Jerry Yu
7f029d8a94
fix coding style issues
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2022-01-11 11:08:53 +08:00
Jerry Yu
ffef9c52d4
fix alignment issue
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-24 22:31:08 +08:00
Jerry Yu
136320ba0b
fix ci fail
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-21 17:09:00 +08:00
Jerry Yu
1ea9d10687
fix test_ref_configs build fail
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-21 14:52:38 +08:00
Jerry Yu
1753261083
change write_supported_groups_ext prototype
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-20 22:32:09 +08:00
Jerry Yu
9d555ac003
Remove TLS12 version write_supported_group_ext
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-20 22:27:58 +08:00
Jerry Yu
7581c11fc7
Remove tls13_write_supported_groups_ext
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-20 22:25:41 +08:00
Jerry Yu
ba07342cd6
Add generic write_supported-groups_ext
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-20 22:22:15 +08:00
Jerry Yu
b47d0f893e
Replace SUPPORTED_ELLIPTIC_CURVES with SUPPORTED_GROUPS
...
According to RFC7919 and RFC8442 , they are same.
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-20 17:38:50 +08:00
Gilles Peskine
12e27d4c5b
List ssl_debug_helpers_generated.h in generated files
...
Running `generate_ssl_debug_helpers.py` generates both
`ssl_debug_helpers_generated.c` and `ssl_debug_helpers_generated.h`.
List the `.h` file as well as the `.c` file in `check-generated-files.sh` so
that `check-generated-files.sh -u` will complain if it isn't up to date.
List it in `Makefile` and `CMakeLists.txt` so that parallel builds know when
to wait until the `.h` file is present. In `Makefile`, declare the `.c` file
as depending on the `.h` file for order. This way, a dependency for either
will wait until the `.h` file is present, and since the `.h` file is
generated after the `.c` file, this guarantees that the `.c` file is
present.
This fixes random failures of `make -j` from a fresh checkout.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-14 00:19:47 +01:00
Gilles Peskine
32d2a58cc2
Merge pull request #5325 from gilles-peskine-arm/zeroize-tag-3.1
...
Zeroize expected MAC/tag intermediate variables
2021-12-13 19:09:30 +01:00
Gilles Peskine
cd74298c83
mbedtls_cipher_check_tag: jump on error for more robustness to refactoring
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 17:01:25 +01:00
Gilles Peskine
a5c18512b9
Merge pull request #5155 from paul-elliott-arm/pcks12_fix
...
Fixes for pkcs12 with NULL and/or zero length password
2021-12-13 14:52:36 +01:00
Gilles Peskine
a4174312da
Initialize hash_len before using it
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 14:38:40 +01:00
Gilles Peskine
14d5fef6b7
PKCS#1v1.5 signature: better cleanup of temporary values
...
Zeroize temporary buffers used to sanity-check the signature.
If there is an error, overwrite the tentative signature in the output
buffer.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:37:55 +01:00
Gilles Peskine
f0fd4c3aee
mbedtls_ssl_parse_finished: zeroize expected finished value on error
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:36:15 +01:00
Gilles Peskine
c2f7b75a71
mbedtls_ssl_cookie_check: zeroize expected cookie on cookie mismatch
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:35:08 +01:00
Gilles Peskine
60aebec47e
PSA hash verification: zeroize expected hash on hash mismatch
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:33:18 +01:00
Gilles Peskine
e7835d92c1
mbedtls_cipher_check_tag: zeroize expected tag on tag mismatch
...
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:32:43 +01:00
Dave Rodgman
050ad4bb50
Merge pull request #5313 from gilles-peskine-arm/missing-ret-check-mbedtls_md_hmac
...
Check HMAC return values
2021-12-13 10:51:27 +00:00
Gilles Peskine
ecf6bebb9c
Catch failures of md_hmac operations
...
Declare mbedtls_md functions as MBEDTLS_CHECK_RETURN_TYPICAL, meaning that
their return values should be checked.
Do check the return values in our code. We were already doing that
everywhere for hash calculations, but not for HMAC calculations.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-11 15:00:57 +01:00
Gilles Peskine
d5ba50e239
Zeroize local MAC variables
...
