mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2025-04-15 23:42:41 +00:00
Merge pull request #9567 from minosgalanakis/config_split
PSA Crypto Configuration Split
This commit is contained in:
Ronald Cron
GitHub
commit
21837fc476
@ -333,11 +333,11 @@ function(set_config_files_compile_definitions target)
|
||||
endif()
|
||||
if(TF_PSA_CRYPTO_CONFIG_FILE)
|
||||
target_compile_definitions(${target}
|
||||
PUBLIC MBEDTLS_PSA_CRYPTO_CONFIG_FILE="${TF_PSA_CRYPTO_CONFIG_FILE}")
|
||||
PUBLIC TF_PSA_CRYPTO_CONFIG_FILE="${TF_PSA_CRYPTO_CONFIG_FILE}")
|
||||
endif()
|
||||
if(TF_PSA_CRYPTO_USER_CONFIG_FILE)
|
||||
target_compile_definitions(${target}
|
||||
PUBLIC MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE="${TF_PSA_CRYPTO_USER_CONFIG_FILE}")
|
||||
PUBLIC TF_PSA_CRYPTO_USER_CONFIG_FILE="${TF_PSA_CRYPTO_USER_CONFIG_FILE}")
|
||||
endif()
|
||||
endfunction(set_config_files_compile_definitions)
|
||||
|
||||
|
||||
16
ChangeLog.d/configuration-split.txt
Normal file
16
ChangeLog.d/configuration-split.txt
Normal file
@ -0,0 +1,16 @@
|
||||
Changes
|
||||
* Cryptography and platform configuration options have been migrated
|
||||
from the Mbed TLS library configuration file mbedtls_config.h to
|
||||
crypto_config.h that will become the TF-PSA-Crypto configuration file,
|
||||
see config-split.md for more information. The reference and test custom
|
||||
configuration files respectively in configs/ and tests/configs/ have
|
||||
been updated accordingly.
|
||||
To migrate custom Mbed TLS configurations where
|
||||
MBEDTLS_PSA_CRYPTO_CONFIG is disabled, you should first adapt them
|
||||
to the PSA configuration scheme based on PSA_WANT_XXX symbols
|
||||
(see psa-conditional-inclusion-c.md for more information).
|
||||
To migrate custom Mbed TLS configurations where
|
||||
MBEDTLS_PSA_CRYPTO_CONFIG is enabled, you should migrate the
|
||||
cryptographic and platform configuration options from mbedtls_config.h
|
||||
to crypto_config.h (see config-split.md for more information and configs/
|
||||
for examples).
|
||||
@ -23,18 +23,7 @@
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/crypto-config-ccm-psk-tls1_2.h"
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
#define MBEDTLS_USE_PSA_CRYPTO
|
||||
|
||||
/* System support */
|
||||
//#define MBEDTLS_HAVE_TIME /* Optionally used in Hello messages */
|
||||
/* Other MBEDTLS_HAVE_XXX flags irrelevant for this configuration */
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_NET_C
|
||||
#define MBEDTLS_SSL_CLI_C
|
||||
#define MBEDTLS_SSL_COOKIE_C
|
||||
@ -68,19 +57,9 @@
|
||||
#define MBEDTLS_SSL_IN_CONTENT_LEN 256
|
||||
#define MBEDTLS_SSL_OUT_CONTENT_LEN 256
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save some RAM by adjusting to your exact needs */
|
||||
#define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */
|
||||
|
||||
/*
|
||||
* You should adjust this to the exact number of sources you're using: default
|
||||
* is the "platform_entropy_poll" source, but you may want to add other ones
|
||||
* Minimum is 2 for the entropy test suite.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
|
||||
|
||||
/* Error messages and TLS debugging traces
|
||||
* (huge code size increase, needed for tests/ssl-opt.sh) */
|
||||
//#define MBEDTLS_DEBUG_C
|
||||
|
||||
@ -22,18 +22,7 @@
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/crypto-config-ccm-psk-tls1_2.h"
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
#define MBEDTLS_USE_PSA_CRYPTO
|
||||
|
||||
/* System support */
|
||||
//#define MBEDTLS_HAVE_TIME /* Optionally used in Hello messages */
|
||||
/* Other MBEDTLS_HAVE_XXX flags irrelevant for this configuration */
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_NET_C
|
||||
#define MBEDTLS_SSL_CLI_C
|
||||
#define MBEDTLS_SSL_SRV_C
|
||||
@ -59,19 +48,10 @@
|
||||
#define MBEDTLS_SSL_IN_CONTENT_LEN 1024
|
||||
#define MBEDTLS_SSL_OUT_CONTENT_LEN 1024
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save some RAM by adjusting to your exact needs */
|
||||
#define MBEDTLS_PSK_MAX_LEN 16 /* 128-bits keys are generally enough */
|
||||
|
||||
/*
|
||||
* You should adjust this to the exact number of sources you're using: default
|
||||
* is the "platform_entropy_poll" source, but you may want to add other ones
|
||||
* Minimum is 2 for the entropy test suite.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
|
||||
|
||||
/* Error messages and TLS debugging traces
|
||||
* (huge code size increase, needed for tests/ssl-opt.sh) */
|
||||
//#define MBEDTLS_DEBUG_C
|
||||
|
||||
@ -21,58 +21,18 @@
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/crypto-config-suite-b.h"
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
#define MBEDTLS_USE_PSA_CRYPTO
|
||||
|
||||
/* System support */
|
||||
#define MBEDTLS_HAVE_ASM
|
||||
#define MBEDTLS_HAVE_TIME
|
||||
|
||||
/* Mbed TLS feature support */
|
||||
#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
|
||||
#define MBEDTLS_SSL_PROTO_TLS1_2
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_NET_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
#define MBEDTLS_SSL_CLI_C
|
||||
#define MBEDTLS_SSL_SRV_C
|
||||
#define MBEDTLS_SSL_TLS_C
|
||||
#define MBEDTLS_X509_CRT_PARSE_C
|
||||
#define MBEDTLS_X509_USE_C
|
||||
|
||||
/* For test certificates */
|
||||
#define MBEDTLS_BASE64_C
|
||||
#define MBEDTLS_PEM_PARSE_C
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save RAM by adjusting to our exact needs */
|
||||
#define MBEDTLS_MPI_MAX_SIZE 48 // 384-bit EC curve = 48 bytes
|
||||
|
||||
/* Save RAM at the expense of speed, see ecp.h */
|
||||
#define MBEDTLS_ECP_WINDOW_SIZE 2
|
||||
#define MBEDTLS_ECP_FIXED_POINT_OPTIM 0
|
||||
|
||||
/* Significant speed benefit at the expense of some ROM */
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
|
||||
/*
|
||||
* You should adjust this to the exact number of sources you're using: default
|
||||
* is the "mbedtls_platform_entropy_poll" source, but you may want to add other ones.
|
||||
* Minimum is 2 for the entropy test suite.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
|
||||
|
||||
/* Save ROM and a few bytes of RAM by specifying our own ciphersuite list */
|
||||
#define MBEDTLS_SSL_CIPHERSUITES \
|
||||
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, \
|
||||
|
||||
@ -8,42 +8,9 @@
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/crypto-config-symmetric-only.h"
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
#define MBEDTLS_USE_PSA_CRYPTO
|
||||
|
||||
/* System support */
|
||||
//#define MBEDTLS_HAVE_ASM
|
||||
#define MBEDTLS_HAVE_TIME
|
||||
#define MBEDTLS_HAVE_TIME_DATE
|
||||
|
||||
/* Mbed TLS feature support */
|
||||
#define MBEDTLS_ERROR_STRERROR_DUMMY
|
||||
#define MBEDTLS_FS_IO
|
||||
#define MBEDTLS_ENTROPY_NV_SEED
|
||||
#define MBEDTLS_SELF_TEST
|
||||
#define MBEDTLS_VERSION_FEATURES
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_BASE64_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_ERROR_C
|
||||
#define MBEDTLS_HMAC_DRBG_C
|
||||
#define MBEDTLS_NIST_KW_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PEM_PARSE_C
|
||||
#define MBEDTLS_PEM_WRITE_C
|
||||
#define MBEDTLS_PKCS5_C
|
||||
#define MBEDTLS_PKCS12_C
|
||||
#define MBEDTLS_PLATFORM_C
|
||||
#define MBEDTLS_PSA_CRYPTO_SE_C
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
#define MBEDTLS_PSA_ITS_FILE_C
|
||||
|
||||
//#define MBEDTLS_THREADING_C
|
||||
#define MBEDTLS_TIMING_C
|
||||
#define MBEDTLS_VERSION_C
|
||||
|
||||
@ -10,59 +10,3 @@
|
||||
|
||||
/* TF-M medium profile: mbedtls legacy configuration */
|
||||
#include "../configs/ext/tfm_mbedcrypto_config_profile_medium.h"
|
||||
|
||||
/* TF-M medium profile: PSA crypto configuration */
|
||||
#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/ext/crypto_config_profile_medium.h"
|
||||
|
||||
/***********************************************************/
|
||||
/* Tweak the configuration to remove dependencies on TF-M. */
|
||||
/***********************************************************/
|
||||
|
||||
/* MBEDTLS_PSA_CRYPTO_SPM needs third-party files, so disable it. */
|
||||
#undef MBEDTLS_PSA_CRYPTO_SPM
|
||||
|
||||
/* Disable buffer-based memory allocator. This isn't strictly required,
|
||||
* but using the native allocator is faster and works better with
|
||||
* memory management analysis frameworks such as ASan. */
|
||||
#undef MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
|
||||
// This macro is enabled in TFM Medium but is disabled here because it is
|
||||
// incompatible with baremetal builds in Mbed TLS.
