Commit Graph

9384 Commits

Author SHA1 Message Date
Darryl Green
5783847c63 Don't put abi dumps in subfolders 2019-04-18 11:47:28 +01:00
Darryl Green
6602538544 Add verbose switch to silence all output except the final report 2019-04-18 11:47:28 +01:00
Darryl Green
3f742987b8 Fetch the remote crypto branch, rather than cloning it 2019-04-18 11:47:28 +01:00
Darryl Green
88bfbc2deb Prefix internal functions with underscore 2019-04-18 11:47:28 +01:00
Darryl Green
7381bea6be Add RepoVersion class to make handling of many arguments easier
There are a number of arguments being passed around, nearly all of
which are duplicated between the old and new versions. Moving these
into a separate class should hopefully make it simpler to follow
what is being done.
2019-04-18 11:47:28 +01:00
Darryl Green
0478a32162 Reduce indentation levels 2019-04-18 11:47:28 +01:00
Darryl Green
7c0e052276 Improve documentation 2019-04-18 11:47:28 +01:00
Darryl Green
06c51d0470 Use optional arguments for setting repositories 2019-04-18 11:47:28 +01:00
Darryl Green
c8e6ad4ace Only build the library
We only need the .so files, so only build the library
2019-04-18 11:47:28 +01:00
Darryl Green
879f2509dc Add ability to compare submodules from different repositories
As before with wanting to compare revisions across different
repositories, the ability to select the crypto submodule from a
different repository is useful.
2019-04-18 11:47:28 +01:00
Darryl Green
de118091f2 Add handling for cases when not all .so files are present
We may wish to compare ABI/API between Mbed TLS and Mbed Crypto,
which will cause issues as not all .so files are shared. Only
compare .so files which both libraries have.
2019-04-18 11:47:28 +01:00
Darryl Green
ae5d66c612 Extend functionality to allow setting crypto submodule version
As going forward we will have Crypto in a submodule, we will need to
be able to check ABI compatibility between versions using different
submodule versions. For TLS versions that support the submodule, we
will always build using the submodule.

If the Crypto submodule is used, libmbedcrypto.so is not in the main
library folder, but in crypto/library instead. Given this, the script
searches for *.so files and notes their path, in order to create the
dumps correctly.
2019-04-18 11:47:28 +01:00
Darryl Green
131e24b1b5 Simplify logic for checking if report folder can be removed 2019-04-18 11:47:28 +01:00
Darryl Green
0da4578fae Add option for a brief report of problems only 2019-04-18 11:47:28 +01:00
Darryl Green
668063bca2 Add option to skip identifiers in ABI checks
By default abi-compliance-checker will check the entire ABI/API.
There are internal identifiers that we do not promise compatibility
for, so we want the ability to skip them when checking the ABI/API.
2019-04-18 11:47:28 +01:00
Darryl Green
5a301f0868 Extend abi-checking to different repos 2019-04-18 11:47:28 +01:00
Jaeden Amero
4cd4b4bf83 abi_check: Update submodules
When grabbing a fresh copy of a branch, it's required to also fetch the
submodule. Add fetching the submodule to abi_check.py.
2019-04-18 11:44:32 +01:00
Jaeden Amero
9ef6028da0 abi_check: Allow checking current checkout
Without a "--detach" option, git worktree will refuse to checkout a branch
that's already checked out. This makes the abi_check.py script not very
useful for checking the currently checked out branch, as git will error
that the branch is already checked out. Add the "--detach" option to check
out the new temporary worktree in detached head mode. This is acceptable
because we aren't planning on working on the branch and just want a
checkout to do ABI checking from.
2019-04-18 11:44:32 +01:00
Jaeden Amero
20d707dd3e Merge remote-tracking branch 'origin/pr/2571' into mbedtls-2.16
* origin/pr/2571:
  Clarify comment mangled by an earlier refactoring
  Add an "out-of-box" component
  Run ssl-opt.sh on 32-bit runtime
2019-04-16 15:10:18 +01:00
Jaeden Amero
69bc50a9a9 Merge remote-tracking branch 'origin/pr/2557' into mbedtls-2.16
* origin/pr/2557:
  Give credit to OSS-Fuzz for #2404
2019-04-16 15:08:08 +01:00
Jaeden Amero
d17b5e9abc Merge remote-tracking branch 'origin/pr/2553' into mbedtls-2.16
* origin/pr/2553:
  Remove ssl_cert_test sample app
2019-04-16 15:07:25 +01:00
Jaeden Amero
cc9b400271 Merge remote-tracking branch 'origin/pr/2568' into mbedtls-2.16
* origin/pr/2568:
  Fix typo in data_file generator code
2019-04-16 14:40:36 +01:00
Jaeden Amero
544fe92221 Merge remote-tracking branch 'origin/pr/2550' into mbedtls-2.16
* origin/pr/2550:
  Fix the proxy seed in Travis runs
2019-04-16 14:38:18 +01:00
Gilles Peskine
0a47c4ffbb Clarify comment mangled by an earlier refactoring 2019-04-10 18:47:51 +02:00
Gilles Peskine
99a3310fba Add an "out-of-box" component
Just run `make` and `make test`. And `selftest` for good measure.
2019-04-10 18:47:51 +02:00
Gilles Peskine
7dd44b28f1 Run ssl-opt.sh on 32-bit runtime
Run ssl-opt.sh on x86_32 with ASan. This may detect bugs that only
show up on 32-bit platforms, for example due to size_t overflow.

