Commit graph

57 commits

Author SHA1 Message Date
Gilles Peskine 987e271b16 If python3 fails, make it clear that this isn't fatal 2019-11-26 13:30:16 +01:00
Gilles Peskine df78e496b7 Error out rather than call python on the perl script 2019-11-26 13:30:00 +01:00
Gilles Peskine 0409bcdef0 Compatibility redirect: add copyright notice 2019-09-13 15:17:47 +02:00
Gilles Peskine a103c18032 Compatibility redirect: if python3 is not available, try python 2019-09-13 11:04:24 +02:00
Gilles Peskine 6cf3127527 Report an error if switching to Python fails 2019-09-13 11:04:23 +02:00
Gilles Peskine bf359c7fc4 Replace config.pl by a redirection to config.py
Keep config.pl in Perl in case people are running "perl config.pl".
2019-09-13 11:04:23 +02:00
Hanno Becker dc54953229 Don't set MBEDTLS_MEMORY_DEBUG through scripts/config.pl full 2019-09-06 07:44:37 -04:00
Hanno Becker 2ea2f053c5 Update documentation of exceptions for config.pl full 2019-09-06 07:44:37 -04:00
Hanno Becker 909e68d45a Disable memory buffer allocator in full config
This commit modifies `config.pl` to not set MBEDTLS_MEMORY_BUFFER_ALLOC
with the `full` option.
2019-09-06 07:40:26 -04:00
Christoph M. Wintersteiger 6cddd30beb ECDH: Disable Everest by default 2019-08-29 16:12:38 +01:00
Andrzej Kurek 9c754a9892 config.pl: disable PSA_ITS_FILE and PSA_CRYPTO_STORAGE for baremetal 2019-05-23 03:01:35 -04:00
Andrzej Kurek 03c35a5744 Disable MBEDTLS_ECP_RESTARTABLE in full config
MBEDTLS_ECP_RESTARTABLE is not compatible with MBEDTLS_USE_PSA_CRYPTO.
2019-05-23 03:01:35 -04:00
Manuel Pégourié-Gonnard 971dea3745 Enable USE_PSA_CRYPTO with config.pl full
Previously it was disabled as too experimental, which no longer holds. Also,
this option introduces new APIs, so it's not only about an internal
alternative (as the comment in config.pl used to state) - people who request a
full config should get all of the available APIs.

Adapt all.sh: now all builds with full config will also test this option, and
builds with the default config will test without it. Just to be sure, let's
have a build with full config minus this option.

Update documentation of MBEDTLS_USE_PSA_CRYPTO to reflect the status of the
new APIs it enables in Mbed TLS and why they're still opt-in.
2019-05-23 03:01:35 -04:00
Manuel Pégourié-Gonnard de7636e2dd Enable MBEDTLS_PSA_CRYPTO_C by default
Also enable it in scripts/config.pl full, as well as two storage options that
were only blacklisted from full config because they depended on
MBEDTLS_PSA_CRYPTO_C.
2019-05-23 03:01:35 -04:00
Jaeden Amero 57f4d9e4fe Update crypto submodule to test with private headers
Update the crypto submodule to the top of the Mbed Crypto development
branch. This brings in a version of Mbed Crypto that enables building
Mbed Crypto tests that depend on private headers, like
'psa_crypto_invasive.h'.

