diff --git a/.travis.yml b/.travis.yml index c67c0cd33c..76cb1c5372 100644 --- a/.travis.yml +++ b/.travis.yml @@ -28,10 +28,6 @@ jobs: script: - tests/scripts/all.sh -k test_full_cmake_gcc_asan - - name: check compilation guards - script: - - tests/scripts/all.sh -k 'test_depends_*' 'build_key_exchanges' - - name: macOS os: osx compiler: clang diff --git a/ChangeLog.d/bugfix_PR3294.txt b/ChangeLog.d/bugfix_PR3294.txt new file mode 100644 index 0000000000..a6ea75e05c --- /dev/null +++ b/ChangeLog.d/bugfix_PR3294.txt @@ -0,0 +1,4 @@ +Bugfix + * Fix build failure in configurations where MBEDTLS_USE_PSA_CRYPTO is + enabled but ECDSA is disabled. Contributed by jdurkop. Fixes #3294. + diff --git a/library/pk.c b/library/pk.c index 8ffbed2a9a..9a3bcb0dc6 100644 --- a/library/pk.c +++ b/library/pk.c @@ -591,6 +591,9 @@ int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk, psa_algorithm_t hash_alg ) { #if !defined(MBEDTLS_ECP_C) + ((void) pk); + ((void) handle); + ((void) hash_alg); return( MBEDTLS_ERR_PK_TYPE_MISMATCH ); #else const mbedtls_ecp_keypair *ec; diff --git a/library/pk_wrap.c b/library/pk_wrap.c index 6bf3169743..903c53b9df 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -551,11 +551,12 @@ static int ecdsa_verify_wrap( void *ctx_arg, mbedtls_md_type_t md_alg, unsigned char buf[30 + 2 * MBEDTLS_ECP_MAX_BYTES]; unsigned char *p; mbedtls_pk_info_t pk_info = mbedtls_eckey_info; - psa_algorithm_t psa_sig_md, psa_md; + psa_algorithm_t psa_sig_md = PSA_ALG_ECDSA_ANY; size_t curve_bits; psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( ctx->grp.id, &curve_bits ); const size_t signature_part_size = ( ctx->grp.nbits + 7 ) / 8; + ((void) md_alg); if( curve == 0 ) return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); @@ -569,11 +570,6 @@ static int ecdsa_verify_wrap( void *ctx_arg, mbedtls_md_type_t md_alg, if( key_len <= 0 ) return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); - psa_md = mbedtls_psa_translate_md( md_alg ); - if( psa_md == 0 ) - return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); - psa_sig_md = PSA_ALG_ECDSA( psa_md ); - psa_set_key_type( &attributes, PSA_KEY_TYPE_ECC_PUBLIC_KEY( curve ) ); psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH ); psa_set_key_algorithm( &attributes, psa_sig_md ); @@ -910,6 +906,8 @@ static int pk_opaque_can_do( mbedtls_pk_type_t type ) type == MBEDTLS_PK_ECDSA ); } +#if defined(MBEDTLS_ECDSA_C) + /* * Simultaneously convert and move raw MPI from the beginning of a buffer * to an ASN.1 MPI at the end of the buffer. @@ -992,11 +990,24 @@ static int pk_ecdsa_sig_asn1_from_psa( unsigned char *sig, size_t *sig_len, return( 0 ); } +#endif /* MBEDTLS_ECDSA_C */ + static int pk_opaque_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, unsigned char *sig, size_t *sig_len, int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) { +#if !defined(MBEDTLS_ECDSA_C) + ((void) ctx); + ((void) md_alg); + ((void) hash); + ((void) hash_len); + ((void) sig); + ((void) sig_len); + ((void) f_rng); + ((void) p_rng); + return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE ); +#else /* !MBEDTLS_ECDSA_C */ const psa_key_handle_t *key = (const psa_key_handle_t *) ctx; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_algorithm_t alg = PSA_ALG_ECDSA( mbedtls_psa_translate_md( md_alg ) ); @@ -1027,6 +1038,7 @@ static int pk_opaque_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, /* transcode it to ASN.1 sequence */ return( pk_ecdsa_sig_asn1_from_psa( sig, sig_len, buf_len ) ); +#endif /* !MBEDTLS_ECDSA_C */ } const mbedtls_pk_info_t mbedtls_pk_opaque_info = { diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 596e1a96a9..578d03e3e5 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -1217,16 +1217,34 @@ component_test_depends_curves () { record_status tests/scripts/curves.pl } +component_test_depends_curves_psa () { + msg "test/build: curves.pl with MBEDTLS_USE_PSA_CRYPTO defined (gcc)" + scripts/config.py set MBEDTLS_USE_PSA_CRYPTO + record_status tests/scripts/curves.pl +} + component_test_depends_hashes () { msg "test/build: depends-hashes.pl (gcc)" # ~ 2 min record_status tests/scripts/depends-hashes.pl } +component_test_depends_hashes_psa () { + msg "test/build: depends-hashes.pl with MBEDTLS_USE_PSA_CRYPTO defined (gcc)" + scripts/config.py set MBEDTLS_USE_PSA_CRYPTO + record_status tests/scripts/depends-hashes.pl +} + component_test_depends_pkalgs () { msg "test/build: depends-pkalgs.pl (gcc)" # ~ 2 min record_status tests/scripts/depends-pkalgs.pl } +component_test_depends_pkalgs_psa () { + msg "test/build: depends-pkalgs.pl with MBEDTLS_USE_PSA_CRYPTO defined (gcc)" + scripts/config.py set MBEDTLS_USE_PSA_CRYPTO + record_status tests/scripts/depends-pkalgs.pl +} + component_build_key_exchanges () { msg "test/build: key-exchanges (gcc)" # ~ 1 min record_status tests/scripts/key-exchanges.pl diff --git a/tests/suites/test_suite_pk.function b/tests/suites/test_suite_pk.function index 43b4914739..c6041b249f 100644 --- a/tests/suites/test_suite_pk.function +++ b/tests/suites/test_suite_pk.function @@ -775,8 +775,8 @@ void pk_ec_test_vec( int type, int id, data_t * key, data_t * hash, TEST_ASSERT( mbedtls_ecp_point_read_binary( &eckey->grp, &eckey->Q, key->x, key->len ) == 0 ); - // MBEDTLS_MD_SHA1 is a dummy - it is ignored, but has to be other than MBEDTLS_MD_NONE. - TEST_ASSERT( mbedtls_pk_verify( &pk, MBEDTLS_MD_SHA1, + // MBEDTLS_MD_NONE is used since it will be ignored. + TEST_ASSERT( mbedtls_pk_verify( &pk, MBEDTLS_MD_NONE, hash->x, hash->len, sig->x, sig->len ) == ret ); exit: