diff --git a/CMakeLists.txt b/CMakeLists.txt index 8372905d0d..561498c5d4 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -243,7 +243,15 @@ if(CMAKE_COMPILER_IS_GNU) set(CMAKE_C_FLAGS_RELEASE "-O2") set(CMAKE_C_FLAGS_DEBUG "-O0 -g3") set(CMAKE_C_FLAGS_COVERAGE "-O0 -g3 --coverage") - set(CMAKE_C_FLAGS_ASAN "-fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O3") + # Old GCC versions hit a performance problem with test_suite_pkwrite + # "Private keey write check EC" tests when building with Asan+UBSan + # and -O3: those tests take more than 100x time than normal, with + # test_suite_pkwrite taking >3h on the CI. Observed with GCC 5.4 on + # Ubuntu 16.04 x86_64 and GCC 6.5 on Ubuntu 18.04 x86_64. + # GCC 7.5 and above on Ubuntu 18.04 appear fine. + # To avoid the performance problem, we use -O2 here. It doesn't slow + # down much even with modern compiler versions. + set(CMAKE_C_FLAGS_ASAN "-fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O2") set(CMAKE_C_FLAGS_ASANDBG "-fsanitize=address -fno-common -fsanitize=undefined -fno-sanitize-recover=all -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls") set(CMAKE_C_FLAGS_TSAN "-fsanitize=thread -O3") set(CMAKE_C_FLAGS_TSANDBG "-fsanitize=thread -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls") diff --git a/ChangeLog.d/9690.txt b/ChangeLog.d/9690.txt new file mode 100644 index 0000000000..d00eb16bc9 --- /dev/null +++ b/ChangeLog.d/9690.txt @@ -0,0 +1,8 @@ +Security + * Fix a buffer underrun in mbedtls_pk_write_key_der() when + called on an opaque key, MBEDTLS_USE_PSA_CRYPTO is enabled, + and the output buffer is smaller than the actual output. + Fix a related buffer underrun in mbedtls_pk_write_key_pem() + when called on an opaque RSA key, MBEDTLS_USE_PSA_CRYPTO is enabled + and MBEDTLS_MPI_MAX_SIZE is smaller than needed for a 4096-bit RSA key. + CVE-2024-49195 diff --git a/ChangeLog.d/fix-driver-schema-check.txt b/ChangeLog.d/fix-driver-schema-check.txt new file mode 100644 index 0000000000..9b6d8acd6e --- /dev/null +++ b/ChangeLog.d/fix-driver-schema-check.txt @@ -0,0 +1,3 @@ +Bugfix + * Fix invalid JSON schemas for driver descriptions used by + generate_driver_wrappers.py. diff --git a/docs/architecture/psa-keystore-design.md b/docs/architecture/psa-keystore-design.md index cdd2cac3ab..be082a812a 100644 --- a/docs/architecture/psa-keystore-design.md +++ b/docs/architecture/psa-keystore-design.md @@ -67,7 +67,7 @@ Note that a slot must not be moved in memory while it is being read or written. There are three variants of the key store implementation, responding to different needs. * Hybrid key store ([static key slots](#static-key-store) with dynamic key data): the key store is a statically allocated array of slots, of size `MBEDTLS_PSA_KEY_SLOT_COUNT`. Key material is allocated on the heap. This is the historical implementation. It remains the default in the Mbed TLS 3.6 long-time support (LTS) branch when using a handwritten `mbedtls_config.h`, as is common on resource-constrained platforms, because the alternatives have tradeoffs (key size limit and larger RAM usage at rest for the static key store, larger code size and more risk due to code complexity for the dynamic key store). -* Fully [static key store](#static-key-store) (since Mbed TLS 3.6.2): the key store is a statically allocated array of slots, of size `MBEDTLS_PSA_KEY_SLOT_COUNT`. Each key slot contains the key representation directly, and the key representation must be no more than `MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE` bytes. This is intended for very constrained devices that do not have a heap. +* Fully [static key store](#static-key-store) (since Mbed TLS 3.6.3): the key store is a statically allocated array of slots, of size `MBEDTLS_PSA_KEY_SLOT_COUNT`. Each key slot contains the key representation directly, and the key representation must be no more than `MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE` bytes. This is intended for very constrained devices that do not have a heap. * [Dynamic key store](#dynamic-key-store) (since Mbed TLS 3.6.1): the key store is dynamically allocated as multiple slices on the heap, with a size that adjusts to the application's usage. Key material is allocated on the heap. Compared to the hybrid key store, the code size and RAM consumption are larger. This is intended for higher-end devices where applications are not expected to have a highly predicatable resource usage. This is the default implementation when using the default `mbedtls_config.h` file, as is common on platforms such as Linux, starting with Mbed TLS 3.6.1. #### Future improvement: merging the key store variants @@ -95,7 +95,7 @@ When creating a volatile key, the slice containing the slot and index of the slo The static key store is the historical implementation. The key store is a statically allocated array of slots, of size `MBEDTLS_PSA_KEY_SLOT_COUNT`. This value is an upper bound for the total number of volatile keys plus loaded keys. -Since Mbed TLS 3.6.2, there are two variants for the static key store: a hybrid variant (default), and a fully-static variant enabled by the configuration option `MBEDTLS_PSA_STATIC_KEY_SLOTS`. The two variants have the same key store management: the only difference is in how the memory for key data is managed. With fully static key slots, the key data is directly inside the slot, and limited to `MBEDTLS_PSA_KEY_SLOT_BUFFER_SIZE` bytes. With the hybrid key store, the slot contains a pointer to the key data, which is allocated on the heap. +Since Mbed TLS 3.6.3, there are two variants for the static key store: a hybrid variant (default), and a fully-static variant enabled by the configuration option `MBEDTLS_PSA_STATIC_KEY_SLOTS`. The two variants have the same key store management: the only difference is in how the memory for key data is managed. With fully static key slots, the key data is directly inside the slot, and limited to `MBEDTLS_PSA_KEY_SLOT_BUFFER_SIZE` bytes. With the hybrid key store, the slot contains a pointer to the key data, which is allocated on the heap. #### Volatile key identifiers in the static key store diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt index ca48a756b9..5cb5ec860f 100644 --- a/library/CMakeLists.txt +++ b/library/CMakeLists.txt @@ -61,11 +61,11 @@ if(GEN_FILES) ${CMAKE_CURRENT_BINARY_DIR}/ssl_debug_helpers_generated.c COMMAND ${MBEDTLS_PYTHON_EXECUTABLE} - ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/generate_ssl_debug_helpers.py + ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_ssl_debug_helpers.py --mbedtls-root ${CMAKE_CURRENT_SOURCE_DIR}/.. ${CMAKE_CURRENT_BINARY_DIR} DEPENDS - ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/generate_ssl_debug_helpers.py + ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_ssl_debug_helpers.py ${tls_error_headers} ) else() diff --git a/library/Makefile b/library/Makefile index 9490aa78de..e9c908ee9c 100644 --- a/library/Makefile +++ b/library/Makefile @@ -364,11 +364,11 @@ $(TF_PSA_CRYPTO_DRIVERS_BUILTIN_SRC_PATH)/error.c: echo " Gen $@" $(PERL) ../scripts/generate_errors.pl -ssl_debug_helpers_generated.c: $(gen_file_dep) ../scripts/generate_ssl_debug_helpers.py +ssl_debug_helpers_generated.c: $(gen_file_dep) ../framework/scripts/generate_ssl_debug_helpers.py ssl_debug_helpers_generated.c: $(gen_file_dep) $(filter-out %config%,$(wildcard ../include/mbedtls/*.h)) ssl_debug_helpers_generated.c: echo " Gen $@" - $(PYTHON) ../scripts/generate_ssl_debug_helpers.py --mbedtls-root .. . + $(PYTHON) ../framework/scripts/generate_ssl_debug_helpers.py --mbedtls-root .. . version_features.c: $(gen_file_dep) ../scripts/generate_features.pl version_features.c: $(gen_file_dep) ../scripts/data_files/version_features.fmt diff --git a/library/common.h b/library/common.h deleted file mode 100644 index 7bb2674293..0000000000 --- a/library/common.h +++ /dev/null @@ -1,437 +0,0 @@ -/** - * \file common.h - * - * \brief Utility macros for internal use in the library - */ -/* - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -#ifndef MBEDTLS_LIBRARY_COMMON_H -#define MBEDTLS_LIBRARY_COMMON_H - -#include "mbedtls/build_info.h" -#include "alignment.h" - -#include -#include -#include -#include - -#if defined(__ARM_NEON) -#include -#define MBEDTLS_HAVE_NEON_INTRINSICS -#elif defined(MBEDTLS_PLATFORM_IS_WINDOWS_ON_ARM64) -#include -#define MBEDTLS_HAVE_NEON_INTRINSICS -#endif - -/** Helper to define a function as static except when building invasive tests. - * - * If a function is only used inside its own source file and should be - * declared `static` to allow the compiler to optimize for code size, - * but that function has unit tests, define it with - * ``` - * MBEDTLS_STATIC_TESTABLE int mbedtls_foo(...) { ... } - * ``` - * and declare it in a header in the `library/` directory with - * ``` - * #if defined(MBEDTLS_TEST_HOOKS) - * int mbedtls_foo(...); - * #endif - * ``` - */ -#if defined(MBEDTLS_TEST_HOOKS) -#define MBEDTLS_STATIC_TESTABLE -#else -#define MBEDTLS_STATIC_TESTABLE static -#endif - -#if defined(MBEDTLS_TEST_HOOKS) -extern void (*mbedtls_test_hook_test_fail)(const char *test, int line, const char *file); -#define MBEDTLS_TEST_HOOK_TEST_ASSERT(TEST) \ - do { \ - if ((!(TEST)) && ((*mbedtls_test_hook_test_fail) != NULL)) \ - { \ - (*mbedtls_test_hook_test_fail)( #TEST, __LINE__, __FILE__); \ - } \ - } while (0) -#else -#define MBEDTLS_TEST_HOOK_TEST_ASSERT(TEST) -#endif /* defined(MBEDTLS_TEST_HOOKS) */ - -/** \def ARRAY_LENGTH - * Return the number of elements of a static or stack array. - * - * \param array A value of array (not pointer) type. - * - * \return The number of elements of the array. - */ -/* A correct implementation of ARRAY_LENGTH, but which silently gives - * a nonsensical result if called with a pointer rather than an array. */ -#define ARRAY_LENGTH_UNSAFE(array) \ - (sizeof(array) / sizeof(*(array))) - -#if defined(__GNUC__) -/* Test if arg and &(arg)[0] have the same type. This is true if arg is - * an array but not if it's a pointer. */ -#define IS_ARRAY_NOT_POINTER(arg) \ - (!__builtin_types_compatible_p(__typeof__(arg), \ - __typeof__(&(arg)[0]))) -/* A compile-time constant with the value 0. If `const_expr` is not a - * compile-time constant with a nonzero value, cause a compile-time error. */ -#define STATIC_ASSERT_EXPR(const_expr) \ - (0 && sizeof(struct { unsigned int STATIC_ASSERT : 1 - 2 * !(const_expr); })) - -/* Return the scalar value `value` (possibly promoted). This is a compile-time - * constant if `value` is. `condition` must be a compile-time constant. - * If `condition` is false, arrange to cause a compile-time error. */ -#define STATIC_ASSERT_THEN_RETURN(condition, value) \ - (STATIC_ASSERT_EXPR(condition) ? 0 : (value)) - -#define ARRAY_LENGTH(array) \ - (STATIC_ASSERT_THEN_RETURN(IS_ARRAY_NOT_POINTER(array), \ - ARRAY_LENGTH_UNSAFE(array))) - -#else -/* If we aren't sure the compiler supports our non-standard tricks, - * fall back to the unsafe implementation. */ -#define ARRAY_LENGTH(array) ARRAY_LENGTH_UNSAFE(array) -#endif -/** Allow library to access its structs' private members. - * - * Although structs defined in header files are publicly available, - * their members are private and should not be accessed by the user. - */ -#define MBEDTLS_ALLOW_PRIVATE_ACCESS - -/** - * \brief Securely zeroize a buffer then free it. - * - * Similar to making consecutive calls to - * \c mbedtls_platform_zeroize() and \c mbedtls_free(), but has - * code size savings, and potential for optimisation in the future. - * - * Guaranteed to be a no-op if \p buf is \c NULL and \p len is 0. - * - * \param buf Buffer to be zeroized then freed. - * \param len Length of the buffer in bytes - */ -void mbedtls_zeroize_and_free(void *buf, size_t len); - -/** Return an offset into a buffer. - * - * This is just the addition of an offset to a pointer, except that this - * function also accepts an offset of 0 into a buffer whose pointer is null. - * (`p + n` has undefined behavior when `p` is null, even when `n == 0`. - * A null pointer is a valid buffer pointer when the size is 0, for example - * as the result of `malloc(0)` on some platforms.) - * - * \param p Pointer to a buffer of at least n bytes. - * This may be \p NULL if \p n is zero. - * \param n An offset in bytes. - * \return Pointer to offset \p n in the buffer \p p. - * Note that this is only a valid pointer if the size of the - * buffer is at least \p n + 1. - */ -static inline unsigned char *mbedtls_buffer_offset( - unsigned char *p, size_t n) -{ - return p == NULL ? NULL : p + n; -} - -/** Return an offset into a read-only buffer. - * - * Similar to mbedtls_buffer_offset(), but for const pointers. - * - * \param p Pointer to a buffer of at least n bytes. - * This may be \p NULL if \p n is zero. - * \param n An offset in bytes. - * \return Pointer to offset \p n in the buffer \p p. - * Note that this is only a valid pointer if the size of the - * buffer is at least \p n + 1. - */ -static inline const unsigned char *mbedtls_buffer_offset_const( - const unsigned char *p, size_t n) -{ - return p == NULL ? NULL : p + n; -} - -/* Always inline mbedtls_xor() for similar reasons as mbedtls_xor_no_simd(). */ -#if defined(__IAR_SYSTEMS_ICC__) -#pragma inline = forced -#elif defined(__GNUC__) -__attribute__((always_inline)) -#endif -/** - * Perform a fast block XOR operation, such that - * r[i] = a[i] ^ b[i] where 0 <= i < n - * - * \param r Pointer to result (buffer of at least \p n bytes). \p r - * may be equal to either \p a or \p b, but behaviour when - * it overlaps in other ways is undefined. - * \param a Pointer to input (buffer of at least \p n bytes) - * \param b Pointer to input (buffer of at least \p n bytes) - * \param n Number of bytes to process. - * - * \note Depending on the situation, it may be faster to use either mbedtls_xor() or - * mbedtls_xor_no_simd() (these are functionally equivalent). - * If the result is used immediately after the xor operation in non-SIMD code (e.g, in - * AES-CBC), there may be additional latency to transfer the data from SIMD to scalar - * registers, and in this case, mbedtls_xor_no_simd() may be faster. In other cases where - * the result is not used immediately (e.g., in AES-CTR), mbedtls_xor() may be faster. - * For targets without SIMD support, they will behave the same. - */ -static inline void mbedtls_xor(unsigned char *r, - const unsigned char *a, - const unsigned char *b, - size_t n) -{ - size_t i = 0; -#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS) -#if defined(MBEDTLS_HAVE_NEON_INTRINSICS) && \ - (!