567 Commits

Author SHA1 Message Date
David Horstmann
4a48becdba Invert and rename config option
Replace MBEDTLS_PSA_COPY_CALLER_BUFFERS with inverse:
!MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS. This ensures that buffer
protection is enabled by default without any change to the Mbed TLS
config file.

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-03-14 14:47:48 +00:00
Waleed Elmelegy
5bc5263b2c Add code improvments and refactoring in dealing with ALPN
Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>
2024-03-13 16:50:01 +00:00
Waleed Elmelegy
883f77cb08 Add mbedtls_ssl_session_set_alpn() function
Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>
2024-03-13 16:50:01 +00:00
Waleed Elmelegy
2824a209bc Add ALPN information in session tickets
Signed-off-by: Waleed Elmelegy <waleed.elmelegy@arm.com>
2024-03-13 16:50:01 +00:00
Ryan Everett
fbf815d9cb Add key_destroyable parameter to key export smoke tests
These are only called from mbedtls_test_psa_exercise_key

Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-13 14:31:11 +00:00
Ryan Everett
73e4ea37f4 Add key_destroyable parameter to non-raw key agreement smoke tests
All current usages have this parameter set to 0 (this means the tests are unchanged).
Remove the GENERIC_ERROR return behaviour, in favour of returning the actual status.

Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-13 14:31:11 +00:00
Valerio Setti
13beaa2e60 psa_crypto_stubs: extend stub functions for the CRYPTO_CLIENT tests
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-03-13 09:52:36 +01:00
David Horstmann
80a5dbd1cd Regenerate PSA wrappers for new PSA functions
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-03-12 17:02:48 +00:00
Ryan Everett
8163028fbd Add key_destroyable parameter to raw key agreement smoke tests
All current usages have this parameter set to 0 (meaning the behaviour
of these tests hasn't changed). We also now return the actual error code, not GENERIC_ERROR

Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
Ryan Everett
c1cc6686f0 Add key_destroyable parameter to key derivation smoke tests
All current usages have this parameter set to 0 (in this case the behaviour of
the test is unchanged)

Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
Ryan Everett
d48fc102d3 Add key_destroyable parameter to exercise_asymmetric_encryption_key
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
Ryan Everett
6edd40819e Add key_destroyable parameter to exercise_signature_key
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
Ryan Everett
fbe703de2a Add key_destroyable parameter to exercise_aead_key
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
Ryan Everett
70691f3082 Add key_destroyable parameter to psa_exercise_cipher_key
If the key has been destroyed (and the new parameter is 1), we test that
psa_cipher_abort succeeds in this scenario.

Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
Ryan Everett
7763550884 Add key_destroyable parameter to exercise_mac_key
If the key has been destroyed (and the new parameter is 1) then we test that
psa_mac_abort succeeds in this scenario.

Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
Ryan Everett
f08a93fbe5 Add key_destroyable parameter to check_key_attributes_sanity
This function is currently only used in the exercise_key smoke test.

Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
Ryan Everett
0a271fde76 Add key_destroyable parameter to mbedtls_test_psa_exercise_key
This will allow us to use this smoke test to ensure that key slot content reads are
only performed when we are registered to read a full slot. We will destroy the key
on another thread while the key is being exercised, and fail the test if an unexpected
error code is hit. Future commits will incrementally implement this new parameter.

All current usages of this function have this parameter set to 0, in which case
the new behaviour must be the same as the old behaviour

Signed-off-by: Ryan Everett <ryan.everett@arm.com>
2024-03-12 17:01:09 +00:00
David Horstmann
93fa4e1b87 Merge branch 'development' into buffer-sharing-merge 2024-03-12 15:05:06 +00:00
David Horstmann
5d64c6acca Generate memory poisoning in wrappers
Generate memory poisoning code in test wrappers for:
* psa_sign_hash_start()
* psa_sign_hash_complete()
* psa_verify_hash_start()

Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-03-11 15:56:13 +00:00
David Horstmann
63dfb45e5e
Merge pull request #1181 from tom-daubney-arm/key_agreement_buffer_protection
Implement safe buffer copying in key agreement
2024-03-11 15:10:49 +00:00
Manuel Pégourié-Gonnard
af3e574f5f
Merge pull request #8862 from valeriosetti/issue8825
Improve support of mbedtls_psa_get_random in client-only builds
2024-03-10 20:06:27 +00:00
Ronald Cron
7e1f9f290f
Merge pull request #8854 from ronald-cron-arm/tls13-srv-max-early-data-size
TLS 1.3: Enforce max_early_data_size on server
2024-03-09 00:16:07 +00:00
Ronald Cron
139a4185b1
Merge pull request #8587 from yanrayw/issue/4911/ssl_setup-check-RNG-configuration
TLS: check RNG when calling mbedtls_ssl_setup()
2024-03-08 07:38:39 +00:00
tom-daubney-arm
d4c57c0ad2
Merge branch 'development-restricted' into key_agreement_buffer_protection
Signed-off-by: tom-daubney-arm <74920390+tom-daubney-arm@users.noreply.github.com>
2024-03-06 16:47:13 +00:00
David Horstmann
a5175634b0
Merge branch 'development-restricted' into copying-pake
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-03-06 11:18:28 +00:00
Gilles Peskine
8462146d01
Merge pull request #8867 from gilles-peskine-arm/psa_key_attributes-remove_core
Merge psa_core_key_attributes_t back into psa_key_attributes_t
2024-03-05 09:59:24 +00:00
Gábor Mezei
716cf2d4e0
Merge branch 'development-restricted' into buffer_protection_for_cipher
Signed-off-by: Gábor Mezei <63054694+gabor-mezei-arm@users.noreply.github.com>
2024-03-04 15:38:05 +00:00
Ronald Cron
987cf898db ssl_helpers: Restore rng_seed incrementation
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-04 10:24:27 +01:00
Valerio Setti
ada2ec3482 psa_crypto_stubs/changelog: fix typos
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-03-01 18:04:14 +01:00
Ronald Cron
10b040fa6f tests: ssl_helpers: Rename rng_get to mbedtls_test_random
mbedtls_test_ as the prefix for test APIs
_random like in mbedtls_ctr/hmac_drbg_random

