diff --git a/.gitignore b/.gitignore index 789f57ee0f..0f95b4c795 100644 --- a/.gitignore +++ b/.gitignore @@ -31,6 +31,17 @@ massif-* # Python build artifacts: *.pyc +# CMake generates *.dir/ folders for in-tree builds (used by MSVC projects), ignore all of those: +*.dir/ + +# Visual Studio artifacts +/visualc/VS2010/.localhistory/ +/visualc/VS2010/.vs/ +/visualc/VS2010/Debug/ +/visualc/VS2010/Release/ +/visualc/VS2010/*.vcxproj.filters +/visualc/VS2010/*.vcxproj.user + # Generated documentation: /apidoc diff --git a/CMakeLists.txt b/CMakeLists.txt index 5d29839e0e..6115f0588c 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -5,6 +5,9 @@ else() project("mbed TLS" C) endif() +# Set the project root directory. +set(MBEDTLS_DIR ${CMAKE_CURRENT_SOURCE_DIR}) + option(ENABLE_PROGRAMS "Build mbed TLS programs." ON) option(UNSAFE_BUILD "Allow unsafe builds. These builds ARE NOT SECURE." OFF) @@ -121,7 +124,10 @@ if(CMAKE_COMPILER_IS_GNU) # note: starting with CMake 2.8 we could use CMAKE_C_COMPILER_VERSION execute_process(COMMAND ${CMAKE_C_COMPILER} -dumpversion OUTPUT_VARIABLE GCC_VERSION) - set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -W -Wdeclaration-after-statement -Wwrite-strings") + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -Wwrite-strings") + if (GCC_VERSION VERSION_GREATER 4.3 OR GCC_VERSION VERSION_EQUAL 4.3) + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wvla") + endif() if (GCC_VERSION VERSION_GREATER 4.5 OR GCC_VERSION VERSION_EQUAL 4.5) set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wlogical-op") endif() @@ -138,7 +144,7 @@ if(CMAKE_COMPILER_IS_GNU) endif(CMAKE_COMPILER_IS_GNU) if(CMAKE_COMPILER_IS_CLANG) - set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -W -Wdeclaration-after-statement -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow") + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla") set(CMAKE_C_FLAGS_RELEASE "-O2") set(CMAKE_C_FLAGS_DEBUG "-O0 -g3") set(CMAKE_C_FLAGS_COVERAGE "-O0 -g3 --coverage") @@ -216,13 +222,13 @@ if(ENABLE_TESTING) COMMAND mv DartConfiguration.tcl.bak DartConfiguration.tcl ) endif(UNIX) -endif() -# Make scripts needed for testing available in an out-of-source build. -if (NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) - link_to_source(scripts) - # Copy (don't link) DartConfiguration.tcl, needed for memcheck, to - # keep things simple with the sed commands in the memcheck target. - configure_file(${CMAKE_CURRENT_SOURCE_DIR}/DartConfiguration.tcl - ${CMAKE_CURRENT_BINARY_DIR}/DartConfiguration.tcl COPYONLY) + # Make scripts needed for testing available in an out-of-source build. + if (NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) + link_to_source(scripts) + # Copy (don't link) DartConfiguration.tcl, needed for memcheck, to + # keep things simple with the sed commands in the memcheck target. + configure_file(${CMAKE_CURRENT_SOURCE_DIR}/DartConfiguration.tcl + ${CMAKE_CURRENT_BINARY_DIR}/DartConfiguration.tcl COPYONLY) + endif() endif() diff --git a/Makefile b/Makefile index 64321cbfbc..c9eb681cee 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,3 @@ - DESTDIR=/usr/local PREFIX=mbedtls_ diff --git a/configs/config-no-entropy.h b/configs/config-no-entropy.h index 6f44899e49..502ca03200 100644 --- a/configs/config-no-entropy.h +++ b/configs/config-no-entropy.h @@ -81,6 +81,6 @@ /* Miscellaneous options */ #define MBEDTLS_AES_ROM_TABLES -#include "check_config.h" +#include "mbedtls/check_config.h" #endif /* MBEDTLS_CONFIG_H */ diff --git a/configs/config-psa-crypto.h b/configs/config-psa-crypto.h index 97a1b2b682..58a2c88cf5 100644 --- a/configs/config-psa-crypto.h +++ b/configs/config-psa-crypto.h @@ -1971,6 +1971,6 @@ #include MBEDTLS_USER_CONFIG_FILE #endif -#include "check_config.h" +#include "mbedtls/check_config.h" #endif /* MBEDTLS_CONFIG_H */ diff --git a/docs/architecture/mbed-crypto-storage-specification.md b/docs/architecture/mbed-crypto-storage-specification.md index 2c3119fbdc..e7315ebc2a 100644 --- a/docs/architecture/mbed-crypto-storage-specification.md +++ b/docs/architecture/mbed-crypto-storage-specification.md @@ -161,21 +161,21 @@ The library integration and the PSA platform integration use different sets of f It would simplify things to always have a 32-bit owner, with a nonzero value, and thus reserve the range 0–0xffffffff for internal library use. -Mbed Crypto 1.0.1 +Mbed Crypto 1.1.0 ----------------- -Tags: TBD +Tags: mbedcrypto-1.1.0 -Released in May 2019.
+Released in early June 2019.
Integrated in Mbed OS 5.13. Identical to [1.0.0](#mbed-crypto-1.0.0) except for some changes in the key file format. -### Key file format for 1.0.1 +### Key file format for 1.1.0 The key file format is identical to [1.0.0](#key-file-format-for-1.0.0), except for the following changes: -* A new policy field, marked as [NEW:1.0.1] below. +* A new policy field, marked as [NEW:1.1.0] below. * The encoding of key types, algorithms and key material has changed, therefore the storage format is not compatible (despite using the same value in the version field so far). A self-contained description of the file layout follows. @@ -189,7 +189,7 @@ The layout of a key file is: * type (4 bytes): `psa_key_type_t` value * policy usage flags (4 bytes): `psa_key_usage_t` value * policy usage algorithm (4 bytes): `psa_algorithm_t` value -* policy enrollment algorithm (4 bytes): `psa_algorithm_t` value [NEW:1.0.1] +* policy enrollment algorithm (4 bytes): `psa_algorithm_t` value [NEW:1.1.0] * key material length (4 bytes) * key material: output of `psa_export_key` * Any trailing data is rejected on load. diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index dac97f44ef..02f924df45 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -16,7 +16,7 @@ if(INSTALL_MBEDTLS_HEADERS) endif(INSTALL_MBEDTLS_HEADERS) # Make config.h available in an out-of-source build. -if (NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) +if (ENABLE_TESTING AND NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR}) link_to_source(mbedtls) link_to_source(psa) endif() diff --git a/include/mbedtls/aes.h b/include/mbedtls/aes.h index 94e7282d36..63c0f672bb 100644 --- a/include/mbedtls/aes.h +++ b/include/mbedtls/aes.h @@ -42,7 +42,7 @@ #define MBEDTLS_AES_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/aesni.h b/include/mbedtls/aesni.h index a4ca012f8a..955b7c9909 100644 --- a/include/mbedtls/aesni.h +++ b/include/mbedtls/aesni.h @@ -28,12 +28,12 @@ #define MBEDTLS_AESNI_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "aes.h" +#include "mbedtls/aes.h" #define MBEDTLS_AESNI_AES 0x02000000u #define MBEDTLS_AESNI_CLMUL 0x00000002u diff --git a/include/mbedtls/arc4.h b/include/mbedtls/arc4.h index fb044d5b7f..acad623ad3 100644 --- a/include/mbedtls/arc4.h +++ b/include/mbedtls/arc4.h @@ -29,7 +29,7 @@ #define MBEDTLS_ARC4_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/aria.h b/include/mbedtls/aria.h index 1e8956ed13..a72a8c22a3 100644 --- a/include/mbedtls/aria.h +++ b/include/mbedtls/aria.h @@ -31,7 +31,7 @@ #define MBEDTLS_ARIA_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -39,7 +39,7 @@ #include #include -#include "platform_util.h" +#include "mbedtls/platform_util.h" #define MBEDTLS_ARIA_ENCRYPT 1 /**< ARIA encryption. */ #define MBEDTLS_ARIA_DECRYPT 0 /**< ARIA decryption. */ diff --git a/include/mbedtls/asn1.h b/include/mbedtls/asn1.h index f80acd7e11..ab947ab7ef 100644 --- a/include/mbedtls/asn1.h +++ b/include/mbedtls/asn1.h @@ -25,7 +25,7 @@ #define MBEDTLS_ASN1_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -33,7 +33,7 @@ #include #if defined(MBEDTLS_BIGNUM_C) -#include "bignum.h" +#include "mbedtls/bignum.h" #endif /** diff --git a/include/mbedtls/asn1write.h b/include/mbedtls/asn1write.h index 8aa01b43a9..336f2daf1b 100644 --- a/include/mbedtls/asn1write.h +++ b/include/mbedtls/asn1write.h @@ -25,12 +25,12 @@ #define MBEDTLS_ASN1_WRITE_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "asn1.h" +#include "mbedtls/asn1.h" #define MBEDTLS_ASN1_CHK_ADD(g, f) \ do \ diff --git a/include/mbedtls/base64.h b/include/mbedtls/base64.h index 0d024164c5..07ae3bf541 100644 --- a/include/mbedtls/base64.h +++ b/include/mbedtls/base64.h @@ -25,7 +25,7 @@ #define MBEDTLS_BASE64_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/bignum.h b/include/mbedtls/bignum.h index a04a145a86..0b26727f36 100644 --- a/include/mbedtls/bignum.h +++ b/include/mbedtls/bignum.h @@ -25,7 +25,7 @@ #define MBEDTLS_BIGNUM_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/blowfish.h b/include/mbedtls/blowfish.h index f01573dcaf..1e5dba3a39 100644 --- a/include/mbedtls/blowfish.h +++ b/include/mbedtls/blowfish.h @@ -25,7 +25,7 @@ #define MBEDTLS_BLOWFISH_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -33,7 +33,7 @@ #include #include -#include "platform_util.h" +#include "mbedtls/platform_util.h" #define MBEDTLS_BLOWFISH_ENCRYPT 1 #define MBEDTLS_BLOWFISH_DECRYPT 0 diff --git a/include/mbedtls/bn_mul.h b/include/mbedtls/bn_mul.h index c33bd8d4ab..db03ba2c05 100644 --- a/include/mbedtls/bn_mul.h +++ b/include/mbedtls/bn_mul.h @@ -39,12 +39,12 @@ #define MBEDTLS_BN_MUL_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "bignum.h" +#include "mbedtls/bignum.h" #if defined(MBEDTLS_HAVE_ASM) diff --git a/include/mbedtls/camellia.h b/include/mbedtls/camellia.h index 3eeb66366d..a8324543c8 100644 --- a/include/mbedtls/camellia.h +++ b/include/mbedtls/camellia.h @@ -25,7 +25,7 @@ #define MBEDTLS_CAMELLIA_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -33,7 +33,7 @@ #include #include -#include "platform_util.h" +#include "mbedtls/platform_util.h" #define MBEDTLS_CAMELLIA_ENCRYPT 1 #define MBEDTLS_CAMELLIA_DECRYPT 0 diff --git a/include/mbedtls/ccm.h b/include/mbedtls/ccm.h index f03e3b580e..ceac36ca39 100644 --- a/include/mbedtls/ccm.h +++ b/include/mbedtls/ccm.h @@ -50,12 +50,12 @@ #define MBEDTLS_CCM_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "cipher.h" +#include "mbedtls/cipher.h" #define MBEDTLS_ERR_CCM_BAD_INPUT -0x000D /**< Bad input parameters to the function. */ #define MBEDTLS_ERR_CCM_AUTH_FAILED -0x000F /**< Authenticated decryption failed. */ diff --git a/include/mbedtls/certs.h b/include/mbedtls/certs.h deleted file mode 100644 index b7c5708f85..0000000000 --- a/include/mbedtls/certs.h +++ /dev/null @@ -1,106 +0,0 @@ -/** - * \file certs.h - * - * \brief Sample certificates and DHM parameters for testing - */ -/* - * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved - * SPDX-License-Identifier: Apache-2.0 - * - * Licensed under the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT - * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * This file is part of mbed TLS (https://tls.mbed.org) - */ -#ifndef MBEDTLS_CERTS_H -#define MBEDTLS_CERTS_H - -#if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" -#else -#include MBEDTLS_CONFIG_FILE -#endif - -#include - -#ifdef __cplusplus -extern "C" { -#endif - -#if defined(MBEDTLS_PEM_PARSE_C) -/* Concatenation of all CA certificates in PEM format if available */ -extern const char mbedtls_test_cas_pem[]; -extern const size_t mbedtls_test_cas_pem_len; -#endif - -/* List of all CA certificates, terminated by NULL */ -extern const char * mbedtls_test_cas[]; -extern const size_t mbedtls_test_cas_len[]; - -/* - * Convenience for users who just want a certificate: - * RSA by default, or ECDSA if RSA is not available - */ -extern const char * mbedtls_test_ca_crt; -extern const size_t mbedtls_test_ca_crt_len; -extern const char * mbedtls_test_ca_key; -extern const size_t mbedtls_test_ca_key_len; -extern const char * mbedtls_test_ca_pwd; -extern const size_t mbedtls_test_ca_pwd_len; -extern const char * mbedtls_test_srv_crt; -extern const size_t mbedtls_test_srv_crt_len; -extern const char * mbedtls_test_srv_key; -extern const size_t mbedtls_test_srv_key_len; -extern const char * mbedtls_test_cli_crt; -extern const size_t mbedtls_test_cli_crt_len; -extern const char * mbedtls_test_cli_key; -extern const size_t mbedtls_test_cli_key_len; - -#if defined(MBEDTLS_ECDSA_C) -extern const char mbedtls_test_ca_crt_ec[]; -extern const size_t mbedtls_test_ca_crt_ec_len; -extern const char mbedtls_test_ca_key_ec[]; -extern const size_t mbedtls_test_ca_key_ec_len; -extern const char mbedtls_test_ca_pwd_ec[]; -extern const size_t mbedtls_test_ca_pwd_ec_len; -extern const char mbedtls_test_srv_crt_ec[]; -extern const size_t mbedtls_test_srv_crt_ec_len; -extern const char mbedtls_test_srv_key_ec[]; -extern const size_t mbedtls_test_srv_key_ec_len; -extern const char mbedtls_test_cli_crt_ec[]; -extern const size_t mbedtls_test_cli_crt_ec_len; -extern const char mbedtls_test_cli_key_ec[]; -extern const size_t mbedtls_test_cli_key_ec_len; -#endif - -#if defined(MBEDTLS_RSA_C) -extern const char mbedtls_test_ca_crt_rsa[]; -extern const size_t mbedtls_test_ca_crt_rsa_len; -extern const char mbedtls_test_ca_key_rsa[]; -extern const size_t mbedtls_test_ca_key_rsa_len; -extern const char mbedtls_test_ca_pwd_rsa[]; -extern const size_t mbedtls_test_ca_pwd_rsa_len; -extern const char mbedtls_test_srv_crt_rsa[]; -extern const size_t mbedtls_test_srv_crt_rsa_len; -extern const char mbedtls_test_srv_key_rsa[]; -extern const size_t mbedtls_test_srv_key_rsa_len; -extern const char mbedtls_test_cli_crt_rsa[]; -extern const size_t mbedtls_test_cli_crt_rsa_len; -extern const char mbedtls_test_cli_key_rsa[]; -extern const size_t mbedtls_test_cli_key_rsa_len; -#endif - -#ifdef __cplusplus -} -#endif - -#endif /* certs.h */ diff --git a/include/mbedtls/chacha20.h b/include/mbedtls/chacha20.h index 2ae5e6e5f4..243ae63af7 100644 --- a/include/mbedtls/chacha20.h +++ b/include/mbedtls/chacha20.h @@ -34,7 +34,7 @@ #define MBEDTLS_CHACHA20_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/chachapoly.h b/include/mbedtls/chachapoly.h index 49e615d278..3d842ef19e 100644 --- a/include/mbedtls/chachapoly.h +++ b/include/mbedtls/chachapoly.h @@ -34,13 +34,13 @@ #define MBEDTLS_CHACHAPOLY_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif /* for shared error codes */ -#include "poly1305.h" +#include "mbedtls/poly1305.h" #define MBEDTLS_ERR_CHACHAPOLY_BAD_STATE -0x0054 /**< The requested operation is not permitted in the current state. */ #define MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED -0x0056 /**< Authenticated decryption failed: data was not authentic. */ @@ -58,7 +58,7 @@ mbedtls_chachapoly_mode_t; #if !defined(MBEDTLS_CHACHAPOLY_ALT) -#include "chacha20.h" +#include "mbedtls/chacha20.h" typedef struct mbedtls_chachapoly_context { diff --git a/include/mbedtls/cipher.h b/include/mbedtls/cipher.h index ea00703c50..96efd937f8 100644 --- a/include/mbedtls/cipher.h +++ b/include/mbedtls/cipher.h @@ -30,13 +30,13 @@ #define MBEDTLS_CIPHER_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif #include -#include "platform_util.h" +#include "mbedtls/platform_util.h" #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CCM_C) || defined(MBEDTLS_CHACHAPOLY_C) #define MBEDTLS_CIPHER_MODE_AEAD diff --git a/include/mbedtls/cipher_internal.h b/include/mbedtls/cipher_internal.h index 8ea2a98829..5930f0e2a1 100644 --- a/include/mbedtls/cipher_internal.h +++ b/include/mbedtls/cipher_internal.h @@ -27,12 +27,12 @@ #define MBEDTLS_CIPHER_WRAP_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "cipher.h" +#include "mbedtls/cipher.h" #if defined(MBEDTLS_USE_PSA_CRYPTO) #include "psa/crypto.h" diff --git a/include/mbedtls/cmac.h b/include/mbedtls/cmac.h index 9d42b3f209..792fbdc339 100644 --- a/include/mbedtls/cmac.h +++ b/include/mbedtls/cmac.h @@ -29,12 +29,12 @@ #define MBEDTLS_CMAC_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "cipher.h" +#include "mbedtls/cipher.h" #ifdef __cplusplus extern "C" { diff --git a/include/mbedtls/compat-1.3.h b/include/mbedtls/compat-1.3.h index a58b47243d..361cf569cf 100644 --- a/include/mbedtls/compat-1.3.h +++ b/include/mbedtls/compat-1.3.h @@ -26,7 +26,7 @@ */ #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index bd6f7b6a03..e202cb49bc 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -277,28 +277,52 @@ * For example, when a function accepts as input a pointer to a buffer that may * contain untrusted data, and its documentation mentions that this pointer * must not be NULL: - * - the pointer is checked to be non-NULL only if this option is enabled - * - the content of the buffer is always validated + * - The pointer is checked to be non-NULL only if this option is enabled. + * - The content of the buffer is always validated. * * When this flag is defined, if a library function receives a parameter that - * is invalid, it will: - * - invoke the macro MBEDTLS_PARAM_FAILED() which by default expands to a - * call to the function mbedtls_param_failed() - * - immediately return (with a specific error code unless the function - * returns void and can't communicate an error). + * is invalid: + * 1. The function will invoke the macro MBEDTLS_PARAM_FAILED(). + * 2. If MBEDTLS_PARAM_FAILED() did not terminate the program, the function + * will immediately return. If the function returns an Mbed TLS error code, + * the error code in this case is MBEDTLS_ERR_xxx_BAD_INPUT_DATA. * - * When defining this flag, you also