(defined(MBEDTLS_COMPILER_IS_GCC) && MBEDTLS_GCC_VERSION < 70300)) - /* Old GCC versions generate a warning here, so disable the NEON path for these compilers */ - for (; (i + 16) <= n; i += 16) { - uint8x16_t v1 = vld1q_u8(a + i); - uint8x16_t v2 = vld1q_u8(b + i); - uint8x16_t x = veorq_u8(v1, v2); - vst1q_u8(r + i, x); - } -#if defined(__IAR_SYSTEMS_ICC__) - /* This if statement helps some compilers (e.g., IAR) optimise out the byte-by-byte tail case - * where n is a constant multiple of 16. - * For other compilers (e.g. recent gcc and clang) it makes no difference if n is a compile-time - * constant, and is a very small perf regression if n is not a compile-time constant. */ - if (n % 16 == 0) { - return; - } -#endif -#elif defined(MBEDTLS_ARCH_IS_X64) || defined(MBEDTLS_ARCH_IS_ARM64) - /* This codepath probably only makes sense on architectures with 64-bit registers */ - for (; (i + 8) <= n; i += 8) { - uint64_t x = mbedtls_get_unaligned_uint64(a + i) ^ mbedtls_get_unaligned_uint64(b + i); - mbedtls_put_unaligned_uint64(r + i, x); - } -#if defined(__IAR_SYSTEMS_ICC__) - if (n % 8 == 0) { - return; - } -#endif -#else - for (; (i + 4) <= n; i += 4) { - uint32_t x = mbedtls_get_unaligned_uint32(a + i) ^ mbedtls_get_unaligned_uint32(b + i); - mbedtls_put_unaligned_uint32(r + i, x); - } -#if defined(__IAR_SYSTEMS_ICC__) - if (n % 4 == 0) { - return; - } -#endif -#endif -#endif - for (; i < n; i++) { - r[i] = a[i] ^ b[i]; - } -} - -/* Always inline mbedtls_xor_no_simd() as we see significant perf regressions when it does not get - * inlined (e.g., observed about 3x perf difference in gcm_mult_largetable with gcc 7 - 12) */ -#if defined(__IAR_SYSTEMS_ICC__) -#pragma inline = forced -#elif defined(__GNUC__) -__attribute__((always_inline)) -#endif -/** - * Perform a fast block XOR operation, such that - * r[i] = a[i] ^ b[i] where 0 <= i < n - * - * In some situations, this can perform better than mbedtls_xor() (e.g., it's about 5% - * better in AES-CBC). - * - * \param r Pointer to result (buffer of at least \p n bytes). \p r - * may be equal to either \p a or \p b, but behaviour when - * it overlaps in other ways is undefined. - * \param a Pointer to input (buffer of at least \p n bytes) - * \param b Pointer to input (buffer of at least \p n bytes) - * \param n Number of bytes to process. - * - * \note Depending on the situation, it may be faster to use either mbedtls_xor() or - * mbedtls_xor_no_simd() (these are functionally equivalent). - * If the result is used immediately after the xor operation in non-SIMD code (e.g, in - * AES-CBC), there may be additional latency to transfer the data from SIMD to scalar - * registers, and in this case, mbedtls_xor_no_simd() may be faster. In other cases where - * the result is not used immediately (e.g., in AES-CTR), mbedtls_xor() may be faster. - * For targets without SIMD support, they will behave the same. - */ -static inline void mbedtls_xor_no_simd(unsigned char *r, - const unsigned char *a, - const unsigned char *b, - size_t n) -{ - size_t i = 0; -#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS) -#if defined(MBEDTLS_ARCH_IS_X64) || defined(MBEDTLS_ARCH_IS_ARM64) - /* This codepath probably only makes sense on architectures with 64-bit registers */ - for (; (i + 8) <= n; i += 8) { - uint64_t x = mbedtls_get_unaligned_uint64(a + i) ^ mbedtls_get_unaligned_uint64(b + i); - mbedtls_put_unaligned_uint64(r + i, x); - } -#if defined(__IAR_SYSTEMS_ICC__) - /* This if statement helps some compilers (e.g., IAR) optimise out the byte-by-byte tail case - * where n is a constant multiple of 8. - * For other compilers (e.g. recent gcc and clang) it makes no difference if n is a compile-time - * constant, and is a very small perf regression if n is not a compile-time constant. */ - if (n % 8 == 0) { - return; - } -#endif -#else - for (; (i + 4) <= n; i += 4) { - uint32_t x = mbedtls_get_unaligned_uint32(a + i) ^ mbedtls_get_unaligned_uint32(b + i); - mbedtls_put_unaligned_uint32(r + i, x); - } -#if defined(__IAR_SYSTEMS_ICC__) - if (n % 4 == 0) { - return; - } -#endif -#endif -#endif - for (; i < n; i++) { - r[i] = a[i] ^ b[i]; - } -} - -/* Fix MSVC C99 compatible issue - * MSVC support __func__ from visual studio 2015( 1900 ) - * Use MSVC predefine macro to avoid name check fail. - */ -#if (defined(_MSC_VER) && (_MSC_VER <= 1900)) -#define /*no-check-names*/ __func__ __FUNCTION__ -#endif - -/* Define `asm` for compilers which don't define it. */ -/* *INDENT-OFF* */ -#ifndef asm -#if defined(__IAR_SYSTEMS_ICC__) -#define asm __asm -#else -#define asm __asm__ -#endif -#endif -/* *INDENT-ON* */ - -/* - * Define the constraint used for read-only pointer operands to aarch64 asm. - * - * This is normally the usual "r", but for aarch64_32 (aka ILP32, - * as found in watchos), "p" is required to avoid warnings from clang. - * - * Note that clang does not recognise '+p' or '=p', and armclang - * does not recognise 'p' at all. Therefore, to update a pointer from - * aarch64 assembly, it is necessary to use something like: - * - * uintptr_t uptr = (uintptr_t) ptr; - * asm( "ldr x4, [%x0], #8" ... : "+r" (uptr) : : ) - * ptr = (void*) uptr; - * - * Note that the "x" in "%x0" is neccessary; writing "%0" will cause warnings. - */ -#if defined(__aarch64__) && defined(MBEDTLS_HAVE_ASM) -#if UINTPTR_MAX == 0xfffffffful -/* ILP32: Specify the pointer operand slightly differently, as per #7787. */ -#define MBEDTLS_ASM_AARCH64_PTR_CONSTRAINT "p" -#elif UINTPTR_MAX == 0xfffffffffffffffful -/* Normal case (64-bit pointers): use "r" as the constraint for pointer operands to asm */ -#define MBEDTLS_ASM_AARCH64_PTR_CONSTRAINT "r" -#else -#error "Unrecognised pointer size for aarch64" -#endif -#endif - -/* Always provide a static assert macro, so it can be used unconditionally. - * It does nothing on systems where we don't know how to define a static assert. - */ -/* Can't use the C11-style `defined(static_assert)` on FreeBSD, since it - * defines static_assert even with -std=c99, but then complains about it. - */ -#if defined(static_assert) && !defined(__FreeBSD__) -#define MBEDTLS_STATIC_ASSERT(expr, msg) static_assert(expr, msg) -#else -/* Make sure `MBEDTLS_STATIC_ASSERT(expr, msg);` is valid both inside and - * outside a function. We choose a struct declaration, which can be repeated - * any number of times and does not need a matching definition. */ -#define MBEDTLS_STATIC_ASSERT(expr, msg) \ - struct ISO_C_does_not_allow_extra_semicolon_outside_of_a_function -#endif - -#if defined(__has_builtin) -#define MBEDTLS_HAS_BUILTIN(x) __has_builtin(x) -#else -#define MBEDTLS_HAS_BUILTIN(x) 0 -#endif - -/* Define compiler branch hints */ -#if MBEDTLS_HAS_BUILTIN(__builtin_expect) -#define MBEDTLS_LIKELY(x) __builtin_expect(!!(x), 1) -#define MBEDTLS_UNLIKELY(x) __builtin_expect(!!(x), 0) -#else -#define MBEDTLS_LIKELY(x) x -#define MBEDTLS_UNLIKELY(x) x -#endif - -/* MBEDTLS_ASSUME may be used to provide additional information to the compiler - * which can result in smaller code-size. */ -#if MBEDTLS_HAS_BUILTIN(__builtin_assume) -/* clang provides __builtin_assume */ -#define MBEDTLS_ASSUME(x) __builtin_assume(x) -#elif MBEDTLS_HAS_BUILTIN(__builtin_unreachable) -/* gcc and IAR can use __builtin_unreachable */ -#define MBEDTLS_ASSUME(x) do { if (!(x)) __builtin_unreachable(); } while (0) -#elif defined(_MSC_VER) -/* Supported by MSVC since VS 2005 */ -#define MBEDTLS_ASSUME(x) __assume(x) -#else -#define MBEDTLS_ASSUME(x) do { } while (0) -#endif - -/* For gcc -Os, override with -O2 for a given function. - * - * This will not affect behaviour for other optimisation settings, e.g. -O0. - */ -#if defined(MBEDTLS_COMPILER_IS_GCC) && defined(__OPTIMIZE_SIZE__) -#define MBEDTLS_OPTIMIZE_FOR_PERFORMANCE __attribute__((optimize("-O2"))) -#else -#define MBEDTLS_OPTIMIZE_FOR_PERFORMANCE -#endif - -/* Suppress compiler warnings for unused functions and variables. */ -#if !defined(MBEDTLS_MAYBE_UNUSED) && defined(__has_attribute) -# if __has_attribute(unused) -# define MBEDTLS_MAYBE_UNUSED __attribute__((unused)) -# endif -#endif -#if !defined(MBEDTLS_MAYBE_UNUSED) && defined(__GNUC__) -# define MBEDTLS_MAYBE_UNUSED __attribute__((unused)) -#endif -#if !defined(MBEDTLS_MAYBE_UNUSED) && defined(__IAR_SYSTEMS_ICC__) && defined(__VER__) -/* IAR does support __attribute__((unused)), but only if the -e flag (extended language support) - * is given; the pragma always works. - * Unfortunately the pragma affects the rest of the file where it is used, but this is harmless. - * Check for version 5.2 or later - this pragma may be supported by earlier versions, but I wasn't - * able to find documentation). - */ -# if (__VER__ >= 5020000) -# define MBEDTLS_MAYBE_UNUSED _Pragma("diag_suppress=Pe177") -# endif -#endif -#if !defined(MBEDTLS_MAYBE_UNUSED) && defined(_MSC_VER) -# define MBEDTLS_MAYBE_UNUSED __pragma(warning(suppress:4189)) -#endif -#if !defined(MBEDTLS_MAYBE_UNUSED) -# define MBEDTLS_MAYBE_UNUSED -#endif - -#endif /* MBEDTLS_LIBRARY_COMMON_H */ diff --git a/library/debug.c b/library/debug.c index c36ed3c5c2..a486353726 100644 --- a/library/debug.c +++ b/library/debug.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_DEBUG_C) diff --git a/library/mps_reader.c b/library/mps_reader.c index 27d0c04c10..0fe7dfe95f 100644 --- a/library/mps_reader.c +++ b/library/mps_reader.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_PROTO_TLS1_3) diff --git a/library/mps_trace.c b/library/mps_trace.c index 69f6e5a0f9..98449b5f77 100644 --- a/library/mps_trace.c +++ b/library/mps_trace.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_PROTO_TLS1_3) diff --git a/library/mps_trace.h b/library/mps_trace.h index b456b2ffdd..ac2b75f6ba 100644 --- a/library/mps_trace.h +++ b/library/mps_trace.h @@ -12,7 +12,7 @@ #ifndef MBEDTLS_MPS_MBEDTLS_MPS_TRACE_H #define MBEDTLS_MPS_MBEDTLS_MPS_TRACE_H -#include "common.h" +#include "ssl_misc.h" #include "mps_common.h" #include "mps_trace.h" diff --git a/library/net_sockets.c b/library/net_sockets.c index ef89a88ef0..33616bccb1 100644 --- a/library/net_sockets.c +++ b/library/net_sockets.c @@ -15,7 +15,7 @@ #define _XOPEN_SOURCE 600 /* sockaddr_storage */ #endif -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_NET_C) diff --git a/library/pkcs7.c b/library/pkcs7.c index 3aac662ba6..ff0567c6f6 100644 --- a/library/pkcs7.c +++ b/library/pkcs7.c @@ -2,12 +2,10 @@ * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "x509_internal.h" -#include "mbedtls/build_info.h" #if defined(MBEDTLS_PKCS7_C) #include "mbedtls/pkcs7.h" -#include "x509_internal.h" #include "mbedtls/asn1.h" #include "mbedtls/x509_crt.h" #include "mbedtls/x509_crl.h" diff --git a/library/ssl_cache.c b/library/ssl_cache.c index 772cb8fdfe..28d0cfbb7d 100644 --- a/library/ssl_cache.c +++ b/library/ssl_cache.c @@ -9,14 +9,13 @@ * to store and retrieve the session information. */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_CACHE_C) #include "mbedtls/platform.h" #include "mbedtls/ssl_cache.h" -#include "ssl_misc.h" #include "mbedtls/error.h" #include diff --git a/library/ssl_ciphersuites.c b/library/ssl_ciphersuites.c index 402c1355ca..149595083e 100644 --- a/library/ssl_ciphersuites.c +++ b/library/ssl_ciphersuites.c @@ -7,7 +7,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_TLS_C) diff --git a/library/ssl_client.c b/library/ssl_client.c index 345e608938..823708173c 100644 --- a/library/ssl_client.c +++ b/library/ssl_client.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_CLI_C) #if defined(MBEDTLS_SSL_PROTO_TLS1_3) || defined(MBEDTLS_SSL_PROTO_TLS1_2) @@ -17,7 +17,6 @@ #include "mbedtls/platform.h" #include "ssl_client.h" -#include "ssl_misc.h" #include "ssl_tls13_keys.h" #include "ssl_debug_helpers.h" diff --git a/library/ssl_client.h b/library/ssl_client.h index 05ee7e4cc3..56e9bf8575 100644 --- a/library/ssl_client.h +++ b/library/ssl_client.h @@ -8,11 +8,7 @@ #ifndef MBEDTLS_SSL_CLIENT_H #define MBEDTLS_SSL_CLIENT_H -#include "common.h" - -#if defined(MBEDTLS_SSL_TLS_C) #include "ssl_misc.h" -#endif #include diff --git a/library/ssl_cookie.c b/library/ssl_cookie.c index cba513d4f6..0e374671ce 100644 --- a/library/ssl_cookie.c +++ b/library/ssl_cookie.c @@ -9,14 +9,13 @@ * to store and retrieve the session information. */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_COOKIE_C) #include "mbedtls/platform.h" #include "mbedtls/ssl_cookie.h" -#include "ssl_misc.h" #include "mbedtls/error.h" #include "mbedtls/platform_util.h" #include "mbedtls/constant_time.h" diff --git a/library/ssl_debug_helpers.h b/library/ssl_debug_helpers.h index 4889e77e04..6f843404c7 100644 --- a/library/ssl_debug_helpers.h +++ b/library/ssl_debug_helpers.h @@ -11,13 +11,11 @@ #ifndef MBEDTLS_SSL_DEBUG_HELPERS_H #define MBEDTLS_SSL_DEBUG_HELPERS_H -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_DEBUG_C) #include "mbedtls/ssl.h" -#include "ssl_misc.h" - const char *mbedtls_ssl_states_str(mbedtls_ssl_states in); diff --git a/library/ssl_misc.h b/library/ssl_misc.h index 47e56e8796..66117dd312 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -10,7 +10,7 @@ #ifndef MBEDTLS_SSL_MISC_H #define MBEDTLS_SSL_MISC_H -#include "mbedtls/build_info.h" +#include "common.h" #include "mbedtls/error.h" @@ -47,7 +47,6 @@ #include "ssl_ciphersuites_internal.h" #include "x509_internal.h" #include "pk_internal.h" -#include "common.h" /* Shorthand for restartable ECC */ #if defined(MBEDTLS_ECP_RESTARTABLE) && \ diff --git a/library/ssl_msg.c b/library/ssl_msg.c index 0165fd6390..7000e93e53 100644 --- a/library/ssl_msg.c +++ b/library/ssl_msg.c @@ -10,14 +10,13 @@ * http://www.ietf.org/rfc/rfc4346.txt */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_TLS_C) #include "mbedtls/platform.h" #include "mbedtls/ssl.h" -#include "ssl_misc.h" #include "debug_internal.h" #include "mbedtls/error.h" #include "mbedtls/platform_util.h" diff --git a/library/ssl_ticket.c b/library/ssl_ticket.c index bfb656cf62..615b37fd64 100644 --- a/library/ssl_ticket.c +++ b/library/ssl_ticket.c @@ -5,13 +5,12 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_TICKET_C) #include "mbedtls/platform.h" -#include "ssl_misc.h" #include "mbedtls/ssl_ticket.h" #include "mbedtls/error.h" #include "mbedtls/platform_util.h" diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 62472484d1..39c7a2e3cb 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -9,7 +9,7 @@ * http://www.ietf.org/rfc/rfc4346.txt */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_TLS_C) @@ -18,7 +18,6 @@ #include "mbedtls/ssl.h" #include "ssl_client.h" #include "ssl_debug_helpers.h" -#include "ssl_misc.h" #include "debug_internal.h" #include "mbedtls/error.h" diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index eac6a3aadd..0affc91c49 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_PROTO_TLS1_2) @@ -13,7 +13,6 @@ #include "mbedtls/ssl.h" #include "ssl_client.h" -#include "ssl_misc.h" #include "debug_internal.h" #include "mbedtls/error.h" #include "mbedtls/constant_time.h" diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c index 03722ac33c..76200be615 100644 --- a/library/ssl_tls12_server.c +++ b/library/ssl_tls12_server.c @@ -5,14 +5,13 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_2) #include "mbedtls/platform.h" #include "mbedtls/ssl.h" -#include "ssl_misc.h" #include "debug_internal.h" #include "mbedtls/error.h" #include "mbedtls/platform_util.h" diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index 162e3a3146..53c519c4bb 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3) @@ -15,7 +15,6 @@ #include "mbedtls/error.h" #include "mbedtls/platform.h" -#include "ssl_misc.h" #include "ssl_client.h" #include "ssl_tls13_keys.h" #include "ssl_debug_helpers.h" diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c index 3f1f551dd1..6a7d502723 100644 --- a/library/ssl_tls13_generic.c +++ b/library/ssl_tls13_generic.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_TLS_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3) @@ -19,7 +19,6 @@ #include "psa/crypto.h" #include "mbedtls/psa_util.h" -#include "ssl_misc.h" #include "ssl_tls13_invasive.h" #include "ssl_tls13_keys.h" #include "ssl_debug_helpers.h" diff --git a/library/ssl_tls13_invasive.h b/library/ssl_tls13_invasive.h index b4506f71c7..73e0e304f9 100644 --- a/library/ssl_tls13_invasive.h +++ b/library/ssl_tls13_invasive.h @@ -6,7 +6,7 @@ #ifndef MBEDTLS_SSL_TLS13_INVASIVE_H #define MBEDTLS_SSL_TLS13_INVASIVE_H -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_PROTO_TLS1_3) diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 739414ea2f..96aad1c4b0 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_PROTO_TLS1_3) @@ -17,7 +17,6 @@ #include "mbedtls/error.h" #include "mbedtls/platform.h" -#include "ssl_misc.h" #include "ssl_tls13_keys.h" #include "ssl_tls13_invasive.h" diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c index 9c949bd0b1..ab27c94efc 100644 --- a/library/ssl_tls13_server.c +++ b/library/ssl_tls13_server.