mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-03-23 07:20:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'development' into issue/wrong-suite-name-in-check_test_cases_py

Browse Source
This commit is contained in:
Pengyu Lv 2023-11-30 10:05:54 +08:00
commit d1198060a5
15 changed files with 410 additions and 410 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
configs/config-tfm.h
View File

@ -21,16 +21,6 @@
/* MBEDTLS_PSA_CRYPTO_SPM needs third-party files, so disable it. */ /* MBEDTLS_PSA_CRYPTO_SPM needs third-party files, so disable it. */
#undef MBEDTLS_PSA_CRYPTO_SPM #undef MBEDTLS_PSA_CRYPTO_SPM
/* TF-M provides its own dummy implementations to save code size.
* We don't have any way to disable the tests that need these feature,
* so we just keep AES decryption enabled. We will resolve this through
* an official way to disable AES decryption, then this deviation
* will no longer be needed:
* https://github.com/Mbed-TLS/mbedtls/issues/7368
*/
#undef MBEDTLS_AES_SETKEY_DEC_ALT
#undef MBEDTLS_AES_DECRYPT_ALT
/* Use built-in platform entropy functions (TF-M provides its own). */ /* Use built-in platform entropy functions (TF-M provides its own). */
#undef MBEDTLS_NO_PLATFORM_ENTROPY #undef MBEDTLS_NO_PLATFORM_ENTROPY
@ -38,3 +28,35 @@
* but using the native allocator is faster and works better with * but using the native allocator is faster and works better with
* memory management analysis frameworks such as ASan. */ * memory management analysis frameworks such as ASan. */
#undef MBEDTLS_MEMORY_BUFFER_ALLOC_C #undef MBEDTLS_MEMORY_BUFFER_ALLOC_C
// This macro is enabled in TFM Medium but is disabled here because it is
// incompatible with baremetal builds in Mbed TLS.
#undef MBEDTLS_PSA_CRYPTO_STORAGE_C
// This macro is enabled in TFM Medium but is disabled here because it is
// incompatible with baremetal builds in Mbed TLS.
#undef MBEDTLS_ENTROPY_NV_SEED
// These platform-related TF-M settings are not useful here.
#undef MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
#undef MBEDTLS_PLATFORM_STD_MEM_HDR
#undef MBEDTLS_PLATFORM_SNPRINTF_MACRO
#undef MBEDTLS_PLATFORM_PRINTF_ALT
#undef MBEDTLS_PLATFORM_STD_EXIT_SUCCESS
#undef MBEDTLS_PLATFORM_STD_EXIT_FAILURE
/*
* In order to get an example config that works cleanly out-of-the-box
* for both baremetal and non-baremetal builds, we detect baremetal builds
* and set this variable automatically.
*/
#if defined(__IAR_SYSTEMS_ICC__) || defined(__ARM_EABI__)
#define MBEDTLS_NO_PLATFORM_ENTROPY
#endif
/***********************************************************************
* Local changes to crypto config below this delimiter
**********************************************************************/
// We expect TF-M to pick this up soon
#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT

44
configs/ext/crypto_config_profile_medium.h
View File

@ -50,7 +50,7 @@
//#define PSA_WANT_ALG_CFB 1 //#define PSA_WANT_ALG_CFB 1
//#define PSA_WANT_ALG_CHACHA20_POLY1305 1 //#define PSA_WANT_ALG_CHACHA20_POLY1305 1
//#define PSA_WANT_ALG_CTR 1 //#define PSA_WANT_ALG_CTR 1
#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1 //#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1
//#define PSA_WANT_ALG_ECB_NO_PADDING 1 //#define PSA_WANT_ALG_ECB_NO_PADDING 1
#define PSA_WANT_ALG_ECDH 1 #define PSA_WANT_ALG_ECDH 1
#define PSA_WANT_ALG_ECDSA 1 #define PSA_WANT_ALG_ECDSA 1
@ -105,33 +105,27 @@
//#define PSA_WANT_KEY_TYPE_CAMELLIA 1 //#define PSA_WANT_KEY_TYPE_CAMELLIA 1
//#define PSA_WANT_KEY_TYPE_CHACHA20 1 //#define PSA_WANT_KEY_TYPE_CHACHA20 1
//#define PSA_WANT_KEY_TYPE_DES 1 //#define PSA_WANT_KEY_TYPE_DES 1
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 //#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1 /* Deprecated */
#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1
#define PSA_WANT_KEY_TYPE_RAW_DATA 1
//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1 /* Deprecated */
//#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1
/*
* The following symbols extend and deprecate the legacy
* PSA_WANT_KEY_TYPE_xxx_KEY_PAIR ones. They include the usage of that key in
* the name's suffix. "_USE" is the most generic and it can be used to describe
* a generic suport, whereas other ones add more features on top of that and
* they are more specific.
*/
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 #define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1
#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 //#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1
#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1
#define PSA_WANT_KEY_TYPE_RAW_DATA 1
//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1
//#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1
/*********************************************************************** #ifdef CRYPTO_HW_ACCELERATOR
* Local edits below this delimiter #include "crypto_accelerator_config.h"
**********************************************************************/ #endif
/* Between Mbed TLS 3.4 and 3.5, the PSA_WANT_KEY_TYPE_RSA_KEY_PAIR macro
* (commented-out above) has been replaced with the following new macros: */
//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1
//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1
//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1
//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1
//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE 1 /* Not supported */
/* Between Mbed TLS 3.4 and 3.5, the following macros have been added: */
//#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC 1
//#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT 1
//#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT 1
//#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE 1
//#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE 1 // Not supported
#endif /* PROFILE_M_PSA_CRYPTO_CONFIG_H */ #endif /* PROFILE_M_PSA_CRYPTO_CONFIG_H */