need to: - * - either provide a definition of the function mbedtls_param_failed() in - * your application (see platform_util.h for its prototype) as the library - * calls that function, but does not provide a default definition for it, - * - or provide a different definition of the macro MBEDTLS_PARAM_FAILED() - * below if the above mechanism is not flexible enough to suit your needs. - * See the documentation of this macro later in this file. + * When defining this flag, you also need to arrange a definition for + * MBEDTLS_PARAM_FAILED(). You can do this by any of the following methods: + * - By default, the library defines MBEDTLS_PARAM_FAILED() to call a + * function mbedtls_param_failed(), but the library does not define this + * function. If you do not make any other arrangements, you must provide + * the function mbedtls_param_failed() in your application. + * See `platform_util.h` for its prototype. + * - If you enable the macro #MBEDTLS_CHECK_PARAMS_ASSERT, then the + * library defines MBEDTLS_PARAM_FAILED(\c cond) to be `assert(cond)`. + * You can still supply an alternative definition of + * MBEDTLS_PARAM_FAILED(), which may call `assert`. + * - If you define a macro MBEDTLS_PARAM_FAILED() before including `config.h` + * or you uncomment the definition of MBEDTLS_PARAM_FAILED() in `config.h`, + * the library will call the macro that you defined and will not supply + * its own version. Note that if MBEDTLS_PARAM_FAILED() calls `assert`, + * you need to enable #MBEDTLS_CHECK_PARAMS_ASSERT so that library source + * files include ``. * * Uncomment to enable validation of application-controlled parameters. */ //#define MBEDTLS_CHECK_PARAMS +/** + * \def MBEDTLS_CHECK_PARAMS_ASSERT + * + * Allow MBEDTLS_PARAM_FAILED() to call `assert`, and make it default to + * `assert`. This macro is only used if #MBEDTLS_CHECK_PARAMS is defined. + * + * If this macro is not defined, then MBEDTLS_PARAM_FAILED() defaults to + * calling a function mbedtls_param_failed(). See the documentation of + * #MBEDTLS_CHECK_PARAMS for details. + * + * Uncomment to allow MBEDTLS_PARAM_FAILED() to call `assert`. + */ +//#define MBEDTLS_CHECK_PARAMS_ASSERT + /* \} name SECTION: System support */ /** @@ -1007,18 +1031,27 @@ /** * \def MBEDTLS_USE_PSA_CRYPTO * - * Make the X.509 and TLS library use PSA for cryptographic operations, see - * #MBEDTLS_PSA_CRYPTO_C. + * Make the X.509 and TLS library use PSA for cryptographic operations, and + * enable new APIs for using keys handled by PSA Crypto. * - * Note: this option is still in progress, the full X.509 and TLS modules are - * not covered yet, but parts that are not ported to PSA yet will still work - * as usual, so enabling this option should not break backwards compatibility. + * \note Development of this option is currently in progress, and parts of Mbed + * TLS's X.509 and TLS modules are not ported to PSA yet. However, these parts + * will still continue to work as usual, so enabling this option should not + * break backwards compatibility. * - * \warning Support for PSA is still an experimental feature. - * Any public API that depends on this option may change - * at any time until this warning is removed. + * \warning Support for PSA is still an experimental feature. + * Any public API that depends on this option may change + * at any time until this warning is removed. + * + * \warning This option enables new Mbed TLS APIs that are dependent on the + * PSA Crypto API, so can't come with the same stability guarantees as the + * rest of the Mbed TLS APIs. You're welcome to experiment with them, but for + * now, access to these APIs is opt-in (via enabling the present option), in + * order to clearly differentiate them from the stable Mbed TLS APIs. * * Requires: MBEDTLS_PSA_CRYPTO_C. + * + * Uncomment this to enable internal use of PSA Crypto and new associated APIs. */ //#define MBEDTLS_USE_PSA_CRYPTO @@ -1702,6 +1735,10 @@ * * Enable the Platform Security Architecture cryptography API. * + * \warning The PSA Crypto API is still beta status. While you're welcome to + * experiment using it, incompatible API changes are still possible, and some + * parts may not have reached the same quality as the rest of Mbed TLS yet. + * * Module: library/psa_crypto.c * * Requires: MBEDTLS_CTR_DRBG_C, MBEDTLS_ENTROPY_C @@ -1966,6 +2003,42 @@ //#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ //#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ +/** + * \brief This macro is invoked by the library when an invalid parameter + * is detected that is only checked with #MBEDTLS_CHECK_PARAMS + * (see the documentation of that option for context). + * + * When you leave this undefined here, the library provides + * a default definition. If the macro #MBEDTLS_CHECK_PARAMS_ASSERT + * is defined, the default definition is `assert(cond)`, + * otherwise the default definition calls a function + * mbedtls_param_failed(). This function is declared in + * `platform_util.h` for the benefit of the library, but + * you need to define in your application. + * + * When you define this here, this replaces the default + * definition in platform_util.h (which no longer declares the + * function mbedtls_param_failed()) and it is your responsibility + * to make sure this macro expands to something suitable (in + * particular, that all the necessary declarations are visible + * from within the library - you can ensure that by providing + * them in this file next to the macro definition). + * If you define this macro to call `assert`, also define + * #MBEDTLS_CHECK_PARAMS_ASSERT so that library source files + * include ``. + * + * Note that you may define this macro to expand to nothing, in + * which case you don't have to worry about declarations or + * definitions. However, you will then be notified about invalid + * parameters only in non-void functions, and void function will + * just silently return early on invalid parameters, which + * partially negates the benefits of enabling + * #MBEDTLS_CHECK_PARAMS in the first place, so is discouraged. + * + * \param cond The expression that should evaluate to true, but doesn't. + */ +//#define MBEDTLS_PARAM_FAILED( cond ) assert( cond ) + /** * Uncomment the macro to let mbed TLS use your alternate implementation of * mbedtls_platform_zeroize(). This replaces the default implementation in @@ -2016,6 +2089,6 @@ #include MBEDTLS_USER_CONFIG_FILE #endif -#include "check_config.h" +#include "mbedtls/check_config.h" #endif /* MBEDTLS_CONFIG_H */ diff --git a/include/mbedtls/ctr_drbg.h b/include/mbedtls/ctr_drbg.h index cc3df7b113..ffaf8ad79d 100644 --- a/include/mbedtls/ctr_drbg.h +++ b/include/mbedtls/ctr_drbg.h @@ -37,15 +37,15 @@ #define MBEDTLS_CTR_DRBG_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "aes.h" +#include "mbedtls/aes.h" #if defined(MBEDTLS_THREADING_C) -#include "threading.h" +#include "mbedtls/threading.h" #endif #define MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED -0x0034 /**< The entropy source failed. */ diff --git a/include/mbedtls/des.h b/include/mbedtls/des.h index 54e6b7894b..1c80b5365f 100644 --- a/include/mbedtls/des.h +++ b/include/mbedtls/des.h @@ -30,7 +30,7 @@ #define MBEDTLS_DES_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/dhm.h b/include/mbedtls/dhm.h index 49eb6a47e9..831cfd74b8 100644 --- a/include/mbedtls/dhm.h +++ b/include/mbedtls/dhm.h @@ -66,11 +66,11 @@ #define MBEDTLS_DHM_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "bignum.h" +#include "mbedtls/bignum.h" /* * DHM Error codes diff --git a/include/mbedtls/ecdh.h b/include/mbedtls/ecdh.h index 384c3dc076..d870a5bd52 100644 --- a/include/mbedtls/ecdh.h +++ b/include/mbedtls/ecdh.h @@ -35,12 +35,12 @@ #define MBEDTLS_ECDH_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "ecp.h" +#include "mbedtls/ecp.h" #ifdef __cplusplus extern "C" { diff --git a/include/mbedtls/ecdsa.h b/include/mbedtls/ecdsa.h index 2943945518..effbb1ed04 100644 --- a/include/mbedtls/ecdsa.h +++ b/include/mbedtls/ecdsa.h @@ -33,13 +33,13 @@ #define MBEDTLS_ECDSA_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "ecp.h" -#include "md.h" +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" /** * \brief Maximum ECDSA signature size for a given curve bit size diff --git a/include/mbedtls/ecjpake.h b/include/mbedtls/ecjpake.h index 3d8d02ae64..97387c3b48 100644 --- a/include/mbedtls/ecjpake.h +++ b/include/mbedtls/ecjpake.h @@ -41,13 +41,13 @@ * also be use outside TLS. */ #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "ecp.h" -#include "md.h" +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" #ifdef __cplusplus extern "C" { diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h index 1a6ec13c1d..6aa677ad07 100644 --- a/include/mbedtls/ecp.h +++ b/include/mbedtls/ecp.h @@ -37,12 +37,12 @@ #define MBEDTLS_ECP_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "bignum.h" +#include "mbedtls/bignum.h" /* * ECP error codes diff --git a/include/mbedtls/ecp_internal.h b/include/mbedtls/ecp_internal.h index 7625ed48e1..3b6fbf1121 100644 --- a/include/mbedtls/ecp_internal.h +++ b/include/mbedtls/ecp_internal.h @@ -62,7 +62,7 @@ #define MBEDTLS_ECP_INTERNAL_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/entropy.h b/include/mbedtls/entropy.h index ca06dc3c58..06aaffaf79 100644 --- a/include/mbedtls/entropy.h +++ b/include/mbedtls/entropy.h @@ -25,7 +25,7 @@ #define MBEDTLS_ENTROPY_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -33,21 +33,21 @@ #include #if defined(MBEDTLS_SHA512_C) && !defined(MBEDTLS_ENTROPY_FORCE_SHA256) -#include "sha512.h" +#include "mbedtls/sha512.h" #define MBEDTLS_ENTROPY_SHA512_ACCUMULATOR #else #if defined(MBEDTLS_SHA256_C) #define MBEDTLS_ENTROPY_SHA256_ACCUMULATOR -#include "sha256.h" +#include "mbedtls/sha256.h" #endif #endif #if defined(MBEDTLS_THREADING_C) -#include "threading.h" +#include "mbedtls/threading.h" #endif #if defined(MBEDTLS_HAVEGE_C) -#include "havege.h" +#include "mbedtls/havege.h" #endif #define MBEDTLS_ERR_ENTROPY_SOURCE_FAILED -0x003C /**< Critical entropy source failure. */ diff --git a/include/mbedtls/entropy_poll.h b/include/mbedtls/entropy_poll.h index 94dd657eb9..ba42805f06 100644 --- a/include/mbedtls/entropy_poll.h +++ b/include/mbedtls/entropy_poll.h @@ -25,7 +25,7 @@ #define MBEDTLS_ENTROPY_POLL_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/error.h b/include/mbedtls/error.h index bee0fe485a..20a245a065 100644 --- a/include/mbedtls/error.h +++ b/include/mbedtls/error.h @@ -25,7 +25,7 @@ #define MBEDTLS_ERROR_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -100,8 +100,8 @@ * ECP 4 10 (Started from top) * MD 5 5 * HKDF 5 1 (Started from top) - * CIPHER 6 8 - * SSL 6 23 (Started from top) + * CIPHER 6 8 (Started from 0x6080) + * SSL 6 24 (Started from top, plus 0x6000) * SSL 7 32 * * Module dependent error code (5 bits 0x.00.-0x.F8.) diff --git a/include/mbedtls/gcm.h b/include/mbedtls/gcm.h index fd130abd7c..a71a2af467 100644 --- a/include/mbedtls/gcm.h +++ b/include/mbedtls/gcm.h @@ -34,12 +34,12 @@ #define MBEDTLS_GCM_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "cipher.h" +#include "mbedtls/cipher.h" #include diff --git a/include/mbedtls/havege.h b/include/mbedtls/havege.h index 4c1c86087a..acd7e489ab 100644 --- a/include/mbedtls/havege.h +++ b/include/mbedtls/havege.h @@ -25,12 +25,13 @@ #define MBEDTLS_HAVEGE_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif #include +#include #define MBEDTLS_HAVEGE_COLLECT_SIZE 1024 @@ -43,9 +44,9 @@ extern "C" { */ typedef struct mbedtls_havege_state { - int PT1, PT2, offset[2]; - int pool[MBEDTLS_HAVEGE_COLLECT_SIZE]; - int WALK[8192]; + uint32_t PT1, PT2, offset[2]; + uint32_t pool[MBEDTLS_HAVEGE_COLLECT_SIZE]; + uint32_t WALK[8192]; } mbedtls_havege_state; diff --git a/include/mbedtls/hkdf.h b/include/mbedtls/hkdf.h index 40ee64eb03..20f325dd8a 100644 --- a/include/mbedtls/hkdf.h +++ b/include/mbedtls/hkdf.h @@ -28,12 +28,12 @@ #define MBEDTLS_HKDF_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "md.h" +#include "mbedtls/md.h" /** * \name HKDF Error codes diff --git a/include/mbedtls/hmac_drbg.h b/include/mbedtls/hmac_drbg.h index f1289cb306..46536a1f44 100644 --- a/include/mbedtls/hmac_drbg.h +++ b/include/mbedtls/hmac_drbg.h @@ -25,15 +25,15 @@ #define MBEDTLS_HMAC_DRBG_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "md.h" +#include "mbedtls/md.h" #if defined(MBEDTLS_THREADING_C) -#include "threading.h" +#include "mbedtls/threading.h" #endif /* diff --git a/include/mbedtls/md.h b/include/mbedtls/md.h index 69ab21f405..0b0ec91ff5 100644 --- a/include/mbedtls/md.h +++ b/include/mbedtls/md.h @@ -30,7 +30,7 @@ #include #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/md2.h b/include/mbedtls/md2.h index fe97cf08d4..df1d5f7e62 100644 --- a/include/mbedtls/md2.h +++ b/include/mbedtls/md2.h @@ -30,7 +30,7 @@ #define MBEDTLS_MD2_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/md4.h b/include/mbedtls/md4.h index ce703c0ba4..e7accd455c 100644 --- a/include/mbedtls/md4.h +++ b/include/mbedtls/md4.h @@ -30,7 +30,7 @@ #define MBEDTLS_MD4_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/md5.h b/include/mbedtls/md5.h index 6eed6cc864..4206c1fbfd 100644 --- a/include/mbedtls/md5.h +++ b/include/mbedtls/md5.h @@ -29,7 +29,7 @@ #define MBEDTLS_MD5_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/md_internal.h b/include/mbedtls/md_internal.h index 04de482918..267cebadcc 100644 --- a/include/mbedtls/md_internal.h +++ b/include/mbedtls/md_internal.h @@ -29,12 +29,12 @@ #define MBEDTLS_MD_WRAP_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "md.h" +#include "mbedtls/md.h" #ifdef __cplusplus extern "C" { diff --git a/include/mbedtls/memory_buffer_alloc.h b/include/mbedtls/memory_buffer_alloc.h index 705f9a6369..8e77f6f7c8 100644 --- a/include/mbedtls/memory_buffer_alloc.h +++ b/include/mbedtls/memory_buffer_alloc.h @@ -25,7 +25,7 @@ #define MBEDTLS_MEMORY_BUFFER_ALLOC_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/nist_kw.h b/include/mbedtls/nist_kw.h index 3b67b59cd2..b39406f449 100644 --- a/include/mbedtls/nist_kw.h +++ b/include/mbedtls/nist_kw.h @@ -38,12 +38,12 @@ #define MBEDTLS_NIST_KW_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "cipher.h" +#include "mbedtls/cipher.h" #ifdef __cplusplus extern "C" { diff --git a/include/mbedtls/oid.h b/include/mbedtls/oid.h index 17cdba74a7..59ce0206be 100644 --- a/include/mbedtls/oid.h +++ b/include/mbedtls/oid.h @@ -25,22 +25,22 @@ #define MBEDTLS_OID_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "asn1.h" -#include "pk.h" +#include "mbedtls/asn1.h" +#include "mbedtls/pk.h" #include #if defined(MBEDTLS_CIPHER_C) -#include "cipher.h" +#include "mbedtls/cipher.h" #endif #if defined(MBEDTLS_MD_C) -#include "md.h" +#include "mbedtls/md.h" #endif #define MBEDTLS_ERR_OID_NOT_FOUND -0x002E /**< OID is not found. */ diff --git a/include/mbedtls/padlock.h b/include/mbedtls/padlock.h index 721a5d4930..513d72f3d4 100644 --- a/include/mbedtls/padlock.h +++ b/include/mbedtls/padlock.h @@ -29,12 +29,12 @@ #define MBEDTLS_PADLOCK_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "aes.h" +#include "mbedtls/aes.h" #define MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED -0x0030 /**< Input data should be aligned. */ diff --git a/include/mbedtls/pem.h b/include/mbedtls/pem.h index a29e9ce300..f7bf1a6676 100644 --- a/include/mbedtls/pem.h +++ b/include/mbedtls/pem.h @@ -25,7 +25,7 @@ #define MBEDTLS_PEM_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -112,17 +112,27 @@ void mbedtls_pem_free( mbedtls_pem_context *ctx ); * \brief Write a buffer of PEM information from a DER encoded * buffer. * - * \param header header string to write - * \param footer footer string to write - * \param der_data DER data to write - * \param der_len length of the DER data - * \param buf buffer to write to - * \param buf_len length of output buffer - * \param olen total length written / required (if buf_len is not enough) + * \param header The header string to write. + * \param footer The footer string to write. + * \param der_data The DER data to encode. + * \param der_len The length of the DER data \p der_data in Bytes. + * \param buf The buffer to write to. + * \param buf_len The length of the output buffer \p buf in Bytes. + * \param olen The address at which to store the total length written + * or required (if \p buf_len is not enough). * - * \return 0 on success, or a specific PEM or BASE64 error code. On - * MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL olen is the required - * size. + * \note You may pass \c NULL for \p buf and \c 0 for \p buf_len + * to request the length of the resulting PEM buffer in + * `*olen`. + * + * \note This function may be called with overlapping \p der_data + * and \p buf buffers. + * + * \return \c 0 on success. + * \return #MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL if \p buf isn't large + * enough to hold the PEM buffer. In this case, `*olen` holds + * the required minimum size of \p buf. + * \return Another PEM or BASE64 error code on other kinds of failure. */ int mbedtls_pem_write_buffer( const char *header, const char *footer, const unsigned char *der_data, size_t der_len, diff --git