mirror of
https://github.com/librekeys/mbedtls.git
synced 2026-04-14 08:47:42 -07:00
Merge remote-tracking branch 'development' into restricted-mbedtls-merge-public-20250916
Conflicts: * `tf-psa-crypto`: updated to the merge of `development` and `development-restricted`.
This commit is contained in:
Gilles Peskine
@@ -124,10 +124,8 @@ class CoverageTask(outcome_analysis.CoverageTask):
|
||||
# Untested platform-specific optimizations.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9588
|
||||
'Config: MBEDTLS_HAVE_SSE2',
|
||||
# Obsolete configuration options, to be replaced by
|
||||
# PSA entropy drivers.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/8150
|
||||
'Config: MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES',
|
||||
# Obsolete config option that we are about to remove
|
||||
'Config: MBEDTLS_PLATFORM_GET_ENTROPY_ALT',
|
||||
# Untested aspect of the platform interface.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9589
|
||||
'Config: MBEDTLS_PLATFORM_NO_STD_FUNCTIONS',
|
||||
|
||||
@@ -123,4 +123,7 @@ component_check_test_helpers () {
|
||||
|
||||
msg "unit test: translate_ciphers.py"
|
||||
python3 -m unittest framework/scripts/translate_ciphers.py 2>&1
|
||||
|
||||
msg "unit test: generate_config_checks.py"
|
||||
tests/scripts/test_config_checks.py 2>&1
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -20,17 +20,18 @@ component_build_no_std_function () {
|
||||
make
|
||||
}
|
||||
|
||||
component_test_platform_get_entropy_alt()
|
||||
component_test_psa_driver_get_entropy()
|
||||
{
|
||||
msg "build: default config + MBEDTLS_PLATFORM_GET_ENTROPY_ALT"
|
||||
msg "build: default - MBEDTLS_PSA_BUILTIN_GET_ENTROPY + MBEDTLS_PSA_DRIVER_GET_ENTROPY"
|
||||
# Use hardware polling as the only source for entropy
|
||||
scripts/config.py set MBEDTLS_PLATFORM_GET_ENTROPY_ALT
|
||||
scripts/config.py unset MBEDTLS_PSA_BUILTIN_GET_ENTROPY
|
||||
scripts/config.py unset MBEDTLS_ENTROPY_NV_SEED
|
||||
scripts/config.py set MBEDTLS_PSA_DRIVER_GET_ENTROPY
|
||||
|
||||
make
|
||||
|
||||
# Run all the tests
|
||||
msg "test: default config + MBEDTLS_PLATFORM_GET_ENTROPY_ALT"
|
||||
msg "test: default - MBEDTLS_PSA_BUILTIN_GET_ENTROPY + MBEDTLS_PSA_DRIVER_GET_ENTROPY"
|
||||
make test
|
||||
}
|
||||
|
||||
@@ -40,7 +41,8 @@ component_build_no_sockets () {
|
||||
msg "build: full config except net_sockets.c, make, gcc -std=c99 -pedantic" # ~ 30s
|
||||
scripts/config.py full
|
||||
scripts/config.py unset MBEDTLS_NET_C # getaddrinfo() undeclared, etc.
