Commit graph

6541 commits

Author SHA1 Message Date
Hanno Becker
fea81b3997 Improve and fix wording in MPS reader documentation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
f1cfa319c4 Fix typos in documentation of MBEDTLS_ERR_MPS_READER_NEED_MORE
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
d913e2e982 Remove duplicate definition of MBEDTLS_MPS_ERR_BASE
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
4a079c5be7 Fix documentation for mbedtls_mps_[stored_]size_t
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
46101c76f9 Improve wording of documentation of mbedtls_mps_size_t
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
6e3484e123 Clarify documentation of MBEDTLS_MPS_STATE_VALIDATION
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
53314aade1 Adjust spacing for MPS reader entries in library/Makefile
Existing entries use combination of tabs and spaces, for whatever reason.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
3d0db81690 Fix typo in MPS reader documentation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
8fc107c9fb Clarify wording in MPS reader documentation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
a408c1719c Clarify wording in MPS reader documentation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
49cc1317b0 Fix typo in MPS reader documentation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
b1855434eb Rename mbedtls_mps_reader::acc_avail -> acc_available
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
f81e41f1e4 Improve readability of MPS reader implementation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
0bea62f2d7 Fix typo in reader documentation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
4f84e20eb0 Don't invalidate MPS reader buffers upon commit call
Previously, the semantics of mbedtls_mps_reader_commit() was to invalidate
all buffers previously fetched via mbedtls_mps_reader_get(), forbidding
any further use by the 'consumer'. This was in fact a necessary constraint
for the current implementation, which did some memory moving in
mbedtls_mps_reader_commit().

This commit simplifies the reader's semantics and implementation in
the following way:

- API: A call to mbedtls_mps_reader_commit() does no longer invalidate
       the buffers previously obtained via mbedtls_mps_reader_get().
       Instead, they can continue to be used until
       mbedtls_mps_reader_reclaim() is called.

       Calling mbedtls_mps_reader_commit() now only sets a marker
       indicating which parts of the data received through
       mbedtls_mps_reader_get() need not be backed up once
       mbedtls_mps_reader_reclaim() is called. Allowing the user
       to call mbedtls_mbedtls_reader_commit() multiple times
       before mbedtls_mps_reader_reclaim() is mere convenience:
       We'd get exactly the same functionality if instead of
       mbedtls_mps_reader_commit(), there was an additional argument
       to mbedtls_mps_reader_reclaim() indicating how much data
       to retain. However, the present design is more convenient
       for the user and doesn't appear to introduce any unnecessary
       complexity (anymore), so we stick with it for now.

- Implementation: mbedtls_mps_reader_commit() is now a 1-liner,
                  setting the 'commit-marker', but doing nothing else.

                  Instead, the complexity of mbedtls_mp_reader_reclaim()
                  slightly increases because it has to deal with creating
                  backups from both the accumulator and the current
                  fragment. In the previous implementation, which shifted
                  the accumulator content with every call to
                  mbedtls_mps_reader_commit(), only the backup from the
                  fragment was necessary; with the new implementation
                  which doesn't shift anything in
                  mbedtls_mps_reader_commit(), we need to do the
                  accumulator shift in mbedtls_mps_reader_reclaim().

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:20:18 +01:00
Hanno Becker
8899396fd1 Move MPS reader to mbedtls_mps_ namespace
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
984fbded58 Move MPS trace macros to MBEDTLS_MPS_ namespace
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
c518c3b7bb Rename MPS files library/mps/xxx.[ch] to library/mps_xxx.[ch]
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
b910016049 Add MPS trace module implementation
This commit adds an implementation of the MPS trace module
based on `printf()`.

The enabling macro MBEDTLS_MPS_TRACE remains unset by default
because MPS tracing is very verbose and consumes unnecessary
space in the CI.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
ac267f3485 Add MPS configuration option for state validation
See the documentation in library/mps/common.h which
this commit modifies.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
447e8a5ecd Add internal header for MPS errors
This commit adds an internal header `library/mps/error.h` related
to error codes in MPS.

