31727 Commits

Author SHA1 Message Date
Gilles Peskine
36571d6d8a Change "realfull" to activate everything
Change "realfull" to activate everything. After investigation, it seems that
having "realfull" not activate everything was a historical oddity due to
proximity with "full", not a goal in itself.

https://github.com/Mbed-TLS/mbedtls/issues/520#issuecomment-727190862
https://github.com/Mbed-TLS/mbedtls/pull/965/files#r523409092

This changes the output of `scripts/config.py realfull`: now all non-boolean
options are uncommented.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-23 15:44:46 +02:00
Gilles Peskine
e4c6955e43 Change "full" to affect boolean settings rather than use sections
To get rid on the reliance on sections, change "full" and friends to enable
settings based on whether the setting is boolean, rather than based on the
section it contains.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-23 15:44:46 +02:00
Gilles Peskine
702d75a2f9 Pass the setting's value to adapters
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-23 15:44:33 +02:00
Ronald Cron
8904570b31
Merge pull request #9470 from gabor-mezei-arm/9325_move_config.py_to_framework
Move `config.py` functionalities to the framework
2024-09-20 16:07:09 +00:00
David Horstmann
bae154d76c
Merge pull request #9385 from eleuzi01/replace-ecdsa-some
Replace MBEDTLS_PK_HAVE_ECDSA* with PSA_WANT counterparts
2024-09-19 13:53:18 +00:00
Gabor Mezei
a941e14b4c
Update framework
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:15 +02:00
Gabor Mezei
cd326bfc49
Apply the parameter change
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:15 +02:00
Gabor Mezei
317a2a3fed
Fix documentation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:14 +02:00
Gabor Mezei
568808a41a
Update member variable names
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:14 +02:00
Gabor Mezei
f5f130879c
Fix documentation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:14 +02:00
Gabor Mezei
0e9e4cbbd8
Move commonly used part to config_common
Move the Setting, Config, ConfigFile and ConfigTool classes to config_common.
Also update the referencies to the moved classes.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:14 +02:00
Gabor Mezei
a12ed6bcb7
Unify spacing
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:14 +02:00
Gabor Mezei
24d7cc71af
Create a class for command line config manipulation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:14 +02:00
Gabor Mezei
776ee9068d
Fix header file detection
Make the include directory check relative to the source file in case not called
from the project root.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:14 +02:00
Gabor Mezei
d53080da2a
Make the Config a proper base class
Due to the forward declaration issues, move the common descendant functions
and configfile handling to the `Config` base class.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:14 +02:00
Gabor Mezei
daf807f02d
Fix pylint issues
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:13 +02:00
Gabor Mezei
c659c1b164
Move config file modification flag handling to the Config class
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:13 +02:00
Gabor Mezei
9f2b817fa7
Update documentation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-09-19 10:47:08 +02:00
Tom Cosgrove
b80516816d
Merge pull request #9536 from mpg/rsapub-perf-dev
[dev] Rsapub performance fix
2024-09-18 14:20:50 +00:00
Gilles Peskine
de4d5b7855
Merge pull request #9497 from minosgalanakis/bugfix/return_early_in_ccm_star
ccm.c: Return early when ccm* is used without tag.
2024-09-13 09:35:18 +00:00
Gilles Peskine
e16aecc8dd
Merge pull request #9556 from gilles-peskine-arm/ssl-opt-psk-detection-development
ssl-opt: improve PSK mode detection
2024-09-13 09:35:04 +00:00
Gilles Peskine
e3eab32600 requires_certificate_authentication: prioritize TLS 1.3
When checking whether the build supports certificate authentication, check
the key exchange modes enabled in the default protocol version. This is TLS
1.3 when it's enabled.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
6e85e35fcc Documentation improvements
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
2dd4395da0 Fix detection of TLS 1.2 PSK-ephemeral key exchange modes
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
7f453bfad4 Improve some comments
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
78df617362 Remove unused auth_mode parameter on a PSK test case
It was causing the test case to be incorrectly skipped as needing
certificate authentication.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
cd4fe70fe2 Fix weirdly quoted invocations of requires_any_configs_enabled
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
db26406934 Also activate PSK-only mode when PSK-ephemeral key exchanges are available
The point of PSK-only mode is to transform certificate-based command lines
into PSK-based command lines, when the certificates are not relevant to what
is being tested. So it makes sense to do that in with PSK-ephemeral key
exchanges too.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
9d3b2079a5 Unify the two requires-key-exchange-with-certificate function
requires_certificate_authentication was called in more places, but did not
do fine-grained analysis of key exchanges and so gave the wrong results in
some builds.

requires_key_exchange_with_cert_in_tls12_or_tls13_enabled gave the correct
result but was only used in some test cases, not in the automatic detection
code.

