11766 Commits

Author SHA1 Message Date
Gilles Peskine
fd6d279452 CMake: generate tls13-compat.sh in the default build target
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 19:02:13 +02:00
Gilles Peskine
40c090f61b Move generation of tls13-compat.sh to tests/CMakeLists.txt
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 19:02:11 +02:00
Gilles Peskine
907e49557b Print a "Gen" line when generating a file
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:59:31 +02:00
Gilles Peskine
1e01b4a1c7 Remove obsolete requirement for GnuTLS %DISABLE_TLS13_COMPAT_MODE
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:59:31 +02:00
Gilles Peskine
5dd839add3 Fix sensitivity of tls13-compat.sh to the exact generation method
Fix `tls13-compat.sh` changing based on exactly how
`generate_tls13_compat_tests.py` was run (e.g. from which directory). This
made `check-generated-files.sh` behave differently from `make`. The script
has no official variations of the content of its output file, so we don't
need to record the full command line.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:59:31 +02:00
Gilles Peskine
3943a1a3bf Automatically generate tests/opt-testcases/tls13-compat.sh
`tests/opt-testcases/tls13-compat.sh` is supposed to be automatically
generated by `tests/scripts/generate_tls13_compat_tests.py`. So far, the
output has been updated by running the script manually and committing the
output. Switch to using our framework for generated files.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:59:31 +02:00
Gilles Peskine
c07bedae56 generate_tls13_compat_tests: change default mode to all
With no options, update the output file (former behavior with -a).
Pass -1 to generate a single test case.

Also have the intended output file location as the default.

This way, you can just run the script after updating it, without having to
know the details of the directory structure.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:59:31 +02:00
Gilles Peskine
ae5a35fc30 Remove obsolete requirements on middlebox compatibility mode: generated
MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE is no longer required, except in test
cases that are specifically about it. This commit removes the requirement in
tls13-compat.sh (which does not have test cases that actually depend on the
feature).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:59:31 +02:00
Gilles Peskine
edc8f35ed3 Remove obsolete requirements on middlebox compatibility mode: manual
MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE is no longer required, except in test
cases that are specifically about it. This commit removes the requirement on
all test cases except those whose description contains "middlebox".

Exclude tls13-compat.sh which is automatically generated and will be handled
in a separate commit.

```
perl -0777 -i -pe '
    # With -0777, we act on the whole file.
    # s[REGEXP][EXPR]gm replaces every occurrence of REGEXP by EXPR.
    # The regexp matches "requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE",
    # followed by zero or more non-empty lines, followed by a line starting
    # with "run_test" and not containing "middlebox".
    # The replacement is everything matched except the first line.
    s[^requires_config_enabled MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE\n((?:.+\n)*run_test (?!.*middlebox))]
     [$1]gm' tests/ssl-opt.sh tests/opt-testcases/tls13-kex-modes.sh tests/opt-testcases/tls13-misc.sh
```

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:59:30 +02:00
Gilles Peskine
0f2d839521 Remove mid-stanza blank lines
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:58:49 +02:00
Gilles Peskine
671a439ddd Adapt middlebox compatibility tests for always-on acceptance
Adapt the test cases for TLS 1.3 middlebox compatibility mode, now that we
always interoperate with peers that support it, regardless of whether
MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE is enabled.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:58:49 +02:00
Gilles Peskine
7b02c1f3b6 Avoid multiline requires_all_configs_xxx
For better searchability and readability, call requires_config_enabled or
requires_config_disabled for each option, instead of calling
requires_all_configs_enabled or requires_all_configs_disabled with a long
list of options.

```
perl -0777 -i -pe '
    # With -0777, we act on the whole file.
    # s[REGEXP][CODE]egm replaces every occurrence of REGEXP by the result
    # of running CODE.
    # The regexp matches "requires_all_configs_enabled" or
    # "requires_all_configs_disabled" followed by a list of words ending
    # with a line break. The words can be separated by a sequence of
    # spaces and optionally a backslash-newline.
    s[^requires_all_configs_(enabled|disabled) *((?:(?: \w+) *(?:\\\n)? *)+)\n][
      $state = $1;
      # Extract all the words from the list of words (/(\w+)/g). For each word,
      # For each word, construct a line "requires_config_XXXabled WORD".
      # The replacement text is the concatenation of these lines.
      join("", map {"requires_config_$state $_\n"} $2 =~ /(\w+)/g)
     ]egm' tests/ssl-opt.sh tests/opt-testcases/*.sh
```

