Commit graph

27511 commits

Author SHA1 Message Date
Jerzy Kasenberg
ee62fceade Rename local variable in aes.c
This changes local variable name RCON to round_constants.

RCON being definition in xc32 compiler headers for some PIC32 register.
Without this change, mynewt project for PIC32 platform fails to build due to
macro redefinition.

This does not changes behavior of library in any way.

Signed-off-by: Jerzy Kasenberg <jerzy.kasenberg@codecoup.pl>
2023-10-11 16:36:24 +02:00
minosgalanakis
1ec69067fa
Merge pull request #1090 from Mbed-TLS/mbedtls-3.5.0rc0-pr
Mbedtls 3.5.0rc0 pr DO NOT MERGE
2023-10-04 23:47:01 +01:00
Minos Galanakis
f7e81d97de Updated BRANCHES.MD
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-04 21:10:40 +01:00
Dave Rodgman
5d323bf0e3 Re-assemble changelog to add missing item, plus a couple of typo fixes.
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-10-04 18:46:47 +01:00
Minos Galanakis
e35e387ad7 Bump library so-crypto, so-x509, so-tls versions.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-04 16:17:46 +01:00
Minos Galanakis
8f4c19a680 Merge pull request #8273 from davidhorstmann-arm:target-prefix-3rdparty
Add MBEDTLS_TARGET_PREFIX to 3rdparty CMake
2023-10-04 16:03:22 +01:00
Minos Galanakis
2546d7da5c Merge pull request #8284 from gilles-peskine-arm:cmake-fix-3rdparty-custom-config
CMake: fix build with 3rdparty module enabled through a custom config
2023-10-04 16:03:21 +01:00
Gilles Peskine
35b49c4d7d Ignore tests of built-in interfaces for driver-only testing parity
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-04 12:28:41 +02:00
Gilles Peskine
010f035cdf Renaming all MBEDTLS_HAVE for curves to MBEDTLS_ECP_HAVE
Fix test cases that were merged concurrently to
db6b4db7a0.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-04 12:27:14 +02:00
Minos Galanakis
591416f32b Auto-generated files for v3.5.0
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-04 00:55:02 +01:00
Minos Galanakis
974388f706 ChangeLog: Set release date
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-03 22:08:53 +01:00
Minos Galanakis
80a8156314 Prepare ChangeLog for 3.5.0 release
```
./scripts/assemble_changelog.py
```

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-03 22:08:39 +01:00
Minos Galanakis
31ca313efa Bump version to 3.5.0
```
./scripts/bump_version.sh --version 3.5.0
```

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-03 22:02:18 +01:00
Minos Galanakis
1a3ad265cc Merge branch 'development-restricted' into mbedtls-3.5.0rc0-pr
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-03 21:57:51 +01:00
Dave Rodgman
3406564b01
Merge pull request #8291 from minosgalanakis/bugfix/updated_check_generated_files 2023-10-03 21:18:57 +01:00
Dave Rodgman
3fb93a8223
Merge pull request #8295 from minosgalanakis/changelog/renamed_psa_crypto_driver_wrappers
Changelog: Added entry for psa_crypto_driver_wrappers rename
2023-10-03 14:05:56 +01:00
Dave Rodgman
130938a804
Merge pull request #1088 from gilles-peskine-arm/tls13_read_public_xxdhe_share-overflow
Fix buffer overflow in TLS 1.3 and USE_PSA_CRYPTO ClientHello ECDH/FFDH parsers
2023-10-03 12:28:38 +01:00
Minos Galanakis
3974b17631 check-generated-files: Added psa_crypto_driver_wrappers_no_static.c file
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-03 11:47:03 +01:00
Minos Galanakis
76b709dd44 Changelog: Added entry for psa_crypto_driver_wrappers rename
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-03 11:14:41 +01:00
Dave Rodgman
ff3e9e1eb0
Merge pull request #8292 from minosgalanakis/bugfix/changelog_extensions
ChangeLog: Added .txt extension to log entries.
2023-10-03 09:29:39 +01:00
Gilles Peskine
3713bee34c Remove leftover local debug line
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-02 18:43:18 +02:00
Minos Galanakis
08707ecbfe ChangeLog: Added .txt extension to log entries.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2023-10-02 16:55:00 +01:00
Gilles Peskine
7910cdd47f Avoid compiler warning about size comparison
GCC warns about comparing uint8_t to a size that may be >255.

Strangely, casting the uint8_t to a size_t in the comparison expression
doesn't avoid the warning. So change the type of the variable.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-02 16:11:05 +02:00
Gilles Peskine
530c423ad2 Improve some debug messages and error codes
On a parsing error in TLS, return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE, not a
crypto error code.

On error paths, emit a level-1 debug message. Report the offending sizes.