a/include/mbedtls/pk.h b/include/mbedtls/pk.h index 0e24b1a5e3..d750004d56 100644 --- a/include/mbedtls/pk.h +++ b/include/mbedtls/pk.h @@ -26,23 +26,23 @@ #define MBEDTLS_PK_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "md.h" +#include "mbedtls/md.h" #if defined(MBEDTLS_RSA_C) -#include "rsa.h" +#include "mbedtls/rsa.h" #endif #if defined(MBEDTLS_ECP_C) -#include "ecp.h" +#include "mbedtls/ecp.h" #endif #if defined(MBEDTLS_ECDSA_C) -#include "ecdsa.h" +#include "mbedtls/ecdsa.h" #endif #if defined(MBEDTLS_USE_PSA_CRYPTO) diff --git a/include/mbedtls/pk_internal.h b/include/mbedtls/pk_internal.h index fc9ba13fe8..7ef6322e40 100644 --- a/include/mbedtls/pk_internal.h +++ b/include/mbedtls/pk_internal.h @@ -26,12 +26,12 @@ #define MBEDTLS_PK_WRAP_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "pk.h" +#include "mbedtls/pk.h" struct mbedtls_pk_info_t { diff --git a/include/mbedtls/pkcs12.h b/include/mbedtls/pkcs12.h index d441357b7f..9d42d7ffe9 100644 --- a/include/mbedtls/pkcs12.h +++ b/include/mbedtls/pkcs12.h @@ -25,14 +25,14 @@ #define MBEDTLS_PKCS12_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "md.h" -#include "cipher.h" -#include "asn1.h" +#include "mbedtls/md.h" +#include "mbedtls/cipher.h" +#include "mbedtls/asn1.h" #include diff --git a/include/mbedtls/pkcs5.h b/include/mbedtls/pkcs5.h index c92185f7a6..bbec7e7ed4 100644 --- a/include/mbedtls/pkcs5.h +++ b/include/mbedtls/pkcs5.h @@ -27,13 +27,13 @@ #define MBEDTLS_PKCS5_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "asn1.h" -#include "md.h" +#include "mbedtls/asn1.h" +#include "mbedtls/md.h" #include #include diff --git a/include/mbedtls/platform.h b/include/mbedtls/platform.h index 801a948bc5..b402f8f972 100644 --- a/include/mbedtls/platform.h +++ b/include/mbedtls/platform.h @@ -34,13 +34,13 @@ #define MBEDTLS_PLATFORM_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif #if defined(MBEDTLS_HAVE_TIME) -#include "platform_time.h" +#include "mbedtls/platform_time.h" #endif #define MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED -0x0070 /**< Hardware accelerator failed */ @@ -256,6 +256,7 @@ int mbedtls_platform_set_snprintf( int (*snprintf_func)( char * s, size_t n, * the destination buffer is too short. */ #if defined(MBEDTLS_PLATFORM_HAS_NON_CONFORMING_VSNPRINTF) +#include /* For Older Windows (inc. MSYS2), we provide our own fixed implementation */ int mbedtls_platform_win32_vsnprintf( char *s, size_t n, const char *fmt, va_list arg ); #endif diff --git a/include/mbedtls/platform_time.h b/include/mbedtls/platform_time.h index 2ed36f56c9..fe484fd75b 100644 --- a/include/mbedtls/platform_time.h +++ b/include/mbedtls/platform_time.h @@ -25,7 +25,7 @@ #define MBEDTLS_PLATFORM_TIME_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/platform_util.h b/include/mbedtls/platform_util.h index dba6d45982..cf0130a84c 100644 --- a/include/mbedtls/platform_util.h +++ b/include/mbedtls/platform_util.h @@ -26,14 +26,14 @@ #define MBEDTLS_PLATFORM_UTIL_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif #include #if defined(MBEDTLS_HAVE_TIME_DATE) -#include "platform_time.h" +#include "mbedtls/platform_time.h" #include #endif /* MBEDTLS_HAVE_TIME_DATE */ @@ -43,6 +43,12 @@ extern "C" { #if defined(MBEDTLS_CHECK_PARAMS) +#if defined(MBEDTLS_CHECK_PARAMS_ASSERT) +/* Allow the user to define MBEDTLS_PARAM_FAILED to something like assert + * (which is what our config.h suggests). */ +#include +#endif /* MBEDTLS_CHECK_PARAMS_ASSERT */ + #if defined(MBEDTLS_PARAM_FAILED) /** An alternative definition of MBEDTLS_PARAM_FAILED has been set in config.h. * @@ -50,6 +56,11 @@ extern "C" { * MBEDTLS_PARAM_FAILED() will expand to a call to mbedtls_param_failed(). */ #define MBEDTLS_PARAM_FAILED_ALT + +#elif defined(MBEDTLS_CHECK_PARAMS_ASSERT) +#define MBEDTLS_PARAM_FAILED( cond ) assert( cond ) +#define MBEDTLS_PARAM_FAILED_ALT + #else /* MBEDTLS_PARAM_FAILED */ #define MBEDTLS_PARAM_FAILED( cond ) \ mbedtls_param_failed( #cond, __FILE__, __LINE__ ) diff --git a/include/mbedtls/poly1305.h b/include/mbedtls/poly1305.h index f0ec44c968..05866a2da6 100644 --- a/include/mbedtls/poly1305.h +++ b/include/mbedtls/poly1305.h @@ -34,7 +34,7 @@ #define MBEDTLS_POLY1305_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/psa_util.h b/include/mbedtls/psa_util.h index b5f0b7fe95..8d18fcc57e 100644 --- a/include/mbedtls/psa_util.h +++ b/include/mbedtls/psa_util.h @@ -29,7 +29,7 @@ #define MBEDTLS_PSA_UTIL_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -38,10 +38,10 @@ #include "psa/crypto.h" -#include "ecp.h" -#include "md.h" -#include "pk.h" -#include "oid.h" +#include "mbedtls/ecp.h" +#include "mbedtls/md.h" +#include "mbedtls/pk.h" +#include "mbedtls/oid.h" #include diff --git a/include/mbedtls/ripemd160.h b/include/mbedtls/ripemd160.h index b42f6d2a95..3c1f5bf50d 100644 --- a/include/mbedtls/ripemd160.h +++ b/include/mbedtls/ripemd160.h @@ -25,7 +25,7 @@ #define MBEDTLS_RIPEMD160_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif @@ -57,7 +57,7 @@ typedef struct mbedtls_ripemd160_context mbedtls_ripemd160_context; #else /* MBEDTLS_RIPEMD160_ALT */ -#include "ripemd160.h" +#include "ripemd160_alt.h" #endif /* MBEDTLS_RIPEMD160_ALT */ /** diff --git a/include/mbedtls/rsa.h b/include/mbedtls/rsa.h index 489f2ed451..840540b0d9 100644 --- a/include/mbedtls/rsa.h +++ b/include/mbedtls/rsa.h @@ -31,16 +31,16 @@ #define MBEDTLS_RSA_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "bignum.h" -#include "md.h" +#include "mbedtls/bignum.h" +#include "mbedtls/md.h" #if defined(MBEDTLS_THREADING_C) -#include "threading.h" +#include "mbedtls/threading.h" #endif /* diff --git a/include/mbedtls/rsa_internal.h b/include/mbedtls/rsa_internal.h index 53abd3c5b0..c1c844ef75 100644 --- a/include/mbedtls/rsa_internal.h +++ b/include/mbedtls/rsa_internal.h @@ -58,12 +58,12 @@ #define MBEDTLS_RSA_INTERNAL_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif -#include "bignum.h" +#include "mbedtls/bignum.h" #ifdef __cplusplus extern "C" { diff --git a/include/mbedtls/sha1.h b/include/mbedtls/sha1.h index bb6ecf05a4..988d2f93d9 100644 --- a/include/mbedtls/sha1.h +++ b/include/mbedtls/sha1.h @@ -32,7 +32,7 @@ #define MBEDTLS_SHA1_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/sha256.h b/include/mbedtls/sha256.h index d64739820c..1c59740219 100644 --- a/include/mbedtls/sha256.h +++ b/include/mbedtls/sha256.h @@ -28,7 +28,7 @@ #define MBEDTLS_SHA256_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/sha512.h b/include/mbedtls/sha512.h index c06ceed1d1..48923e5bc6 100644 --- a/include/mbedtls/sha512.h +++ b/include/mbedtls/sha512.h @@ -27,7 +27,7 @@ #define MBEDTLS_SHA512_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/threading.h b/include/mbedtls/threading.h index 92e6e6b987..cab40f71af 100644 --- a/include/mbedtls/threading.h +++ b/include/mbedtls/threading.h @@ -25,7 +25,7 @@ #define MBEDTLS_THREADING_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/timing.h b/include/mbedtls/timing.h index a965fe0d35..b264a5a95d 100644 --- a/include/mbedtls/timing.h +++ b/include/mbedtls/timing.h @@ -25,7 +25,7 @@ #define MBEDTLS_TIMING_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/version.h b/include/mbedtls/version.h index 79b42b26c2..fd77830447 100644 --- a/include/mbedtls/version.h +++ b/include/mbedtls/version.h @@ -29,7 +29,7 @@ #define MBEDTLS_VERSION_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/mbedtls/xtea.h b/include/mbedtls/xtea.h index b47f553508..2dc0afc737 100644 --- a/include/mbedtls/xtea.h +++ b/include/mbedtls/xtea.h @@ -25,7 +25,7 @@ #define MBEDTLS_XTEA_H #if !defined(MBEDTLS_CONFIG_FILE) -#include "config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/psa/crypto_platform.h b/include/psa/crypto_platform.h index 42cdad32a4..86af08f91b 100644 --- a/include/psa/crypto_platform.h +++ b/include/psa/crypto_platform.h @@ -38,7 +38,7 @@ /* Include the Mbed TLS configuration file, the way Mbed TLS does it * in each of its header files. */ #if !defined(MBEDTLS_CONFIG_FILE) -#include "../mbedtls/config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/psa/crypto_sizes.h b/include/psa/crypto_sizes.h index 09a292b2d5..bcca72482f 100644 --- a/include/psa/crypto_sizes.h +++ b/include/psa/crypto_sizes.h @@ -45,7 +45,7 @@ /* Include the Mbed TLS configuration file, the way Mbed TLS does it * in each of its header files. */ #if !defined(MBEDTLS_CONFIG_FILE) -#include "../mbedtls/config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/include/psa/crypto_struct.h b/include/psa/crypto_struct.h index 453c835655..9e38e53cea 100644 --- a/include/psa/crypto_struct.h +++ b/include/psa/crypto_struct.h @@ -38,7 +38,7 @@ /* Include the Mbed TLS configuration file, the way Mbed TLS does it * in each of its header files. */ #if !defined(MBEDTLS_CONFIG_FILE) -#include "../mbedtls/config.h" +#include "mbedtls/config.h" #else #include MBEDTLS_CONFIG_FILE #endif diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt index 78c233a08c..b1f1fb34c8 100644 --- a/library/CMakeLists.txt +++ b/library/CMakeLists.txt @@ -1,6 +1,14 @@ option(USE_STATIC_MBEDTLS_LIBRARY "Build mbed TLS static library." ON) option(USE_SHARED_MBEDTLS_LIBRARY "Build mbed TLS shared library." OFF) option(LINK_WITH_PTHREAD "Explicitly link mbed TLS library to pthread." OFF) +option(LINK_WITH_TRUSTED_STORAGE "Explicitly link mbed TLS library to trusted_storage." OFF) + +# Set the project root directory if it's not already defined, as may happen if +# the library folder is included directly by a parent project, without +# including the top level CMakeLists.txt. +if(NOT DEFINED MBEDTLS_DIR) + set(MBEDTLS_DIR ${CMAKE_SOURCE_DIR}) +endif() set(src_crypto aes.c @@ -73,9 +81,9 @@ set(src_crypto if(USE_CRYPTO_SUBMODULE) set(src_crypto ${src_crypto} - ${CMAKE_SOURCE_DIR}/library/version.c - ${CMAKE_SOURCE_DIR}/library/version_features.c - ${CMAKE_SOURCE_DIR}/library/error.c + ${MBEDTLS_DIR}/library/version.c + ${MBEDTLS_DIR}/library/version_features.c + ${MBEDTLS_DIR}/library/error.c ) else() set(src_crypto @@ -119,6 +127,10 @@ if(LINK_WITH_PTHREAD) set(libs ${libs} pthread) endif() +if(LINK_WITH_TRUSTED_STORAGE) + set(libs ${libs} trusted_storage) +endif() + if (NOT USE_STATIC_MBEDTLS_LIBRARY AND NOT USE_SHARED_MBEDTLS_LIBRARY) message(FATAL_ERROR "Need to choose static or shared mbedtls build!") endif(NOT USE_STATIC_MBEDTLS_LIBRARY AND NOT USE_SHARED_MBEDTLS_LIBRARY) @@ -134,8 +146,8 @@ if(USE_STATIC_MBEDTLS_LIBRARY) set_target_properties(${mbedcrypto_static_target} PROPERTIES OUTPUT_NAME mbedcrypto) target_link_libraries(${mbedcrypto_static_target} ${libs}) target_include_directories(${mbedcrypto_static_target} - PUBLIC ${CMAKE_SOURCE_DIR}/include/ - PUBLIC ${CMAKE_SOURCE_DIR}/crypto/include/) + PUBLIC ${MBEDTLS_DIR}/include/ + PUBLIC ${MBEDTLS_DIR}/crypto/include/) install(TARGETS ${mbedcrypto_static_target} DESTINATION ${LIB_INSTALL_DIR} @@ -147,8 +159,8 @@ if(USE_SHARED_MBEDTLS_LIBRARY) set_target_properties(mbedcrypto PROPERTIES VERSION 2.17.0 SOVERSION 3) target_link_libraries(mbedcrypto ${libs}) target_include_directories(mbedcrypto - PUBLIC ${CMAKE_SOURCE_DIR}/include/ - PUBLIC ${CMAKE_SOURCE_DIR}/crypto/include/) + PUBLIC ${MBEDTLS_DIR}/include/ + PUBLIC ${MBEDTLS_DIR}/crypto/include/) install(TARGETS mbedcrypto DESTINATION ${LIB_INSTALL_DIR} diff --git a/library/Makefile b/library/Makefile index 2b979b4878..736ce09b22 100644 --- a/library/Makefile +++ b/library/Makefile @@ -2,7 +2,7 @@ # Also see "include/mbedtls/config.h" CFLAGS ?= -O2 -WARNING_CFLAGS ?= -Wall -W -Wdeclaration-after-statement +WARNING_CFLAGS ?= -Wall -Wextra LDFLAGS ?= CRYPTO_INCLUDES ?= -I../include diff --git a/library/dhm.c b/library/dhm.c index fb6937e854..8255632a99 100644 --- a/library/dhm.c +++ b/library/dhm.c @@ -649,12 +649,28 @@ int mbedtls_dhm_parse_dhmfile( mbedtls_dhm_context *dhm, const char *path ) #if defined(MBEDTLS_SELF_TEST) +#if defined(MBEDTLS_PEM_PARSE_C) static const char mbedtls_test_dhm_params[] = "-----BEGIN DH PARAMETERS-----\r\n" "MIGHAoGBAJ419DBEOgmQTzo5qXl5fQcN9TN455wkOL7052HzxxRVMyhYmwQcgJvh\r\n" "1sa18fyfR9OiVEMYglOpkqVoGLN7qd5aQNNi5W7/C+VBdHTBJcGZJyyP5B3qcz32\r\n" "9mLJKudlVudV0Qxk5qUJaPZ/xupz0NyoVpviuiBOI1gNi8ovSXWzAgEC\r\n" "-----END DH PARAMETERS-----\r\n"; +#else /* MBEDTLS_PEM_PARSE_C */ +static const char mbedtls_test_dhm_params[] = { + 0x30, 0x81, 0x87, 0x02, 0x81, 0x81, 0x00, 0x9e, 0x35, 0xf4, 0x30, 0x44, + 0x3a, 0x09, 0x90, 0x4f, 0x3a, 0x39, 0xa9, 0x79, 0x79, 0x7d, 0x07, 0x0d, + 0xf5, 0x33, 0x78, 0xe7, 0x9c, 0x24, 0x38, 0xbe, 0xf4, 0xe7, 0x61, 0xf3, + 0xc7, 0x14, 0x55, 0x33, 0x28, 0x58, 0x9b, 0x04, 0x1c, 0x80, 0x9b, 0xe1, + 0xd6, 0xc6, 0xb5, 0xf1, 0xfc, 0x9f, 0x47, 0xd3, 0xa2, 0x54, 0x43, 0x18, + 0x82, 0x53, 0xa9, 0x92, 0xa5, 0x68, 0x18, 0xb3, 0x7b, 0xa9, 0xde, 0x5a, + 0x40, 0xd3, 0x62, 0xe5, 0x6e, 0xff, 0x0b, 0xe5, 0x41, 0x74, 0x74, 0xc1, + 0x25, 0xc1, 0x99, 0x27, 0x2c, 0x8f, 0xe4, 0x1d, 0xea, 0x73, 0x3d, 0xf6, + 0xf6, 0x62, 0xc9, 0x2a, 0xe7, 0x65, 0x56, 0xe7, 0x55, 0xd1, 0x0c, 0x64, + 0xe6, 0xa5, 0x09, 0x68, 0xf6, 0x7f, 0xc6, 0xea, 0x73, 0xd0, 0xdc, 0xa8, + 0x56, 0x9b, 0xe2, 0xba, 0x20, 0x4e, 0x23, 0x58, 0x0d, 0x8b, 0xca, 0x2f, + 0x49, 0x75, 0xb3, 0x02, 0x01, 0x02 }; +#endif /* MBEDTLS_PEM_PARSE_C */ static const size_t mbedtls_test_dhm_params_len = sizeof( mbedtls_test_dhm_params ); diff --git a/library/ecp.c b/library/ecp.c index 03f5fefd4d..ccc0788c20 100644 --- a/library/ecp.c +++ b/library/ecp.c @@ -2004,8 +2004,10 @@ static unsigned char ecp_pick_window_size( const mbedtls_ecp_group *grp, * Make sure w is within bounds. * (The last test is useful only for very small curves in the test suite.) */ +#if( MBEDTLS_ECP_WINDOW_SIZE < 6 ) if( w > MBEDTLS_ECP_WINDOW_SIZE ) w = MBEDTLS_ECP_WINDOW_SIZE; +#endif if( w >= grp->nbits ) w = 2; diff --git a/library/havege.c b/library/havege.c index 54f897c6e7..ca7dd17fbb 100644 --- a/library/havege.c +++ b/library/havege.c @@ -38,6 +38,7 @@ #include "mbedtls/timing.h" #include "mbedtls/platform_util.h" +#include #include /* ------------------------------------------------------------------------ @@ -54,7 +55,7 @@ * ------------------------------------------------------------------------ */ -#define SWAP(X,Y) { int *T = (X); (X) = (Y); (Y) = T; } +#define SWAP(X,Y) { uint32_t *T = (X); (X) = (Y); (Y) = T; } #define TST1_ENTER if( PTEST & 1 ) { PTEST ^= 3; PTEST >>= 1; #define TST2_ENTER if( PTEST & 1 ) { PTEST ^= 3; PTEST >>= 1; @@ -77,7 +78,7 @@ PTX = (PT1 >> 18) & 7; \ PT1 &= 0x1FFF; \ PT2 &= 0x1FFF; \ - CLK = (int) mbedtls_timing_hardclock(); \ + CLK = (uint32_t) mbedtls_timing_hardclock(); \ \ i = 0; \ A = &WALK[PT1 ]; RES[i++] ^= *A; \ @@ -100,7 +101,7 @@ \ IN = (*A >> (5)) ^ (*A << (27)) ^ CLK; \ *A = (*B >> (6)) ^ (*B << (26)) ^ CLK; \ - *B = IN; CLK = (int) mbedtls_timing_hardclock(); \ + *B = IN; CLK = (uint32_t) mbedtls_timing_hardclock(); \ *C = (*C >> (7)) ^ (*C << (25)) ^ CLK; \ *D = (*D >> (8)) ^ (*D << (24)) ^ CLK; \ \ @@ -158,10 +159,11 @@ */ static void havege_fill( mbedtls_havege_state *hs ) { - int i, n = 0; - int U1, U2, *A, *B, *C, *D; - int PT1, PT2, *WALK, RES[16]; - int PTX, PTY, CLK, PTEST, IN; + size_t n = 0; + size_t i; + uint32_t U1, U2, *A, *B, *C, *D; + uint32_t PT1, PT2, *WALK, RES[16]; + uint32_t PTX, PTY, CLK, PTEST, IN; WALK = hs->WALK; PT1 = hs->PT1; @@ -212,7 +214,7 @@ void mbedtls_havege_free( mbedtls_havege_state *hs ) */ int mbedtls_havege_random( void *p_rng, unsigned char *buf, size_t len ) { - int val; + uint32_t val; size_t use_len; mbedtls_havege_state *hs = (mbedtls_havege_state *) p_rng; unsigned char *p = buf; @@ -220,8 +222,8 @@ int mbedtls_havege_random( void *p_rng, unsigned char *buf, size_t len ) while( len > 0 ) { use_len = len; - if( use_len > sizeof(int) ) - use_len = sizeof(int); + if( use_len > sizeof( val ) ) + use_len = sizeof( val ); if( hs->offset[1] >= MBEDTLS_HAVEGE_COLLECT_SIZE ) havege_fill( hs ); diff --git a/library/psa_crypto.c b/library/psa_crypto.c index b602f19617..41289c607e 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -5922,6 +5922,15 @@ psa_status_t psa_crypto_init( void ) /* Initialize the random generator. */ global_data.entropy_init( &global_data.entropy ); +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) + /* The PSA entropy injection feature depends on using NV seed as an entropy + * source. Add NV seed as an entropy source for PSA entropy injection. */ + mbedtls_entropy_add_source( &global_data.entropy, + mbedtls_nv_seed_poll, NULL, + MBEDTLS_ENTROPY_BLOCK_SIZE, + MBEDTLS_ENTROPY_SOURCE_STRONG ); +#endif mbedtls_ctr_drbg_init( &global_data.ctr_drbg ); global_data.rng_state = RNG_INITIALIZED; status = mbedtls_to_psa_error( diff --git a/library/psa_crypto_its.h b/library/psa_crypto_its.h index 44d51982a4..3809787607 100644 --- a/library/psa_crypto_its.h +++ b/library/psa_crypto_its.h @@ -91,6 +91,7 @@ psa_status_t psa_its_set(psa_storage_uid_t uid, * \param[in] data_offset The starting offset of the data requested * \param[in] data_length the amount of data requested (and the minimum allocated size of the `p_data` buffer) * \param[out] p_data The buffer where the data will be placed upon successful completion + * \param[out] p_data_length The amount of data returned in the p_data buffer * * * \return A status indicating the success/failure of the operation @@ -106,7 +107,8 @@ psa_status_t psa_its_set(psa_storage_uid_t uid, psa_status_t psa_its_get(psa_storage_uid_t uid, uint32_t data_offset, uint32_t data_length, - void *p_data); + void *p_data, + size_t *p_data_length ); /** * \brief Retrieve the metadata about the provided uid diff --git a/library/psa_crypto_se.c b/library/psa_crypto_se.c index 58b0f38079..bc73251808 100644 --- a/library/psa_crypto_se.c +++ b/library/psa_crypto_se.c @@ -148,17 +148,23 @@ psa_status_t psa_load_se_persistent_data( { psa_status_t status; psa_storage_uid_t uid; + size_t length; status = psa_get_se_driver_its_file_uid( driver, &uid ); if( status != PSA_SUCCESS ) return( status ); + /* Read the amount of persistent data that the driver requests. + * If the data in storage is larger, it is truncated. If the data + * in storage is smaller, silently keep what is already at the end + * of the output buffer. */ /* psa_get_se_driver_its_file_uid ensures that the size_t * persistent_data_size is in range, but compilers don't know that, * so cast to reassure them. */ return( psa_its_get( uid, 0, (uint32_t) driver->internal.persistent_data_size, - driver->internal.persistent_data ) ); + driver->internal.persistent_data, + &length ) ); } psa_status_t psa_save_se_persistent_data( diff --git a/library/psa_crypto_storage.c b/library/psa_crypto_storage.c index 55fd65af98..a27442cd90 100644 --- a/library/psa_crypto_storage.c +++ b/library/psa_crypto_storage.c @@ -102,12 +102,15 @@ static psa_status_t psa_crypto_storage_load( const psa_key_file_id_t key, psa_status_t status; psa_storage_uid_t data_identifier = psa_its_identifier_of_slot( key ); struct psa_storage_info_t data_identifier_info; + size_t data_length = 0; status = psa_its_get_info( data_identifier, &data_identifier_info ); if( status != PSA_SUCCESS ) return( status ); - status = psa_its_get( data_identifier, 0, (uint32_t) data_size, data ); + status = psa_its_get( data_identifier, 0, (uint32_t) data_size, data, &data_length ); + if( data_size != data_length ) + return( PSA_ERROR_STORAGE_FAILURE ); return( status ); } @@ -433,9 +436,16 @@ psa_status_t psa_crypto_save_transaction( void ) psa_status_t psa_crypto_load_transaction( void ) { - return( psa_its_get( PSA_CRYPTO_ITS_TRANSACTION_UID, 0, - sizeof( psa_crypto_transaction ), - &psa_crypto_transaction ) ); + psa_status_t status; + size_t length; + status = psa_its_get( PSA_CRYPTO_ITS_TRANSACTION_UID, 0, + sizeof( psa_crypto_transaction ), + &psa_crypto_transaction, &length ); + if( status != PSA_SUCCESS ) + return( status ); + if( length != sizeof( psa_crypto_transaction ) ) + return( PSA_ERROR_STORAGE_FAILURE ); + return( PSA_SUCCESS ); } psa_status_t psa_crypto_stop_transaction( void ) diff --git a/library/psa_its_file.c b/library/psa_its_file.c index 8cdf783a7b..05ca8afc79 100644 --- a/library/psa_its_file.c +++ b/library/psa_its_file.c @@ -44,7 +44,9 @@ #include #include +#if !defined(PSA_ITS_STORAGE_PREFIX) #define PSA_ITS_STORAGE_PREFIX "" +#endif #define PSA_ITS_STORAGE_FILENAME_PATTERN "%08lx%08lx" #define PSA_ITS_STORAGE_SUFFIX ".psa_its" @@ -137,7 +139,8 @@ psa_status_t psa_its_get_info( psa_storage_uid_t uid, psa_status_t psa_its_get( psa_storage_uid_t uid, uint32_t data_offset, uint32_t data_length, - void *p_data ) + void *p_data, + size_t *p_data_length ) { psa_status_t status; FILE *stream = NULL; @@ -172,6 +175,8 @@ psa_status_t psa_its_get( psa_storage_uid_t uid, if( n != data_length ) goto exit; status = PSA_SUCCESS; + if( p_data_length != NULL ) + *p_data_length = n; exit: if( stream != NULL ) diff --git a/library/timing.c b/library/timing.c index 413d133fb6..009516a6e3 100644 --- a/library/timing.c +++ b/library/timing.c @@ -51,7 +51,6 @@ #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32) #include -#include #include struct _hr_time diff --git a/library/version_features.c b/library/version_features.c index 57015986c8..cd75cc0f7b 100644 --- a/library/version_features.c +++ b/library/version_features.c @@ -31,7 +31,7 @@ #include -static const char *features[] = { +static const char * const features[] = { #if defined(MBEDTLS_VERSION_FEATURES) #if defined(MBEDTLS_HAVE_ASM) "MBEDTLS_HAVE_ASM", @@ -90,6 +90,9 @@ static const char *features[] = { #if defined(MBEDTLS_CHECK_PARAMS) "MBEDTLS_CHECK_PARAMS", #endif /* MBEDTLS_CHECK_PARAMS */ +#if defined(MBEDTLS_CHECK_PARAMS_ASSERT) + "MBEDTLS_CHECK_PARAMS_ASSERT", +#endif /* MBEDTLS_CHECK_PARAMS_ASSERT */ #if defined(MBEDTLS_TIMING_ALT) "MBEDTLS_TIMING_ALT", #endif /* MBEDTLS_TIMING_ALT */ @@ -597,7 +600,7 @@ static const char *features[] = { int mbedtls_version_check_feature( const char *feature ) { - const char **idx = features; + const char * const *idx = features; if( *idx == NULL ) return( -2 ); diff --git a/programs/Makefile b/programs/Makefile index c7cc9953e2..1a69b7469f 100644 --- a/programs/Makefile +++ b/programs/Makefile @@ -2,8 +2,8 @@ # To compile on SunOS: add "-lsocket -lnsl" to LDFLAGS CFLAGS ?= -O2 -WARNING_CFLAGS ?= -Wall -W -Wdeclaration-after-statement -WARNING_CXXFLAGS ?= -Wall -W +WARNING_CFLAGS ?= -Wall -Wextra +WARNING_CXXFLAGS ?= -Wall -Wextra LDFLAGS ?= LOCAL_CFLAGS = $(WARNING_CFLAGS) -I../include -D_FILE_OFFSET_BITS=64 @@ -244,6 +244,7 @@ psa/crypto_examples$(EXEXT): psa/crypto_examples.c $(DEP) clean: ifndef WINDOWS rm -f $(APPS) $(EXTRA_GENERATED) + -rm -f test/cpp_dummy_build$(EXEXT) else if exist *.o del /S /Q /F *.o if exist *.exe del /S /Q /F *.exe diff --git a/programs/aes/aescrypt2.c b/programs/aes/aescrypt2.c index bdeac3afc8..8242ea7c9e 100644 --- a/programs/aes/aescrypt2.c +++ b/programs/aes/aescrypt2.c @@ -80,17 +80,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/aes/crypt_and_hash.c b/programs/aes/crypt_and_hash.c index f58e6166dc..a5acf5b8bf 100644 --- a/programs/aes/crypt_and_hash.c +++ b/programs/aes/crypt_and_hash.c @@ -82,17 +82,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/hash/generic_sum.c b/programs/hash/generic_sum.c index 4b7fe37be5..709a149e0e 100644 --- a/programs/hash/generic_sum.c +++ b/programs/hash/generic_sum.c @@ -52,17 +52,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif static int generic_wrapper( const mbedtls_md_info_t *md_info, char *filename, unsigned char *sum ) { diff --git a/programs/hash/hello.c b/programs/hash/hello.c index 6046f868cd..55a0c7e74b 100644 --- a/programs/hash/hello.c +++ b/programs/hash/hello.c @@ -48,17 +48,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( void ) { diff --git a/programs/pkey/dh_genprime.c b/programs/pkey/dh_genprime.c index cca43ca59a..bf5482ed0a 100644 --- a/programs/pkey/dh_genprime.c +++ b/programs/pkey/dh_genprime.c @@ -69,17 +69,6 @@ int main( void ) */ #define GENERATOR "4" -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char **argv ) { diff --git a/programs/pkey/ecdh_curve25519.c b/programs/pkey/ecdh_curve25519.c index 9267c7ef5a..9f849dd29d 100644 --- a/programs/pkey/ecdh_curve25519.c +++ b/programs/pkey/ecdh_curve25519.c @@ -53,17 +53,6 @@ int main( void ) #include "mbedtls/ctr_drbg.h" #include "mbedtls/ecdh.h" -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/ecdsa.c b/programs/pkey/ecdsa.c index 4471a201e5..b851c3173a 100644 --- a/programs/pkey/ecdsa.c +++ b/programs/pkey/ecdsa.c @@ -100,17 +100,6 @@ static void dump_pubkey( const char *title, mbedtls_ecdsa_context *key ) #define dump_pubkey( a, b ) #endif -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/gen_key.c b/programs/pkey/gen_key.c index 35fc1498fb..23e4e145c6 100644 --- a/programs/pkey/gen_key.c +++ b/programs/pkey/gen_key.c @@ -137,17 +137,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif /* * global options diff --git a/programs/pkey/key_app.c b/programs/pkey/key_app.c index b4860fe048..19dcdfe494 100644 --- a/programs/pkey/key_app.c +++ b/programs/pkey/key_app.c @@ -64,7 +64,6 @@ " password_file=%%s default: \"\"\n" \ "\n" - #if !defined(MBEDTLS_BIGNUM_C) || \ !defined(MBEDTLS_PK_PARSE_C) || !defined(MBEDTLS_FS_IO) int main( void ) @@ -75,17 +74,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif /* * global options diff --git a/programs/pkey/key_app_writer.c b/programs/pkey/key_app_writer.c index b81530cebc..60964292b9 100644 --- a/programs/pkey/key_app_writer.c +++ b/programs/pkey/key_app_writer.c @@ -98,17 +98,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif /* * global options diff --git a/programs/pkey/mpi_demo.c b/programs/pkey/mpi_demo.c index 80573c0ed0..ecdcd329a1 100644 --- a/programs/pkey/mpi_demo.c +++ b/programs/pkey/mpi_demo.c @@ -50,17 +50,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( void ) { diff --git a/programs/pkey/pk_decrypt.c b/programs/pkey/pk_decrypt.c index 978f39ef1d..bf425079e2 100644 --- a/programs/pkey/pk_decrypt.c +++ b/programs/pkey/pk_decrypt.c @@ -48,7 +48,6 @@ #include #endif - #if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_PK_PARSE_C) || \ !defined(MBEDTLS_FS_IO) || !defined(MBEDTLS_ENTROPY_C) || \ !defined(MBEDTLS_CTR_DRBG_C) @@ -61,17 +60,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/pk_encrypt.c b/programs/pkey/pk_encrypt.c index 806c59aae8..a32b147615 100644 --- a/programs/pkey/pk_encrypt.c +++ b/programs/pkey/pk_encrypt.c @@ -61,17 +61,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/pk_sign.c b/programs/pkey/pk_sign.c index 7354082f11..47a098a1a1 100644 --- a/programs/pkey/pk_sign.c +++ b/programs/pkey/pk_sign.c @@ -60,17 +60,6 @@ int main( void ) #include #include -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/pk_verify.c b/programs/pkey/pk_verify.c index 9fcf029b8a..a6bfe3f297 100644 --- a/programs/pkey/pk_verify.c +++ b/programs/pkey/pk_verify.c @@ -56,17 +56,6 @@ int main( void ) #include #include -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { @@ -112,7 +101,6 @@ int main( int argc, char *argv[] ) goto exit; } - i = fread( buf, 1, sizeof(buf), f ); fclose( f ); diff --git a/programs/pkey/rsa_decrypt.c b/programs/pkey/rsa_decrypt.c index dc8a9200d5..ff71bd0553 100644 --- a/programs/pkey/rsa_decrypt.c +++ b/programs/pkey/rsa_decrypt.c @@ -59,17 +59,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/rsa_encrypt.c b/programs/pkey/rsa_encrypt.c index e9effe806a..4a71c15dd1 100644 --- a/programs/pkey/rsa_encrypt.c +++ b/programs/pkey/rsa_encrypt.c @@ -59,17 +59,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/rsa_genkey.c b/programs/pkey/rsa_genkey.c index c66f4e7bd5..f2b7b5078b 100644 --- a/programs/pkey/rsa_genkey.c +++ b/programs/pkey/rsa_genkey.c @@ -63,17 +63,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( void ) { diff --git a/programs/pkey/rsa_sign.c b/programs/pkey/rsa_sign.c index f014872027..9bcd7a6270 100644 --- a/programs/pkey/rsa_sign.c +++ b/programs/pkey/rsa_sign.c @@ -56,17 +56,6 @@ int main( void ) #include #include -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/rsa_sign_pss.c b/programs/pkey/rsa_sign_pss.c index cb69fa6ed8..5019f28f5b 100644 --- a/programs/pkey/rsa_sign_pss.c +++ b/programs/pkey/rsa_sign_pss.c @@ -60,17 +60,6 @@ int main( void ) #include #include -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/rsa_verify.c b/programs/pkey/rsa_verify.c index 5d1c0851e1..94f0ef9ce9 100644 --- a/programs/pkey/rsa_verify.c +++ b/programs/pkey/rsa_verify.c @@ -55,17 +55,6 @@ int main( void ) #include #include -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/pkey/rsa_verify_pss.c b/programs/pkey/rsa_verify_pss.c index d745274bff..de28337c8d 100644 --- a/programs/pkey/rsa_verify_pss.c +++ b/programs/pkey/rsa_verify_pss.c @@ -59,17 +59,6 @@ int main( void ) #include #include -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { @@ -124,7 +113,6 @@ int main( int argc, char *argv[] ) goto exit; } - i = fread( buf, 1, MBEDTLS_MPI_MAX_SIZE, f ); fclose( f ); diff --git a/programs/random/gen_entropy.c b/programs/random/gen_entropy.c index 3b350ede2f..6ae63b725d 100644 --- a/programs/random/gen_entropy.c +++ b/programs/random/gen_entropy.c @@ -51,17 +51,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/random/gen_random_ctr_drbg.c b/programs/random/gen_random_ctr_drbg.c index a50402f19f..59df34b665 100644 --- a/programs/random/gen_random_ctr_drbg.c +++ b/programs/random/gen_random_ctr_drbg.c @@ -54,17 +54,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/random/gen_random_havege.c b/programs/random/gen_random_havege.c index ef888ff61b..5ea52aec9b 100644 --- a/programs/random/gen_random_havege.c +++ b/programs/random/gen_random_havege.c @@ -52,17 +52,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/test/benchmark.c b/programs/test/benchmark.c index e31faafeb3..2b86566925 100644 --- a/programs/test/benchmark.c +++ b/programs/test/benchmark.c @@ -258,17 +258,6 @@ typedef struct { rsa, dhm, ecdsa, ecdh; } todo_list; -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif int main( int argc, char *argv[] ) { diff --git a/programs/test/cmake_subproject/.gitignore b/programs/test/cmake_subproject/.gitignore new file mode 100644 index 0000000000..464833b932 --- /dev/null +++ b/programs/test/cmake_subproject/.gitignore @@ -0,0 +1,3 @@ +build +Makefile +cmake_subproject diff --git a/programs/test/cmake_subproject/CMakeLists.txt b/programs/test/cmake_subproject/CMakeLists.txt new file mode 100644 index 0000000000..3afbdb21e3 --- /dev/null +++ b/programs/test/cmake_subproject/CMakeLists.txt @@ -0,0 +1,17 @@ +cmake_minimum_required(VERSION 2.6) + +# We use the parent Mbed TLS directory as the MBEDTLS_DIR for this test. Other +# projects that use Mbed TLS as a subproject are likely to add by their own +# relative paths. +set(MBEDTLS_DIR ../../../) + +# Add Mbed TLS as a subdirectory. +add_subdirectory(${MBEDTLS_DIR} build) + +# Link against the Mbed Crypto library. +set(libs + mbedcrypto +) + +add_executable(cmake_subproject cmake_subproject.c) +target_link_libraries(cmake_subproject ${libs}) diff --git a/programs/test/cmake_subproject/cmake_subproject.c b/programs/test/cmake_subproject/cmake_subproject.c new file mode 100644 index 0000000000..ca899bcaf4 --- /dev/null +++ b/programs/test/cmake_subproject/cmake_subproject.c @@ -0,0 +1,56 @@ +/* + * Simple program to test that CMake builds with Mbed TLS as a subdirectory + * work correctly. + * + * Copyright (C) 2006-2019, ARM Limited, All Rights Reserved + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * This file is part of mbed TLS (https://tls.mbed.org) + */ + +#if !defined(MBEDTLS_CONFIG_FILE) +#include "mbedtls/config.h" +#else +#include MBEDTLS_CONFIG_FILE +#endif + +#if defined(MBEDTLS_PLATFORM_C) +#include "mbedtls/platform.h" +#else +#include +#include +#define mbedtls_fprintf fprintf +#define mbedtls_printf printf +#define mbedtls_exit exit +#define MBEDTLS_EXIT_SUCCESS EXIT_SUCCESS +#define MBEDTLS_EXIT_FAILURE EXIT_FAILURE +#endif /* MBEDTLS_PLATFORM_C */ + +#include "mbedtls/version.h" + +/* The main reason to build this is for testing the CMake build, so the program + * doesn't need to do very much. It calls a single library function to ensure + * linkage works, but that is all. */ +int main() +{ + /* This version string is 18 bytes long, as advised by version.h. */ + char version[18]; + + mbedtls_version_get_string_full( version ); + + mbedtls_printf( "Built against %s\n", version ); + + return( 0 ); +} diff --git a/programs/test/cpp_dummy_build.cpp b/programs/test/cpp_dummy_build.cpp index c1dc7433db..81ca32c8fe 100644 --- a/programs/test/cpp_dummy_build.cpp +++ b/programs/test/cpp_dummy_build.cpp @@ -38,13 +38,13 @@ #include "mbedtls/bn_mul.h" #include "mbedtls/camellia.h" #include "mbedtls/ccm.h" -#include "mbedtls/certs.h" #include "mbedtls/chacha20.h" #include "mbedtls/chachapoly.h" #include "mbedtls/check_config.h" #include "mbedtls/cipher.h" #include "mbedtls/cipher_internal.h" #include "mbedtls/cmac.h" +#include "mbedtls/compat-1.3.h" #include "mbedtls/ctr_drbg.h" #include "mbedtls/des.h" #include "mbedtls/dhm.h" diff --git a/programs/test/query_config.c b/programs/test/query_config.c index ee754d9b05..f57ca31076 100644 --- a/programs/test/query_config.c +++ b/programs/test/query_config.c @@ -47,7 +47,6 @@ #include "mbedtls/blowfish.h" #include "mbedtls/camellia.h" #include "mbedtls/ccm.h" -#include "mbedtls/certs.h" #include "mbedtls/chacha20.h" #include "mbedtls/chachapoly.h" #include "mbedtls/cipher.h" @@ -269,6 +268,14 @@ int query_config( const char *config ) } #endif /* MBEDTLS_CHECK_PARAMS */ +#if defined(MBEDTLS_CHECK_PARAMS_ASSERT) + if( strcmp( "MBEDTLS_CHECK_PARAMS_ASSERT", config ) == 0 ) + { + MACRO_EXPANSION_TO_STR( MBEDTLS_CHECK_PARAMS_ASSERT ); + return( 0 ); + } +#endif /* MBEDTLS_CHECK_PARAMS_ASSERT */ + #if defined(MBEDTLS_TIMING_ALT) if( strcmp( "MBEDTLS_TIMING_ALT", config ) == 0 ) { diff --git a/programs/test/selftest.c b/programs/test/selftest.c index fac7e92042..638ef70388 100644 --- a/programs/test/selftest.c +++ b/programs/test/selftest.c @@ -76,17 +76,6 @@ #include "mbedtls/memory_buffer_alloc.h" #endif -#if defined(MBEDTLS_CHECK_PARAMS) -#include "mbedtls/platform_util.h" -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif static int test_snprintf( size_t n, const char ref_buf[10], int ref_ret ) { diff --git a/programs/util/pem2der.c b/programs/util/pem2der.c index 0cc9d06644..f184939266 100644 --- a/programs/util/pem2der.c +++ b/programs/util/pem2der.c @@ -65,17 +65,6 @@ int main( void ) } #else -#if defined(MBEDTLS_CHECK_PARAMS) -#define mbedtls_exit exit -void mbedtls_param_failed( const char *failure_condition, - const char *file, - int line ) -{ - mbedtls_printf( "%s:%i: Input param failed - %s\n", - file, line, failure_condition ); - mbedtls_exit( MBEDTLS_EXIT_FAILURE ); -} -#endif /* * global options diff --git a/scripts/abi_check.py b/scripts/abi_check.py index 30c3fe5172..533aaea3dc 100755 --- a/scripts/abi_check.py +++ b/scripts/abi_check.py @@ -59,9 +59,7 @@ class AbiChecker(object): @staticmethod def check_repo_path(): - current_dir = os.path.realpath('.') - root_dir = os.path.dirname(os.path.dirname(os.path.realpath(__file__))) - if current_dir != root_dir: + if not all(os.path.isdir(d) for d in ["include", "library", "tests"]): raise Exception("Must be run from Mbed TLS root") def _setup_logger(self): @@ -108,6 +106,12 @@ class AbiChecker(object): stderr=subprocess.STDOUT ) self.log.debug(worktree_output.decode("utf-8")) + version.commit = subprocess.check_output( + [self.git_command, "rev-parse", worktree_rev], + cwd=git_worktree_path, + stderr=subprocess.STDOUT + ).decode("ascii").rstrip() + self.log.debug("Commit is {}".format(version.commit)) return git_worktree_path def _update_git_submodules(self, git_worktree_path, version): @@ -163,6 +167,13 @@ class AbiChecker(object): os.path.join(root, file) ) + @staticmethod + def _pretty_revision(version): + if version.revision == version.commit: + return version.revision + else: + return "{} ({})".format(version.revision, version.commit) + def _get_abi_dumps_from_shared_libraries(self, version): """Generate the ABI dumps for the specified git revision. The shared libraries must have been built and the module paths @@ -177,7 +188,7 @@ class AbiChecker(object): "abi-dumper", module_path, "-o", output_path, - "-lver", version.revision + "-lver", self._pretty_revision(version), ] abi_dump_output = subprocess.check_output( abi_dump_command, @@ -214,7 +225,7 @@ class AbiChecker(object): def _remove_extra_detail_from_report(self, report_root): for tag in ['test_info', 'test_results', 'problem_summary', - 'added_symbols', 'removed_symbols', 'affected']: + 'added_symbols', 'affected']: self._remove_children_with_tag(report_root, tag) for report in report_root: @@ -222,69 +233,84 @@ class AbiChecker(object): if not problems.getchildren(): report.remove(problems) + def _abi_compliance_command(self, mbed_module, output_path): + """Build the command to run to analyze the library mbed_module. + The report will be placed in output_path.""" + abi_compliance_command = [ + "abi-compliance-checker", + "-l", mbed_module, + "-old", self.old_version.abi_dumps[mbed_module], + "-new", self.new_version.abi_dumps[mbed_module], + "-strict", + "-report-path", output_path, + ] + if self.skip_file: + abi_compliance_command += ["-skip-symbols", self.skip_file, + "-skip-types", self.skip_file] + if self.brief: + abi_compliance_command += ["-report-format", "xml", + "-stdout"] + return abi_compliance_command + + def _is_library_compatible(self, mbed_module, compatibility_report): + """Test if the library mbed_module has remained compatible. + Append a message regarding compatibility to compatibility_report.""" + output_path = os.path.join( + self.report_dir, "{}-{}-{}.html".format( + mbed_module, self.old_version.revision, + self.new_version.revision + ) + ) + try: + subprocess.check_output( + self._abi_compliance_command(mbed_module, output_path), + stderr=subprocess.STDOUT + ) + except subprocess.CalledProcessError as err: + if err.returncode != 1: + raise err + if self.brief: + self.log.info( + "Compatibility issues found for {}".format(mbed_module) + ) + report_root = ET.fromstring(err.output.decode("utf-8")) + self._remove_extra_detail_from_report(report_root) + self.log.info(ET.tostring(report_root).decode("utf-8")) + else: + self.can_remove_report_dir = False + compatibility_report.append( + "Compatibility issues found for {}, " + "for details see {}".format(mbed_module, output_path) + ) + return False + compatibility_report.append( + "No compatibility issues for {}".format(mbed_module) + ) + if not (self.keep_all_reports or self.brief): + os.remove(output_path) + return True + def get_abi_compatibility_report(self): """Generate a report of the differences between the reference ABI and the new ABI. ABI dumps from self.old_version and self.new_version must be available.""" - compatibility_report = "" + compatibility_report = ["Checking evolution from {} to {}".format( + self._pretty_revision(self.old_version), + self._pretty_revision(self.new_version) + )] compliance_return_code = 0 shared_modules = list(set(self.old_version.modules.keys()) & set(self.new_version.modules.keys())) for mbed_module in shared_modules: - output_path = os.path.join( - self.report_dir, "{}-{}-{}.html".format( - mbed_module, self.old_version.revision, - self.new_version.revision - ) - ) - abi_compliance_command = [ - "abi-compliance-checker", - "-l", mbed_module, - "-old", self.old_version.abi_dumps[mbed_module], - "-new", self.new_version.abi_dumps[mbed_module], - "-strict", - "-report-path", output_path, - ] - if self.skip_file: - abi_compliance_command += ["-skip-symbols", self.skip_file, - "-skip-types", self.skip_file] - if self.brief: - abi_compliance_command += ["-report-format", "xml", - "-stdout"] - try: - subprocess.check_output( - abi_compliance_command, - stderr=subprocess.STDOUT - ) - except subprocess.CalledProcessError as err: - if err.returncode == 1: - compliance_return_code = 1 - if self.brief: - self.log.info( - "Compatibility issues found for {}".format(mbed_module) - ) - report_root = ET.fromstring(err.output.decode("utf-8")) - self._remove_extra_detail_from_report(report_root) - self.log.info(ET.tostring(report_root).decode("utf-8")) - else: - self.can_remove_report_dir = False - compatibility_report += ( - "Compatibility issues found for {}, " - "for details see {}\n".format(mbed_module, output_path) - ) - else: - raise err - else: - compatibility_report += ( - "No compatibility issues for {}\n".format(mbed_module) - ) - if not (self.keep_all_reports or self.brief): - os.remove(output_path) - os.remove(self.old_version.abi_dumps[mbed_module]) - os.remove(self.new_version.abi_dumps[mbed_module]) + if not self._is_library_compatible(mbed_module, + compatibility_report): + compliance_return_code = 1 + for version in [self.old_version, self.new_version]: + for mbed_module, mbed_module_dump in version.abi_dumps.items(): + os.remove(mbed_module_dump) if self.can_remove_report_dir: os.rmdir(self.report_dir) - self.log.info(compatibility_report) + self.log.info("\n".join(compatibility_report)) return compliance_return_code def check_for_abi_changes(self): @@ -356,7 +382,9 @@ def run_main(): ) parser.add_argument( "-s", "--skip-file", type=str, - help="path to file containing symbols and types to skip" + help=("path to file containing symbols and types to skip " + "(typically \"-s identifiers\" after running " + "\"tests/scripts/list-identifiers.sh --internal\")") ) parser.add_argument( "-b", "--brief", action="store_true", @@ -370,6 +398,7 @@ def run_main(): version="old", repository=abi_args.old_repo, revision=abi_args.old_rev, + commit=None, crypto_repository=abi_args.old_crypto_repo, crypto_revision=abi_args.old_crypto_rev, abi_dumps={}, @@ -379,6 +408,7 @@ def run_main(): version="new", repository=abi_args.new_repo, revision=abi_args.new_rev, + commit=None, crypto_repository=abi_args.new_crypto_repo, crypto_revision=abi_args.new_crypto_rev, abi_dumps={}, diff --git a/scripts/config.pl b/scripts/config.pl index 6479c6d53b..4588757686 100755 --- a/scripts/config.pl +++ b/scripts/config.pl @@ -29,8 +29,9 @@ # MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES # MBEDTLS_NO_PLATFORM_ENTROPY # MBEDTLS_RSA_NO_CRT -# MBEDTLS_USE_PSA_CRYPTO -# - experimental, and more an alternative implementation than a feature +# MBEDTLS_PSA_CRYPTO_SPM +# MBEDTLS_PSA_INJECT_ENTROPY +# MBEDTLS_ECP_RESTARTABLE # and any symbol beginning _ALT # @@ -89,7 +90,7 @@ MBEDTLS_PSA_CRYPTO_SE_C MBEDTLS_PSA_CRYPTO_SPM MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER MBEDTLS_PSA_INJECT_ENTROPY -MBEDTLS_USE_PSA_CRYPTO +MBEDTLS_ECP_RESTARTABLE _ALT\s*$ ); @@ -108,10 +109,9 @@ MBEDTLS_MEMORY_BACKTRACE MBEDTLS_MEMORY_BUFFER_ALLOC_C MBEDTLS_PLATFORM_TIME_ALT MBEDTLS_PLATFORM_FPRINTF_ALT +MBEDTLS_PSA_ITS_FILE_C MBEDTLS_PSA_CRYPTO_SE_C MBEDTLS_PSA_CRYPTO_STORAGE_C -MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C -MBEDTLS_PSA_ITS_FILE_C ); # Things that should be enabled in "full" even if they match @excluded diff --git a/scripts/data_files/query_config.fmt b/scripts/data_files/query_config.fmt index 600f13030a..911900f8b8 100644 --- a/scripts/data_files/query_config.fmt +++ b/scripts/data_files/query_config.fmt @@ -47,7 +47,6 @@ #include "mbedtls/blowfish.h" #include "mbedtls/camellia.h" #include "mbedtls/ccm.h" -#include "mbedtls/certs.h" #include "mbedtls/chacha20.h" #include "mbedtls/chachapoly.h" #include "mbedtls/cipher.h" diff --git a/scripts/data_files/version_features.fmt b/scripts/data_files/version_features.fmt index 767eda1c74..63ae94cb69 100644 --- a/scripts/data_files/version_features.fmt +++ b/scripts/data_files/version_features.fmt @@ -31,7 +31,7 @@ #include -static const char *features[] = { +static const char * const features[] = { #if defined(MBEDTLS_VERSION_FEATURES) FEATURE_DEFINES #endif /* MBEDTLS_VERSION_FEATURES */ @@ -40,7 +40,7 @@ FEATURE_DEFINES int mbedtls_version_check_feature( const char *feature ) { - const char **idx = features; + const char * const *idx = features; if( *idx == NULL ) return( -2 ); diff --git a/scripts/data_files/vs2010-app-template.vcxproj b/scripts/data_files/vs2010-app-template.vcxproj index fac9812e63..1db7ee42a4 100644 --- a/scripts/data_files/vs2010-app-template.vcxproj +++ b/scripts/data_files/vs2010-app-template.vcxproj @@ -53,7 +53,6 @@ false true Unicode - Windows7.1SDK diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 323ad2dc6c..7e543700ee 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -2,6 +2,13 @@ set(libs mbedcrypto ) +# Set the project root directory if it's not already defined, as may happen if +# the tests folder is included directly by a parent project, without including +# the top level CMakeLists.txt. +if(NOT DEFINED MBEDTLS_DIR) + set(MBEDTLS_DIR ${CMAKE_SOURCE_DIR}) +endif() + find_package(Perl) if(NOT PERL_FOUND) message(FATAL_ERROR "Cannot build test suites without Perl") @@ -43,9 +50,9 @@ function(add_test_suite suite_name) add_executable(${exe_name} test_suite_${data_name}.c) target_link_libraries(${exe_name} ${libs}) target_include_directories(${exe_name} - PUBLIC ${CMAKE_SOURCE_DIR}/include/ - PUBLIC ${CMAKE_SOURCE_DIR}/crypto/include/ - PRIVATE ${CMAKE_SOURCE_DIR}/crypto/library/) + PUBLIC ${MBEDTLS_DIR}/include/ + PUBLIC ${MBEDTLS_DIR}/crypto/include/ + PUBLIC ${MBEDTLS_DIR}/crypto/library/) if(${data_name} MATCHES ${SKIP_TEST_SUITES_REGEX}) message(STATUS "The test suite ${data_name} will not be executed.") diff --git a/tests/Makefile b/tests/Makefile index 94f0bc40e9..6b72523eb9 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -2,7 +2,7 @@ # To compile on SunOS: add "-lsocket -lnsl" to LDFLAGS CFLAGS ?= -O2 -WARNING_CFLAGS ?= -Wall -W -Wdeclaration-after-statement -Wno-unused-function -Wno-unused-value +WARNING_CFLAGS ?= -Wall -Wextra LDFLAGS ?= CRYPTO_INCLUDES ?= -I../include diff --git a/tests/docker/bionic/Dockerfile b/tests/docker/bionic/Dockerfile new file mode 100644 index 0000000000..1b2d40f28c --- /dev/null +++ b/tests/docker/bionic/Dockerfile @@ -0,0 +1,168 @@ +# Dockerfile +# +# Purpose +# ------- +# Defines a Docker container suitable to build and run all tests (all.sh), +# except for those that use a proprietary toolchain. + +# Copyright (C) 2006-2019, Arm Limited (or its affiliates), All Rights Reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# This file is part of Mbed TLS (https://tls.mbed.org) +ARG MAKEFLAGS_PARALLEL="" +ARG MY_REGISTRY= + +FROM ${MY_REGISTRY}ubuntu:bionic + + +ENV DEBIAN_FRONTEND noninteractive + +RUN apt-get update \ + && apt-get -y install software-properties-common \ + && rm -rf /var/lib/apt/lists + +RUN add-apt-repository -y ppa:team-gcc-arm-embedded/ppa + +RUN apt-get update \ + && apt-get -y install \ + # mbedtls build/test dependencies + build-essential \ + clang \ + cmake \ + doxygen \ + gcc-arm-none-eabi \ + gcc-mingw-w64-i686 \ + gcc-multilib \ + g++-multilib \ + gdb \ + git \ + graphviz \ + lsof \ + python \ + python3-pip \ + python3 \ + pylint3 \ + valgrind \ + wget \ + # libnettle build dependencies + libgmp-dev \ + m4 \ + pkg-config \ + && rm -rf /var/lib/apt/lists/* + +# Build a static, legacy openssl from sources with sslv3 enabled +# Based on https://gist.github.com/bmaupin/8caca3a1e8c3c5686141 (build-openssl.sh) +# Note: openssl-1.0.2 and earlier has known build issues with parallel make. +RUN cd /tmp \ + && wget https://www.openssl.org/source/old/1.0.1/openssl-1.0.1j.tar.gz -qO- | tar xz \ + && cd openssl-1.0.1j \ + && ./config --openssldir=/usr/local/openssl-1.0.1j no-shared \ + && (make ${MAKEFLAGS_PARALLEL} || make -j 1) \ + && make install_sw \ + && rm -rf /tmp/openssl* +ENV OPENSSL_LEGACY=/usr/local/openssl-1.0.1j/bin/openssl + +# Build OPENSSL as 1.0.2g +RUN cd /tmp \ + && wget https://www.openssl.org/source/old/1.0.2/openssl-1.0.2g.tar.gz -qO- | tar xz \ + && cd openssl-1.0.2g \ + && ./config --openssldir=/usr/local/openssl-1.0.2g no-shared \ + && (make ${MAKEFLAGS_PARALLEL} || make -j 1) \ + && make install_sw \ + && rm -rf /tmp/openssl* +ENV OPENSSL=/usr/local/openssl-1.0.2g/bin/openssl + +# Build a new openssl binary for ARIA/CHACHA20 support +# Based on https://gist.github.com/bmaupin/8caca3a1e8c3c5686141 (build-openssl.sh) +RUN cd /tmp \ + && wget https://www.openssl.org/source/openssl-1.1.1a.tar.gz -qO- | tar xz \ + && cd openssl-1.1.1a \ + && ./config --prefix=/usr/local/openssl-1.1.1a -Wl,--enable-new-dtags,-rpath,'${LIBRPATH}' no-shared \ + && make ${MAKEFLAGS_PARALLEL} \ + && make install_sw \ + && rm -rf /tmp/openssl* +ENV OPENSSL_NEXT=/usr/local/openssl-1.1.1a/bin/openssl + +# Build libnettle 2.7.1 (needed by legacy gnutls) +RUN cd /tmp \ + && wget https://ftp.gnu.org/gnu/nettle/nettle-2.7.1.tar.gz -qO- | tar xz \ + && cd nettle-2.7.1 \ + && ./configure --disable-documentation \ + && make ${MAKEFLAGS_PARALLEL} \ + && make install \ + && /sbin/ldconfig \ + && rm -rf /tmp/nettle* + +# Build legacy gnutls (3.3.8) +RUN cd /tmp \ + && wget https://www.gnupg.org/ftp/gcrypt/gnutls/v3.3/gnutls-3.3.8.tar.xz -qO- | tar xJ \ + && cd gnutls-3.3.8 \ + && ./configure --prefix=/usr/local/gnutls-3.3.8 --exec_prefix=/usr/local/gnutls-3.3.8 --disable-shared --disable-guile --disable-doc \ + && make ${MAKEFLAGS_PARALLEL} \ + && make install \ + && rm -rf /tmp/gnutls* +ENV GNUTLS_LEGACY_CLI=/usr/local/gnutls-3.3.8/bin/gnutls-cli +ENV GNUTLS_LEGACY_SERV=/usr/local/gnutls-3.3.8/bin/gnutls-serv + +# Build libnettle 3.1 (needed by gnutls) +RUN cd /tmp \ + && wget https://ftp.gnu.org/gnu/nettle/nettle-3.1.tar.gz -qO- | tar xz \ + && cd nettle-3.1 \ + && ./configure --disable-documentation \ + && make ${MAKEFLAGS_PARALLEL} \ + && make install \ + && /sbin/ldconfig \ + && rm -rf /tmp/nettle* + +# Build gnutls (3.4.10) +RUN cd /tmp \ + && wget https://www.gnupg.org/ftp/gcrypt/gnutls/v3.4/gnutls-3.4.10.tar.xz -qO- | tar xJ \ + && cd gnutls-3.4.10 \ + && ./configure --prefix=/usr/local/gnutls-3.4.10 --exec_prefix=/usr/local/gnutls-3.4.10 \ + --with-included-libtasn1 --without-p11-kit \ + --disable-shared --disable-guile --disable-doc \ + && make ${MAKEFLAGS_PARALLEL} \ + && make install \ + && rm -rf /tmp/gnutls* +ENV GNUTLS_CLI=/usr/local/gnutls-3.4.10/bin/gnutls-cli +ENV GNUTLS_SERV=/usr/local/gnutls-3.4.10/bin/gnutls-serv + +# Build libnettle 3.4 (needed by gnutls next) +RUN cd /tmp \ + && wget https://ftp.gnu.org/gnu/nettle/nettle-3.4.1.tar.gz -qO- | tar xz \ + && cd nettle-3.4.1 \ + && ./configure --disable-documentation \ + && make ${MAKEFLAGS_PARALLEL} \ + && make install \ + && /sbin/ldconfig \ + && rm -rf /tmp/nettle* + +# Build gnutls next (3.6.5) +RUN cd /tmp \ + && wget https://www.gnupg.org/ftp/gcrypt/gnutls/v3.6/gnutls-3.6.5.tar.xz -qO- | tar xJ \ + && cd gnutls-3.6.5 \ + && ./configure --prefix=/usr/local/gnutls-3.6.5 --exec_prefix=/usr/local/gnutls-3.6.5 \ + --with-included-libtasn1 --with-included-unistring --without-p11-kit \ + --disable-shared --disable-guile --disable-doc \ + && make ${MAKEFLAGS_PARALLEL} \ + && make install \ + && rm -rf /tmp/gnutls* + +ENV GNUTLS_NEXT_CLI=/usr/local/gnutls-3.6.5/bin/gnutls-cli +ENV GNUTLS_NEXT_SERV=/usr/local/gnutls-3.6.5/bin/gnutls-serv + +RUN pip3 install --no-cache-dir \ + mbed-host-tests \ + mock diff --git a/tests/make-in-docker.sh b/tests/make-in-docker.sh new file mode 100755 index 0000000000..4fbfe1ccbc --- /dev/null +++ b/tests/make-in-docker.sh @@ -0,0 +1,31 @@ +#!