Commit graph

5808 commits

Author SHA1 Message Date
Ron Eldor eba5dabc61 Resource leak fix on windows platform
Fix a resource leak on windows platform, in mbedtls_x509_crt_parse_path,
in case a failure. when an error occurs, goto cleanup, and free the
resource, instead of returning error code immediately.
2017-07-20 01:02:40 +02:00
Ron Eldor 85bdcf8c16 Wrong preproccessor condition fix
Fix for issue #696
Change #if defined(MBEDTLS_THREADING_PTHREAD)
to #if defined(MBEDTLS_THREADING_C)
2017-07-20 00:44:57 +02:00
Ron Eldor e1b92fee55 fix for issue 1118: check if iv is zero in gcm.
1) found by roberto in mbedtls forum
2) if iv_len is zero, return an error
3) add tests for invalid parameters
2017-07-20 00:11:24 +02:00
Ron Eldor ee5a0ca3bb Minor: Fix typos in program comments
Fix a couple of typos and writer's mistakes,
in some reference program applications
2017-07-19 23:33:24 +02:00
Andres Amaya Garcia 6f45598d32 Add ChangeLog entry for config-no-entropy.h change 2017-07-19 12:24:45 +01:00
Andres Amaya Garcia 8c1b0be111 Enable MBEDTLS_AES_ROM_TABLES in config-no-entropy
Enable the MBEDTLS_AES_ROM_TABLES option in the
configs/config-no-entropy.h to place AES lookup tables in ROM. This
saves considerable RAM space, a resource that is very limited in small
devices that use this configuration.
2017-07-19 12:22:48 +01:00
Janos Follath a9e775efe4 Remove mutexes from ECP hardware acceleration
Protecting the ECP hardware acceleratior with mutexes is inconsistent with the
philosophy of the library. Pre-existing hardware accelerator interfaces
leave concurrency support to the underlying platform.

Fixes #863
2017-07-19 02:07:59 +01:00
Hanno Becker 248ae6dbb8 Improve documentation of PKCS1 decryption functions
Document the preconditions on the input and output buffers for
the PKCS1 decryption functions
- mbedtls_rsa_pkcs1_decrypt,
- mbedtls_rsa_rsaes_pkcs1_v15_decrypt
- mbedtls_rsa_rsaes_oaep_decrypt
2017-07-19 01:46:44 +01:00
Martijn de Milliano b194a283a9 dh_server: Fixed expected number of bytes received from client when receiving public value. 2017-07-06 23:55:59 +02:00
Manuel Pégourié-Gonnard 760c9b91d7 Update doc of return value of verify() 2017-07-06 15:00:32 +02:00
Manuel Pégourié-Gonnard 5be13d8fd1 Make test script more portable
seq isn't POSIX and isn't present by default on BSDs
2017-07-06 14:31:54 +02:00
Manuel Pégourié-Gonnard 9107b5fdd3 Improve comments 2017-07-06 12:16:25 +02:00
Manuel Pégourié-Gonnard ee98109af5 Add ChangeLog entry for the security issue 2017-07-06 11:58:41 +02:00
Manuel Pégourié-Gonnard 81bb6b6acf Add SSL tests for long cert chains 2017-07-06 11:58:41 +02:00
Manuel Pégourié-Gonnard 31458a1878 Only return VERIFY_FAILED from a single point
Everything else is a fatal error. Also improve documentation about that for
the vrfy callback.
2017-07-06 11:58:41 +02:00
Manuel Pégourié-Gonnard d15795acd5 Improve behaviour on fatal errors
If we didn't walk the whole chain, then there may be any kind of errors in the
part of the chain we didn't check, so setting all flags looks like the safe
thing to do.
2017-07-06 11:58:41 +02:00
Manuel Pégourié-Gonnard 1beb048316 Add test for limit on intermediate certificates
Inspired by test code provided by Nicholas Wilson in PR #351.

The test will fail if someone sets MAX_INTERMEDIATE_CA to a value larger than
18 (default is 8), which is hopefully unlikely and can easily be fixed by
running long.sh again with a larger value if it ever happens.