|
||||
#undef MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
|
||||
// This macro is enabled in TFM Medium but is disabled here because it is
|
||||
// incompatible with baremetal builds in Mbed TLS.
|
||||
#undef MBEDTLS_ENTROPY_NV_SEED
|
||||
|
||||
// These platform-related TF-M settings are not useful here.
|
||||
#undef MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
|
||||
#undef MBEDTLS_PLATFORM_STD_MEM_HDR
|
||||
#undef MBEDTLS_PLATFORM_SNPRINTF_MACRO
|
||||
#undef MBEDTLS_PLATFORM_PRINTF_ALT
|
||||
#undef MBEDTLS_PLATFORM_STD_EXIT_SUCCESS
|
||||
#undef MBEDTLS_PLATFORM_STD_EXIT_FAILURE
|
||||
|
||||
/*
|
||||
* In order to get an example config that works cleanly out-of-the-box
|
||||
* for both baremetal and non-baremetal builds, we detect baremetal builds
|
||||
* (either IAR, Arm compiler or __ARM_EABI__ defined), and adjust some
|
||||
* variables accordingly.
|
||||
*/
|
||||
#if defined(__IAR_SYSTEMS_ICC__) || defined(__ARMCC_VERSION) || defined(__ARM_EABI__)
|
||||
#define MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
#else
|
||||
/* Use built-in platform entropy functions (TF-M provides its own). */
|
||||
#undef MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
#endif
|
||||
|
||||
/***********************************************************************
|
||||
* Local changes to crypto config below this delimiter
|
||||
**********************************************************************/
|
||||
|
||||
// We expect TF-M to pick this up soon
|
||||
#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
|
||||
|
||||
/* CCM is the only cipher/AEAD enabled in TF-M configuration files, but it
|
||||
* does not need CIPHER_C to be enabled, so we can disable it in order
|
||||
* to reduce code size further. */
|
||||
#undef MBEDTLS_CIPHER_C
|
||||
|
||||
@ -21,17 +21,7 @@
|
||||
* See README.txt for usage instructions.
|
||||
*/
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/crypto-config-thread.h"
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
#define MBEDTLS_USE_PSA_CRYPTO
|
||||
|
||||
/* System support */
|
||||
#define MBEDTLS_HAVE_ASM
|
||||
|
||||
/* Mbed TLS feature support */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
|
||||
#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
|
||||
#define MBEDTLS_SSL_PROTO_TLS1_2
|
||||
@ -40,15 +30,6 @@
|
||||
#define MBEDTLS_SSL_DTLS_HELLO_VERIFY
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_HMAC_DRBG_C
|
||||
#define MBEDTLS_MD_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
#define MBEDTLS_SSL_COOKIE_C
|
||||
#define MBEDTLS_SSL_CLI_C
|
||||
#define MBEDTLS_SSL_SRV_C
|
||||
@ -58,11 +39,5 @@
|
||||
#define MBEDTLS_NET_C
|
||||
#define MBEDTLS_TIMING_C
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save RAM by adjusting to our exact needs */
|
||||
#define MBEDTLS_MPI_MAX_SIZE 32 // 256-bit EC curve = 32 bytes
|
||||
|
||||
/* Save ROM and a few bytes of RAM by specifying our own ciphersuite list */
|
||||
#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
|
||||
|
||||
@ -20,4 +20,9 @@
|
||||
#define PSA_WANT_KEY_TYPE_AES 1
|
||||
#define PSA_WANT_KEY_TYPE_RAW_DATA 1
|
||||
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
|
||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
||||
|
||||
@ -22,4 +22,24 @@
|
||||
#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1
|
||||
|
||||
#define PSA_WANT_KEY_TYPE_AES 1
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* System support */
|
||||
//#define MBEDTLS_HAVE_TIME /* Optionally used in Hello messages */
|
||||
/* Other MBEDTLS_HAVE_XXX flags irrelevant for this configuration */
|
||||
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/*
|
||||
* You should adjust this to the exact number of sources you're using: default
|
||||
* is the "platform_entropy_poll" source, but you may want to add other ones
|
||||
* Minimum is 2 for the entropy test suite.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
|
||||
|
||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
||||
|
||||
@ -38,4 +38,42 @@
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* System support */
|
||||
#define MBEDTLS_HAVE_ASM
|
||||
#define MBEDTLS_HAVE_TIME
|
||||
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
|
||||
/* For test certificates */
|
||||
#define MBEDTLS_BASE64_C
|
||||
#define MBEDTLS_PEM_PARSE_C
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save RAM by adjusting to our exact needs */
|
||||
#define MBEDTLS_MPI_MAX_SIZE 48 // 384-bit EC curve = 48 bytes
|
||||
|
||||
/* Save RAM at the expense of speed, see ecp.h */
|
||||
#define MBEDTLS_ECP_WINDOW_SIZE 2
|
||||
#define MBEDTLS_ECP_FIXED_POINT_OPTIM 0
|
||||
|
||||
/* Significant speed benefit at the expense of some ROM */
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
|
||||
/*
|
||||
* You should adjust this to the exact number of sources you're using: default
|
||||
* is the "mbedtls_platform_entropy_poll" source, but you may want to add other ones.
|
||||
* Minimum is 2 for the entropy test suite.
|
||||
*/
|
||||
#define MBEDTLS_ENTROPY_MAX_SOURCES 2
|
||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
||||
|
||||
@ -55,4 +55,37 @@
|
||||
#define PSA_WANT_KEY_TYPE_DES 1
|
||||
#define PSA_WANT_KEY_TYPE_HMAC 1
|
||||
|
||||
#define MBEDTLS_SELF_TEST
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* System support */
|
||||
//#define MBEDTLS_HAVE_ASM
|
||||
#define MBEDTLS_HAVE_TIME
|
||||
#define MBEDTLS_HAVE_TIME_DATE
|
||||
|
||||
#define MBEDTLS_FS_IO
|
||||
#define MBEDTLS_ENTROPY_NV_SEED
|
||||
|
||||
/* Mbed TLS modules */
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_BASE64_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_ERROR_C
|
||||
#define MBEDTLS_HMAC_DRBG_C
|
||||
#define MBEDTLS_NIST_KW_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PEM_PARSE_C
|
||||
#define MBEDTLS_PEM_WRITE_C
|
||||
#define MBEDTLS_PKCS5_C
|
||||
#define MBEDTLS_PKCS12_C
|
||||
#define MBEDTLS_PLATFORM_C
|
||||
#define MBEDTLS_PSA_CRYPTO_SE_C
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
#define MBEDTLS_PSA_ITS_FILE_C
|
||||
|
||||
//#define MBEDTLS_THREADING_C
|
||||
|
||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
||||
|
||||
@ -44,4 +44,27 @@
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* System support */
|
||||
#define MBEDTLS_HAVE_ASM
|
||||
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
#define MBEDTLS_ECP_NIST_OPTIM
|
||||
|
||||
#define MBEDTLS_ASN1_PARSE_C
|
||||
#define MBEDTLS_ASN1_WRITE_C
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_HMAC_DRBG_C
|
||||
#define MBEDTLS_MD_C
|
||||
#define MBEDTLS_OID_C
|
||||
#define MBEDTLS_PK_C
|
||||
#define MBEDTLS_PK_PARSE_C
|
||||
|
||||
/* Save RAM at the expense of ROM */
|
||||
#define MBEDTLS_AES_ROM_TABLES
|
||||
|
||||
/* Save RAM by adjusting to our exact needs */
|
||||
#define MBEDTLS_MPI_MAX_SIZE 32 // 256-bit EC curve = 32 bytes
|
||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
||||
|
||||
@ -125,6 +125,59 @@
|
||||
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1
|
||||
//#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1
|
||||
|
||||
/***********************************************************/
|
||||
/* Tweak the configuration to remove dependencies on TF-M. */
|
||||
/***********************************************************/
|
||||
|
||||
/* MBEDTLS_PSA_CRYPTO_SPM needs third-party files, so disable it. */
|
||||
#undef MBEDTLS_PSA_CRYPTO_SPM
|
||||
|
||||
/* Disable buffer-based memory allocator. This isn't strictly required,
|
||||
* but using the native allocator is faster and works better with
|
||||
* memory management analysis frameworks such as ASan. */
|
||||
#undef MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
|
||||
// This macro is enabled in TFM Medium but is disabled here because it is
|
||||
// incompatible with baremetal builds in Mbed TLS.