|
||||
scripts/config.py set MBEDTLS_PLATFORM_GET_ENTROPY_ALT # prevent syscall() on GNU/Linux
|
||||
scripts/config.py unset MBEDTLS_PSA_BUILTIN_GET_ENTROPY # prevent syscall() on GNU/Linux
|
||||
scripts/config.py set MBEDTLS_PSA_DRIVER_GET_ENTROPY
|
||||
make CC=gcc CFLAGS='-Werror -Wall -Wextra -O1 -std=c99 -pedantic' lib
|
||||
}
|
||||
|
||||
|
||||
@@ -50,15 +50,15 @@ component_test_tls1_2_default_stream_cipher_only () {
|
||||
msg "build: default with only stream cipher use psa"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
scripts/config.py unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
#Disable TLS 1.3 (as no AEAD)
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
|
||||
# Disable CBC. Note: When implemented, PSA_WANT_ALG_CBC_MAC will also need to be unset here to fully disable CBC
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
|
||||
scripts/config.py unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py unset PSA_WANT_ALG_CBC_PKCS7
|
||||
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Enable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
@@ -79,14 +79,14 @@ component_test_tls1_2_default_cbc_legacy_cipher_only () {
|
||||
msg "build: default with only CBC-legacy cipher use psa"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
scripts/config.py unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
#Disable TLS 1.3 (as no AEAD)
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
|
||||
# Enable CBC-legacy
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H set PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py set PSA_WANT_ALG_CBC_NO_PADDING
|
||||
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
@@ -108,14 +108,14 @@ component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only () {
|
||||
msg "build: default with only CBC-legacy and CBC-EtM ciphers use psa"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
scripts/config.py unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
#Disable TLS 1.3 (as no AEAD)
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
|
||||
# Enable CBC-legacy
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H set PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py set PSA_WANT_ALG_CBC_NO_PADDING
|
||||
# Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py set MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
@@ -235,6 +235,7 @@ component_test_small_mbedtls_ssl_dtls_max_buffering () {
|
||||
# - test only TLS (i.e. test_suite_tls and ssl-opt)
|
||||
build_full_minus_something_and_test_tls () {
|
||||
symbols_to_disable="$1"
|
||||
filter="${2-.}"
|
||||
|
||||
msg "build: full minus something, test TLS"
|
||||
|
||||
@@ -250,11 +251,12 @@ build_full_minus_something_and_test_tls () {
|
||||
( cd tests; ./test_suite_ssl )
|
||||
|
||||
msg "ssl-opt: full minus something, test TLS"
|
||||
tests/ssl-opt.sh
|
||||
tests/ssl-opt.sh -f "$filter"
|
||||
}
|
||||
|
||||
#These tests are temporarily disabled due to an unknown dependency of static ecdh as described in https://github.com/Mbed-TLS/mbedtls/issues/10385.
|
||||
component_full_without_ecdhe_ecdsa () {
|
||||
build_full_minus_something_and_test_tls "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED"
|
||||
build_full_minus_something_and_test_tls "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED" 'psk\|PSK\|1\.3'
|
||||
}
|
||||
|
||||
component_full_without_ecdhe_ecdsa_and_tls13 () {
|
||||
@@ -342,23 +344,6 @@ component_test_variable_ssl_in_out_buffer_len () {
|
||||
tests/compat.sh
|
||||
}
|
||||
|
||||
component_test_dtls_cid_legacy () {
|
||||
msg "build: MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy) enabled (ASan build)"
|
||||
scripts/config.py set MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT 1
|
||||
|
||||
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy)"
|
||||
make test
|
||||
|
||||
msg "test: ssl-opt.sh, MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy) enabled"
|
||||
tests/ssl-opt.sh
|
||||
|
||||
msg "test: compat.sh, MBEDTLS_SSL_DTLS_CONNECTION_ID (legacy) enabled"
|
||||
tests/compat.sh
|
||||
}
|
||||
|
||||
component_test_ssl_alloc_buffer_and_mfl () {
|
||||
msg "build: default config with memory buffer allocator and MFL extension"
|
||||
scripts/config.py set MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
@@ -378,10 +363,10 @@ component_test_ssl_alloc_buffer_and_mfl () {
|
||||
|
||||
component_test_when_no_ciphersuites_have_mac () {
|
||||
msg "build: when no ciphersuites have MAC"
|
||||
scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7
|
||||
scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CMAC
|
||||
scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
|
||||
scripts/config.py unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py unset PSA_WANT_ALG_CBC_PKCS7
|
||||
scripts/config.py unset PSA_WANT_ALG_CMAC
|
||||
scripts/config.py unset PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
|
||||
|
||||
scripts/config.py unset MBEDTLS_CIPHER_NULL_CIPHER
|
||||
|
||||
@@ -436,22 +421,22 @@ component_test_tls13_only_psk () {
|
||||
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py set MBEDTLS_TEST_HOOKS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_FFDH
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_2048
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_3072
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_4096
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_6144
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_8192
|
||||
scripts/config.py unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py unset PSA_WANT_ALG_FFDH
|
||||
scripts/config.py unset PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY
|
||||
scripts/config.py unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC
|
||||
scripts/config.py unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT
|
||||
scripts/config.py unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT
|
||||
scripts/config.py unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE
|
||||
scripts/config.py unset PSA_WANT_DH_RFC7919_2048
|
||||
scripts/config.py unset PSA_WANT_DH_RFC7919_3072
|
||||
scripts/config.py unset PSA_WANT_DH_RFC7919_4096
|
||||
scripts/config.py unset PSA_WANT_DH_RFC7919_6144
|
||||
scripts/config.py unset PSA_WANT_DH_RFC7919_8192
|
||||
# Note: The four unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDH_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
@@ -481,6 +466,7 @@ component_test_tls13_only_ephemeral () {
|
||||
tests/ssl-opt.sh
|
||||
}
|
||||
|
||||
#These tests are temporarily disabled due to an unknown dependency of static ecdh as described in https://github.com/Mbed-TLS/mbedtls/issues/10385.