For this component, turn off some memory management features that are
not useful, potentially slow, and may reduce ASan's effectiveness at
catching buffer overflows.
2019-04-10 18:47:50 +02:00
Qixiang Xu
4c4ee7e0ae Fix CMake build error on Cygwin and minGW platforms
Signed-off-by: Qixiang Xu <qixiang.xu@arm.com>
2019-04-10 15:07:04 +01:00
Jaeden Amero
e59c4193fb Fix typo in data_file generator code
The file to generate is `server10_int3-bs.pem`, not
`server10-bs_int3-bs.pem`.
2019-04-10 11:50:36 +01:00
Jaeden Amero
da6a3c4d15 Give credit to OSS-Fuzz for #2404
Add "Credit to OSS-Fuzz", in addition to Guido Vranken, for identifying
bug #2404.
2019-04-08 11:27:43 +01:00
Ron Eldor
1ec99c66b8 Remove ssl_cert_test sample app
Remove the ssl_cert_test sample application, as it uses
hardcoded certificates that moved, and is redundant with the x509
tests and applications. Fixes #1905.
2019-04-07 16:51:18 +03:00
Jaeden Amero
0ea24a9127 Merge remote-tracking branch 'origin/pr/2500' into mbedtls-2.16
* origin/pr/2500:
  Fix default port number information
2019-04-05 14:26:20 +01:00
Manuel Pégourié-Gonnard
ab9bf63b06 Fix the proxy seed in Travis runs
This is what we do in Jenkins, so it only makes sense to do it here as well.
This will avoid random failures for no other reason than the proxy was
dropping all the messages due to an unlucky PRNG seed.