|
||||
#undef MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
|
||||
// This macro is enabled in TFM Medium but is disabled here because it is
|
||||
// incompatible with baremetal builds in Mbed TLS.
|
||||
#undef MBEDTLS_ENTROPY_NV_SEED
|
||||
|
||||
// These platform-related TF-M settings are not useful here.
|
||||
#undef MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
|
||||
#undef MBEDTLS_PLATFORM_STD_MEM_HDR
|
||||
#undef MBEDTLS_PLATFORM_SNPRINTF_MACRO
|
||||
#undef MBEDTLS_PLATFORM_PRINTF_ALT
|
||||
#undef MBEDTLS_PLATFORM_STD_EXIT_SUCCESS
|
||||
#undef MBEDTLS_PLATFORM_STD_EXIT_FAILURE
|
||||
|
||||
/*
|
||||
* In order to get an example config that works cleanly out-of-the-box
|
||||
* for both baremetal and non-baremetal builds, we detect baremetal builds
|
||||
* (either IAR, Arm compiler or __ARM_EABI__ defined), and adjust some
|
||||
* variables accordingly.
|
||||
*/
|
||||
#if defined(__IAR_SYSTEMS_ICC__) || defined(__ARMCC_VERSION) || defined(__ARM_EABI__)
|
||||
#define MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
#else
|
||||
/* Use built-in platform entropy functions (TF-M provides its own). */
|
||||
#undef MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
#endif
|
||||
|
||||
/***********************************************************************
|
||||
* Local changes to crypto config below this delimiter
|
||||
**********************************************************************/
|
||||
|
||||
// We expect TF-M to pick this up soon
|
||||
#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
|
||||
|
||||
/* CCM is the only cipher/AEAD enabled in TF-M configuration files, but it
|
||||
* does not need CIPHER_C to be enabled, so we can disable it in order
|
||||
* to reduce code size further. */
|
||||
#undef MBEDTLS_CIPHER_C
|
||||
|
||||
#ifdef CRYPTO_HW_ACCELERATOR
|
||||
#include "crypto_accelerator_config.h"
|
||||
#endif
|
||||
|
||||
@ -234,7 +234,7 @@
|
||||
* mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols
|
||||
* in mbedtls_config.h.
|
||||
*
|
||||
* If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies
|
||||
* If the symbol #TF_PSA_CRYPTO_CONFIG_FILE is defined, it specifies
|
||||
* an alternative header to include instead of include/psa/crypto_config.h.
|
||||
*
|
||||
* This feature is still experimental and is not ready for production since
|
||||
@ -460,7 +460,7 @@
|
||||
//#define MBEDTLS_USER_CONFIG_FILE "/dev/null"
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE
|
||||
* \def TF_PSA_CRYPTO_CONFIG_FILE
|
||||
*
|
||||
* If defined, this is a header which will be included instead of
|
||||
* `"psa/crypto_config.h"`.
|
||||
@ -475,13 +475,13 @@
|
||||
* The value of this symbol is typically a path in double quotes, either
|
||||
* absolute or relative to a directory on the include search path.
|
||||
*/
|
||||
//#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h"
|
||||
//#define TF_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h"
|
||||
|
||||
/**
|
||||
* \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE
|
||||
* \def TF_PSA_CRYPTO_USER_CONFIG_FILE
|
||||
*
|
||||
* If defined, this is a header which will be included after
|
||||
* `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE.
|
||||
* `"psa/crypto_config.h"` or #TF_PSA_CRYPTO_CONFIG_FILE.
|
||||
* This allows you to modify the default configuration, including the ability
|
||||
* to undefine options that are enabled by default.
|
||||
*
|
||||
@ -492,7 +492,7 @@
|
||||
* The value of this symbol is typically a path in double quotes, either
|
||||
* absolute or relative to a directory on the include search path.
|
||||
*/
|
||||
//#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null"
|
||||
//#define TF_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null"
|
||||
|
||||
/** \} name SECTION: General configuration options */
|
||||
|
||||
|
||||
@ -114,6 +114,7 @@ section dedicated to non boolean configuration options anymore.
|
||||
#define MBEDTLS_HAVE_TIME
|
||||
#define MBEDTLS_HAVE_TIME_DATE
|
||||
//#define MBEDTLS_MEMORY_BACKTRACE
|
||||
//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
//#define MBEDTLS_MEMORY_DEBUG
|
||||
#define MBEDTLS_PLATFORM_C
|
||||
//#define MBEDTLS_PLATFORM_EXIT_ALT
|
||||
@ -248,6 +249,8 @@ PSA_WANT_\* macros as in current `crypto_config.h`.
|
||||
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
//#define MBEDTLS_PSA_INJECT_ENTROPY
|
||||
#define MBEDTLS_PSA_ITS_FILE_C
|
||||
#define MBEDTLS_PSA_KEY_STORE_DYNAMIC
|
||||
//#define MBEDTLS_PSA_STATIC_KEY_SLOTS
|
||||
|
||||
//#define MBEDTLS_ENTROPY_MAX_GATHER 128
|
||||
//#define MBEDTLS_ENTROPY_MAX_SOURCES 20
|
||||
@ -255,6 +258,7 @@ PSA_WANT_\* macros as in current `crypto_config.h`.
|
||||
//#define MBEDTLS_PSA_CRYPTO_PLATFORM_FILE "psa/crypto_platform_alt.h"
|
||||
//#define MBEDTLS_PSA_CRYPTO_STRUCT_FILE "psa/crypto_struct_alt.h"
|
||||
//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32
|
||||
//#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 256
|
||||
```
|
||||
|
||||
#### SECTION Builtin drivers
|
||||
@ -311,6 +315,7 @@ PSA_WANT_\* macros as in current `crypto_config.h`.
|
||||
#define MBEDTLS_CIPHER_MODE_CTR
|
||||
#define MBEDTLS_CIPHER_MODE_OFB
|
||||
#define MBEDTLS_CIPHER_MODE_XTS
|
||||
//#define MBEDTLS_CIPHER_NULL_CIPHER
|
||||
#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
|
||||
#define MBEDTLS_CIPHER_PADDING_PKCS7
|
||||
#define MBEDTLS_CIPHER_PADDING_ZEROS
|
||||
@ -382,7 +387,6 @@ PSA_WANT_\* macros as in current `crypto_config.h`.
|
||||
|
||||
#### SECTION TLS feature selection
|
||||
```
|
||||
//#define MBEDTLS_CIPHER_NULL_CIPHER
|
||||
#define MBEDTLS_DEBUG_C
|
||||
#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
|
||||
#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
|
||||
|
||||
@ -1 +1 @@
|
||||
Subproject commit df0144c4a3c0fc9beea606afde07cf8708233675
|
||||
Subproject commit a2c76945ca090f9dd099001d7c5158557f5a2036
|
||||
@ -131,13 +131,13 @@
|
||||
#endif
|
||||
|
||||
/* PSA crypto configuration */
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_CONFIG_FILE)
|
||||
#include MBEDTLS_PSA_CRYPTO_CONFIG_FILE
|
||||
#if defined(TF_PSA_CRYPTO_CONFIG_FILE)
|
||||
#include TF_PSA_CRYPTO_CONFIG_FILE
|
||||
#else
|
||||
#include "psa/crypto_config.h"
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE)
|
||||
#include MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE
|
||||
#if defined(TF_PSA_CRYPTO_USER_CONFIG_FILE)
|
||||
#include TF_PSA_CRYPTO_USER_CONFIG_FILE
|
||||
#endif
|
||||
|
||||
/* Indicate that all configuration files have been read.