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 17:00:38 +01:00
Manuel Pégourié-Gonnard
e33b349c90
Merge pull request #8864 from valeriosetti/issue8848
Deprecate or remove mbedtls_pk_wrap_as_opaque
2024-03-01 15:54:32 +00:00
Ronald Cron
5d3036e6d5 tests: ssl: Add max_early_data_size option
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-03-01 09:03:51 +01:00
Valerio Setti
1a58e9a232 psa_util: change guard for mbedtls_psa_get_random() to CRYPTO_CLIENT
This commit also:
- updates changelog
- add a stub function to be used in component_test_psa_crypto_client()
  test

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-29 16:14:29 +01:00
David Horstmann
c5688a2629
Merge branch 'development-restricted' into generate-random-buffer-protection
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-29 14:25:56 +00:00
tom-daubney-arm
840dfe8b41
Merge branch 'development-restricted' into asymmetric_encrypt_buffer_protection
Signed-off-by: tom-daubney-arm <74920390+tom-daubney-arm@users.noreply.github.com>
2024-02-28 15:42:38 +00:00
Gabor Mezei
b74ac66c8b
Update test wrapper functions for ciper buffer protection
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-28 15:17:18 +00:00
Gabor Mezei
b8f97a1f3f
Add test wrapper functions for cipher buffer protection
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2024-02-28 15:17:17 +00:00
Gilles Peskine
2f107ae000 Don't access psa_key_attributes_t.core
Access the fields of `psa_key_attributes_t` directly rather than through the
`core` field. This makes the `core` field obsolete.

This commit is fully automated:
```
git ls-files '*.h' '*.c' '*.function' '*.jinja' | xargs perl -l -i -pe '$core = qr/\b(core\b|MBEDTLS_PRIVATE\(core\))/; s/->$core\./->/g; s/&(\w+)\.$core\./&$1./g; s/(\w+)\.$core/$1/g'
```

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-28 01:30:24 +01:00
Valerio Setti
a9de9445b1 ssl_helpers: minor fix in mbedtls_test_ssl_endpoint_certificate_init()
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-27 13:56:09 +01:00
Tom Cosgrove
ca21b241bd
Merge pull request #8840 from gilles-peskine-arm/domain_parameters-remove
Remove domain parameters
2024-02-27 10:36:51 +00:00
Valerio Setti
1fa2f6e9af test: remove usage of mbedtls_pk_wrap_as_opaque() from tests
This is replaced with: mbedtls_pk_get_psa_attributes() +
mbedtls_pk_import_into_psa() + mbedtls_pk_setup_opaque().

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2024-02-27 09:23:35 +01:00
David Horstmann
075c5fb76f Generate test wrappers for psa_generate_random()
Signed-off-by: David Horstmann <david.horstmann@arm.com>
2024-02-26 17:12:34 +00:00
Tom Cosgrove
f4a200f106
Merge pull request #8838 from paul-elliott-arm/improve_test_data_accessors
Improve test info data accessors
2024-02-26 11:22:20 +00:00
Gilles Peskine
4c32b69f37 Ignore domain parameters in RSA key generation
Remove the ability to select a custom public exponent via domain parameters
in RSA key generation. The only way to select a custom public exponent is
now to pass custom production parameters to psa_generate_key_ext().

A subsequent commit will remove domain parameters altogether from the API,
thus this commit does not bother to update the documentation.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-02-26 08:50:38 +01:00
Paul Elliott
9011dae0c1 Improve documentation / comments
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2024-02-24 10:57:22 +00:00
tom-daubney-arm
5cd611d144
Merge branch 'development-restricted' into mac_buffer_protection
Signed-off-by: tom-daubney-arm <74920390+tom-daubney-arm@users.noreply.github.com>
2024-02-22 15:26:06 +00:00
Gilles Peskine
0aab69d2eb
Merge pull request #8807 from gilles-peskine-arm/pk_import_into_psa-implement_import
Implement mbedtls_pk_import_into_psa
2024-02-21 15:45:17 +00:00
Gilles Peskine
dd49c739f0 Merge remote-tracking branch 'development' into pk_import_into_psa-implement_import
Conflicts:
* tests/suites/test_suite_pk.function: consecutive changes to the
  depends_on line of pk_sign_verify and its argument list.
2024-02-21 12:10:40 +01:00
Manuel Pégourié-Gonnard
0ecb5fd6f5
Merge pull request #8574 from ronald-cron-arm/ssl-tickets
Fix and align ticket age check in ssl_ticket.c for TLS 1.2 and TLS 1.3
2024-02-21 09:38:46 +00:00
David Horstmann
cf3457ef26
Merge pull request #1132 from davidhorstmann-arm/copying-aead
Copy buffers in AEAD
2024-02-20 16:07:30 +00:00