/bin/bash -eu + +# make-in-docker.sh +# +# Purpose +# ------- +# This runs make in a Docker container. +# +# See also: +# - scripts/docker_env.sh for general Docker prerequisites and other information. + +# Copyright (C) 2006-2019, Arm Limited (or its affiliates), All Rights Reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# This file is part of Mbed TLS (https://tls.mbed.org) + +source tests/scripts/docker_env.sh + +run_in_docker make $@ diff --git a/tests/scripts/all-in-docker.sh b/tests/scripts/all-in-docker.sh new file mode 100755 index 0000000000..ee9a092901 --- /dev/null +++ b/tests/scripts/all-in-docker.sh @@ -0,0 +1,37 @@ +#!/bin/bash -eu + +# all-in-docker.sh +# +# Purpose +# ------- +# This runs all.sh (except for armcc) in a Docker container. +# +# Notes for users +# --------------- +# See docker_env.sh for prerequisites and other information. +# +# See also all.sh for notes about invocation of that script. + +# Copyright (C) 2006-2019, Arm Limited (or its affiliates), All Rights Reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# This file is part of Mbed TLS (https://tls.mbed.org) + +source tests/scripts/docker_env.sh + +# Run tests that are possible with openly available compilers +run_in_docker tests/scripts/all.sh \ + --no-armcc \ + $@ diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 28225899fc..fa77436ba2 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -218,6 +218,16 @@ cleanup() git update-index --no-skip-worktree Makefile library/Makefile programs/Makefile tests/Makefile git checkout -- Makefile library/Makefile programs/Makefile tests/Makefile + # Remove any artifacts from the component_test_cmake_as_subdirectory test. + rm -rf programs/test/cmake_subproject/build + rm -f programs/test/cmake_subproject/Makefile + rm -f programs/test/cmake_subproject/cmake_subproject + + # Remove any artifacts from the component_test_cmake_as_subdirectory test. + rm -rf programs/test/cmake_subproject/build + rm -f programs/test/cmake_subproject/Makefile + rm -f programs/test/cmake_subproject/cmake_subproject + if [ -f "$CONFIG_BAK" ]; then mv "$CONFIG_BAK" "$CONFIG_H" fi @@ -536,7 +546,7 @@ component_check_files () { component_check_names () { msg "test/build: declared and exported names" # < 3s - record_status tests/scripts/check-names.sh + record_status tests/scripts/check-names.sh -v } component_check_doxygen_warnings () { @@ -575,6 +585,19 @@ component_test_ref_configs () { record_status tests/scripts/test-ref-configs.pl } +component_test_no_pem_no_fs () { + msg "build: Default + !MBEDTLS_PEM_PARSE_C + !MBEDTLS_FS_IO (ASan build)" + scripts/config.pl unset MBEDTLS_PEM_PARSE_C + scripts/config.pl unset MBEDTLS_FS_IO + scripts/config.pl unset MBEDTLS_PSA_ITS_FILE_C # requires a filesystem + scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA ITS + CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan . + make + + msg "test: !MBEDTLS_PEM_PARSE_C !MBEDTLS_FS_IO - main suites (inc. selftests) (ASan build)" # ~ 50s + make test +} + component_test_rsa_no_crt () { msg "build: Default + RSA_NO_CRT (ASan build)" # ~ 6 min scripts/config.pl set MBEDTLS_RSA_NO_CRT @@ -602,13 +625,23 @@ component_test_full_cmake_clang () { CC=clang cmake -D CMAKE_BUILD_TYPE:String=Check -D ENABLE_TESTING=On . make - msg "test: main suites (full config)" # ~ 5s + msg "test: main suites (full config, clang)" # ~ 5s make test - msg "test: psa_constant_names (full config)" # ~ 1s + msg "test: psa_constant_names (full config, clang)" # ~ 1s record_status tests/scripts/test_psa_constant_names.py } +component_test_full_make_gcc_o0 () { + msg "build: make, full config, gcc -O0" # ~ 50s + scripts/config.pl full + scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # too slow for tests + make CC=gcc CFLAGS='-O0' + + msg "test: main suites (full config, gcc -O0)" # ~ 5s + make test +} + component_build_deprecated () { msg "build: make, full config + DEPRECATED_WARNING, gcc -O" # ~ 30s scripts/config.pl full @@ -627,7 +660,6 @@ component_build_deprecated () { make CC=clang CFLAGS='-O -Werror -Wall -Wextra -Wno-unused-function' tests } - component_test_depends_curves () { msg "test/build: curves.pl (gcc)" # ~ 4 min record_status tests/scripts/curves.pl @@ -654,24 +686,38 @@ component_build_default_make_gcc_and_cxx () { make TEST_CPP=1 } -component_test_use_psa_crypto_full_cmake_asan() { - # MBEDTLS_USE_PSA_CRYPTO: run the same set of tests as basic-build-test.sh +component_test_no_use_psa_crypto_full_cmake_asan() { + # full minus MBEDTLS_USE_PSA_CRYPTO: run the same set of tests as basic-build-test.sh msg "build: cmake, full config + MBEDTLS_USE_PSA_CRYPTO, ASan" scripts/config.pl full scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # too slow for tests - scripts/config.pl unset MBEDTLS_ECP_RESTARTABLE # restartable ECC not supported through PSA + scripts/config.pl set MBEDTLS_ECP_RESTARTABLE # not using PSA, so enable restartable ECC scripts/config.pl set MBEDTLS_PSA_CRYPTO_C - scripts/config.pl set MBEDTLS_USE_PSA_CRYPTO + scripts/config.pl unset MBEDTLS_USE_PSA_CRYPTO + scripts/config.pl unset MBEDTLS_PSA_ITS_FILE_C + scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan . make - msg "test: main suites (MBEDTLS_USE_PSA_CRYPTO)" + msg "test: main suites (full minus MBEDTLS_USE_PSA_CRYPTO)" make test } +component_test_check_params_functionality () { + msg "build+test: MBEDTLS_CHECK_PARAMS functionality" + scripts/config.pl full # includes CHECK_PARAMS + # Make MBEDTLS_PARAM_FAILED call mbedtls_param_failed(). + scripts/config.pl unset MBEDTLS_CHECK_PARAMS_ASSERT + scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C + # Only build and run tests. Do not build sample programs, because + # they don't have a mbedtls_param_failed() function. + make CC=gcc CFLAGS='-Werror -O1' lib test +} + component_test_check_params_without_platform () { msg "build+test: MBEDTLS_CHECK_PARAMS without MBEDTLS_PLATFORM_C" scripts/config.pl full # includes CHECK_PARAMS + # Keep MBEDTLS_PARAM_FAILED as assert. scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # too slow for tests scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C scripts/config.pl unset MBEDTLS_PLATFORM_EXIT_ALT @@ -689,6 +735,7 @@ component_test_check_params_silent () { msg "build+test: MBEDTLS_CHECK_PARAMS with alternative MBEDTLS_PARAM_FAILED()" scripts/config.pl full # includes CHECK_PARAMS scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # too slow for tests + # Set MBEDTLS_PARAM_FAILED to nothing. sed -i 's/.*\(#define MBEDTLS_PARAM_FAILED( cond )\).*/\1/' "$CONFIG_H" make CC=gcc CFLAGS='-Werror -O1' all test } @@ -712,7 +759,6 @@ component_test_no_platform () { scripts/config.pl unset MBEDTLS_PSA_CRYPTO_SE_C scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C scripts/config.pl unset MBEDTLS_PSA_ITS_FILE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C # Note, _DEFAULT_SOURCE needs to be defined for platforms using glibc version >2.19, # to re-enable platform integration features otherwise disabled in C99 builds make CC=gcc CFLAGS='-Werror -Wall -Wextra -std=c99 -pedantic -O0 -D_DEFAULT_SOURCE' lib programs @@ -803,14 +849,14 @@ component_test_se_full () { component_test_make_shared () { msg "build/test: make shared" # ~ 40s - make SHARED=1 all check + make SHARED=1 all check -j1 } component_test_m32_o0 () { # Build once with -O0, to compile out the i386 specific inline assembly msg "build: i386, make, gcc -O0 (ASan build)" # ~ 30s scripts/config.pl full - make CC=gcc CFLAGS='-O0 -Werror -Wall -Wextra -m32 -fsanitize=address' + make CC=gcc CFLAGS='-O0 -Werror -Wall -Wextra -m32 -fsanitize=address' LDFLAGS='-m32 -fsanitize=address' msg "test: i386, make, gcc -O0 (ASan build)" make test @@ -829,7 +875,7 @@ component_test_m32_o1 () { scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C scripts/config.pl unset MBEDTLS_MEMORY_DEBUG - make CC=gcc CFLAGS='-O1 -Werror -Wall -Wextra -m32 -fsanitize=address' + make CC=gcc CFLAGS='-O1 -Werror -Wall -Wextra -m32 -fsanitize=address' LDFLAGS='-m32 -fsanitize=address' msg "test: i386, make, gcc -O1 (ASan build)" make test @@ -841,7 +887,7 @@ support_test_m32_o1 () { component_test_mx32 () { msg "build: 64-bit ILP32, make, gcc" # ~ 30s scripts/config.pl full - make CC=gcc CFLAGS='-Werror -Wall -Wextra -mx32' + make CC=gcc CFLAGS='-Werror -Wall -Wextra -mx32' LDFLAGS='-mx32' msg "test: 64-bit ILP32, make, gcc" make test @@ -909,41 +955,13 @@ component_test_no_64bit_multiplication () { component_build_arm_none_eabi_gcc () { msg "build: arm-none-eabi-gcc, make" # ~ 10s - scripts/config.pl full - scripts/config.pl unset MBEDTLS_TIMING_C - scripts/config.pl unset MBEDTLS_FS_IO - scripts/config.pl unset MBEDTLS_PSA_ITS_FILE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_SE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C - scripts/config.pl unset MBEDTLS_ENTROPY_NV_SEED - scripts/config.pl set MBEDTLS_NO_PLATFORM_ENTROPY - # following things are not in the default config - scripts/config.pl unset MBEDTLS_HAVEGE_C # depends on timing.c - scripts/config.pl unset MBEDTLS_THREADING_PTHREAD - scripts/config.pl unset MBEDTLS_THREADING_C - scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # execinfo.h - scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C # calls exit + scripts/config.pl baremetal make CC=arm-none-eabi-gcc AR=arm-none-eabi-ar LD=arm-none-eabi-ld CFLAGS='-Werror -Wall -Wextra' lib } component_build_arm_none_eabi_gcc_no_udbl_division () { msg "build: arm-none-eabi-gcc -DMBEDTLS_NO_UDBL_DIVISION, make" # ~ 10s - scripts/config.pl full - scripts/config.pl unset MBEDTLS_TIMING_C - scripts/config.pl unset MBEDTLS_FS_IO - scripts/config.pl unset MBEDTLS_PSA_ITS_FILE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_SE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C - scripts/config.pl unset MBEDTLS_ENTROPY_NV_SEED - scripts/config.pl set MBEDTLS_NO_PLATFORM_ENTROPY - # following things are not in the default config - scripts/config.pl unset MBEDTLS_HAVEGE_C # depends on timing.c - scripts/config.pl unset MBEDTLS_THREADING_PTHREAD - scripts/config.pl unset MBEDTLS_THREADING_C - scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # execinfo.h - scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C # calls exit + scripts/config.pl baremetal scripts/config.pl set MBEDTLS_NO_UDBL_DIVISION make CC=arm-none-eabi-gcc AR=arm-none-eabi-ar LD=arm-none-eabi-ld CFLAGS='-Werror -Wall -Wextra' lib echo "Checking that software 64-bit division is not required" @@ -952,21 +970,7 @@ component_build_arm_none_eabi_gcc_no_udbl_division () { component_build_arm_none_eabi_gcc_no_64bit_multiplication () { msg "build: arm-none-eabi-gcc MBEDTLS_NO_64BIT_MULTIPLICATION, make" # ~ 10s - scripts/config.pl full - scripts/config.pl unset MBEDTLS_TIMING_C - scripts/config.pl unset MBEDTLS_FS_IO - scripts/config.pl unset MBEDTLS_PSA_ITS_FILE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_SE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C - scripts/config.pl unset MBEDTLS_ENTROPY_NV_SEED - scripts/config.pl set MBEDTLS_NO_PLATFORM_ENTROPY - # following things are not in the default config - scripts/config.pl unset MBEDTLS_HAVEGE_C # depends on timing.c - scripts/config.pl unset MBEDTLS_THREADING_PTHREAD - scripts/config.pl unset MBEDTLS_THREADING_C - scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # execinfo.h - scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C # calls exit + scripts/config.pl baremetal scripts/config.pl set MBEDTLS_NO_64BIT_MULTIPLICATION make CC=arm-none-eabi-gcc AR=arm-none-eabi-ar LD=arm-none-eabi-ld CFLAGS='-Werror -O1 -march=armv6-m -mthumb' lib echo "Checking that software 64-bit multiplication is not required" @@ -975,25 +979,7 @@ component_build_arm_none_eabi_gcc_no_64bit_multiplication () { component_build_armcc () { msg "build: ARM Compiler 5, make" - scripts/config.pl full - scripts/config.pl unset MBEDTLS_TIMING_C - scripts/config.pl unset MBEDTLS_FS_IO - scripts/config.pl unset MBEDTLS_PSA_ITS_FILE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_SE_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C - scripts/config.pl unset MBEDTLS_PSA_CRYPTO_STORAGE_C - scripts/config.pl unset MBEDTLS_ENTROPY_NV_SEED - scripts/config.pl unset MBEDTLS_HAVE_TIME - scripts/config.pl unset MBEDTLS_HAVE_TIME_DATE - scripts/config.pl set MBEDTLS_NO_PLATFORM_ENTROPY - # following things are not in the default config - scripts/config.pl unset MBEDTLS_DEPRECATED_WARNING - scripts/config.pl unset MBEDTLS_HAVEGE_C # depends on timing.c - scripts/config.pl unset MBEDTLS_THREADING_PTHREAD - scripts/config.pl unset MBEDTLS_THREADING_C - scripts/config.pl unset MBEDTLS_MEMORY_BACKTRACE # execinfo.h - scripts/config.pl unset MBEDTLS_MEMORY_BUFFER_ALLOC_C # calls exit - scripts/config.pl unset MBEDTLS_PLATFORM_TIME_ALT # depends on MBEDTLS_HAVE_TIME + scripts/config.pl baremetal make CC="$ARMC5_CC" AR="$ARMC5_AR" WARNING_CFLAGS='--strict --c99' lib make clean @@ -1016,15 +1002,15 @@ component_build_armcc () { component_build_mingw () { msg "build: Windows cross build - mingw64, make (Link Library)" # ~ 30s - make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall -Wextra' WINDOWS_BUILD=1 lib programs + make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall -Wextra' WINDOWS_BUILD=1 lib programs -j1 # note Make tests only builds the tests, but doesn't run them - make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror' WINDOWS_BUILD=1 tests + make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror' WINDOWS_BUILD=1 tests -j1 make WINDOWS_BUILD=1 clean msg "build: Windows cross build - mingw64, make (DLL)" # ~ 30s - make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall -Wextra' WINDOWS_BUILD=1 SHARED=1 lib programs - make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall -Wextra' WINDOWS_BUILD=1 SHARED=1 tests + make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall -Wextra' WINDOWS_BUILD=1 SHARED=1 lib programs -j1 + make CC=i686-w64-mingw32-gcc AR=i686-w64-mingw32-ar LD=i686-w64-minggw32-ld CFLAGS='-Werror -Wall -Wextra' WINDOWS_BUILD=1 SHARED=1 tests -j1 make WINDOWS_BUILD=1 clean } support_build_mingw() { @@ -1069,6 +1055,19 @@ component_test_cmake_out_of_source () { unset MBEDTLS_ROOT_DIR } +component_test_cmake_as_subdirectory () { + msg "build: cmake 'as-subdirectory' build" + MBEDTLS_ROOT_DIR="$PWD" + + cd programs/test/cmake_subproject + cmake . + make + if_build_succeeded ./cmake_subproject + + cd "$MBEDTLS_ROOT_DIR" + unset MBEDTLS_ROOT_DIR +} + component_test_zeroize () { # Test that the function mbedtls_platform_zeroize() is not optimized away by # different combinations of compilers and optimization flags by using an diff --git a/tests/scripts/basic-build-test.sh b/tests/scripts/basic-build-test.sh index a653001e7d..54ca934136 100755 --- a/tests/scripts/basic-build-test.sh +++ b/tests/scripts/basic-build-test.sh @@ -43,6 +43,7 @@ echo # Step 1 - Make and instrumented build for code coverage export CFLAGS=' --coverage -g3 -O0 ' +export LDFLAGS=' --coverage' make clean cp "$CONFIG_H" "$CONFIG_BAK" scripts/config.pl full @@ -53,6 +54,9 @@ make -j # Step 2 - Execute the tests TEST_OUTPUT=out_${PPID} cd tests +if [ ! -f "seedfile" ]; then + dd if=/dev/urandom of="seedfile" bs=32 count=1 +fi # Step 2a - Unit Tests perl scripts/run-test-suites.pl -v 2 |tee unit-test-$TEST_OUTPUT diff --git a/tests/scripts/basic-in-docker.sh b/tests/scripts/basic-in-docker.sh new file mode 100755 index 0000000000..096f8edd85 --- /dev/null +++ b/tests/scripts/basic-in-docker.sh @@ -0,0 +1,47 @@ +#!/bin/bash -eu + +# basic-in-docker.sh +# +# Purpose +# ------- +# This runs a rough equivalent of the travis.yml in a Docker container. +# The tests are run for both clang and gcc. +# +# Notes for users +# --------------- +# See docker_env.sh for prerequisites and other information. + +# Copyright (C) 2006-2019, Arm Limited (or its affiliates), All Rights Reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# This file is part of Mbed TLS (https://tls.mbed.org) + +source tests/scripts/docker_env.sh + +run_in_docker tests/scripts/recursion.pl library/*.c +run_in_docker tests/scripts/check-generated-files.sh +run_in_docker tests/scripts/check-doxy-blocks.pl +run_in_docker tests/scripts/check-names.sh +run_in_docker tests/scripts/check-files.py +run_in_docker tests/scripts/doxygen.sh + +for compiler in clang gcc; do + run_in_docker -e CC=${compiler} cmake -D CMAKE_BUILD_TYPE:String="Check" . + run_in_docker -e CC=${compiler} make + run_in_docker -e CC=${compiler} make test + run_in_docker programs/test/selftest + run_in_docker tests/scripts/test-ref-configs.pl + run_in_docker tests/scripts/curves.pl +done diff --git a/tests/scripts/check-files.py b/tests/scripts/check-files.py index 00fd0edfb7..255bed8b93 100755 --- a/tests/scripts/check-files.py +++ b/tests/scripts/check-files.py @@ -1,14 +1,12 @@ #!