Commit graph

9547 commits

Author SHA1 Message Date
Gilles Peskine 1724bd2a4f
Merge pull request #4322 from gilles-peskine-arm/ecp-add-fix-tests-2.16
Backport 2.16: Test read of zero-padded negative number
2021-04-15 14:00:50 +02:00
Gilles Peskine 52d0b48f04
Merge pull request #4346 from mstarzyk-mobica/long_url_backport_mbedtls_216
Backport 2.16: Allow changelog entries to have URLs exceeding 80 char limit.
2021-04-15 11:12:24 +02:00
Mateusz Starzyk 270626ee70 Allow changelog entries to have URLs exceeding 80 char limit.
Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-04-15 10:05:03 +02:00
Gilles Peskine 5a1d0fc55f Fix copypasta in test case description
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-13 11:12:22 +02:00
Gilles Peskine 8d2b7aaede
Merge pull request #4337 from gilles-peskine-arm/changelog_linelength_enforcement-2.16
Backport 2.16: Make assemble changelog script enforce line length
2021-04-12 20:49:23 +02:00
Gilles Peskine 08d6737368 Explain the problem in more concrete terms
Don't try to make the reader guess what a “negative zero” might mean.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-12 17:17:34 +02:00
Paul Elliott 0ec5979461 Pythonify and fix reported line number
Use enumerate to give the line number and use the correct offset to
actually calculate it.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-12 16:18:30 +02:00
Paul Elliott 217565ef4e Improve error message
Make sure line number reported is correct for the overly long line, and
change the message to be more readable.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-12 16:18:29 +02:00
Paul Elliott 46bef5f929 Remove changelog entry
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-12 16:18:28 +02:00
Paul Elliott c24a1e86da Make assemble changelog script enforce line length
As I descovered, a changelog entry with a line length greater than 80
characters would still pass CI. This is a quick change to the script to
make it detect these descrepancies and fail.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-12 16:18:26 +02:00
Gilles Peskine cd7d074ff9 mbedtls_mpi_read_string("-0") no longer produces a "negative zero"
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-09 17:11:34 +02:00
Gilles Peskine 2c8cfcf59f Fix an incorrect comment about fix_negative
We're subtracting multiples of 2^bits, not 2^(bits+32).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-09 16:32:08 +02:00
Gilles Peskine c3ccae7faf Unit test function for mbedtls_ecp_muladd
Write a simple unit test for mbedtls_ecp_muladd().

Add just one pair of test cases. One of them causes the argument to
fix_negative to have an argument with an all-bits-zero least
significant limb which briefly triggered a branch in Mbed TLS 2.26+.
See https://github.com/ARMmbed/mbedtls/issues/4296 and
https://github.com/ARMmbed/mbedtls/pull/4297.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-09 16:32:08 +02:00
Gilles Peskine 984fd07c53 Fix and simplify sign handling in mbedtls_mpi_read_string
Move the handling of the sign out of the base-specific loops. This
both simplifies the code, and corrects an edge case: the code in the
non-hexadecimal case depended on mbedtls_mpi_mul_int() preserving the
sign bit when multiplying a "negative zero" MPI by an integer, which
used to be the case but stopped with PR #2512.

Fix #4295. Thanks to Guido Vranken for analyzing the cause of the bug.
Credit to OSS-Fuzz.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-09 16:32:08 +02:00
Gilles Peskine 228b98f24f Add a few unit tests for mbedtls_mpi_read_string with leading zeros
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-09 16:25:36 +02:00
Dave Rodgman 384a0880c4
Merge pull request #4310 from daverodgman/check-names-grep-backport-2.16
Backport 2.16: Make check-names.sh accept any grep
2021-04-07 15:29:03 +01:00
Dave Rodgman aa9dfbfdf4 Make check-names.sh accept any grep
check-names.sh works fine with GNU and with modern FreeBSD grep
so remove the check for GNU grep.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-04-07 15:03:53 +01:00
Gilles Peskine 05371be430
Merge pull request #3905 from gilles-peskine-arm/ssl-opt-less-grep-2.16
Backport 2.16: Speed up ssl-opt.sh when running a small number of test cases
2021-04-06 11:05:39 +02:00
Ronald Cron b72f0ed48a
Merge pull request #4273 from gilles-peskine-arm/etags-no-line-directive-2.16
Backport 2.16: TAGS: Fix lookup in test/suites/!(test_suite_*).function
2021-03-31 08:25:47 +02:00
Gilles Peskine f70a3144a0 TAGS: Fix lookup in test/suites/!(test_suite_*).function
tests/suites/helpers.function and tests/suites/*_test.function contain
"#line" directives. This causes the TAGS file to contain references
pointing to the file path named in the "#line" directives, which is
relative to the "tests" directory rather than to the toplevel. Fix
this by telling etags to ignore "#line" directives, which is ok since
we aren't actually running it on any generated code.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-30 17:34:02 +02:00
Gilles Peskine cb25374b2c
Merge pull request #3720 from militant-daos/mbedtls-2.16
backport 2.16: Fix premature fopen() call in mbedtls_entropy_write_seed_file
2021-03-30 17:33:12 +02:00
Gilles Peskine 09d33092cb
Merge pull request #4230 from rrlapointe/dtls_demo_use_read_timeout_2.16
2.16: Actually use the READ_TIMEOUT_MS in the example DTLS client and server
2021-03-17 14:39:47 +01:00
Ryan LaPointe d80763761f Fix inaccurate comment in sample DTLS server
Signed-off-by: Ryan LaPointe <ryan@ryanlapointe.org>
2021-03-15 16:55:10 -04:00
Ryan LaPointe a7e586bc2f Actually use the READ_TIMEOUT_MS in the sample DTLS client and server
Signed-off-by: Ryan LaPointe <ryan@ryanlapointe.org>
2021-03-15 16:55:03 -04:00
Gilles Peskine c5714bb4ea Fix regexp detection
In a case exprssion, `|` separates patterns so it needs to be quoted.
Also `\` was not actually part of the set since it was quoting another
character.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-10 23:31:11 +01:00
Gilles Peskine b7bb068b84 Avoid using grep for test case names if possible
If `$FILTER` (`-f`) and `$EXCLUDE` (`-e`) are simple selections that
can be expressed as shell patterns, use a case statement instead of
calling grep to determine whether a test case should be executed.
Using a case statement significantly reduces the time it takes to
determine that a test case is excluded (but the improvement is small
compared to running the test).