|
||||
component_test_tls13_only_ephemeral_ffdh () {
|
||||
msg "build: TLS 1.3 only from default, only ephemeral ffdh key exchange mode"
|
||||
scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
|
||||
@@ -488,7 +474,7 @@ component_test_tls13_only_ephemeral_ffdh () {
|
||||
scripts/config.py unset MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py set MBEDTLS_TEST_HOOKS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py unset PSA_WANT_ALG_ECDH
|
||||
# Note: The unset below is to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDH_C
|
||||
|
||||
@@ -498,7 +484,7 @@ component_test_tls13_only_ephemeral_ffdh () {
|
||||
cd tests; ./test_suite_ssl; cd ..
|
||||
|
||||
msg "ssl-opt.sh: TLS 1.3 only, only ephemeral ffdh key exchange mode"
|
||||
tests/ssl-opt.sh
|
||||
tests/ssl-opt.sh -f "ffdh"
|
||||
}
|
||||
|
||||
component_test_tls13_only_psk_ephemeral () {
|
||||
@@ -512,10 +498,10 @@ component_test_tls13_only_psk_ephemeral () {
|
||||
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py set MBEDTLS_TEST_HOOKS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py unset PSA_WANT_ALG_RSA_PSS
|
||||
# Note: The two unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
|
||||
@@ -539,11 +525,11 @@ component_test_tls13_only_psk_ephemeral_ffdh () {
|
||||
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py set MBEDTLS_TEST_HOOKS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py unset PSA_WANT_ALG_RSA_PSS
|
||||
# Note: The three unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDH_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
@@ -567,10 +553,10 @@ component_test_tls13_only_psk_all () {
|
||||
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py set MBEDTLS_TEST_HOOKS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py unset PSA_WANT_ALG_RSA_PSS
