs generated on tiny devices
without the private key leaving said tiny device).
2019-11-13 14:29:38 +00:00
Gilles Peskine
73a1f377f0 Add documentation notes about the required size of the signature buffers 2019-11-13 12:15:35 +01:00
k-stachowiak
ff25af2c15 Add missing MBEDTLS_ECP_C dependencies in check_config.h 2019-11-13 12:15:35 +01:00
Gilles Peskine
f0d87001d0
Merge pull request #315 from gilles-peskine-arm/pk_signature_max_size
Define MBEDTLS_PK_SIGNATURE_MAX_SIZE
2019-11-13 12:13:57 +01:00
Gilles Peskine
9db14fa478 Update the documentation of mbedtls_pk_sign_restartable()
Clarify the documentation regarding the signature size.

Also fix minor niggles about references to mbedtls_pk_sign().
2019-11-13 10:57:59 +01:00
Gilles Peskine
5bcb24b56e Fix output buffer length check in pk_opaque_sign_wrap 2019-11-13 10:57:59 +01:00
Gilles Peskine
5460565be4 Fix errors in the definition of MBEDTLS_PK_SIGNATURE_MAX_SIZE
The initial value for the max calculation needs to be 0. The fallback
needs to come last. With the old code, the value was never smaller
than the fallback.

For RSA_ALT, use MPI_MAX_SIZE. Only use this if RSA_ALT is enabled.

For PSA, check PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE, and separately check
the special case of ECDSA where PSA and mbedtls have different
representations for the signature.
2019-11-13 10:57:59 +01:00
Gilles Peskine
7a9899f1bd
Merge pull request #284 from gilles-peskine-arm/bk-warning-fixes-crypto
Fix some possibly-undefined variable warnings
2019-11-12 19:45:13 +01:00
Gilles Peskine
cb0101ff33
Merge pull request #298 from gilles-peskine-arm/config-symmetric-only
Test a build without any asymmetric cryptography
2019-11-12 19:37:13 +01:00
Gilles Peskine
24354a74a2 Link to PSA documentation websites
Link to the official PSA documentation page.

Link to the PSA Crypto portal page.
2019-11-12 18:02:05 +01:00
Gilles Peskine
7dd0b45b7f Note that local documentation will be tailored to a specific config 2019-11-12 18:01:51 +01:00
Gilles Peskine
d296e82e2d Mbed Crypto implements mbedtls_xxx as well as PSA
Link to the Mbed TLS documentation.
2019-11-12 18:01:43 +01:00
Gilles Peskine
2975571ff5 Fix ECDSA case in PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE
PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE was taking the maximum ECDSA key
size as the ECDSA signature size. Fix it to use the actual maximum
size of an ECDSA signature.
2019-11-12 13:21:53 +01:00
Gilles Peskine
f48d6f2320 Add sanity checks for the mbedtls_pk_sign output size
mbedtls_pk_sign does not take the size of its output buffer as a
parameter. We guarantee that MBEDTLS_PK_SIGNATURE_MAX_SIZE is enough.
For RSA and ECDSA signatures made in software, this is ensured by the
way MBEDTLS_PK_SIGNATURE_MAX_SIZE is defined at compile time. For
signatures made through RSA-alt and PSA, this is not guaranteed
robustly at compile time, but we can test it at runtime, so do that.
2019-11-12 13:21:53 +01:00
Gilles Peskine
b22a24b23f Fix MBEDTLS_PK_SIGNATURE_MAX_SIZE to account for ECDSA
The original definition of MBEDTLS_PK_SIGNATURE_MAX_SIZE only took RSA
into account. An ECDSA signature may be larger than the maximum
possible RSA signature size, depending on build options; for example
this is the case with config-suite-b.h.
2019-11-12 13:21:53 +01:00
Gilles Peskine
a719db8b04 Add pk_utils and pk_sign tests with different curves
This reveals that MBEDTLS_PK_SIGNATURE_MAX_SIZE is too small.
2019-11-12 13:21:53 +01:00
Gilles Peskine
e48fe55c24 test_suite_pk: pk_genkey: support a variable key size or curve
No intended behavior change.
2019-11-12 13:21:52 +01:00
Gilles Peskine
a428ced165
Merge pull request #277 from k-stachowiak/check-array-index-range
Check array index range in GCM multiplication
2019-11-12 13:18:47 +01:00
Gilles Peskine
e80c7e49e7
Merge pull request #278 from ARMmbed/dev/yanesca/iotcrypt-767-ecdsa-timing-side-channel
ECDSA timing side channel due to non-constant-time integer comparison
2019-11-12 11:44:13 +01:00
Jaeden Amero
90bc6b8143
Merge pull request #281 from AndrzejKurek/IOTCRYPT-968-zeroize-aes-variables
Zeroize local AES variables before exiting the function
2019-11-12 10:38:20 +00:00
Gilles Peskine
95b9f601fd
Merge pull request #280 from ARMmbed/dev/yanesca/iotcrypt-958-ecdsa-side-channel-fix
ECDSA: Fix side channel vulnerability
2019-11-12 11:34:39 +01:00
Gilles Peskine
eba088a8ac test_suite_pk: check the signature size after pk_sign
Add a check that the signature size from pk_sign is less than the
documented maximum size.

Reduce the stack consumption in pk_sign_verify.
2019-11-12 11:10:54 +01:00
Gilles Peskine
f85e4e67bd test_suite_pk: fix use of sig_len without initialization
In pk_sign_verify, if mbedtls_pk_sign() failed, sig_len was passed to
mbedtls_pk_verify_restartable() without having been initialized. This
worked only because in the only test case that expects signature to
fail, the verify implementation doesn't look at sig_len before failing
for the expected reason.

The value of sig_len if sign() fails is undefined, so set sig_len to
something sensible.
2019-11-12 11:09:26 +01:00
Andrzej Kurek
96ae5cd087 Zeroize local AES variables before exiting the function
This issue has been reported by Tuba Yavuz, Farhaan Fowze, Ken (Yihang) Bai,
Grant Hernandez, and Kevin Butler (University of Florida) and
Dave Tian (Purdue University).

In AES encrypt and decrypt some variables were left on the stack. The value
of these variables can be used to recover the last round key. To follow best
practice and to limit the impact of buffer overread vulnerabilities (like
Heartbleed) we need to zeroize them before exiting the function.
2019-11-12 03:05:51 -05:00
Gilles Peskine
2ad5e45de6
Merge pull request #314 from gilles-peskine-arm/pkwrite_ECPrivateKey_size-crypto
Fix pk_write with EC key to use a constant size for the private value
2019-11-08 19:30:51 +01:00
Gilles Peskine
c82ed6fbf4
Merge pull request #317 from Patater/reduce-ram-rsa
getting_started: Make it clear that keys are passed in
2019-11-08 17:44:10 +01:00
Jaeden Amero
b14a4ff840
Merge pull request #316 from Patater/stop-reentrant-transaction
Stop transactions from being reentrant
2019-11-08 14:59:39 +00:00