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_PROTO_TLS1_3) @@ -16,7 +16,6 @@ #include "mbedtls/oid.h" #include "mbedtls/psa_util.h" -#include "ssl_misc.h" #include "ssl_tls13_keys.h" #include "ssl_debug_helpers.h" diff --git a/library/version.c b/library/version.c index 04397332bb..2cd947da72 100644 --- a/library/version.c +++ b/library/version.c @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_VERSION_C) diff --git a/library/x509.c b/library/x509.c index be7b277bb0..0571687daa 100644 --- a/library/x509.c +++ b/library/x509.c @@ -15,11 +15,10 @@ * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf */ -#include "common.h" +#include "x509_internal.h" #if defined(MBEDTLS_X509_USE_C) -#include "x509_internal.h" #include "mbedtls/asn1.h" #include "mbedtls/error.h" #include "mbedtls/oid.h" diff --git a/library/x509_create.c b/library/x509_create.c index 130983189f..48ac080cbe 100644 --- a/library/x509_create.c +++ b/library/x509_create.c @@ -5,11 +5,10 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "x509_internal.h" #if defined(MBEDTLS_X509_CREATE_C) -#include "x509_internal.h" #include "mbedtls/asn1write.h" #include "mbedtls/error.h" #include "mbedtls/oid.h" diff --git a/library/x509_crl.c b/library/x509_crl.c index 7901992e20..e67fde7210 100644 --- a/library/x509_crl.c +++ b/library/x509_crl.c @@ -15,12 +15,11 @@ * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf */ -#include "common.h" +#include "x509_internal.h" #if defined(MBEDTLS_X509_CRL_PARSE_C) #include "mbedtls/x509_crl.h" -#include "x509_internal.h" #include "mbedtls/error.h" #include "mbedtls/oid.h" #include "mbedtls/platform_util.h" diff --git a/library/x509_crt.c b/library/x509_crt.c index 1de1ee64c1..d72e2fb8ad 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -17,12 +17,11 @@ * [SIRO] https://cabforum.org/wp-content/uploads/Chunghwatelecom201503cabforumV4.pdf */ -#include "common.h" +#include "x509_internal.h" #if defined(MBEDTLS_X509_CRT_PARSE_C) #include "mbedtls/x509_crt.h" -#include "x509_internal.h" #include "mbedtls/error.h" #include "mbedtls/oid.h" #include "mbedtls/platform_util.h" @@ -680,8 +679,8 @@ static int x509_get_authority_key_id(unsigned char **p, } if (*p != end) { - return MBEDTLS_ERR_X509_INVALID_EXTENSIONS + - MBEDTLS_ERR_ASN1_LENGTH_MISMATCH; + return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH); } return 0; diff --git a/library/x509_csr.c b/library/x509_csr.c index 813d64466c..3a78268685 100644 --- a/library/x509_csr.c +++ b/library/x509_csr.c @@ -15,12 +15,11 @@ * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf */ -#include "common.h" +#include "x509_internal.h" #if defined(MBEDTLS_X509_CSR_PARSE_C) #include "mbedtls/x509_csr.h" -#include "x509_internal.h" #include "mbedtls/error.h" #include "mbedtls/oid.h" #include "mbedtls/platform_util.h" diff --git a/library/x509_internal.h b/library/x509_internal.h index 8a2d2ed007..ec1ac50db6 100644 --- a/library/x509_internal.h +++ b/library/x509_internal.h @@ -9,9 +9,9 @@ */ #ifndef MBEDTLS_X509_INTERNAL_H #define MBEDTLS_X509_INTERNAL_H -#include "mbedtls/private_access.h" -#include "mbedtls/build_info.h" +#include "common.h" +#include "mbedtls/private_access.h" #include "mbedtls/x509.h" #include "mbedtls/asn1.h" diff --git a/library/x509write.c b/library/x509write.c index 4704900d38..8288c892bb 100644 --- a/library/x509write.c +++ b/library/x509write.c @@ -4,11 +4,11 @@ * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "x509_internal.h" + #if defined(MBEDTLS_X509_CSR_WRITE_C) || defined(MBEDTLS_X509_CRT_WRITE_C) #include "mbedtls/x509_crt.h" -#include "x509_internal.h" #include "mbedtls/asn1write.h" #include "mbedtls/error.h" #include "mbedtls/oid.h" diff --git a/library/x509write_crt.c b/library/x509write_crt.c index ce9e4a6106..8bce1ccf52 100644 --- a/library/x509write_crt.c +++ b/library/x509write_crt.c @@ -11,12 +11,11 @@ * - attributes: PKCS#9 v2.0 aka RFC 2985 */ -#include "common.h" +#include "x509_internal.h" #if defined(MBEDTLS_X509_CRT_WRITE_C) #include "mbedtls/x509_crt.h" -#include "x509_internal.h" #include "mbedtls/asn1write.h" #include "mbedtls/error.h" #include "mbedtls/oid.h" diff --git a/library/x509write_csr.c b/library/x509write_csr.c index 0d6f6bb1d3..604c94c3e5 100644 --- a/library/x509write_csr.c +++ b/library/x509write_csr.c @@ -10,11 +10,10 @@ * - attributes: PKCS#9 v2.0 aka RFC 2985 */ -#include "common.h" +#include "x509_internal.h" #if defined(MBEDTLS_X509_CSR_WRITE_C) -#include "x509_internal.h" #include "mbedtls/x509_csr.h" #include "mbedtls/asn1write.h" #include "mbedtls/error.h" diff --git a/scripts/code_style.py b/scripts/code_style.py index ed9f7bc0bf..26b691c2f4 100755 --- a/scripts/code_style.py +++ b/scripts/code_style.py @@ -103,8 +103,10 @@ def get_src_files(since: Optional[str]) -> List[str]: "--name-only", "--pretty=", "--"] + src_files output = subprocess.check_output(cmd, universal_newlines=True) committed_changed_files = output.split() + # ... the framework submodule - cmd = ["git", "-C", "framework", "log", since + "..HEAD", + framework_since = get_submodule_hash(since, "framework") + cmd = ["git", "-C", "framework", "log", framework_since + "..HEAD", "--name-only", "--pretty=", "--"] + framework_src_files output = subprocess.check_output(cmd, universal_newlines=True, env=framework_env) @@ -137,6 +139,12 @@ def get_src_files(since: Optional[str]) -> List[str]: is_file_autogenerated(filename))] return src_files +def get_submodule_hash(commit: str, submodule: str) -> str: + """Get the commit hash of a submodule at a given commit in the Git repository.""" + cmd = ["git", "ls-tree", commit, submodule] + output = subprocess.check_output(cmd, universal_newlines=True) + return output.split()[2] + def get_uncrustify_version() -> str: """ Get the version string from Uncrustify diff --git a/scripts/data_files/driver_jsons/driver_opaque_schema.json b/scripts/data_files/driver_jsons/driver_opaque_schema.json index 933eb07488..b05da00dc4 100644 --- a/scripts/data_files/driver_jsons/driver_opaque_schema.json +++ b/scripts/data_files/driver_jsons/driver_opaque_schema.json @@ -11,7 +11,7 @@ }, "type": { "type": "string", - "const": ["opaque"] + "const": "opaque" }, "location": { "type": ["integer","string"], diff --git a/scripts/data_files/driver_jsons/driver_transparent_schema.json b/scripts/data_files/driver_jsons/driver_transparent_schema.json index f5d91eb321..1791163888 100644 --- a/scripts/data_files/driver_jsons/driver_transparent_schema.json +++ b/scripts/data_files/driver_jsons/driver_transparent_schema.json @@ -11,7 +11,7 @@ }, "type": { "type": "string", - "const": ["transparent"] + "const": "transparent" }, "mbedtls/h_condition": { "type": "string" diff --git a/scripts/data_files/version_features.fmt b/scripts/data_files/version_features.fmt index d820d4d1a7..fc71f5d777 100644 --- a/scripts/data_files/version_features.fmt +++ b/scripts/data_files/version_features.fmt @@ -5,7 +5,7 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#include "common.h" +#include "ssl_misc.h" #if defined(MBEDTLS_VERSION_C) diff --git a/scripts/generate_ssl_debug_helpers.py b/scripts/generate_ssl_debug_helpers.py deleted file mode 100755 index 600d16096e..0000000000 --- a/scripts/generate_ssl_debug_helpers.py +++ /dev/null @@ -1,416 +0,0 @@ -#!/usr/bin/env python3 - -"""Generate library/ssl_debug_helpers_generated.c - -The code generated by this module includes debug helper functions that can not be -implemented by fixed codes. - -""" - -# Copyright The Mbed TLS Contributors -# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later -import sys -import re -import os -import textwrap -import argparse - -import framework_scripts_path # pylint: disable=unused-import -from mbedtls_framework import build_tree - - -def remove_c_comments(string): - """ - Remove C style comments from input string - """ - string_pattern = r"(?P\".*?\"|\'.*?\')" - comment_pattern = r"(?P/\*.*?\*/|//[^\r\n]*$)" - pattern = re.compile(string_pattern + r'|' + comment_pattern, - re.MULTILINE | re.DOTALL) - - def replacer(match): - if match.lastgroup == 'comment': - return "" - return match.group() - return pattern.sub(replacer, string) - - -class CondDirectiveNotMatch(Exception): - pass - - -def preprocess_c_source_code(source, *classes): - """ - Simple preprocessor for C source code. - - Only processes condition directives without expanding them. - Yield object according to the classes input. Most match firstly - - If the directive pair does not match , raise CondDirectiveNotMatch. - - Assume source code does not include comments and compile pass. - - """ - - pattern = re.compile(r"^[ \t]*#[ \t]*" + - r"(?P(if[ \t]|ifndef[ \t]|ifdef[ \t]|else|endif))" + - r"[ \t]*(?P(.*\\\n)*.*$)", - re.MULTILINE) - stack = [] - - def _yield_objects(s, d, p, st, end): - """ - Output matched source piece - """ - nonlocal stack - start_line, end_line = '', '' - if stack: - start_line = '#{} {}'.format(d, p) - if d == 'if': - end_line = '#endif /* {} */'.format(p) - elif d == 'ifdef': - end_line = '#endif /* defined({}) */'.format(p) - else: - end_line = '#endif /* !defined({}) */'.format(p) - has_instance = False - for cls in classes: - for instance in cls.extract(s, st, end): - if has_instance is False: - has_instance = True - yield pair_start, start_line - yield instance.span()[0], instance - if has_instance: - yield start, end_line - - for match in pattern.finditer(source): - - directive = match.groupdict()['directive'].strip() - param = match.groupdict()['param'] - start, end = match.span() - - if directive in ('if', 'ifndef', 'ifdef'): - stack.append((directive, param, start, end)) - continue - - if not stack: - raise CondDirectiveNotMatch() - - pair_directive, pair_param, pair_start, pair_end = stack.pop() - yield from _yield_objects(source, - pair_directive, - pair_param, - pair_end, - start) - - if directive == 'endif': - continue - - if pair_directive == 'if': - directive = 'if' - param = "!( {} )".format(pair_param) - elif pair_directive == 'ifdef': - directive = 'ifndef' - param = pair_param - else: - directive = 'ifdef' - param = pair_param - - stack.append((directive, param, start, end)) - assert not stack, len(stack) - - -class EnumDefinition: - """ - Generate helper functions around enumeration. - - Currently, it generate translation function from enum value to string. - Enum definition looks like: - [typedef] enum [prefix name] { [body] } [suffix name]; - - Known limitation: - - the '}' and ';' SHOULD NOT exist in different macro blocks. Like - ``` - enum test { - .... - #if defined(A) - .... - }; - #else - .... - }; - #endif - ``` - """ - - @classmethod - def extract(cls, source_code, start=0, end=-1): - enum_pattern = re.compile(r'enum\s*(?P\w*)\s*' + - r'{\s*(?P[^}]*)}' + - r'\s*(?P\w*)\s*;', - re.MULTILINE | re.DOTALL) - - for match in enum_pattern.finditer(source_code, start, end): - yield EnumDefinition(source_code, - span=match.span(), - group=match.groupdict()) - - def __init__(self, source_code, span=None, group=None): - assert isinstance(group, dict) - prefix_name = group.get('prefix_name', None) - suffix_name = group.get('suffix_name', None) - body = group.get('body', None) - assert prefix_name or suffix_name - assert body - assert span - # If suffix_name exists, it is a typedef - self._prototype = suffix_name if suffix_name else 'enum ' + prefix_name - self._name = suffix_name if suffix_name else prefix_name - self._body = body - self._source = source_code - self._span = span - - def __repr__(self): - return 'Enum({},{})'.format(self._name, self._span) - - def __str__(self): - return repr(self) - - def span(self): - return self._span - - def generate_translation_function(self): - """ - Generate function for translating value to string - """ - translation_table = [] - - for line in self._body.splitlines(): - - if line.strip().startswith('#'): - # Preprocess directive, keep it in table - translation_table.append(line.strip()) - continue - - if not line.strip(): - continue - - for field in line.strip().split(','): - if not field.strip(): - continue - member = field.strip().split()[0] - translation_table.append( - '{space}case {member}:\n{space} return "{member}";' - .format(member=member, space=' '*8) - ) - - body = textwrap.dedent('''\ - const char *{name}_str( {prototype} in ) - {{ - switch (in) {{ - {translation_table} - default: - return "UNKNOWN_VALUE"; - }} - }} - ''') - body = body.format(translation_table='\n'.join(translation_table), - name=self._name, - prototype=self._prototype) - return body - - -class SignatureAlgorithmDefinition: - """ - Generate helper functions for signature algorithms. - - It generates translation function from signature algorithm define to string. - Signature algorithm definition looks like: - #define MBEDTLS_TLS1_3_SIG_[ upper case signature algorithm ] [ value(hex) ] - - Known limitation: - - the definitions SHOULD exist in same macro blocks. - """ - - @classmethod - def extract(cls, source_code, start=0, end=-1): - sig_alg_pattern = re.compile(r'#define\s+(?PMBEDTLS_TLS1_3_SIG_\w+)\s+' + - r'(?P0[xX][0-9a-fA-F]+)$', - re.MULTILINE | re.DOTALL) - matches = list(sig_alg_pattern.finditer(source_code, start, end)) - if matches: - yield SignatureAlgorithmDefinition(source_code, definitions=matches) - - def __init__(self, source_code, definitions=None): - if definitions is None: - definitions = [] - assert isinstance(definitions, list) and definitions - self._definitions = definitions - self._source = source_code - - def __repr__(self): - return 'SigAlgs({})'.format(self._definitions[0].span()) - - def span(self): - return self._definitions[0].span() - - def __str__(self): - """ - Generate function for translating value to string - """ - translation_table = [] - for m in self._definitions: - name = m.groupdict()['name'] - return_val = name[len('MBEDTLS_TLS1_3_SIG_'):].lower() - translation_table.append( - ' case {}:\n return "{}";'.format(name, return_val)) - - body = textwrap.dedent('''\ - const char *mbedtls_ssl_sig_alg_to_str( uint16_t in ) - {{ - switch( in ) - {{ - {translation_table} - }}; - - return "UNKNOWN"; - }}''') - body = body.format(translation_table='\n'.join(translation_table)) - return body - - -class NamedGroupDefinition: - """ - Generate helper functions for named group - - It generates translation function from named group define to string. - Named group definition looks like: - #define MBEDTLS_SSL_IANA_TLS_GROUP_[ upper case named group ] [ value(hex) ] - - Known limitation: - - the definitions SHOULD exist in same macro blocks. - """ - - @classmethod - def extract(cls, source_code, start=0, end=-1): - named_group_pattern = re.compile(r'#define\s+(?PMBEDTLS_SSL_IANA_TLS_GROUP_\w+)\s+' + - r'(?P0[xX][0-9a-fA-F]+)$', - re.MULTILINE | re.DOTALL) - matches = list(named_group_pattern.finditer(source_code, start, end)) - if matches: - yield NamedGroupDefinition(source_code, definitions=matches) - - def __init__(self, source_code, definitions=None): - if definitions is None: - definitions = [] - assert isinstance(definitions, list) and definitions - self._definitions = definitions - self._source = source_code - - def __repr__(self): - return 'NamedGroup({})'.format(self._definitions[0].span()) - - def span(self): - return self._definitions[0].span() - - def __str__(self): - """ - Generate function for translating value to string - """ - translation_table = [] - for m in self._definitions: - name = m.groupdict()['name'] - iana_name = name[len('MBEDTLS_SSL_IANA_TLS_GROUP_'):].lower() - translation_table.append(' case {}:\n return "{}";'.format(name, iana_name)) - - body = textwrap.dedent('''\ - const char *mbedtls_ssl_named_group_to_str( uint16_t in ) - {{ - switch( in ) - {{ - {translation_table} - }}; - - return "UNKNOWN"; - }}''') - body = body.format(translation_table='\n'.join(translation_table)) - return body - - -OUTPUT_C_TEMPLATE = '''\ -/* Automatically generated by generate_ssl_debug_helpers.py. DO NOT EDIT. */ - -/** - * \\file ssl_debug_helpers_generated.c - * - * \\brief Automatically generated helper functions for debugging - */ -/* - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - * - */ - -#include "common.h" - -#if defined(MBEDTLS_DEBUG_C) - -#include "ssl_debug_helpers.h" - -{functions} - -#endif /* MBEDTLS_DEBUG_C */ -/* End of automatically generated file. */ - -''' - - -def generate_ssl_debug_helpers(output_directory, mbedtls_root): - """ - Generate functions of debug helps - """ - mbedtls_root = os.path.abspath( - mbedtls_root or build_tree.guess_mbedtls_root()) - with open(os.path.join(mbedtls_root, 'include/mbedtls/ssl.h')) as f: - source_code = remove_c_comments(f.read()) - - definitions = dict() - for start, instance in preprocess_c_source_code(source_code, - EnumDefinition, - SignatureAlgorithmDefinition, - NamedGroupDefinition): - if start in definitions: - continue - if isinstance(instance, EnumDefinition): - definition = instance.generate_translation_function() - else: - definition = instance - definitions[start] = definition - - function_definitions = [str(v) for _, v in sorted(definitions.items())] - if output_directory == sys.stdout: - sys.stdout.write(OUTPUT_C_TEMPLATE.format( - functions='\n'.join(function_definitions))) - else: - with open(os.path.join(output_directory, 'ssl_debug_helpers_generated.c'), 'w') as f: - f.write(OUTPUT_C_TEMPLATE.format( - functions='\n'.join(function_definitions))) - - -def main(): - """ - Command line entry - """ - parser = argparse.ArgumentParser() - parser.add_argument('--mbedtls-root', nargs='?', default=None, - help='root directory of mbedtls source code') - parser.add_argument('output_directory', nargs='?', - default='library', help='source/header files location') - - args = parser.parse_args() - - generate_ssl_debug_helpers(args.output_directory, args.mbedtls_root) - return 0 - - -if __name__ == '__main__': - sys.exit(main()) diff --git a/scripts/make_generated_files.bat b/scripts/make_generated_files.bat index ba1a49783c..735cc7dc7d 100644 --- a/scripts/make_generated_files.bat +++ b/scripts/make_generated_files.bat @@ -13,7 +13,7 @@ python scripts\generate_driver_wrappers.py || exit /b 1 perl scripts\generate_errors.pl || exit /b 1 perl scripts\generate_query_config.pl || exit /b 1 perl scripts\generate_features.pl || exit /b 1 -python scripts\generate_ssl_debug_helpers.py || exit /b 1 +python framework\scripts\generate_ssl_debug_helpers.py || exit /b 1 @rem @@@@ Build @@@@ perl scripts\generate_visualc_files.pl || exit /b 1 @@ -29,4 +29,4 @@ python framework\scripts\generate_ecp_tests.py --directory tf-psa-crypto\tests\s python framework\scripts\generate_psa_tests.py --directory tf-psa-crypto\tests\suites || exit /b 1 python framework\scripts\generate_test_keys.py --output tests\src\test_keys.h || exit /b 1 python framework\scripts\generate_test_cert_macros.py --output tests\src\test_certs.h || exit /b 1 -python tests\scripts\generate_tls13_compat_tests.py || exit /b 1 +python framework\scripts\generate_tls13_compat_tests.py || exit /b 1 diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 5b6850376c..4e90bffb3a 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -71,9 +71,9 @@ if(GEN_FILES) ${CMAKE_CURRENT_SOURCE_DIR}/.. COMMAND "${MBEDTLS_PYTHON_EXECUTABLE}" - "${CMAKE_CURRENT_SOURCE_DIR}/scripts/generate_tls13_compat_tests.py" + "${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_tls13_compat_tests.py" DEPENDS - ${CMAKE_CURRENT_SOURCE_DIR}/scripts/generate_tls13_compat_tests.py + ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/generate_tls13_compat_tests.py ) add_custom_target(tls13-compat.sh DEPENDS ${CMAKE_CURRENT_SOURCE_DIR}/opt-testcases/tls13-compat.sh) diff --git a/tests/Makefile b/tests/Makefile index 66bb1cd130..c6d8e2ccc3 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -62,9 +62,9 @@ GENERATED_FILES += src/test_keys.h src/test_certs.h # Generated files needed to (fully) run ssl-opt.sh .PHONY: ssl-opt -opt-testcases/tls13-compat.sh: scripts/generate_tls13_compat_tests.py +opt-testcases/tls13-compat.sh: ../framework/scripts/generate_tls13_compat_tests.py echo " Gen $@" - $(PYTHON) scripts/generate_tls13_compat_tests.py -o $@ + $(PYTHON) ../framework/scripts/generate_tls13_compat_tests.py -o $@ GENERATED_FILES += opt-testcases/tls13-compat.sh ssl-opt: opt-testcases/tls13-compat.sh diff --git a/tests/compat.sh b/tests/compat.sh index 52f75e0de3..22da5ee4ed 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -290,7 +290,7 @@ reset_ciphersuites() # list of entries of the form "STANDARD_NAME=PROGRAM_NAME". translate_ciphers() { - ciphers=$(scripts/translate_ciphers.py "$@") + ciphers=$(../framework/scripts/translate_ciphers.py "$@") if [ $? -ne 0 ]; then echo "translate_ciphers.py failed with exit code $1" >&2 echo "$2" >&2 diff --git a/tests/configs/user-config-for-test.h b/tests/configs/user-config-for-test.h index f40f83895f..e543297e59 100644 --- a/tests/configs/user-config-for-test.h +++ b/tests/configs/user-config-for-test.h @@ -10,108 +10,6 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ -#if defined(PSA_CRYPTO_DRIVER_TEST_ALL) -/* PSA_CRYPTO_DRIVER_TEST_ALL activates test drivers while keeping the - * built-in implementations active. Normally setting MBEDTLS_PSA_ACCEL_xxx - * would disable MBEDTLS_PSA_BUILTIN_xxx unless fallback is activated, but - * here we arrange to have both active so that psa_crypto_*.c includes - * the built-in implementations and the driver code can call the built-in - * implementations. - * - * The point of this test mode is to verify that the - * driver entry points are called when they should be in a lightweight - * way, without requiring an actual driver. This is different from builds - * with libtestdriver1, where we make a copy of the library source code - * and use that as an external driver. - */ - -/* Enable the use of the test driver in the library, and build the generic - * part of the test driver. */ -#define PSA_CRYPTO_DRIVER_TEST - -/* With MBEDTLS_PSA_CRYPTO_CONFIG, if we set up the acceleration, the - * built-in implementations won't be enabled. */ -#if defined(MBEDTLS_PSA_CRYPTO_CONFIG) -#error \ - "PSA_CRYPTO_DRIVER_TEST_ALL sets up a nonstandard configuration that is incompatible with MBEDTLS_PSA_CRYPTO_CONFIG" -#endif - -/* Use the accelerator driver for all cryptographic mechanisms for which - * the test driver is implemented. This is copied from psa/crypto_config.h - * with the parts not implemented by the test driver commented out. */ -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DERIVE -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_PASSWORD -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_PASSWORD_HASH -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_HMAC -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_AES -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20 -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DES -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE -//#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RAW_DATA -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY - -#define MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING -#define MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7 -#define MBEDTLS_PSA_ACCEL_ALG_CCM -#define MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG -#define MBEDTLS_PSA_ACCEL_ALG_CMAC -#define MBEDTLS_PSA_ACCEL_ALG_CFB -#define MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 -#define MBEDTLS_PSA_ACCEL_ALG_CTR -#define MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA -#define MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING -#define MBEDTLS_PSA_ACCEL_ALG_ECDH -#define MBEDTLS_PSA_ACCEL_ALG_FFDH -#define MBEDTLS_PSA_ACCEL_ALG_ECDSA -#define MBEDTLS_PSA_ACCEL_ALG_JPAKE -#define MBEDTLS_PSA_ACCEL_ALG_GCM -//#define MBEDTLS_PSA_ACCEL_ALG_HKDF -//#define MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT -//#define MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND -#define MBEDTLS_PSA_ACCEL_ALG_HMAC -#define MBEDTLS_PSA_ACCEL_ALG_MD5 -#define MBEDTLS_PSA_ACCEL_ALG_OFB -//#define MBEDTLS_PSA_ACCEL_ALG_PBKDF2_HMAC -//#define MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128 -#define MBEDTLS_PSA_ACCEL_ALG_RIPEMD160 -#define MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP -#define MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT -#define MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN -#define MBEDTLS_PSA_ACCEL_ALG_RSA_PSS -#define MBEDTLS_PSA_ACCEL_ALG_SHA_1 -#define MBEDTLS_PSA_ACCEL_ALG_SHA_224 -#define MBEDTLS_PSA_ACCEL_ALG_SHA_256 -#define MBEDTLS_PSA_ACCEL_ALG_SHA_384 -#define MBEDTLS_PSA_ACCEL_ALG_SHA_512 -#define MBEDTLS_PSA_ACCEL_ALG_SHA3_224 -#define MBEDTLS_PSA_ACCEL_ALG_SHA3_256 -#define MBEDTLS_PSA_ACCEL_ALG_SHA3_384 -#define MBEDTLS_PSA_ACCEL_ALG_SHA3_512 -#define MBEDTLS_PSA_ACCEL_ALG_STREAM_CIPHER -//#define MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF -//#define MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS -//#define MBEDTLS_PSA_ACCEL_ALG_TLS12_ECJPAKE_TO_PMS - -#endif /* PSA_CRYPTO_DRIVER_TEST_ALL */ - - - #if defined(MBEDTLS_PSA_INJECT_ENTROPY) /* The #MBEDTLS_PSA_INJECT_ENTROPY feature requires two extra platform * functions, which must be configured as #MBEDTLS_PLATFORM_NV_SEED_READ_MACRO diff --git a/tests/scripts/check-generated-files.sh b/tests/scripts/check-generated-files.sh index 2a112075fa..583c26e8de 100755 --- a/tests/scripts/check-generated-files.sh +++ b/tests/scripts/check-generated-files.sh @@ -173,8 +173,8 @@ if in_mbedtls_repo; then check scripts/generate_errors.pl ${builtin_drivers_dir}/error.c check scripts/generate_query_config.pl programs/test/query_config.c check scripts/generate_features.pl library/version_features.c - check scripts/generate_ssl_debug_helpers.py library/ssl_debug_helpers_generated.c - check tests/scripts/generate_tls13_compat_tests.py tests/opt-testcases/tls13-compat.sh + check framework/scripts/generate_ssl_debug_helpers.py library/ssl_debug_helpers_generated.c + check framework/scripts/generate_tls13_compat_tests.py tests/opt-testcases/tls13-compat.sh check framework/scripts/generate_test_cert_macros.py tests/src/test_certs.h # generate_visualc_files enumerates source files (library/*.c). It doesn't # care about their content, but the files must exist. So it must run after diff --git a/tests/scripts/check_files.py b/tests/scripts/check_files.py index e9372028a0..87326e8723 100755 --- a/tests/scripts/check_files.py +++ b/tests/scripts/check_files.py @@ -446,6 +446,25 @@ class LicenseIssueTracker(LineIssueTracker): return False +class ErrorAddIssueTracker(LineIssueTracker): + """Signal direct additions of error codes. + + Adding a low-level error code with a high-level error code is deprecated + and should use MBEDTLS_ERROR_ADD. + """ + + heading = "Direct addition of error codes" + + _ERR_PLUS_RE = re.compile(br'MBEDTLS_ERR_\w+ *\+|' + br'\+ *MBEDTLS_ERR_') + _EXCLUDE_RE = re.compile(br' *case ') + + def issue_with_line(self, line, filepath, line_number): + if self._ERR_PLUS_RE.search(line) and not self._EXCLUDE_RE.match(line): + return True + return False + + class IntegrityChecker: """Sanity-check files under the current directory.""" @@ -467,6 +486,7 @@ class IntegrityChecker: TabIssueTracker(), MergeArtifactIssueTracker(), LicenseIssueTracker(), + ErrorAddIssueTracker(), ] def setup_logger(self, log_file, level=logging.INFO): diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh index 86951f74ba..5ecd02954c 100644 --- a/tests/scripts/components-basic-checks.sh +++ b/tests/scripts/components-basic-checks.sh @@ -160,6 +160,6 @@ component_check_test_helpers () { ./framework/scripts/test_generate_test_code.py 2>&1 msg "unit test: translate_ciphers.py" - python3 -m unittest tests/scripts/translate_ciphers.py 2>&1 + python3 -m unittest framework/scripts/translate_ciphers.py 2>&1 } diff --git a/tests/scripts/components-configuration-crypto.sh b/tests/scripts/components-configuration-crypto.sh index 74ebb793d7..de8ab2d0ce 100644 --- a/tests/scripts/components-configuration-crypto.sh +++ b/tests/scripts/components-configuration-crypto.sh @@ -2671,12 +2671,19 @@ component_test_full_static_keystore () { } component_test_psa_crypto_drivers () { + # Test dispatch to drivers and fallbacks with + # test_suite_psa_crypto_driver_wrappers test suite. The test drivers that + # are wrappers around the builtin drivers are activated by + # PSA_CRYPTO_DRIVER_TEST. + # + # For the time being, some test cases in test_suite_block_cipher and + # test_suite_md.psa rely on this component to be run at least once by the + # CI. This should disappear as we progress the 4.x work. See + # config_adjust_test_accelerators.h for more information. msg "build: full + test drivers dispatching to builtins" scripts/config.py full - scripts/config.py unset MBEDTLS_PSA_CRYPTO_CONFIG - loc_cflags="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST_ALL" - loc_cflags="${loc_cflags} '-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'" - loc_cflags="${loc_cflags} -I../tests/include -O2" + loc_cflags="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_CONFIG_ADJUST_TEST_ACCELERATORS" + loc_cflags="${loc_cflags} -I../tests/include" make CC=$ASAN_CC CFLAGS="${loc_cflags}" LDFLAGS="$ASAN_CFLAGS" diff --git a/tests/scripts/generate_tls13_compat_tests.py b/tests/scripts/generate_tls13_compat_tests.py deleted file mode 100755 index b9dcff4e10..0000000000 --- a/tests/scripts/generate_tls13_compat_tests.py +++ /dev/null @@ -1,649 +0,0 @@ -#!/usr/bin/env python3 - -# generate_tls13_compat_tests.py -# -# Copyright The Mbed TLS Contributors -# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - -""" -Generate TLSv1.3 Compat test cases - -""" - -import sys -import os -import argparse -import itertools -from collections import namedtuple - -# define certificates configuration entry -Certificate = namedtuple("Certificate", ['cafile', 'certfile', 'keyfile']) -# define the certificate parameters for signature algorithms -CERTIFICATES = { - 'ecdsa_secp256r1_sha256': Certificate('$DATA_FILES_PATH/test-ca2.crt', - '$DATA_FILES_PATH/ecdsa_secp256r1.crt', - '$DATA_FILES_PATH/ecdsa_secp256r1.key'), - 'ecdsa_secp384r1_sha384': Certificate('$DATA_FILES_PATH/test-ca2.crt', - '$DATA_FILES_PATH/ecdsa_secp384r1.crt', - '$DATA_FILES_PATH/ecdsa_secp384r1.key'), - 'ecdsa_secp521r1_sha512': Certificate('$DATA_FILES_PATH/test-ca2.crt', - '$DATA_FILES_PATH/ecdsa_secp521r1.crt', - '$DATA_FILES_PATH/ecdsa_secp521r1.key'), - 'rsa_pss_rsae_sha256': Certificate('$DATA_FILES_PATH/test-ca_cat12.crt', - '$DATA_FILES_PATH/server2-sha256.crt', - '$DATA_FILES_PATH/server2.key') -} - -CIPHER_SUITE_IANA_VALUE = { - "TLS_AES_128_GCM_SHA256": 0x1301, - "TLS_AES_256_GCM_SHA384": 0x1302, - "TLS_CHACHA20_POLY1305_SHA256": 0x1303, - "TLS_AES_128_CCM_SHA256": 0x1304, - "TLS_AES_128_CCM_8_SHA256": 0x1305 -} - -SIG_ALG_IANA_VALUE = { - "ecdsa_secp256r1_sha256": 0x0403, - "ecdsa_secp384r1_sha384": 0x0503, - "ecdsa_secp521r1_sha512": 0x0603, - 'rsa_pss_rsae_sha256': 0x0804, -} - -NAMED_GROUP_IANA_VALUE = { - 'secp256r1': 0x17, - 'secp384r1': 0x18, - 'secp521r1': 0x19, - 'x25519': 0x1d, - 'x448': 0x1e, - # Only one finite field group to keep testing time within reasonable bounds. - 'ffdhe2048': 0x100, -} - -class TLSProgram: - """ - Base class for generate server/client command. - """ - - # pylint: disable=too-many-arguments - def __init__(self, ciphersuite=None, signature_algorithm=None, named_group=None, - cert_sig_alg=None): - self._ciphers = [] - self._sig_algs = [] - self._named_groups = [] - self._cert_sig_algs = [] - if ciphersuite: - self.add_ciphersuites(ciphersuite) - if named_group: - self.add_named_groups(named_group) - if signature_algorithm: - self.add_signature_algorithms(signature_algorithm) - if cert_sig_alg: - self.add_cert_signature_algorithms(cert_sig_alg) - - # add_ciphersuites should not override by sub class - def add_ciphersuites(self, *ciphersuites): - self._ciphers.extend( - [cipher for cipher in ciphersuites if cipher not in self._ciphers]) - - # add_signature_algorithms should not override by sub class - def add_signature_algorithms(self, *signature_algorithms): - self._sig_algs.extend( - [sig_alg for sig_alg in signature_algorithms if sig_alg not in self._sig_algs]) - - # add_named_groups should not override by sub class - def add_named_groups(self, *named_groups): - self._named_groups.extend( - [named_group for named_group in named_groups if named_group not in self._named_groups]) - - # add_cert_signature_algorithms should not override by sub class - def add_cert_signature_algorithms(self, *signature_algorithms): - self._cert_sig_algs.extend( - [sig_alg for sig_alg in signature_algorithms if