See https://docs.travis-ci.com/user/environment-variables/ for syntax
2019-04-05 15:23:20 +02:00
Jaeden Amero
db8821cb7e Merge remote-tracking branch 'origin/pr/2470' into mbedtls-2.16
* origin/pr/2470:
  Silence pylint
  check-files.py: readability improvement in permission check
  check-files.py: use class fields for class-wide constants
  check-files.py: clean up class structure
  abi_check.py: Document more methods
  check-files.py: document some classes and methods
  Fix pylint errors going uncaught
  Call pylint3, not pylint
  New, documented pylint configuration
2019-04-05 14:20:00 +01:00
Jaeden Amero
f41fa48dd4 Merge remote-tracking branch 'origin/pr/2520' into mbedtls-2.16
* origin/pr/2520:
  Fix errors in AEAD test function
2019-04-05 14:17:47 +01:00
Jaeden Amero
77027354f4 Merge remote-tracking branch 'origin/pr/2503' into mbedtls-2.16
* origin/pr/2503:
  Fix ChangeLog entry ordering
  Fix typo
  Add non-regression test for buffer overflow
  Improve documentation of mbedtls_mpi_write_string()
  Adapt ChangeLog
  Fix 1-byte buffer overflow in mbedtls_mpi_write_string()
2019-04-05 14:10:02 +01:00
Jaeden Amero
1c752f175d Merge remote-tracking branch 'origin/pr/2501' into mbedtls-2.16
* origin/pr/2501:
  Change Perl to Python in test builds
2019-04-05 14:08:11 +01:00
Jaeden Amero
9bfcebfe27 Merge remote-tracking branch 'origin/pr/2364' into mbedtls-2.16
* origin/pr/2364:
  Increase okm_hex buffer to contain null character
  Minor modifications to hkdf test
  Add explanation for okm_string size
  Update ChangeLog
  Reduce buffer size of okm
  Reduce Stack usage of hkdf test function
2019-04-05 13:53:22 +01:00
Jaeden Amero
5546267c86 Merge remote-tracking branch 'origin/pr/2510' into mbedtls-2.16
* origin/pr/2510:
  Remove Circle CI script
2019-04-05 13:51:52 +01:00
Jaeden Amero
749c944664 Merge remote-tracking branch 'origin/pr/2514' into mbedtls-2.16
* origin/pr/2514:
  x509.c: Fix potential memory leak in X.509 self test
2019-04-05 13:48:45 +01:00
Ron Eldor
24eec79255 Add guards for MBEDTLS_X509_CRL_PARSE_C in sample
Add checks in `ssl_server2` that `MBEDTLS_X509_CRL_PARSE_C` is defined
to fix compilation issue. Fixes #560.
2019-04-04 15:17:34 +03:00
Jaeden Amero
186c2c054d Merge remote-tracking branch 'restricted/pr/553' into mbedtls-2.16
* restricted/pr/553:
  Fix mbedtls_ecdh_get_params with new ECDH context
  Add changelog entry for mbedtls_ecdh_get_params robustness
  Fix ecdh_get_params with mismatching group
  Add test case for ecdh_get_params with mismatching group
  Add test case for ecdh_calc_secret
  Fix typo in documentation
2019-03-27 14:54:00 +00:00
Jaeden Amero
f2357f8903 Merge remote-tracking branch 'origin/pr/2526' into mbedtls-2.16
* origin/pr/2526:
  Update library version to 2.16.1
2019-03-26 15:27:56 +00:00
Jaeden Amero
9f4f8eec93 Update library version to 2.16.1 2019-03-19 16:20:02 +00:00
Jack Lloyd
b25719b031 Fix errors in AEAD test function
It was failing to set the key in the ENCRYPT direction before encrypting.
This just happened to work for GCM and CCM.

After re-encrypting, compare the length to the expected ciphertext
length not the plaintext length. Again this just happens to work for
GCM and CCM since they do not perform any kind of padding.
2019-03-14 11:06:02 +02:00
Junhwan Park
60ee28b36b x509.c: Fix potential memory leak in X.509 self test
Found and fixed by Junhwan Park in #2106.

Signed-off-by: Junhwan Park <semoking@naver.com>
2019-03-11 15:19:05 +02:00
Janos Follath
61ccc131d0 Remove Circle CI script
We are running an equivalent set of test by other means and therefore
this script is no longer needed.
2019-03-11 11:19:06 +00:00
Janos Follath
7ffe827fca Add ChangeLog entry for new function 2019-03-06 16:51:22 +00:00
Janos Follath
5f72119116 Add ChangeLog entry 2019-03-06 16:51:22 +00:00
Janos Follath
d73f61332e Correct deterministic ECDSA behavior
We were still reusing the internal HMAC-DRBG of the deterministic ECDSA
for blinding. This meant that with cryptographically low likelyhood the
result was not the same signature as the one the deterministic ECDSA
algorithm has to produce (however it is still a valid ECDSA signature).

To correct this we seed a second HMAC-DRBG with the same seed to restore
correct behavior. We also apply a label to avoid reusing the bits of the
ephemeral key for a different purpose and reduce the chance that they
leak.

This workaround can't be implemented in the restartable case without
penalising the case where external RNG is available or completely
defeating the purpose of the restartable feature, therefore in this case
the small chance of incorrect behavior remains.
2019-03-06 16:51:22 +00:00
Janos Follath
9f24b73151 Add warning for alternative ECDSA implementations
Alternative implementations are often hardware accelerators and might
not need an RNG for blinding. But if they do, then we make them misuse
the RNG in the deterministic case.

There are several way around this:
- Exposing a lower level function for replacement. This would be the
optimal solution, but litters the API and is not backward compatible.
- Introducing a new compile time option for replacing the deterministic
function. This would mostly cover the same code as
MBEDTLS_ECDSA_DETERMINISTIC and would be yet another compile time flag.
- Reusing the existing MBEDTLS_ECDSA_DETERMINISTIC macro. This changes
the algorithm used by the PK layer from deterministic to randomised if
the alternative implementation is present.

This commit implements the third option. This is a temporary solution
and should be fixed at the next device driver API change.
2019-03-06 16:51:22 +00:00