Downgrade an informational message's level to 3.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-02 15:42:11 +02:00
Gilles Peskine
6dd5b9a60c In TLS 1.2, only servers are affected
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-02 15:38:51 +02:00
Gilles Peskine
b782415e1b Changelog entry for xxdh_psa_peerkey size validation
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-02 15:08:37 +02:00
Gilles Peskine
c29df535ee Improve robustness of ECDH public key length validation
In client-side code with MBEDTLS_USE_PSA_CRYPTO, use the buffer size to
validate what is written in handshake->xxdh_psa_peerkey. The previous code
was correct, but a little fragile to misconfiguration or maintenance.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-02 15:02:39 +02:00
Gilles Peskine
c8df898204 Fix buffer overflow in TLS 1.2 ClientKeyExchange parsing
Fix a buffer overflow in TLS 1.2 ClientKeyExchange parsing. When
MBEDTLS_USE_PSA_CRYPTO is enabled, the length of the public key in an ECDH
or ECDHE key exchange was not validated. This could result in an overflow of
handshake->xxdh_psa_peerkey, overwriting further data in the handshake
structure or further on the heap.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-02 15:02:33 +02:00
Gilles Peskine
12c5aaae57 Fix buffer overflow in TLS 1.3 ECDH public key parsing
Fix a buffer overflow in TLS 1.3 ServerHello and ClientHello parsing. The
length of the public key in an ECDH- or FFDH-based key exchange was not
validated. This could result in an overflow of handshake->xxdh_psa_peerkey,
overwriting further data in the handshake structure or further on the heap.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-10-02 15:02:10 +02:00
David Horstmann
bf66b752b4 Add custom config logic to 3rdparty modules
These do not link directly against Mbed TLS so need their own
propagation of the custom config values through CMake.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-10-02 11:07:35 +01:00
Dave Rodgman
0673ed2e93
Merge pull request #8278 from gilles-peskine-arm/7298-changelog
Changelog entry for 7298
2023-09-29 15:56:30 +00:00
Gilles Peskine
53307b794d CMake: fix build with 3rdparty module enabled through a custom config
Fixes #8165

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-09-29 17:37:55 +02:00
Gilles Peskine
673fec0c8c
Merge pull request #8277 from mpg/cl-ffdh-psa
Fix ChangeLog entry for FFDH in PSA
2023-09-29 13:17:53 +00:00
Gilles Peskine
16e9256fe8
Merge pull request #8272 from daverodgman/iar-warnings
Fix IAR warnings
2023-09-29 13:11:03 +00:00
Gilles Peskine
d39edead25 Changelog entry for #7298
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2023-09-29 13:07:01 +02:00
Gilles Peskine
f7baf7bfb3
Merge pull request #8271 from daverodgman/fix-numops
Fix error handling in psa_driver_wrapper_xxx_hash_get_num_ops
2023-09-29 10:46:50 +00:00
Manuel Pégourié-Gonnard
ef89fb80d7 Fix ChangeLog entry for FFDH in PSA
It was jumping directly to "driver support" and omitting the first step
of "PSA support".

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-09-29 12:26:47 +02:00
Dave Rodgman
9ac0e72386 Undo not-needed change
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-29 10:39:31 +01:00
Dave Rodgman
ed9c22d533 Remove redundant code
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-29 10:33:49 +01:00
Dave Rodgman
3572bde9c9 Assume get_num_ops cannot fail
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 19:33:15 +01:00
Dave Rodgman
fe43d12f60 Always call get_num_ops
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 18:46:11 +01:00
David Horstmann
de527fbfe0 Add MBEDTLS_TARGET_PREFIX to 3rdparty CMake
MBEDTLS_TARGET_PREFIX is prepended to the CMake targets for Mbed TLS
except for targets in 3rdparty. Change this so that 3rdparty targets use
the prefix as well.

This allows multiple copies of Mbed TLS to be used in the same CMake
tree when using code in the 3rdparty directory.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2023-09-28 18:39:33 +01:00
Dave Rodgman
b51f3da354
Merge pull request #8264 from mpg/follow-up-8075
Follow up to 8075
2023-09-28 17:32:12 +00:00
Dave Rodgman
2bc38a6dfe Fix return type
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 18:15:58 +01:00
Dave Rodgman
9329252620 Fix IAR statement is unreachable warning
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 18:14:53 +01:00
Dave Rodgman
90330a4a2d Fix IAR control bypasses initialisation warning
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 18:13:46 +01:00
Dave Rodgman
321c7e9ed9 Fix error handling in psa_driver_wrapper_xxx_hash_get_num_ops
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 18:07:25 +01:00
Dave Rodgman
02a53d7bef Fix IAR pointless integer comparison
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 17:19:50 +01:00
Dave Rodgman
7e9af05409 Fix IAR control bypasses initialisation warning
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 17:08:49 +01:00
Dave Rodgman
73d8591f7f Fix IAR change of sign warning
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-09-28 17:00:50 +01:00