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -420,7 +420,7 @@ class CombinedConfig(config_common.Config):
|
||||
raise ValueError(f'Feature is unstable: \'{name}\'')
|
||||
|
||||
# The default value in the crypto config is '1'
|
||||
if not value:
|
||||
if not value and re.match(self._crypto_regexp, name):
|
||||
value = '1'
|
||||
|
||||
if name not in self.settings:
|
||||
|
||||
@ -340,14 +340,20 @@ libtestdriver1.a:
|
||||
|
||||
# Set the test driver base (minimal) configuration.
|
||||
cp ../tf-psa-crypto/tests/configs/config_test_driver.h ./libtestdriver1/include/mbedtls/mbedtls_config.h
|
||||
cp ../tf-psa-crypto/tests/configs/crypto_config_test_driver.h ./libtestdriver1/tf-psa-crypto/include/psa/crypto_config.h
|
||||
|
||||
# Set the PSA cryptography configuration for the test library.
|
||||
# It is set from the copied include/psa/crypto_config.h of the Mbed TLS
|
||||
# library the test library is intended to be linked with extended by
|
||||
# ../tf-psa-crypto/tests/configs/crypto_config_test_driver_extension.h
|
||||
# to mirror the PSA_ACCEL_* macros.
|
||||
# The configuration is created by joining the base
|
||||
# ../tf-psa-crypto/tests/configs/crypto_config_test_driver.h,
|
||||
# with the the library's PSA_WANT_* macros extracted from
|
||||
# ./tf-psa-crypto/include/psa/crypto_config.h
|
||||
# and then extended with entries of
|
||||
# ../tf-psa-crypto/tests/configs/crypto_config_test_driver_extension.h
|
||||
# to mirror the PSA_ACCEL_* macros.
|
||||
|
||||
mv ./libtestdriver1/tf-psa-crypto/include/psa/crypto_config.h ./libtestdriver1/tf-psa-crypto/include/psa/crypto_config.h.bak
|
||||
head -n -1 ./libtestdriver1/tf-psa-crypto/include/psa/crypto_config.h.bak > ./libtestdriver1/tf-psa-crypto/include/psa/crypto_config.h
|
||||
grep '^#define PSA_WANT_*' ../tf-psa-crypto/include/psa/crypto_config.h >> ./libtestdriver1/tf-psa-crypto/include/psa/crypto_config.h
|
||||
cat ../tf-psa-crypto/tests/configs/crypto_config_test_driver_extension.h >> ./libtestdriver1/tf-psa-crypto/include/psa/crypto_config.h
|
||||
echo "#endif /* PSA_CRYPTO_CONFIG_H */" >> ./libtestdriver1/tf-psa-crypto/include/psa/crypto_config.h
|
||||
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
/* MBEDTLS_USER_CONFIG_FILE for testing.
|
||||
/* TF_PSA_CRYPTO_USER_CONFIG_FILE for testing.
|
||||
* Only used for a few test configurations.
|
||||
*
|
||||
* Typical usage (note multiple levels of quoting):
|
||||
* make CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'"
|
||||
* make CFLAGS="'-DTF_PSA_CRYPTO_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'"
|
||||
*/
|
||||
|
||||
/*
|
||||
|
||||
@ -87,11 +87,6 @@ class CoverageTask(outcome_analysis.CoverageTask):
|
||||
re.compile(r'EC restart:.*no USE_PSA.*'),
|
||||
],
|
||||
'test_suite_config.mbedtls_boolean': [
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9583
|
||||
'Config: !MBEDTLS_ECP_NIST_OPTIM',
|
||||
# We never test without the PSA client code. Should we?
|
||||
# https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/112
|
||||
'Config: !MBEDTLS_PSA_CRYPTO_CLIENT',
|
||||
# Missing coverage of test configurations.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9585
|
||||
'Config: !MBEDTLS_SSL_DTLS_ANTI_REPLAY',
|
||||
@ -101,34 +96,6 @@ class CoverageTask(outcome_analysis.CoverageTask):
|
||||
# We don't run test_suite_config when we test this.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9586
|
||||
'Config: !MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED',
|
||||
# We only test multithreading with pthreads.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9584
|
||||
'Config: !MBEDTLS_THREADING_PTHREAD',
|
||||
# Built but not tested.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9587
|
||||
'Config: MBEDTLS_AES_USE_HARDWARE_ONLY',
|
||||
# Untested platform-specific optimizations.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9588
|
||||
'Config: MBEDTLS_HAVE_SSE2',
|
||||
# Obsolete configuration option, to be replaced by
|
||||
# PSA entropy drivers.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/8150
|
||||
'Config: MBEDTLS_NO_PLATFORM_ENTROPY',
|
||||
# Untested aspect of the platform interface.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9589
|
||||
'Config: MBEDTLS_PLATFORM_NO_STD_FUNCTIONS',
|
||||
# In a client-server build, test_suite_config runs in the
|
||||
# client configuration, so it will never report
|
||||
# MBEDTLS_PSA_CRYPTO_SPM as enabled. That's ok.
|
||||
'Config: MBEDTLS_PSA_CRYPTO_SPM',
|
||||
# We don't test on armv8 yet.
|
||||
'Config: MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT',
|
||||
'Config: MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY',
|
||||
'Config: MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY',
|
||||
'Config: MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY',
|
||||
# We don't run test_suite_config when we test this.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9586
|
||||
'Config: MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND',
|
||||
],
|
||||
'test_suite_config.psa_boolean': [
|
||||
# We don't test with HMAC disabled.
|
||||
@ -174,6 +141,39 @@ class CoverageTask(outcome_analysis.CoverageTask):
|
||||
'Config: PSA_WANT_KEY_TYPE_ECC_KEY_PAIR',
|
||||
'Config: PSA_WANT_KEY_TYPE_RSA_KEY_PAIR',
|
||||
'Config: PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE',
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9583
|
||||
'Config: !MBEDTLS_ECP_NIST_OPTIM',
|
||||
# We never test without the PSA client code. Should we?
|
||||
# https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/112
|
||||
'Config: !MBEDTLS_PSA_CRYPTO_CLIENT',
|
||||
# We only test multithreading with pthreads.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9584
|
||||
'Config: !MBEDTLS_THREADING_PTHREAD',
|
||||
# Built but not tested.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9587
|
||||
'Config: MBEDTLS_AES_USE_HARDWARE_ONLY',
|
||||
# Untested platform-specific optimizations.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9588
|
||||
'Config: MBEDTLS_HAVE_SSE2',
|
||||
# Obsolete configuration option, to be replaced by
|
||||
# PSA entropy drivers.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/8150
|
||||
'Config: MBEDTLS_NO_PLATFORM_ENTROPY',
|
||||
# Untested aspect of the platform interface.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9589
|
||||
'Config: MBEDTLS_PLATFORM_NO_STD_FUNCTIONS',
|
||||
# In a client-server build, test_suite_config runs in the
|
||||
# client configuration, so it will never report
|
||||
# MBEDTLS_PSA_CRYPTO_SPM as enabled. That's ok.
|
||||
'Config: MBEDTLS_PSA_CRYPTO_SPM',
|
||||
# We don't test on armv8 yet.
|
||||
'Config: MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT',
|
||||
'Config: MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY',
|
||||
'Config: MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY',
|
||||
'Config: MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY',
|
||||
# We don't run test_suite_config when we test this.
|
||||
# https://github.com/Mbed-TLS/mbedtls/issues/9586
|
||||
'Config: MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND',
|
||||
],
|
||||
'test_suite_config.psa_combinations': [
|
||||
# We don't test this unusual, but sensible configuration.
|
||||
|
||||
@ -50,7 +50,7 @@ from mbedtls_framework import build_tree
|
||||
|
||||
# Naming patterns to check against. These are defined outside the NameCheck
|
||||
# class for ease of modification.
|
||||
PUBLIC_MACRO_PATTERN = r"^(MBEDTLS|PSA)_[0-9A-Z_]*[0-9A-Z]$"
|
||||
PUBLIC_MACRO_PATTERN = r"^(MBEDTLS|PSA|TF_PSA)_[0-9A-Z_]*[0-9A-Z]$"
|
||||
INTERNAL_MACRO_PATTERN = r"^[0-9A-Za-z_]*[0-9A-Z]$"
|
||||
CONSTANTS_PATTERN = PUBLIC_MACRO_PATTERN
|
||||
IDENTIFIER_PATTERN = r"^(mbedtls|psa)_[0-9a-z_]*[0-9a-z]$"
|
||||
|
||||
@ -167,6 +167,7 @@ support_test_cmake_as_package_install () {
|
||||
component_build_cmake_custom_config_file () {
|
||||
# Make a copy of config file to use for the in-tree test
|
||||
cp "$CONFIG_H" include/mbedtls_config_in_tree_copy.h
|
||||
cp "$CRYPTO_CONFIG_H" include/mbedtls_crypto_config_in_tree_copy.h
|
||||
|
||||
MBEDTLS_ROOT_DIR="$PWD"
|
||||
mkdir "$OUT_OF_SOURCE_DIR"
|
||||
@ -177,21 +178,27 @@ component_build_cmake_custom_config_file () {
|
||||
make
|
||||
|
||||
msg "build: cmake with -DMBEDTLS_CONFIG_FILE"
|
||||
scripts/config.py -w full_config.h full
|
||||
cd "$MBEDTLS_ROOT_DIR"
|
||||
scripts/config.py full
|
||||
cp include/mbedtls/mbedtls_config.h $OUT_OF_SOURCE_DIR/full_config.h
|
||||
cp tf-psa-crypto/include/psa/crypto_config.h $OUT_OF_SOURCE_DIR/full_crypto_config.h
|
||||
cd "$OUT_OF_SOURCE_DIR"
|
||||
echo '#error "cmake -DMBEDTLS_CONFIG_FILE is not working."' > "$MBEDTLS_ROOT_DIR/$CONFIG_H"
|
||||
cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h "$MBEDTLS_ROOT_DIR"
|
||||
cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h -DTF_PSA_CRYPTO_CONFIG_FILE=full_crypto_config.h "$MBEDTLS_ROOT_DIR"
|
||||
make
|
||||
|
||||
msg "build: cmake with -DMBEDTLS_CONFIG_FILE + -DMBEDTLS_USER_CONFIG_FILE"
|
||||
msg "build: cmake with -DMBEDTLS/TF_PSA_CRYPTO_CONFIG_FILE + -DMBEDTLS/TF_PSA_CRYPTO_USER_CONFIG_FILE"