204
configs/ext/tfm_mbedcrypto_config_profile_medium.h
View File

@ -15,6 +15,8 @@
#ifndef PROFILE_M_MBEDTLS_CONFIG_H #ifndef PROFILE_M_MBEDTLS_CONFIG_H
#define PROFILE_M_MBEDTLS_CONFIG_H #define PROFILE_M_MBEDTLS_CONFIG_H
//#include "config_tfm.h"
#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE) #if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
#define _CRT_SECURE_NO_DEPRECATE 1 #define _CRT_SECURE_NO_DEPRECATE 1
#endif #endif
@ -80,44 +82,6 @@
* \{ * \{
*/ */
/**
* \def MBEDTLS_MD2_PROCESS_ALT
*
* MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you
* alternate core implementation of symmetric crypto or hash function. Keep in
* mind that function prototypes should remain the same.
*
* This replaces only one function. The header file from mbed TLS is still
* used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags.
*
* Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will
* no longer provide the mbedtls_sha1_process() function, but it will still provide
* the other function (using your mbedtls_sha1_process() function) and the definition
* of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible
* with this definition.
*
* \note Because of a signature change, the core AES encryption and decryption routines are
* currently named mbedtls_aes_internal_encrypt and mbedtls_aes_internal_decrypt,
* respectively. When setting up alternative implementations, these functions should
* be overridden, but the wrapper functions mbedtls_aes_decrypt and mbedtls_aes_encrypt
* must stay untouched.
*
* \note If you use the AES_xxx_ALT macros, then is is recommended to also set
* MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES
* tables.
*
* Uncomment a macro to enable alternate implementation of the corresponding
* function.
*
* \warning MD2, MD4, MD5, DES and SHA-1 are considered weak and their use
* constitutes a security risk. If possible, we recommend avoiding
* dependencies on them, and considering stronger message digests
* and ciphers instead.
*
*/
#define MBEDTLS_AES_SETKEY_DEC_ALT
#define MBEDTLS_AES_DECRYPT_ALT
/** /**
* \def MBEDTLS_AES_ROM_TABLES * \def MBEDTLS_AES_ROM_TABLES
* *
@ -171,21 +135,6 @@
*/ */
#define MBEDTLS_ECP_NIST_OPTIM #define MBEDTLS_ECP_NIST_OPTIM
/**
* \def MBEDTLS_ERROR_STRERROR_DUMMY
*
* Enable a dummy error function to make use of mbedtls_strerror() in
* third party libraries easier when MBEDTLS_ERROR_C is disabled
* (no effect when MBEDTLS_ERROR_C is enabled).
*
* You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're
* not using mbedtls_strerror() or error_strerror() in your application.
*
* Disable if you run into name conflicts and want to really remove the
* mbedtls_strerror()
*/
#define MBEDTLS_ERROR_STRERROR_DUMMY
/** /**
* \def MBEDTLS_NO_PLATFORM_ENTROPY * \def MBEDTLS_NO_PLATFORM_ENTROPY
* *
@ -223,26 +172,7 @@
* \note The entropy collector will write to the seed file before entropy is * \note The entropy collector will write to the seed file before entropy is
* given to an external source, to update it. * given to an external source, to update it.
*/ */
// This macro is enabled in TFM Medium but is disabled here because it is #define MBEDTLS_ENTROPY_NV_SEED
// incompatible with baremetal builds in Mbed TLS.
//#define MBEDTLS_ENTROPY_NV_SEED
/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
*
* Enable key identifiers that encode a key owner identifier.
*
* This is only meaningful when building the library as part of a
* multi-client service. When you activate this option, you must provide an
* implementation of the type mbedtls_key_owner_id_t and a translation from
* mbedtls_svc_key_id_t to file name in all the storage backends that you
* you wish to support.
*
* Note that while this define has been removed from TF-M's copy of this config
* file, TF-M still passes this option to Mbed TLS during the build via CMake.
* Therefore we keep it in our copy. See discussion on PR #7426 for more info.
*
*/
#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
/** /**
* \def MBEDTLS_PSA_CRYPTO_SPM * \def MBEDTLS_PSA_CRYPTO_SPM
@ -326,26 +256,21 @@
#define MBEDTLS_AES_C #define MBEDTLS_AES_C
/** /**
* \def MBEDTLS_BLOCK_CIPHER_NO_DECRYPT * \def MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
* *
* Remove decryption operation for AES, ARIA and Camellia block cipher. * Use only 128-bit keys in AES operations to save ROM.
* *
* \note This feature is incompatible with insecure block cipher, * Uncomment this macro to remove support for AES operations that use 192-
* MBEDTLS_DES_C, and cipher modes which always require decryption * or 256-bit keys.
* operation, MBEDTLS_CIPHER_MODE_CBC, MBEDTLS_CIPHER_MODE_XTS and *
* MBEDTLS_NIST_KW_C. When #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, * Uncommenting this macro reduces the size of AES code by ~300 bytes
* this feature is incompatible with following supported PSA equivalence, * on v8-M/Thumb2.
* PSA_WANT_ALG_ECB_NO_PADDING, PSA_WANT_ALG_CBC_NO_PADDING,
* PSA_WANT_ALG_CBC_PKCS7 and PSA_WANT_KEY_TYPE_DES.
* *
* Module: library/aes.c * Module: library/aes.c
* library/aesce.c *
* library/aesni.c * Requires: MBEDTLS_AES_C
* library/aria.c
* library/camellia.c
* library/cipher.c
*/ */
#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT #define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
/** /**
* \def MBEDTLS_CIPHER_C * \def MBEDTLS_CIPHER_C
@ -388,18 +313,6 @@
*/ */
#define MBEDTLS_ENTROPY_C #define MBEDTLS_ENTROPY_C
/**
* \def MBEDTLS_ERROR_C
*
* Enable error code to error string conversion.
*
* Module: library/error.c
* Caller:
*
* This module enables mbedtls_strerror().
*/
#define MBEDTLS_ERROR_C
/** /**
* \def MBEDTLS_HKDF_C * \def MBEDTLS_HKDF_C
* *
@ -413,40 +326,7 @@
* This module adds support for the Hashed Message Authentication Code * This module adds support for the Hashed Message Authentication Code
* (HMAC)-based key derivation function (HKDF). * (HMAC)-based key derivation function (HKDF).
*/ */
#define MBEDTLS_HKDF_C /* Used for HUK deriviation */ //#define MBEDTLS_HKDF_C /* Used for HUK deriviation */
/**
* \def MBEDTLS_MD_C
*
* Enable the generic layer for message digest (hashing) and HMAC.
*
* Requires: one of: MBEDTLS_MD5_C, MBEDTLS_RIPEMD160_C, MBEDTLS_SHA1_C,
* MBEDTLS_SHA224_C, MBEDTLS_SHA256_C, MBEDTLS_SHA384_C,
* MBEDTLS_SHA512_C, or MBEDTLS_PSA_CRYPTO_C with at least
* one hash.
* Module: library/md.c
* Caller: library/constant_time.c
* library/ecdsa.c
* library/ecjpake.c
* library/hkdf.c
* library/hmac_drbg.c
* library/pk.c
* library/pkcs5.c
* library/pkcs12.c
* library/psa_crypto_ecp.c
* library/psa_crypto_rsa.c
* library/rsa.c
* library/ssl_cookie.c
* library/ssl_msg.c
* library/ssl_tls.c
* library/x509.c
* library/x509_crt.c
* library/x509write_crt.c
* library/x509write_csr.c
*
* Uncomment to enable generic message digest wrappers.
*/
#define MBEDTLS_MD_C
/** /**
* \def MBEDTLS_MEMORY_BUFFER_ALLOC_C * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
@ -484,6 +364,15 @@
*/ */
#define MBEDTLS_PLATFORM_C #define MBEDTLS_PLATFORM_C
#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h>
#include <stdio.h>
#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf
#define MBEDTLS_PLATFORM_PRINTF_ALT
#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS EXIT_SUCCESS
#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE EXIT_FAILURE
/** /**
* \def MBEDTLS_PSA_CRYPTO_C * \def MBEDTLS_PSA_CRYPTO_C
@ -508,9 +397,7 @@
* either MBEDTLS_PSA_ITS_FILE_C or a native implementation of * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of
* the PSA ITS interface * the PSA ITS interface
*/ */
// This macro is enabled in TFM Medium but is disabled here because it is #define MBEDTLS_PSA_CRYPTO_STORAGE_C
// incompatible with baremetal builds in Mbed TLS.
//#define MBEDTLS_PSA_CRYPTO_STORAGE_C
/* \} name SECTION: mbed TLS modules */ /* \} name SECTION: mbed TLS modules */
@ -614,6 +501,47 @@
/* ECP options */ /* ECP options */
#define MBEDTLS_ECP_FIXED_POINT_OPTIM 0 /**< Disable fixed-point speed-up */ #define MBEDTLS_ECP_FIXED_POINT_OPTIM 0 /**< Disable fixed-point speed-up */
/**
* Uncomment to enable p256-m. This is an alternative implementation of
* key generation, ECDH and (randomized) ECDSA on the curve SECP256R1.
* Compared to the default implementation:
*
* - p256-m has a much smaller code size and RAM footprint.
* - p256-m is only available via the PSA API. This includes the pk module
* when #MBEDTLS_USE_PSA_CRYPTO is enabled.
* - p256-m does not support deterministic ECDSA, EC-JPAKE, custom protocols
* over the core arithmetic, or deterministic derivation of keys.
*
* We recommend enabling this option if your application uses the PSA API
* and the only elliptic curve support it needs is ECDH and ECDSA over
* SECP256R1.
*
* If you enable this option, you do not need to enable any ECC-related
* MBEDTLS_xxx option. You do need to separately request support for the
* cryptographic mechanisms through the PSA API:
* - #MBEDTLS_PSA_CRYPTO_C and #MBEDTLS_PSA_CRYPTO_CONFIG for PSA-based
* configuration;
* - #MBEDTLS_USE_PSA_CRYPTO if you want to use p256-m from PK, X.509 or TLS;
* - #PSA_WANT_ECC_SECP_R1_256;
* - #PSA_WANT_ALG_ECDH and/or #PSA_WANT_ALG_ECDSA as needed;
* - #PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY, #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC,
* #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT,
* #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT and/or
* #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE as needed.
*
* \note To benefit from the smaller code size of p256-m, make sure that you
* do not enable any ECC-related option not supported by p256-m: this
* would cause the built-in ECC implementation to be built as well, in
* order to provide the required option.
* Make sure #PSA_WANT_ALG_DETERMINISTIC_ECDSA, #PSA_WANT_ALG_JPAKE and
* #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE, and curves other than
* SECP256R1 are disabled as they are not supported by this driver.
* Also, avoid defining #MBEDTLS_PK_PARSE_EC_COMPRESSED or
* #MBEDTLS_PK_PARSE_EC_EXTENDED as those currently require a subset of
* the built-in ECC implementation, see docs/driver-only-builds.md.
*/
#define MBEDTLS_PSA_P256M_DRIVER_ENABLED
/* \} name SECTION: Customisation configuration options */ /* \} name SECTION: Customisation configuration options */
#if CRYPTO_NV_SEED #if CRYPTO_NV_SEED
@ -621,7 +549,7 @@
#endif /* CRYPTO_NV_SEED */ #endif /* CRYPTO_NV_SEED */
#if !defined(CRYPTO_HW_ACCELERATOR) && defined(MBEDTLS_ENTROPY_NV_SEED) #if !defined(CRYPTO_HW_ACCELERATOR) && defined(MBEDTLS_ENTROPY_NV_SEED)
#include "mbedtls_entropy_nv_seed_config.h" //#include "mbedtls_entropy_nv_seed_config.h"
#endif #endif
#ifdef CRYPTO_HW_ACCELERATOR #ifdef CRYPTO_HW_ACCELERATOR