/usr/bin/env python3 + +# This file is part of Mbed TLS (https://tls.mbed.org) +# Copyright (c) 2018, Arm Limited, All Rights Reserved + """ -This file is part of Mbed TLS (https://tls.mbed.org) - -Copyright (c) 2018, Arm Limited, All Rights Reserved - -Purpose - This script checks the current state of the source code for minor issues, including incorrect file permissions, presence of tabs, non-Unix line endings, -trailing whitespace, presence of UTF-8 BOM, and TODO comments. +trailing whitespace, and presence of UTF-8 BOM. Note: requires python 3, must be run from Mbed TLS root. """ @@ -170,19 +168,6 @@ class MergeArtifactIssueTracker(LineIssueTracker): return True return False -class TodoIssueTracker(LineIssueTracker): - """Track lines containing ``TODO``.""" - - heading = "TODO present:" - files_exemptions = frozenset([ - os.path.basename(__file__), - "benchmark.c", - "pull_request_template.md", - ]) - - def issue_with_line(self, line, _filepath): - return b"todo" in line.lower() - class IntegrityChecker(object): """Sanity-check files under the current directory.""" @@ -211,7 +196,6 @@ class IntegrityChecker(object): TrailingWhitespaceIssueTracker(), TabIssueTracker(), MergeArtifactIssueTracker(), - TodoIssueTracker(), ] @staticmethod @@ -257,15 +241,7 @@ class IntegrityChecker(object): def run_main(): - parser = argparse.ArgumentParser( - description=( - "This script checks the current state of the source code for " - "minor issues, including incorrect file permissions, " - "presence of tabs, non-Unix line endings, trailing whitespace, " - "presence of UTF-8 BOM, and TODO comments. " - "Note: requires python 3, must be run from Mbed TLS root." - ) - ) + parser = argparse.ArgumentParser(description=__doc__) parser.add_argument( "-l", "--log_file", type=str, help="path to optional output log", ) diff --git a/tests/scripts/check-names.sh b/tests/scripts/check-names.sh index 925037c330..7d2302cb2b 100755 --- a/tests/scripts/check-names.sh +++ b/tests/scripts/check-names.sh @@ -2,26 +2,42 @@ # # This file is part of mbed TLS (https://tls.mbed.org) # -# Copyright (c) 2015-2016, ARM Limited, All Rights Reserved -# -# Purpose -# -# This script confirms that the naming of all symbols and identifiers in mbed -# TLS are consistent with the house style and are also self-consistent. -# +# Copyright (c) 2015-2019, ARM Limited, All Rights Reserved + set -eu +if [ $# -ne 0 ] && [ "$1" = "--help" ]; then + cat </dev/null; then :; else echo "This script requires GNU grep.">&2 exit 1 fi +trace= +if [ $# -ne 0 ] && [ "$1" = "-v" ]; then + shift + trace='-x' + exec 2>check-names.err + trap 'echo "FAILED UNEXPECTEDLY, status=$?"; + cat check-names.err' EXIT + set -x +fi + printf "Analysing source code...\n" -tests/scripts/list-macros.sh +sh $trace tests/scripts/list-macros.sh tests/scripts/list-enum-consts.pl -tests/scripts/list-identifiers.sh -tests/scripts/list-symbols.sh +sh $trace tests/scripts/list-identifiers.sh +sh $trace tests/scripts/list-symbols.sh FAIL=0 @@ -82,6 +98,12 @@ else FAIL=1 fi +if [ -n "$trace" ]; then + set +x + trap - EXIT + rm check-names.err +fi + printf "\nOverall: " if [ "$FAIL" -eq 0 ]; then rm macros actual-macros enum-consts identifiers exported-symbols diff --git a/tests/scripts/curves.pl b/tests/scripts/curves.pl index ddc90c580a..4791d5521d 100755 --- a/tests/scripts/curves.pl +++ b/tests/scripts/curves.pl @@ -57,7 +57,7 @@ for my $curve (@curves) { system( "CFLAGS='-Werror -Wall -Wextra' make lib" ) and abort "Failed to build lib: $curve\n"; - system( "cd tests && make" ) and abort "Failed to build tests: $curve\n"; + system( "make" ) and abort "Failed to build tests: $curve\n"; system( "make test" ) and abort "Failed test suite: $curve\n"; } diff --git a/tests/scripts/docker_env.sh b/tests/scripts/docker_env.sh new file mode 100755 index 0000000000..8bdc425796 --- /dev/null +++ b/tests/scripts/docker_env.sh @@ -0,0 +1,93 @@ +#!/bin/bash -eu + +# docker_env.sh +# +# Purpose +# ------- +# +# This is a helper script to enable running tests under a Docker container, +# thus making it easier to get set up as well as isolating test dependencies +# (which include legacy/insecure configurations of openssl and gnutls). +# +# Notes for users +# --------------- +# This script expects a Linux x86_64 system with a recent version of Docker +# installed and available for use, as well as http/https access. If a proxy +# server must be used, invoke this script with the usual environment variables +# (http_proxy and https_proxy) set appropriately. If an alternate Docker +# registry is needed, specify MBEDTLS_DOCKER_REGISTRY to point at the +# host name. +# +# +# Running this script directly will check for Docker availability and set up +# the Docker image. + +# Copyright (C) 2006-2019, Arm Limited (or its affiliates), All Rights Reserved. +# SPDX-License-Identifier: Apache-2.0 +# +# Licensed under the Apache License, Version 2.0 (the "License"); you may +# not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT +# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# This file is part of Mbed TLS (https://tls.mbed.org) + + +# default values, can be overridden by the environment +: ${MBEDTLS_DOCKER_GUEST:=bionic} + + +DOCKER_IMAGE_TAG="armmbed/mbedtls-test:${MBEDTLS_DOCKER_GUEST}" + +# Make sure docker is available +if ! which docker > /dev/null; then + echo "Docker is required but doesn't seem to be installed. See https://www.docker.com/ to get started" + exit 1 +fi + +# Figure out if we need to 'sudo docker' +if groups | grep docker > /dev/null; then + DOCKER="docker" +else + echo "Using sudo to invoke docker since you're not a member of the docker group..." + DOCKER="sudo docker" +fi + +# Build the Docker image +echo "Getting docker image up to date (this may take a few minutes)..." +${DOCKER} image build \ + -t ${DOCKER_IMAGE_TAG} \ + --cache-from=${DOCKER_IMAGE_TAG} \ + --build-arg MAKEFLAGS_PARALLEL="-j $(nproc)" \ + --network host \ + ${http_proxy+--build-arg http_proxy=${http_proxy}} \ + ${https_proxy+--build-arg https_proxy=${https_proxy}} \ + ${MBEDTLS_DOCKER_REGISTRY+--build-arg MY_REGISTRY="${MBEDTLS_DOCKER_REGISTRY}/"} \ + tests/docker/${MBEDTLS_DOCKER_GUEST} + +run_in_docker() +{ + ENV_ARGS="" + while [ "$1" == "-e" ]; do + ENV_ARGS="${ENV_ARGS} $1 $2" + shift 2 + done + + ${DOCKER} container run -it --rm \ + --cap-add SYS_PTRACE \ + --user "$(id -u):$(id -g)" \ + --volume $PWD:$PWD \ + --workdir $PWD \ + -e MAKEFLAGS \ + -e PYLINTHOME=/tmp/.pylintd \ + ${ENV_ARGS} \ + ${DOCKER_IMAGE_TAG} \ + $@ +} diff --git a/tests/scripts/list-symbols.sh b/tests/scripts/list-symbols.sh index c258719429..930722c1bb 100755 --- a/tests/scripts/list-symbols.sh +++ b/tests/scripts/list-symbols.sh @@ -14,8 +14,21 @@ fi cp include/mbedtls/config.h include/mbedtls/config.h.bak scripts/config.pl full -CFLAGS=-fno-asynchronous-unwind-tables make clean lib >/dev/null 2>&1 +make clean +make_ret= +CFLAGS=-fno-asynchronous-unwind-tables make lib \ + >list-symbols.make.log 2>&1 || + { + make_ret=$? + echo "Build failure: CFLAGS=-fno-asynchronous-unwind-tables make lib" + cat list-symbols.make.log >&2 + } +rm list-symbols.make.log mv include/mbedtls/config.h.bak include/mbedtls/config.h +if [ -n "$make_ret" ]; then + exit "$make_ret" +fi + if uname | grep -F Darwin >/dev/null; then nm -gUj library/libmbed*.a 2>/dev/null | sed -n -e 's/^_//p' elif uname | grep -F Linux >/dev/null; then diff --git a/tests/scripts/mbedtls_test.py b/tests/scripts/mbedtls_test.py index ac2912d4c9..6ac68a4fb3 100755 --- a/tests/scripts/mbedtls_test.py +++ b/tests/scripts/mbedtls_test.py @@ -79,7 +79,7 @@ class TestDataParser(object): split_colon_fn = lambda x: re.sub(r'\\' + split_char, split_char, x) if len(split_char) > 1: raise ValueError('Expected split character. Found string!') - out = map(split_colon_fn, re.split(r'(?= 'A' && c <= 'F' ) c -= 'A' - 10; else - assert( 0 ); + TEST_HELPER_ASSERT( 0 ); c2 = *ibuf++; if( c2 >= '0' && c2 <= '9' ) @@ -518,7 +518,7 @@ static int unhexify( unsigned char *obuf, const char *ibuf ) else if( c2 >= 'A' && c2 <= 'F' ) c2 -= 'A' - 10; else - assert( 0 ); + TEST_HELPER_ASSERT( 0 ); *obuf++ = ( c << 4 ) | c2; } @@ -526,7 +526,7 @@ static int unhexify( unsigned char *obuf, const char *ibuf ) return len; } -static void hexify( unsigned char *obuf, const unsigned char *ibuf, int len ) +void hexify( unsigned char *obuf, const unsigned char *ibuf, int len ) { unsigned char l, h; @@ -563,7 +563,7 @@ static unsigned char *zero_alloc( size_t len ) size_t actual_len = ( len != 0 ) ? len : 1; p = mbedtls_calloc( 1, actual_len ); - assert( p != NULL ); + TEST_HELPER_ASSERT( p != NULL ); memset( p, 0x00, actual_len ); @@ -580,7 +580,7 @@ static unsigned char *zero_alloc( size_t len ) * * For convenience, dies if allocation fails. */ -static unsigned char *unhexify_alloc( const char *ibuf, size_t *olen ) +unsigned char *unhexify_alloc( const char *ibuf, size_t *olen ) { unsigned char *obuf; @@ -590,7 +590,7 @@ static unsigned char *unhexify_alloc( const char *ibuf, size_t *olen ) return( zero_alloc( *olen ) ); obuf = mbedtls_calloc( 1, *olen ); - assert( obuf != NULL ); + TEST_HELPER_ASSERT( obuf != NULL ); (void) unhexify( obuf, ibuf ); @@ -631,7 +631,7 @@ static int rnd_std_rand( void *rng_state, unsigned char *output, size_t len ) * * rng_state shall be NULL. */ -static int rnd_zero_rand( void *rng_state, unsigned char *output, size_t len ) +int rnd_zero_rand( void *rng_state, unsigned char *output, size_t len ) { if( rng_state != NULL ) rng_state = NULL; @@ -658,7 +658,7 @@ typedef struct * * After the buffer is empty it will return rand(); */ -static int rnd_buffer_rand( void *rng_state, unsigned char *output, size_t len ) +int rnd_buffer_rand( void *rng_state, unsigned char *output, size_t len ) { rnd_buf_info *info = (rnd_buf_info *) rng_state; size_t use_len; @@ -704,7 +704,7 @@ typedef struct * * rng_state shall be a pointer to a rnd_pseudo_info structure. */ -static int rnd_pseudo_rand( void *rng_state, unsigned char *output, size_t len ) +int rnd_pseudo_rand( void *rng_state, unsigned char *output, size_t len ) { rnd_pseudo_info *info = (rnd_pseudo_info *) rng_state; uint32_t i, *k, sum, delta=0x9E3779B9; diff --git a/tests/suites/host_test.function b/tests/suites/host_test.function index 3c43032083..fe6a2bc070 100644 --- a/tests/suites/host_test.function +++ b/tests/suites/host_test.function @@ -179,7 +179,7 @@ static int parse_arguments( char *buf, size_t len, char **params, if( p + 1 < buf + len ) { cur = p + 1; - assert( cnt < params_len ); + TEST_HELPER_ASSERT( cnt < params_len ); params[cnt++] = cur; } *p = '\0'; diff --git a/tests/suites/target_test.function b/tests/suites/target_test.function index 56abf29489..d430d9d5d9 100644 --- a/tests/suites/target_test.function +++ b/tests/suites/target_test.function @@ -13,11 +13,11 @@ */ #define INCR_ASSERT(p, start, len, step) do \ { \ - assert( ( p ) >= ( start ) ); \ - assert( sizeof( *( p ) ) == sizeof( *( start ) ) ); \ + TEST_HELPER_ASSERT( ( p ) >= ( start ) ); \ + TEST_HELPER_ASSERT( sizeof( *( p ) ) == sizeof( *( start ) ) ); \ /* <= is checked to support use inside a loop where \ pointer is incremented after reading data. */ \ - assert( (uint32_t)( ( ( p ) - ( start ) ) + ( step ) ) <= ( len ) );\ + TEST_HELPER_ASSERT( (uint32_t)( ( ( p ) - ( start ) ) + ( step ) ) <= ( len ) );\ ( p ) += ( step ); \ } \ while( 0 ) @@ -59,10 +59,29 @@ int verify_dependencies( uint8_t count, uint8_t * dep_p ) return( DEPENDENCY_SUPPORTED ); } +/** + * \brief Receives hex string on serial interface, and converts to a byte. + * + * \param none + * + * \return unsigned int8 + */ +uint8_t receive_byte() +{ + uint8_t byte; + uint8_t c[3]; + char *endptr; + c[0] = greentea_getc(); + c[1] = greentea_getc(); + c[2] = '\0'; + + assert( unhexify( &byte, c ) != 2 ); + return( byte ); +} /** * \brief Receives unsigned integer on serial interface. - * Integers are encoded in network order. + * Integers are encoded in network order, and sent as hex ascii string. * * \param none * @@ -71,10 +90,17 @@ int verify_dependencies( uint8_t count, uint8_t * dep_p ) uint32_t receive_uint32() { uint32_t value; - value = (uint8_t)greentea_getc() << 24; - value |= (uint8_t)greentea_getc() << 16; - value |= (uint8_t)greentea_getc() << 8; - value |= (uint8_t)greentea_getc(); + const uint8_t c[9] = { greentea_getc(), + greentea_getc(), + greentea_getc(), + greentea_getc(), + greentea_getc(), + greentea_getc(), + greentea_getc(), + greentea_getc(), + '\0' + }; + assert( unhexify( &value, c ) != 8 ); return( (uint32_t)value ); } @@ -127,12 +153,12 @@ uint8_t * receive_data( uint32_t * data_len ) /* Read data length */ *data_len = receive_uint32(); data = (uint8_t *)malloc( *data_len ); - assert( data != NULL ); + TEST_HELPER_ASSERT( data != NULL ); greentea_getc(); // read ';' received after key i.e. *data_len for( i = 0; i < *data_len; i++ ) - data[i] = greentea_getc(); + data[i] = receive_byte(); /* Read closing braces */ for( i = 0; i < 2; i++ ) @@ -221,7 +247,7 @@ void ** parse_parameters( uint8_t count, uint8_t * data, uint32_t data_len, hex_count = find_hex_count(count, data, data_len); params = (void **)malloc( sizeof( void *) * ( count + hex_count ) ); - assert( params != NULL ); + TEST_HELPER_ASSERT( params != NULL ); cur = params; p = data; @@ -360,7 +386,7 @@ int execute_tests( int args, const char ** argv ) { /* Read dependency count */ count = *p; - assert( count < data_len ); + TEST_HELPER_ASSERT( count < data_len ); INCR_ASSERT( p, data, data_len, sizeof( uint8_t ) ); ret = verify_dependencies( count, p ); if ( ret != DEPENDENCY_SUPPORTED ) diff --git a/tests/suites/test_suite_cipher.aes.data b/tests/suites/test_suite_cipher.aes.data index 1a8ff1e4bc..c42fc7911d 100644 --- a/tests/suites/test_suite_cipher.aes.data +++ b/tests/suites/test_suite_cipher.aes.data @@ -1,6 +1,6 @@ Decrypt empty buffer depends_on:MBEDTLS_AES_C:MBEDTLS_CIPHER_MODE_CBC:MBEDTLS_CIPHER_PADDING_PKCS7 -dec_empty_buf: +dec_empty_buf:MBEDTLS_CIPHER_AES_128_CBC AES-128 CBC - Encrypt and decrypt 0 bytes with PKCS7 padding depends_on:MBEDTLS_AES_C:MBEDTLS_CIPHER_MODE_CBC:MBEDTLS_CIPHER_PADDING_PKCS7 diff --git a/tests/suites/test_suite_cipher.chacha20.data b/tests/suites/test_suite_cipher.chacha20.data index c67e582e78..11de1038af 100644 --- a/tests/suites/test_suite_cipher.chacha20.data +++ b/tests/suites/test_suite_cipher.chacha20.data @@ -1,7 +1,3 @@ -Decrypt empty buffer -depends_on:MBEDTLS_CHACHA20_C -dec_empty_buf: - Chacha20 RFC 7539 Test Vector #1 depends_on:MBEDTLS_CHACHA20_C decrypt_test_vec:MBEDTLS_CIPHER_CHACHA20:-1:"0000000000000000000000000000000000000000000000000000000000000000":"000000000000000000000000":"76b8e0ada0f13d90405d6ae55386bd28bdd219b8a08ded1aa836efcc8b770dc7da41597c5157488d7724e03fb8d84a376a43b8f41518a11cc387b669b2ee6586":"00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000":"":"":0:0 diff --git a/tests/suites/test_suite_cipher.chachapoly.data b/tests/suites/test_suite_cipher.chachapoly.data index 7310a84d77..ccd0dfb574 100644 --- a/tests/suites/test_suite_cipher.chachapoly.data +++ b/tests/suites/test_suite_cipher.chachapoly.data @@ -1,6 +1,6 @@ Decrypt empty buffer depends_on:MBEDTLS_CHACHAPOLY_C -dec_empty_buf: +dec_empty_buf:MBEDTLS_CIPHER_CHACHA20_POLY1305 ChaCha20+Poly1305 Encrypt and decrypt 0 bytes depends_on:MBEDTLS_CHACHAPOLY_C diff --git a/tests/suites/test_suite_cipher.function b/tests/suites/test_suite_cipher.function index ca39937c29..f6367f1758 100644 --- a/tests/suites/test_suite_cipher.function +++ b/tests/suites/test_suite_cipher.function @@ -4,6 +4,11 @@ #if defined(MBEDTLS_GCM_C) #include "mbedtls/gcm.h" #endif + +#if defined(MBEDTLS_USE_PSA_CRYPTO) +#include "psa_crypto_helpers.h" +#endif + /* END_HEADER */ /* BEGIN_DEPENDENCIES @@ -710,7 +715,7 @@ exit: /* END_CASE */ /* BEGIN_CASE */ -void dec_empty_buf( ) +void dec_empty_buf( int cipher ) { unsigned char key[32]; unsigned char iv[16]; @@ -723,6 +728,8 @@ void dec_empty_buf( ) size_t outlen = 0; + int expected_ret; + memset( key, 0, 32 ); memset( iv , 0, 16 ); @@ -732,12 +739,15 @@ void dec_empty_buf( ) memset( decbuf, 0, 64 ); /* Initialise context */ - cipher_info = mbedtls_cipher_info_from_type( MBEDTLS_CIPHER_AES_128_CBC ); + cipher_info = mbedtls_cipher_info_from_type( cipher ); TEST_ASSERT( NULL != cipher_info); + TEST_ASSERT( sizeof(key) * 8 >= cipher_info->key_bitlen ); TEST_ASSERT( 0 == mbedtls_cipher_setup( &ctx_dec, cipher_info ) ); - TEST_ASSERT( 0 == mbedtls_cipher_setkey( &ctx_dec, key, 128, MBEDTLS_DECRYPT ) ); + TEST_ASSERT( 0 == mbedtls_cipher_setkey( &ctx_dec, + key, cipher_info->key_bitlen, + MBEDTLS_DECRYPT ) ); TEST_ASSERT( 0 == mbedtls_cipher_set_iv( &ctx_dec, iv, 16 ) ); @@ -750,8 +760,23 @@ void dec_empty_buf( ) /* decode 0-byte string */ TEST_ASSERT( 0 == mbedtls_cipher_update( &ctx_dec, encbuf, 0, decbuf, &outlen ) ); TEST_ASSERT( 0 == outlen ); - TEST_ASSERT( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED == mbedtls_cipher_finish( - &ctx_dec, decbuf + outlen, &outlen ) ); + + if ( cipher_info->mode == MBEDTLS_MODE_CBC || + cipher_info->mode == MBEDTLS_MODE_ECB ) + { + /* CBC and ECB ciphers need a full block of input. */ + expected_ret = MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED; + } + else + { + /* Non-CBC and non-ECB ciphers are OK with decrypting empty buffers and + * return success, not MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED, when + * decrypting an empty buffer. */ + expected_ret = 0; + } + + TEST_ASSERT( expected_ret == mbedtls_cipher_finish( + &ctx_dec, decbuf + outlen, &outlen ) ); TEST_ASSERT( 0 == outlen ); exit: @@ -962,7 +987,7 @@ void auth_crypt_tv( int cipher_id, data_t * key, data_t * iv, #else if( use_psa == 1 ) { - TEST_ASSERT( psa_crypto_init() == 0 ); + PSA_ASSERT( psa_crypto_init( ) ); /* PSA requires that the tag immediately follows the ciphertext. */ tmp_cipher = mbedtls_calloc( 1, cipher->len + tag->len ); @@ -1046,14 +1071,15 @@ void auth_crypt_tv( int cipher_id, data_t * key, data_t * iv, exit: + mbedtls_cipher_free( &ctx ); + #if defined(MBEDTLS_USE_PSA_CRYPTO) if( use_psa == 1 ) { mbedtls_free( tmp_cipher ); + PSA_DONE( ); } #endif /* MBEDTLS_USE_PSA_CRYPTO */ - - mbedtls_cipher_free( &ctx ); } /* END_CASE */ @@ -1123,7 +1149,7 @@ void test_vec_crypt( int cipher_id, int operation, char *hex_key, #else if( use_psa == 1 ) { - TEST_ASSERT( psa_crypto_init() == 0 ); + PSA_ASSERT( psa_crypto_init( ) ); TEST_ASSERT( 0 == mbedtls_cipher_setup_psa( &ctx, mbedtls_cipher_info_from_type( cipher_id ), 0 ) ); } @@ -1152,6 +1178,9 @@ void test_vec_crypt( int cipher_id, int operation, char *hex_key, exit: mbedtls_cipher_free( &ctx ); +#if defined(MBEDTLS_USE_PSA_CRYPTO) + PSA_DONE( ); +#endif /* MBEDTLS_USE_PSA_CRYPTO */ } /* END_CASE */ diff --git a/tests/suites/test_suite_entropy.function b/tests/suites/test_suite_entropy.function index 0b1cfe80d4..46137da638 100644 --- a/tests/suites/test_suite_entropy.function +++ b/tests/suites/test_suite_entropy.function @@ -48,7 +48,7 @@ static int entropy_dummy_source( void *data, unsigned char *output, * This might break memory checks in the future if sources need 'free-ing' then * as well. */ -static void entropy_clear_sources( mbedtls_entropy_context *ctx ) +void entropy_clear_sources( mbedtls_entropy_context *ctx ) { ctx->source_count = 0; } @@ -58,7 +58,7 @@ static void entropy_clear_sources( mbedtls_entropy_context *ctx ) */ static unsigned char buffer_seed[MBEDTLS_ENTROPY_BLOCK_SIZE]; -static int buffer_nv_seed_read( unsigned char *buf, size_t buf_len ) +int buffer_nv_seed_read( unsigned char *buf, size_t buf_len ) { if( buf_len != MBEDTLS_ENTROPY_BLOCK_SIZE ) return( -1 ); @@ -67,7 +67,7 @@ static int buffer_nv_seed_read( unsigned char *buf, size_t buf_len ) return( 0 ); } -static int buffer_nv_seed_write( unsigned char *buf, size_t buf_len ) +int buffer_nv_seed_write( unsigned char *buf, size_t buf_len ) { if( buf_len != MBEDTLS_ENTROPY_BLOCK_SIZE ) return( -1 ); @@ -98,7 +98,7 @@ static int write_nv_seed( unsigned char *buf, size_t buf_len ) return( 0 ); } -static int read_nv_seed( unsigned char *buf, size_t buf_len ) +int read_nv_seed( unsigned char *buf, size_t buf_len ) { FILE *f; diff --git a/tests/suites/test_suite_pk.function b/tests/suites/test_suite_pk.function index 3d38535e32..fbb69073e5 100644 --- a/tests/suites/test_suite_pk.function +++ b/tests/suites/test_suite_pk.function @@ -13,6 +13,13 @@ #if defined(MBEDTLS_USE_PSA_CRYPTO) #include "mbedtls/psa_util.h" #include "psa_crypto_helpers.h" +#define PSA_INIT( ) PSA_ASSERT( psa_crypto_init( ) ) +#else +/* Define empty macros so that we can use them in the preamble and teardown + * of every test function that uses PSA conditionally based on + * MBEDTLS_USE_PSA_CRYPTO. */ +#define PSA_INIT( ) ( (void) 0 ) +#define PSA_DONE( ) ( (void) 0 ) #endif static int rnd_std_rand( void *rng_state, unsigned char *output, size_t len ); @@ -117,7 +124,7 @@ void pk_psa_utils( ) size_t len; mbedtls_pk_debug_item dbg; - TEST_ASSERT( psa_crypto_init() == 0 ); + PSA_ASSERT( psa_crypto_init( ) ); mbedtls_pk_init( &pk ); mbedtls_pk_init( &pk2 ); @@ -173,6 +180,7 @@ void pk_psa_utils( ) exit: mbedtls_pk_free( &pk ); /* redundant except upon error */ mbedtls_pk_free( &pk2 ); + PSA_DONE( ); } /* END_CASE */ @@ -763,7 +771,7 @@ void pk_ec_test_vec( int type, int id, data_t * key, data_t * hash, mbedtls_ecp_keypair *eckey; mbedtls_pk_init( &pk ); - + PSA_INIT( ); TEST_ASSERT( mbedtls_pk_setup( &pk, mbedtls_pk_info_from_type( type ) ) == 0 ); @@ -780,6 +788,7 @@ void pk_ec_test_vec( int type, int id, data_t * key, data_t * hash, exit: mbedtls_pk_free( &pk ); + PSA_DONE( ); } /* END_CASE */ @@ -904,6 +913,7 @@ void pk_sign_verify( int type, int sign_ret, int verify_ret ) #endif mbedtls_pk_init( &pk ); + PSA_INIT( ); memset( hash, 0x2a, sizeof hash ); memset( sig, 0, sizeof sig ); @@ -955,6 +965,7 @@ exit: mbedtls_pk_restart_free( rs_ctx ); #endif mbedtls_pk_free( &pk ); + PSA_DONE( ); } /* END_CASE */ @@ -1210,6 +1221,8 @@ void pk_psa_sign( ) * - parse it to a PK context and verify the signature this way */ + PSA_ASSERT( psa_crypto_init( ) ); + /* Create legacy EC public/private key in PK context. */ mbedtls_pk_init( &pk ); TEST_ASSERT( mbedtls_pk_setup( &pk, @@ -1259,5 +1272,6 @@ void pk_psa_sign( ) exit: mbedtls_pk_free( &pk ); + PSA_DONE( ); } /* END_CASE */ diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 81ccb4ce31..0eb6172a49 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -726,9 +726,9 @@ exit: return( ok ); } -static int asn1_skip_integer( unsigned char **p, const unsigned char *end, - size_t min_bits, size_t max_bits, - int must_be_odd ) +int asn1_skip_integer( unsigned char **p, const unsigned char *end, + size_t min_bits, size_t max_bits, + int must_be_odd ) { size_t len; size_t actual_bits; @@ -853,10 +853,10 @@ static int exported_key_sanity_check( psa_key_type_t type, size_t bits, { uint8_t *p = exported; uint8_t *end = exported + exported_length; - size_t len; #if defined(MBEDTLS_RSA_C) if( type == PSA_KEY_TYPE_RSA_PUBLIC_KEY ) { + size_t len; /* RSAPublicKey ::= SEQUENCE { * modulus INTEGER, -- n * publicExponent INTEGER } -- e diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index 8b15005991..a1d39bf541 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -71,6 +71,7 @@ void set_get_remove( int uid_arg, int flags_arg, data_t *data ) uint32_t flags = flags_arg; struct psa_storage_info_t info; unsigned char *buffer = NULL; + size_t ret_len = 0; ASSERT_ALLOC( buffer, data->len ); @@ -79,8 +80,8 @@ void set_get_remove( int uid_arg, int flags_arg, data_t *data ) PSA_ASSERT( psa_its_get_info( uid, &info ) ); TEST_ASSERT( info.size == data->len ); TEST_ASSERT( info.flags == flags ); - PSA_ASSERT( psa_its_get( uid, 0, data->len, buffer ) ); - ASSERT_COMPARE( data->x, data->len, buffer, data->len ); + PSA_ASSERT( psa_its_get( uid, 0, data->len, buffer, &ret_len ) ); + ASSERT_COMPARE( data->x, data->len, buffer, ret_len ); PSA_ASSERT( psa_its_remove( uid ) ); @@ -100,6 +101,7 @@ void set_overwrite( int uid_arg, uint32_t flags2 = flags2_arg; struct psa_storage_info_t info; unsigned char *buffer = NULL; + size_t ret_len = 0; ASSERT_ALLOC( buffer, MAX( data1->len, data2->len ) ); @@ -107,15 +109,16 @@ void set_overwrite( int uid_arg, PSA_ASSERT( psa_its_get_info( uid, &info ) ); TEST_ASSERT( info.size == data1->len ); TEST_ASSERT( info.flags == flags1 ); - PSA_ASSERT( psa_its_get( uid, 0, data1->len, buffer ) ); - ASSERT_COMPARE( data1->x, data1->len, buffer, data1->len ); + PSA_ASSERT( psa_its_get( uid, 0, data1->len, buffer, &ret_len ) ); + ASSERT_COMPARE( data1->x, data1->len, buffer, ret_len ); PSA_ASSERT( psa_its_set_wrap( uid, data2->len, data2->x, flags2 ) ); PSA_ASSERT( psa_its_get_info( uid, &info ) ); TEST_ASSERT( info.size == data2->len ); TEST_ASSERT( info.flags == flags2 ); - PSA_ASSERT( psa_its_get( uid, 0, data2->len, buffer ) ); - ASSERT_COMPARE( data2->x, data2->len, buffer, data2->len ); + ret_len = 0; + PSA_ASSERT( psa_its_get( uid, 0, data2->len, buffer, &ret_len ) ); + ASSERT_COMPARE( data2->x, data2->len, buffer, ret_len ); PSA_ASSERT( psa_its_remove( uid ) ); @@ -132,6 +135,7 @@ void set_multiple( int first_id, int count ) psa_storage_uid_t uid; char stored[40]; char retrieved[40]; + size_t ret_len = 0; memset( stored, '.', sizeof( stored ) ); for( uid = uid0; uid < uid0 + count; uid++ ) @@ -145,11 +149,11 @@ void set_multiple( int first_id, int count ) { mbedtls_snprintf( stored, sizeof( stored ), "Content of file 0x%08lx", (unsigned long) uid ); - PSA_ASSERT( psa_its_get( uid, 0, sizeof( stored ), retrieved ) ); - ASSERT_COMPARE( retrieved, sizeof( stored ), + PSA_ASSERT( psa_its_get( uid, 0, sizeof( stored ), retrieved, &ret_len ) ); + ASSERT_COMPARE( retrieved, ret_len, stored, sizeof( stored ) ); PSA_ASSERT( psa_its_remove( uid ) ); - TEST_ASSERT( psa_its_get( uid, 0, 0, NULL ) == + TEST_ASSERT( psa_its_get( uid, 0, 0, NULL, NULL ) == PSA_ERROR_DOES_NOT_EXIST ); } @@ -173,7 +177,7 @@ void nonexistent( int uid_arg, int create_and_remove ) TEST_ASSERT( psa_its_remove( uid ) == PSA_ERROR_DOES_NOT_EXIST ); TEST_ASSERT( psa_its_get_info( uid, &info ) == PSA_ERROR_DOES_NOT_EXIST ); - TEST_ASSERT( psa_its_get( uid, 0, 0, NULL ) == + TEST_ASSERT( psa_its_get( uid, 0, 0, NULL, NULL ) == PSA_ERROR_DOES_NOT_EXIST ); exit: @@ -192,6 +196,7 @@ void get_at( int uid_arg, data_t *data, size_t length = length_arg >= 0 ? length_arg : 0; unsigned char *trailer; size_t i; + size_t ret_len = 0; ASSERT_ALLOC( buffer, length + 16 ); trailer = buffer + length; @@ -199,11 +204,11 @@ void get_at( int uid_arg, data_t *data, PSA_ASSERT( psa_its_set_wrap( uid, data->len, data->x, 0 ) ); - status = psa_its_get( uid, offset, length_arg, buffer ); + status = psa_its_get( uid, offset, length_arg, buffer, &ret_len ); TEST_ASSERT( status == (psa_status_t) expected_status ); if( status == PSA_SUCCESS ) - ASSERT_COMPARE( data->x + offset, length, - buffer, length ); + ASSERT_COMPARE( data->x + offset, (size_t) length_arg, + buffer, ret_len ); for( i = 0; i < 16; i++ ) TEST_ASSERT( trailer[i] == '-' ); PSA_ASSERT( psa_its_remove( uid ) ); diff --git a/visualc/VS2010/aescrypt2.vcxproj b/visualc/VS2010/aescrypt2.vcxproj index db387f979e..63a124aeea 100644 --- a/visualc/VS2010/aescrypt2.vcxproj +++ b/visualc/VS2010/aescrypt2.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/benchmark.vcxproj b/visualc/VS2010/benchmark.vcxproj index 934c844388..ffbd1ad4d2 100644 --- a/visualc/VS2010/benchmark.vcxproj +++ b/visualc/VS2010/benchmark.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/crypt_and_hash.vcxproj b/visualc/VS2010/crypt_and_hash.vcxproj index 99199d965f..fb7ef77d17 100644 --- a/visualc/VS2010/crypt_and_hash.vcxproj +++ b/visualc/VS2010/crypt_and_hash.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/crypto_examples.vcxproj b/visualc/VS2010/crypto_examples.vcxproj index 9ca6b64855..2fa23a7f90 100644 --- a/visualc/VS2010/crypto_examples.vcxproj +++ b/visualc/VS2010/crypto_examples.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/dh_genprime.vcxproj b/visualc/VS2010/dh_genprime.vcxproj index d9c19009a9..fdd6c6fdf8 100644 --- a/visualc/VS2010/dh_genprime.vcxproj +++ b/visualc/VS2010/dh_genprime.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/ecdh_curve25519.vcxproj b/visualc/VS2010/ecdh_curve25519.vcxproj index 1120111f19..748b6d1213 100644 --- a/visualc/VS2010/ecdh_curve25519.vcxproj +++ b/visualc/VS2010/ecdh_curve25519.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/ecdsa.vcxproj b/visualc/VS2010/ecdsa.vcxproj index 3718c9f272..03418d082b 100644 --- a/visualc/VS2010/ecdsa.vcxproj +++ b/visualc/VS2010/ecdsa.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/gen_entropy.vcxproj b/visualc/VS2010/gen_entropy.vcxproj index 4c57655b27..89b41c0815 100644 --- a/visualc/VS2010/gen_entropy.vcxproj +++ b/visualc/VS2010/gen_entropy.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/gen_key.vcxproj b/visualc/VS2010/gen_key.vcxproj index a07e1aacc3..c8ea11f428 100644 --- a/visualc/VS2010/gen_key.vcxproj +++ b/visualc/VS2010/gen_key.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/gen_random_ctr_drbg.vcxproj b/visualc/VS2010/gen_random_ctr_drbg.vcxproj index 11740c448b..64200afbe5 100644 --- a/visualc/VS2010/gen_random_ctr_drbg.vcxproj +++ b/visualc/VS2010/gen_random_ctr_drbg.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/gen_random_havege.vcxproj b/visualc/VS2010/gen_random_havege.vcxproj index 01253ceefb..70c8138a07 100644 --- a/visualc/VS2010/gen_random_havege.vcxproj +++ b/visualc/VS2010/gen_random_havege.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/generic_sum.vcxproj b/visualc/VS2010/generic_sum.vcxproj index 0f2ecb43ca..21bd90f62c 100644 --- a/visualc/VS2010/generic_sum.vcxproj +++ b/visualc/VS2010/generic_sum.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/hello.vcxproj b/visualc/VS2010/hello.vcxproj index c986b07bed..b5f6eb005a 100644 --- a/visualc/VS2010/hello.vcxproj +++ b/visualc/VS2010/hello.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/key_app.vcxproj b/visualc/VS2010/key_app.vcxproj index f96a0b052b..0fc246a8f1 100644 --- a/visualc/VS2010/key_app.vcxproj +++ b/visualc/VS2010/key_app.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/key_app_writer.vcxproj b/visualc/VS2010/key_app_writer.vcxproj index 0e4af3a589..e4ef62b04c 100644 --- a/visualc/VS2010/key_app_writer.vcxproj +++ b/visualc/VS2010/key_app_writer.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/key_ladder_demo.vcxproj b/visualc/VS2010/key_ladder_demo.vcxproj index 80914ffbe3..b8fe6a09bd 100644 --- a/visualc/VS2010/key_ladder_demo.vcxproj +++ b/visualc/VS2010/key_ladder_demo.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/mbedTLS.vcxproj b/visualc/VS2010/mbedTLS.vcxproj index 2034a8411a..2db9a162e7 100644 --- a/visualc/VS2010/mbedTLS.vcxproj +++ b/visualc/VS2010/mbedTLS.vcxproj @@ -158,7 +158,6 @@ - diff --git a/visualc/VS2010/mpi_demo.vcxproj b/visualc/VS2010/mpi_demo.vcxproj index d68bc75b37..d770d35aff 100644 --- a/visualc/VS2010/mpi_demo.vcxproj +++ b/visualc/VS2010/mpi_demo.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/pem2der.vcxproj b/visualc/VS2010/pem2der.vcxproj index 507c79a4d9..2f1248c5df 100644 --- a/visualc/VS2010/pem2der.vcxproj +++ b/visualc/VS2010/pem2der.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/pk_decrypt.vcxproj b/visualc/VS2010/pk_decrypt.vcxproj index 5ccaf4f1e9..168adf34b7 100644 --- a/visualc/VS2010/pk_decrypt.vcxproj +++ b/visualc/VS2010/pk_decrypt.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/pk_encrypt.vcxproj b/visualc/VS2010/pk_encrypt.vcxproj index d5ef208d8e..bb09f06aaa 100644 --- a/visualc/VS2010/pk_encrypt.vcxproj +++ b/visualc/VS2010/pk_encrypt.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/pk_sign.vcxproj b/visualc/VS2010/pk_sign.vcxproj index d21f17a414..98941f4be0 100644 --- a/visualc/VS2010/pk_sign.vcxproj +++ b/visualc/VS2010/pk_sign.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/pk_verify.vcxproj b/visualc/VS2010/pk_verify.vcxproj index 637ddd6f5e..6d3006e612 100644 --- a/visualc/VS2010/pk_verify.vcxproj +++ b/visualc/VS2010/pk_verify.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/psa_constant_names.vcxproj b/visualc/VS2010/psa_constant_names.vcxproj index 2618c7c0a8..41cb85b6d2 100644 --- a/visualc/VS2010/psa_constant_names.vcxproj +++ b/visualc/VS2010/psa_constant_names.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/query_compile_time_config.vcxproj b/visualc/VS2010/query_compile_time_config.vcxproj index dcb6f32c7f..8e7f07bd0e 100644 --- a/visualc/VS2010/query_compile_time_config.vcxproj +++ b/visualc/VS2010/query_compile_time_config.vcxproj @@ -55,7 +55,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/rsa_decrypt.vcxproj b/visualc/VS2010/rsa_decrypt.vcxproj index 9e1d0a20ea..ffba32a6a2 100644 --- a/visualc/VS2010/rsa_decrypt.vcxproj +++ b/visualc/VS2010/rsa_decrypt.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/rsa_encrypt.vcxproj b/visualc/VS2010/rsa_encrypt.vcxproj index c3b03716c9..9f5f327841 100644 --- a/visualc/VS2010/rsa_encrypt.vcxproj +++ b/visualc/VS2010/rsa_encrypt.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/rsa_genkey.vcxproj b/visualc/VS2010/rsa_genkey.vcxproj index e6b5060000..824e3043ce 100644 --- a/visualc/VS2010/rsa_genkey.vcxproj +++ b/visualc/VS2010/rsa_genkey.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/rsa_sign.vcxproj b/visualc/VS2010/rsa_sign.vcxproj index c1147c3c2f..dda4756cdc 100644 --- a/visualc/VS2010/rsa_sign.vcxproj +++ b/visualc/VS2010/rsa_sign.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/rsa_sign_pss.vcxproj b/visualc/VS2010/rsa_sign_pss.vcxproj index adfee6d9cf..31da8cadee 100644 --- a/visualc/VS2010/rsa_sign_pss.vcxproj +++ b/visualc/VS2010/rsa_sign_pss.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/rsa_verify.vcxproj b/visualc/VS2010/rsa_verify.vcxproj index bb44b4f9df..b78dfc338e 100644 --- a/visualc/VS2010/rsa_verify.vcxproj +++ b/visualc/VS2010/rsa_verify.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/rsa_verify_pss.vcxproj b/visualc/VS2010/rsa_verify_pss.vcxproj index 7781aa51aa..220ad2d421 100644 --- a/visualc/VS2010/rsa_verify_pss.vcxproj +++ b/visualc/VS2010/rsa_verify_pss.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/selftest.vcxproj b/visualc/VS2010/selftest.vcxproj index 12ff76d70f..1f5e10918f 100644 --- a/visualc/VS2010/selftest.vcxproj +++ b/visualc/VS2010/selftest.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/strerror.vcxproj b/visualc/VS2010/strerror.vcxproj index d7ec570d63..c3ec8fa746 100644 --- a/visualc/VS2010/strerror.vcxproj +++ b/visualc/VS2010/strerror.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK diff --git a/visualc/VS2010/zeroize.vcxproj b/visualc/VS2010/zeroize.vcxproj index 9d311c7217..dff71d30e5 100644 --- a/visualc/VS2010/zeroize.vcxproj +++ b/visualc/VS2010/zeroize.vcxproj @@ -54,7 +54,6 @@ false true Unicode - Windows7.1SDK