|
||||
# In the user config, disable one feature (for simplicity, pick a feature
|
||||
# that nothing else depends on).
|
||||
echo '#undef MBEDTLS_NIST_KW_C' >user_config.h
|
||||
echo '#undef MBEDTLS_SSL_ALL_ALERT_MESSAGES' >user_config.h
|
||||
echo '#undef MBEDTLS_NIST_KW_C' >crypto_user_config.h
|
||||
|
||||
cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h -DMBEDTLS_USER_CONFIG_FILE=user_config.h "$MBEDTLS_ROOT_DIR"
|
||||
cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h -DMBEDTLS_USER_CONFIG_FILE=user_config.h -DTF_PSA_CRYPTO_CONFIG_FILE=full_crypto_config.h -DTF_PSA_CRYPTO_USER_CONFIG_FILE=crypto_user_config.h "$MBEDTLS_ROOT_DIR"
|
||||
make
|
||||
not programs/test/query_compile_time_config MBEDTLS_SSL_ALL_ALERT_MESSAGES
|
||||
not programs/test/query_compile_time_config MBEDTLS_NIST_KW_C
|
||||
|
||||
rm -f user_config.h full_config.h
|
||||
rm -f user_config.h full_config.h full_crypto_config.h
|
||||
|
||||
cd "$MBEDTLS_ROOT_DIR"
|
||||
rm -rf "$OUT_OF_SOURCE_DIR"
|
||||
@ -200,24 +207,29 @@ component_build_cmake_custom_config_file () {
|
||||
|
||||
# Restore config for the in-tree test
|
||||
mv include/mbedtls_config_in_tree_copy.h "$CONFIG_H"
|
||||
mv include/mbedtls_crypto_config_in_tree_copy.h "$CRYPTO_CONFIG_H"
|
||||
|
||||
# Build once to get the generated files (which need an intact config)
|
||||
cmake .
|
||||
make
|
||||
|
||||
msg "build: cmake (in-tree) with -DMBEDTLS_CONFIG_FILE"
|
||||
scripts/config.py -w full_config.h full
|
||||
cp include/mbedtls/mbedtls_config.h full_config.h
|
||||
cp tf-psa-crypto/include/psa/crypto_config.h full_crypto_config.h
|
||||
|
||||
echo '#error "cmake -DMBEDTLS_CONFIG_FILE is not working."' > "$MBEDTLS_ROOT_DIR/$CONFIG_H"
|
||||
cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h .
|
||||
cmake -DGEN_FILES=OFF -DTF_PSA_CRYPTO_CONFIG_FILE=full_crypto_config.h -DMBEDTLS_CONFIG_FILE=full_config.h .
|
||||
make
|
||||
|
||||
msg "build: cmake (in-tree) with -DMBEDTLS_CONFIG_FILE + -DMBEDTLS_USER_CONFIG_FILE"
|
||||
msg "build: cmake (in-tree) with -DMBEDTLS/TF_PSA_CRYPTO_CONFIG_FILE + -DMBEDTLS/TF_PSA_CRYPTO_USER_CONFIG_FILE"
|
||||
# In the user config, disable one feature (for simplicity, pick a feature
|
||||
# that nothing else depends on).
|
||||
echo '#undef MBEDTLS_NIST_KW_C' >user_config.h
|
||||
echo '#undef MBEDTLS_SSL_ALL_ALERT_MESSAGES' >user_config.h
|
||||
echo '#undef MBEDTLS_NIST_KW_C' >crypto_user_config.h
|
||||
|
||||
cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h -DMBEDTLS_USER_CONFIG_FILE=user_config.h .
|
||||
cmake -DGEN_FILES=OFF -DMBEDTLS_CONFIG_FILE=full_config.h -DMBEDTLS_USER_CONFIG_FILE=user_config.h -DTF_PSA_CRYPTO_CONFIG_FILE=full_crypto_config.h -DTF_PSA_CRYPTO_USER_CONFIG_FILE=crypto_user_config.h .
|
||||
make
|
||||
not programs/test/query_compile_time_config MBEDTLS_SSL_ALL_ALERT_MESSAGES
|
||||
not programs/test/query_compile_time_config MBEDTLS_NIST_KW_C
|
||||
|
||||
rm -f user_config.h full_config.h
|
||||
|
||||
@ -16,6 +16,7 @@ support_build_tfm_armcc () {
|
||||
component_build_tfm_armcc () {
|
||||
# test the TF-M configuration can build cleanly with various warning flags enabled
|
||||
cp configs/config-tfm.h "$CONFIG_H"
|
||||
cp configs/ext/crypto_config_profile_medium.h "$CRYPTO_CONFIG_H"
|
||||
|
||||
msg "build: TF-M config, armclang armv7-m thumb2"
|
||||
helper_armc6_build_test "--target=arm-arm-none-eabi -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused -I../framework/tests/include/spe"
|
||||
|
||||
@ -82,22 +82,22 @@ component_test_psa_crypto_without_heap() {
|
||||
msg "crypto without heap: build libtestdriver1"
|
||||
# Disable PSA features that cannot be accelerated and whose builtin support
|
||||
# requires calloc/free.
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_HKDF"
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_PBKDF2_"
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_TLS12_"
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_HKDF"
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_PBKDF2_"
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_TLS12_"
|
||||
# RSA key support requires ASN1 parse/write support for testing, but ASN1
|
||||
# is disabled below.
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_KEY_TYPE_RSA_"
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_RSA_"
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_KEY_TYPE_RSA_"
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_RSA_"
|
||||
# DES requires built-in support for key generation (parity check) so it
|
||||
# cannot be accelerated
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
|
||||
# EC-JPAKE use calloc/free in PSA core
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
|
||||
|
||||
# Accelerate all PSA features (which are still enabled in CRYPTO_CONFIG_H).
|
||||
PSA_SYM_LIST=$(./scripts/config.py -f $CRYPTO_CONFIG_H get-all-enabled PSA_WANT)
|
||||
PSA_SYM_LIST=$(./scripts/config.py -c $CRYPTO_CONFIG_H get-all-enabled PSA_WANT)
|
||||
loc_accel_list=$(echo $PSA_SYM_LIST | sed 's/PSA_WANT_//g')
|
||||
|
||||
helper_libtestdriver1_adjust_config crypto
|
||||
@ -139,7 +139,7 @@ component_test_psa_crypto_without_heap() {
|
||||
component_test_no_rsa_key_pair_generation () {
|
||||
msg "build: default config minus PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE"
|
||||
scripts/config.py unset MBEDTLS_GENPRIME
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
|
||||
make
|
||||
|
||||
msg "test: default config minus PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE"
|
||||
@ -270,7 +270,7 @@ component_test_psa_inject_entropy () {
|
||||
scripts/config.py unset MBEDTLS_PLATFORM_NV_SEED_ALT
|
||||
scripts/config.py unset MBEDTLS_PLATFORM_STD_NV_SEED_READ
|
||||
scripts/config.py unset MBEDTLS_PLATFORM_STD_NV_SEED_WRITE
|
||||
make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS '-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'" LDFLAGS="$ASAN_CFLAGS"
|
||||
make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS '-DTF_PSA_CRYPTO_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'" LDFLAGS="$ASAN_CFLAGS"
|
||||
|
||||
msg "test: full + MBEDTLS_PSA_INJECT_ENTROPY"
|
||||
make test
|
||||
@ -305,7 +305,7 @@ component_test_crypto_full_md_light_only () {
|
||||
scripts/config.py unset MBEDTLS_PKCS7_C
|
||||
# Disable indirect dependencies of MD_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # needs HMAC_DRBG
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
# Disable things that would auto-enable MD_C
|
||||
scripts/config.py unset MBEDTLS_PKCS5_C
|
||||
|
||||
@ -331,17 +331,17 @@ component_test_full_no_cipher () {
|
||||
# on CIPHER_C so we disable them.
|
||||
# This does not hold for KEY_TYPE_CHACHA20 and ALG_CHACHA20_POLY1305
|
||||
# so we keep them enabled.
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CMAC
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CFB
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CTR
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_OFB
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_STREAM_CIPHER
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CMAC
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CFB
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CTR
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_OFB
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_STREAM_CIPHER
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
|
||||
|
||||
# The following modules directly depends on CIPHER_C
|
||||
scripts/config.py unset MBEDTLS_CMAC_C
|
||||
@ -411,7 +411,8 @@ component_test_full_no_ccm_star_no_tag () {
|
||||
|
||||
component_test_config_symmetric_only () {
|
||||
msg "build: configs/config-symmetric-only.h"
|
||||
cp configs/config-symmetric-only.h "$CONFIG_H"
|
||||
MBEDTLS_CONFIG="configs/config-symmetric-only.h"
|
||||
CRYPTO_CONFIG="configs/crypto-config-symmetric-only.h"