This also requires updating our config.h to include new configuration
options added to Mbed Crypto. MBEDTLS_PSA_ITS_FILE_C replaces
MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C and MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C.
MBEDTLS_PSA_INJECT_ENTROPY replaces MBEDTLS_PSA_HAS_ITS_IO.
2019-03-19 15:45:09 +00:00
Andres Amaya Garcia 4a512281ec Reduce priority of 3DES ciphersuites 2019-03-01 10:19:27 +01:00
Andrzej Kurek 172457460b Add MBEDTLS_PSA_HAS_ITS_IO to config.pl exclude list 2019-02-07 08:49:53 -05:00
Andrzej Kurek d3643ef29b Add PSA defines to config.pl exclude list 2019-02-07 07:41:27 -05:00
Hanno Becker e10f191543 Remove MBEDTLS_PSA_CRYPTO_SPM from config.pl
This configuration option has been removed by now.
2018-11-22 09:43:35 +00:00
Manuel Pégourié-Gonnard aeefa49edd Add config option for X.509/TLS to use PSA 2018-11-21 21:03:14 +00:00
Jaeden Amero 484ee33c35 psa: Add PSA Crypto configuration
Add an option that can enable the exposure of PSA Crypto APIs from
libmbedcrypto.
2018-11-21 12:54:57 +00:00
Simon Butcher 9fa21bffe6 Merge remote-tracking branch 'public/pr/1533' into development 2018-06-27 10:50:58 +01:00
Manuel Pégourié-Gonnard 2adb375c50 Add option to avoid 64-bit multiplication
Motivation is similar to NO_UDBL_DIVISION.

The alternative implementation of 64-bit mult is straightforward and aims at
obvious correctness. Also, visual examination of the generate assembly show
that it's quite efficient with clang, armcc5 and arm-clang. However current
GCC generates fairly inefficient code for it.

I tried to rework the code in order to make GCC generate more efficient code.
Unfortunately the only way to do that is to get rid of 64-bit add and handle
the carry manually, but this causes other compilers to generate less efficient
code with branches, which is not acceptable from a side-channel point of view.

So let's keep the obvious code that works for most compilers and hope future
versions of GCC learn to manage registers in a sensible way in that context.

See https://bugs.launchpad.net/gcc-arm-embedded/+bug/1775263
2018-06-07 11:05:33 +02:00
fbrosson 533407a266 Use "#!/usr/bin/env perl" as shebang line. 2018-04-04 21:44:29 +00:00
Hanno Becker a3389ebb09 Merge branch 'development-restricted' into iotssl-1306-rsa-is-vulnerable-to-bellcore-glitch-attack 2018-03-06 11:55:21 +00:00
Azim Khan c4e9694d43 Add MBEDTLS_NO_UDBL_DIVISION to excludes of full config 2017-12-21 15:22:37 +00:00
Azim Khan c3c3a68e74 Update usage description 2017-12-21 15:19:53 +00:00
Azim Khan 0d44573e8b Add option to do baremetal configuration. 2017-12-21 10:41:38 +00:00
Gilles Peskine 8ca0e8fdff Minor style fix 2017-10-12 23:21:37 +01:00
Gilles Peskine d98e9e8577 config.pl get: be better behaved
When printing an option's value, print a newline at the end.

When the requested option is missing, fail with status 1 (the usual
convention for "not found") rather than -1 (which has a
system-dependent effect).
2017-10-12 23:21:37 +01:00
Gilles Peskine 01f57e351c config.pl get: don't rewrite config.h; detect write errors
scripts/config.pl would always rewrite config.h if it was reading it.
This commit changes it to not modify the file when only reading is
required, i.e. for the get command.

Also, die if writing config.h fails (e.g. disk full).
2017-10-12 23:21:37 +01:00
Gilles Peskine f0f55ccb72 Fixed "config.pl get" for options with no value
Between 2.5.0 and 2.6.0, "scripts/config.pl get MBEDTLS_XXX" was fixed
for config.h lines with a comment at the end, but that broke the case
of macros with an empty expansion. Support all cases.
2017-10-12 23:21:37 +01:00
Hanno Becker 7c0f17d115 Add MBEDTLS_RSA_NO_CRT to options unaffected by config.pl full
The effect of `config.pl full` on 'negative' options such as
`NO_PLATFORM_ENTROPY` is usually inverted, but `MBEDTLS_RSA_NO_CRT` was not
included in the list of such options. This commit adds it.
2017-09-28 12:53:34 +01:00
Hanno Becker c6f346b60c Fix get option in config.pl script 2017-07-28 16:45:55 +01:00
Brian J Murray 2adecba01f Clarify Comments and Fix Typos (#651)
Fixes many typos, and errors in comments.