|
||||
# Note: The two unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
|
||||
|
||||
@@ -284,7 +284,8 @@ component_test_no_platform () {
|
||||
# Use the test alternative implementation of mbedtls_platform_get_entropy()
|
||||
# which is provided in "framework/tests/src/fake_external_rng_for_test.c"
|
||||
# since the default one is excluded in this scenario.
|
||||
scripts/config.py set MBEDTLS_PLATFORM_GET_ENTROPY_ALT
|
||||
scripts/config.py unset MBEDTLS_PSA_BUILTIN_GET_ENTROPY
|
||||
scripts/config.py set MBEDTLS_PSA_DRIVER_GET_ENTROPY
|
||||
# Note, _DEFAULT_SOURCE needs to be defined for platforms using glibc version >2.19,
|
||||
# to re-enable platform integration features otherwise disabled in C99 builds
|
||||
make CC=gcc CFLAGS='-Werror -Wall -Wextra -std=c99 -pedantic -Os -D_DEFAULT_SOURCE' lib programs
|
||||
|
||||
@@ -297,15 +297,6 @@ component_build_sha_armce () {
|
||||
grep -E 'sha256[a-z0-9]+.32\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s
|
||||
scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY
|
||||
|
||||
|
||||
# test the deprecated form of the config option
|
||||
scripts/config.py set MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY
|
||||
msg "MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY clang, thumb"
|
||||
make -B library/../${BUILTIN_SRC_PATH}/sha256.o library/../${BUILTIN_SRC_PATH}/sha256.s CC=clang CFLAGS="--target=arm-linux-gnueabihf -mcpu=cortex-a32+crypto -mthumb"
|
||||
msg "MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY clang, test T32 crypto instructions built"
|
||||
grep -E 'sha256[a-z0-9]+.32\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s
|
||||
scripts/config.py unset MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY
|
||||
|
||||
scripts/config.py set MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
|
||||
msg "MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT clang, aarch64"
|
||||
make -B library/../${BUILTIN_SRC_PATH}/sha256.o library/../${BUILTIN_SRC_PATH}/sha256.s CC=clang CFLAGS="--target=aarch64-linux-gnu -march=armv8-a+crypto"
|
||||
@@ -313,18 +304,6 @@ component_build_sha_armce () {
|
||||
grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s
|
||||
scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
|
||||
|
||||
|
||||
# test the deprecated form of the config option
|
||||
scripts/config.py set MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
|
||||
msg "MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT clang, arm"
|
||||
make -B library/../${BUILTIN_SRC_PATH}/sha256.o library/../${BUILTIN_SRC_PATH}/sha256.s CC=clang CFLAGS="--target=arm-linux-gnueabihf -mcpu=cortex-a72+crypto -marm -std=c99"
|
||||
|
||||
msg "MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT clang, thumb"
|
||||
make -B library/../${BUILTIN_SRC_PATH}/sha256.o library/../${BUILTIN_SRC_PATH}/sha256.s CC=clang CFLAGS="--target=arm-linux-gnueabihf -mcpu=cortex-a32+crypto -mthumb"
|
||||
msg "MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT clang, test T32 crypto instructions built"
|
||||
grep -E 'sha256[a-z0-9]+.32\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s
|
||||
scripts/config.py unset MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
|
||||
|
||||
# examine the disassembly for absence of SHA instructions
|
||||
msg "clang, test A32 crypto instructions not built"
|
||||
make -B library/../${BUILTIN_SRC_PATH}/sha256.s CC=clang CFLAGS="--target=arm-linux-gnueabihf -mcpu=cortex-a72 -marm"
|
||||
|
||||
@@ -78,7 +78,7 @@ component_test_suite_with_psasim()
|
||||
msg "build client library"
|
||||
helper_psasim_config client
|
||||
# PAKE functions are still unsupported from PSASIM
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
|
||||
scripts/config.py unset PSA_WANT_ALG_JPAKE
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
|
||||
helper_psasim_build client
|
||||
|
||||
|
||||
@@ -66,7 +66,7 @@ component_release_test_valgrind_constant_flow_no_asm () {
|
||||
# - or alternatively, build with debug info and manually run the offending
|
||||
# test suite with valgrind --track-origins=yes, then check if the origin
|
||||
# was TEST_CF_SECRET() or something else.
|
||||
msg "build: cmake release GCC, full config minus MBEDTLS_USE_PSA_CRYPTO, minus MBEDTLS_HAVE_ASM with constant flow testing"
|
||||
msg "build: cmake release GCC, full config minus MBEDTLS_HAVE_ASM with constant flow testing"
|
||||
scripts/config.py full
|
||||
scripts/config.py set MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND
|
||||
scripts/config.py unset MBEDTLS_AESNI_C
|
||||
@@ -77,7 +77,7 @@ component_release_test_valgrind_constant_flow_no_asm () {
|
||||
|
||||
# this only shows a summary of the results (how many of each type)
|
||||
# details are left in Testing/<date>/DynamicAnalysis.xml
|
||||
msg "test: some suites (full minus MBEDTLS_USE_PSA_CRYPTO, minus MBEDTLS_HAVE_ASM, valgrind + constant flow)"
|
||||
msg "test: some suites (full minus MBEDTLS_HAVE_ASM, valgrind + constant flow)"
|
||||
make memcheck
|
||||
}
|
||||
|
||||
@@ -150,7 +150,7 @@ component_test_memsan () {
|
||||
|
||||
component_release_test_valgrind () {
|
||||
msg "build: Release (clang)"
|
||||
# default config, in particular without MBEDTLS_USE_PSA_CRYPTO
|
||||
# default config
|
||||
CC=clang cmake -D CMAKE_BUILD_TYPE:String=Release .
