Commit graph

330 commits

Author SHA1 Message Date
Manuel Pégourié-Gonnard f08284769d Add an option to test constant-flow with valgrind
Currently the new component in all.sh fails because
mbedtls_ssl_cf_memcpy_offset() is not actually constant flow - this is on
purpose to be able to verify that the new test works.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-08-25 11:26:37 +02:00
Manuel Pégourié-Gonnard f0b469e42b Merge branch 'mbedtls-2.16' into mbedtls-2.16-restricted
* mbedtls-2.16: (32 commits)
  A different approach of signed-to-unsigned comparison
  Fix bug in redirection of unit test outputs
  Don't forget to free G, P, Q, ctr_drbg, and entropy
  Backport e2k support to mbedtls-2.7
  compat.sh: stop using allow_sha1
  compat.sh: quit using SHA-1 certificates
  compat.sh: enable CBC-SHA-2 suites for GnuTLS
  Fix license header in pre-commit hook
  Update copyright notices to use Linux Foundation guidance
  Fix building on NetBSD 9.0
  Remove obsolete buildbot reference in compat.sh
  Fix misuse of printf in shell script
  Fix added proxy command when IPv6 is used
  Simplify test syntax
  Fix logic error in setting client port
  ssl-opt.sh: include test name in log files
  ssl-opt.sh: remove old buildbot-specific condition
  ssl-opt.sh: add proxy to all DTLS tests
  Log change as bugfix
  Add changelog entry
  ...
2020-08-25 10:58:15 +02:00
Bence Szépkúti a2947ac7bb Update copyright notices to use Linux Foundation guidance
As a result, the copyright of contributors other than Arm is now
acknowledged, and the years of publishing are no longer tracked in the
source files.

Also remove the now-redundant lines declaring that the files are part of
MbedTLS.

This commit was generated using the following script:

# ========================
#!/bin/sh

# Find files
find '(' -path './.git' -o -path './3rdparty' ')' -prune -o -type f -print | xargs sed -bi '

# Replace copyright attribution line
s/Copyright.*Arm.*/Copyright The Mbed TLS Contributors/I

# Remove redundant declaration and the preceding line
$!N
/This file is part of Mbed TLS/Id
P
D
'
# ========================

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-08-19 16:37:36 +02:00
Manuel Pégourié-Gonnard a237722118 Add MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN
This option allows to test the constant-flow nature of selected code, using
MemSan and the fundamental observation behind ctgrind that the set of
operations allowed on undefined memory by dynamic analysers is the same as the
set of operations allowed on secret data to avoid leaking it to a local
attacker via side channels, namely, any operation except branching and
dereferencing.

(This isn't the full story, as on some CPUs some instructions have variable
execution depending on the inputs, most notably division and on some cores
multiplication. However, testing that no branch or memory access depends on
secret data is already a good start.)

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-07-28 11:21:24 +02:00
Janos Follath f69b919844 Merge branch 'mbedtls-2.16-restricted' into mbedtls-2.16.7r0 2020-06-25 09:19:21 +01:00
Manuel Pégourié-Gonnard 23983f30de Add config.h option MBEDTLS_ECP_NO_INTERNAL_RNG
No effect so far, except on dependency checking, as the feature it's meant to
disable isn't implemented yet (so the descriptions in config.h and the
ChangeLog entry are anticipation for now).

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2020-06-16 10:51:42 +02:00
Bence Szépkúti f744bd72ee Update license headers to Apache-2.0 OR GPL-2.0-or-later
This will allow us to ship the LTS branches in a single archive

This commit was generated using the following script:

# ========================
#!/bin/sh

header1='\ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later\
 *\
 *  This file is provided under the Apache License 2.0, or the\
 *  GNU General Public License v2.0 or later.\
 *\
 *  **********\
 *  Apache License 2.0:\
 *\
 *  Licensed under the Apache License, Version 2.0 (the "License"); you may\
 *  not use this file except in compliance with the License.\
 *  You may obtain a copy of the License at\
 *\
 *  http://www.apache.org/licenses/LICENSE-2.0\
 *\
 *  Unless required by applicable law or agreed to in writing, software\
 *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\
 *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\
 *  See the License for the specific language governing permissions and\
 *  limitations under the License.\
 *\
 *  **********\
 *\
 *  **********\
 *  GNU General Public License v2.0 or later:\
 *\
 *  This program is free software; you can redistribute it and/or modify\
 *  it under the terms of the GNU General Public License as published by\
 *  the Free Software Foundation; either version 2 of the License, or\
 *  (at your option) any later version.\
 *\
 *  This program is distributed in the hope that it will be useful,\
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of\
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\
 *  GNU General Public License for more details.\
 *\
 *  You should have received a copy of the GNU General Public License along\
 *  with this program; if not, write to the Free Software Foundation, Inc.,\
 *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.\
 *\
 *  **********'

find -path './.git' -prune -o '(' -name '*.c' -o -name '*.cpp' -o -name '*.fmt' -o -name '*.h' ')' -print | xargs sed -i "
# Normalize the first line of the copyright headers (no text on the first line of a block comment)
/^\/\*.*Copyright.*Arm/I s/\/\*/&\n */

# Insert new copyright header
/SPDX-License-Identifier/ i\
$header1

# Delete old copyright header
/SPDX-License-Identifier/,$ {
  # Delete lines until the one preceding the mbedtls declaration
  N
  1,/This file is part of/ {
    /This file is part of/! D
  }
}
"

# Format copyright header for inclusion into scripts
header2=$(echo "$header1" | sed 's/^\\\? \* \?/#/')

find -path './.git' -prune -o '(' -name '*.gdb' -o -name '*.pl' -o -name '*.py' -o -name '*.sh' ')' -print | xargs sed -i "
# Insert new copyright header
/SPDX-License-Identifier/ i\
$header2

# Delete old copyright header
/SPDX-License-Identifier/,$ {
  # Delete lines until the one preceding the mbedtls declaration
  N
  1,/This file is part of/ {
    /This file is part of/! D
  }
}
"
# ========================

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-06-15 12:48:48 +02:00
Bence Szépkúti 51b41d5422 Add Apache-2.0 headers to all scripts
This commit was generated using the following script:

# ========================
#!/bin/sh

# Find scripts
find -path './.git' -prune -o '(' -name '*.gdb' -o -name '*.pl' -o -name '*.py' -o -name '*.sh' ')' -print | xargs sed -i '

# Remove Mbed TLS declaration if it occurs before the copyright line
1,/Copyright.*Arm/I {
  /This file is part of/,$ {
    /Copyright.*Arm/I! d
  }
}

# Convert non-standard header in scripts/abi_check.py to the format used in the other scripts
/"""/,/"""/ {

  # Cut copyright declaration
  /Copyright.*Arm/I {
    h
    N
    d
  }

  # Paste copyright declaration
  /"""/ {
    x
    /./ {
      s/^/# /    # Add #
      x          # Replace orignal buffer with Copyright declaration
      p          # Print original buffer, insert newline
      i\

      s/.*//     # Clear original buffer
    }
    x
  }
}

/Copyright.*Arm/I {

  # Print copyright declaration
  p

  # Read the two lines immediately following the copyright declaration
  N
  N

  # Insert Apache header if it is missing
  /SPDX/! {
    i\
# SPDX-License-Identifier: Apache-2.0\
#\
# Licensed under the Apache License, Version 2.0 (the "License"); you may\
# not use this file except in compliance with the License.\
# You may obtain a copy of the License at\
#\
# http://www.apache.org/licenses/LICENSE-2.0\
#\
# Unless required by applicable law or agreed to in writing, software\
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\
# See the License for the specific language governing permissions and\
# limitations under the License.

