2747 Commits

Author SHA1 Message Date
Gilles Peskine
72da8b3521 Don't authorize private access to fields where not actually needed
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-22 12:07:29 +01:00
Gilles Peskine
abf0be392a fuzz_dtlsserver: explicitly note the one access to a private field
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-22 12:07:09 +01:00
Gilles Peskine
d5f68976e8 fuzz_pubkey, fuzz_privkey: no real need to access private fields
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-22 12:05:35 +01:00
Gilles Peskine
7a3059ac92 Benchmark: not using private fields anymore
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-22 10:53:31 +01:00
Gilles Peskine
984352d6f1 Benchmark: remove the legacy-context ECDH block
We have two blocks of code to benchmark ECDH. One uses the legacy context
structure, which is only enabled when MBEDTLS_ECP_RESTARTABLE is enabled.
That block doesn't convey any information that's specific to restartable
ECC, it exists only for historical reasons (it came first). The other block
uses only the implementation-agnostic API.

Remove the block that uses the legacy context. It doesn't provide much
extra information and most users won't even see it.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-22 10:50:12 +01:00
Ronald Cron
0aead12706 ssl_client2: Improve loop writing early data
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-21 17:37:33 +01:00
Ronald Cron
b4fd47e897 ssl_client2: Default to library default for early data enablement
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-21 17:37:33 +01:00
Manuel Pégourié-Gonnard
0ecb5fd6f5
Merge pull request #8574 from ronald-cron-arm/ssl-tickets
Fix and align ticket age check in ssl_ticket.c for TLS 1.2 and TLS 1.3
2024-02-21 09:38:46 +00:00
Janos Follath
028a38b7cb
Merge pull request #8661 from BensonLiou/use_init_api
use mbedtls_ssl_session_init() to init session variable
2024-02-19 15:49:34 +00:00
Paul Elliott
60bbfe63a1 Add metatests for failing TEST_EQUAL and TEST_LE_*
After getting caught with deadlock issues when these tests fail, add a
metatest to test them failing.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-02-14 14:55:04 +00:00
Gilles Peskine
3ea9450463
Merge pull request #8734 from valeriosetti/issue8564
Add test for driver-only HMAC
2024-02-14 13:43:40 +00:00
PiotrBzdrega
f6a9cfa5d2 adjust indentation
Signed-off-by: PiotrBzdrega <piotrbzdrega@yandex.com>
2024-02-11 09:41:56 +01:00
PiotrBzdrega
2b20ff62fc move entropy init prior arguments number recognition
Signed-off-by: PiotrBzdrega <piotrbzdrega@yandex.com>
2024-02-11 02:15:03 +01:00
Manuel Pégourié-Gonnard
c3d17cde46
Merge pull request #8702 from minosgalanakis/update/dhm_context_in_programs_5015
[MBEDTLS_PRIVATE] Update dhm context in programs
2024-02-10 08:47:51 +00:00
Paul Elliott
54ad01efed Merge remote-tracking branch 'upstream/development' into make_tests_thread_safe 2024-02-09 14:33:58 +00:00
Janos Follath
7a28738205
Merge pull request #8636 from paul-elliott-arm/new_test_thread_interface
New test thread interface
2024-02-08 12:35:40 +00:00
Manuel Pégourié-Gonnard
1d7bc1ecdf
Merge pull request #8717 from valeriosetti/issue8030
PSA FFDH: feature macros for parameters
2024-02-07 10:06:03 +00:00
Ronald Cron
a5561893e7 ssl_client2: Add support for early data writing
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-07 08:06:46 +01:00
Ronald Cron
2fe0ec8c31 ssl_client2: Add buffer overflow check
Add buffer overflow check to build_http_request().

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-07 08:06:46 +01:00
Ronald Cron
ccfaefa361 ssl_client2: Switch from int to size_t
Switch from int to size_t for some
data lengths and counter local
variables.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-07 08:06:46 +01:00
Ronald Cron
4e1bd470fb ssl_client2: Move code to build http request
Move code to build http request into a
dedicated function.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-07 08:06:46 +01:00
Ronald Cron
54a3829453 ssl_client2: Simplify early_data option
No need to define specific early data,
the idea is rather to just send the
usual request data as early data
instead of standard application data.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-07 08:06:46 +01:00
Jerry Yu
192e0f9b1d ssl_server2: Add read early data support
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-02-01 16:40:47 +01:00
Minos Galanakis
8ee1b5f46e programs_benchmark: Updated to use mbedtls_dhm_read_public().
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-26 15:00:13 +00:00
Minos Galanakis
97489dc7e5 programs_benchmark: Updated to use mbedtls_dhm_set_group() & mbedtls_dhm_get_len()
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-26 15:00:13 +00:00
Minos Galanakis
e29c868ca4 programs_dh_server: Updated to use mbedtls_dhm_set_group() & mbedtls_dhm_get_len().
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-26 15:00:13 +00:00
Dave Rodgman
047c724c22 Merge remote-tracking branch 'restricted/development-restricted' into update-development-r
Conflicts:
	programs/Makefile
	tests/scripts/check-generated-files.sh
2024-01-26 12:42:51 +00:00
Paul Elliott
0c847bcbe7 Fix Make issues with Everest enabled
Apply Gilles suggestion to fix the problem with make on the CI when everest is enabled, i.e. use $(THIRDPARTY_DIR) instead of a fuzz specific hack involving $(THIRDPARTY_INCLUDES)