5
include/mbedtls/check_config.h
View File

@ -785,9 +785,8 @@
#error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites (missing RNG)" #error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites (missing RNG)"
#endif #endif
#if defined(MBEDTLS_PSA_CRYPTO_C) && \ #if defined(MBEDTLS_PSA_CRYPTO_C) && defined(PSA_HAVE_SOFT_BLOCK_MODE) && \
(defined(PSA_HAVE_SOFT_BLOCK_CIPHER) || defined(PSA_HAVE_SOFT_BLOCK_AEAD)) && \ defined(PSA_HAVE_SOFT_BLOCK_CIPHER) && !defined(MBEDTLS_CIPHER_C)
!defined(MBEDTLS_CIPHER_C)
#error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites" #error "MBEDTLS_PSA_CRYPTO_C defined, but not all prerequisites"
#endif #endif

9
include/mbedtls/config_adjust_psa_from_legacy.h
View File

@ -25,9 +25,11 @@
#if defined(MBEDTLS_CCM_C) #if defined(MBEDTLS_CCM_C)
#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 #define MBEDTLS_PSA_BUILTIN_ALG_CCM 1
#define MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG 1
#define PSA_WANT_ALG_CCM 1 #define PSA_WANT_ALG_CCM 1
#if defined(MBEDTLS_CIPHER_C)
#define MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG 1
#define PSA_WANT_ALG_CCM_STAR_NO_TAG 1 #define PSA_WANT_ALG_CCM_STAR_NO_TAG 1
#endif /* MBEDTLS_CIPHER_C */
#endif /* MBEDTLS_CCM_C */ #endif /* MBEDTLS_CCM_C */
#if defined(MBEDTLS_CMAC_C) #if defined(MBEDTLS_CMAC_C)
@ -247,8 +249,9 @@
#endif #endif
#endif #endif
#if defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) || \ #if (defined(MBEDTLS_AES_C) || defined(MBEDTLS_DES_C) || \
defined(MBEDTLS_ARIA_C) || defined(MBEDTLS_CAMELLIA_C) defined(MBEDTLS_ARIA_C) || defined(MBEDTLS_CAMELLIA_C)) && \
defined(MBEDTLS_CIPHER_C)
#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1 #define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1
#define PSA_WANT_ALG_ECB_NO_PADDING 1 #define PSA_WANT_ALG_ECB_NO_PADDING 1
#endif #endif

12
include/mbedtls/threading.h
View File

@ -28,10 +28,14 @@ extern "C" {
#include <pthread.h> #include <pthread.h>
typedef struct mbedtls_threading_mutex_t { typedef struct mbedtls_threading_mutex_t {
pthread_mutex_t MBEDTLS_PRIVATE(mutex); pthread_mutex_t MBEDTLS_PRIVATE(mutex);
/* is_valid is 0 after a failed init or a free, and nonzero after a
* successful init. This field is not considered part of the public /* WARNING - state should only be accessed when holding the mutex lock in
* API of Mbed TLS and may change without notice. */ * tests/src/threading_helpers.c, otherwise corruption can occur.
char MBEDTLS_PRIVATE(is_valid); * state will be 0 after a failed init or a free, and nonzero after a
* successful init. This field is for testing only and thus not considered
* part of the public API of Mbed TLS and may change without notice.*/
char MBEDTLS_PRIVATE(state);
} mbedtls_threading_mutex_t; } mbedtls_threading_mutex_t;
#endif #endif

19
library/common.h
View File

@ -23,6 +23,15 @@
#include <arm_neon.h> #include <arm_neon.h>
#endif /* __ARM_NEON */ #endif /* __ARM_NEON */
#if defined(__GNUC__) && !defined(__ARMCC_VERSION) && !defined(__clang__) \
&& !defined(__llvm__) && !defined(__INTEL_COMPILER)
/* Defined if the compiler really is gcc and not clang, etc */
#define MBEDTLS_COMPILER_IS_GCC
#define MBEDTLS_GCC_VERSION \
(__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
#endif
/** Helper to define a function as static except when building invasive tests. /** Helper to define a function as static except when building invasive tests.
* *
* If a function is only used inside its own source file and should be * If a function is only used inside its own source file and should be
@ -169,7 +178,9 @@ inline void mbedtls_xor(unsigned char *r, const unsigned char *a, const unsigned
{ {
size_t i = 0; size_t i = 0;
#if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS) #if defined(MBEDTLS_EFFICIENT_UNALIGNED_ACCESS)
#if defined(__ARM_NEON) #if defined(__ARM_NEON) && \
(!defined(MBEDTLS_COMPILER_IS_GCC) || \
(defined(MBEDTLS_COMPILER_IS_GCC) && MBEDTLS_GCC_VERSION >= 70300))
for (; (i + 16) <= n; i += 16) { for (; (i + 16) <= n; i += 16) {
uint8x16_t v1 = vld1q_u8(a + i); uint8x16_t v1 = vld1q_u8(a + i);
uint8x16_t v2 = vld1q_u8(b + i); uint8x16_t v2 = vld1q_u8(b + i);
@ -324,12 +335,6 @@ static inline void mbedtls_xor_no_simd(unsigned char *r,
#define MBEDTLS_ASSUME(x) do { } while (0) #define MBEDTLS_ASSUME(x) do { } while (0)
#endif #endif
#if defined(__GNUC__) && !defined(__ARMCC_VERSION) && !defined(__clang__) \
&& !defined(__llvm__) && !defined(__INTEL_COMPILER)
/* Defined if the compiler really is gcc and not clang, etc */
#define MBEDTLS_COMPILER_IS_GCC
#endif
/* For gcc -Os, override with -O2 for a given function. /* For gcc -Os, override with -O2 for a given function.
* *
* This will not affect behaviour for other optimisation settings, e.g. -O0. * This will not affect behaviour for other optimisation settings, e.g. -O0.

21
library/threading.c
View File

@ -56,28 +56,27 @@ static void threading_mutex_init_pthread(mbedtls_threading_mutex_t *mutex)
return; return;
} }
/* A nonzero value of is_valid indicates a successfully initialized /* One problem here is that calling lock on a pthread mutex without first
* mutex. This is a workaround for not being able to return an error * having initialised it is undefined behaviour. Obviously we cannot check
* code for this function. The lock/unlock functions return an error * this here in a thread safe manner without a significant performance
* if is_valid is nonzero. The Mbed TLS unit test code uses this field * hit, so state transitions are checked in tests only via the state
* to distinguish more states of the mutex; see * variable. Please make sure any new mutex that gets added is exercised in
* tests/src/threading_helpers for details. */ * tests; see tests/src/threading_helpers.c for more details. */
mutex->is_valid = pthread_mutex_init(&mutex->mutex, NULL) == 0; (void) pthread_mutex_init(&mutex->mutex, NULL);
} }
static void threading_mutex_free_pthread(mbedtls_threading_mutex_t *mutex) static void threading_mutex_free_pthread(mbedtls_threading_mutex_t *mutex)
{ {
if (mutex == NULL || !mutex->is_valid) { if (mutex == NULL) {
return; return;
} }
(void) pthread_mutex_destroy(&mutex->mutex); (void) pthread_mutex_destroy(&mutex->mutex);
mutex->is_valid = 0;
} }
static int threading_mutex_lock_pthread(mbedtls_threading_mutex_t *mutex) static int threading_mutex_lock_pthread(mbedtls_threading_mutex_t *mutex)
{ {
if (mutex == NULL || !mutex->is_valid) { if (mutex == NULL) {
return MBEDTLS_ERR_THREADING_BAD_INPUT_DATA; return MBEDTLS_ERR_THREADING_BAD_INPUT_DATA;
} }
@ -90,7 +89,7 @@ static int threading_mutex_lock_pthread(mbedtls_threading_mutex_t *mutex)
static int threading_mutex_unlock_pthread(mbedtls_threading_mutex_t *mutex) static int threading_mutex_unlock_pthread(mbedtls_threading_mutex_t *mutex)
{ {
if (mutex == NULL || !mutex->is_valid) { if (mutex == NULL) {
return MBEDTLS_ERR_THREADING_BAD_INPUT_DATA; return MBEDTLS_ERR_THREADING_BAD_INPUT_DATA;
} }

3
programs/ssl/ssl_test_lib.c
View File

@ -435,6 +435,9 @@ int test_hooks_failure_detected(void)
void test_hooks_free(void) void test_hooks_free(void)
{ {
#if defined(MBEDTLS_TEST_MUTEX_USAGE)
mbedtls_test_mutex_usage_end();
#endif
} }
#endif /* MBEDTLS_TEST_HOOKS */ #endif /* MBEDTLS_TEST_HOOKS */