    # Insert Mbed TLS declaration if it is missing
    /This file is part of/! i\
#\
# This file is part of Mbed TLS (https://tls.mbed.org)
  }

  # Clear copyright declaration from buffer
  D
}
'
# ========================

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-06-15 12:18:56 +02:00
Bence Szépkúti 468a76f88a Add copyright dates to all scripts
To find any files with a missing copyright declaration, use the following script:

# ========================
#!/bin/sh

# Find files with copyright declarations, and list their file extensions
exts=$(grep -Ril --exclude-dir .git 'Copyright.*Arm' | sed '
  s/.*\./-name "*./
  s/$/"/
' | sort -u | sed -n '
  :l
    N
    $!bl
  s/\n/ -o /gp
')

# Find files with file extensions that ususally include copyright extensions, but don't include a copyright declaration themselves.
eval "find -path './.git' -prune -o ! -path './tests/data_files/format_pkcs12.fmt' '(' $exts ')' -print" | xargs grep -Li 'Copyright.*Arm'
# ========================

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-06-15 12:18:56 +02:00
Gilles Peskine e913f911cd Do include asn1.h in error.c
When generate_errors.pl was first written, there was no asn1.h. But
now there is one and it does not need any special treatment.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-28 11:59:59 +02:00
Gilles Peskine 4f84cc7d67 Check that all necessary headers are included in error.c
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-05-28 11:59:59 +02:00
Ronald Cron 0665677265 Add output of python3 version
Add output of python3 version to output_env.sh.
Added in addition to the version of `python` as some
project's scripts try both executable names.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-05-26 14:20:12 +02:00
Ronald Cron 2eefeeebdb Add output of make and cmake versions
Add output of make and cmake versions to output_env.sh.
That way we can see their versions in the CI.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-05-26 14:19:40 +02:00
Gilles Peskine 0f593416e0
Merge pull request #3247 from gilles-peskine-arm/travis-rationalize-2.16
Backport 2.16: Rationalize Travis builds
2020-05-04 12:10:55 +02:00
danh-arm 21f2ba54f7
Merge pull request #3286 from gilles-peskine-arm/config-full-clarify-2.16
Backport 2.16: Clarify that the full config enables everything that can be tested together
2020-05-04 10:29:41 +01:00
Gilles Peskine 1e8cafcd3d Exclude DEPRECATED_WARNING in config full
In the full config, don't set MBEDTLS_DEPRECATED_WARNING. This is debatable:
the full config does not enable deprecated features in this branch, so
MBEDTLS_DEPRECATED_WARNING is compatible with the other features.
Exclude it to keep LTS branches closer to development.

In any case, baremetal and full should have the same settings regarding
deprecated features, so don't do anything about DEPRECATED_xxx in baremetal.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-30 09:04:40 +02:00
Gilles Peskine df4f7c1274 Document and fix the MBEDTLS_xxx_ALT logic for the full config
The intended logic around MBEDTLS_xxx_ALT is to exclude them from full
because they require the alternative implementation of one or more
library functions, except that MBEDTLS_PLATFORM_xxx_ALT are different:
they're alternative implementations of a platform function and they
have a built-in default, so they should be included in full. Document
this.

Fix a bug whereby MBEDTLS_PLATFORM_xxx_ALT didn't catch symbols where
xxx contains an underscore. As a consequence,
MBEDTLS_PLATFORM_GMTIME_R_ALT and MBEDTLS_PLATFORM_NV_SEED_ALT are now
enabled in the full config. Explicitly exclude
MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT because it behaves like the
non-platform ones, requiring an extra build-time dependency.
Explicitly exclude MBEDTLS_PLATFORM_NV_SEED_ALT from baremetal
because it requires MBEDTLS_ENTROPY_NV_SEED, and likewise explicitly
unset it from builds that unset MBEDTLS_ENTROPY_NV_SEED.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-28 15:02:50 +02:00
Manuel Pégourié-Gonnard 899f63805a
Merge pull request #3205 from irwir/fix_vcxproj-2.16
[backport 2.16] Finalize fixing bugs in .vcxproj files
2020-04-28 13:03:30 +02:00
Gilles Peskine d6189e115d Sort lists for easier maintenance
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-28 11:50:06 +02:00
Gilles Peskine 108ebf2b26 Explain the rationale for inclusion in "full" and "baremetal"
Remove the duplicated, and often out-of-date, list in the comments.
Instead explain in a comment, and have a single copy of the list which
is in the code.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-28 11:50:06 +02:00
Gilles Peskine df5614ef1d Enable X509_ALLOW_EXTENSIONS_NON_V3 in config full
Enable MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3 in the full config. There's
no reason to keep it out. We weren't testing it at all on the CI.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-28 10:23:59 +02:00
Gilles Peskine 989d05ffd8 Remove obsolete options from config.pl
These options haven't existed for a long time.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-28 10:23:59 +02:00
Gilles Peskine 468adcc20b Add a simple build script for Windows with Visual Studio
Keep it simple and mostly non-parametrizable for now.
A path to Visual Studio 2017 is hard-coded.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-27 09:14:42 +00:00
Gilles Peskine cff94e33b0 Copy the changelog entry assembling script from development
This commit is the combined cherry-pick of the following commits:
dba4de0a12
b695d5e30a
7c3f7cdeae
4d977a4f40
e248e83f9f
eebf24f7a8
6e97c43959
c68c7c8864
ac0f0860f1
42f384c186
98a53aa399
13dc634282
7fa3eb7d44
28af958ea4
8f46bbf46f
27a1facd48
afc9db8bb7
a26079613a
da14e8225e
37d670a1e1
974349d40e
d8b6c77388
2b242495e1
6e91009cfe
566407d6f6
8c4a84c5de
5e39c9e94f
974232f045
40b3f411ec

