32007 Commits

Author SHA1 Message Date
Gilles Peskine
43b4264cd8 Enable MBEDTLS_USE_PSA_CRYPTO by default
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-22 22:10:42 +02:00
Gilles Peskine
8fd2117360 Remove !MBEDTLS_USE_PSA_CRYPTO test cases that have a USE_PSA alternate
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-22 22:10:42 +02:00
Gilles Peskine
fef912c30b Test partial ECC creation support: switch to MBEDTLS_USE_PSA_CRYPTO
With PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE disabled, test TLS 1.3 and
USE_PSA TLS 1.2.

With PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE disabled, just test crypto,
because the TLS code needs that to generate ephemeral ECDH keys but this is
not tracked properly (the ephemeral ECDH code is only gated on having ECDH).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-22 22:10:42 +02:00
David Horstmann
f0abbb4f1a
Merge pull request #9711 from ThePassionate/mbedtls-1021
net/mbedtls_net_connect: Preventing double close problem
2024-10-22 16:49:25 +00:00
Manuel Pégourié-Gonnard
6b644938d2
Merge pull request #9657 from mpg/refactor-all.sh-dev
Refactor all.sh
2024-10-22 13:33:45 +00:00
Ronald Cron
7917074649
Merge pull request #9292 from gabor-mezei-arm/9140_depends-py_use_psa
Support the crypto_config.h usage in depends.py
2024-10-22 11:44:44 +00:00
David Horstmann
a40e95fda0 Add newline to ChangeLog entry
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-10-22 12:22:47 +01:00
Gabor Mezei
6a986d9122
Update coverage datebase
With the `depend.py` using the crypto config the `PBKDF2_HMAC` can be
enabled so thest cases can be run.

The equivalence (synonym) between `PSA_WANT_ALG_RSA_PSS_ANY_SALT` and
`PSA_WANT_ALG_RSA_PSS` is now done properly, the test can be run.

Dependencies for `MBEDTLS_CIPHER_PADDING_PKCS7' has been updated and
now it can be actually disabled.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-22 10:43:03 +02:00
makejian
9606d560a7 net/mbedtls_net_connect: Preventing double close problem
In the test examples and real usage scenarios, 'mbedtls_net_free' is called after 'mbedtls_net_connect' fails, which will cause the problem of double close the same fd. It is possible to close this closed fd which has been applied by other link.

Signed-off-by: makejian <makejian@xiaomi.com>
2024-10-22 14:06:41 +08:00
Gabor Mezei
b8a20676a3
Update framework
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:28:11 +02:00
Gabor Mezei
4fef797450
Update macro dependencies
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:27:23 +02:00
Gabor Mezei
f10402c028
Update macro dependencies
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:27:22 +02:00
Gabor Mezei
c9f01cf8b5
Use f-string instead of concatenation
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:27:22 +02:00
Gabor Mezei
224152eec0
Remove unneeded newlines
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:27:22 +02:00
Gabor Mezei
fb06101b9f
Fix recursive dependencies for cross referencing
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:27:22 +02:00
Gabor Mezei
4e10d6c21d
Add consistency check for option avalability
The PSA and MbedTLS options can switch the same functionality separately
so add a check to ensure the cpnsistency.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:26:52 +02:00
Gabor Mezei
8f94485166
Fix dependency
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:26:52 +02:00
Gabor Mezei
610e6e2aea
Add PSA macro dependencies
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:26:52 +02:00
Gabor Mezei
8ec990bc45
Apply config dependecies recursively
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:26:52 +02:00
Gabor Mezei
9ce6d244f1
Remove depends.py option to use without PSA
Also removed test which uses this option.

Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:26:52 +02:00
Gabor Mezei
035d7c8cfa
Move file backup support to config_common.py
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:26:52 +02:00
Gabor Mezei
f5408f0909
Enable usage of crypto config in depends.py
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-10-21 14:26:52 +02:00
Gilles Peskine
6707584614
Merge pull request #9593 from gilles-peskine-arm/test-cases-not-executed-enforce-development
Test cases not executed: switch to enforcement mode
2024-10-18 18:19:34 +00:00
Manuel Pégourié-Gonnard
fd4f2831d7 Fix a typo in a comment
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-10-18 09:58:11 +02:00
Gilles Peskine
f5025e2680 Merge remote-tracking branch 'development' into test-cases-not-executed-enforce-development
Conflicts:
* framework: update to the head of 'main'.
2024-10-17 21:20:01 +02:00
David Horstmann
13d2939563
Merge pull request #9673 from eleuzi01/issue-54-fw
Move TLS auxiliary test scripts to the framework
2024-10-17 17:15:46 +00:00
Manuel Pégourié-Gonnard
dea880f035 all.sh: fix missing quotes
Without quotes, when the variable is empty, the shell will see three
tokens: [, -n, ]. After skipping ] as usual, it will see a single token,
so it will consider it not as command, but a string to be tested for "is
it empty", and since "-n" is not empty, the command will return true.