For now, those error codes can be considered internal and thus we
don't have to avoid clashes with other Mbed TLS error codes. This
is OK as long as it's true that MPS isn't public API, and its error
codes are never forwarded to the return values of public API calls.

The error code allocation of MPS will likely need revisiting over time.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
75ac1f7b95 Add implementation for MPS assertion macros
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
0ea0db4368 Add MPS reader translation unit to Makefile and CMakeLists
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
d2f9f53f7f Add typedef's for MPS buffer size types
Most buffers that MPS deals with are small and representable
with integer types of width 16-bit or more.

For highly memory constrained systems, it is therefore a potential
for significant memory savings to use 16-bit types for buffer sizes
throughout MPS.

In prepraration for this, this commit introduces typdefs

```
   mbedtls_mps_size_t
   mbedtls_mps_stored_size_t
```

for buffer sizes in the MPS implementation and the MPS structures,
respectively.

So far, those MUST be defined as `size_t`: While an effort has been made
to write most of MPS code in terms of `mbedtls_mps_[stored_]size_t` in a
way that would allow narrower types, those aren't yet supported. Still,
we retain the typedefs in order to avoid unnecessary rewriting of a large
body of the MPS codebase.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
13cd7846a0 Add MPS reader implementation
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
1c0cd10ea8 Add header and documentation for MPS reader
This commit adds the interface fo the MPS reader component as
`library/mps/reader.h`.

Please see the file itself for extensive documentation.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
c809ff6ef6 Add stub implementation for MPS tracing API
MPS' tracing module uses four macros:

1) TRACE( type, fmt, ... )

   This acts like `printf( fmt, ... )` but also allows
   the specification of a type of trace output (comment,
   warning, error, ...)

2) TRACE_INIT

   This acts like TRACE() but increases the level of
   indentation. It will be used at the beginning of
   function calls.

3) RETURN( val )

   Equivalent to `return( val )` plus a decrement in the
   level of indentation. This should be used at the end of
   functions that have been started with TRACE_INIT.

4) TRACE_END

   This combines a trace output with a decrement of the
   level of indentation. It's necessary prior to leaving
   functions which have been started with TRACE_INIT
   but which don't have a return value.

This commit defines those macros as no-op dummies in
`library/mps/trace.h` for now.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
1ae9f756ba Add MPS compile-time option for enabling/disabling tracing
This commit adds an MPS-specific compile-time option
`MBEDTLS_MPS_TRACE` to the internal MPS header `mps/common.h`.

So far -- this may need revisiting -- MPS comes with its own
internal tracing module which allows to track the operation of
MPS' various layers for the purpose of understanding of it workings
as well as for debugging.

The reasons for the introduction of a module separate from SSL debug
are the following:

1) The SSL debug module requires an SSL context to function because
   debug callbacks are part of the runtime configuration of the SSL
   module.

   The MPS tracing module, in contrast, is not supposed to be used
   in production environments, and there is no need for a runtime
   configuration. Instead, a compile-time defined tracing callback
   is used.

2) In the interest of modularity, MPS' tracing module shouldn't
   require having an SSL context around.

3) Purely visually, MPS' tracing module adds support for indentation
   according to call-depth and coloring according to which module is
   being used, which makes it very useful for what's going on; however,
   those features aren't available in the SSL debug module (and they
   shouldn't be).

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
6ed183cf00 Add MPS compile time option for enabling/disabling assertions
This commit adds the compile-time option MBEDTLS_MPS_ENABLE_ASSERTIONS
which controls the presence of runtime assertions in MPS code.

See the documentation in the header for more information.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Hanno Becker
108fc84b04 Add MPS configuration header
This commit introduces the internal MPS header `mps/common.h`
which will subsequently be populated with MPS-specific compile-time
options and helper macros. For now, it's a stub.

Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2021-03-29 14:19:32 +01:00
Ronald Cron
cfcc3784c1
Merge pull request #4256 from ronald-cron-arm/psa-cipher-iv-size
PSA cipher iv size
CI is OK, just expected ABI-API-checking failure.
2021-03-29 15:02:48 +02:00
Ronald Cron
58946f4a6a
Merge pull request #4229 from ronald-cron-arm/psa-cipher
PSA cipher driver delegation rework
CI is OK, just expected ABI-API-checking failure.
2021-03-29 15:02:14 +02:00
Gilles Peskine
2aff17b8c5
Merge pull request #4098 from gstrauss/remove-redundant-condition
remove ssl_parse_client_hello redundant conditions
2021-03-27 22:47:13 +01:00
Ronald Cron
5618a39fcf psa: cipher: Remove cipher_generate_iv driver entry point
Remove cipher_generate_iv driver entry point as there
is no known use case to delegate this to a driver.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:58:25 +01:00
Ronald Cron
a0d6817838 psa: cipher: Add bound check of the IV length in the core
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:58:25 +01:00
Ronald Cron
c17e8a9bf2 psa: cipher: Use PSA_CIPHER_IV_LENGTH to compute the IV length
The IV length computed in the cipher PSA implementation is
the default IV length thus use the PSA macro PSA_CIPHER_IV_LENGTH
defined to do that.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:58:25 +01:00
Ronald Cron
6ad554cb83 psa: cipher: Prefer length rather than size for IV/block length
Prefer length rather than size for IV/block length as
per the PSA specification.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:58:25 +01:00
Ronald Cron
f2381aaa43 psa: cipher: Use psa_generate_random to generate IVs
Use psa_generate_random() to generate IVs instead of
mbedtls_psa_get_random(). mbedtls_psa_get_random() is
meant to be used as the f_rng argument of Mbed TLS
library functions.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:48:13 +01:00
Ronald Cron
7b4154df0f psa: wrapper: Fix potential unreachable statement warning
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:48:13 +01:00
Ronald Cron
75e6ae25ef Move mbedtls_cipher_info_from_psa to psa_crypto_cipher.c
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:48:13 +01:00
Ronald Cron
1f0db80c78 psa: cipher: Fix symmetric key management
Symmetric key management is not intended to be
delegated to drivers. Thus, key management code
for a given symmetric key type should be included
in the library whether or not the support for
cryptographic operations based on that type of
symmetric key may be delegated to drivers.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:48:13 +01:00
Ronald Cron
5d9b00dddb psa: cipher: Include Mbed TLS cipher driver only if necessary
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 15:48:07 +01:00
Ronald Cron
3522e32132 psa: cipher: Add transparent driver test specific entry points
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 11:38:40 +01:00
Ronald Cron
8287e6b078 psa: cipher: Add utility functions
Isolate the Mbed TLS cipher driver interfaces.
Do the actual cipher operations in utility
functions that are just called by the interface
functions.

The utility functions are intended to be also called
by the cipher test driver interface functions (to be
introduced subsequently) and allow to test the case
where cipher operations are fully accelerated with no
fallback (component test_psa_crypto_config_basic of
all.sh).

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 11:38:40 +01:00
Ronald Cron
7cb9c3d360 psa: cipher: Move to driver operation context application allocation
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 11:38:40 +01:00
Ronald Cron
6e412a71ee psa: cipher: Pass Mbed TLS implementation its operation ctx
As per drivers, pass to the Mbed TLS implementation of
the cipher multi-part operation its operation context
and not the PSA operation context.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 11:38:40 +01:00
Ronald Cron
937dfee92c psa: cipher: Re-organize multi-part operation context
Move members that are of no use to the PSA crypto core
to the Mbed TLS implementation specific operation context.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 11:38:40 +01:00
Ronald Cron
49fafa98b1 psa: cipher: Dispatch based on driver identifier
For cipher multi-part operations, dispatch based on
the driver identifier even in the case of the
Mbed TLS software implementation (viewed as a driver).
Also use the driver identifier to check that an
cipher operation context is active or not.

This aligns the way hash and cipher multi-part
operations are dispatched.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 11:38:40 +01:00
Ronald Cron
06aa442bef psa: cipher: Remove unused key_set operation field
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 11:38:40 +01:00
Ronald Cron
dd24c9bbd9 psa: Call cipher operations software implementations as a driver
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 11:38:40 +01:00