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-21 18:34:06 +02:00
Gilles Peskine 15316fdb94
Merge pull request #3169 from gilles-peskine-arm/check-windows-files-2.16
Backport 2.16: Check Windows files for sanity as well
2020-04-20 13:59:18 +02:00
irwir 3d9b798f60 [backport 2.16] Finalize fixing bugs in .vcxproj files
This is the 2.16 backport of #2853

Signed-off-by: irwir <irwir@users.noreply.github.com>
2020-04-19 17:09:42 +03:00
Gilles Peskine 5d1dfd4108 Pylint: abide by useless-object-inheritance warnings
Inheriting from object is a remainder of Python 2 habits and is just
clutter in Python 3.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-11 20:50:51 +02:00
Gilles Peskine ce56956f59 Systematically use Windows line endings in Windows files
Don't mix Windows and Unix line endings, it's the worst of both worlds.

Update the Visual Studio templates and regenerate the generated files.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-06 16:32:30 +02:00
Gilles Peskine fea21d4c3d Fix a stray CR inside a line
Use CRLF consistently instead of cobbling a \r here and a \n there.

The generated files don't change.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-04-06 16:29:44 +02:00
Simon Butcher 47f728718f Change the use of pylint to optionally use pylint3
Pylint when installed as a distro package can be installed as pylint3, whilst as
a PEP egg, it can be installed as pylint.

This commit changes the scripts to first use pylint if installed, and optionally
look for pylint3 if not installed. This is to allow a preference for the PEP
version over the distro version, assuming the PEP one is more likely to be
the correct one.

Signed-off-by: Simon Butcher <simon.butcher@arm.com>
2020-03-16 13:53:06 +00:00
Simon Butcher bae7328b32 Fix output_env.sh for varying pylint3 output
`pylint3 --version` will output to stderr the status of the config file it's
using. This can be "No config file found" or "Using config file" or nothing.
This means the pylint version may or may not be on the first line.

Therefore this commit changes the filters on the pylint3 version output to first
strip out the config line, and then to select only the pylint line.

Signed-off-by: Simon Butcher <simon.butcher@arm.com>
2020-03-06 19:26:32 +00:00
Simon Butcher 85c4c865db Add Python, Perl and Pylint to output_env.sh
Add the versions of Python, Perl, and Pylint to the version dump provided by
the output_env.sh script.

Signed-off-by: Simon Butcher <simon.butcher@arm.com>
2020-03-06 19:26:09 +00:00
Simon Butcher 679d2de36b Make minor fixes to output_env.sh after review
A number of clean-up improvements following review.
 * removal of redundant `` quotes
 * removal of non-portable echo "\n", in favour of additional echo commands
 * change to use of uname to detemine if the platform is Linux or not
 * revised formatting of output
 * change to dpkg-query from dpkg to find installed libasan variants

Co-Authored-By: Gilles Peskine <gilles.peskine@arm.com>
Signed-off-by: Simon Butcher <simon.butcher@arm.com>
2020-03-04 11:31:05 +00:00
Simon Butcher 3104eec4cf Enhance the output_env.sh script
This commit adds additional information to the output_env.sh script of:
  * Linux distribution version (if available)
  * GDB version (if available)

It also makes some information clearer:
  * the type of OpenSSL/GNUTLS version (legacy/default/next)
  * and whether certain versions are not installed, or not configured

And it simplifies the error messages for absent tools.