sig_alg not in self._cert_sig_algs]) - - # pylint: disable=no-self-use - def pre_checks(self): - return [] - - # pylint: disable=no-self-use - def cmd(self): - if not self._cert_sig_algs: - self._cert_sig_algs = list(CERTIFICATES.keys()) - return self.pre_cmd() - - # pylint: disable=no-self-use - def post_checks(self): - return [] - - # pylint: disable=no-self-use - def pre_cmd(self): - return ['false'] - - # pylint: disable=unused-argument,no-self-use - def hrr_post_checks(self, named_group): - return [] - - -class OpenSSLBase(TLSProgram): - """ - Generate base test commands for OpenSSL. - """ - - NAMED_GROUP = { - 'secp256r1': 'P-256', - 'secp384r1': 'P-384', - 'secp521r1': 'P-521', - 'x25519': 'X25519', - 'x448': 'X448', - 'ffdhe2048': 'ffdhe2048', - } - - def cmd(self): - ret = super().cmd() - - if self._ciphers: - ciphersuites = ':'.join(self._ciphers) - ret += ["-ciphersuites {ciphersuites}".format(ciphersuites=ciphersuites)] - - if self._sig_algs: - signature_algorithms = set(self._sig_algs + self._cert_sig_algs) - signature_algorithms = ':'.join(signature_algorithms) - ret += ["-sigalgs {signature_algorithms}".format( - signature_algorithms=signature_algorithms)] - - if self._named_groups: - named_groups = ':'.join( - map(lambda named_group: self.NAMED_GROUP[named_group], self._named_groups)) - ret += ["-groups {named_groups}".format(named_groups=named_groups)] - - ret += ['-msg -tls1_3'] - - return ret - - def pre_checks(self): - ret = ["requires_openssl_tls1_3"] - - # ffdh groups require at least openssl 3.0 - ffdh_groups = ['ffdhe2048'] - - if any(x in ffdh_groups for x in self._named_groups): - ret = ["requires_openssl_tls1_3_with_ffdh"] - - return ret - - -class OpenSSLServ(OpenSSLBase): - """ - Generate test commands for OpenSSL server. - """ - - def cmd(self): - ret = super().cmd() - ret += ['-num_tickets 0 -no_resume_ephemeral -no_cache'] - return ret - - def post_checks(self): - return ['-c "HTTP/1.0 200 ok"'] - - def pre_cmd(self): - ret = ['$O_NEXT_SRV_NO_CERT'] - for _, cert, key in map(lambda sig_alg: CERTIFICATES[sig_alg], self._cert_sig_algs): - ret += ['-cert {cert} -key {key}'.format(cert=cert, key=key)] - return ret - - -class OpenSSLCli(OpenSSLBase): - """ - Generate test commands for OpenSSL client. - """ - - def pre_cmd(self): - return ['$O_NEXT_CLI_NO_CERT', - '-CAfile {cafile}'.format(cafile=CERTIFICATES[self._cert_sig_algs[0]].cafile)] - - -class GnuTLSBase(TLSProgram): - """ - Generate base test commands for GnuTLS. - """ - - CIPHER_SUITE = { - 'TLS_AES_256_GCM_SHA384': [ - 'AES-256-GCM', - 'SHA384', - 'AEAD'], - 'TLS_AES_128_GCM_SHA256': [ - 'AES-128-GCM', - 'SHA256', - 'AEAD'], - 'TLS_CHACHA20_POLY1305_SHA256': [ - 'CHACHA20-POLY1305', - 'SHA256', - 'AEAD'], - 'TLS_AES_128_CCM_SHA256': [ - 'AES-128-CCM', - 'SHA256', - 'AEAD'], - 'TLS_AES_128_CCM_8_SHA256': [ - 'AES-128-CCM-8', - 'SHA256', - 'AEAD']} - - SIGNATURE_ALGORITHM = { - 'ecdsa_secp256r1_sha256': ['SIGN-ECDSA-SECP256R1-SHA256'], - 'ecdsa_secp521r1_sha512': ['SIGN-ECDSA-SECP521R1-SHA512'], - 'ecdsa_secp384r1_sha384': ['SIGN-ECDSA-SECP384R1-SHA384'], - 'rsa_pss_rsae_sha256': ['SIGN-RSA-PSS-RSAE-SHA256']} - - NAMED_GROUP = { - 'secp256r1': ['GROUP-SECP256R1'], - 'secp384r1': ['GROUP-SECP384R1'], - 'secp521r1': ['GROUP-SECP521R1'], - 'x25519': ['GROUP-X25519'], - 'x448': ['GROUP-X448'], - 'ffdhe2048': ['GROUP-FFDHE2048'], - } - - def pre_checks(self): - return ["requires_gnutls_tls1_3", - "requires_gnutls_next_no_ticket"] - - def cmd(self): - ret = super().cmd() - - priority_string_list = [] - - def update_priority_string_list(items, map_table): - for item in items: - for i in map_table[item]: - if i not in priority_string_list: - yield i - - if self._ciphers: - priority_string_list.extend(update_priority_string_list( - self._ciphers, self.CIPHER_SUITE)) - else: - priority_string_list.extend(['CIPHER-ALL', 'MAC-ALL']) - - if self._sig_algs: - signature_algorithms = set(self._sig_algs + self._cert_sig_algs) - priority_string_list.extend(update_priority_string_list( - signature_algorithms, self.SIGNATURE_ALGORITHM)) - else: - priority_string_list.append('SIGN-ALL') - - - if self._named_groups: - priority_string_list.extend(update_priority_string_list( - self._named_groups, self.NAMED_GROUP)) - else: - priority_string_list.append('GROUP-ALL') - - priority_string_list = ['NONE'] + \ - priority_string_list + ['VERS-TLS1.3'] - - priority_string = ':+'.join(priority_string_list) - priority_string += ':%NO_TICKETS' - - ret += ['--priority={priority_string}'.format( - priority_string=priority_string)] - return ret - -class GnuTLSServ(GnuTLSBase): - """ - Generate test commands for GnuTLS server. - """ - - def pre_cmd(self): - ret = ['$G_NEXT_SRV_NO_CERT', '--http', '--disable-client-cert', '--debug=4'] - - for _, cert, key in map(lambda sig_alg: CERTIFICATES[sig_alg], self._cert_sig_algs): - ret += ['--x509certfile {cert} --x509keyfile {key}'.format( - cert=cert, key=key)] - return ret - - def post_checks(self): - return ['-c "HTTP/1.0 200 OK"'] - - -class GnuTLSCli(GnuTLSBase): - """ - Generate test commands for GnuTLS client. - """ - - def pre_cmd(self): - return ['$G_NEXT_CLI_NO_CERT', '--debug=4', '--single-key-share', - '--x509cafile {cafile}'.format(cafile=CERTIFICATES[self._cert_sig_algs[0]].cafile)] - - -class MbedTLSBase(TLSProgram): - """ - Generate base test commands for mbedTLS. - """ - - CIPHER_SUITE = { - 'TLS_AES_256_GCM_SHA384': 'TLS1-3-AES-256-GCM-SHA384', - 'TLS_AES_128_GCM_SHA256': 'TLS1-3-AES-128-GCM-SHA256', - 'TLS_CHACHA20_POLY1305_SHA256': 'TLS1-3-CHACHA20-POLY1305-SHA256', - 'TLS_AES_128_CCM_SHA256': 'TLS1-3-AES-128-CCM-SHA256', - 'TLS_AES_128_CCM_8_SHA256': 'TLS1-3-AES-128-CCM-8-SHA256'} - - def cmd(self): - ret = super().cmd() - ret += ['debug_level=4'] - - - if self._ciphers: - ciphers = ','.join( - map(lambda cipher: self.CIPHER_SUITE[cipher], self._ciphers)) - ret += ["force_ciphersuite={ciphers}".format(ciphers=ciphers)] - - if self._sig_algs + self._cert_sig_algs: - ret += ['sig_algs={sig_algs}'.format( - sig_algs=','.join(set(self._sig_algs + self._cert_sig_algs)))] - - if self._named_groups: - named_groups = ','.join(self._named_groups) - ret += ["groups={named_groups}".format(named_groups=named_groups)] - return ret - - #pylint: disable=missing-function-docstring - def add_ffdh_group_requirements(self, requirement_list): - if 'ffdhe2048' in self._named_groups: - requirement_list.append('requires_config_enabled PSA_WANT_DH_RFC7919_2048') - if 'ffdhe3072' in self._named_groups: - requirement_list.append('requires_config_enabled PSA_WANT_DH_RFC7919_2048') - if 'ffdhe4096' in self._named_groups: - requirement_list.append('requires_config_enabled PSA_WANT_DH_RFC7919_2048') - if 'ffdhe6144' in self._named_groups: - requirement_list.append('requires_config_enabled PSA_WANT_DH_RFC7919_2048') - if 'ffdhe8192' in self._named_groups: - requirement_list.append('requires_config_enabled PSA_WANT_DH_RFC7919_2048') - - def pre_checks(self): - ret = ['requires_config_enabled MBEDTLS_DEBUG_C', - 'requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED'] - - if 'rsa_pss_rsae_sha256' in self._sig_algs + self._cert_sig_algs: - ret.append( - 'requires_config_enabled MBEDTLS_X509_RSASSA_PSS_SUPPORT') - - ec_groups = ['secp256r1', 'secp384r1', 'secp521r1', 'x25519', 'x448'] - ffdh_groups = ['ffdhe2048', 'ffdhe3072', 'ffdhe4096', 'ffdhe6144', 'ffdhe8192'] - - if any(x in ec_groups for x in self._named_groups): - ret.append('requires_config_enabled PSA_WANT_ALG_ECDH') - - if any(x in ffdh_groups for x in self._named_groups): - ret.append('requires_config_enabled PSA_WANT_ALG_FFDH') - self.add_ffdh_group_requirements(ret) - - return ret - - -class MbedTLSServ(MbedTLSBase): - """ - Generate test commands for mbedTLS server. - """ - - def cmd(self): - ret = super().cmd() - ret += ['tls13_kex_modes=ephemeral cookies=0 tickets=0'] - return ret - - def pre_checks(self): - return ['requires_config_enabled MBEDTLS_SSL_SRV_C'] + super().pre_checks() - - def post_checks(self): - check_strings = ["Protocol is TLSv1.3"] - if self._ciphers: - check_strings.append( - "server hello, chosen ciphersuite: {} ( id={:04d} )".format( - self.CIPHER_SUITE[self._ciphers[0]], - CIPHER_SUITE_IANA_VALUE[self._ciphers[0]])) - if self._sig_algs: - check_strings.append( - "received signature algorithm: 0x{:x}".format( - SIG_ALG_IANA_VALUE[self._sig_algs[0]])) - - for named_group in self._named_groups: - check_strings += ['got named group: {named_group}({iana_value:04x})'.format( - named_group=named_group, - iana_value=NAMED_GROUP_IANA_VALUE[named_group])] - - check_strings.append("Certificate verification was skipped") - return ['-s "{}"'.format(i) for i in check_strings] - - def pre_cmd(self): - ret = ['$P_SRV'] - for _, cert, key in map(lambda sig_alg: CERTIFICATES[sig_alg], self._cert_sig_algs): - ret += ['crt_file={cert} key_file={key}'.format(cert=cert, key=key)] - return ret - - def hrr_post_checks(self, named_group): - return ['-s "HRR selected_group: {:s}"'.format(named_group)] - - -class MbedTLSCli(MbedTLSBase): - """ - Generate test commands for mbedTLS client. - """ - - def pre_cmd(self): - return ['$P_CLI', - 'ca_file={cafile}'.format(cafile=CERTIFICATES[self._cert_sig_algs[0]].cafile)] - - def pre_checks(self): - return ['requires_config_enabled MBEDTLS_SSL_CLI_C'] + super().pre_checks() - - def hrr_post_checks(self, named_group): - ret = ['-c "received HelloRetryRequest message"'] - ret += ['-c "selected_group ( {:d} )"'.format(NAMED_GROUP_IANA_VALUE[named_group])] - return ret - - def post_checks(self): - check_strings = ["Protocol is TLSv1.3"] - if self._ciphers: - check_strings.append( - "server hello, chosen ciphersuite: ( {:04x} ) - {}".format( - CIPHER_SUITE_IANA_VALUE[self._ciphers[0]], - self.CIPHER_SUITE[self._ciphers[0]])) - if self._sig_algs: - check_strings.append( - "Certificate Verify: Signature algorithm ( {:04x} )".format( - SIG_ALG_IANA_VALUE[self._sig_algs[0]])) - - for named_group in self._named_groups: - check_strings += ['NamedGroup: {named_group} ( {iana_value:x} )'.format( - named_group=named_group, - iana_value=NAMED_GROUP_IANA_VALUE[named_group])] - - check_strings.append("Verifying peer X.509 certificate... ok") - return ['-c "{}"'.format(i) for i in check_strings] - - -SERVER_CLASSES = {'OpenSSL': OpenSSLServ, 'GnuTLS': GnuTLSServ, 'mbedTLS': MbedTLSServ} -CLIENT_CLASSES = {'OpenSSL': OpenSSLCli, 'GnuTLS': GnuTLSCli, 'mbedTLS': MbedTLSCli} - - -def generate_compat_test(client=None, server=None, cipher=None, named_group=None, sig_alg=None): - """ - Generate test case with `ssl-opt.sh` format. - """ - name = 'TLS 1.3 {client[0]}->{server[0]}: {cipher},{named_group},{sig_alg}'.format( - client=client, server=server, cipher=cipher[4:], sig_alg=sig_alg, named_group=named_group) - - server_object = SERVER_CLASSES[server](ciphersuite=cipher, - named_group=named_group, - signature_algorithm=sig_alg, - cert_sig_alg=sig_alg) - client_object = CLIENT_CLASSES[client](ciphersuite=cipher, - named_group=named_group, - signature_algorithm=sig_alg, - cert_sig_alg=sig_alg) - - cmd = ['run_test "{}"'.format(name), - '"{}"'.format(' '.join(server_object.cmd())), - '"{}"'.format(' '.join(client_object.cmd())), - '0'] - cmd += server_object.post_checks() - cmd += client_object.post_checks() - cmd += ['-C "received HelloRetryRequest message"'] - prefix = ' \\\n' + (' '*9) - cmd = prefix.join(cmd) - return '\n'.join(server_object.pre_checks() + client_object.pre_checks() + [cmd]) - - -def generate_hrr_compat_test(client=None, server=None, - client_named_group=None, server_named_group=None, - cert_sig_alg=None): - """ - Generate Hello Retry Request test case with `ssl-opt.sh` format. - """ - name = 'TLS 1.3 {client[0]}->{server[0]}: HRR {c_named_group} -> {s_named_group}'.format( - client=client, server=server, c_named_group=client_named_group, - s_named_group=server_named_group) - server_object = SERVER_CLASSES[server](named_group=server_named_group, - cert_sig_alg=cert_sig_alg) - - client_object = CLIENT_CLASSES[client](named_group=client_named_group, - cert_sig_alg=cert_sig_alg) - client_object.add_named_groups(server_named_group) - - cmd = ['run_test "{}"'.format(name), - '"{}"'.format(' '.join(server_object.cmd())), - '"{}"'.format(' '.join(client_object.cmd())), - '0'] - cmd += server_object.post_checks() - cmd += client_object.post_checks() - cmd += server_object.hrr_post_checks(server_named_group) - cmd += client_object.hrr_post_checks(server_named_group) - prefix = ' \\\n' + (' '*9) - cmd = prefix.join(cmd) - return '\n'.join(server_object.pre_checks() + - client_object.pre_checks() + - [cmd]) - -SSL_OUTPUT_HEADER = '''\ -# TLS 1.3 interoperability test cases (equivalent of compat.sh for TLS 1.3). -# -# Automatically generated by {cmd}. Do not edit! - -# Copyright The Mbed TLS Contributors -# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later -''' -DATA_FILES_PATH_VAR = ''' -DATA_FILES_PATH=../framework/data_files -''' - -def main(): - """ - Main function of this program - """ - parser = argparse.ArgumentParser() - - parser.add_argument('-o', '--output', - default='tests/opt-testcases/tls13-compat.sh', - help='Output file path (not used with -1)') - - parser.add_argument('-1', '--single', action='store_true', - help='Print a single test case') - # Single mode used to be the default. - parser.add_argument('-a', '--generate-all-tls13-compat-tests', - action='store_false', dest='single', - help='Generate all test cases (negates -1) (default)') - - parser.add_argument('--list-ciphers', action='store_true', - default=False, help='List supported ciphersuites') - - parser.add_argument('--list-sig-algs', action='store_true', - default=False, help='List supported signature algorithms') - - parser.add_argument('--list-named-groups', action='store_true', - default=False, help='List supported named groups') - - parser.add_argument('--list-servers', action='store_true', - default=False, help='List supported TLS servers') - - parser.add_argument('--list-clients', action='store_true', - default=False, help='List supported TLS Clients') - - parser.add_argument('server', choices=SERVER_CLASSES.keys(), nargs='?', - default=list(SERVER_CLASSES.keys())[0], - help='Choose TLS server program for test') - parser.add_argument('client', choices=CLIENT_CLASSES.keys(), nargs='?', - default=list(CLIENT_CLASSES.keys())[0], - help='Choose TLS client program for test') - parser.add_argument('cipher', choices=CIPHER_SUITE_IANA_VALUE.keys(), nargs='?', - default=list(CIPHER_SUITE_IANA_VALUE.keys())[0], - help='Choose cipher suite for test') - parser.add_argument('sig_alg', choices=SIG_ALG_IANA_VALUE.keys(), nargs='?', - default=list(SIG_ALG_IANA_VALUE.keys())[0], - help='Choose cipher suite for test') - parser.add_argument('named_group', choices=NAMED_GROUP_IANA_VALUE.keys(), nargs='?', - default=list(NAMED_GROUP_IANA_VALUE.keys())[0], - help='Choose cipher suite for test') - - args = parser.parse_args() - - def get_all_test_cases(): - # Generate normal compat test cases - for client, server, cipher, named_group, sig_alg in \ - itertools.product(CLIENT_CLASSES.keys(), - SERVER_CLASSES.keys(), - CIPHER_SUITE_IANA_VALUE.keys(), - NAMED_GROUP_IANA_VALUE.keys(), - SIG_ALG_IANA_VALUE.keys()): - if server == 'mbedTLS' or client == 'mbedTLS': - yield generate_compat_test(client=client, server=server, - cipher=cipher, named_group=named_group, - sig_alg=sig_alg) - - - # Generate Hello Retry Request compat test cases - for client, server, client_named_group, server_named_group in \ - itertools.product(CLIENT_CLASSES.keys(), - SERVER_CLASSES.keys(), - NAMED_GROUP_IANA_VALUE.keys(), - NAMED_GROUP_IANA_VALUE.keys()): - - if (client == 'mbedTLS' or server == 'mbedTLS') and \ - client_named_group != server_named_group: - yield generate_hrr_compat_test(client=client, server=server, - client_named_group=client_named_group, - server_named_group=server_named_group, - cert_sig_alg="ecdsa_secp256r1_sha256") - - if not args.single: - if args.output: - with open(args.output, 'w', encoding="utf-8") as f: - f.write(SSL_OUTPUT_HEADER.format( - filename=os.path.basename(args.output), - cmd=os.path.basename(sys.argv[0]))) - f.write(DATA_FILES_PATH_VAR) - f.write('\n\n'.join(get_all_test_cases())) - f.write('\n') - else: - print('\n\n'.join(get_all_test_cases())) - return 0 - - if args.list_ciphers or args.list_sig_algs or args.list_named_groups \ - or args.list_servers or args.list_clients: - if args.list_ciphers: - print(*CIPHER_SUITE_IANA_VALUE.keys()) - if args.list_sig_algs: - print(*SIG_ALG_IANA_VALUE.keys()) - if args.list_named_groups: - print(*NAMED_GROUP_IANA_VALUE.keys()) - if args.list_servers: - print(*SERVER_CLASSES.keys()) - if args.list_clients: - print(*CLIENT_CLASSES.keys()) - return 0 - - print(generate_compat_test(server=args.server, client=args.client, sig_alg=args.sig_alg, - cipher=args.cipher, named_group=args.named_group)) - return 0 - - -if __name__ == "__main__": - sys.exit(main()) diff --git a/tests/scripts/translate_ciphers.py b/tests/scripts/translate_ciphers.py deleted file mode 100755 index 90514fca15..0000000000 --- a/tests/scripts/translate_ciphers.py +++ /dev/null @@ -1,180 +0,0 @@ -#!