Commit graph

10564 commits

Author SHA1 Message Date
Jaeden Amero aad3dabd2b
Merge pull request #165 from gilles-peskine-arm/storage_spec-1.1.0-release
Correct version number in storage format spec
2019-07-30 10:12:44 +01:00
Jaeden Amero 456674d585
Merge pull request #186 from simonqhughes/psa-storage-and-cmake-fix
Add CMake option for explicitly link library to trusted_storage
2019-07-24 15:52:21 +01:00
Moshe Shahar 6763fe4a12 Change LINK_WITH_TRUSTED_STORAGE option to OFF 2019-07-24 14:19:35 +03:00
Moshe Shahar 7e36765945 Add CMake option for explicitly link library to trusted_storage (#2)
option name: LINK_WITH_TRUSTED_STORAGE
default value: ON
2019-07-24 13:32:13 +03:00
Jaeden Amero b992313f47
Merge pull request #180 from simonqhughes/feature-psa-storage
PSA Storage: Add psa_trusted_storage_linux persistent storage support for v1.0.0 APIs
2019-07-24 11:19:32 +01:00
Simon D Hughes bda5a21112 Add psa_trusted_storage_linux persistent storage support for v1.0.0 APIs
The following provides more information on this PR:
- PSA stands for Platform Security Architecture.
- Add support for use of psa_trusted_storage_api internal_trusted_storage.h v1.0.0
  as the interface to the psa_trusted_storage_linux backend (i.e. for persistent
  storage when MBEDTLS_PSA_ITS_FILE_C is not defined). This requires changes
  to psa_crypto_its.h and psa_crypto_storage.c to migrate to the new API.
2019-07-23 17:30:37 +01:00
Jaeden Amero 9565a9732b
Merge pull request #173 from Patater/prep-remove-crypto-from-tls
Prepare for removing crypto from mbedtls
2019-07-19 16:11:46 +01:00
Jaeden Amero f7dca86522 Allow building with the -Wunused flag
Make some functions non-static, to avoid Wunused function warnings. Make
a function scoped variable block scoped instead, to avoid Wunused
variable warnings in some configurations.
2019-07-15 15:52:25 +01:00
Jaeden Amero 3a0f08d911 Revert "cpp_dummy_build: Remove dependency on compat-1.3.h"
There is now a test that ensures all headers are included in the
cpp_dummy_build test, so we can't remove compat-1.3.h from the
cpp_dummy_build test until we remove compat-1.3.h.

This reverts commit 2b725ef727.
2019-07-15 15:52:25 +01:00
Jaeden Amero b8e4ae18cf Remove certs.h
certs.h is not needed in Mbed Crypto. No programs or other library code
use it.
2019-07-15 15:52:25 +01:00
Jaeden Amero 8045cfbaa8 Enable ALT implementations of ripemd160
In configurations wanting an alternative ripemd160 implementation, We
were including the ordinary Mbed Crypto ripemd160.h instead of the
user-provided ripemd160_alt.h. Use the user-provided header instead.
2019-07-15 15:52:25 +01:00
Jaeden Amero c49fbbf3eb Use mbedtls-based path for includes
To help the build system find the correct include files, paths starting
with "mbedtls/" or "psa/" must be used. Otherwise, you can run into
build failures like the following when building Mbed Crypto as a
submodule.

    In file included from chachapoly.c:31:0:
    ../../include/mbedtls/chachapoly.h:43:10: fatal error: poly1305.h: No such file or directory
     #include "poly1305.h"
              ^~~~~~~~~~~~
    compilation terminated.

Includes for ALT implementations are not modified, as the alt headers
are provided by system integrators and not Mbed TLS or Mbed Crypto.
2019-07-15 15:52:25 +01:00
Gilles Peskine 2c8f909782 Correct version number for 1.1.0 format (formerly 1.0.1)
Update the 1.1.0 format description now that its version number has
been decided. This release turned out to be 1.1.0, not 1.0.1.
2019-07-10 17:19:46 +02:00
Jaeden Amero b6229e304e
Merge pull request #149 from gilles-peskine-arm/havege-asan-crypto
Fix misuse of signed ints in the HAVEGE module
2019-07-05 15:30:30 +01:00
Jaeden Amero e78cd62acb
Merge pull request #159 from k-stachowiak/IOTCRYPT-474-prevent-dead-code-warning
Prevent dead code warning
2019-07-05 14:43:11 +01:00
k-stachowiak 653a4a2fba Prevent dead code warning
The window size variable in ecp_pick_window_size() can take values
4, 5 or 6, but we clamp it not to exceed the value of
MBEDTLS_ECP_WINDOW_SIZE. If that is 6 (default) or higher, the
static analyzer will point out that the test:
w > MBEDTLS_ECP_WINDOW_SIZE always evaluates to false.

