Commit graph

276 commits

Author SHA1 Message Date
gabor-mezei-arm d1c98fcf5e
Zeroize internal buffers and variables in MD hashes
Zeroising of local buffers and variables which are used for calculations in
mbedtls_internal_md*_process() and mbedtls_internal_ripemd160_process()
functions to erase sensitive data from memory.
Checked all function for possible missing zeroisation in MD.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-08-25 19:13:59 +02:00
gabor-mezei-arm 76749aea78
Zeroize internal buffers and variables in PKCS and SHA
Zeroising of local buffers and variables which are used for calculations in
mbedtls_pkcs5_pbkdf2_hmac() and mbedtls_internal_sha*_process() functions
to erase sensitive data from memory.
Checked all function for possible missing zeroisation in PKCS and SHA.

Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-08-25 19:13:58 +02:00
Steven Cooreman a6033e92af Style and language fixes
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-25 12:32:22 +02:00
Gilles Peskine ed19762a22
Merge pull request #3574 from makise-homura/e2k_support
Support building on e2k (Elbrus) architecture
2020-08-25 09:46:36 +02:00
John Durkop af5363c24e Updates to cleanup fixes for #3294
Minor updates to changelog for more concise wording and fixed styling
in other files as needed.

Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-08-24 08:29:39 -07:00
John Durkop bc5a754f28 Add change log description for Fix #3294
Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-08-24 08:23:21 -07:00
Gilles Peskine 0f343ac87f
Merge pull request #3528 from gufe44/helpers-redirect-restore-output
Fix bug in redirection of unit test outputs
2020-08-24 10:45:08 +02:00
Manuel Pégourié-Gonnard 6edfe60e0d
Merge pull request #2182 from hanno-arm/key_pwd
Add support for password protected key files to ssl_server2 and ssl_client2
2020-08-24 09:42:38 +02:00
Manuel Pégourié-Gonnard 1a6af8489e
Merge pull request #3578 from gilles-peskine-arm/md_setup-leak-development
Fix memory leak in mbedtls_md_setup with HMAC
2020-08-21 09:19:12 +02:00
gufe44 067f6e01f1 Fix bug in redirection of unit test outputs
Avoid replacing handle. stdout is defined as a macro on several platforms.

Signed-off-by: gufe44 <gu981@protonmail.com>
2020-08-21 08:32:26 +02:00
Christopher 8043eb0b5d Update ChangeLog.d/comment_typo_in_mbedtls_ssl_set_bio.txt
Co-authored-by: Hanno Becker <hanno.becker@arm.com>
Signed-off-by: Christopher Moynihan <christophm@gmail.com>
2020-08-20 14:31:00 -07:00
Manuel Pégourié-Gonnard 53d216081c Add a ChangeLog entry for local Lucky13 variant
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-08-20 12:17:05 +02:00
Dan Handley abccfc1684 Merge development into development-restricted
* development:
  Update copyright notices to use Linux Foundation guidance
  Undef ASSERT before defining it to ensure that no previous definition has sneaked in through included files.
  Add ChangeLog entry for X.509 CN-type vulnerability
  Improve documentation of cn in x509_crt_verify()
  Fix comparison between different name types
  Add test: DNS names should not match IP addresses
  Remove obsolete buildbot reference in compat.sh
  Fix misuse of printf in shell script
  Fix added proxy command when IPv6 is used
  Simplify test syntax
  Fix logic error in setting client port
  ssl-opt.sh: include test name in log files
  ssl-opt.sh: remove old buildbot-specific condition
  ssl-opt.sh: add proxy to all DTLS tests

Signed-off-by: Dan Handley <dan.handley@arm.com>
2020-08-20 11:07:12 +01:00
Gilles Peskine c57497e655
Merge pull request #3584 from mpg/fix-changelog-file-location
Fix location of a ChangeLog entry file
2020-08-20 11:50:05 +02:00
Manuel Pégourié-Gonnard eb528eef57 Fix location of a ChangeLog entry file
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-08-20 10:35:26 +02:00
Gilles Peskine d15c740df6 Fix memory leak in mbedtls_md_setup with HMAC
mbedtls_md_setup() allocates a hash-specific context and then, if
requested, an extra HMAC context. If the second allocation failed, the
hash context was not freed.