|
||||
make
|
||||
|
||||
@@ -178,7 +178,7 @@ component_release_test_valgrind () {
|
||||
|
||||
component_release_test_valgrind_psa () {
|
||||
msg "build: Release, full (clang)"
|
||||
# full config, in particular with MBEDTLS_USE_PSA_CRYPTO
|
||||
# full config
|
||||
scripts/config.py full
|
||||
CC=clang cmake -D CMAKE_BUILD_TYPE:String=Release .
|
||||
make
|
||||
|
||||
+14
-14
@@ -257,23 +257,29 @@ REVERSE_DEPENDENCIES = {
|
||||
'PSA_WANT_ALG_CCM': ['PSA_WANT_ALG_CCM_STAR_NO_TAG'],
|
||||
'PSA_WANT_ALG_CMAC': ['PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128'],
|
||||
|
||||
# These reverse dependencies can be removed as part of issue
|
||||
# tf-psa-crypto#364.
|
||||
'PSA_WANT_ECC_BRAINPOOL_P_R1_256': ['MBEDTLS_ECP_DP_BP256R1_ENABLED'],
|
||||
'PSA_WANT_ECC_BRAINPOOL_P_R1_384': ['MBEDTLS_ECP_DP_BP384R1_ENABLED'],
|
||||
'PSA_WANT_ECC_BRAINPOOL_P_R1_512': ['MBEDTLS_ECP_DP_BP512R1_ENABLED'],
|
||||
'PSA_WANT_ECC_MONTGOMERY_255': ['MBEDTLS_ECP_DP_CURVE25519_ENABLED'],
|
||||
'PSA_WANT_ECC_MONTGOMERY_448': ['MBEDTLS_ECP_DP_CURVE448_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_R1_192': ['MBEDTLS_ECP_DP_SECP192R1_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_R1_224': ['MBEDTLS_ECP_DP_SECP224R1_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_R1_256': ['PSA_WANT_ALG_JPAKE',
|
||||
'MBEDTLS_ECP_DP_SECP256R1_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_R1_384': ['MBEDTLS_ECP_DP_SECP384R1_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_R1_521': ['MBEDTLS_ECP_DP_SECP521R1_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_K1_192': ['MBEDTLS_ECP_DP_SECP192K1_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_K1_256': ['MBEDTLS_ECP_DP_SECP256K1_ENABLED'],
|
||||
|
||||
# Support for secp224[k|r]1 was removed in tfpsacrypto#408 while
|
||||
# secp192[k|r]1 were kept only for internal testing (hidden to the end
|
||||
# user). We need to keep these reverse dependencies here until
|
||||
# symbols are hidden/removed from crypto_config.h.
|
||||
'PSA_WANT_ECC_SECP_R1_192': ['MBEDTLS_ECP_DP_SECP192R1_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_R1_224': ['MBEDTLS_ECP_DP_SECP224R1_ENABLED'],
|
||||
'PSA_WANT_ECC_SECP_K1_192': ['MBEDTLS_ECP_DP_SECP192K1_ENABLED'],
|
||||
|
||||
'PSA_WANT_ALG_ECDSA': ['PSA_WANT_ALG_DETERMINISTIC_ECDSA',
|
||||
'MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED',
|
||||
'MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED',
|
||||
'MBEDTLS_ECDSA_C'],
|
||||
'PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC': [
|
||||
'PSA_WANT_ALG_ECDSA',
|
||||
@@ -287,7 +293,6 @@ REVERSE_DEPENDENCIES = {
|
||||
'MBEDTLS_ECP_RESTARTABLE',
|
||||
'MBEDTLS_PK_PARSE_EC_EXTENDED',
|
||||
'MBEDTLS_PK_PARSE_EC_COMPRESSED',
|
||||
'MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED',
|
||||
'MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED',
|
||||
'MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED',
|
||||
'MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED',
|
||||
@@ -305,15 +310,12 @@ REVERSE_DEPENDENCIES = {
|
||||
'PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY',
|
||||
'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT',
|
||||
'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT',
|
||||
'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE',
|
||||
'MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED'],
|
||||
'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE'],
|
||||
|
||||
'PSA_WANT_ALG_SHA_224': ['MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED',
|
||||
'MBEDTLS_ENTROPY_FORCE_SHA256',
|
||||
'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT',
|
||||
'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY'],
|
||||
'PSA_WANT_ALG_SHA_256': ['MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED',
|
||||
'MBEDTLS_ENTROPY_FORCE_SHA256',
|
||||
'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT',
|
||||
'MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY',
|
||||
'MBEDTLS_LMS_C',
|
||||
@@ -482,9 +484,7 @@ class DomainData:
|
||||
if alg.can_do(crypto_knowledge.AlgorithmCategory.HASH)}
|
||||
|
||||
# Find elliptic curve enabling macros by name.
|
||||
# MBEDTLS_ECP_DP_SECP224K1_ENABLED added to disable it for all curves
|
||||
curve_symbols = self.config_symbols_matching(r'PSA_WANT_ECC_\w+\Z|'
|
||||
r'MBEDTLS_ECP_DP_SECP224K1_ENABLED')
|
||||
curve_symbols = self.config_symbols_matching(r'PSA_WANT_ECC_\w+\Z')
|
||||
|
||||
# Find key exchange enabling macros by name.
|
||||
key_exchange_symbols = self.config_symbols_matching(r'MBEDTLS_KEY_EXCHANGE_\w+_ENABLED\Z')
|
||||
@@ -512,10 +512,10 @@ class DomainData:
|
||||
'curves': ExclusiveDomain(curve_symbols, build_and_test),
|
||||
|
||||
# Hash algorithms. Excluding exclusive domains of MD, RIPEMD, SHA1, SHA3*,
|
||||
# SHA224 and SHA384 because MBEDTLS_ENTROPY_C is extensively used
|
||||
# SHA224 and SHA384 because the built-in entropy module is extensively used
|
||||
# across various modules, but it depends on either SHA256 or SHA512.
|
||||
# As a consequence an "exclusive" test of anything other than SHA256
|
||||
# or SHA512 with MBEDTLS_ENTROPY_C enabled is not possible.
|
||||
# or SHA512 with the built-in entropy module enabled is not possible.
|
||||
'hashes': DualDomain(hash_symbols, build_and_test,
|
||||
exclude=r'PSA_WANT_ALG_(?!SHA_(256|512))'),
|
||||
|
||||
|
||||
@@ -15,11 +15,15 @@ my @public_files = map { basename($_) } glob("../tf-psa-crypto/include/mbedtls/*
|
||||
|
||||
my $public_files_regex = join('|', map { quotemeta($_) } @public_files);
|
||||
|
||||
my @private_files = map { basename($_) } glob("../tf-psa-crypto/include/mbedtls/private/*.h");
|
||||
|
||||
my $private_files_regex = join('|', map { quotemeta($_) } @private_files);
|
||||
|
||||
while (<>) {
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/build_info.h!${1}libtestdriver1/include/mbedtls/build_info.h!;
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/mbedtls_config.h!${1}libtestdriver1/include/mbedtls/mbedtls_config.h!;
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/config_adjust_x509.h!${1}libtestdriver1/include/mbedtls/config_adjust_x509.h!;
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/config_adjust_ssl.h!${1}libtestdriver1/include/mbedtls/config_adjust_ssl.h!;
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/private/config_adjust_x509.h!${1}libtestdriver1/include/mbedtls/private/config_adjust_x509.h!;
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/private/config_adjust_ssl.h!${1}libtestdriver1/include/mbedtls/private/config_adjust_ssl.h!;
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/check_config.h!${1}libtestdriver1/include/mbedtls/check_config.h!;
|
||||
# Files in include/mbedtls and drivers/builtin/include/mbedtls are both
|
||||
# included in files via #include mbedtls/<file>.h, so when expanding to the
|
||||
@@ -28,6 +32,9 @@ while (<>) {
|
||||
if ( $public_files_regex ) {
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/($public_files_regex)!${1}libtestdriver1/tf-psa-crypto/include/mbedtls/${2}!;
|
||||
}
|
||||
if ( $private_files_regex ) {
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/private/($private_files_regex)!${1}libtestdriver1/tf-psa-crypto/include/mbedtls/private/${2}!;
|
||||
}
|
||||
s!^(\s*#\s*include\s*[\"<])mbedtls/!${1}libtestdriver1/tf-psa-crypto/drivers/builtin/include/mbedtls/!;
|
||||