12
tests/include/test/helpers.h
View File

@ -255,10 +255,18 @@ int mbedtls_test_hexcmp(uint8_t *a, uint8_t *b,
#endif #endif
#if defined(MBEDTLS_TEST_MUTEX_USAGE) #if defined(MBEDTLS_TEST_MUTEX_USAGE)
/** Permanently activate the mutex usage verification framework. See /**
* threading_helpers.c for information. */ * Activate the mutex usage verification framework. See threading_helpers.c for
* information.
* */
void mbedtls_test_mutex_usage_init(void); void mbedtls_test_mutex_usage_init(void);
/**
* Deactivate the mutex usage verification framework. See threading_helpers.c
* for information.
*/
void mbedtls_test_mutex_usage_end(void);
/** Call this function after executing a test case to check for mutex usage /** Call this function after executing a test case to check for mutex usage
* errors. */ * errors. */
void mbedtls_test_mutex_usage_check(void); void mbedtls_test_mutex_usage_check(void);

37
tests/scripts/all.sh
View File

@ -1583,9 +1583,7 @@ common_test_full_no_cipher_with_psa_crypto () {
# on CIPHER_C so we disable them. # on CIPHER_C so we disable them.
# This does not hold for KEY_TYPE_CHACHA20 and ALG_CHACHA20_POLY1305 # This does not hold for KEY_TYPE_CHACHA20 and ALG_CHACHA20_POLY1305
# so we keep them enabled. # so we keep them enabled.
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_GCM
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CMAC scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CMAC
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
@ -1594,27 +1592,19 @@ common_test_full_no_cipher_with_psa_crypto () {
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_OFB scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_OFB
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_STREAM_CIPHER scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_STREAM_CIPHER
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_AES
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_CAMELLIA
scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_ARIA
else else
# Don't pull in cipher via PSA mechanisms # Don't pull in cipher via PSA mechanisms
scripts/config.py unset MBEDTLS_PSA_CRYPTO_CONFIG scripts/config.py unset MBEDTLS_PSA_CRYPTO_CONFIG
# Disable cipher modes/keys that make PSA depend on CIPHER_C. # Disable cipher modes/keys that make PSA depend on CIPHER_C.
# Keep CHACHA20 and CHACHAPOLY enabled since they do not depend on CIPHER_C. # Keep CHACHA20 and CHACHAPOLY enabled since they do not depend on CIPHER_C.
scripts/config.py unset-all MBEDTLS_CIPHER_MODE scripts/config.py unset-all MBEDTLS_CIPHER_MODE
scripts/config.py unset MBEDTLS_AES_C
scripts/config.py unset MBEDTLS_DES_C scripts/config.py unset MBEDTLS_DES_C
scripts/config.py unset MBEDTLS_ARIA_C
scripts/config.py unset MBEDTLS_CAMELLIA_C
# Dependencies on AES_C # Dependencies on AES_C
scripts/config.py unset MBEDTLS_CTR_DRBG_C scripts/config.py unset MBEDTLS_CTR_DRBG_C
fi fi
# The following modules directly depends on CIPHER_C # The following modules directly depends on CIPHER_C
scripts/config.py unset MBEDTLS_CCM_C
scripts/config.py unset MBEDTLS_CMAC_C scripts/config.py unset MBEDTLS_CMAC_C
scripts/config.py unset MBEDTLS_GCM_C
scripts/config.py unset MBEDTLS_NIST_KW_C scripts/config.py unset MBEDTLS_NIST_KW_C
scripts/config.py unset MBEDTLS_PKCS12_C scripts/config.py unset MBEDTLS_PKCS12_C
scripts/config.py unset MBEDTLS_PKCS5_C scripts/config.py unset MBEDTLS_PKCS5_C
@ -3251,14 +3241,6 @@ common_tfm_config () {
# #
# Enable filesystem I/O for the benefit of PK parse/write tests. # Enable filesystem I/O for the benefit of PK parse/write tests.
echo "#define MBEDTLS_FS_IO" >> "$CONFIG_H" echo "#define MBEDTLS_FS_IO" >> "$CONFIG_H"
# Config adjustments for features that are not supported
# when using only drivers / by p256-m
#
# Disable all the features that auto-enable ECP_LIGHT (see config_adjust_legacy_crypto.h)
scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
# Disable deterministic ECDSA as p256-m only does randomized
scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
} }
# Keep this in sync with component_test_tfm_config() as they are both meant # Keep this in sync with component_test_tfm_config() as they are both meant
@ -3268,8 +3250,8 @@ component_test_tfm_config_p256m_driver_accel_ec () {
common_tfm_config common_tfm_config
# Build crypto library specifying we want to use P256M code for EC operations # Build crypto library
make CFLAGS="$ASAN_CFLAGS -DMBEDTLS_PSA_P256M_DRIVER_ENABLED -I../tests/include/spe" LDFLAGS="$ASAN_CFLAGS" make CFLAGS="$ASAN_CFLAGS -I../tests/include/spe" LDFLAGS="$ASAN_CFLAGS"
# Make sure any built-in EC alg was not re-enabled by accident (additive config) # Make sure any built-in EC alg was not re-enabled by accident (additive config)
not grep mbedtls_ecdsa_ library/ecdsa.o not grep mbedtls_ecdsa_ library/ecdsa.o
@ -3280,6 +3262,8 @@ component_test_tfm_config_p256m_driver_accel_ec () {
not grep mbedtls_rsa_ library/rsa.o not grep mbedtls_rsa_ library/rsa.o
not grep mbedtls_dhm_ library/dhm.o not grep mbedtls_dhm_ library/dhm.o
not grep mbedtls_mpi_ library/bignum.o not grep mbedtls_mpi_ library/bignum.o
# Check that p256m was built
grep -q p256_ecdsa_ library/libmbedcrypto.a
# Run the tests # Run the tests
msg "test: TF-M config + p256m driver + accel ECDH(E)/ECDSA" msg "test: TF-M config + p256m driver + accel ECDH(E)/ECDSA"
@ -3292,9 +3276,16 @@ component_test_tfm_config_p256m_driver_accel_ec () {
component_test_tfm_config() { component_test_tfm_config() {
common_tfm_config common_tfm_config
# Disable P256M driver, which is on by default, so that analyze_outcomes
# can compare this test with test_tfm_config_p256m_driver_accel_ec
echo "#undef MBEDTLS_PSA_P256M_DRIVER_ENABLED" >> "$CONFIG_H"
msg "build: TF-M config" msg "build: TF-M config"
make CFLAGS='-Werror -Wall -Wextra -I../tests/include/spe' tests make CFLAGS='-Werror -Wall -Wextra -I../tests/include/spe' tests
# Check that p256m was not built
not grep p256_ecdsa_ library/libmbedcrypto.a
msg "test: TF-M config" msg "test: TF-M config"
make test make test
} }
@ -4119,8 +4110,7 @@ support_build_tfm_armcc () {
component_build_tfm_armcc() { component_build_tfm_armcc() {
# test the TF-M configuration can build cleanly with various warning flags enabled # test the TF-M configuration can build cleanly with various warning flags enabled
cp configs/ext/tfm_mbedcrypto_config_profile_medium.h "$CONFIG_H" cp configs/config-tfm.h "$CONFIG_H"
cp configs/ext/crypto_config_profile_medium.h "$CRYPTO_CONFIG_H"
msg "build: TF-M config, armclang armv7-m thumb2" msg "build: TF-M config, armclang armv7-m thumb2"
armc6_build_test "--target=arm-arm-none-eabi -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused -I../tests/include/spe" armc6_build_test "--target=arm-arm-none-eabi -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused -I../tests/include/spe"
@ -4132,8 +4122,7 @@ component_build_tfm() {
# TF-M configuration needs a TF-M platform. A tweaked version of # TF-M configuration needs a TF-M platform. A tweaked version of
# the configuration that works on mainstream platforms is in # the configuration that works on mainstream platforms is in
# configs/config-tfm.h, tested via test-ref-configs.pl. # configs/config-tfm.h, tested via test-ref-configs.pl.
cp configs/ext/tfm_mbedcrypto_config_profile_medium.h "$CONFIG_H" cp configs/config-tfm.h "$CONFIG_H"
cp configs/ext/crypto_config_profile_medium.h "$CRYPTO_CONFIG_H"
msg "build: TF-M config, clang, armv7-m thumb2" msg "build: TF-M config, clang, armv7-m thumb2"
make lib CC="clang" CFLAGS="--target=arm-linux-gnueabihf -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused -I../tests/include/spe" make lib CC="clang" CFLAGS="--target=arm-linux-gnueabihf -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused -I../tests/include/spe"

