From 57f4d9e4fe31340880e39a383ed44f30dc6cde19 Mon Sep 17 00:00:00 2001 From: Jaeden Amero Date: Fri, 15 Mar 2019 16:14:19 +0000 Subject: [PATCH] Update crypto submodule to test with private headers Update the crypto submodule to the top of the Mbed Crypto development branch. This brings in a version of Mbed Crypto that enables building Mbed Crypto tests that depend on private headers, like 'psa_crypto_invasive.h'. This also requires updating our config.h to include new configuration options added to Mbed Crypto. MBEDTLS_PSA_ITS_FILE_C replaces MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C and MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C. MBEDTLS_PSA_INJECT_ENTROPY replaces MBEDTLS_PSA_HAS_ITS_IO. --- crypto | 2 +- include/mbedtls/check_config.h | 27 ++++++++++---------- include/mbedtls/config.h | 45 +++++++++++++--------------------- library/version_features.c | 15 +++++------- programs/ssl/query_config.c | 24 ++++++------------ scripts/config.pl | 10 +++----- 6 files changed, 49 insertions(+), 74 deletions(-) diff --git a/crypto b/crypto index a52c0593c..82b3b83d5 160000 --- a/crypto +++ b/crypto @@ -1 +1 @@ -Subproject commit a52c0593cceb54113d7cd9937b042fd395f55991 +Subproject commit 82b3b83d540ec9611277ca3e9b645b335f80846a diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h index 962d3db87..c1450dbda 100644 --- a/include/mbedtls/check_config.h +++ b/include/mbedtls/check_config.h @@ -525,26 +525,25 @@ #error "MBEDTLS_PSA_CRYPTO_SPM defined, but not all prerequisites" #endif -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) && defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) -#error "Only one of MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C can be defined" -#endif - #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ - !( defined(MBEDTLS_PSA_CRYPTO_C) && \ - ( defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) || \ - defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) ) ) + ! defined(MBEDTLS_PSA_CRYPTO_C) #error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites" #endif -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) && \ - !( defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ - defined(MBEDTLS_FS_IO) ) -#error "MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C defined, but not all prerequisites" +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + !( defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \ + defined(MBEDTLS_ENTROPY_NV_SEED) ) +#error "MBEDTLS_PSA_INJECT_ENTROPY defined, but not all prerequisites" #endif -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) && \ - ! defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) -#error "MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C defined, but not all prerequisites" +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \ + !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) +#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with actual entropy sources" +#endif + +#if defined(MBEDTLS_PSA_ITS_FILE_C) && \ + !defined(MBEDTLS_FS_IO) +#error "MBEDTLS_PSA_ITS_FILE_C defined, but not all prerequisites" #endif #if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \ diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 3a2fed528..31a305923 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -1237,14 +1237,17 @@ //#define MBEDTLS_PSA_CRYPTO_SPM /** - * \def MBEDTLS_PSA_HAS_ITS_IO + * \def MBEDTLS_PSA_INJECT_ENTROPY * - * Enable the non-volatile secure storage usage. + * Enable support for entropy injection at first boot. This feature is + * required on systems that do not have a built-in entropy source (TRNG). + * This feature is currently not supported on systems that have a built-in + * entropy source. * - * This is crucial on systems that do not have a HW TRNG support. + * Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED * */ -//#define MBEDTLS_PSA_HAS_ITS_IO +//#define MBEDTLS_PSA_INJECT_ENTROPY /** * \def MBEDTLS_RSA_NO_CRT @@ -2741,40 +2744,26 @@ * * Enable the Platform Security Architecture persistent key storage. * - * Module: library/psa_crypto_storage.c - * - * Requires: MBEDTLS_PSA_CRYPTO_C and one of either - * MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C - * (but not both) + * Module: crypto/library/psa_crypto_storage.c * + * Requires: MBEDTLS_PSA_CRYPTO_C, + * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of + * the PSA ITS interface */ //#define MBEDTLS_PSA_CRYPTO_STORAGE_C /** - * \def MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C + * \def MBEDTLS_PSA_ITS_FILE_C * - * Enable persistent key storage over files for the - * Platform Security Architecture cryptography API. + * Enable the emulation of the Platform Security Architecture + * Internal