Signed-off-by: Simon Butcher <simon.butcher@arm.com>
2020-03-04 11:30:49 +00:00
Gilles Peskine 16ee3c15a3 config.pl full: exclude MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
This is a variant toggle, not an extra feature, so it should be tested
separately.
2019-10-08 15:19:25 +02:00
Hanno Becker dfc974412c Don't set MBEDTLS_MEMORY_DEBUG through scripts/config.pl full 2019-09-09 05:28:25 -04:00
Andrzej Kurek 8762101c01 Update documentation of exceptions for config.pl full 2019-09-09 05:25:05 -04:00
Hanno Becker 307dfcd439 Disable memory buffer allocator in full config
This commit modifies `config.pl` to not set MBEDTLS_MEMORY_BUFFER_ALLOC
with the `full` option.
2019-09-09 05:17:37 -04:00
Darryl Green 64b4b6e35e Change worktree_rev to HEAD for rev-parse
Due to how the checking script is run in docker, worktree_rev is
ambiguous when running rev-parse. We're running it in the checked
out worktree, so we can use HEAD instead, which is unambiguous.
2019-07-25 14:38:55 +01:00
Gilles Peskine 47a4cba1db Split _abi_compliance_command into smaller functions
This makes the code easier to read and pacifies pylint.
2019-07-05 17:06:19 +02:00
Gilles Peskine ea94391500 Record the commits that were compared
Record the commit ID in addition to the symbolic name of the version
being tested. This makes it easier to figure out what has been
compared when reading logs that don't always indicate explicitly what
things like HEAD are.

This makes the title of HTML reports somewhat verbose, but I think
that's a small price to pay.
2019-07-05 17:06:19 +02:00
Gilles Peskine 826286a04e Document how to build the typical argument for -s 2019-07-05 17:06:19 +02:00
Gilles Peskine c53b93b8ef Allow running /somewhere/else/path/to/abi_check.py
Don't require abi_check.py to be the one in scripts/ under the current
directory.
2019-07-05 17:06:19 +02:00
Jaeden Amero 73a36ff512 windows: Fix Release x64 configuration
Inherit PlatformToolset from the project configuration. This allow the
project to configure PlatformToolset, and aligns the Release x64 build
with other build types.

Fixes #1430
2019-06-20 16:34:22 +01:00
Jaeden Amero 342223e72c Merge remote-tracking branch 'origin/pr/2676' into mbedtls-2.16
* origin/pr/2676:
  Show removed symbols in abi check
2019-06-14 08:54:50 +01:00
Darryl Green 0ae1a53e32 Show removed symbols in abi check 2019-06-05 12:58:40 +01:00
Darryl Green e831f5575b Remove all abi dumps, not just ones shared between versions
While the abi-checking script handled comparing only the modules
that were shared between the old and new versions correctly, the
cleanup of the abi dumps only removed what was shared. Change the
cleanup logic to remove all abi dumps instead.
2019-05-29 13:40:19 +01:00
Darryl Green fbf3c8ac23 Only use submodule if present
Enabling the USE_CRYPTO_SUBMODULE option causes problems if the
crypto submodule isn't present. For example, when building
mbed-crypto as a submodule, it should use error.c from the parent
project if USE_CRYPTO_SUBMODULE is set. However if the parent
project isn't present, then the build will fail. Only enable it
if the submodule actually exists.
2019-05-09 13:25:26 +01:00
Darryl Green a0415bc779 Use check_output instead of Popen 2019-04-18 11:47:28 +01:00
Darryl Green 03c5e856e8 Start unused variable with underscore 2019-04-18 11:47:28 +01:00