1984 Commits

Author SHA1 Message Date
Gilles Peskine
d3268834f3 Document what the SSL async sign callback needs to do with RSA
Document how the SSL async sign callback must treat its md_alg and
hash parameters when doing an RSA signature: sign-the-hash if md_alg
is nonzero (TLS 1.2), and sign-the-digestinfo if md_alg is zero
(TLS <= 1.1).

In ssl_server2, don't use md_alg=MBEDTLS_MD_NONE to indicate that
ssl_async_resume must perform an encryption, because md_alg is also
MBEDTLS_MD_NONE in TLS <= 1.1. Add a test case to exercise this
case (signature with MBEDTLS_MD_NONE).
2018-04-26 10:00:40 +02:00
Gilles Peskine
ad28bf0e58 Documentation improvements 2018-04-26 10:00:40 +02:00
Gilles Peskine
168dae8567 Comment formatting and whitespace fixes 2018-04-26 10:00:40 +02:00
Gilles Peskine
b74a1c73b1 Rename MBEDTLS_SSL_ASYNC_PRIVATE_C to MBEDTLS_SSL_ASYNC_PRIVATE
This is an optional feature, not a module of its own, so don't call it
MBEDTLS_xxx_C and put it in the appropriate section of config.h.
2018-04-26 10:00:39 +02:00
Gilles Peskine
b44692f126 Merge branch 'mbedtls_ssl_get_key_exchange_md_ssl_tls-return_hashlen' into tls_async_server-2.9
Conflict resolution:
* ChangeLog: put the new entry from my branch in the proper place.
* include/mbedtls/error.h: counted high-level module error codes again.
* include/mbedtls/ssl.h: picked different numeric codes for the
  concurrently added errors; made the new error a full sentence per
  current standards.
* library/error.c: ran scripts/generate_errors.pl.
* library/ssl_srv.c:
    * ssl_prepare_server_key_exchange "DHE key exchanges": the conflict
      was due to style corrections in development
      (4cb1f4d49cff999d0c853bc696ad7eea68888c35) which I merged with
      my refactoring.
    * ssl_prepare_server_key_exchange "For key exchanges involving the
      server signing", first case, variable declarations: merged line
      by line:
        * dig_signed_len: added in async
        * signature_len: removed in async
        * hashlen: type changed to size_t in development
        * hash: size changed to MBEDTLS_MD_MAX_SIZE in async
        * ret: added in async
    * ssl_prepare_server_key_exchange "For key exchanges involving the
      server signing", first cae comment: the conflict was due to style
      corrections in development (4cb1f4d49cff999d0c853bc696ad7eea68888c35)
      which I merged with my comment changes made as part of refactoring
      the function.
    * ssl_prepare_server_key_exchange "Compute the hash to be signed" if
      `md_alg != MBEDTLS_MD_NONE`: conflict between
      ebd652fe2dfc2c82d774bfd334398279d9027492
      "ssl_write_server_key_exchange: calculate hashlen explicitly" and
      46f5a3e9b4d5db3cacfe2ba33480a27317c62d46 "Check return codes from
      MD in ssl code". I took the code from commit
      ca1d74290439ec9e2723a911657fd96aa320e219 made on top of development
      which makes mbedtls_ssl_get_key_exchange_md_ssl_tls return the
      hash length.
* programs/ssl/ssl_server2.c: multiple conflicts between the introduction
  of MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS and new auxiliary functions and
  definitions for async support, and the introduction of idle().
    * definitions before main: concurrent additions, kept both.
    * main, just after `handshake:`: in the loop around
      mbedtls_ssl_handshake(), merge the addition of support for
      MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS and SSL_ASYNC_INJECT_ERROR_CANCEL
      with the addition of the idle() call.
    * main, if `opt.transport == MBEDTLS_SSL_TRANSPORT_STREAM`: take the
      code from development and add a check for
      MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS.
    * main, loop around mbedtls_ssl_read() in the datagram case:
      take the code from development and add a check for
      MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS; revert to a do...while loop.
    * main, loop around mbedtls_ssl_write() in the datagram case:
      take the code from development and add a check for
      MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS; revert to a do...while loop.
2018-04-26 10:00:27 +02:00
Jaeden Amero
38c42d5afa Merge remote-tracking branch 'upstream-public/pr/1570' into development-proposed
Resolve merge conflict in ChangeLog.
2018-04-25 14:20:08 +01:00
Andres Amaya Garcia
708c5cb6ab mbedtls_zeroize -> mbedtls_platform_zeroize in docs 2018-04-24 08:33:31 -05:00
Gilles Peskine
fcca9d8cef SSL asynchronous decryption (server side): tests
Test SSL asynchronous private operation for the case of a
decryption operation on a server.
2018-04-24 09:36:37 +02:00
Gilles Peskine
d9bfcabcb9 SSL asynchronous signature: fix renegotiation tests
Fixed typo in "SSL async private: renegotiation" tests that caused the
renegotiation not to actually take place.
2018-04-24 09:36:36 +02:00
Gilles Peskine
dbb14e09f2 all.sh: run ssl-opt.sh on ECJPAKE, SSL async
Run ssl-opt.sh in the "full" configuration on things that are not in
the default configuration: SSL async private, ECJPAKE.
2018-04-24 09:36:36 +02:00
Gilles Peskine
60ee4cadce SSL asynchronous signature: basic test of recovery after error
Add test cases where the server goes through an async operation which
fails, then the server makes a successful connection.
2018-04-24 09:36:36 +02:00
Gilles Peskine
3665f1db9d SSL asynchronous signature: test cases
Add test cases for SSL asynchronous signature to ssl-opt.sh:

* Delay=0,1 to test the sequences of calls to f_async_resume
* Test fallback when the async callbacks don't support that key
* Test error injection at each stage
* Test renegotiation
2018-04-24 09:36:36 +02:00
Andrzej Kurek
f13ca9536c Test suites: print error on failed platform_setup
Return encountered errors instead of covering them
Fix return value on the broken snprintf implementation
2018-04-18 04:14:31 -04:00
Andres Amaya Garcia
eecea0e281 Update zeroize test to use mbedtls_platform_zeroize() 2018-04-17 10:14:53 -05:00
Andres Amaya Garcia
757cd72edf Update license headers year and branding 2018-04-17 09:21:49 -05:00
Andres Amaya Garcia
42defd10a6 Improve docs for zeroize.c and test_zeroize.gdb 2018-04-17 09:21:49 -05:00
Andres Amaya Garcia
806f403a02 Improve detection of program exit code in gdb script 2018-04-17 09:19:05 -05:00
Andres Amaya Garcia
7111a0d13b Change test_zeroize.gdb script breakpoint due to zeroize.c change 2018-04-17 09:19:05 -05:00
Andres Amaya Garcia
2967381ccd Extend zeroize tests to multiple optimizations
Extend the all.sh test to cover multiple compiler optimization levels.
At the momment, the test is run using gcc and clang.
2018-04-17 09:19:05 -05:00
Andres Amaya Garcia
24768bfa37 Improve test_zeroize.gdb breakpoint
Improve the position of the breakpoint to be set at a line of code that
is less likely to be optimised out by the compiler. Setting the breakpoint
at a place that can be easily optimised out by the compiler will cause the
gdb script to fail as it cannot match the source code line to the
compiled code. For this reason the breakpoint is now set at the fclose()
call which is very unlikely to be optimised out or there might be a
resource leak.
2018-04-17 09:19:05 -05:00
Andres Amaya Garcia
d0d7bf614e Add gdb zeroize test when compiling with clang 2018-04-17 09:17:38 -05:00
Andres Amaya Garcia
f2d17929c0 Document test_zeroize.gdb script 2018-04-17 09:17:38 -05:00
Andres Amaya Garcia
ddebc49f28 Add gdb script to test mbedtls_zeroize()
The gdb script loads the programs/test/zeroize program and feeds it as
imput its own source code. Then sets a breakpoint just before the last
program's return code and checks that every element in memory was
zeroized. Otherwise it signals a failure and terminates.

The test was added to all.sh.
2018-04-17 09:17:38 -05:00
Andrzej Kurek
a282270a10 Add explicit checks for non-zero result of platform setup in test suites 2018-04-16 06:33:28 -04:00
Andrzej Kurek
32a675f032 Add conditional platform context creation & usage
Add another layer of abstraction before calling platform setup and teardown.
2018-04-13 06:16:04 -04:00
Andrzej Kurek
1152fa83f9 Add platform setup and teardown calls to test suites
Add a global platform context variable available for tests
2018-04-13 05:15:17 -04:00
Andres AG
c4ec716ec8 Fix uninitialized var in check-generated-files.sh 2018-04-11 21:13:20 -05:00
Andres Amaya Garcia
4c1e2ec286 Check generated-visualc-files in check-generated-files 2018-04-11 20:52:30 -05:00
Jethro Beekman
666892792d Generate primes according to FIPS 186-4
The specification requires that numbers are the raw entropy (except for odd/
even) and at least 2^(nbits-0.5). If not, new random bits need to be used for
the next number. Similarly, if the number is not prime new random bits need to
be used.
2018-04-11 08:38:37 -07:00
fbrosson
533407a266 Use "#!/usr/bin/env perl" as shebang line. 2018-04-04 21:44:29 +00:00
Gilles Peskine
80aa3b8d65 Merge branch 'pr_946' into development-proposed 2018-04-04 10:33:45 +02:00
Gilles Peskine
5c77f2ef37 Merge remote-tracking branch 'upstream-public/pr/1535' into development-proposed 2018-04-04 10:31:09 +02:00
Gilles Peskine
be2371c3d9 Merge branch 'pr_348' into development-proposed 2018-04-04 09:18:27 +02:00
Gilles Peskine
0ed632f445 Merge remote-tracking branch 'upstream-public/pr/1499' into development-proposed 2018-04-01 12:41:22 +02:00
Gilles Peskine
695d557dcf Merge branch 'pr_1180' into development-proposed 2018-04-01 12:26:36 +02:00
Nicholas Wilson
08f3ef1861 Basic support for Curve448, similar to the current level of support for Curve25519 2018-03-29 14:29:06 +01:00
Azim Khan
19d1373bb9 Enable SSL test scripts to dump logs on stdout 2018-03-29 11:10:57 +01:00
Jaeden Amero
78a03ec230 Merge remote-tracking branch 'upstream-public/pr/1379' into development-proposed 2018-03-29 10:57:57 +01:00
Jaeden Amero
2843d21d99 Merge remote-tracking branch 'upstream-public/pr/1523' into development-proposed 2018-03-28 15:32:13 +01:00
Hanno Becker
2bd57578af Merge branch 'development' into iotssl-1204 2018-03-28 14:52:35 +01:00
Jaeden Amero
9528658446 Merge remote-tracking branch 'upstream-public/pr/701' into development-proposed
Fixes #1299, fixes #1475
2018-03-28 12:50:28 +01:00
Jaeden Amero
8645e90825 Merge remote-tracking branch 'upstream-restricted/pr/363' into development-proposed 2018-03-28 11:54:28 +01:00
Jethro Beekman
6c563fa7cd Add tests for "return plaintext data faster on unpadded decryption" 2018-03-27 19:25:35 -07:00
Andres Amaya Garcia
576d474704 Fix test dependencies of pkcs5 pbs2 on asn1 parse 2018-03-27 20:53:56 +01:00
Andres Amaya Garcia
79db933fb6 Fix shared library lookup on Mac OS X when running tests 2018-03-27 19:58:08 +01:00
Andres Amaya Garcia
420f0ccdfd Make DLEXT var configurable in programs and tests makefiles 2018-03-27 19:17:21 +01:00
Hanno Becker
98a678674b Adapt changes to all.sh to work with --keep-going mode 2018-03-27 17:10:09 +01:00
Hanno Becker
783cb06e05 Remove duplicate test in all.sh 2018-03-27 16:49:04 +01:00
Deomid Ryabkov
de420a47b6 Fix some test deps
* Cert revocation tests require `MBEDTLS_HAVE_TIME_DATE`.
 * Verison features tests require... well, `MBEDTLS_VERSION_FEATURES`, actually.

Fixes https://github.com/ARMmbed/mbedtls/issues/1475
2018-03-27 14:39:26 +01:00
Gilles Peskine
1cfa2d0e19 Add missing dependencies in test_suite_x509parse
Found by depends-hashes.pl and depends-pkgalgs.pl.
2018-03-23 02:16:43 +01:00