Zeroize local MAC variables used for CBC+HMAC cipher suites. In encryption,
this is just good hygiene but probably not needed for security since the
data protected by the MAC that could leak is about to be transmitted anyway.
In DTLS decryption, this could be a security issue since an adversary could
learn the MAC of data that they were trying to inject. At least with
encrypt-then-MAC, the adversary could then easily inject a datagram with
a corrected packet. TLS would still be safe since the receiver would close
the connection after the bad MAC.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-11 14:59:45 +01:00
Ronald Cron
db6adc5aad
ssl: Fix some compilation guards for TLS 1.3 signature algorithms
...
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-12-10 14:25:35 +01:00
Ronald Cron
6f135e1148
Rename MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL to MBEDTLS_SSL_PROTO_TLS1_3
...
As we have now a minimal viable implementation of TLS 1.3,
let's remove EXPERIMENTAL from the config option enabling
it.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-12-10 13:47:55 +01:00
Dave Rodgman
76a2b306ac
Merge pull request #4981 from yuhaoth/pr/add-debug-helpers-generated
...
Add debug helpers generated
2021-12-10 11:56:55 +00:00
Manuel Pégourié-Gonnard
4525cce691
Merge pull request #5256 from yuhaoth/pr/clean-up-secrets-after-done
...
TLS1.3 MVP: Erase secrets when they are not necessary anymore.
2021-12-10 12:48:25 +01:00
Ronald Cron
6b07916e40
Merge pull request #5230 from ronald-cron-arm/tls13_ccs_client
...
Add initial support for "Middlebox Compatibility Mode"
2021-12-10 11:58:05 +01:00
Jerry Yu
a5563f6115
move position of base_key init
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 18:14:36 +08:00
Jerry Yu
b737f6a9be
move base_key init
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 17:55:59 +08:00
Ronald Cron
574ace48d8
Remove unnecessary blank line
...
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-12-10 10:27:25 +01:00
Jerry Yu
9c07473ebc
fix various issues
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 17:12:43 +08:00
Jerry Yu
889b3b76da
fix clang build fail
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 12:57:45 +08:00
Jerry Yu
d05e1cec4b
fix build fail on check_*
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 12:47:03 +08:00
Jerry Yu
e6369b0061
fix test_cmake_as_package fail
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 12:47:03 +08:00
Jerry Yu
eb96fb508e
Add cmake generator
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 12:47:03 +08:00
Jerry Yu
e3b3412bc4
Add tests for enum helper
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 12:45:52 +08:00
Jerry Yu
e78ee99624
add enum value to string helpers
...
Only add helpers for enum in `ssl.h`.
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 12:43:30 +08:00
Jerry Yu
4a2fa5d0aa
Move erase handshake secrets
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:37:14 +08:00
Jerry Yu
27224f58be
fix coding style issue
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Jerry Yu
5132771f5f
Revert "fix possible security leak for counter"
...
This reverts commit 8aab77e11e2aebec09dc9d682b16373771471fe0.
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Jerry Yu
7ca3054795
move zerioize tls13_hs_secrets
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Jerry Yu
23ab7a46a3
move zeroize master secrets
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Jerry Yu
2c70a39d97
move zeroize randbytes
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Jerry Yu
bdfd01835a
fix compile break after merge
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Jerry Yu
a986e9faac
Clean handshake secrets
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Jerry Yu
d103bdb01d
Clean randbytes
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Jerry Yu
745db226db
fix possible security leak for counter
...
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-10 10:33:27 +08:00
Gilles Peskine
d5b2a59826
Merge pull request #5047 from paul-elliott-arm/psa-m-aead-ccm
...
PSA Multipart AEAD CCM Internal implementation and tests.
2021-12-09 14:49:42 +01:00
Ronald Cron
d4c64027a5
tls13: Move state transition after sending CCS to ssl_tls13_client.c
...
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-12-09 13:40:22 +01:00
Ronald Cron
49ad6197ca
Add injection of dummy's ChangeCipherSpec for middlebox compatibility
...
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-12-09 13:40:22 +01:00