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:58:47 +02:00
Gilles Peskine
1d6a9505ee opt-testcases/*.sh are not executable
The *.sh files in opt-testcases cannot be executed directly: they can only
be sourced by ssl-opt.sh. So don't make them executable and don't give them
a shebang line.

Also make sure that the first paragraph of each file is a short description.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-24 18:56:24 +02:00
Gilles Peskine
26650f5711
Merge pull request #9565 from gilles-peskine-arm/test-ref-configs-go-away
Switch from test-ref-configs.pl to separate components
2024-09-24 13:00:50 +00:00
Gilles Peskine
ea5de2b40d Simplify psa-crypto components that come from test-ref-configs
In the components migrated from test-ref-configs.pl, we don't need to
activate PSA: it's always on. Also, since there is no "_legacy" component to
contrast with, drop "_psa" from the component names.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-19 18:41:55 +02:00
Gilles Peskine
e7422a14e9 Remove legacy-crypto components that come from test-ref-configs
Remove the components migrated from test-ref-configs.pl that use legacy
crypto (no enabling of MBEDTLS_USE_PSA_CRYPTO). In the 4.0 preparation
branch, we are no longer interested in such configurations.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-19 18:36:25 +02:00
David Horstmann
bae154d76c
Merge pull request #9385 from eleuzi01/replace-ecdsa-some
Replace MBEDTLS_PK_HAVE_ECDSA* with PSA_WANT counterparts
2024-09-19 13:53:18 +00:00
Tom Cosgrove
b80516816d
Merge pull request #9536 from mpg/rsapub-perf-dev
[dev] Rsapub performance fix
2024-09-18 14:20:50 +00:00
Gilles Peskine
2e449f06ad Remove test-ref-configs.pl, which no longer does anything
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-14 18:20:57 +02:00
Gilles Peskine
effa6a0769 Move config-tfm.h testing to separate all.sh component
Rename the existing component_test_tfm_config which tests a modified version
of config-tfm.h for the sake of driver-vs-reference comparison.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-14 18:20:57 +02:00
Gilles Peskine
af5a899a12 Move config-symmetric-only.h testing to separate all.sh components
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-14 18:20:57 +02:00
Gilles Peskine
86ceb133d4 Move config-thread.h testing to separate all.sh components
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-14 18:20:57 +02:00
Gilles Peskine
b6d4913df9 Move config-suite-b.h testing to separate all.sh components
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-14 18:20:57 +02:00
Gilles Peskine
68f511ec92 Move config-ccm-psk-dtls1_2.h testing to separate all.sh components
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-14 18:20:57 +02:00
Gilles Peskine
063fb8cf13 Move config-ccm-psk-tls1_2.h testing to separate all.sh components
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-14 13:06:15 +02:00
Gilles Peskine
e3eab32600 requires_certificate_authentication: prioritize TLS 1.3
When checking whether the build supports certificate authentication, check
the key exchange modes enabled in the default protocol version. This is TLS
1.3 when it's enabled.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
6e85e35fcc Documentation improvements
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
2dd4395da0 Fix detection of TLS 1.2 PSK-ephemeral key exchange modes
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
7f453bfad4 Improve some comments
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
78df617362 Remove unused auth_mode parameter on a PSK test case
It was causing the test case to be incorrectly skipped as needing
certificate authentication.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
cd4fe70fe2 Fix weirdly quoted invocations of requires_any_configs_enabled
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
db26406934 Also activate PSK-only mode when PSK-ephemeral key exchanges are available
The point of PSK-only mode is to transform certificate-based command lines
into PSK-based command lines, when the certificates are not relevant to what
is being tested. So it makes sense to do that in with PSK-ephemeral key
exchanges too.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
9d3b2079a5 Unify the two requires-key-exchange-with-certificate function
requires_certificate_authentication was called in more places, but did not
do fine-grained analysis of key exchanges and so gave the wrong results in
some builds.

requires_key_exchange_with_cert_in_tls12_or_tls13_enabled gave the correct
result but was only used in some test cases, not in the automatic detection
code.