|
||||
# test-ref-configs works by overwriting mbedtls_config.h; this makes cmake
|
||||
# want to re-generate generated files that depend on it, quite correctly.
|
||||
# However this doesn't work as the generation script expects a specific
|
||||
@ -421,7 +422,7 @@ component_test_config_symmetric_only () {
|
||||
# whether they're on or off. So, disable cmake's (over-sensitive here)
|
||||
# dependency resolution for generated files and just rely on them being
|
||||
# present (thanks to pre_generate_files) by turning GEN_FILES off.
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: configs/config-symmetric-only.h - unit tests"
|
||||
@ -452,18 +453,18 @@ component_test_everest_curve25519_only () {
|
||||
msg "build: Everest ECDH context, only Curve25519" # ~ 6 min
|
||||
scripts/config.py set MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H set PSA_WANT_ALG_ECDH
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H set PSA_WANT_ALG_ECDH
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
|
||||
scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
|
||||
scripts/config.py unset MBEDTLS_ECJPAKE_C
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
|
||||
|
||||
# Disable all curves
|
||||
scripts/config.py unset-all "MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED"
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset-all "PSA_WANT_ECC_[0-9A-Z_a-z]*$"
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H set PSA_WANT_ECC_MONTGOMERY_255
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset-all "PSA_WANT_ECC_[0-9A-Z_a-z]*$"
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H set PSA_WANT_ECC_MONTGOMERY_255
|
||||
|
||||
make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
|
||||
|
||||
@ -1402,8 +1403,9 @@ component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum () {
|
||||
|
||||
component_test_tfm_config_as_is () {
|
||||
msg "build: configs/config-tfm.h"
|
||||
cp configs/config-tfm.h "$CONFIG_H"
|
||||
CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
MBEDTLS_CONFIG="configs/config-tfm.h"
|
||||
CRYPTO_CONFIG="configs/ext/crypto_config_profile_medium.h"
|
||||
CC=$ASAN_CC cmake -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: configs/config-tfm.h - unit tests"
|
||||
@ -1416,14 +1418,13 @@ component_test_tfm_config_as_is () {
|
||||
common_tfm_config () {
|
||||
# Enable TF-M config
|
||||
cp configs/config-tfm.h "$CONFIG_H"
|
||||
echo "#undef MBEDTLS_PSA_CRYPTO_CONFIG_FILE" >> "$CONFIG_H"
|
||||
cp configs/ext/crypto_config_profile_medium.h "$CRYPTO_CONFIG_H"
|
||||
|
||||
# Config adjustment for better test coverage in our environment.
|
||||
# This is not needed just to build and pass tests.
|
||||
#
|
||||
# Enable filesystem I/O for the benefit of PK parse/write tests.
|
||||
echo "#define MBEDTLS_FS_IO" >> "$CONFIG_H"
|
||||
sed -i '/PROFILE_M_PSA_CRYPTO_CONFIG_H/i #define MBEDTLS_FS_IO' "$CRYPTO_CONFIG_H"
|
||||
}
|
||||
|
||||
# Keep this in sync with component_test_tfm_config() as they are both meant
|
||||
@ -1465,7 +1466,7 @@ component_test_tfm_config_no_p256m () {
|
||||
|
||||
# Disable P256M driver, which is on by default, so that analyze_outcomes
|
||||
# can compare this test with test_tfm_config_p256m_driver_accel_ec
|
||||
echo "#undef MBEDTLS_PSA_P256M_DRIVER_ENABLED" >> "$CONFIG_H"
|
||||
sed -i '/PROFILE_M_PSA_CRYPTO_CONFIG_H/i #undef MBEDTLS_PSA_P256M_DRIVER_ENABLED' "$CRYPTO_CONFIG_H"
|
||||
|
||||
msg "build: TF-M config without p256m"
|
||||
make CFLAGS='-Werror -Wall -Wextra -I../framework/tests/include/spe' tests
|
||||
@ -1534,8 +1535,8 @@ config_psa_crypto_accel_rsa () {
|
||||
|
||||
# We need PEM parsing in the test library as well to support the import
|
||||
# of PEM encoded RSA keys.
|
||||
scripts/config.py -f "$CONFIG_TEST_DRIVER_H" set MBEDTLS_PEM_PARSE_C
|
||||
scripts/config.py -f "$CONFIG_TEST_DRIVER_H" set MBEDTLS_BASE64_C
|
||||
scripts/config.py -c "$CONFIG_TEST_DRIVER_H" set MBEDTLS_PEM_PARSE_C
|
||||
scripts/config.py -c "$CONFIG_TEST_DRIVER_H" set MBEDTLS_BASE64_C
|
||||
fi
|
||||
}
|
||||
|
||||
@ -2164,11 +2165,9 @@ component_test_aead_only_ccm () {
|
||||
component_test_ccm_aes_sha256 () {
|
||||
msg "build: CCM + AES + SHA256 configuration"
|
||||
|
||||
cp "$CONFIG_TEST_DRIVER_H" "$CONFIG_H"
|
||||
cp configs/crypto-config-ccm-aes-sha256.h "$CRYPTO_CONFIG_H"
|
||||
|
||||
# Setting a blank config disables everyhing in the library side.
|
||||
echo '#define MBEDTLS_CONFIG_H ' >"$CONFIG_H"
|
||||
make
|
||||
|
||||
msg "test: CCM + AES + SHA256 configuration"
|
||||
make test
|
||||
}
|
||||
@ -2281,10 +2280,10 @@ component_build_aes_variations () {
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
|
||||
scripts/config.py unset MBEDTLS_NIST_KW_C
|
||||
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
|
||||
# Note: The two unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
|
||||
scripts/config.py unset MBEDTLS_DES_C
|
||||
@ -2649,22 +2648,22 @@ component_test_psa_crypto_drivers () {
|
||||
}
|
||||
|
||||
component_build_psa_config_file () {
|
||||
msg "build: make with MBEDTLS_PSA_CRYPTO_CONFIG_FILE" # ~40s
|
||||
msg "build: make with TF_PSA_CRYPTO_CONFIG_FILE" # ~40s
|
||||
cp "$CRYPTO_CONFIG_H" psa_test_config.h
|
||||
echo '#error "MBEDTLS_PSA_CRYPTO_CONFIG_FILE is not working"' >"$CRYPTO_CONFIG_H"
|
||||
make CFLAGS="-I '$PWD' -DMBEDTLS_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"'"
|
||||
echo '#error "TF_PSA_CRYPTO_CONFIG_FILE is not working"' >"$CRYPTO_CONFIG_H"
|
||||
make CFLAGS="-I '$PWD' -DTF_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"'"
|
||||
# Make sure this feature is enabled. We'll disable it in the next phase.
|
||||
programs/test/query_compile_time_config MBEDTLS_CMAC_C
|
||||
make clean
|
||||
|
||||
msg "build: make with MBEDTLS_PSA_CRYPTO_CONFIG_FILE + MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE" # ~40s
|
||||
msg "build: make with TF_PSA_CRYPTO_CONFIG_FILE + TF_PSA_CRYPTO_USER_CONFIG_FILE" # ~40s
|
||||
# In the user config, disable one feature and its dependencies, which will
|
||||
# reflect on the mbedtls configuration so we can query it with
|
||||
# query_compile_time_config.
|
||||
echo '#undef PSA_WANT_ALG_CMAC' >psa_user_config.h
|
||||
echo '#undef PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128' >> psa_user_config.h
|
||||
scripts/config.py unset MBEDTLS_CMAC_C
|
||||
make CFLAGS="-I '$PWD' -DMBEDTLS_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"' -DMBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE='\"psa_user_config.h\"'"
|
||||
echo '#undef MBEDTLS_CMAC_C' >> psa_user_config.h
|
||||
make CFLAGS="-I '$PWD' -DTF_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"' -DTF_PSA_CRYPTO_USER_CONFIG_FILE='\"psa_user_config.h\"'"
|
||||
not programs/test/query_compile_time_config MBEDTLS_CMAC_C
|
||||
|
||||
rm -f psa_test_config.h psa_user_config.h
|
||||
|
||||
@ -11,7 +11,8 @@
|
||||
|
||||
component_test_config_suite_b () {
|
||||
msg "build: configs/config-suite-b.h"
|
||||
cp configs/config-suite-b.h "$CONFIG_H"
|
||||
MBEDTLS_CONFIG="configs/config-suite-b.h"
|
||||
CRYPTO_CONFIG="configs/crypto-config-suite-b.h"
