diff --git a/library/ccm.c b/library/ccm.c index 9911e0f4e..750ec9e98 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -37,6 +37,7 @@ #if defined(MBEDTLS_CCM_C) #include "mbedtls/ccm.h" +#include "mbedtls/platform.h" #include "mbedtls/platform_util.h" #include @@ -74,7 +75,7 @@ int mbedtls_ccm_setkey( mbedtls_ccm_context *ctx, const unsigned char *key, unsigned int keybits ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; const mbedtls_cipher_info_t *cipher_info; CCM_VALIDATE_RET( ctx != NULL ); @@ -98,7 +99,7 @@ int mbedtls_ccm_setkey( mbedtls_ccm_context *ctx, return( ret ); } - return( 0 ); + return( ret ); } /* @@ -155,7 +156,7 @@ static int ccm_auth_crypt( mbedtls_ccm_context *ctx, int mode, size_t length, const unsigned char *input, unsigned char *output, unsigned char *tag, size_t tag_len ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; unsigned char i; unsigned char q; size_t len_left, olen; @@ -315,7 +316,7 @@ static int ccm_auth_crypt( mbedtls_ccm_context *ctx, int mode, size_t length, CTR_CRYPT( y, y, 16 ); mbedtls_platform_memcpy( tag, y, tag_len ); - return( 0 ); + return( ret ); } /* @@ -365,7 +366,7 @@ int mbedtls_ccm_star_auth_decrypt( mbedtls_ccm_context *ctx, size_t length, const unsigned char *input, unsigned char *output, const unsigned char *tag, size_t tag_len ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; unsigned char check_tag[16]; unsigned char i; int diff; @@ -394,7 +395,7 @@ int mbedtls_ccm_star_auth_decrypt( mbedtls_ccm_context *ctx, size_t length, return( MBEDTLS_ERR_CCM_AUTH_FAILED ); } - return( 0 ); + return( ret ); } int mbedtls_ccm_auth_decrypt( mbedtls_ccm_context *ctx, size_t length, diff --git a/library/entropy.c b/library/entropy.c index 6656ee86b..f5d7d4021 100644 --- a/library/entropy.c +++ b/library/entropy.c @@ -142,7 +142,7 @@ int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx, mbedtls_entropy_f_source_ptr f_source, void *p_source, size_t threshold, int strong ) { - int idx, ret = 0; + int idx, ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; #if defined(MBEDTLS_THREADING_C) if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 ) @@ -162,6 +162,7 @@ int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx, ctx->source[idx].strong = strong; ctx->source_count++; + ret = 0; exit: #if defined(MBEDTLS_THREADING_C) @@ -182,7 +183,7 @@ static int entropy_update( mbedtls_entropy_context *ctx, unsigned char source_id unsigned char tmp[MBEDTLS_ENTROPY_BLOCK_SIZE]; size_t use_len = len; const unsigned char *p = data; - int ret = 0; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; if( use_len > MBEDTLS_ENTROPY_BLOCK_SIZE ) { @@ -234,7 +235,7 @@ cleanup: int mbedtls_entropy_update_manual( mbedtls_entropy_context *ctx, const unsigned char *data, size_t len ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; #if defined(MBEDTLS_THREADING_C) if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 ) @@ -325,7 +326,7 @@ cleanup: */ int mbedtls_entropy_gather( mbedtls_entropy_context *ctx ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; #if defined(MBEDTLS_THREADING_C) if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 ) @@ -344,7 +345,8 @@ int mbedtls_entropy_gather( mbedtls_entropy_context *ctx ) int mbedtls_entropy_func( void *data, unsigned char *output, size_t len ) { - int ret, count = 0, i, done; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; + int count = 0, i, done; mbedtls_entropy_context *ctx = (mbedtls_entropy_context *) data; unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE]; diff --git a/library/hmac_drbg.c b/library/hmac_drbg.c index dd895be42..d197f24a1 100644 --- a/library/hmac_drbg.c +++ b/library/hmac_drbg.c @@ -199,7 +199,7 @@ static int hmac_drbg_reseed_core( mbedtls_hmac_drbg_context *ctx, unsigned char seed[MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT]; size_t seedlen = 0; size_t total_entropy_len; - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; if( use_nonce == HMAC_NONCE_NO ) total_entropy_len = ctx->entropy_len; @@ -298,7 +298,7 @@ int mbedtls_hmac_drbg_seed( mbedtls_hmac_drbg_context *ctx, const unsigned char *custom, size_t len ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; size_t md_size; if( ( ret = mbedtls_md_setup( &ctx->md_ctx, md_info, 1 ) ) != 0 ) @@ -375,7 +375,7 @@ int mbedtls_hmac_drbg_random_with_add( void *p_rng, unsigned char *output, size_t out_len, const unsigned char *additional, size_t add_len ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; volatile unsigned char *output_fi = output; volatile size_t out_len_fi = out_len; mbedtls_hmac_drbg_context *ctx = (mbedtls_hmac_drbg_context *) p_rng; @@ -461,7 +461,7 @@ exit: */ int mbedtls_hmac_drbg_random( void *p_rng, unsigned char *output, size_t out_len ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; mbedtls_hmac_drbg_context *ctx = (mbedtls_hmac_drbg_context *) p_rng; #if defined(MBEDTLS_THREADING_C) diff --git a/library/pk.c b/library/pk.c index caa5e17d0..85575133d 100644 --- a/library/pk.c +++ b/library/pk.c @@ -576,8 +576,8 @@ static int uecc_eckey_verify_wrap( void *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, const unsigned char *sig, size_t sig_len ) { - int ret; - volatile int ret_fi; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; + volatile int ret_fi = UECC_FAULT_DETECTED; uint8_t signature[2*NUM_ECC_BYTES]; unsigned char *p; const mbedtls_uecc_keypair *keypair = (const mbedtls_uecc_keypair *) ctx; @@ -677,7 +677,7 @@ static int asn1_write_mpibuf( unsigned char **p, unsigned char *start, static int pk_ecdsa_sig_asn1_from_uecc( unsigned char *sig, size_t *sig_len, size_t buf_len ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; size_t len = 0; const size_t rs_len = *sig_len / 2; unsigned char *p = sig + buf_len; @@ -691,10 +691,11 @@ static int pk_ecdsa_sig_asn1_from_uecc( unsigned char *sig, size_t *sig_len, *--p = MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE; len += 2; + ret = 0; memmove( sig, p, len ); *sig_len = len; - return( 0 ); + return( ret ); } static int uecc_eckey_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, diff --git a/library/ssl_cli.c b/library/ssl_cli.c index 3c5992328..7aee3ac56 100644 --- a/library/ssl_cli.c +++ b/library/ssl_cli.c @@ -47,6 +47,7 @@ #include "mbedtls/platform_time.h" #endif +#include "mbedtls/platform.h" #if defined(MBEDTLS_SSL_SESSION_TICKETS) #include "mbedtls/platform_util.h" #endif @@ -682,7 +683,7 @@ static void ssl_write_alpn_ext( mbedtls_ssl_context *ssl, */ static int ssl_generate_random( mbedtls_ssl_context *ssl ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; unsigned char *p = ssl->handshake->randbytes; #if defined(MBEDTLS_HAVE_TIME) mbedtls_time_t t; @@ -2342,7 +2343,7 @@ static int ssl_rsa_generate_partial_pms( mbedtls_ssl_context *ssl, unsigned char* out, unsigned add_length_tag ) { - volatile int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; + volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; /* * Generate (part of) the pre-master secret as @@ -2390,7 +2391,7 @@ static int ssl_rsa_encrypt_partial_pms( mbedtls_ssl_context *ssl, unsigned char *out, size_t buflen, size_t *olen ) { - volatile int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; + volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; size_t len_bytes = mbedtls_ssl_get_minor_ver( ssl ) == MBEDTLS_SSL_MINOR_VERSION_0 ? 