Remove all uses of requires_key_exchange_with_cert_in_tls12_or_tls13_enabled
because they are in fact covered by automated detection that calls
requires_certificate_authentication.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
24b4303ddd Detect PSK-only mode in TLS 1.3 as well
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
4f0986487d Fix PSK-only mode doing less than it should
Don't add a certificate requirement when PSK is enabled.

Do command line requirement detection after the injection of PSK into the
command line in PSK-only mode. Otherwise certificate requirements would be
added even in PSK-only mode.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
ae3dc17e50 Detect more cases where certificates are required
When requiring a cryptographic mechanism for the sake of certificate
authentication, also require that certificate authentication is enabled.

Setting auth_mode explicitly means that we're testing something related to
how certificate-based authentication is handled, so require a key exchange
with certificate-based authentication.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:34 +02:00
Gilles Peskine
6f9952abfc ssl-opt: Fix GnuTLS PSK injection
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:33 +02:00
Gilles Peskine
9404169146 Use CONFIGS_ENABLED instead of repeatedly calling query_compile_time_config
It's faster and more readable.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:01 +02:00
Gilles Peskine
56ee69de5b Fix "Renegotiation: openssl server, client-initiated" with OpenSSL 3
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-13 09:48:01 +02:00
Elena Uziunaite
ffce45c19f Add missing ALG_SHA_1
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-12 14:58:52 +01:00
Ronald Cron
a45ba05e35
Merge pull request #9549 from ronald-cron-arm/adapt-components
Adapt some all.sh components to MBEDTLS_PSA_CRYPTO_CONFIG always on
2024-09-12 12:00:39 +00:00
Paul Elliott
2f620f3127
Merge pull request #9561 from gilles-peskine-arm/cmake-underscore_D
Fix typo that caused cpp_dummy_build not to be built with CMake
2024-09-12 11:40:46 +00:00
Paul Elliott
8ea8b30941
Merge pull request #8988 from billatarm/add-pc-files
tests: add a test for pkg-config files
2024-09-11 21:14:46 +00:00
Bill Roberts
10ff4174f4
tests: add a test for pkg-config files
Add a test that does some basic validation of the pkg-config files.

Example run:
./tests/scripts/all.sh test_cmake_as_package
<snip>
******************************************************************
* test_cmake_as_package: build: cmake 'as-package' build
* Wed Sep 11 16:17:41 UTC 2024
******************************************************************
cmake .
make
Built against Mbed TLS 3.6.0
testing package config file: mbedtls ... passed
testing package config file: mbedx509 ... passed
testing package config file: mbedcrypto ... passed
make clean

Signed-off-by: Bill Roberts <bill.roberts@arm.com>
2024-09-11 09:19:42 -07:00
Gilles Peskine
236e05d758 Fix typo that caused cpp_dummy_build not to be built with CMake
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-09-11 17:51:45 +02:00
Ronald Cron
4153ebb55d Fix comments
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-09-11 15:32:48 +02:00
Elena Uziunaite
b430eeea85 Bring back some dependencies
To make CI happier

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-09 11:18:10 +01:00
Elena Uziunaite
91d8386a42 Enable USE_PSA_CRYPTO
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-09 11:18:10 +01:00
Elena Uziunaite
96867b6bf4 Address review comments: remove dependencies
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-09 11:18:10 +01:00
Elena Uziunaite
8d8620bf18 Address review comments: add PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-09 11:18:10 +01:00