1
0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-07-08 23:21:59 +03:00
Commit Graph

13540 Commits

Author SHA1 Message Date
f686f1dc17 Fix naming inconsistencies in config bits
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-03-01 11:20:32 +00:00
19bfe0a631 tls13: Rename early_data_count to total_early_data_size
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 09:29:16 +01:00
70eab45ba6 tls13: generic: Fix log
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 09:29:16 +01:00
01d273d31f Enforce maximum size of early data in case of HRR
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 09:29:16 +01:00
919e596c05 Enforce maximum size of early data when rejected
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 09:29:16 +01:00
8571804382 tls13: srv: Enforce maximum size of early data
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 09:29:09 +01:00
c286519747 tls13: srv: Do not forget to include max_early_data_size in the ticket
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 09:03:51 +01:00
26a9811027 ssl: Add early_data_count field
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 09:03:51 +01:00
531aca2810 Fix missing fields in ssl session struct comment
The endpoint and version were factorized out into the main session.
Update the session struct comment to reflect these new fields, as was
previously missed.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-29 18:14:28 +00:00
cb01b361e1 Move session descriptions into a single comment
Describe the TLS 1.2, TLS 1.3 and full session structs in the same
place for ease of reference.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-29 18:10:13 +00:00
80a9668762 Add config guards to session struct comments
This shows which fields of the session are dependent on which config
options.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-29 18:00:32 +00:00
e59f970f28 Move session functions to same part of file
Ensure that session save and load functions are not scattered
throughout ssl_tls.c but are in the same part of the file.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-29 17:50:44 +00:00
92b258bb50 Update ssl session serialization config bitflag
Add config bits for server name indication, early data and record size
limit, which all cause the serialized session to be structured
differently.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-29 17:41:31 +00:00
5c5a32f52a Add session config bit for KEEP_PEER_CERTIFICATE
This config option decides whether the session stores the entire
certificate or just a digest of it, but was missing from the
serialization config bitflag.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-29 17:41:31 +00:00
469f7811fa Require framework directory to exist when building
The framework directory will be provided by a submodule.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-29 18:19:56 +01:00
1a58e9a232 psa_util: change guard for mbedtls_psa_get_random() to CRYPTO_CLIENT
This commit also:
- updates changelog
- add a stub function to be used in component_test_psa_crypto_client()
  test

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-29 16:14:29 +01:00
9b4e964c2c Merge pull request #8760 from ronald-cron-arm/tls13-write-early-data
TLS 1.3: Add mbedtls_ssl_write_early_data() API
2024-02-29 14:31:55 +00:00
c5688a2629 Merge branch 'development-restricted' into generate-random-buffer-protection
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-29 14:25:56 +00:00
bcfed50917 Fix compilation on macOS without apple-clang
Signed-off-by: Steven WdV <swdv@cs.ru.nl>
2024-02-29 15:19:06 +01:00
d753738fc0 echd: Added mbedtls_ecdh_get_grp_id getter.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-02-29 13:31:34 +00:00
0b04116cc8 Do not copy the content to the local output buffer with allocation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-29 10:08:16 +00:00
840dfe8b41 Merge branch 'development-restricted' into asymmetric_encrypt_buffer_protection
Signed-off-by: tom-daubney-arm <74920390+tom-daubney-arm@users.noreply.github.com>
2024-02-28 15:42:38 +00:00
358eb218ab Fix buffer protection handling for cipher_generate_iv
Use the `LOCAL_OUTPUT_` macros for buffer protection instead of the existing
local variable.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-28 15:17:19 +00:00
7abf8ee51b Add buffer protection for cipher_generate_iv and cipher_set_iv
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-28 15:17:18 +00:00
8b8e485961 Move local buffer allocation just before usage
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-28 15:17:18 +00:00
4892d75e9b Add LOCAL_OUTPUT_ALLOC_WITH_COPY macro if buffer protection is disabled
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-28 15:17:17 +00:00
c25fbd2cc1 Fix ASAN error for psa_cipher_update
The ASAN gives an error for `psa_cipher_update` when the `input_length`
is 0 and the `input` buffer is `NULL`. The root cause of this issue is
`mbedtls_cipher_update` always need a valid pointer for the
input buffer even if the length is 0.
This fix avoids the `mbedtls_cipher_update` to be called if the
input buffer length is 0.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-28 15:17:17 +00:00
212eb08884 Add buffer protection for cipher functions
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-28 15:15:49 +00:00
e097bbdcf3 Add missing guards around exit label
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-28 14:17:10 +00:00
84a7bfbd33 mbedtls_ecp_write_key_ext(): Upgrade import_pair_into_psa as well
It wasn't done with the others because that code was added in a concurrent
branch.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 14:21:32 +01:00
b395e74edd mbedtls_ecp_write_key_ext(): make key const
Having a non-const `key` parameter was anotherf defect of
mbedtls_ecp_write_key(). Take this opportunity to fix it.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 14:18:28 +01:00
c0f7a8680f mbedtls_ecp_write_key(): deprecate the old function
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 13:19:42 +01:00
84b9f1b039 mbedtls_ecp_write_key_ext(): migrate internally
Stop using mbedtls_ecp_write_key() except to test it.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 13:19:42 +01:00
e3fb4ccabf mbedtls_ecp_write_key_ext(): new function
Same as mbedtls_ecp_write_key(), but doesn't require the caller to figure out
the length of the output and possibly distinguish between Weierstrass and
Montgomery curves.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 13:19:42 +01:00
7f523bf9eb Merge pull request #8845 from gilles-peskine-arm/ecp-write-doc-3.6
Document ECP write functions
2024-02-28 11:04:38 +00:00
b484e37d91 pk: fix alg selection in mbedtls_pk_sign_ext() for opaque keys
This commit also fixes pk_psa_wrap_sign_ext() setting the RSA padding
mode so that mbedtls_pk_get_psa_attributes() correctly guesses
the PSA alg to be used.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-28 09:44:35 +01:00
718180c7b5 psa_crypto_random_impl: minor fixes
- define mbedtls_psa_random_context_t even when MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
  is defined
- define mbedtls_psa_legacy_get_random as pointer to function instead
  of #define to make "check_names" test happy.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-28 06:48:49 +01:00
e92796ef98 Get rid of flags in attributes
The `flags` field in `psa_key_attributes_t` was a general mechanism that
only ever got used for a single flag: to indicate that the `slot_number`
field has been set. We have switched to a dedicated indicator for that, so
we can now remove `flags`.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 01:56:16 +01:00
972539c241 In attributes, keep track of slot number through a dedicated field
In `psa_key_attributes_t`, keep track of whether `slot_number` has been set
through a dedicated field, rather than using a flag.