/usr/bin/env python3 - -# translate_ciphers.py -# -# Copyright The Mbed TLS Contributors -# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - -""" -Translate standard ciphersuite names to GnuTLS, OpenSSL and Mbed TLS standards. - -To test the translation functions run: -python3 -m unittest translate_cipher.py -""" - -import re -import argparse -import unittest - -class TestTranslateCiphers(unittest.TestCase): - """ - Ensure translate_ciphers.py translates and formats ciphersuite names - correctly - """ - def test_translate_all_cipher_names(self): - """ - Translate standard ciphersuite names to GnuTLS, OpenSSL and - Mbed TLS counterpart. Use only a small subset of ciphers - that exercise each step of the translation functions - """ - ciphers = [ - ("TLS_ECDHE_ECDSA_WITH_NULL_SHA", - "+ECDHE-ECDSA:+NULL:+SHA1", - "ECDHE-ECDSA-NULL-SHA", - "TLS-ECDHE-ECDSA-WITH-NULL-SHA"), - ("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", - "+ECDHE-ECDSA:+AES-128-GCM:+AEAD", - "ECDHE-ECDSA-AES128-GCM-SHA256", - "TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256"), - ("TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA", - "+DHE-RSA:+3DES-CBC:+SHA1", - "EDH-RSA-DES-CBC3-SHA", - "TLS-DHE-RSA-WITH-3DES-EDE-CBC-SHA"), - ("TLS_RSA_WITH_AES_256_CBC_SHA", - "+RSA:+AES-256-CBC:+SHA1", - "AES256-SHA", - "TLS-RSA-WITH-AES-256-CBC-SHA"), - ("TLS_PSK_WITH_3DES_EDE_CBC_SHA", - "+PSK:+3DES-CBC:+SHA1", - "PSK-3DES-EDE-CBC-SHA", - "TLS-PSK-WITH-3DES-EDE-CBC-SHA"), - ("TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", - None, - "ECDHE-ECDSA-CHACHA20-POLY1305", - "TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256"), - ("TLS_ECDHE_ECDSA_WITH_AES_128_CCM", - "+ECDHE-ECDSA:+AES-128-CCM:+AEAD", - None, - "TLS-ECDHE-ECDSA-WITH-AES-128-CCM"), - ("TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", - None, - "ECDHE-ARIA256-GCM-SHA384", - "TLS-ECDHE-RSA-WITH-ARIA-256-GCM-SHA384"), - ] - - for s, g_exp, o_exp, m_exp in ciphers: - - if g_exp is not None: - g = translate_gnutls(s) - self.assertEqual(g, g_exp) - - if o_exp is not None: - o = translate_ossl(s) - self.assertEqual(o, o_exp) - - if m_exp is not None: - m = translate_mbedtls(s) - self.assertEqual(m, m_exp) - -def translate_gnutls(s_cipher): - """ - Translate s_cipher from standard ciphersuite naming convention - and return the GnuTLS naming convention - """ - - # Replace "_" with "-" to handle ciphersuite names based on Mbed TLS - # naming convention - s_cipher = s_cipher.replace("_", "-") - - s_cipher = re.sub(r'\ATLS-', '+', s_cipher) - s_cipher = s_cipher.replace("-WITH-", ":+") - s_cipher = s_cipher.replace("-EDE", "") - - # SHA in Mbed TLS == SHA1 GnuTLS, - # if the last 3 chars are SHA append 1 - if s_cipher[-3:] == "SHA": - s_cipher = s_cipher+"1" - - # CCM or CCM-8 should be followed by ":+AEAD" - # Replace "GCM:+SHAxyz" with "GCM:+AEAD" - if "CCM" in s_cipher or "GCM" in s_cipher: - s_cipher = re.sub(r"GCM-SHA\d\d\d", "GCM", s_cipher) - s_cipher = s_cipher+":+AEAD" - - # Replace the last "-" with ":+" - else: - index = s_cipher.rindex("-") - s_cipher = s_cipher[:index] + ":+" + s_cipher[index+1:] - - return s_cipher - -def translate_ossl(s_cipher): - """ - Translate s_cipher from standard ciphersuite naming convention - and return the OpenSSL naming convention - """ - - # Replace "_" with "-" to handle ciphersuite names based on Mbed TLS - # naming convention - s_cipher = s_cipher.replace("_", "-") - - s_cipher = re.sub(r'^TLS-', '', s_cipher) - s_cipher = s_cipher.replace("-WITH", "") - - # Remove the "-" from "ABC-xyz" - s_cipher = s_cipher.replace("AES-", "AES") - s_cipher = s_cipher.replace("CAMELLIA-", "CAMELLIA") - s_cipher = s_cipher.replace("ARIA-", "ARIA") - - # Remove "RSA" if it is at the beginning - s_cipher = re.sub(r'^RSA-', r'', s_cipher) - - # For all circumstances outside of PSK - if "PSK" not in s_cipher: - s_cipher = s_cipher.replace("-EDE", "") - s_cipher = s_cipher.replace("3DES-CBC", "DES-CBC3") - - # Remove "CBC" if it is not prefixed by DES - s_cipher = re.sub(r'(? data)) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_len1.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_len1.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA) X509 CSR ASN.1 (attributes: invalid len (len < data)) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_len2.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_len2.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) X509 CSR ASN.1 (attributes: extension request invalid len (len > data)) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len1.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len1.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA) X509 CSR ASN.1 (attributes: extension request invalid len (len < data)) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len2.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len2.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA) X509 CSR ASN.1 (extensions: invalid sequence tag) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extensions_sequence_tag.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extensions_sequence_tag.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CSR ASN.1 (extensions: invalid extension id tag) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_id_tag.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_id_tag.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CSR ASN.1 (extensions: invalid extension data tag) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_data_tag.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_data_tag.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CSR ASN.1 (extensions: invalid extension data len (len > data)) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_data_len1.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_data_len1.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA) X509 CSR ASN.1 (extensions: invalid extension data len (len < data)) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_data_len2.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_data_len2.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) X509 CSR ASN.1 (extensions: invalid extension key usage bitstream tag) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_key_usage_bitstream_tag.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_key_usage_bitstream_tag.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CSR ASN.1 (extensions: invalid extension subject alt name sequence tag) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_subject_alt_name_sequence_tag.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_subject_alt_name_sequence_tag.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CSR ASN.1 (extensions: invalid extension ns cert bitstream tag) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_ns_cert_bitstream_tag.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_extension_ns_cert_bitstream_tag.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CSR ASN.1 (extensions: duplicated extension) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_duplicated_extension.csr.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_INVALID_DATA +mbedtls_x509_csr_parse_file:"../framework/data_files/parse_input/test_csr_v3_all_malformed_duplicated_extension.csr.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_INVALID_DATA) X509 CSR ASN.1 (extensions: invalid extension type data) depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C @@ -3137,7 +3137,7 @@ mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server7_pem_spa X509 File parse (all certificates fail) depends_on:PSA_HAVE_ALG_SOME_ECDSA:MBEDTLS_RSA_C -mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server7_all_space.crt":MBEDTLS_ERR_PEM_INVALID_DATA + MBEDTLS_ERR_BASE64_INVALID_CHARACTER:0 +mbedtls_x509_crt_parse_file:"../framework/data_files/parse_input/server7_all_space.crt":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PEM_INVALID_DATA, MBEDTLS_ERR_BASE64_INVALID_CHARACTER):0 X509 File parse (trailing spaces, OK) depends_on:PSA_HAVE_ALG_SOME_ECDSA:PSA_WANT_ECC_SECP_R1_256:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C @@ -3217,7 +3217,7 @@ x509_get_time:MBEDTLS_ASN1_UTC_TIME:"000229121212+0300":MBEDTLS_ERR_X509_INVALID X509 Get time (Date with invalid tag) depends_on:MBEDTLS_X509_USE_C -x509_get_time:MBEDTLS_ASN1_CONTEXT_SPECIFIC:"000229121212":MBEDTLS_ERR_X509_INVALID_DATE+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:0:0:0:0:0:0 +x509_get_time:MBEDTLS_ASN1_CONTEXT_SPECIFIC:"000229121212":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_DATE, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):0:0:0:0:0:0 X509 Get time (UTC, truncated) depends_on:MBEDTLS_X509_USE_C @@ -3381,11 +3381,11 @@ x509_crt_parse_subjectkeyid:"../framework/data_files/authorityKeyId_subjectKeyId X509 CRT parse Subject Key Id - Wrong OCTET_STRING tag depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_subjectkeyid:"../framework/data_files/authorityKeyId_subjectKeyId_tag_malformed.crt.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +x509_crt_parse_subjectkeyid:"../framework/data_files/authorityKeyId_subjectKeyId_tag_malformed.crt.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CRT parse Subject Key Id - Wrong OCTET_STRING length depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_subjectkeyid:"../framework/data_files/authorityKeyId_subjectKeyId_tag_len_malformed.crt.der":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +x509_crt_parse_subjectkeyid:"../framework/data_files/authorityKeyId_subjectKeyId_tag_len_malformed.crt.der":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) X509 CRT parse Authority Key Id - Correct Authority Key ID depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C @@ -3405,40 +3405,40 @@ x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_no_authori X509 CRT parse Authority Key Id - Wrong Length depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_length_malformed.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_length_malformed.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) X509 CRT parse Authority Key Id - Wrong Sequence tag depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_sequence_tag_malformed.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_sequence_tag_malformed.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CRT parse Authority Key Id - Wrong KeyId Tag depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_keyid_tag_malformed.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_keyid_tag_malformed.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CRT parse Authority Key Id - Wrong KeyId Tag Length depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_keyid_tag_len_malformed.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_INVALID_LENGTH +x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_keyid_tag_len_malformed.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_INVALID_LENGTH) X509 CRT parse Authority Key Id - Wrong Issuer Tag depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_issuer_tag1_malformed.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_issuer_tag1_malformed.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CRT parse Authority Key Id - Wrong DirectoryName tag in issuer field depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_issuer_tag2_malformed.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_issuer_tag2_malformed.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CRT parse Authority Key Id - Wrong Serial Number Tag depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_sn_tag_malformed.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_UNEXPECTED_TAG +x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_sn_tag_malformed.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) X509 CRT parse Authority Key Id - Wrong Serial Number Tag length depends_on:PSA_WANT_ALG_SHA_256:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_sn_len_malformed.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +x509_crt_parse_authoritykeyid:"../framework/data_files/authorityKeyId_subjectKeyId_sn_len_malformed.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) # clusterfuzz-testcase-minimized-fuzz_x509crt-6666050834661376: test for bad sequence of names in authorityCertIssuer (see issue #7576) X509 CRT parse Authority Key Id - Wrong Issuer sequence depends_on:PSA_WANT_ALG_MD5:MBEDTLS_RSA_C -x509_crt_parse_authoritykeyid:"../framework/data_files/clusterfuzz-testcase-minimized-fuzz_x509crt-6666050834661376.crt.der":"":"":"":MBEDTLS_ERR_X509_INVALID_EXTENSIONS+MBEDTLS_ERR_ASN1_OUT_OF_DATA +x509_crt_parse_authoritykeyid:"../framework/data_files/clusterfuzz-testcase-minimized-fuzz_x509crt-6666050834661376.crt.der":"":"":"":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, MBEDTLS_ERR_ASN1_OUT_OF_DATA) OID get numeric string - hardware module name oid_get_numeric_string:"2B06010505070804":0:"1.3.6.1.5.5.7.8.4" diff --git a/tf-psa-crypto/drivers/builtin/include/mbedtls/config_adjust_test_accelerators.h b/tf-psa-crypto/drivers/builtin/include/mbedtls/config_adjust_test_accelerators.h new file mode 100644 index 0000000000..7d930427e6 --- /dev/null +++ b/tf-psa-crypto/drivers/builtin/include/mbedtls/config_adjust_test_accelerators.h @@ -0,0 +1,121 @@ +/* + * \file mbedtls/config_adjust_test_accelerators.h + * \brief Declare the transparent test drivers as accelerators + * + * This is an internal header for test purposes only. Do not include it directly. + * + * As part of the transition to MBEDTLS_PSA_CRYPTO_CONFIG always on, the + * purpose of this header is to keep executing as long as necessary some + * driver-only related unit test cases when running the test_psa_crypto_drivers + * all.sh component (namely test cases in test_suite_block_cipher and + * test_suite_md.psa). It is expected that as the 4.x work progress these test + * cases will not be necessary anymore and: + * . test_psa_crypto_drivers scope is restricted to running the + * test_suite_psa_crypto_driver_wrappers test suite: test of the dispatch to + * drivers and fallbacks. + * . this file can be removed. + * + * This header is used as part of a build containing all the built-in drivers + * and all the transparent test drivers as wrappers around the built-in + * drivers. All the built-in drivers and the transparent test drivers are + * included in the build by starting from a full configuration (config.py full) + * and defining PSA_CRYPTO_DRIVER_TEST when building + * (make CFLAGS="-DPSA_CRYPTO_DRIVER_TEST ..."). + * + * The purpose of this header is to declare the transparent test drivers as + * accelerators just after infering the built-in drivers + * (config_adjust_legacy_from_psa.h). Not before the inclusion + * of config_adjust_legacy_from_psa.h in the build_info.h sequence of header + * inclusions as this would remove the built-in drivers. Just after to set up + * properly the internal macros introduced