This commit removes the test for the cases of the window size
large enough to fit all the potential values of the variable.
2019-07-04 12:19:47 +02:00
Jaeden Amero ee6f9b2a9f
Merge pull request #152 from Patater/cmake-subproject-fix
Enable use of Mbed TLS and Mbed Crypto as a CMake subproject
2019-07-02 08:39:11 +01:00
Jaeden Amero 8646a9241c
Merge pull request #156 from k-stachowiak/add-basic-build-to-all-sh
Add an alternarive full build component to all.sh
2019-06-28 10:32:19 +01:00
k-stachowiak 5559b31b6b Disable optimizations for the full+make+gcc all.sh component 2019-06-27 11:28:11 +02:00
k-stachowiak 0291cb7180 Add an alternarive full build component to all.sh 2019-06-26 15:52:12 +02:00
Jaeden Amero e8451f2274 CMake: Add a subdirectory build regression test
If we have a regression with the "build Mbed Crypto as a subdirectory
with CMake" feature and fail to build, fail the test.
2019-06-26 12:46:53 +01:00
Jaeden Amero 77dd25d98f tests: Enable building with add_subdirectory()
When building Mbed Crypto when including it via CMake's
`add_subdirectory()`, the tests are also built by default. This means
all headers the tests need must be public, in order for the build of the
tests to have access to the headers.
2019-06-26 12:46:53 +01:00
Ashley Duncan d85a7e9b09 Remove use of CMAKE_SOURCE_DIR
Remove use of CMAKE_SOURCE_DIR in case mbedtls is built from within
another CMake project. Define MBEDTLS_DIR to ${CMAKE_CURRENT_SOURCE_DIR}
in the main CMakeLists.txt file and refer to that when defining target
include paths to enable mbedtls to be built as a sub project.

Fixes https://github.com/ARMmbed/mbedtls/issues/2609

Signed-off-by: Ashley Duncan <ashes.man@gmail.com>
Signed-off-by: Jaeden Amero <jaeden.amero@arm.com>
2019-06-26 12:46:53 +01:00
Gilles Peskine bc2adf94a8 Fix minor type choice inconsistency 2019-06-24 15:45:09 +02:00
Jaeden Amero 54b8eabd76
Merge pull request #153 from gilles-peskine-arm/remove_unused_functions-iotssl-2563-clang-warnings
Remove unused functions from test_suite_psa_crypto
2019-06-20 15:04:29 +01:00
Gilles Peskine 9e5bcbd8d1 Remove unused functions
These functions became obsolete when the key export format changed
from including the SubjectPublicKeyInfo to being just the key
material.
2019-06-20 13:01:56 +02:00
Gilles Peskine 7846299adb Fix misuse of signed ints in the HAVEGE module
The elements of the HAVEGE state are manipulated with bitwise
operations, with the expectations that the elements are 32-bit
unsigned integers (or larger). But they are declared as int, and so
the code has undefined behavior. Clang with Asan correctly points out
some shifts that reach the sign bit.

Since these are supposed to be 32-bit unsigned integers, declare them
as uint32_t.

This is technically an API break, since the type mbedtls_havege_state
is exposed in a public header. However normal applications should not
be affected.
2019-06-14 19:23:10 +02:00
Jaeden Amero 86268e1d30
Merge pull request #148 from ARMmbed/dev/gilles-peskine-arm/check_params-test_without_function-crypto
Make test suites compatible with #include <assert.h>
2019-06-14 09:25:05 +01:00
Gilles Peskine 9e23bea692 Make test suites compatible with #include <assert.h>
Don't use the macro name assert. It's technically permitted as long as
<assert.h> is not included, but it's fragile, because it means the
code and any header that it includes must not include <assert.h>.
2019-06-13 15:13:43 +02:00
Jaeden Amero 47f2de1329
Merge pull request #143 from Patater/chachapoly-empty-buf-test
test: Check empty buffer decryption for chachapoly
2019-06-07 13:48:45 +01:00
Jaeden Amero 3d94e3468e
Merge pull request #142 from Patater/no-relative-includes
psa: Avoid use of relative include paths
2019-06-07 13:16:09 +01:00
Jaeden Amero b01314683a test: Remove redundant 0-byte decryption test
Remove the "Decrypt empty buffer" test, as ChaCha20 is a stream cipher
and 0 bytes encrypted is identical to a 0 length buffer. The "ChaCha20
Encrypt and decrypt 0 bytes" test will test decryption of a 0 length
buffer.
2019-06-07 12:57:33 +01:00
Jaeden Amero 5ab80efa10 test: Check empty buffer decryption for chachapoly
Previously, even in the Chacha20 and Chacha20-Poly1305 tests, we would
test that decryption of an empty buffer would work with
MBEDTLS_CIPHER_AES_128_CBC.