Trusted Storage (PSA ITS) over files. * - * Module: library/psa_crypto_storage_file.c + * Module: crypto/library/psa_its_file.c * - * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_FS_IO + * Requires: MBEDTLS_FS_IO * */ -//#define MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C - -/** - * \def MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C - * - * Enable persistent key storage over PSA ITS for the - * Platform Security Architecture cryptography API. - * - * Module: library/psa_crypto_storage_its.c - * - * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_HAS_ITS_IO - * - */ -//#define MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C +//#define MBEDTLS_PSA_ITS_FILE_C /** * \def MBEDTLS_RIPEMD160_C diff --git a/library/version_features.c b/library/version_features.c index 161788ca7..1be0e0fc9 100644 --- a/library/version_features.c +++ b/library/version_features.c @@ -429,9 +429,9 @@ static const char *features[] = { #if defined(MBEDTLS_PSA_CRYPTO_SPM) "MBEDTLS_PSA_CRYPTO_SPM", #endif /* MBEDTLS_PSA_CRYPTO_SPM */ -#if defined(MBEDTLS_PSA_HAS_ITS_IO) - "MBEDTLS_PSA_HAS_ITS_IO", -#endif /* MBEDTLS_PSA_HAS_ITS_IO */ +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) + "MBEDTLS_PSA_INJECT_ENTROPY", +#endif /* MBEDTLS_PSA_INJECT_ENTROPY */ #if defined(MBEDTLS_RSA_NO_CRT) "MBEDTLS_RSA_NO_CRT", #endif /* MBEDTLS_RSA_NO_CRT */ @@ -708,12 +708,9 @@ static const char *features[] = { #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) "MBEDTLS_PSA_CRYPTO_STORAGE_C", #endif /* MBEDTLS_PSA_CRYPTO_STORAGE_C */ -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) - "MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C", -#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C */ -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) - "MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C", -#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C */ +#if defined(MBEDTLS_PSA_ITS_FILE_C) + "MBEDTLS_PSA_ITS_FILE_C", +#endif /* MBEDTLS_PSA_ITS_FILE_C */ #if defined(MBEDTLS_RIPEMD160_C) "MBEDTLS_RIPEMD160_C", #endif /* MBEDTLS_RIPEMD160_C */ diff --git a/programs/ssl/query_config.c b/programs/ssl/query_config.c index f2f7b46d6..f27267650 100644 --- a/programs/ssl/query_config.c +++ b/programs/ssl/query_config.c @@ -1186,13 +1186,13 @@ int query_config( const char *config ) } #endif /* MBEDTLS_PSA_CRYPTO_SPM */ -#if defined(MBEDTLS_PSA_HAS_ITS_IO) - if( strcmp( "MBEDTLS_PSA_HAS_ITS_IO", config ) == 0 ) +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) + if( strcmp( "MBEDTLS_PSA_INJECT_ENTROPY", config ) == 0 ) { - MACRO_EXPANSION_TO_STR( MBEDTLS_PSA_HAS_ITS_IO ); + MACRO_EXPANSION_TO_STR( MBEDTLS_PSA_INJECT_ENTROPY ); return( 0 ); } -#endif /* MBEDTLS_PSA_HAS_ITS_IO */ +#endif /* MBEDTLS_PSA_INJECT_ENTROPY */ #if defined(MBEDTLS_RSA_NO_CRT) if( strcmp( "MBEDTLS_RSA_NO_CRT", config ) == 0 ) @@ -1930,21 +1930,13 @@ int query_config( const char *config ) } #endif /* MBEDTLS_PSA_CRYPTO_STORAGE_C */ -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) - if( strcmp( "MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C", config ) == 0 ) +#if defined(MBEDTLS_PSA_ITS_FILE_C) + if( strcmp( "MBEDTLS_PSA_ITS_FILE_C", config ) == 0 ) { - MACRO_EXPANSION_TO_STR( MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C ); + MACRO_EXPANSION_TO_STR( MBEDTLS_PSA_ITS_FILE_C ); return( 0 ); } -#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C */ - -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) - if( strcmp( "MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C", config ) == 0 ) - { - MACRO_EXPANSION_TO_STR( MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C ); - return( 0 ); - } -#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C */ +#endif /* MBEDTLS_PSA_ITS_FILE_C */ #if defined(MBEDTLS_RIPEMD160_C) if( strcmp( "MBEDTLS_RIPEMD160_C", config ) == 0 ) diff --git a/scripts/config.pl b/scripts/config.pl index 84069d231..6300362fa 100755 --- a/scripts/config.pl +++ b/scripts/config.pl @@ -41,10 +41,9 @@ # MBEDTLS_USE_PSA_CRYPTO # - experimental, and more an alternative implementation than a feature # MBEDTLS_PSA_CRYPTO_STORAGE_C -# MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C -# MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C +# MBEDTLS_PSA_ITS_FILE_C # MBEDTLS_PSA_CRYPTO_SPM -# MBEDTLS_PSA_HAS_ITS_IO +# MBEDTLS_PSA_INJECT_ENTROPY # and any symbol beginning _ALT # @@ -109,10 +108,9 @@ MBEDTLS_NO_UDBL_DIVISION MBEDTLS_NO_64BIT_MULTIPLICATION MBEDTLS_USE_PSA_CRYPTO MBEDTLS_PSA_CRYPTO_STORAGE_C -MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C -MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C +MBEDTLS_PSA_ITS_FILE_C MBEDTLS_PSA_CRYPTO_SPM -MBEDTLS_PSA_HAS_ITS_IO +MBEDTLS_PSA_INJECT_ENTROPY _ALT\s*$ );