* Clarifies many comments
* Grammar correction in config.pl help text
* Removed comment about MBEDTLS_X509_EXT_NS_CERT_TYPE.
* Comment typo fix (Dont => Don't)
* Comment typo fix (assure => ensure)
* Comment typo fix (byes => bytes)
* Added citation for quoted standard
* Comment typo fix (one complement => 1's complement)

The is some debate about whether to prefer "one's complement",  "ones'
complement", or "1's complement".  The more recent RFCs related to TLS
(RFC 6347,  RFC 4347, etc) use " 1's complement", so I followed that
convention.

* Added missing ")" in comment
* Comment alignment
* Incorrect comment after #endif
2016-11-06 12:45:15 +00:00
Simon Butcher 3d26513650 Fix for config.pl if no arguments are passed 2016-06-26 15:44:20 +01:00
Simon Butcher dd9895d810 Fix config.pl to return successful exitcode for full and realfull 2016-06-21 15:12:00 +01:00
Simon Butcher 4ae869139a Adds 'get' command to scripts/config.pl to retrieve config state
Adds 'get' command to indicate if the option is enabled in the given
configuration file, and to returns it's value if one has been set.
2016-06-21 10:09:25 +01:00
Simon Butcher ab5df40054 Rename the 'no entropy' feature to MBEDTLS_TEST_NULL_ENTROPY
Following review and for clarity, changed the name of the feature to 'null
entropy'.
2016-06-11 02:31:21 +01:00
Janos Follath 53de78444c Add entropy safety switch.
Add a switch that turns entropy collecting off entirely, but enables
mbed TLS to run in an entirely unsafe mode. Enables to test mbed TLS
on platforms that don't have their entropy sources integrated yet.
2016-06-09 11:54:54 +01:00
SimonB 73883c12bc Fixes formatting of spacing in config.pl 2016-04-04 13:49:10 +01:00
SimonB 60f2cf93f5 Adds option to config.pl to force config changes
The script config.pl fails when setting a #define symbol if the symbol isn't
already in the configuration header. This adds an option '--force' to append
the symbol to the end of the file if it isn't already present.

Also clarified usage, and added copyright to the config.pl.
2016-04-03 14:16:08 +01:00
Manuel Pégourié-Gonnard 1989caf71c Use a full config.h with doxygen
Otherwise we get warnings that some documentation items don't have
corresponding #define, and more importantly the corresponding snippets are not
included in the output.

For that we need a modified version of the "full" argument for config.pl.

Also, the new CMakeLists.txt target only works on Unix (which was already the
case of the Makefile target). Hopefully this is not an issue as people are
unlikely to need that target on Windows.
2016-01-04 12:57:32 +01:00
Manuel Pégourié-Gonnard 7f9049baf4 Make config.pl more resistant to misuse 2015-06-23 23:30:16 +02:00
Manuel Pégourié-Gonnard a14cbb6141 Have config.pl return non-zero rather than warn 2015-06-03 10:49:38 +01:00
Manuel Pégourié-Gonnard 7ee5ddd798 Merge branch 'mbedtls-1.3' into development
* mbedtls-1.3:
  Fix compile errors with NO_STD_FUNCTIONS
  Expand config.pl's notion of "full"
  Ack external bugfix in Changelog
  FIx misplaced Changelog entry (oops)
  Fix compile bug: incompatible declaration of polarssl_exit in platform.c
  Fix contributor's name in Changelog
2015-06-03 10:33:55 +01:00
Manuel Pégourié-Gonnard b752715893 Expand config.pl's notion of "full"
Make sure bugs in PLATFORM_xxx_ALT are catched
2015-06-03 10:00:02 +01:00
Manuel Pégourié-Gonnard 7b53889f05 Remove support for HAVE_INT8 and HAVE_INT16 2015-04-10 11:34:22 +02:00
Manuel Pégourié-Gonnard b20a70fcc7 Move rename.pl to scripts & add data file 2015-04-08 20:13:33 +02:00
Manuel Pégourié-Gonnard 2cf5a7c98e The Great Renaming
A simple execution of tmp/invoke-rename.pl
2015-04-08 13:25:31 +02:00