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-01-24 19:08:31 +00:00
Paul Elliott
7fd162ec26 Refactor common PThreads CMake code
Move the flags and find of Threads to root CMakeLists.txt, rather
than duplicate these everywhere. Make explicit linking of library with
PThreads use the same mechanism.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-01-24 18:05:53 +00:00
David Horstmann
9c5c9c351d
Merge pull request #1141 from davidhorstmann-arm/memory-poisoning-runtime-enable
Enable and disable memory poisoning at runtime
2024-01-24 14:46:43 +00:00
Valerio Setti
e35117640d cert_[req/write]: add MD_C dependency
Both programs use mbedtls_md_info_from_string() which is only
available as long as MBEDTLS_MD_C is enabled.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-01-22 16:28:23 +01:00
Paul Elliott
a8f6192f9a Remove unneeded lines from fuzz/Makefile
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-01-19 16:41:05 +00:00
Paul Elliott
85ea3e623b Set preferences before finding Threads in CMake
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-01-19 15:57:22 +00:00
Minos Galanakis
42151380af programs_dh_client/server: Updated config guards.
Adjusted to use `MBEDTLS_SHA256_C` instead of `MBEDTLS_MD_CAN_SHA256`
since the former is being used in accelerated driver configurations.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-19 14:39:41 +00:00
Minos Galanakis
db8915287e programs_dh_client/server: Changed mdlen type to unsigned integer.
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-19 14:38:51 +00:00
Minos Galanakis
7c8448842d programs_dh_client/server: Updated to query digest size using mbedtls_md_info_from_type().
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-18 14:29:41 +00:00
Minos Galanakis
6e92df12c2 programs_rsa_rsa_verify: Updated program to use mbedtls_rsa_get_len()
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-18 14:29:41 +00:00
Minos Galanakis
992f0b8427 programs_rsa_rsa_sign: Updated program to use mbedtls_rsa_get_len()
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-18 14:29:41 +00:00
Minos Galanakis
ee757d35df programs_rsa_encrypt/decrypt: Updated programs to use mbedtls_rsa_get_len()
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-18 14:29:41 +00:00
Minos Galanakis
b6a96195fb programs_dh_client/server: Updated programs to use mbedtls_rsa_get_len()
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-18 14:29:41 +00:00
Minos Galanakis
f4dfd1c8a5 programs/dh_client/server: Added entropy source to mbedtls_rsa_pkcs1_sign()
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-18 14:29:41 +00:00
Minos Galanakis
a184fd0516 programs/dh_client/server: Replaced mbedtls_sha1 with mbedtls_sha256
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2024-01-18 14:29:41 +00:00
Gilles Peskine
b1f96c0354
Merge pull request #7815 from gilles-peskine-arm/ecp-export-partial
ECP keypair utility functions
2024-01-18 10:29:05 +00:00
Valerio Setti
e8683ce9ef ssl_test_lib: add guards for enabled DH groups
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-01-17 15:56:30 +01:00
David Horstmann
9de6edd462 Separate memory poisoning tests from generic ASan
Some platforms may support ASan but be C99-only (no C11 support).
These platforms will support ASan metatests but not memory poisoning,
which requires C11 features.

To allow for this, create a separate platform requirement, "poison",
in metatest.c to distinguish generic ASan metatests from ones that
require suppport for memory poisoning.

In practice our platforms support both, so run "poison" tests in
the same all.sh components where we run "asan" ones.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-01-17 14:53:08 +00:00
David Horstmann
c2ab398d01 Request C11 in CMake (but only for tests)
Set the C_STANDARD property on the mbedtls_test target to 11.
This requests C11 for the tests only.

If C11 is not supported the build will not fail, since
C_STANDARD_REQUIRED is not set, and memory poisoning will be disabled
by a preprocessor check on __STDC_VERSION__.

Additionally, reintroduce previous C99 enforcement on the rest of the
library.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-01-17 14:02:40 +00:00
Gilles Peskine
4411c9c1f8 Disable PSA wrappers psa_collect_statuses builds
`psa_collect_statuses.py` runs `make RECORD_PSA_STATUS_COVERAGE_LOG=1`,
which builds with `RECORD_PSA_STATUS_COVERAGE_LOG`. In this mode, the build
includes wrappers for PSA functions, which conflict with the newly
introduced wrappers that are enabled whenever `MBEDTLS_TEST_HOOKS` is
enabled. In the future, the collect-statuses mechanism should use the new
generic wrapper mechanism. For the time being, keep the old wrappers and
avoid the new wrappers when doing the collect-statuses build.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-01-15 19:30:48 +01:00
Ronald Cron
d1c106c787 Define ticket creation time in TLS 1.2 case as well
The purpose of this change is to eventually base
the calculation in ssl_ticket.c of the ticket age
when parsing a ticket on the ticket creation time
both in TLS 1.2 and TLS 1.3 case.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-01-15 08:58:19 +01:00
Dave Rodgman
67223bb501 add support for AES-CTR to benchmark
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2024-01-12 18:33:57 +00:00
David Horstmann
9432e64933 Only run memory poisoning metatests when poisoning
When we cannot memory poison due to platform constraints, do not attempt
to run memory poisoning metatests (but still run other ASan metatests).

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-01-12 15:13:54 +00:00