0 : 2; mbedtls_pk_context *peer_pk = NULL; @@ -3121,7 +3122,7 @@ static int ssl_in_server_key_exchange_postprocess( mbedtls_ssl_context *ssl ) static int ssl_process_in_server_key_exchange( mbedtls_ssl_context *ssl ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server key exchange" ) ); /* Preparation: @@ -3362,7 +3363,7 @@ exit: static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> parse server hello done" ) ); @@ -3396,7 +3397,7 @@ static int ssl_parse_server_hello_done( mbedtls_ssl_context *ssl ) MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= parse server hello done" ) ); - return( 0 ); + return( ret ); } /* diff --git a/library/ssl_srv.c b/library/ssl_srv.c index bab8f00d7..fbad37b34 100644 --- a/library/ssl_srv.c +++ b/library/ssl_srv.c @@ -38,6 +38,7 @@ #include "mbedtls/debug.h" #include "mbedtls/ssl.h" #include "mbedtls/ssl_internal.h" +#include "mbedtls/platform.h" #include "mbedtls/platform_util.h" #include @@ -3424,7 +3425,7 @@ static int ssl_prepare_server_key_exchange( mbedtls_ssl_context *ssl, #if defined(MBEDTLS_USE_TINYCRYPT) { - int ret; + int ret = UECC_FAULT_DETECTED; static const unsigned char ecdh_param_hdr[] = { MBEDTLS_SSL_EC_TLS_NAMED_CURVE, 0 /* high bits of secp256r1 TLS ID */, @@ -4213,7 +4214,7 @@ static int ssl_in_client_key_exchange_parse( mbedtls_ssl_context *ssl, unsigned char *buf, size_t buflen ) { - int ret; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; mbedtls_ssl_ciphersuite_handle_t ciphersuite_info = mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake ); unsigned char *p, *end; @@ -4249,8 +4250,7 @@ static int ssl_in_client_key_exchange_parse( mbedtls_ssl_context *ssl, mbedtls_ssl_suite_get_key_exchange( ciphersuite_info ) == MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA ) { - ((void) ret); - if( mbedtls_ssl_ecdh_read_peerkey( ssl, &p, end ) != 0 ) + if( ( ret = mbedtls_ssl_ecdh_read_peerkey( ssl, &p, end ) ) != 0 ) return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED ); } else @@ -4272,7 +4272,6 @@ static int ssl_in_client_key_exchange_parse( mbedtls_ssl_context *ssl, if( ( ret = mbedtls_ecdh_read_public( &ssl->handshake->ecdh_ctx, p, end - p) ) != 0 ) { - ((void) ret); MBEDTLS_SSL_DEBUG_RET( 1, "mbedtls_ecdh_read_public", ret ); return( MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP ); } @@ -4414,7 +4413,7 @@ static int ssl_in_client_key_exchange_parse( mbedtls_ssl_context *ssl, return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); } - return( 0 ); + return( ret ); } /* Update the handshake state */ @@ -4735,7 +4734,7 @@ static int ssl_write_new_session_ticket( mbedtls_ssl_context *ssl ) */ int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl ) { - int ret = 0; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; if( ssl->state == MBEDTLS_SSL_HANDSHAKE_OVER || ssl->handshake == NULL ) return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA ); diff --git a/library/ssl_tls.c b/library/ssl_tls.c index 146a8f1e9..b81df29aa 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -50,7 +50,6 @@ #include "mbedtls/version.h" #include "mbedtls/platform.h" - #include #if defined(MBEDTLS_X509_CRT_PARSE_C) @@ -175,7 +174,7 @@ int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl, unsigned char *buf, size_t buflen ) { - int ret = 0; + int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; mbedtls_record rec; MBEDTLS_SSL_DEBUG_MSG( 1, ( "=> mbedtls_ssl_check_record" ) ); MBEDTLS_SSL_DEBUG_BUF( 3, "record buffer", buf, buflen ); @@ -1892,7 +1891,7 @@ static int ssl_compute_master( mbedtls_ssl_handshake_params *handshake, int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl ) { - volatile int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; + volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> derive keys" ) ); ssl->handshake->key_derivation_done = MBEDTLS_SSL_FI_FLAG_UNSET; @@ -1981,7 +1980,7 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl ) int mbedtls_ssl_build_pms( mbedtls_ssl_context *ssl ) { - volatile int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; + volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; mbedtls_ssl_ciphersuite_handle_t ciphersuite_info = mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake ); @@ -7319,7 +7318,7 @@ static int ssl_parse_certificate_verify( mbedtls_ssl_context *ssl, void *rs_ctx ) { volatile int verify_ret = MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE; - volatile int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; + volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; volatile int flow_counter = 0; mbedtls_ssl_ciphersuite_handle_t ciphersuite_info = mbedtls_ssl_handshake_get_ciphersuite( ssl->handshake ); @@ -7945,7 +7944,7 @@ static void ssl_handshake_wrapup_free_hs_transform( mbedtls_ssl_context *ssl ) int mbedtls_ssl_handshake_wrapup( mbedtls_ssl_context *ssl ) { - volatile int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR; + volatile int ret = MBEDTLS_ERR_PLATFORM_FAULT_DETECTED; #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) volatile const int authmode = ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET diff --git a/tinycrypt/ecc.c b/tinycrypt/ecc.c index c6c722a95..8854c2342 100644 --- a/tinycrypt/ecc.c +++ b/tinycrypt/ecc.c @@ -848,7 +848,7 @@ void vli_mmod_fast_secp256r1(unsigned int *result, unsigned int*product) } while (carry < 0); } else { - while (carry || + while (carry || uECC_vli_cmp_unsafe(curve_p, result) != 1) { carry -= uECC_vli_sub(result, result, curve_p); } @@ -1224,7 +1224,7 @@ int uECC_valid_public_key(const uint8_t *public_key) int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key) { - int ret; + int ret = UECC_FAULT_DETECTED; uECC_word_t _private[NUM_ECC_WORDS]; uECC_word_t _public[NUM_ECC_WORDS * 2]; @@ -1252,6 +1252,5 @@ int uECC_compute_public_key(const uint8_t *private_key, uint8_t *public_key) uECC_vli_nativeToBytes( public_key + NUM_ECC_BYTES, NUM_ECC_BYTES, _public + NUM_ECC_WORDS); - return UECC_SUCCESS; + return ret; } - diff --git a/tinycrypt/ecc_dh.c b/tinycrypt/ecc_dh.c index 1b1ff3fbf..ceabb0005 100644 --- a/tinycrypt/ecc_dh.c +++ b/tinycrypt/ecc_dh.c @@ -74,7 +74,7 @@ int uECC_make_key_with_d(uint8_t *public_key, uint8_t *private_key, unsigned int *d) { - int ret; + int ret = UECC_FAULT_DETECTED; uECC_word_t _private[NUM_ECC_WORDS]; uECC_word_t _public[NUM_ECC_WORDS * 2]; @@ -109,7 +109,7 @@ exit: int uECC_make_key(uint8_t *public_key, uint8_t *private_key) { - int ret; + int ret = UECC_FAULT_DETECTED; uECC_word_t _random[NUM_ECC_WORDS * 2]; uECC_word_t _private[NUM_ECC_WORDS]; uECC_word_t _public[NUM_ECC_WORDS * 2]; @@ -162,7 +162,7 @@ int uECC_shared_secret(const uint8_t *public_key, const uint8_t *private_key, uECC_word_t _private[NUM_ECC_WORDS]; wordcount_t num_words = NUM_ECC_WORDS; wordcount_t num_bytes = NUM_ECC_BYTES; - int r; + int r = UECC_FAULT_DETECTED; /* Converting buffers to correct bit order: */ uECC_vli_bytesToNative(_private, diff --git a/tinycrypt/ecc_dsa.c b/tinycrypt/ecc_dsa.c index 660c5e9fa..41e1d71bd 100644 --- a/tinycrypt/ecc_dsa.c +++ b/tinycrypt/ecc_dsa.c @@ -89,7 +89,7 @@ int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash, uECC_word_t s[NUM_ECC_WORDS]; uECC_word_t p[NUM_ECC_WORDS * 2]; wordcount_t num_n_words = BITS_TO_WORDS(NUM_ECC_BITS); - int r; + int r = UECC_FAILURE; /* Make sure 0 < k < curve_n */ @@ -136,7 +136,7 @@ int uECC_sign_with_k(const uint8_t *private_key, const uint8_t *message_hash, } uECC_vli_nativeToBytes(signature + NUM_ECC_BYTES, NUM_ECC_BYTES, s); - return UECC_SUCCESS; + return r; } int uECC_sign(const uint8_t *private_key, const uint8_t *message_hash,