190
tests/scripts/analyze_outcomes.py
View File

@ -12,9 +12,36 @@ import traceback
import re import re
import subprocess import subprocess
import os import os
import typing
import check_test_cases import check_test_cases
# `ComponentOutcomes` is a named tuple which is defined as:
# ComponentOutcomes(
# successes = {
# "<suite_case>",
# ...
# },
# failures = {
# "<suite_case>",
# ...
# }
# )
# suite_case = "<suite>;<case>"
ComponentOutcomes = typing.NamedTuple('ComponentOutcomes',
[('successes', typing.Set[str]),
('failures', typing.Set[str])])
# `Outcomes` is a representation of the outcomes file,
# which defined as:
# Outcomes = {
# "<component>": ComponentOutcomes,
# ...
# }
Outcomes = typing.Dict[str, ComponentOutcomes]
class Results: class Results:
"""Process analysis results.""" """Process analysis results."""
@ -40,35 +67,12 @@ class Results:
def _print_line(fmt, *args, **kwargs): def _print_line(fmt, *args, **kwargs):
sys.stderr.write((fmt + '\n').format(*args, **kwargs)) sys.stderr.write((fmt + '\n').format(*args, **kwargs))
class TestCaseOutcomes: def execute_reference_driver_tests(results: Results, ref_component: str, driver_component: str, \
"""The outcomes of one test case across many configurations.""" outcome_file: str) -> None:
# pylint: disable=too-few-public-methods
def __init__(self):
# Collect a list of witnesses of the test case succeeding or failing.
# Currently we don't do anything with witnesses except count them.
# The format of a witness is determined by the read_outcome_file
# function; it's the platform and configuration joined by ';'.
self.successes = []
self.failures = []
def hits(self):
"""Return the number of times a test case has been run.
This includes passes and failures, but not skips.
"""
return len(self.successes) + len(self.failures)
def execute_reference_driver_tests(results: Results, ref_component, driver_component, \
outcome_file):
"""Run the tests specified in ref_component and driver_component. Results """Run the tests specified in ref_component and driver_component. Results
are stored in the output_file and they will be used for the following are stored in the output_file and they will be used for the following
coverage analysis""" coverage analysis"""
# If the outcome file already exists, we assume that the user wants to results.new_section("Test {} and {}", ref_component, driver_component)
# perform the comparison analysis again without repeating the tests.
if os.path.exists(outcome_file):
results.info("Outcome file ({}) already exists. Tests will be skipped.", outcome_file)
return
shell_command = "tests/scripts/all.sh --outcome-file " + outcome_file + \ shell_command = "tests/scripts/all.sh --outcome-file " + outcome_file + \
" " + ref_component + " " + driver_component " " + ref_component + " " + driver_component
@ -78,24 +82,28 @@ def execute_reference_driver_tests(results: Results, ref_component, driver_compo
if ret_val != 0: if ret_val != 0:
results.error("failed to run reference/driver components") results.error("failed to run reference/driver components")
def analyze_coverage(results, outcomes, allow_list, full_coverage): def analyze_coverage(results: Results, outcomes: Outcomes,
allow_list: typing.List[str], full_coverage: bool) -> None:
"""Check that all available test cases are executed at least once.""" """Check that all available test cases are executed at least once."""
available = check_test_cases.collect_available_test_cases() available = check_test_cases.collect_available_test_cases()
for key in available: for suite_case in available:
hits = outcomes[key].hits() if key in outcomes else 0 hit = any(suite_case in comp_outcomes.successes or
if hits == 0 and key not in allow_list: suite_case in comp_outcomes.failures
for comp_outcomes in outcomes.values())
if not hit and suite_case not in allow_list:
if full_coverage: if full_coverage:
results.error('Test case not executed: {}', key) results.error('Test case not executed: {}', suite_case)
else: else:
results.warning('Test case not executed: {}', key) results.warning('Test case not executed: {}', suite_case)
elif hits != 0 and key in allow_list: elif hit and suite_case in allow_list:
# Test Case should be removed from the allow list. # Test Case should be removed from the allow list.
if full_coverage: if full_coverage:
results.error('Allow listed test case was executed: {}', key) results.error('Allow listed test case was executed: {}', suite_case)
else: else:
results.warning('Allow listed test case was executed: {}', key) results.warning('Allow listed test case was executed: {}', suite_case)
def name_matches_pattern(name, str_or_re): def name_matches_pattern(name: str, str_or_re) -> bool:
"""Check if name matches a pattern, that may be a string or regex. """Check if name matches a pattern, that may be a string or regex.
- If the pattern is a string, name must be equal to match. - If the pattern is a string, name must be equal to match.
- If the pattern is a regex, name must fully match. - If the pattern is a regex, name must fully match.
@ -103,24 +111,34 @@ def name_matches_pattern(name, str_or_re):
# The CI's python is too old for re.Pattern # The CI's python is too old for re.Pattern
#if isinstance(str_or_re, re.Pattern): #if isinstance(str_or_re, re.Pattern):
if not isinstance(str_or_re, str): if not isinstance(str_or_re, str):
return str_or_re.fullmatch(name) return str_or_re.fullmatch(name) is not None
else: else:
return str_or_re == name return str_or_re == name
def analyze_driver_vs_reference(results: Results, outcomes, def analyze_driver_vs_reference(results: Results, outcomes: Outcomes,
component_ref, component_driver, component_ref: str, component_driver: str,
ignored_suites, ignored_tests=None): ignored_suites: typing.List[str], ignored_tests=None) -> None:
"""Check that all tests executed in the reference component are also """Check that all tests passing in the reference component are also
executed in the corresponding driver component. passing in the corresponding driver component.
Skip: Skip:
- full test suites provided in ignored_suites list - full test suites provided in ignored_suites list
- only some specific test inside a test suite, for which the corresponding - only some specific test inside a test suite, for which the corresponding
output string is provided output string is provided
""" """
seen_reference_passing = False ref_outcomes = outcomes.get("component_" + component_ref)
for key in outcomes: driver_outcomes = outcomes.get("component_" + component_driver)