as part of the driver only work + * (mainly if not only in config_adjust_legacy_crypto.h). + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#ifndef MBEDTLS_CONFIG_ADJUST_TEST_ACCELERATORS_H +#define MBEDTLS_CONFIG_ADJUST_TEST_ACCELERATORS_H + +#if !defined(MBEDTLS_CONFIG_FILES_READ) +#error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \ + "up to and including runtime errors such as buffer overflows. " \ + "If you're trying to fix a complaint from check_config.h, just remove " \ + "it from your configuration file: since Mbed TLS 3.0, it is included " \ + "automatically at the right point." +#endif + +/* Declare the accelerator driver for all cryptographic mechanisms for which + * the test driver is implemented. This is copied from psa/crypto_config.h + * with the parts not implemented by the test driver commented out. */ +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DERIVE //no-check-names +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_PASSWORD //no-check-names +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_PASSWORD_HASH //no-check-names +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_HMAC //no-check-names +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_AES +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20 +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DES +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE +//#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RAW_DATA //no-check-names +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE +#define MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY + +#define MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING +#define MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7 +#define MBEDTLS_PSA_ACCEL_ALG_CCM +#define MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG +#define MBEDTLS_PSA_ACCEL_ALG_CMAC +#define MBEDTLS_PSA_ACCEL_ALG_CFB +#define MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 +#define MBEDTLS_PSA_ACCEL_ALG_CTR +#define MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA +#define MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING +#define MBEDTLS_PSA_ACCEL_ALG_ECDH +#define MBEDTLS_PSA_ACCEL_ALG_FFDH +#define MBEDTLS_PSA_ACCEL_ALG_ECDSA +#define MBEDTLS_PSA_ACCEL_ALG_JPAKE +#define MBEDTLS_PSA_ACCEL_ALG_GCM +//#define MBEDTLS_PSA_ACCEL_ALG_HKDF +//#define MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT +//#define MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND +#define MBEDTLS_PSA_ACCEL_ALG_HMAC +#define MBEDTLS_PSA_ACCEL_ALG_MD5 +#define MBEDTLS_PSA_ACCEL_ALG_OFB +//#define MBEDTLS_PSA_ACCEL_ALG_PBKDF2_HMAC +//#define MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128 +#define MBEDTLS_PSA_ACCEL_ALG_RIPEMD160 +#define MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP +#define MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT +#define MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN +#define MBEDTLS_PSA_ACCEL_ALG_RSA_PSS +#define MBEDTLS_PSA_ACCEL_ALG_SHA_1 +#define MBEDTLS_PSA_ACCEL_ALG_SHA_224 +#define MBEDTLS_PSA_ACCEL_ALG_SHA_256 +#define MBEDTLS_PSA_ACCEL_ALG_SHA_384 +#define MBEDTLS_PSA_ACCEL_ALG_SHA_512 +#define MBEDTLS_PSA_ACCEL_ALG_SHA3_224 +#define MBEDTLS_PSA_ACCEL_ALG_SHA3_256 +#define MBEDTLS_PSA_ACCEL_ALG_SHA3_384 +#define MBEDTLS_PSA_ACCEL_ALG_SHA3_512 +#define MBEDTLS_PSA_ACCEL_ALG_STREAM_CIPHER +//#define MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF +//#define MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS +//#define MBEDTLS_PSA_ACCEL_ALG_TLS12_ECJPAKE_TO_PMS + +#endif /* MBEDTLS_CONFIG_ADJUST_TEST_ACCELERATORS_H */ diff --git a/tf-psa-crypto/drivers/builtin/include/mbedtls/config_psa.h b/tf-psa-crypto/drivers/builtin/include/mbedtls/config_psa.h index 2520a9a53d..86bcc80a7b 100644 --- a/tf-psa-crypto/drivers/builtin/include/mbedtls/config_psa.h +++ b/tf-psa-crypto/drivers/builtin/include/mbedtls/config_psa.h @@ -38,7 +38,10 @@ /* If we are implementing PSA crypto ourselves, then we want to enable the * required built-ins. Otherwise, PSA features will be provided by the server. */ #include "mbedtls/config_adjust_legacy_from_psa.h" +#if defined(MBEDTLS_CONFIG_ADJUST_TEST_ACCELERATORS) //no-check-names +#include "mbedtls/config_adjust_test_accelerators.h" #endif +#endif /* MBEDTLS_PSA_CRYPTO_C */ #else /* MBEDTLS_PSA_CRYPTO_CONFIG */ diff --git a/tf-psa-crypto/drivers/builtin/src/pkwrite.c b/tf-psa-crypto/drivers/builtin/src/pkwrite.c index 8c01b440ae..0b57995849 100644 --- a/tf-psa-crypto/drivers/builtin/src/pkwrite.c +++ b/tf-psa-crypto/drivers/builtin/src/pkwrite.c @@ -65,17 +65,21 @@ static int pk_write_rsa_der(unsigned char **p, unsigned char *buf, #if defined(MBEDTLS_USE_PSA_CRYPTO) if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_OPAQUE) { uint8_t tmp[PSA_EXPORT_KEY_PAIR_MAX_SIZE]; - size_t len = 0, tmp_len = 0; + size_t tmp_len = 0; if (psa_export_key(pk->priv_id, tmp, sizeof(tmp), &tmp_len) != PSA_SUCCESS) { return MBEDTLS_ERR_PK_BAD_INPUT_DATA; } + /* Ensure there's enough space in the provided buffer before copying data into it. */ + if (tmp_len > (size_t) (*p - buf)) { + mbedtls_platform_zeroize(tmp, sizeof(tmp)); + return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL; + } *p -= tmp_len; memcpy(*p, tmp, tmp_len); - len += tmp_len; mbedtls_platform_zeroize(tmp, sizeof(tmp)); - return (int) len; + return (int) tmp_len; } #endif /* MBEDTLS_USE_PSA_CRYPTO */ return mbedtls_rsa_write_key(mbedtls_pk_rsa(*pk), buf, p); @@ -125,6 +129,10 @@ static int pk_write_ec_pubkey(unsigned char **p, unsigned char *start, if (psa_export_public_key(pk->priv_id, buf, sizeof(buf), &len) != PSA_SUCCESS) { return MBEDTLS_ERR_PK_BAD_INPUT_DATA; } + /* Ensure there's enough space in the provided buffer before copying data into it. */ + if (len > (size_t) (*p - start)) { + return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL; + } *p -= len; memcpy(*p, buf, len); return (int) len; diff --git a/tf-psa-crypto/tests/suites/test_suite_dhm.data b/tf-psa-crypto/tests/suites/test_suite_dhm.data index f909eb8244..b0367933a0 100644 --- a/tf-psa-crypto/tests/suites/test_suite_dhm.data +++ b/tf-psa-crypto/tests/suites/test_suite_dhm.data @@ -71,7 +71,7 @@ Diffie-Hellman full exchange: 286-bit dhm_do_dhm:"301abc09a57b66a953bfcc206a32e9ab56724084e4b47635779ca35fee79ce1060cb4117":36:"15aa1039b4dd361ed1b5b88e52f2919d0cbcb15adbe5fc290dab13b34e7":0 Diffie-Hellman small modulus -dhm_do_dhm:"3":1:"5":MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED+MBEDTLS_ERR_MPI_BAD_INPUT_DATA +dhm_do_dhm:"3":1:"5":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED, MBEDTLS_ERR_MPI_BAD_INPUT_DATA) Diffie-Hellman zero modulus dhm_do_dhm:"0":1:"5":MBEDTLS_ERR_DHM_BAD_INPUT_DATA @@ -107,7 +107,7 @@ Diffie-Hellman MPI_MAX_SIZE modulus dhm_make_public:MBEDTLS_MPI_MAX_SIZE:"5":0 Diffie-Hellman MPI_MAX_SIZE + 1 modulus -dhm_make_public:MBEDTLS_MPI_MAX_SIZE + 1:"5":MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED+MBEDTLS_ERR_MPI_BAD_INPUT_DATA +dhm_make_public:MBEDTLS_MPI_MAX_SIZE + 1:"5":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED, MBEDTLS_ERR_MPI_BAD_INPUT_DATA) DH load parameters from PEM file (1024-bit, g=2) depends_on:MBEDTLS_PEM_PARSE_C diff --git a/tf-psa-crypto/tests/suites/test_suite_dhm.function b/tf-psa-crypto/tests/suites/test_suite_dhm.function index bb64ef320f..6c6f15bbf7 100644 --- a/tf-psa-crypto/tests/suites/test_suite_dhm.function +++ b/tf-psa-crypto/tests/suites/test_suite_dhm.function @@ -1,5 +1,6 @@ /* BEGIN_HEADER */ #include "mbedtls/dhm.h" +#include "mbedtls/error.h" static int check_get_value(const mbedtls_dhm_context *ctx, mbedtls_dhm_parameter param, diff --git a/tf-psa-crypto/tests/suites/test_suite_pkcs5.data b/tf-psa-crypto/tests/suites/test_suite_pkcs5.data index 5884acffc1..7fa517d29b 100644 --- a/tf-psa-crypto/tests/suites/test_suite_pkcs5.data +++ b/tf-psa-crypto/tests/suites/test_suite_pkcs5.data @@ -168,15 +168,15 @@ pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"302706092A864886 PBES2 Decrypt (bad params tag) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_SEQUENCE:"":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:"" +pbes2_decrypt:MBEDTLS_ASN1_SEQUENCE:"":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):"" PBES2 Decrypt (bad KDF AlgId: not a sequence) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"31":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"31":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):"" PBES2 Decrypt (bad KDF AlgId: overlong) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"3001":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_OUT_OF_DATA:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"3001":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_OUT_OF_DATA):"" PBES2 Decrypt (KDF != PBKDF2) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C @@ -184,27 +184,27 @@ pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300B06092A864886 PBES2 Decrypt (bad PBKDF2 params: not a sequence) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300D06092A864886F70D01050C3100":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300D06092A864886F70D01050C3100":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):"" PBES2 Decrypt (bad PBKDF2 params: overlong) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300D06092A864886F70D01050C3001":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_OUT_OF_DATA:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300D06092A864886F70D01050C3001":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_OUT_OF_DATA):"" PBES2 Decrypt (bad PBKDF2 params salt: not an octet string) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C:MBEDTLS_CIPHER_MODE_CBC -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300E06092A864886F70D01050C30010500":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300E06092A864886F70D01050C30010500":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):"" PBES2 Decrypt (bad PBKDF2 params salt: overlong) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300E06092A864886F70D01050C30010401":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_OUT_OF_DATA:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"300E06092A864886F70D01050C30010401":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_OUT_OF_DATA):"" PBES2 Decrypt (bad PBKDF2 params iter: not an int) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301906092A864886F70D01050C300C04082ED7F24A1D516DD70300":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301906092A864886F70D01050C300C04082ED7F24A1D516DD70300":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):"" PBES2 Decrypt (bad PBKDF2 params iter: overlong) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301906092A864886F70D01050C300C04082ED7F24A1D516DD70201":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_OUT_OF_DATA:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301906092A864886F70D01050C300C04082ED7F24A1D516DD70201":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_OUT_OF_DATA):"" PBES2 Decrypt (OK, PBKDF2 params explicit keylen) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C:MBEDTLS_CIPHER_MODE_CBC @@ -212,7 +212,7 @@ pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301E06092A864886 PBES2 Decrypt (bad PBKDF2 params explicit keylen: overlong) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301D06092A864886F70D01050C301004082ED7F24A1D516DD7020208000201":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_OUT_OF_DATA:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301D06092A864886F70D01050C301004082ED7F24A1D516DD7020208000201":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_OUT_OF_DATA):"" PBES2 Decrypt (OK, PBKDF2 params explicit prf_alg) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C:MBEDTLS_CIPHER_MODE_CBC @@ -220,11 +220,11 @@ pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"302706092A864886 PBES2 Decrypt (bad, PBKDF2 params explicit prf_alg not a sequence) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301D06092A864886F70D01050C301004082ED7F24A1D516DD7020208003100":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301D06092A864886F70D01050C301004082ED7F24A1D516DD7020208003100":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):"" PBES2 Decrypt (bad, PBKDF2 params explicit prf_alg overlong) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301D06092A864886F70D01050C301004082ED7F24A1D516DD7020208003001":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_OUT_OF_DATA:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301D06092A864886F70D01050C301004082ED7F24A1D516DD7020208003001":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_OUT_OF_DATA):"" PBES2 Decrypt (bad, PBKDF2 params explicit prf_alg != HMAC-SHA*) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C @@ -232,15 +232,15 @@ pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"302706092A864886 PBES2 Decrypt (bad, PBKDF2 params extra data) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"302806092A864886F70D01050C301B04082ED7F24A1D516DD702020800300A06082A864886F70D020700":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"302806092A864886F70D01050C301B04082ED7F24A1D516DD702020800300A06082A864886F70D020700":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH):"" PBES2 Decrypt (bad enc_scheme_alg: not a sequence) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301B06092A864886F70D01050C300E04082ED7F24A1D516DD7020208003100":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301B06092A864886F70D01050C300E04082ED7F24A1D516DD7020208003100":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_UNEXPECTED_TAG):"" PBES2 Decrypt (bad enc_scheme_alg: overlong) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301B06092A864886F70D01050C300E04082ED7F24A1D516DD7020208003001":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_OUT_OF_DATA:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301B06092A864886F70D01050C300E04082ED7F24A1D516DD7020208003001":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_OUT_OF_DATA):"" PBES2 Decrypt (bad enc_scheme_alg: unknown oid) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C @@ -252,7 +252,7 @@ pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301B06092A864886 PBES2 Decrypt (bad enc_scheme_alg params: overlong) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C -pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301B06092A864886F70D01050C300E04082ED7F24A1D516DD702020800300C06082A864886F70D03070401":"":"":0:MBEDTLS_ERR_PKCS5_INVALID_FORMAT + MBEDTLS_ERR_ASN1_OUT_OF_DATA:"" +pbes2_decrypt:MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE:"301B06092A864886F70D01050C300E04082ED7F24A1D516DD702020800300C06082A864886F70D03070401":"":"":0:MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS5_INVALID_FORMAT, MBEDTLS_ERR_ASN1_OUT_OF_DATA):"" PBES2 Decrypt (bad enc_scheme_alg params: len != iv_len) depends_on:PSA_WANT_ALG_SHA_1:MBEDTLS_DES_C:MBEDTLS_CIPHER_MODE_CBC diff --git a/tf-psa-crypto/tests/suites/test_suite_pkcs5.function b/tf-psa-crypto/tests/suites/test_suite_pkcs5.function index afe9f38071..f6be142089 100644 --- a/tf-psa-crypto/tests/suites/test_suite_pkcs5.function +++ b/tf-psa-crypto/tests/suites/test_suite_pkcs5.function @@ -1,4 +1,5 @@ /* BEGIN_HEADER */ +#include "mbedtls/error.h" #include "mbedtls/pkcs5.h" #include "mbedtls/cipher.h" /* END_HEADER */ diff --git a/tf-psa-crypto/tests/suites/test_suite_pkparse.data b/tf-psa-crypto/tests/suites/test_suite_pkparse.data index 70ca864842..f896dd4d36 100644 --- a/tf-psa-crypto/tests/suites/test_suite_pkparse.data +++ b/tf-psa-crypto/tests/suites/test_suite_pkparse.data @@ -1191,11 +1191,11 @@ pk_parse_key:"3072020101300506032b656e04220420b06d829655543a51cba36e53522bc0acfd Key ASN1 (Encrypted key PKCS5, trailing garbage data) depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_MONTGOMERY_255:PSA_WANT_ALG_SHA_1:MBEDTLS_CIPHER_C:MBEDTLS_DES_C:MBEDTLS_CIPHER_MODE_CBC:MBEDTLS_CIPHER_PADDING_PKCS7:MBEDTLS_PKCS5_C:MBEDTLS_CIPHER_C -pk_parse_key_encrypted:"307C304006092A864886F70D01050D3033301B06092A864886F70D01050C300E04082ED7F24A1D516DD702020800301406082A864886F70D030704088A4FCC9DCC3949100438AD100BAC552FD0AE70BECAFA60F5E519B6180C77E8DB0B9ECC6F23FEDD30AB9BDCA2AF9F97BC470FC3A82DCA2364E22642DE0AF9275A82CB":"AAAAAAAAAAAAAAAAAA":MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +pk_parse_key_encrypted:"307C304006092A864886F70D01050D3033301B06092A864886F70D01050C300E04082ED7F24A1D516DD702020800301406082A864886F70D030704088A4FCC9DCC3949100438AD100BAC552FD0AE70BECAFA60F5E519B6180C77E8DB0B9ECC6F23FEDD30AB9BDCA2AF9F97BC470FC3A82DCA2364E22642DE0AF9275A82CB":"AAAAAAAAAAAAAAAAAA":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) Key ASN1 (Encrypted key PKCS12, trailing garbage data) depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_MONTGOMERY_255:PSA_WANT_ALG_SHA_1:MBEDTLS_CIPHER_C:MBEDTLS_DES_C:MBEDTLS_CIPHER_MODE_CBC:MBEDTLS_CIPHER_PADDING_PKCS7:MBEDTLS_PKCS12_C:MBEDTLS_CIPHER_C -pk_parse_key_encrypted:"3058301C060A2A864886F70D010C0103300E0409CCCCCCCCCCCCCCCCCC02010A04380A8CAF39C4FA001884D0583B323C5E70942444FBE1F650B92F8ADF4AD7BD5049B4748F53A2531139EBF253FE01E8FC925C82C759C944B4D0":"AAAAAAAAAAAAAAAAAA":MBEDTLS_ERR_PK_KEY_INVALID_FORMAT + MBEDTLS_ERR_ASN1_LENGTH_MISMATCH +pk_parse_key_encrypted:"3058301C060A2A864886F70D010C0103300E0409CCCCCCCCCCCCCCCCCC02010A04380A8CAF39C4FA001884D0583B323C5E70942444FBE1F650B92F8ADF4AD7BD5049B4748F53A2531139EBF253FE01E8FC925C82C759C944B4D0":"AAAAAAAAAAAAAAAAAA":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT, MBEDTLS_ERR_ASN1_LENGTH_MISMATCH) # From RFC8410 Appendix A but made into version 0 OneAsymmetricKey X25519, doesn't match masking requirements #1 diff --git a/tf-psa-crypto/tests/suites/test_suite_pkparse.function b/tf-psa-crypto/tests/suites/test_suite_pkparse.function index 2aea1b8106..1cd6e2bb98 100644 --- a/tf-psa-crypto/tests/suites/test_suite_pkparse.function +++ b/tf-psa-crypto/tests/suites/test_suite_pkparse.function @@ -1,4 +1,5 @@ /* BEGIN_HEADER */ +#include "mbedtls/error.h" #include "mbedtls/pk.h" #include "mbedtls/pem.h" #include "mbedtls/oid.h" diff --git a/tf-psa-crypto/tests/suites/test_suite_pkwrite.data b/tf-psa-crypto/tests/suites/test_suite_pkwrite.data index 67a846b807..d895d39d3a 100644 --- a/tf-psa-crypto/tests/suites/test_suite_pkwrite.data +++ b/tf-psa-crypto/tests/suites/test_suite_pkwrite.data @@ -30,13 +30,16 @@ Public key write check EC 521 bits (DER) depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_SECP_R1_521 pk_write_pubkey_check:"../../framework/data_files/ec_521_pub.der":TEST_DER -Public key write check EC Brainpool 512 bits -depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:MBEDTLS_PEM_PARSE_C:MBEDTLS_PEM_WRITE_C:PSA_WANT_ECC_BRAINPOOL_P_R1_512 -pk_write_pubkey_check:"../../framework/data_files/ec_bp512_pub.pem":TEST_PEM +## The pk_write_pubkey_check sometimes take ~3 hours to run with +## GCC+Asan on the CI in the full config. Comment out the slowest +## ones while we investigate and release 3.6.2. +# Public key write check EC Brainpool 512 bits +# depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:MBEDTLS_PEM_PARSE_C:MBEDTLS_PEM_WRITE_C:PSA_WANT_ECC_BRAINPOOL_P_R1_512 +# pk_write_pubkey_check:"../../framework/data_files/ec_bp512_pub.pem":TEST_PEM -Public key write check EC Brainpool 512 bits (DER) -depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_BRAINPOOL_P_R1_512 -pk_write_pubkey_check:"../../framework/data_files/ec_bp512_pub.der":TEST_DER +# Public key write check EC Brainpool 512 bits (DER) +# depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:PSA_WANT_ECC_BRAINPOOL_P_R1_512 +# pk_write_pubkey_check:"../../framework/data_files/ec_bp512_pub.der":TEST_DER Public key write check EC X25519 depends_on:PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY:MBEDTLS_PEM_PARSE_C:MBEDTLS_PEM_WRITE_C:PSA_WANT_ECC_MONTGOMERY_255 diff --git a/tf-psa-crypto/tests/suites/test_suite_pkwrite.function b/tf-psa-crypto/tests/suites/test_suite_pkwrite.function index 735c12547c..491bc489aa 100644 --- a/tf-psa-crypto/tests/suites/test_suite_pkwrite.function +++ b/tf-psa-crypto/tests/suites/test_suite_pkwrite.function @@ -2,6 +2,7 @@ #include "pk_internal.h" #include "mbedtls/pem.h" #include "mbedtls/oid.h" +#include "mbedtls/base64.h" #include "psa/crypto_sizes.h" typedef enum { @@ -73,6 +74,7 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der) unsigned char *check_buf = NULL; unsigned char *start_buf; size_t buf_len, check_buf_len; + int expected_result; #if defined(MBEDTLS_USE_PSA_CRYPTO) mbedtls_svc_key_id_t opaque_id = MBEDTLS_SVC_KEY_ID_INIT; psa_key_attributes_t key_attr = PSA_KEY_ATTRIBUTES_INIT; @@ -109,6 +111,17 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der) start_buf = buf; buf_len = check_buf_len; + if (is_der) { + expected_result = MBEDTLS_ERR_ASN1_BUF_TOO_SMALL; + } else { + expected_result = MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL; + } + /* Intentionally pass a wrong size for the provided output buffer and check + * that the writing functions fails as expected. */ + for (size_t i = 1; i < buf_len; i++) { + TEST_EQUAL(pk_write_any_key(&key, &start_buf, &i, is_public_key, + is_der), expected_result); + } TEST_EQUAL(pk_write_any_key(&key, &start_buf, &buf_len, is_public_key, is_der), 0); @@ -127,6 +140,12 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der) TEST_EQUAL(mbedtls_pk_setup_opaque(&key, opaque_id), 0); start_buf = buf; buf_len = check_buf_len; + /* Intentionally pass a wrong size for the provided output buffer and check + * that the writing functions fails as expected. */ + for (size_t i = 1; i < buf_len; i++) { + TEST_EQUAL(pk_write_any_key(&key, &start_buf, &i, is_public_key, + is_der), expected_result); + } TEST_EQUAL(pk_write_any_key(&key, &start_buf, &buf_len, is_public_key, is_der), 0); diff --git a/tf-psa-crypto/tests/suites/test_suite_rsa.data b/tf-psa-crypto/tests/suites/test_suite_rsa.data index 61e07cd0d1..8be8b588ba 100644 --- a/tf-psa-crypto/tests/suites/test_suite_rsa.data +++ b/tf-psa-crypto/tests/suites/test_suite_rsa.data @@ -270,7 +270,7 @@ mbedtls_rsa_pkcs1_encrypt:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c RSA PKCS1 Decrypt #2 (Data too small) depends_on:MBEDTLS_PKCS1_V15 -mbedtls_rsa_pkcs1_decrypt:"deadbeafcafedeadbeeffedcba9876":MBEDTLS_RSA_PKCS_V15:2048:"e79a373182bfaa722eb035f772ad2a9464bd842de59432c18bbab3a7dfeae318c9b915ee487861ab665a40bd6cda560152578e8579016c929df99fea05b4d64efca1d543850bc8164b40d71ed7f3fa4105df0fb9b9ad2a18ce182c8a4f4f975bea9aa0b9a1438a27a28e97ac8330ef37383414d1bd64607d6979ac050424fd17":"c6749cbb0db8c5a177672d4728a8b22392b2fc4d3b8361d5c0d5055a1b4e46d821f757c24eef2a51c561941b93b3ace7340074c058c9bb48e7e7414f42c41da4cccb5c2ba91deb30c586b7fb18af12a52995592ad139d3be429add6547e044becedaf31fa3b39421e24ee034fbf367d11f6b8f88ee483d163b431e1654ad3e89":"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":32:"4E636AF98E40F3ADCFCCB698F4E80B9F":MBEDTLS_ERR_RSA_PRIVATE_FAILED + MBEDTLS_ERR_MPI_BAD_INPUT_DATA +mbedtls_rsa_pkcs1_decrypt:"deadbeafcafedeadbeeffedcba9876":MBEDTLS_RSA_PKCS_V15:2048:"e79a373182bfaa722eb035f772ad2a9464bd842de59432c18bbab3a7dfeae318c9b915ee487861ab665a40bd6cda560152578e8579016c929df99fea05b4d64efca1d543850bc8164b40d71ed7f3fa4105df0fb9b9ad2a18ce182c8a4f4f975bea9aa0b9a1438a27a28e97ac8330ef37383414d1bd64607d6979ac050424fd17":"c6749cbb0db8c5a177672d4728a8b22392b2fc4d3b8361d5c0d5055a1b4e46d821f757c24eef2a51c561941b93b3ace7340074c058c9bb48e7e7414f42c41da4cccb5c2ba91deb30c586b7fb18af12a52995592ad139d3be429add6547e044becedaf31fa3b39421e24ee034fbf367d11f6b8f88ee483d163b431e1654ad3e89":"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":32:"4E636AF98E40F3ADCFCCB698F4E80B9F":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_RSA_PRIVATE_FAILED, MBEDTLS_ERR_MPI_BAD_INPUT_DATA) RSA PKCS1 Decrypt #4 (Output buffer too small) depends_on:MBEDTLS_PKCS1_V15 @@ -371,7 +371,7 @@ RSA Private (Correct) mbedtls_rsa_private:"59779fd2a39e56640c4fc1e67b60aeffcecd78aed7ad2bdfa464e93d04198d48466b8da7445f25bfa19db2844edd5c8f539cf772cc132b483169d390db28a43bc4ee0f038f6568ffc87447746cb72fefac2d6d90ee3143a915ac4688028805905a68eb8f8a96674b093c495eddd8704461eaa2b345efbb2ad6930acd8023f8700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":2048:"e79a373182bfaa722eb035f772ad2a9464bd842de59432c18bbab3a7dfeae318c9b915ee487861ab665a40bd6cda560152578e8579016c929df99fea05b4d64efca1d543850bc8164b40d71ed7f3fa4105df0fb9b9ad2a18ce182c8a4f4f975bea9aa0b9a1438a27a28e97ac8330ef37383414d1bd64607d6979ac050424fd17":"c6749cbb0db8c5a177672d4728a8b22392b2fc4d3b8361d5c0d5055a1b4e46d821f757c24eef2a51c561941b93b3ace7340074c058c9bb48e7e7414f42c41da4cccb5c2ba91deb30c586b7fb18af12a52995592ad139d3be429add6547e044becedaf31fa3b39421e24ee034fbf367d11f6b8f88ee483d163b431e1654ad3e89":"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":"48ce62658d82be10737bd5d3579aed15bc82617e6758ba862eeb12d049d7bacaf2f62fce8bf6e980763d1951f7f0eae3a493df9890d249314b39d00d6ef791de0daebf2c50f46e54aeb63a89113defe85de6dbe77642aae9f2eceb420f3a47a56355396e728917f17876bb829fabcaeef8bf7ef6de2ff9e84e6108ea2e52bbb62b7b288efa0a3835175b8b08fac56f7396eceb1c692d419ecb79d80aef5bc08a75d89de9f2b2d411d881c0e3ffad24c311a19029d210d3d3534f1b626f982ea322b4d1cfba476860ef20d4f672f38c371084b5301b429b747ea051a619e4430e0dac33c12f9ee41ca4d81a4f6da3e495aa8524574bdc60d290dd1f7a62e90a67":0 RSA Private (Data larger than N) -mbedtls_rsa_private:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":2048:"e79a373182bfaa722eb035f772ad2a9464bd842de59432c18bbab3a7dfeae318c9b915ee487861ab665a40bd6cda560152578e8579016c929df99fea05b4d64efca1d543850bc8164b40d71ed7f3fa4105df0fb9b9ad2a18ce182c8a4f4f975bea9aa0b9a1438a27a28e97ac8330ef37383414d1bd64607d6979ac050424fd17":"c6749cbb0db8c5a177672d4728a8b22392b2fc4d3b8361d5c0d5055a1b4e46d821f757c24eef2a51c561941b93b3ace7340074c058c9bb48e7e7414f42c41da4cccb5c2ba91deb30c586b7fb18af12a52995592ad139d3be429add6547e044becedaf31fa3b39421e24ee034fbf367d11f6b8f88ee483d163b431e1654ad3e89":"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":"605baf947c0de49e4f6a0dfb94a43ae318d5df8ed20ba4ba5a37a73fb009c5c9e5cce8b70a25b1c7580f389f0d7092485cdfa02208b70d33482edf07a7eafebdc54862ca0e0396a5a7d09991b9753eb1ffb6091971bb5789c6b121abbcd0a3cbaa39969fa7c28146fce96c6d03272e3793e5be8f5abfa9afcbebb986d7b3050604a2af4d3a40fa6c003781a539a60259d1e84f13322da9e538a49c369b83e7286bf7d30b64bbb773506705da5d5d5483a563a1ffacc902fb75c9a751b1e83cdc7a6db0470056883f48b5a5446b43b1d180ea12ba11a6a8d93b3b32a30156b6084b7fb142998a2a0d28014b84098ece7d9d5e4d55cc342ca26f5a0167a679dec8":MBEDTLS_ERR_RSA_PRIVATE_FAILED + MBEDTLS_ERR_MPI_BAD_INPUT_DATA +mbedtls_rsa_private:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":2048:"e79a373182bfaa722eb035f772ad2a9464bd842de59432c18bbab3a7dfeae318c9b915ee487861ab665a40bd6cda560152578e8579016c929df99fea05b4d64efca1d543850bc8164b40d71ed7f3fa4105df0fb9b9ad2a18ce182c8a4f4f975bea9aa0b9a1438a27a28e97ac8330ef37383414d1bd64607d6979ac050424fd17":"c6749cbb0db8c5a177672d4728a8b22392b2fc4d3b8361d5c0d5055a1b4e46d821f757c24eef2a51c561941b93b3ace7340074c058c9bb48e7e7414f42c41da4cccb5c2ba91deb30c586b7fb18af12a52995592ad139d3be429add6547e044becedaf31fa3b39421e24ee034fbf367d11f6b8f88ee483d163b431e1654ad3e89":"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":"605baf947c0de49e4f6a0dfb94a43ae318d5df8ed20ba4ba5a37a73fb009c5c9e5cce8b70a25b1c7580f389f0d7092485cdfa02208b70d33482edf07a7eafebdc54862ca0e0396a5a7d09991b9753eb1ffb6091971bb5789c6b121abbcd0a3cbaa39969fa7c28146fce96c6d03272e3793e5be8f5abfa9afcbebb986d7b3050604a2af4d3a40fa6c003781a539a60259d1e84f13322da9e538a49c369b83e7286bf7d30b64bbb773506705da5d5d5483a563a1ffacc902fb75c9a751b1e83cdc7a6db0470056883f48b5a5446b43b1d180ea12ba11a6a8d93b3b32a30156b6084b7fb142998a2a0d28014b84098ece7d9d5e4d55cc342ca26f5a0167a679dec8":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_RSA_PRIVATE_FAILED, MBEDTLS_ERR_MPI_BAD_INPUT_DATA) RSA Private (Data = 0 ) mbedtls_rsa_private:"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":2048:"e79a373182bfaa722eb035f772ad2a9464bd842de59432c18bbab3a7dfeae318c9b915ee487861ab665a40bd6cda560152578e8579016c929df99fea05b4d64efca1d543850bc8164b40d71ed7f3fa4105df0fb9b9ad2a18ce182c8a4f4f975bea9aa0b9a1438a27a28e97ac8330ef37383414d1bd64607d6979ac050424fd17":"c6749cbb0db8c5a177672d4728a8b22392b2fc4d3b8361d5c0d5055a1b4e46d821f757c24eef2a51c561941b93b3ace7340074c058c9bb48e7e7414f42c41da4cccb5c2ba91deb30c586b7fb18af12a52995592ad139d3be429add6547e044becedaf31fa3b39421e24ee034fbf367d11f6b8f88ee483d163b431e1654ad3e89":"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":0 @@ -380,7 +380,7 @@ RSA Public (Correct) mbedtls_rsa_public:"59779fd2a39e56640c4fc1e67b60aeffcecd78aed7ad2bdfa464e93d04198d48466b8da7445f25bfa19db2844edd5c8f539cf772cc132b483169d390db28a43bc4ee0f038f6568ffc87447746cb72fefac2d6d90ee3143a915ac4688028805905a68eb8f8a96674b093c495eddd8704461eaa2b345efbb2ad6930acd8023f8700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":2048:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":"1f5e927c13ff231090b0f18c8c3526428ed0f4a7561457ee5afe4d22d5d9220c34ef5b9a34d0c07f7248a1f3d57f95d10f7936b3063e40660b3a7ca3e73608b013f85a6e778ac7c60d576e9d9c0c5a79ad84ceea74e4722eb3553bdb0c2d7783dac050520cb27ca73478b509873cb0dcbd1d51dd8fccb96c29ad314f36d67cc57835d92d94defa0399feb095fd41b9f0b2be10f6041079ed4290040449f8a79aba50b0a1f8cf83c9fb8772b0686ec1b29cb1814bb06f9c024857db54d395a8da9a2c6f9f53b94bec612a0cb306a3eaa9fc80992e85d9d232e37a50cabe48c9343f039601ff7d95d60025e582aec475d031888310e8ec3833b394a5cf0599101e":0 RSA Public (Data larger than N) -mbedtls_rsa_public:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":2048:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":"605baf947c0de49e4f6a0dfb94a43ae318d5df8ed20ba4ba5a37a73fb009c5c9e5cce8b70a25b1c7580f389f0d7092485cdfa02208b70d33482edf07a7eafebdc54862ca0e0396a5a7d09991b9753eb1ffb6091971bb5789c6b121abbcd0a3cbaa39969fa7c28146fce96c6d03272e3793e5be8f5abfa9afcbebb986d7b3050604a2af4d3a40fa6c003781a539a60259d1e84f13322da9e538a49c369b83e7286bf7d30b64bbb773506705da5d5d5483a563a1ffacc902fb75c9a751b1e83cdc7a6db0470056883f48b5a5446b43b1d180ea12ba11a6a8d93b3b32a30156b6084b7fb142998a2a0d28014b84098ece7d9d5e4d55cc342ca26f5a0167a679dec8":MBEDTLS_ERR_RSA_PUBLIC_FAILED + MBEDTLS_ERR_MPI_BAD_INPUT_DATA +mbedtls_rsa_public:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":2048:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":"605baf947c0de49e4f6a0dfb94a43ae318d5df8ed20ba4ba5a37a73fb009c5c9e5cce8b70a25b1c7580f389f0d7092485cdfa02208b70d33482edf07a7eafebdc54862ca0e0396a5a7d09991b9753eb1ffb6091971bb5789c6b121abbcd0a3cbaa39969fa7c28146fce96c6d03272e3793e5be8f5abfa9afcbebb986d7b3050604a2af4d3a40fa6c003781a539a60259d1e84f13322da9e538a49c369b83e7286bf7d30b64bbb773506705da5d5d5483a563a1ffacc902fb75c9a751b1e83cdc7a6db0470056883f48b5a5446b43b1d180ea12ba11a6a8d93b3b32a30156b6084b7fb142998a2a0d28014b84098ece7d9d5e4d55cc342ca26f5a0167a679dec8":MBEDTLS_ERROR_ADD(MBEDTLS_ERR_RSA_PUBLIC_FAILED, MBEDTLS_ERR_MPI_BAD_INPUT_DATA) RSA Public (Data = 0) mbedtls_rsa_public:"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":2048:"b38ac65c8141f7f5c96e14470e851936a67bf94cc6821a39ac12c05f7c0b06d9e6ddba2224703b02e25f31452f9c4a8417b62675fdc6df46b94813bc7b9769a892c482b830bfe0ad42e46668ace68903617faf6681f4babf1cc8e4b0420d3c7f61dc45434c6b54e2c3ee0fc07908509d79c9826e673bf8363255adb0add2401039a7bcd1b4ecf0fbe6ec8369d2da486eec59559dd1d54c9b24190965eafbdab203b35255765261cd0909acf93c3b8b8428cbb448de4715d1b813d0c94829c229543d391ce0adab5351f97a3810c1f73d7b1458b97daed4209c50e16d064d2d5bfda8c23893d755222793146d0a78c3d64f35549141486c3b0961a7b4c1a2034f":"3":"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":0 diff --git a/tf-psa-crypto/tests/suites/test_suite_rsa.function b/tf-psa-crypto/tests/suites/test_suite_rsa.function index 98ea9efb1c..b84848b916 100644 --- a/tf-psa-crypto/tests/suites/test_suite_rsa.function +++ b/tf-psa-crypto/tests/suites/test_suite_rsa.function @@ -1,4 +1,5 @@ /* BEGIN_HEADER */ +#include "mbedtls/error.h" #include "mbedtls/rsa.h" #include "bignum_core.h" #include "rsa_alt_helpers.h"