Current behaviour is suboptimal as flags are not set, but currently the goal
is only to document/test existing behaviour.
2017-07-06 11:57:31 +02:00
Andres Amaya Garcia fe9483184f Remove malloc references in mbedtls/scripts 2017-07-06 10:34:12 +01:00
Andres Amaya Garcia f01a644aac Add ChangeLog entry 2017-07-03 16:00:59 +01:00
Andres Amaya Garcia 7a005e2fa4 Remove invalid doxygen docs from deprecated func 2017-07-03 14:42:34 +01:00
Andres Amaya Garcia 276ebb650e Add stdlib.h include to hello.c sample 2017-07-03 11:16:57 +01:00
Andres Amaya Garcia 1a607a1b9a Change ssl_tls to use new MD API and check ret code 2017-06-29 17:09:42 +01:00
Andres Amaya Garcia 95869c4934 Do not start md accumulator in mbedtls_entropy_init
This change moves the calls to mbedtls_sha256_starts() and
mbedtls_sha512_starts() out of the mbedtls_entropy_init() function as
these now have return codes which need to be checked.
2017-06-29 16:31:44 +01:00
Andres Amaya Garcia a7559cb7ba Fix entropy module to work with hw accelerator
This patch modifies the entropy.c module to ensure that the sha256 and
sha512 contexts are correctly initialised and freed instead of skipping
these calls or simply zeroizing with memset() or mbedtls_zeroize().
This is important as the sha contexts might otherwise leak memory or
other resources, and even more so in the context of hardware
accelerators where the configuration of the device might be done in the
init and free calls.
2017-06-29 16:27:15 +01:00
Andres Amaya Garcia 207cea57f9 Change entropy to use new MD API and check ret code 2017-06-29 15:57:46 +01:00
Andres Amaya Garcia 8d08c4489e Change pem to use new MD API and check ret code 2017-06-29 11:16:38 +01:00
Andres Amaya Garcia 0dd4fa0f45 Fix functions in MD layer to check return codes 2017-06-28 14:16:07 +01:00
Andres Amaya Garcia 5f872df26a Change func ptrs to have ret val in MD layer
This patch modifies the internal md context structure in md_wrap.c to
add return values to the function pointers. This enables us to use the
new API in the corresponding MD modules so that failures can be
found at any point in an MD computation.
2017-06-28 14:12:44 +01:00
Andres Amaya Garcia 1ff60f437f Change examples to use the new MD API and check ret code 2017-06-28 13:26:36 +01:00
Andres Amaya Garcia d21d625e1f Change ssl_srv to new MD API and check return code 2017-06-28 13:09:05 +01:00
Andres Amaya Garcia f0e521e9f1 Change ssl_cli to new MD API and check return code 2017-06-28 13:05:06 +01:00
Andres Amaya Garcia 698089e07e Change RSA to use new MD API and check return code 2017-06-28 13:01:15 +01:00
Andres Amaya Garcia 8d8204fc6f Change x509write_crt to use new MD API ret code 2017-06-28 12:52:16 +01:00
Andres Amaya Garcia b71b630730 Change test suites to use new MD API with ret code 2017-06-28 12:52:16 +01:00
Andres Amaya Garcia cccfe08530 Rename md process functions with _internal_ 2017-06-28 12:52:16 +01:00
Andres Amaya Garcia 614c689e05 Add int return values to SHA-512 function calls
The following function calls are being deprecated to introduce int
return values.
    * mbedtls_sha512()
    * mbedtls_sha512_starts()
    * mbedtls_sha512_update()
    * mbedtls_sha512_finish()
    * mbedtls_sha512_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
2017-06-28 12:52:16 +01:00
Andres Amaya Garcia 72a7f53064 Add int return values to SHA-256 function calls
The following function calls are being deprecated to introduce int
return values.
    * mbedtls_sha256()
    * mbedtls_sha256_starts()
    * mbedtls_sha256_update()
    * mbedtls_sha256_finish()
    * mbedtls_sha256_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
2017-06-28 12:52:16 +01:00
Andres Amaya Garcia b1a8bf9725 Add int return values to RIPEMD-160 function calls
The following function calls are being deprecated to introduce int
return values.
    * mbedtls_ripemd160()
    * mbedtls_ripemd160_starts()
    * mbedtls_ripemd160_update()
    * mbedtls_ripemd160_finish()
    * mbedtls_ripemd160_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
2017-06-28 12:52:16 +01:00
Andres Amaya Garcia 2cfd7a982c Add int return values to MD5 function calls
The following function calls are being deprecated to introduce int
return values.
    * mbedtls_md5()
    * mbedtls_md5_starts()
    * mbedtls_md5_update()
    * mbedtls_md5_finish()
    * mbedtls_md5_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
2017-06-28 12:52:16 +01:00
Andres Amaya Garcia bee0635b15 Add int return values to MD4 function calls
The following function calls are being deprecated to introduce int
return values.
    * mbedtls_md4()
    * mbedtls_md4_starts()
    * mbedtls_md4_update()
    * mbedtls_md4_finish()
    * mbedtls_md4_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
2017-06-28 12:52:16 +01:00
Andres Amaya Garcia 1d85213602 Add int return values to MD2 function calls
The following function calls are being deprecated to introduce int
return values.
    * mbedtls_md2()
    * mbedtls_md2_starts()
    * mbedtls_md2_update()
    * mbedtls_md2_finish()
    * mbedtls_md2_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
2017-06-28 12:52:15 +01:00
Andres Amaya Garcia 034ea7e754 Add int return values to SHA1 function calls
The following function calls are being deprecated to introduce int
return values.
    * mbedtls_sha1()
    * mbedtls_sha1_starts()
    * mbedtls_sha1_update()
    * mbedtls_sha1_finish()
    * mbedtls_sha1_process()
The return codes can be used to return error values. This is important
when using hardware accelerators.
2017-06-28 12:52:15 +01:00
Andres Amaya Garcia 79ae065117 Add ChangeLog entry for IAR compilation warnings 2017-06-27 16:37:40 +01:00
Andres Amaya Garcia 53c77cccc9 Initialise pointers to avoid IAR compiler warnings 2017-06-27 16:15:06 +01:00
Simon Butcher f2a597fa3d Update the version number to 2.5.1 2017-06-20 23:08:10 +01:00
Janos Follath 5a1c0e7162 Improve Changelog 2017-06-16 12:27:47 +01:00
Andres Amaya Garcia d3e7e7d83f Add comment for skipped AES-192 test condition 2017-06-15 16:17:46 +01:00
Andres Amaya Garcia 2a078da134 Run AES-GCM-192 selftest if available only
This patch modifies the function mbedtls_gcm_self_test() function to
ensure that AES-GCM-192 tests are only run if the key size is supported
by the available implementation. This is useful when using
MBEDTLS_AES_ALT as some hardware crypto accelerators might not support
AES-192.
2017-06-15 11:45:23 +01:00
Andres Amaya Garcia 58f98c23d5 Run AES-192 selftest if available only
This patch modifies the function mbedtls_aes_selftest() function to
ensure that AES-192 tests are only run if the key size is supported by
the available implementation. This is useful when using MBEDTLS_AES_ALT
as some hardware crypto accelerators might not support AES-192.
2017-06-14 16:19:42 +01:00
Andres Amaya Garcia fd48739461 Add AES feature unavailable error code 2017-06-14 16:19:12 +01:00