This noticeably speeds up running a single test or a small number of
tests. Before:
```
tests/ssl-opt.sh -f Default  1.75s user 0.54s system 79% cpu 2.885 total
```
After:
```
tests/ssl-opt.sh -f Default  0.37s user 0.14s system 29% cpu 1.715 total
```
There is no perceptible difference when running a large number of tests.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-10 23:31:05 +01:00
Gilles Peskine 5bf15b6d63 Reduce the use of grep
Avoid using the external command grep for simple string-based checks.
Prefer a case statement. This improves performance.

The performance improvement is moderate but noticeable when skipping
most tests. When a test is run, the cost of the associated grep calls
is negligible. In this commit, I focused on the uses of grep that can
be easily replaced and that are executed a large number of times.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-10 23:31:02 +01:00
Dave Rodgman d61fa61bef
Merge pull request #814 from ARMmbed/mbedtls-2.16.10-rc0-pr
Mbedtls 2.16.10 rc0 pr
2021-03-09 18:02:13 +00:00
Dave Rodgman 7bee63a310 Bump version to Mbed TLS 2.16.10
Executed ./scripts/bump_version.sh --version 2.16.10

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-03-09 16:03:29 +00:00
Dave Rodgman c776582dc3 Update Changelog for 2.16.10
Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-03-08 18:31:02 +00:00
Dave Rodgman 18a8698e76 Add missing changelog entry
Add missing changelog entry for 4044: Mark basic constraints critical
as appropriate.

Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-03-08 18:29:22 +00:00
Dave Rodgman 2ed6fe0b30 Merge branch 'mbedtls-2.16-restricted' into mbedtls-2.16.10-rc 2021-03-08 16:46:51 +00:00
Manuel Pégourié-Gonnard c785394ba6
Merge pull request #810 from paul-elliott-arm/cf_base64_work_2_16
Backport 2.16: Constant Flow Base64 Table Access
2021-03-04 17:25:43 +01:00
Paul Elliott cd65b62f21 Code style fixups
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:43:17 +00:00
Paul Elliott 0c0f9adab1 Fixup changelog formatting
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:43:01 +00:00
Paul Elliott c22d0b9d5b Fix misnamed base64 test
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:42:46 +00:00
Paul Elliott 4823624542 Fix carelessly copy pasted comment
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott 490c5d4628 Fix constant flow mask maths
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott 6f69d4c7e2 Remove multiplication from conditional assignments
Multiplication is not constant flow on any CPU we are generally
targetting, so replace this with bit twiddling.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott 4c71707987 Prevent false positive CF Test Failures
Marked dirty memory ends up in the result buffer after encoding (due to
the input having been marked dirty), and then the final comparison
to make sure that we got what we expected was triggering the constant
flow checker.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott 7dac825a3c Add further more rigorous tests for base64
Original author was gilles.peskine@arm.com

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott e8ee0f1a94 Fix Non CF access to table in base64 decrypt
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott 6a66737433 Optimise unneccesary cf table accesses away
Also fix missed bare access of base_64_dec_map

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott 86cb928e54 Fix incorrect assumptions about the size of size_t
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott f13a47bbb2 Fixes for MSVC warnings
Also added a couple of missing comment blocks.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott 8d265f75a4 Add Changelog entry
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:13 +00:00
Paul Elliott 69b904b679 First pass at constant flow tests for base64
This contains working CF tests for encode, however I have not yet got
decode to pass the tests.

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 14:08:12 +00:00
Janos Follath 1b6a24f759
Merge pull request #4180 from gilles-peskine-arm/net_poll-fd_setsize-2.16
Backport 2.16: Fix stack corruption in mbedtls_net_poll with large file descriptor
2021-03-04 12:15:53 +00:00
Paul Elliott 738d2310a7 Attempt to make Base64 table access constant flow
Add constant flow table access code, and use that exclusively to access
the base64 lookup table

Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-03-04 10:28:01 +00:00
Gilles Peskine 388a9d3a8b Update error codes listed in the net_sockets documentation
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-03 12:35:46 +01:00