With quotes it see 4 tokens: [, -n, <empty string>, ] and interprets -n
as desired.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-10-17 09:21:19 +02:00
Gilles Peskine
86421f3e87 Update framework to main
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-16 19:34:30 +02:00
Gilles Peskine
e1f37c58a2
Merge pull request #9566 from gilles-peskine-arm/error-codes-4.0-enforce-add-macro
Error codes: enforce add macro
2024-10-16 17:28:04 +00:00
Elena Uziunaite
8b6ee19890 Update submodule after the merge
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-10-16 14:59:32 +01:00
Gilles Peskine
4e4647a4e7
Merge pull request #9690 from valeriosetti/fix-pk-write-buffer-overrun
pkwrite: fix buffer overrun
2024-10-16 12:00:52 +00:00
Ronald Cron
51287b3be5
Merge pull request #9700 from ronald-cron-arm/test-psa-crypto-drivers
Enable PSA_CRYPTO_CONFIG in test_psa_crypto_drivers
2024-10-16 11:29:20 +00:00
Gilles Peskine
5255a9e805 Include "error.h" for MBEDTLS_ERROR_ADD
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-16 11:52:47 +02:00
Gilles Peskine
8085f51108 Use MBEDTLS_ERROR_ADD instead of explicit addition: enforcement
Reject direct additions of error constants (regex-based approximation).

Fix the lone straggler.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-16 11:52:27 +02:00
Gilles Peskine
ed6feae513 Use MBEDTLS_ERROR_ADD instead of explicit addition: simple cases
Replace obvious additions of an `MBEDTLS_ERR_xxx` constant by a call to
`MBEDTLS_ERROR_ADD`.

Skip `case` statements since `MBEDTLS_ERROR_ADD(pp_constant)` is not a
preprocessor constant.

This commit does not replace additions split over lines. Those will be
handled in a subsequent commit.

```
git ls-files '*.h' '*.c' '*.function' '*.data' |
xargs perl -i -pe '
    next if /\bcase\b/;
    s/\b(MBEDTLS_ERR_\w+)\s*\+\s*(\w+)\b/MBEDTLS_ERROR_ADD($1, $2)/g;
    s/\b(\w+)\s*\+\s*(MBEDTLS_ERR_\w+)\b/MBEDTLS_ERROR_ADD($1, $2)/g'
```

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-16 11:52:24 +02:00
Manuel Pégourié-Gonnard
6c0b4e73c0 all.sh: adjust for when tf-psa-crypto is absent
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-10-16 10:50:43 +02:00
Manuel Pégourié-Gonnard
f48d4edd0c all.sh: re-instate 3.6-specific code
This aligns development and 3.6 in preparation for moving to the
framework repo.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-10-16 10:50:15 +02:00
Gilles Peskine
50d7579dd1 Temporarily comment out tests that are clogging the CI
The pk_write_pubkey_check sometimes take ~3 hours to run with
GCC+Asan on the CI in the full config. Comment out the slowest
ones while we investigate and release 3.6.2.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-16 10:48:56 +02:00
Ronald Cron
ede04b34d1 Remove unnecessary -O2 compilation flag
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-10-16 10:47:15 +02:00
Ronald Cron
6197cdf869 Fix comment
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-10-16 10:45:38 +02:00
Gilles Peskine
c76f82db27 Work around GCC 5 performance problem with Asan+UBSan and -O3
Old GCC versions hit a performance problem with test_suite_pkwrite
"Private keey write check EC" tests when building with Asan+UBSan
and -O3: those tests take more than 100x time than normal, with
test_suite_pkwrite taking >3h on the CI. Observed with GCC 5.4 on
Ubuntu 16.04 x86_64 and GCC 6.5 on Ubuntu 18.04 x86_64.
GCC 7.5 and above on Ubuntu 18.04 appear fine.

To avoid the performance problem, use -O2 instead of -O3 in then "Asan"
build type with GCC. It doesn't slow down much even with modern compiler
versions.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-16 10:31:29 +02:00
Gilles Peskine
604e4d99dd Fix completion mistake in changelog entry
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-16 10:31:28 +02:00
David Horstmann
a4415d992a Defer static keystore to 3.6.3
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-10-16 10:30:33 +02:00
Gilles Peskine
e298eeb739 Changelog entry for security fix
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-10-16 10:30:30 +02:00
Ronald Cron
360928af9d Pacify check_names.py
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-10-15 17:09:36 +02:00
Ronald Cron
a0afbfb2a4 Fix/Add documentation
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-10-15 17:09:36 +02:00
Ronald Cron
67cc6a73aa Use config_adjust_test_accelerators.h
Use config_adjust_test_accelerators.h
to adjust the configuration needed for
test_psa_crypto_drivers all.sh component
with PSA_CRYPTO_CONFIG enabled.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-10-15 17:09:36 +02:00
Ronald Cron
1520875247 config_adjust_test_accelerators.h: Error out if wrong usage
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-10-15 17:09:36 +02:00
Ronald Cron
e8a9258ff0 config_adjust_test_accelerators.h: Do not define PSA_CRYPTO_DRIVER_TEST
PSA_CRYPTO_DRIVER_TEST needs to be defined
upper in build_info.h sequence of definitions/
inclusions.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-10-15 17:09:36 +02:00
Ronald Cron
2b36f5f5ab config_adjust_test_accelerators.h: Do not error if PSA_CRYPTO_CONFIG is ON
That's the purpose of the changes, to have
PSA_CRYPTO_CONFIG enabled.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-10-15 17:09:36 +02:00