# key is like "test_suite_foo.bar;Description of test case"
(full_test_suite, test_string) = key.split(';') if ref_outcomes is None or driver_outcomes is None:
results.error("required components are missing: bad outcome file?")
return
if not ref_outcomes.successes:
results.error("no passing test in reference component: bad outcome file?")
return
for suite_case in ref_outcomes.successes:
# suite_case is like "test_suite_foo.bar;Description of test case"
(full_test_suite, test_string) = suite_case.split(';')
test_suite = full_test_suite.split('.')[0] # retrieve main part of test suite name test_suite = full_test_suite.split('.')[0] # retrieve main part of test suite name
# Immediately skip fully-ignored test suites # Immediately skip fully-ignored test suites
@ -136,67 +154,48 @@ def analyze_driver_vs_reference(results: Results, outcomes,
if name_matches_pattern(test_string, str_or_re): if name_matches_pattern(test_string, str_or_re):
ignored = True ignored = True
# Search for tests that run in reference component and not in driver component if not ignored and not suite_case in driver_outcomes.successes:
driver_test_passed = False results.error("PASS -> SKIP/FAIL: {}", suite_case)
reference_test_passed = False if ignored and suite_case in driver_outcomes.successes:
for entry in outcomes[key].successes: results.error("uselessly ignored: {}", suite_case)
if component_driver in entry:
driver_test_passed = True
if component_ref in entry:
reference_test_passed = True
seen_reference_passing = True
if reference_test_passed and not driver_test_passed and not ignored:
results.error("PASS -> SKIP/FAIL: {}", key)
if ignored and driver_test_passed:
results.error("uselessly ignored: {}", key)
if not seen_reference_passing: def analyze_outcomes(results: Results, outcomes: Outcomes, args) -> None:
results.error("no passing test in reference component: bad outcome file?")
def analyze_outcomes(results: Results, outcomes, args):
"""Run all analyses on the given outcome collection.""" """Run all analyses on the given outcome collection."""
analyze_coverage(results, outcomes, args['allow_list'], analyze_coverage(results, outcomes, args['allow_list'],
args['full_coverage']) args['full_coverage'])
def read_outcome_file(outcome_file): def read_outcome_file(outcome_file: str) -> Outcomes:
"""Parse an outcome file and return an outcome collection. """Parse an outcome file and return an outcome collection.
"""
An outcome collection is a dictionary mapping keys to TestCaseOutcomes objects.
The keys are the test suite name and the test case description, separated
by a semicolon.
"""
outcomes = {} outcomes = {}
with open(outcome_file, 'r', encoding='utf-8') as input_file: with open(outcome_file, 'r', encoding='utf-8') as input_file:
for line in input_file: for line in input_file:
(platform, config, suite, case, result, _cause) = line.split(';') (_platform, component, suite, case, result, _cause) = line.split(';')
key = ';'.join([suite, case]) # Note that `component` is not unique. If a test case passes on Linux
setup = ';'.join([platform, config]) # and fails on FreeBSD, it'll end up in both the successes set and
if key not in outcomes: # the failures set.
outcomes[key] = TestCaseOutcomes() suite_case = ';'.join([suite, case])
if component not in outcomes:
outcomes[component] = ComponentOutcomes(set(), set())
if result == 'PASS': if result == 'PASS':
outcomes[key].successes.append(setup) outcomes[component].successes.add(suite_case)
elif result == 'FAIL': elif result == 'FAIL':
outcomes[key].failures.append(setup) outcomes[component].failures.add(suite_case)
return outcomes return outcomes
def do_analyze_coverage(results: Results, outcome_file, args): def do_analyze_coverage(results: Results, outcomes: Outcomes, args) -> None:
"""Perform coverage analysis.""" """Perform coverage analysis."""
results.new_section("Analyze coverage") results.new_section("Analyze coverage")
outcomes = read_outcome_file(outcome_file)
analyze_outcomes(results, outcomes, args) analyze_outcomes(results, outcomes, args)
def do_analyze_driver_vs_reference(results: Results, outcome_file, args): def do_analyze_driver_vs_reference(results: Results, outcomes: Outcomes, args) -> None:
"""Perform driver vs reference analyze.""" """Perform driver vs reference analyze."""
results.new_section("Analyze driver {} vs reference {}", results.new_section("Analyze driver {} vs reference {}",
args['component_driver'], args['component_ref']) args['component_driver'], args['component_ref'])
execute_reference_driver_tests(results, args['component_ref'], \
args['component_driver'], outcome_file)
ignored_suites = ['test_suite_' + x for x in args['ignored_suites']] ignored_suites = ['test_suite_' + x for x in args['ignored_suites']]
outcomes = read_outcome_file(outcome_file)
analyze_driver_vs_reference(results, outcomes, analyze_driver_vs_reference(results, outcomes,
args['component_ref'], args['component_driver'], args['component_ref'], args['component_driver'],
ignored_suites, args['ignored_tests']) ignored_suites, args['ignored_tests'])
@ -542,10 +541,31 @@ def main():
KNOWN_TASKS['analyze_coverage']['args']['full_coverage'] = options.full_coverage KNOWN_TASKS['analyze_coverage']['args']['full_coverage'] = options.full_coverage
# If the outcome file exists, parse it once and share the result
# among tasks to improve performance.
# Otherwise, it will be generated by execute_reference_driver_tests.
if not os.path.exists(options.outcomes):
if len(tasks_list) > 1:
sys.stderr.write("mutiple tasks found, please provide a valid outcomes file.\n")
sys.exit(2)
task_name = tasks_list[0]
task = KNOWN_TASKS[task_name]
if task['test_function'] != do_analyze_driver_vs_reference: # pylint: disable=comparison-with-callable
sys.stderr.write("please provide valid outcomes file for {}.\n".format(task_name))
sys.exit(2)
execute_reference_driver_tests(main_results,
task['args']['component_ref'],
task['args']['component_driver'],
options.outcomes)
outcomes = read_outcome_file(options.outcomes)
for task in tasks_list: for task in tasks_list:
test_function = KNOWN_TASKS[task]['test_function'] test_function = KNOWN_TASKS[task]['test_function']
test_args = KNOWN_TASKS[task]['args'] test_args = KNOWN_TASKS[task]['args']
test_function(main_results, options.outcomes, test_args) test_function(main_results, outcomes, test_args)
main_results.info("Overall results: {} warnings and {} errors", main_results.info("Overall results: {} warnings and {} errors",
main_results.warning_count, main_results.error_count) main_results.warning_count, main_results.error_count)

165
tests/src/threading_helpers.c
View File

@ -58,15 +58,15 @@
* indicate the exact location of the problematic call. To locate the error, * indicate the exact location of the problematic call. To locate the error,
* use a debugger and set a breakpoint on mbedtls_test_mutex_usage_error(). * use a debugger and set a breakpoint on mbedtls_test_mutex_usage_error().
*/ */
enum value_of_mutex_is_valid_field { enum value_of_mutex_state_field {
/* Potential values for the is_valid field of mbedtls_threading_mutex_t. /* Potential values for the state field of mbedtls_threading_mutex_t.
* Note that MUTEX_FREED must be 0 and MUTEX_IDLE must be 1 for * Note that MUTEX_FREED must be 0 and MUTEX_IDLE must be 1 for
* compatibility with threading_mutex_init_pthread() and * compatibility with threading_mutex_init_pthread() and
* threading_mutex_free_pthread(). MUTEX_LOCKED could be any nonzero * threading_mutex_free_pthread(). MUTEX_LOCKED could be any nonzero
* value. */ * value. */
MUTEX_FREED = 0, //!< Set by threading_mutex_free_pthread MUTEX_FREED = 0, //! < Set by mbedtls_test_wrap_mutex_free
MUTEX_IDLE = 1, //!< Set by threading_mutex_init_pthread and by our unlock MUTEX_IDLE = 1, //! < Set by mbedtls_test_wrap_mutex_init and by mbedtls_test_wrap_mutex_unlock
MUTEX_LOCKED = 2, //!< Set by our lock MUTEX_LOCKED = 2, //! < Set by mbedtls_test_wrap_mutex_lock
}; };
typedef struct { typedef struct {
@ -77,10 +77,30 @@ typedef struct {
} mutex_functions_t; } mutex_functions_t;
static mutex_functions_t mutex_functions; static mutex_functions_t mutex_functions;
/** The total number of calls to mbedtls_mutex_init(), minus the total number /**
* of calls to mbedtls_mutex_free(). * The mutex used to guard live_mutexes below and access to the status variable
* in every mbedtls_threading_mutex_t.
* Note that we are not reporting any errors when locking and unlocking this
* mutex. This is for a couple of reasons:
* *
* Reset to 0 after each test case. * 1. We have no real way of reporting any errors with this mutex - we cannot
* report it back to the caller, as the failure was not that of the mutex
* passed in. We could fail the test, but again this would indicate a problem
* with the test code that did not exist.
*
* 2. Any failure to lock is unlikely to be intermittent, and will thus not
* give false test results - the overall result would be to turn off the
* testing. This is not a situation that is likely to happen with normal
* testing and we still have TSan to fall back on should this happen.
*/
mbedtls_threading_mutex_t mbedtls_test_mutex_mutex;
/**
* The total number of calls to mbedtls_mutex_init(), minus the total number
* of calls to mbedtls_mutex_free().
*
* Do not read or write without holding mbedtls_test_mutex_mutex (above). Reset
* to 0 after each test case.
*/ */
static int live_mutexes; static int live_mutexes;
@ -88,6 +108,7 @@ static void mbedtls_test_mutex_usage_error(mbedtls_threading_mutex_t *mutex,
const char *msg) const char *msg)
{ {
(void) mutex; (void) mutex;
if (mbedtls_test_info.mutex_usage_error == NULL) { if (mbedtls_test_info.mutex_usage_error == NULL) {
mbedtls_test_info.mutex_usage_error = msg; mbedtls_test_info.mutex_usage_error = msg;
} }
@ -101,76 +122,92 @@ static void mbedtls_test_mutex_usage_error(mbedtls_threading_mutex_t *mutex,
static void mbedtls_test_wrap_mutex_init(mbedtls_threading_mutex_t *mutex) static void mbedtls_test_wrap_mutex_init(mbedtls_threading_mutex_t *mutex)
{ {
mutex_functions.init(mutex); mutex_functions.init(mutex);
if (mutex->is_valid) {
if (mutex_functions.lock(&mbedtls_test_mutex_mutex) == 0) {
mutex->state = MUTEX_IDLE;
++live_mutexes; ++live_mutexes;
mutex_functions.unlock(&mbedtls_test_mutex_mutex);
} }
} }
static void mbedtls_test_wrap_mutex_free(mbedtls_threading_mutex_t *mutex) static void mbedtls_test_wrap_mutex_free(mbedtls_threading_mutex_t *mutex)
{ {
switch (mutex->is_valid) { if (mutex_functions.lock(&mbedtls_test_mutex_mutex) == 0) {
case MUTEX_FREED:
mbedtls_test_mutex_usage_error(mutex, "free without init or double free"); switch (mutex->state) {
break; case MUTEX_FREED:
case MUTEX_IDLE: mbedtls_test_mutex_usage_error(mutex, "free without init or double free");
/* Do nothing. The underlying free function will reset is_valid break;
* to 0. */ case MUTEX_IDLE:
break; mutex->state = MUTEX_FREED;
case MUTEX_LOCKED: --live_mutexes;
mbedtls_test_mutex_usage_error(mutex, "free without unlock"); break;
break; case MUTEX_LOCKED:
default: mbedtls_test_mutex_usage_error(mutex, "free without unlock");
mbedtls_test_mutex_usage_error(mutex, "corrupted state"); break;
break; default:
} mbedtls_test_mutex_usage_error(mutex, "corrupted state");
if (mutex->is_valid) { break;
--live_mutexes; }
mutex_functions.unlock(&mbedtls_test_mutex_mutex);
} }
mutex_functions.free(mutex); mutex_functions.free(mutex);
} }
static int mbedtls_test_wrap_mutex_lock(mbedtls_threading_mutex_t *mutex) static int mbedtls_test_wrap_mutex_lock(mbedtls_threading_mutex_t *mutex)
{ {
/* Lock the passed in mutex first, so that the only way to change the state
* is to hold the passed in and internal mutex - otherwise we create a race
* condition. */
int ret = mutex_functions.lock(mutex); int ret = mutex_functions.lock(mutex);
switch (mutex->is_valid) { if (mutex_functions.lock(&mbedtls_test_mutex_mutex) == 0) {
case MUTEX_FREED: switch (mutex->state) {
mbedtls_test_mutex_usage_error(mutex, "lock without init"); case MUTEX_FREED:
break; mbedtls_test_mutex_usage_error(mutex, "lock without init");
case MUTEX_IDLE: break;
if (ret == 0) { case MUTEX_IDLE:
mutex->is_valid = 2; if (ret == 0) {
} mutex->state = MUTEX_LOCKED;
break; }
case MUTEX_LOCKED: break;
mbedtls_test_mutex_usage_error(mutex, "double lock"); case MUTEX_LOCKED:
break; mbedtls_test_mutex_usage_error(mutex, "double lock");
default: break;
mbedtls_test_mutex_usage_error(mutex, "corrupted state"); default:
break; mbedtls_test_mutex_usage_error(mutex, "corrupted state");
break;
}
mutex_functions.unlock(&mbedtls_test_mutex_mutex);
} }
return ret; return ret;
} }
static int mbedtls_test_wrap_mutex_unlock(mbedtls_threading_mutex_t *mutex) static int mbedtls_test_wrap_mutex_unlock(mbedtls_threading_mutex_t *mutex)
{ {
int ret = mutex_functions.unlock(mutex); /* Lock the internal mutex first and change state, so that the only way to
switch (mutex->is_valid) { * change the state is to hold the passed in and internal mutex - otherwise
case MUTEX_FREED: * we create a race condition. */
mbedtls_test_mutex_usage_error(mutex, "unlock without init"); if (mutex_functions.lock(&mbedtls_test_mutex_mutex) == 0) {
break; switch (mutex->state) {
case MUTEX_IDLE: case MUTEX_FREED:
mbedtls_test_mutex_usage_error(mutex, "unlock without lock"); mbedtls_test_mutex_usage_error(mutex, "unlock without init");
break; break;
case MUTEX_LOCKED: case MUTEX_IDLE:
if (ret == 0) { mbedtls_test_mutex_usage_error(mutex, "unlock without lock");
mutex->is_valid = MUTEX_IDLE; break;
} case MUTEX_LOCKED:
break; mutex->state = MUTEX_IDLE;
default: break;
mbedtls_test_mutex_usage_error(mutex, "corrupted state"); default:
break; mbedtls_test_mutex_usage_error(mutex, "corrupted state");
break;
}
mutex_functions.unlock(&mbedtls_test_mutex_mutex);
} }
return ret; return mutex_functions.unlock(mutex);
} }
void mbedtls_test_mutex_usage_init(void) void mbedtls_test_mutex_usage_init(void)
@ -183,6 +220,8 @@ void mbedtls_test_mutex_usage_init(void)
mbedtls_mutex_free = &mbedtls_test_wrap_mutex_free; mbedtls_mutex_free = &mbedtls_test_wrap_mutex_free;
mbedtls_mutex_lock = &mbedtls_test_wrap_mutex_lock; mbedtls_mutex_lock = &mbedtls_test_wrap_mutex_lock;
mbedtls_mutex_unlock = &mbedtls_test_wrap_mutex_unlock; mbedtls_mutex_unlock = &mbedtls_test_wrap_mutex_unlock;
mutex_functions.init(&mbedtls_test_mutex_mutex);
} }
void mbedtls_test_mutex_usage_check(void) void mbedtls_test_mutex_usage_check(void)
@ -207,4 +246,14 @@ void mbedtls_test_mutex_usage_check(void)
mbedtls_test_info.mutex_usage_error = NULL; mbedtls_test_info.mutex_usage_error = NULL;
} }
void mbedtls_test_mutex_usage_end(void)
{
mbedtls_mutex_init = mutex_functions.init;
mbedtls_mutex_free = mutex_functions.free;
mbedtls_mutex_lock = mutex_functions.lock;
mbedtls_mutex_unlock = mutex_functions.unlock;
mutex_functions.free(&mbedtls_test_mutex_mutex);
}
#endif /* MBEDTLS_TEST_MUTEX_USAGE */ #endif /* MBEDTLS_TEST_MUTEX_USAGE */

53
tests/ssl-opt.sh
View File

@ -358,9 +358,18 @@ requires_protocol_version() {
# Space-separated list of ciphersuites supported by this build of # Space-separated list of ciphersuites supported by this build of
# Mbed TLS. # Mbed TLS.
P_CIPHERSUITES=" $($P_CLI --help 2>/dev/null | P_CIPHERSUITES=""
grep 'TLS-\|TLS1-3' | if [ "$LIST_TESTS" -eq 0 ]; then
tr -s ' \n' ' ')" P_CIPHERSUITES=" $($P_CLI help_ciphersuites 2>/dev/null |
grep 'TLS-\|TLS1-3' |
tr -s ' \n' ' ')"
if [ -z "${P_CIPHERSUITES# }" ]; then
echo >&2 "$0: fatal error: no cipher suites found!"
exit 125
fi
fi
requires_ciphersuite_enabled() { requires_ciphersuite_enabled() {
case $P_CIPHERSUITES in case $P_CIPHERSUITES in
*" $1 "*) :;; *" $1 "*) :;;
@ -2332,7 +2341,6 @@ run_test "Opaque key for server authentication: invalid alg: ecdh with RSA ke
requires_config_enabled MBEDTLS_USE_PSA_CRYPTO requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
requires_config_enabled MBEDTLS_X509_CRT_PARSE_C requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_CCM_C
run_test "Opaque key for server authentication: invalid alg: ECDHE-ECDSA with ecdh" \ run_test "Opaque key for server authentication: invalid alg: ECDHE-ECDSA with ecdh" \
"$P_SRV key_opaque=1 crt_file=data_files/server5.crt \ "$P_SRV key_opaque=1 crt_file=data_files/server5.crt \
key_file=data_files/server5.key key_opaque_algs=ecdh,none \ key_file=data_files/server5.key key_opaque_algs=ecdh,none \
@ -2386,7 +2394,6 @@ run_test "Opaque keys for server authentication: EC keys with different algs,
requires_config_enabled MBEDTLS_USE_PSA_CRYPTO requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
requires_config_enabled MBEDTLS_X509_CRT_PARSE_C requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
requires_hash_alg SHA_384 requires_hash_alg SHA_384
requires_config_enabled MBEDTLS_CCM_C
requires_config_disabled MBEDTLS_X509_REMOVE_INFO requires_config_disabled MBEDTLS_X509_REMOVE_INFO
run_test "Opaque keys for server authentication: EC + RSA, force ECDHE-ECDSA" \ run_test "Opaque keys for server authentication: EC + RSA, force ECDHE-ECDSA" \
"$P_SRV key_opaque=1 crt_file=data_files/server5.crt \ "$P_SRV key_opaque=1 crt_file=data_files/server5.crt \
@ -2566,7 +2573,6 @@ requires_config_enabled MBEDTLS_USE_PSA_CRYPTO
requires_config_enabled MBEDTLS_X509_CRT_PARSE_C requires_config_enabled MBEDTLS_X509_CRT_PARSE_C
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_hash_alg SHA_384 requires_hash_alg SHA_384
requires_config_enabled MBEDTLS_GCM_C
requires_config_disabled MBEDTLS_X509_REMOVE_INFO requires_config_disabled MBEDTLS_X509_REMOVE_INFO
run_test "Opaque keys for server authentication: EC + RSA, force DHE-RSA" \ run_test "Opaque keys for server authentication: EC + RSA, force DHE-RSA" \
"$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server5.crt \ "$P_SRV auth_mode=required key_opaque=1 crt_file=data_files/server5.crt \
@ -9115,8 +9121,6 @@ run_test "SSL async private: renegotiation: server-initiated, decrypt" \
# Tests for ECC extensions (rfc 4492) # Tests for ECC extensions (rfc 4492)
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_CIPHER_MODE_CBC
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
run_test "Force a non ECC ciphersuite in the client side" \ run_test "Force a non ECC ciphersuite in the client side" \
@ -9128,8 +9132,6 @@ run_test "Force a non ECC ciphersuite in the client side" \
-S "found supported elliptic curves extension" \ -S "found supported elliptic curves extension" \
-S "found supported point formats extension" -S "found supported point formats extension"
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_CIPHER_MODE_CBC
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED requires_config_enabled MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
run_test "Force a non ECC ciphersuite in the server side" \ run_test "Force a non ECC ciphersuite in the server side" \
@ -9139,8 +9141,6 @@ run_test "Force a non ECC ciphersuite in the server side" \
-C "found supported_point_formats extension" \ -C "found supported_point_formats extension" \
-S "server hello, supported_point_formats extension" -S "server hello, supported_point_formats extension"
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_CIPHER_MODE_CBC
requires_hash_alg SHA_256 requires_hash_alg SHA_256
run_test "Force an ECC ciphersuite in the client side" \ run_test "Force an ECC ciphersuite in the client side" \
"$P_SRV debug_level=3" \ "$P_SRV debug_level=3" \
@ -9151,8 +9151,6 @@ run_test "Force an ECC ciphersuite in the client side" \
-s "found supported elliptic curves extension" \ -s "found supported elliptic curves extension" \
-s "found supported point formats extension" -s "found supported point formats extension"
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_CIPHER_MODE_CBC
requires_hash_alg SHA_256 requires_hash_alg SHA_256
run_test "Force an ECC ciphersuite in the server side" \ run_test "Force an ECC ciphersuite in the server side" \
"$P_SRV debug_level=3 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \ "$P_SRV debug_level=3 force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-CBC-SHA256" \
@ -9677,8 +9675,6 @@ run_test "DTLS fragmenting: both (MTU=1024)" \
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: both (MTU=512)" \ run_test "DTLS fragmenting: both (MTU=512)" \
-p "$P_PXY mtu=512" \ -p "$P_PXY mtu=512" \
@ -9707,8 +9703,6 @@ run_test "DTLS fragmenting: both (MTU=512)" \
not_with_valgrind not_with_valgrind
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU: auto-reduction (not valgrind)" \ run_test "DTLS fragmenting: proxy MTU: auto-reduction (not valgrind)" \
-p "$P_PXY mtu=508" \ -p "$P_PXY mtu=508" \
@ -9730,8 +9724,6 @@ run_test "DTLS fragmenting: proxy MTU: auto-reduction (not valgrind)" \
only_with_valgrind only_with_valgrind
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU: auto-reduction (with valgrind)" \ run_test "DTLS fragmenting: proxy MTU: auto-reduction (with valgrind)" \
-p "$P_PXY mtu=508" \ -p "$P_PXY mtu=508" \
@ -9782,8 +9774,6 @@ run_test "DTLS fragmenting: proxy MTU, simple handshake (MTU=1024)" \
not_with_valgrind # spurious autoreduction due to timeout not_with_valgrind # spurious autoreduction due to timeout
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU, simple handshake (MTU=512)" \ run_test "DTLS fragmenting: proxy MTU, simple handshake (MTU=512)" \
-p "$P_PXY mtu=512" \ -p "$P_PXY mtu=512" \
@ -9831,8 +9821,6 @@ run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio (MTU=1024)" \
not_with_valgrind # spurious autoreduction due to timeout not_with_valgrind # spurious autoreduction due to timeout
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio (MTU=512)" \ run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio (MTU=512)" \
-p "$P_PXY mtu=512" \ -p "$P_PXY mtu=512" \
@ -9866,8 +9854,6 @@ run_test "DTLS fragmenting: proxy MTU, simple handshake, nbio (MTU=512)" \
not_with_valgrind # spurious autoreduction due to timeout not_with_valgrind # spurious autoreduction due to timeout
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU, resumed handshake" \ run_test "DTLS fragmenting: proxy MTU, resumed handshake" \
-p "$P_PXY mtu=1450" \ -p "$P_PXY mtu=1450" \
@ -9895,7 +9881,6 @@ requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
requires_config_enabled MBEDTLS_CHACHAPOLY_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU, ChachaPoly renego" \ run_test "DTLS fragmenting: proxy MTU, ChachaPoly renego" \
-p "$P_PXY mtu=512" \ -p "$P_PXY mtu=512" \
@ -9909,7 +9894,7 @@ run_test "DTLS fragmenting: proxy MTU, ChachaPoly renego" \
crt_file=data_files/server8_int-ca2.crt \ crt_file=data_files/server8_int-ca2.crt \
key_file=data_files/server8.key \ key_file=data_files/server8.key \
exchanges=2 renegotiation=1 renegotiate=1 \ exchanges=2 renegotiation=1 renegotiate=1 \
force_ciphersuite=TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256 \ force_ciphersuite=TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256 \
hs_timeout=10000-60000 \ hs_timeout=10000-60000 \
mtu=512" \ mtu=512" \
0 \ 0 \
@ -9925,8 +9910,6 @@ requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU, AES-GCM renego" \ run_test "DTLS fragmenting: proxy MTU, AES-GCM renego" \
-p "$P_PXY mtu=512" \ -p "$P_PXY mtu=512" \
@ -9956,8 +9939,6 @@ requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_CCM_C
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU, AES-CCM renego" \ run_test "DTLS fragmenting: proxy MTU, AES-CCM renego" \
-p "$P_PXY mtu=1024" \ -p "$P_PXY mtu=1024" \
@ -9987,8 +9968,6 @@ requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_CIPHER_MODE_CBC
requires_config_enabled MBEDTLS_SSL_ENCRYPT_THEN_MAC requires_config_enabled MBEDTLS_SSL_ENCRYPT_THEN_MAC
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU, AES-CBC EtM renego" \ run_test "DTLS fragmenting: proxy MTU, AES-CBC EtM renego" \
@ -10019,8 +9998,6 @@ requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_hash_alg SHA_256 requires_hash_alg SHA_256
requires_config_enabled MBEDTLS_SSL_RENEGOTIATION requires_config_enabled MBEDTLS_SSL_RENEGOTIATION
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_CIPHER_MODE_CBC
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU, AES-CBC non-EtM renego" \ run_test "DTLS fragmenting: proxy MTU, AES-CBC non-EtM renego" \
-p "$P_PXY mtu=1024" \ -p "$P_PXY mtu=1024" \
@ -10046,8 +10023,6 @@ run_test "DTLS fragmenting: proxy MTU, AES-CBC non-EtM renego" \
# Forcing ciphersuite for this test to fit the MTU of 512 with full config. # Forcing ciphersuite for this test to fit the MTU of 512 with full config.
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
client_needs_more_time 2 client_needs_more_time 2
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU + 3d" \ run_test "DTLS fragmenting: proxy MTU + 3d" \
@ -10069,8 +10044,6 @@ run_test "DTLS fragmenting: proxy MTU + 3d" \
# Forcing ciphersuite for this test to fit the MTU of 512 with full config. # Forcing ciphersuite for this test to fit the MTU of 512 with full config.
requires_config_enabled MBEDTLS_SSL_PROTO_DTLS requires_config_enabled MBEDTLS_SSL_PROTO_DTLS
requires_config_enabled MBEDTLS_RSA_C requires_config_enabled MBEDTLS_RSA_C
requires_config_enabled MBEDTLS_AES_C
requires_config_enabled MBEDTLS_GCM_C
client_needs_more_time 2 client_needs_more_time 2
requires_max_content_len 2048 requires_max_content_len 2048
run_test "DTLS fragmenting: proxy MTU + 3d, nbio" \ run_test "DTLS fragmenting: proxy MTU + 3d, nbio" \

4
tests/suites/host_test.function
View File

@ -772,6 +772,10 @@ int execute_tests(int argc, const char **argv)
mbedtls_fprintf(stdout, " (%u / %u tests (%u skipped))\n", mbedtls_fprintf(stdout, " (%u / %u tests (%u skipped))\n",
total_tests - total_errors, total_tests, total_skipped); total_tests - total_errors, total_tests, total_skipped);
#if defined(MBEDTLS_TEST_MUTEX_USAGE)
mbedtls_test_mutex_usage_end();
#endif
#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && \ #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && \
!defined(TEST_SUITE_MEMORY_BUFFER_ALLOC) !defined(TEST_SUITE_MEMORY_BUFFER_ALLOC)
#if defined(MBEDTLS_MEMORY_DEBUG) #if defined(MBEDTLS_MEMORY_DEBUG)