Remove all uses of requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
because they are in fact covered by automated detection that calls
requires_certificate_authentication.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
24b4303ddd Detect PSK-only mode in TLS 1.3 as well
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
4f0986487d Fix PSK-only mode doing less than it should
Don't add a certificate requirement when PSK is enabled.

Do command line requirement detection after the injection of PSK into the
command line in PSK-only mode. Otherwise certificate requirements would be
added even in PSK-only mode.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
ae3dc17e50 Detect more cases where certificates are required
When requiring a cryptographic mechanism for the sake of certificate
authentication, also require that certificate authentication is enabled.

Setting auth_mode explicitly means that we're testing something related to
how certificate-based authentication is handled, so require a key exchange
with certificate-based authentication.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
6f9952abfc ssl-opt: Fix GnuTLS PSK injection
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:33 +02:00
Gilles Peskine
9404169146 Use CONFIGS_ENABLED instead of repeatedly calling query_compile_time_config
It's faster and more readable.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:01 +02:00
Gilles Peskine
56ee69de5b Fix "Renegotiation: openssl server, client-initiated" with OpenSSL 3
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:01 +02:00
Elena Uziunaite
ffce45c19f Add missing ALG_SHA_1
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-12 14:58:52 +01:00
Ronald Cron
a45ba05e35
Merge pull request #9549 from ronald-cron-arm/adapt-components
Adapt some all.sh components to MBEDTLS_PSA_CRYPTO_CONFIG always on
2024-09-12 12:00:39 +00:00
Paul Elliott
2f620f3127
Merge pull request #9561 from gilles-peskine-arm/cmake-underscore_D
Fix typo that caused cpp_dummy_build not to be built with CMake
2024-09-12 11:40:46 +00:00
Ronald Cron
5f71537fdd
Merge pull request #9552 from ronald-cron-arm/project-and-branches-detection
Projects and 3.6 branch detections
2024-09-12 11:06:13 +00:00
Paul Elliott
8ea8b30941
Merge pull request #8988 from billatarm/add-pc-files
tests: add a test for pkg-config files
2024-09-11 21:14:46 +00:00
Bill Roberts
10ff4174f4
tests: add a test for pkg-config files
Add a test that does some basic validation of the pkg-config files.

Example run:
./tests/scripts/all.sh test_cmake_as_package
<snip>
******************************************************************
* test_cmake_as_package: build: cmake 'as-package' build
* Wed Sep 11 16:17:41 UTC 2024
******************************************************************
cmake .
make
Built against Mbed TLS 3.6.0
testing package config file: mbedtls ... passed
testing package config file: mbedx509 ... passed
testing package config file: mbedcrypto ... passed
make clean

Signed-off-by: Bill Roberts <bill.roberts@arm.com>
2024-09-11 09:19:42 -07:00
Gilles Peskine
236e05d758 Fix typo that caused cpp_dummy_build not to be built with CMake
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-11 17:51:45 +02:00
Ronald Cron
4153ebb55d Fix comments
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-09-11 15:32:48 +02:00
Ronald Cron
25012e5f81 Update framework to the merge of #45
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-09-11 14:55:06 +02:00
Ronald Cron
22eb209c3a Update framework
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-09-11 09:41:31 +02:00
David Horstmann
7ba04a298c Bump version to 4.0.0
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-09-10 10:43:14 +02:00
Ronald Cron
932878137a Use scripts/project_name.txt in Python scripts
Use scripts/project_name.txt in Python scripts
to detect between Mbed TLS and TF-PSA-Crypto
project.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-09-10 10:43:02 +02:00
Elena Uziunaite
9c6476461f Remove definitions of MBEDTLS_PK_CAN/HAVE_ECDSA*
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-09 11:18:10 +01:00
Elena Uziunaite
b430eeea85 Bring back some dependencies
To make CI happier

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-09 11:18:10 +01:00
Elena Uziunaite
91d8386a42 Enable USE_PSA_CRYPTO
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-09 11:18:10 +01:00