|
||||
# test-ref-configs works by overwriting mbedtls_config.h; this makes cmake
|
||||
# want to re-generate generated files that depend on it, quite correctly.
|
||||
# However this doesn't work as the generation script expects a specific
|
||||
@ -21,7 +22,7 @@ component_test_config_suite_b () {
|
||||
# whether they're on or off. So, disable cmake's (over-sensitive here)
|
||||
# dependency resolution for generated files and just rely on them being
|
||||
# present (thanks to pre_generate_files) by turning GEN_FILES off.
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: configs/config-suite-b.h - unit tests"
|
||||
@ -33,8 +34,8 @@ component_test_config_suite_b () {
|
||||
msg "build: configs/config-suite-b.h + DEBUG"
|
||||
MBEDTLS_TEST_CONFIGURATION="$MBEDTLS_TEST_CONFIGURATION+DEBUG"
|
||||
make clean
|
||||
scripts/config.py set MBEDTLS_DEBUG_C
|
||||
scripts/config.py set MBEDTLS_ERROR_C
|
||||
scripts/config.py -f "$MBEDTLS_CONFIG" set MBEDTLS_DEBUG_C
|
||||
scripts/config.py -f "$MBEDTLS_CONFIG" set MBEDTLS_ERROR_C
|
||||
make ssl-opt
|
||||
|
||||
msg "test: configs/config-suite-b.h + DEBUG - ssl-opt.sh"
|
||||
@ -58,10 +59,10 @@ component_test_tls1_2_default_stream_cipher_only () {
|
||||
msg "build: default with only stream cipher use psa"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
# Note: The three unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
@ -69,8 +70,8 @@ component_test_tls1_2_default_stream_cipher_only () {
|
||||
#Disable TLS 1.3 (as no AEAD)
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
|
||||
# Disable CBC. Note: When implemented, PSA_WANT_ALG_CBC_MAC will also need to be unset here to fully disable CBC
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
|
||||
# Disable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
# Note: The unset below is to be removed for 4.0
|
||||
scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
|
||||
@ -94,10 +95,10 @@ component_test_tls1_2_default_cbc_legacy_cipher_only () {
|
||||
msg "build: default with only CBC-legacy cipher use psa"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
# Note: The three unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
@ -105,7 +106,7 @@ component_test_tls1_2_default_cbc_legacy_cipher_only () {
|
||||
#Disable TLS 1.3 (as no AEAD)
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
|
||||
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H set PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H set PSA_WANT_ALG_CBC_NO_PADDING
|
||||
# Disable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
@ -127,10 +128,10 @@ component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only () {
|
||||
msg "build: default with only CBC-legacy and CBC-EtM ciphers use psa"
|
||||
|
||||
# Disable AEAD (controlled by the presence of one of GCM_C, CCM_C, CHACHAPOLY_C)
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CHACHA20_POLY1305
|
||||
# Note: The three unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_GCM_C
|
||||
scripts/config.py unset MBEDTLS_CCM_C
|
||||
@ -138,7 +139,7 @@ component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only () {
|
||||
#Disable TLS 1.3 (as no AEAD)
|
||||
scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
|
||||
# Enable CBC-legacy (controlled by MBEDTLS_CIPHER_MODE_CBC plus at least one block cipher (AES, ARIA, Camellia, DES))
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H set PSA_WANT_ALG_CBC_NO_PADDING
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H set PSA_WANT_ALG_CBC_NO_PADDING
|
||||
# Enable CBC-EtM (controlled by the same as CBC-legacy plus MBEDTLS_SSL_ENCRYPT_THEN_MAC)
|
||||
scripts/config.py set MBEDTLS_SSL_ENCRYPT_THEN_MAC
|
||||
# Disable stream (currently that's just the NULL pseudo-cipher (controlled by MBEDTLS_CIPHER_NULL_CIPHER))
|
||||
@ -158,7 +159,8 @@ component_test_tls1_2_default_cbc_legacy_cbc_etm_cipher_only () {
|
||||
|
||||
component_test_config_thread () {
|
||||
msg "build: configs/config-thread.h"
|
||||
cp configs/config-thread.h "$CONFIG_H"
|
||||
MBEDTLS_CONFIG="configs/config-thread.h"
|
||||
CRYPTO_CONFIG="configs/crypto-config-thread.h"
|
||||
# test-ref-configs works by overwriting mbedtls_config.h; this makes cmake
|
||||
# want to re-generate generated files that depend on it, quite correctly.
|
||||
# However this doesn't work as the generation script expects a specific
|
||||
@ -168,7 +170,7 @@ component_test_config_thread () {
|
||||
# whether they're on or off. So, disable cmake's (over-sensitive here)
|
||||
# dependency resolution for generated files and just rely on them being
|
||||
# present (thanks to pre_generate_files) by turning GEN_FILES off.
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: configs/config-thread.h - unit tests"
|
||||
@ -180,7 +182,8 @@ component_test_config_thread () {
|
||||
|
||||
component_test_tls1_2_ccm_psk () {
|
||||
msg "build: configs/config-ccm-psk-tls1_2.h"
|
||||
cp configs/config-ccm-psk-tls1_2.h "$CONFIG_H"
|
||||
MBEDTLS_CONFIG="configs/config-ccm-psk-tls1_2.h"
|
||||
CRYPTO_CONFIG="configs/crypto-config-ccm-psk-tls1_2.h"
|
||||
# test-ref-configs works by overwriting mbedtls_config.h; this makes cmake
|
||||
# want to re-generate generated files that depend on it, quite correctly.
|
||||
# However this doesn't work as the generation script expects a specific
|
||||
@ -190,7 +193,7 @@ component_test_tls1_2_ccm_psk () {
|
||||
# whether they're on or off. So, disable cmake's (over-sensitive here)
|
||||
# dependency resolution for generated files and just rely on them being
|
||||
# present (thanks to pre_generate_files) by turning GEN_FILES off.
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: configs/config-ccm-psk-tls1_2.h - unit tests"
|
||||
@ -202,7 +205,8 @@ component_test_tls1_2_ccm_psk () {
|
||||
|
||||
component_test_tls1_2_ccm_psk_dtls () {
|
||||
msg "build: configs/config-ccm-psk-dtls1_2.h"
|
||||
cp configs/config-ccm-psk-dtls1_2.h "$CONFIG_H"
|
||||
MBEDTLS_CONFIG="configs/config-ccm-psk-dtls1_2.h"
|
||||
CRYPTO_CONFIG="configs/crypto-config-ccm-psk-tls1_2.h"
|
||||
# test-ref-configs works by overwriting mbedtls_config.h; this makes cmake
|
||||
# want to re-generate generated files that depend on it, quite correctly.
|
||||
# However this doesn't work as the generation script expects a specific
|
||||
@ -212,7 +216,7 @@ component_test_tls1_2_ccm_psk_dtls () {
|
||||
# whether they're on or off. So, disable cmake's (over-sensitive here)
|
||||
# dependency resolution for generated files and just rely on them being
|
||||
# present (thanks to pre_generate_files) by turning GEN_FILES off.
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
CC=$ASAN_CC cmake -D GEN_FILES=Off -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
|
||||
make
|
||||
|
||||
msg "test: configs/config-ccm-psk-dtls1_2.h - unit tests"
|
||||
@ -224,8 +228,8 @@ component_test_tls1_2_ccm_psk_dtls () {
|
||||
msg "build: configs/config-ccm-psk-dtls1_2.h + DEBUG"
|
||||
MBEDTLS_TEST_CONFIGURATION="$MBEDTLS_TEST_CONFIGURATION+DEBUG"
|
||||
make clean
|
||||
scripts/config.py set MBEDTLS_DEBUG_C
|
||||
scripts/config.py set MBEDTLS_ERROR_C
|
||||
scripts/config.py -f "$MBEDTLS_CONFIG" set MBEDTLS_DEBUG_C
|
||||
scripts/config.py -f "$MBEDTLS_CONFIG" set MBEDTLS_ERROR_C
|
||||
make ssl-opt
|
||||
|
||||
msg "test: configs/config-ccm-psk-dtls1_2.h + DEBUG - ssl-opt.sh"
|
||||
@ -478,22 +482,22 @@ component_test_tls13_only_psk () {
|
||||
scripts/config.py unset MBEDTLS_PKCS7_C
|
||||
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_FFDH
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_2048
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_3072
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_4096
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_6144
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_8192
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_FFDH
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_2048
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_3072
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_4096
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_6144
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_DH_RFC7919_8192
|
||||
# Note: The four unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDH_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