Fix this by ensuring that the mbedtls_md_context_t object is always in
a consistent state, in particular, that the md_info field is always
set. For robustness, ensure that the object is in a consistent state
even on errors (other than BAD_INPUT_DATA if the object was not in a
consistent state on entry).

Fix #3486

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-08-19 12:04:56 +02:00
Bence Szépkúti 1e14827beb Update copyright notices to use Linux Foundation guidance
As a result, the copyright of contributors other than Arm is now
acknowledged, and the years of publishing are no longer tracked in the
source files.

Also remove the now-redundant lines declaring that the files are part of
MbedTLS.

This commit was generated using the following script:

# ========================
#!/bin/sh

# Find files
find '(' -path './.git' -o -path './3rdparty' ')' -prune -o -type f -print | xargs sed -bi '

# Replace copyright attribution line
s/Copyright.*Arm.*/Copyright The Mbed TLS Contributors/I

# Remove redundant declaration and the preceding line
$!N
/This file is part of Mbed TLS/Id
P
D
'
# ========================

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-08-19 10:35:41 +02:00
makise-homura e5595501ce Fix e2k support changelog snippet
Signed-off-by: makise-homura <akemi_homura@kurisa.ch>
2020-08-19 01:33:15 +03:00
makise-homura ac2fd6524a Support building on e2k (Elbrus) architecture
Signed-off-by: makise-homura <akemi_homura@kurisa.ch>
2020-08-18 21:59:46 +03:00
Raoul Strackx a4e86141f1 Always revoke certificate on CRL
RFC5280 does not state that the `revocationDate` should be checked.

In addition, when no time source is available (i.e., when MBEDTLS_HAVE_TIME_DATE is not defined), `mbedtls_x509_time_is_past` always returns 0. This results in the CRL not being checked at all.

https://tools.ietf.org/html/rfc5280
Signed-off-by: Raoul Strackx <raoul.strackx@fortanix.com>
2020-08-17 09:05:03 +02:00
Gilles Peskine 71f4fa13bb
Merge pull request #721 from gilles-peskine-arm/x509parse_crl-empty_entry-development
Fix buffer overflow in x509_get_entries (oss-fuzz 24123)
2020-08-14 23:22:31 +02:00
Christopher Moynihan 74e2534a10 Fix typo in mbedtls_ssl_set_bio description.
Description referred to mbedtls_ssl_sent_t callback,
but the callback is named mbedtls_ssl_send_t.

Signed-off-by: Christopher Moynihan <christophm@gmail.com>
2020-08-14 12:43:10 -07:00
Manuel Pégourié-Gonnard 8ca03a7b68
Merge pull request #3554 from mpg/x509-verify-non-dns-san-dev
X509 verify non-DNS SANs
2020-08-14 11:32:22 +02:00
Hanno Becker 063f3bba90 Add ChangeLog entry
Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-08-14 10:02:36 +01:00
Manuel Pégourié-Gonnard c4af324a4b Merge branch 'development' into development-restricted
* development: (55 commits)
  Log change as bugfix
  Add changelog entry
  Clarify updates to the persistent state in storage
  With multiple applicable transparent drivers, the order is unspecified
  Minor clarifications
  Give some examples of purpsoses of pure-software transparent driver
  Fix typos
  Add a link to the PSA API specification
  Explain locations vs lifetimes
  Initialize key pointer in ecdh to NULL
  Add buffer zeroization when ecp_write_key fails
  Simplified key slot deletion
  Style fixes
  Use arc4random_buf instead of rand on NetBSD
  Apply review feedback
  Update open question section about public key storage
  Remove the paragraph about declaring application needs
  Change driver persistent data to a callback interface
  Rework and expand key management in opaque drivers
  Fix typos and copypasta
  ...
2020-08-14 10:11:21 +02:00
Gilles Peskine 3890f7cd3d
Merge pull request #3540 from gufe44/netbsd-rand-arc4random_buf
Use arc4random_buf instead of rand on NetBSD
2020-08-13 15:27:45 +02:00
gufe44 29fcac3263 Log change as bugfix
Signed-off-by: gufe44 <gu981@protonmail.com>
2020-08-13 06:24:42 +02:00
Gilles Peskine e900b59703
Merge pull request #719 from gabor-mezei-arm/689_zeroising_of_plaintext_buffers
Zeroising of plaintext buffers in mbedtls_ssl_read()
2020-08-12 18:51:42 +02:00
Manuel Pégourié-Gonnard 204e05404f Add ChangeLog entry for X.509 CN-type vulnerability
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-08-11 10:24:21 +02:00
gufe44 ed06d2fe78 Add changelog entry
Signed-off-by: gufe44 <gu981@protonmail.com>
2020-08-06 13:23:49 +02:00
Gilles Peskine 67a85d1d3b
Merge pull request #3492 from stevew817/rework/key_slot_contains_key_buffer
Rework PSA Crypto core to store keys in export representation
2020-08-05 21:16:11 +02:00
Steven Cooreman 3fa684ed91 Allow importing Montgomery public keys in PSA Crypto
PSA Crypto was checking the byte length of a to-be-imported public ECP key
against the expected length for Weierstrass keys, forgetting that
Curve25519/Curve448 exists.

Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-30 15:35:14 +02:00
Gilles Peskine 171826550f
Merge pull request #709 from mpg/protect-base-blinding-dev-restricted
Protect base blinding in RSA and DHM
2020-07-29 10:58:53 +02:00
Gilles Peskine 0478c2f77e Add ChangeLog entry for single-curve build fixes
Fix #941, #1412, #1147, #2017

Signed-off-by: Gilles Peskine <gilles.peskine@arm.com>
2020-07-22 03:17:24 +02:00
Gilles Peskine 5dd5a491da x509_crl_parse: fix 1-byte buffer overflow and entry->raw.tag
In the entries (mbedtls_x509_crl_entry values) on the list constructed
by mbedtls_x509_crl_parse_der(), set entry->raw.tag to
(SEQUENCE | CONSTRUCTED) rather than to the tag of the first ASN.1
element of the entry (which happens to be the tag of the serial
number, so INTEGER or INTEGER | CONTEXT_SPECIFIC). This is doesn't
really matter in practice (and in particular the value is never used
in Mbed TLS itself), and isn't documented, but at least it's
consistent with how mbedtls_x509_buf is normally used.

The primary importance of this change is that the old code tried to
access the tag of the first element of the entry even when the entry
happened to be empty. If the entry was empty and not followed by
anything else in the CRL, this could cause a read 1 byte after the end
of the buffer containing the CRL.

The test case "X509 CRL ASN1 (TBSCertList, single empty entry at end)"
hit the problematic buffer overflow, which is detected with ASan.

Credit to OSS-Fuzz for detecting the problem.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-07-16 18:40:17 +02:00
gabor-mezei-arm 3c57ccd777
Add missing newline
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-07-16 10:19:18 +02:00
gabor-mezei-arm a321413807
Zeroising of plaintext buffers to erase unused application data from memory
Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-07-15 14:14:41 +02:00
Steven Cooreman aec44e9fe8 Merge remote-tracking branch 'mbedtls/development' into montgomery-keys-clarification 2020-07-13 11:48:21 +02:00
Manuel Pégourié-Gonnard d4d6ad0363
Merge pull request #3464 from CodeMonkeyLeet/csr_heap_alloc
Dynamically allocate requested CSR write buffer size
2020-07-10 10:57:22 +02:00
Simon Leet 40ca54a9ac Revise comments for x509write_csr_der_internal
Address remaining PR comments for #2118
- Add ChangeLog.d/x509write_csr_heap_alloc.txt.
- Fix parameter alignment per Gille's recommendation.
- Update comments to more explicitly describe the manipulation of buf.
- Replace use of `MBEDTLS_MPI_MAX_SIZE` as `sig` buffer size for
  call to `x509write_csr_der_internal()` with more intuitive
  `MBEDTLS_PK_SIGNATURE_MAX_SIZE`.
- Update `mbedtls_x509write_csr_der()` to return
  `MBEDTLS_ERR_X509_ALLOC_FAILED` on mbedtls_calloc error.

Signed-off-by: Simon Leet <simon.leet@microsoft.com>
2020-07-08 18:32:47 +00:00
Manuel Pégourié-Gonnard 3ee91f47f4
Merge pull request #3452 from okhowang/local-labels
Use local labels in padlock.c
2020-07-07 11:48:05 +02:00
Manuel Pégourié-Gonnard fafe8553c6
Merge pull request #3392 from paul-elliott-arm/psa_ecc_dh_macros
PSA: update EC curve and DH group family macros
2020-07-07 09:20:44 +02:00
Steven Cooreman 2a48b53ee7 Added changelog entry for AES-ECB in PSA
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-06 14:42:39 +02:00
Steven Cooreman bd3a6f4497 Rewrite changelog for #3425 as requested
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-06 10:52:38 +02:00
Steven Cooreman e3fd39289e Fix endianness and masking for Curve25519 keys handled by PSA
Changed PSA core (and PKWrite) from reaching into MPI to using the proper
ecp function to fetch a private key.
Added changelog.

Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-06 10:45:31 +02:00
okhowang(王沛文) 0c4bbda16a Use local labels in padlock.c
Fixes #3451

Signed-off-by: okhowang(王沛文) <okhowang@tencent.com>
2020-07-04 01:43:41 +08:00
okhowang(王沛文) 0cd8e0f6a7 Only pass -Wformat-signedness to versions of GCC that support it.
Fixes #3478

Signed-off-by: okhowang(王沛文) <okhowang@tencent.com>
2020-07-03 16:51:14 +08:00
Manuel Pégourié-Gonnard 527b87890d
Merge pull request #3454 from gilles-peskine-arm/include-common-h-development
Include common.h from all library source files
2020-07-03 09:44:18 +02:00
Paul Elliott 06a28082af Add Changelog entry for PSA DH/ECC Macros rename
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-07-02 17:00:06 +01:00
Gilles Peskine 280165c9b3 Library files aren't supposed to be executable
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-07-02 13:19:17 +02:00
Janos Follath be9a5752c2 Merge tag 'mbedtls-2.23.0' into merge-2.23.0-release-to-development
Mbed TLS 2.23.0
2020-07-01 11:23:17 +01:00
Janos Follath 1959010c4b Assemble changelog
Executed scripts/assemble_changelog.py and manually fixed style where it
diverged from the instructions in ChangeLog.d/00README.md.

Manually added ChangeLog.d/bugfix_PR3405 which didn't have the .txt
extension as prescribed in ChangeLog.d/00README.md and deleted it
afterwards.

Signed-off-by: Janos Follath <janos.follath@arm.com>
2020-06-29 22:35:07 +01:00
Gilles Peskine 961914df12
Merge pull request #3382 from stevew817/feature/volatile-keys-in-SE
Support volatile keys in external SE
2020-06-26 20:27:11 +02:00
Manuel Pégourié-Gonnard 34c1e7d069 Add ChangeLog entry for base blinding protection
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-06-26 11:33:41 +02:00
Janos Follath a805c4d328 Add ChangeLog entry for #3319: fix typo in test
Signed-off-by: Janos Follath <janos.follath@arm.com>
2020-06-25 13:29:46 +01:00
Janos Follath 0b849818d3 Add ChangeLog entry for #3311: fix uninitialised variable
Signed-off-by: Janos Follath <janos.follath@arm.com>
2020-06-25 13:28:58 +01:00
Janos Follath 3ec2e4a464 Add ChangeLog entry for #3239: win2k net support
Signed-off-by: Janos Follath <janos.follath@arm.com>
2020-06-25 13:28:51 +01:00
Janos Follath 8a43bd1d20 Add ChangeLog entry for #3217: avoid re-assignment
Signed-off-by: Janos Follath <janos.follath@arm.com>
2020-06-25 13:27:54 +01:00
Janos Follath f8f5026a3b Add ChangeLog entry for #3147: MSVC flags
Signed-off-by: Janos Follath <janos.follath@arm.com>
2020-06-25 13:27:06 +01:00
Manuel Pégourié-Gonnard db61c3503b Merge branch 'development' into development-restricted
* development: (87 commits)
  entropy: Adjust parameter type of internal function to avoid a cast
  entropy: Avoid arithmetic on void pointer
  add comment about potential future extension
  Adjust comments about SEED synchronisation
  entropy: Rename sysctl_wrapper to sysctl_arnd_wrapper
  test_suite_x509parse.function improvement
  Pass "certificate policies" extension to callback
  Update iv and len context pointers manually when reallocating buffers
  Add Apache-2.0 headers to all source files
  Remove Dangerous Parameter Passing
  Add Apache-2.0 headers to all scripts
  Add missing copyright dates to scripts and sources
  Show failure in ssl-opts.sh  when key export fails
  Add changelog entry
  tests: Reformating due to rnd_* renaming
  tests: Add mbedtls_test_ prefix to rnd_* symbols
  tests: Reformating due to hexcmp() renaming
  tests: Add mbedtls_test_ prefix to hexcmp()
  tests: Reformating due to unhexify_alloc() renaming
  tests: Add mbedtls_test_ prefix to unhexify_alloc()
  ...
2020-06-25 11:53:43 +02:00
Janos Follath 4d1884916b Merge branch 'development-restricted' into mbedtls-2.23.0r0 2020-06-25 09:17:25 +01:00
Manuel Pégourié-Gonnard 1cb2beb905
Merge pull request #3423 from niacat/sysctl-arnd
entropy: Add support for BSD sysctl(KERN_ARND)
2020-06-25 09:34:20 +02:00
Manuel Pégourié-Gonnard 1c7d54a209
Merge pull request #700 from mpg/l13-hw-starts-finish-restricted
Lucky 13: just use starts/finish around calls to process()
2020-06-23 10:43:13 +02:00
Gilles Peskine dda104558b
Merge pull request #3419 from ndilieto/development
Pass "certificate policies" extension to callback
2020-06-23 09:35:45 +02:00
Gilles Peskine e81dc00df4
Merge pull request #3422 from niacat/net-sockets-fixes
NetBSD 9.0 build fixes
2020-06-22 23:33:53 +02:00
Manuel Pégourié-Gonnard d335f2b6cb
Merge pull request #3421 from niacat/posix_c_source
Define _POSIX_C_SOURCE to be 200112L, as a minimum for C99.
2020-06-18 13:01:38 +02:00
Nicola Di Lieto c84b1e6aa0 Pass "certificate policies" extension to callback
Pass the "certificate policies" extension to the callback supplied to
mbedtls_x509_crt_parse_der_with_ext_cb() if it contains unsupported
policies. This allows the callback to fully replicate the behaviour
of the deprecated MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
configuration.

Signed-off-by: Nicola Di Lieto <nicola.dilieto@gmail.com>
2020-06-17 17:55:29 +02:00
Steven Cooreman 14b8184db1 Added missing newline in changelog entry
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-17 13:54:18 +02:00
Steven Cooreman de18338865 Add changelog entry for #3382
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-17 13:54:18 +02:00
danh-arm c4b6656a91
Merge pull request #3405 from AndrzejKurek/variable-buffers-cid-serialization
Update iv and len context pointers manually when reallocating buffers
2020-06-17 12:26:24 +01:00
Andrzej Kurek b657783269
Update iv and len context pointers manually when reallocating buffers
These fields might be shifted accordingly in `ssl_parse_record_header()`
when receiving a connection with CID, so they require a manual update
after calling the generic `mbedtls_ssl_reset_in_out_pointers()`.

This commit also adds a regression test which is run by all.sh.

Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2020-06-16 11:54:51 -04:00
Manuel Pégourié-Gonnard f4e3fc9133 Use starts/finish around Lucky 13 dummy compressions
Fixes #3246

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-06-15 11:55:53 +02:00
Manuel Pégourié-Gonnard b21b1f5e7c
Merge pull request #3387 from ronald-cron-arm/tests-common-code
Add support to build and link common code in tests
2020-06-15 11:33:19 +02:00
Manuel Pégourié-Gonnard a92e3def48
Merge pull request #873 from hanno-arm/ssl_write_client_hello
Bounds checks in ssl_write_client_hello
2020-06-15 10:57:51 +02:00
Ronald Cron ff1825ec19 Add changelog entry
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-06-12 14:48:47 +02:00
nia ecef1ddd5b Add ChangeLog.d entry for PR3421
Signed-off-by: nia <nia@netbsd.org>
2020-06-11 18:43:59 +01:00
nia 6777dcb16f Add ChangeLog.d entry for kern.arandom support.
Signed-off-by: nia <nia@netbsd.org>
2020-06-11 14:08:07 +01:00
nia 508e21ccfd Add ChangeLog.d entry for #3422
Signed-off-by: nia <nia@netbsd.org>
2020-06-11 14:05:41 +01:00
Manuel Pégourié-Gonnard 87a51aa08e
Merge pull request #3243 from ndilieto/development
New mbedtls_x509_crt_parse_der_with_ext_cb() routine
2020-06-10 12:59:58 +02:00
okhowang(王沛文) 3c1b090e58 Use FindPython3 when cmake version >= 3.15.0
Signed-off-by: okhowang(王沛文) <okhowang@tencent.com>
2020-06-10 10:21:50 +08:00
danh-arm 5afc4c7124
Merge pull request #3333 from irwir/fix_vcxproj2
Fix minor issues in MSVC projects.
2020-06-09 15:43:49 +01:00
irwir 672257b7d9 Add changelog entry
Signed-off-by: irwir <irwir@users.noreply.github.com>
2020-06-09 15:03:03 +03:00
Janos Follath 3c4a46c44a
Merge pull request #3398 from gilles-peskine-arm/montmul-cmp-branch-development
Remove a secret-dependent branch in Montgomery multiplication
2020-06-09 12:40:51 +01:00
Manuel Pégourié-Gonnard c721178487 Add Security ChangeLog entry for lack of blinding
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-06-08 09:09:20 +02:00
Manuel Pégourié-Gonnard 1a3f9edc08 Add config.h option MBEDTLS_ECP_NO_INTERNAL_RNG
No effect so far, except on dependency checking, as the feature it's meant to
disable isn't implemented yet (so the descriptions in config.h and the
ChangeLog entry are anticipation for now).

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-06-08 09:09:20 +02:00
Manuel Pégourié-Gonnard e860fef438
Merge pull request #3318 from Jonas4420/development
Fix potential memory leak in EC multiplication
2020-06-05 11:43:52 +02:00
Gilles Peskine d55bfe962a Add changelog entry: fix #3394
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-04 21:55:23 +02:00
Manuel Pégourié-Gonnard bd004e862d
Merge pull request #3320 from gilles-peskine-arm/check-files-changelog-development
Check changelog entries on CI
2020-06-02 09:38:37 +02:00
Nicola Di Lieto 110a794e93 Add ChangeLog.d/new-mbedtls_x509_crt_parse_der_with_ext_cb_routine.txt
Signed-off-by: Nicola Di Lieto <nicola.dilieto@gmail.com>
2020-05-29 23:27:47 +02:00
Hanno Becker 261602cb34 Uniformize bounds checks using new macro
This commit uses the previously defined macro to uniformize
bounds checks in several places. It also adds bounds checks to
the ClientHello writing function that were previously missing.
Also, the functions adding extensions to the ClientHello message
can now fail if the buffer is too small or a different error
condition occurs, and moreover they take an additional buffer
end parameter to free them from the assumption that one is
writing to the default output buffer.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-05-29 15:07:00 +02:00
Gilles Peskine 6147e86e5d
Merge pull request #3350 from gilles-peskine-arm/error-include-asn1-development
Include asn1.h in error.c
2020-05-28 15:09:20 +02:00
Jonas b246214ade Fix Changelag PR number and uniformize code when prng fails
Signed-off-by: Jonas <jonas.lejeune4420@gmail.com>
2020-05-28 20:02:40 +09:00
Gilles Peskine ba968a723b Wrap line to 79 columns
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:55:10 +02:00
Gilles Peskine ee40e76943 Normalize line endings
Convert all text files to Unix line endings unless they're Windows
stuff.

Make sure that all text files have a trailing newline.

Remove whitespace at the end of lines.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-27 21:55:08 +02:00
Gilles Peskine b1ccff8725
Merge pull request #2855 from irwir/fix_x509_crt.c
Remove non-working check from x509_get_subject_alt_name
2020-05-26 18:32:16 +02:00
Gilles Peskine deacf60f79
Merge pull request #3326 from kohnakagawa/fix/utf-8_encoding_bug
fix mbedtls_x509_dn_gets to show non-ASCII string properly
2020-05-25 14:18:48 +02:00
Gilles Peskine 7c3468efbc Fix #3328
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-25 12:26:04 +02:00
Ørjan Malde 479d8de31d Add support for midipix, a POSIX layer for Microsoft Windows
Signed-off-by: Ørjan Malde <orjan.malde@foxi.me>
2020-05-20 18:14:45 +00:00
Koh M. Nakagawa 46b8782a72 fix mbedtls_x509_dn_gets to escape non-ASCII characters
Signed-off-by: Koh M. Nakagawa <tsunekou1019@gmail.com>
2020-05-21 01:56:55 +09:00
irwir d742a2416d Add changelog entry
Signed-off-by: irwir <irwir@users.noreply.github.com>
2020-05-20 18:24:12 +03:00
Manuel Pégourié-Gonnard 5eae4dd08e
Merge pull request #3301 from Patater/inline-mbedtls_ecc_group_to_psa
psa: Define mbedtls_ecc_group_to_psa() inline
2020-05-19 09:06:04 +02:00
Gilles Peskine ee61b6601e
Merge pull request #3302 from gilles-peskine-arm/psa-lifetime-persistence-indicator
Define some structure for lifetime values
2020-05-14 16:13:20 +02:00
Jonas 4a67182962 Add Changelog entry for #3318
Signed-off-by: Jonas <jonas.lejeune4420@gmail.com>
2020-05-13 14:25:57 +09:00
Gilles Peskine e24fc7b0a1
Merge pull request #2595 from k-stachowiak/unified-exit-in-examples
Unify the example programs' termination
2020-05-12 10:46:47 +02:00
Gilles Peskine b88bb5fd7f Add changelog entry file
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-11 22:13:27 +02:00
Gilles Peskine c39a80daee
Merge pull request #3312 from sander-visser/cleanup-nullptr-deref
Scope reduction to enable NULL check to protect dereferencing.
2020-05-11 21:59:07 +02:00
Gilles Peskine fb79dfef47 Changelog entry noting the behavior change and storage format change
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-11 11:15:26 +02:00
sander-visser a65fe0b8cb Add changelog entry for #3310.
Signed-off-by: sander-visser <github@visser.se>
2020-05-07 22:06:49 +02:00
sander-visser c64b72394d Add Changelog entry for #3312
Signed-off-by: sander-visser <github@visser.se>
2020-05-07 20:09:30 +02:00
Darryl Green 2f0eb51aae psa: Define mbedtls_ecc_group_to_psa() inline
On dual world platforms, we want to run the PK module (pk.c) on the NS
side so TLS can use PSA APIs via the PK interface. PK currently has a
hard dependency on mbedtls_ecc_group_to_psa() which is declared in
crypto_extra.h, but only defined in psa_crypto.c, which is only built
for the S side.

Without this change, dual world platforms get error messages like the
following.

    [Error] @0,0: L6218E: Undefined symbol mbedtls_ecc_group_to_psa (referred from BUILD/LPC55S69_NS/ARM/mbed-os/features/mbedtls/mbed-crypto/src/pk.o)

Make mbedtls_ecc_group_to_psa() inline within crypto_extra.h so that it
is available to both NS and S world code.

Fixes #3300

Signed-off-by: Darryl Green <darryl.green@arm.com>
Signed-off-by: Jaeden Amero <jaeden.amero@arm.com>
2020-05-05 12:41:48 +01:00
Gilles Peskine bdd5ba98e8
Merge pull request #3216 from gilles-peskine-arm/changelog-20200421-development
Add missing changelog entries for PRs since 2.22.0
2020-04-28 13:10:36 +02:00
Manuel Pégourié-Gonnard 0c103a8f40
Merge pull request #2853 from irwir/fix_vcxproj
Finalize fixing bugs in .vcxproj files
2020-04-28 13:03:13 +02:00
Gilles Peskine 4830d2134b Use () after function name
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-28 12:10:02 +02:00
Manuel Pégourié-Gonnard b1c8e41ae3
Merge pull request #3209 from aurel32/fix-ecp_double_add_mxz
Fix wrong modulo call in ecp_double_add_mxz
2020-04-24 09:28:17 +02:00
Aurelien Jarno 66deb38d64 Fix wrong modulo call in ecp_double_add_mxz
ecp_double_add_mxz wrongly does an MPI addition followed by a call to
MOD_MUL instead of MOD_ADD. This is more visible since the
mbedtls_mpi_xxx_mod functions have been added in commit 3b3b34f608
("Replace some macros by functions").

Fix that by using mbedtls_mpi_add_mod instead. The testsuite still
passes after that change.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
2020-04-23 23:16:11 +02:00
Kenneth Soerensen 518d435e7b Fix GCC format-signedness warnings
Signed-off-by: Kenneth Soerensen <knnthsrnsn@gmail.com>
2020-04-22 16:01:48 +02:00
Gilles Peskine 19028a8bb1 Add changelog entry for #3150: simplify ssl_write_certificate_request
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-22 09:51:51 +02:00
Gilles Peskine bdc639b86f Add changelog entry for #3208: md.c switch case unification
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-21 20:19:29 +02:00
Gilles Peskine fd0627521b Add changelog entry for #3176: new error functions
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-21 20:18:26 +02:00
Gilles Peskine 14884f9822 Add changelog entry for #3127: ssl_context_info
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-21 20:15:37 +02:00
Gilles Peskine e7a5386eb9 Add changelog entry for #3192: x509_crt max_pathlen int overflow fix
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-21 19:56:53 +02:00
irwir af81957abd Add changelog
Signed-off-by: irwir <irwir@users.noreply.github.com>
2020-04-20 13:23:21 +03:00
Gilles Peskine b695d5e30a Add guidance on writing and maintaining changelog entries
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-03-27 20:14:19 +01:00
Gilles Peskine 7c3f7cdeae Convert ChangeLog.d/README to markdown
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-03-27 20:14:19 +01:00
Gilles Peskine 6e97c43959 Switch to the classic Mbed TLS ChangeLog format
Instead of working with Markdown format, keep the classic Mbed TLS
ChangeLog format, with the classic category names. Keep the classic
file name as well. This way there's no risk of breaking third-party
scripts that may copy or even parse the changelog file.

Accordingly, expect ChangeLog/*.txt files instead of ChangeLog/*.md.

This commit completely rewrites the parsing and output code.

This commit systematically appends to the existing top version. A
subsequent commit will restore the capability of creating a new
version.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-03-27 20:13:45 +01:00
Gilles Peskine 40b3f411ec Changelog merging script
assemble_changelog.py reads changelog entries from ChangeLog.d/*.md
and merges them into ChangeLog.md.

The changelog entries are merged into the first version in
ChangeLog.md. The script does not yet support creating a new version
in ChangeLog.md.

The changelog entries are merged in alphabetical order of the file
names. Future versions of this script are likely to adopt a different
order that reflects the git history of the entries.
2019-10-13 21:44:25 +02:00