Make the cipher used with the dec_empty_buf() test configurable, so that
Chacha20 and Chacha20-Poly1305 empty buffer tests can use ciphers other
than AES CBC. Then, make the Chacha20 and Chacha20-Poly1305 empty buffer
tests use the MBEDTLS_CIPHER_CHACHA20 and
MBEDTLS_CIPHER_CHACHA20_POLY1305 cipher suites.
2019-06-07 12:57:33 +01:00
Jaeden Amero d58a00d5b7 psa: Avoid use of relative include paths
Relative include paths should be avoided. The build system will
determine where to pull in includes from. Specifically, `#include
"../mbedtls/config.h"` shouldn't be used. Use `#include
"mbedtls/config.h` instead, so that the submodule-building makefiles can
change which directory to use to get mbedtls include files from.

Fixes #141
2019-06-07 11:49:59 +01:00
Jaeden Amero cad1223654
Merge pull request #138 from Patater/add-entropy-injection-source
psa: Add NV seed as an entropy source when needed
2019-06-05 16:35:46 +01:00
Jaeden Amero 7654161dbf psa: Add NV seed as an entropy source when needed
When MBEDTLS_PSA_INJECT_ENTROPY is used, we now require also defining
MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES. When
MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES is defined, we do not add entropy
sources by default. This includes the NV seed entropy source, which the
PSA entropy injection API is built upon.

The PSA entropy injection feature depends on using NV seed as an entropy
source. Add NV seed as an entropy source for PSA entropy injection.

Fixes e3dbdd8d90 ("Gate entropy injection through a dedicated configuration option")
2019-06-05 11:09:38 +01:00
Jaeden Amero d5072d1f13
Merge pull request #133 from hanno-arm/dhm_selftest_der
Allow DHM selftest to run if MBEDTLS_PEM_PARSE_C is unset
2019-06-03 11:29:53 +01:00
Hanno Becker 8b0f9e6388 Allow DHM selftest to run if MBEDTLS_PEM_PARSE_C is unset
If MBEDTLS_PEM_PARSE_C is unset, the DHM selftest fails because
it uses PEM encoded test data.

This commit fixes this by providing the DER encoded form of the
test data instead in case MBEDTLS_PEM_PARSE_C is unset.
2019-05-31 17:28:59 +01:00
Jaeden Amero f479aaef9b
Merge pull request #125 from gilles-peskine-arm/readme-fix-api-links
Fix PSA Crypto API links in README
2019-05-24 11:15:40 +01:00
Gilles Peskine f81f87f4cc API spec HTML: Use Github Pages rather than htmlpreview
htmlpreview.github.io breaks some links: in index.html viewed through
this service, the links that should go to from_doxygen.html are shown
as internal links, so the meat of the document is invisible.

Link to Github pages instead. This relies on the documentation being
available on the `master` branch of the mbed-crypto repository.

This has the added benefit of not depending on a third-party service.
2019-05-23 19:34:06 +02:00
Gilles Peskine 58501e5ecc API spec PDF: link to the actual PDF
Link to the PDF file, not to a page with an embedded PDF reader
2019-05-23 19:33:45 +02:00
Jaeden Amero 8907b019e7
Merge pull request #124 from Patater/full-parent-paths
Makefile: Use full paths to refer to parent files
2019-05-22 15:08:52 +01:00
Jaeden Amero 8d4d4f55f0 Makefile: Use full paths to refer to parent files
When running lcov, files can't be found relative to the parent project
(Mbed TLS) root. Use full, non-relative paths to refer to files used in
building Mbed Crypto from Mbed TLS in order to enable lcov to locate the
files properly.
2019-05-22 13:54:52 +01:00
Jaeden Amero 0cad4bac30
Merge pull request #123 from gilles-peskine-arm/api-link-index
Update link to PSA Crypto API HTML
2019-05-22 12:40:03 +01:00
Jaeden Amero 496c176d90
Merge pull request #266 from ARMmbed/psa-policy_alg2-poc
Keys may allow a second algorithm
2019-05-22 11:55:01 +01:00
Gilles Peskine 549ea8676a Minor documentation improvements 2019-05-22 11:45:59 +02:00
Gilles Peskine 7a91ece3be Update link to PSA Crypto API HTML
Now that we aren't using Doxygen directly any longer, there is no
longer a modules.html. Link to index.html instead.
2019-05-21 20:05:34 +02:00
Gilles Peskine 52315e4c16 Enrollment algorithm in policy: add tests of psa_copy_key 2019-05-21 18:31:59 +02:00
Gilles Peskine 705cbfd802 Enrollment algorithm in policy: add support in psa_copy_key tests
Add parameters to psa_copy_key tests for the enrollment algorithm (alg2).

This commit only tests with alg2=0, which is equivalent to not setting
an enrollment algorithm.
2019-05-21 18:31:59 +02:00
Gilles Peskine 131aa31c82 New key file format for 1.0.1
Add alg2 field and note that some encodings have changed.
2019-05-21 18:31:59 +02:00