This paves the way to removing `flags`, which is not used for anything else.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 01:49:45 +01:00
2f107ae000 Don't access psa_key_attributes_t.core
Access the fields of `psa_key_attributes_t` directly rather than through the
`core` field. This makes the `core` field obsolete.

This commit is fully automated:
```
git ls-files '*.h' '*.c' '*.function' '*.jinja' | xargs perl -l -i -pe '$core = qr/\b(core\b|MBEDTLS_PRIVATE\(core\))/; s/->$core\./->/g; s/&(\w+)\.$core\./&$1./g; s/(\w+)\.$core/$1/g'
```

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 01:30:24 +01:00
7a5d9201c1 Get rid of intermediate full-attributes local variables
Now that a key slot contains the full `psa_key_attributes_t, the temporary
local variables holding a copy of core attributes read from the slot are no
longer needed.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 01:30:24 +01:00
7fad3ef3b5 Switch key slots to psa_key_attributes_t
Switch `psa_key_slot_t` to the full `psa_key_attributes_t`, now that this
structure only has psa_core_key_attributes_t`.

To minimize the diff without breaking the build much, temporarily make
`psa_key_attributes_t` contain either the `core` field or all the fields.
This allows both things like `slot->attr.core.type` and `slot->attr.type`
to exist. The build breaks with compilers that don't support anonymous
unions and structs, which are only standard C since C11.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 01:30:24 +01:00
0f40a41cea psa_key_attributes_t: move slot_number to core structure
Move the `slot_number` field of `psa_key_attributes_t` to
`psa_core_key_attributes_t`. This makes ``psa_core_key_attributes_t` core`
the sole field of `psa_key_attributes_t`. This paves the way to unifying
the two structures.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 01:29:43 +01:00
09e6fb42eb Merge pull request #8865 from daverodgman/iar-fixes-feb27
Add missing casts to fix IAR warnings
2024-02-27 14:41:53 +00:00
88ae0ef286 pk: completely remove mbedtls_pk_wrap_as_opaque
Remove instead of deprecating it.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-27 13:49:42 +01:00
5b5faf0898 Merge pull request #8844 from davidhorstmann-arm/restore-x509-functions-to-public
Restore some X509 functions to public headers
2024-02-27 10:55:16 +00:00
6a3da2d5ed Add missing casts
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2024-02-27 10:41:53 +00:00
4c6cea549c pk: deprecate mbedtls_pk_wrap_as_opaque()
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-27 10:51:03 +01:00
40c837dc40 Simplify pi rolled-up variant
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2024-02-26 18:43:22 +00:00
08b81bf1e8 Test all unroll variations
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2024-02-26 18:43:22 +00:00