@ -529,7 +533,7 @@ component_test_tls13_only_ephemeral_ffdh () {
|
||||
scripts/config.py unset MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
|
||||
scripts/config.py unset MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
# Note: The unset below is to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDH_C
|
||||
|
||||
@ -552,10 +556,10 @@ component_test_tls13_only_psk_ephemeral () {
|
||||
scripts/config.py unset MBEDTLS_PKCS7_C
|
||||
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
# Note: The two unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
scripts/config.py unset MBEDTLS_PKCS1_V21
|
||||
@ -579,11 +583,11 @@ component_test_tls13_only_psk_ephemeral_ffdh () {
|
||||
scripts/config.py unset MBEDTLS_PKCS7_C
|
||||
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDH
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
# Note: The three unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDH_C
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
@ -607,10 +611,10 @@ component_test_tls13_only_psk_all () {
|
||||
scripts/config.py unset MBEDTLS_PKCS7_C
|
||||
scripts/config.py set MBEDTLS_SSL_EARLY_DATA
|
||||
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_OAEP
|
||||
scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_RSA_PSS
|
||||
# Note: The two unsets below are to be removed for Mbed TLS 4.0
|
||||
scripts/config.py unset MBEDTLS_ECDSA_C
|
||||
scripts/config.py unset MBEDTLS_PKCS1_V21
|
||||
|
||||
@ -236,6 +236,7 @@ component_build_tfm () {
|
||||
# the configuration that works on mainstream platforms is in
|
||||
# configs/config-tfm.h, tested via test-ref-configs.pl.
|
||||
cp configs/config-tfm.h "$CONFIG_H"
|
||||
cp configs/ext/crypto_config_profile_medium.h "$CRYPTO_CONFIG_H"
|
||||
|
||||
msg "build: TF-M config, clang, armv7-m thumb2"
|
||||
make lib CC="clang" CFLAGS="--target=arm-linux-gnueabihf -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused -I../framework/tests/include/spe"
|
||||
@ -292,15 +293,15 @@ component_build_mbedtls_config_file () {
|
||||
echo '#error "MBEDTLS_CONFIG_FILE is not working"' >"$CONFIG_H"
|
||||
make CFLAGS="-I '$PWD' -DMBEDTLS_CONFIG_FILE='\"full_config.h\"'"
|
||||
# Make sure this feature is enabled. We'll disable it in the next phase.
|
||||
programs/test/query_compile_time_config MBEDTLS_NIST_KW_C
|
||||
programs/test/query_compile_time_config MBEDTLS_SSL_ALL_ALERT_MESSAGES
|
||||
make clean
|
||||
|
||||
msg "build: make with MBEDTLS_CONFIG_FILE + MBEDTLS_USER_CONFIG_FILE"
|
||||
# In the user config, disable one feature (for simplicity, pick a feature
|
||||
# that nothing else depends on).
|
||||
echo '#undef MBEDTLS_NIST_KW_C' >user_config.h
|
||||
echo '#undef MBEDTLS_SSL_ALL_ALERT_MESSAGES' >user_config.h
|
||||
make CFLAGS="-I '$PWD' -DMBEDTLS_CONFIG_FILE='\"full_config.h\"' -DMBEDTLS_USER_CONFIG_FILE='\"user_config.h\"'"
|
||||
not programs/test/query_compile_time_config MBEDTLS_NIST_KW_C
|
||||
not programs/test/query_compile_time_config MBEDTLS_SSL_ALL_ALERT_MESSAGES
|
||||
|
||||
rm -f user_config.h full_config.h
|
||||
}
|
||||
|
||||
@ -49,7 +49,7 @@ component_test_memsan_constant_flow_psa () {
|
||||
scripts/config.py set MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN
|
||||
scripts/config.py unset MBEDTLS_AESNI_C # memsan doesn't grok asm
|
||||
scripts/config.py unset MBEDTLS_HAVE_ASM
|
||||
CC=clang cmake -D CMAKE_BUILD_TYPE:String=MemSan .
|
||||
CC=clang cmake -D GEN_FILES=Off -D CMAKE_BUILD_TYPE:String=MemSan .
|
||||
make
|
||||
|
||||
msg "test: main suites (Msan + constant flow)"
|
||||
|
||||
@ -233,9 +233,11 @@ get_options "$@"
|
||||
# Read boolean configuration options from mbedtls_config.h for easy and quick
|
||||
# testing. Skip non-boolean options (with something other than spaces
|
||||
# and a comment after "#define SYMBOL"). The variable contains a
|
||||
# space-separated list of symbols.
|
||||
# space-separated list of symbols. The list should always be
|
||||
# terminated by a single whitespace character, otherwise the last entry
|
||||
# will not get matched by the parsing regex.
|
||||
if [ "$LIST_TESTS" -eq 0 ];then
|
||||
CONFIGS_ENABLED=" $(echo `$P_QUERY -l` )"
|
||||
CONFIGS_ENABLED=" $(echo `$P_QUERY -l` ) "
|
||||
else
|
||||
P_QUERY=":"
|
||||
CONFIGS_ENABLED=""
|
||||
|
||||
@ -7,9 +7,9 @@ check_runtime_version:"4.0.0"
|
||||
Check for MBEDTLS_VERSION_C
|
||||
check_feature:"MBEDTLS_VERSION_C":0
|
||||
|
||||
Check for MBEDTLS_AES_C when already present
|
||||
depends_on:MBEDTLS_AES_C
|
||||
check_feature:"MBEDTLS_AES_C":0
|
||||
Check for MBEDTLS_TIMING_C when already present
|
||||
depends_on:MBEDTLS_TIMING_C
|
||||
check_feature:"MBEDTLS_TIMING_C":0
|
||||
|
||||
Check for unknown define
|
||||
check_feature:"MBEDTLS_UNKNOWN":-1
|
||||
|
||||
@ -359,11 +359,11 @@ function(set_config_files_compile_definitions target)
|
||||
endif()
|
||||
if(TF_PSA_CRYPTO_CONFIG_FILE)
|
||||
target_compile_definitions(${target}
|
||||
PUBLIC MBEDTLS_PSA_CRYPTO_CONFIG_FILE="${TF_PSA_CRYPTO_CONFIG_FILE}")
|
||||
PUBLIC TF_PSA_CRYPTO_CONFIG_FILE="${TF_PSA_CRYPTO_CONFIG_FILE}")
|
||||
endif()
|
||||
if(TF_PSA_CRYPTO_USER_CONFIG_FILE)
|
||||
target_compile_definitions(${target}
|
||||
PUBLIC MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE="${TF_PSA_CRYPTO_USER_CONFIG_FILE}")
|
||||
PUBLIC TF_PSA_CRYPTO_USER_CONFIG_FILE="${TF_PSA_CRYPTO_USER_CONFIG_FILE}")
|
||||
endif()
|
||||
endfunction(set_config_files_compile_definitions)
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -17,29 +17,4 @@
|
||||
#define _CRT_SECURE_NO_DEPRECATE 1
|
||||
#endif
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* PSA core mandatory configuration options */
|
||||
#define MBEDTLS_CIPHER_C
|
||||
#define MBEDTLS_AES_C
|
||||
#define MBEDTLS_SHA256_C
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_ENTROPY_FORCE_SHA256
|
||||
|
||||
/*
|
||||
* Configuration options that may need to be additionally enabled for the
|
||||
* purpose of a specific set of tests.
|
||||
*/
|
||||
//#define MBEDTLS_SHA1_C
|
||||
//#define MBEDTLS_SHA224_C
|
||||
//#define MBEDTLS_SHA384_C
|
||||
//#define MBEDTLS_SHA512_C
|
||||
//#define MBEDTLS_MD_C
|
||||
//#define MBEDTLS_PEM_PARSE_C
|
||||
//#define MBEDTLS_BASE64_C
|
||||
//#define MBEDTLS_THREADING_C
|
||||
//#define MBEDTLS_THREADING_PTHREAD
|
||||
|
||||
#endif /* MBEDTLS_CONFIG_H */
|
||||
|
||||
40
tf-psa-crypto/tests/configs/crypto_config_test_driver.h
Normal file
40
tf-psa-crypto/tests/configs/crypto_config_test_driver.h
Normal file
@ -0,0 +1,40 @@
|
||||
/*
|
||||
* PSA Crypto configuration base for PSA test driver libraries. It includes:
|
||||
* . the minimum set of modules needed by the PSA core.
|
||||
* . the Mbed TLS configuration options that may need to be additionally
|
||||
* enabled for the purpose of a specific test.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#ifndef PSA_CRYPTO_CONFIG_H
|
||||
#define PSA_CRYPTO_CONFIG_H
|
||||
|
||||
#define MBEDTLS_PSA_CRYPTO_C
|
||||
|
||||
/* PSA core mandatory configuration options */
|
||||
#define MBEDTLS_CIPHER_C
|
||||
#define MBEDTLS_AES_C
|
||||
#define MBEDTLS_SHA256_C
|
||||
#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1
|
||||
#define MBEDTLS_CTR_DRBG_C
|
||||
#define MBEDTLS_ENTROPY_C
|
||||
#define MBEDTLS_ENTROPY_FORCE_SHA256
|
||||
|
||||
/*
|
||||
* Configuration options that may need to be additionally enabled for the
|
||||
* purpose of a specific set of tests.
|
||||
*/
|
||||
//#define MBEDTLS_SHA1_C
|
||||
//#define MBEDTLS_SHA224_C
|
||||
//#define MBEDTLS_SHA384_C
|
||||
//#define MBEDTLS_SHA512_C
|
||||
//#define MBEDTLS_MD_C
|
||||
//#define MBEDTLS_PEM_PARSE_C
|
||||
//#define MBEDTLS_BASE64_C
|
||||
//#define MBEDTLS_THREADING_C
|
||||
//#define MBEDTLS_THREADING_PTHREAD
|
||||
|
||||
#endif /* PSA_CRYPTO_CONFIG_H */
|
||||
Loading…
x
Reference in New Issue
Block a user