s!^(\s*#\s*include\s*[\"<])psa/!${1}libtestdriver1/tf-psa-crypto/include/psa/!;
|
||||
s!^(\s*#\s*include\s*[\"<])tf-psa-crypto/!${1}libtestdriver1/tf-psa-crypto/include/tf-psa-crypto/!;
|
||||
|
||||
@@ -27,13 +27,9 @@ CLASSIC_DEPENDENCIES = frozenset([
|
||||
'MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS',
|
||||
'MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN',
|
||||
'MBEDTLS_CIPHER_PADDING_ZEROS',
|
||||
#curve#'MBEDTLS_ECP_DP_SECP192R1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_SECP224R1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_SECP256R1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_SECP384R1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_SECP521R1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_SECP192K1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_SECP224K1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_SECP256K1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_BP256R1_ENABLED',
|
||||
#curve#'MBEDTLS_ECP_DP_BP384R1_ENABLED',
|
||||
|
||||
Executable
+63
@@ -0,0 +1,63 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Test the configuration checks generated by generate_config_checks.py.
|
||||
"""
|
||||
|
||||
## Copyright The Mbed TLS Contributors
|
||||
## SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
|
||||
import unittest
|
||||
|
||||
import scripts_path # pylint: disable=unused-import
|
||||
from mbedtls_framework import unittest_config_checks
|
||||
|
||||
|
||||
class MbedtlsTestConfigChecks(unittest_config_checks.TestConfigChecks):
|
||||
"""Mbed TLS unit tests for checks generated by config_checks_generator."""
|
||||
|
||||
#pylint: disable=invalid-name # uppercase letters make sense here
|
||||
|
||||
PROJECT_CONFIG_C = 'library/mbedtls_config.c'
|
||||
PROJECT_SPECIFIC_INCLUDE_DIRECTORIES = [
|
||||
'tf-psa-crypto/include',
|
||||
'tf-psa-crypto/drivers/builtin/include',
|
||||
]
|
||||
|
||||
@unittest.skip("At this time, mbedtls does not go through crypto's check_config.h.")
|
||||
def test_crypto_no_fs_io(self) -> None:
|
||||
"""A sample error expected from crypto's check_config.h."""
|
||||
self.bad_case('#undef MBEDTLS_FS_IO',
|
||||
None,
|
||||
error=('MBEDTLS_PSA_ITS_FILE_C'))
|
||||
|
||||
def test_mbedtls_no_session_tickets_for_early_data(self) -> None:
|
||||
"""An error expected from mbedtls_check_config.h based on the TLS configuration."""
|
||||
self.bad_case(None,
|
||||
'''
|
||||
#define MBEDTLS_SSL_EARLY_DATA
|
||||
#undef MBEDTLS_SSL_SESSION_TICKETS
|
||||
''',
|
||||
error=('MBEDTLS_SSL_EARLY_DATA'))
|
||||
|
||||
def test_mbedtls_no_ecdsa(self) -> None:
|
||||
"""An error expected from mbedtls_check_config.h based on crypto+TLS configuration."""
|
||||
self.bad_case('''
|
||||
#undef PSA_WANT_ALG_ECDSA
|
||||
#undef PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
#undef MBEDTLS_ECDSA_C
|
||||
''',
|
||||
'''
|
||||
#if defined(PSA_WANT_ALG_ECDSA)
|
||||
#error PSA_WANT_ALG_ECDSA unexpected
|
||||
#endif
|
||||
#if defined(PSA_WANT_ALG_DETERMINSTIC_ECDSA)
|
||||
#error PSA_WANT_ALG_DETERMINSTIC_ECDSA unexpected
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECDSA_C)
|
||||
#error MBEDTLS_ECDSA_C unexpected
|
||||
#endif
|
||||
''',
|
||||
error=('MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED'))
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
unittest.main()
|
||||
Reference in New Issue
Block a user