Make sure that extra UNPOISON calls do not cause the poisoning counter
to underflow and wrap around.
Memory that is unpoisoned multiple times should remain unpoisoned.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Some platforms may support ASan but be C99-only (no C11 support).
These platforms will support ASan metatests but not memory poisoning,
which requires C11 features.
To allow for this, create a separate platform requirement, "poison",
in metatest.c to distinguish generic ASan metatests from ones that
require suppport for memory poisoning.
In practice our platforms support both, so run "poison" tests in
the same all.sh components where we run "asan" ones.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
This allows unusually-nested memory poisoning to work correctly, since
it keeps track of whether any buffers are still poisoned, rather than
just disabling poisoning at the first call to the UNPOISON() macro.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Set the C_STANDARD property on the mbedtls_test target to 11.
This requests C11 for the tests only.
If C11 is not supported the build will not fail, since
C_STANDARD_REQUIRED is not set, and memory poisoning will be disabled
by a preprocessor check on __STDC_VERSION__.
Additionally, reintroduce previous C99 enforcement on the rest of the
library.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
When we cannot memory poison due to platform constraints, do not attempt
to run memory poisoning metatests (but still run other ASan metatests).
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Allow memory poisoning to be enabled and disabled at runtime using a
thread-local flag. This allows poisoning to be disabled whenever a PSA
function is called but not through the test wrappers, removing false
positive use-after-poisons.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Any timing variance dependant on the output of this function enables a
Bleichenbacher attack. It is extremely difficult to use safely.
In the Marvin attack paper
(https://people.redhat.com/~hkario/marvin/marvin-attack-paper.pdf) the
author suggests that implementations of PKCS 1.5 decryption that don't
include a countermeasure should be considered inherently dangerous.
They suggest that all libraries implement the same countermeasure, as
implementing different countermeasures across libraries enables the
Bleichenbacher attack as well.
This is extremely fragile and therefore we don't implement it. The use
of PKCS 1.5 in Mbed TLS implements the countermeasures recommended in
the TLS standard (7.4.7.1 of RFC 5246) and is not vulnerable.
Add a warning to PKCS 1.5 decryption to warn users about this.
Signed-off-by: Janos Follath <janos.follath@arm.com>
Make sure that we don't enable memory poisoning when
MBEDTLS_PSA_COPY_CALLER_BUFFERS is disabled.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Specifically:
* Move the creation of the pointer to the copied buffer into the
DECLARE() macro, to solve warnings about potentially skipping
initialization.
* Reorder the arguments of the FREE() macro - having a different order
made it confusing, so keep the order the same throughout.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Note that enabling MBEDTLS_PSA_COPY_CALLER_BUFFERS allows full buffer
overlap support, whereas without it, overlap support is reduced to that
documented in the function descriptions.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
* Separate initialization from allocation.
* Rewrite description of macros to fit the new interface.
* Use a longer name to store the local copy objects, to reduce the risk
of shadowing.
* Use different names for the original and the copy. Append the suffix
'_external' to the original argument and use the previous name
for the copy.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Previously the return from psa_crypto_local_output_free() had a fixed
name, which meant that multiple outputs would cause redefinitions of the
same variable.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
* Set swapped pointers to NULL when the buffers are freed.
* Change example name <buffer> to <input> and <output> to reduce
confusion.
* Document assumptions of FREE_LOCAL_ macros.
* Add comment on error case in FREE_LOCAL_OUTPUT(), explaining why it's
okay to mask the existing status code.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Since psa_crypto.c does not include tests/include/test/memory.h, we do
not need the tests/include include path.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
This allows us to entirely remove copying code, where the convenience
macros are used for copying.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
This check is intended to ensure that we do not write intermediate
results to the shared output buffer. This check will be made obselete
by generic memory-poisoning-based testing for all functions.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Since we are applying hooks transparently to all tests, we cannot setup
and teardown test hooks in the tests. Instead we must do this in the
test wrappers which are used to pre-poison and unpoison memory.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Use the preprocessor to wrap psa_cipher_encrypt in a wrapper that
poisons the input and output buffers.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
These are needed to allow them to operate on buffer copies without
triggering ASan use-after-poison detection.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Now that library is in the include path when compiling metatest.c, don't
duplicate the definition of __func__ from library/common.h.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
