Commit Graph

11567 Commits

Author SHA1 Message Date
Hanno Becker
4f664cbb5c Clarify that mbedtls_ssl_set_cid() applies to all subsequent HSs 2019-06-03 14:42:08 +01:00
Hanno Becker
318a87b336 Document that the use of CID is disabled by default.
(Even if MBEDTLS_SSL_CID is set in config.h)
2019-06-03 14:42:08 +01:00
Hanno Becker
9742809531 Reference CID Draft in Connection ID documentation in config.h 2019-06-03 14:42:08 +01:00
Hanno Becker
7cf463e3cc Add basic Connection ID tests to ssl-opt.sh 2019-06-03 14:42:08 +01:00
Hanno Becker
a7d2542248 ssl_server2: Add cmd line options to configure use of CID extension 2019-06-03 14:42:08 +01:00
Hanno Becker
90cb359cf0 ssl_client2: Add cmd line options to configure use of CID extension 2019-06-03 14:42:08 +01:00
Hanno Becker
1f583eecd8 ssl_client2: Add helper to unhexify binary command line data 2019-06-03 14:42:08 +01:00
Hanno Becker
f8542cf620 Add dummy implementations for CID API 2019-06-03 14:42:08 +01:00
Hanno Becker
f8c10269d1 Update version_features.c 2019-06-03 14:42:08 +01:00
Hanno Becker
ebafe8b7cc Update query_config.c 2019-06-03 14:42:08 +01:00
Hanno Becker
bb47cd906f Add dep of MBEDTLS_SSL_CID on MBEDTLS_SSL_PROTO_DTLS to config check 2019-06-03 14:42:08 +01:00
Hanno Becker
019f4b58de Add API for the use of the DTLS Connection ID extension 2019-06-03 14:42:08 +01:00
Hanno Becker
2234e650f7 Add new configuration option controlling CID extension 2019-06-03 14:42:08 +01:00
Hanno Becker
53756b3228 Add MD[245] test CRTs to tree 2019-06-03 14:22:59 +01:00
Hanno Becker
2e0f71f977 Add instructions for MD[245] test CRTs to tests/data_files/Makefile 2019-06-03 14:22:53 +01:00
Hanno Becker
9dbc56152f Add suppport for MD2 to CSR and CRT writing example programs
The example programs programs/x509/cert_req and programs/x509/cert_write
(demonstrating the use of X.509 CSR and CRT writing functionality)
previously didn't support MD2 signatures.

For testing purposes, this commit adds support for MD2 to cert_req,
and support for MD2 and MD4 to cert_write.
2019-06-03 14:10:44 +01:00
Jaeden Amero
d5072d1f13
Merge pull request #133 from hanno-arm/dhm_selftest_der
Allow DHM selftest to run if MBEDTLS_PEM_PARSE_C is unset
2019-06-03 11:29:53 +01:00
Gilles Peskine
a3b93ff893 Make docstring style consistent
Use PEP 257 indented docstring style, mostly: always with """, with the
terminating """ on a separate line if the docstring is more than one
line, and with all lines indented to the opening """.

This commit does not change the text to keep the first paragraph single-line.
2019-06-03 11:23:56 +02:00
Jaeden Amero
7be9b4e932 Merge remote-tracking branch 'origin/pr/2664' into development
* origin/pr/2664:
  test: Always use `make clean` by itself
2019-06-03 09:56:07 +01:00
Hanno Becker
ba698da57a Remove use of MD2 in further x509parse tests 2019-06-03 09:54:07 +01:00
Hanno Becker
32b48ea364 Convert further x509parse tests to use lower-case hex data 2019-06-03 09:48:39 +01:00
Hanno Becker
8b0f9e6388 Allow DHM selftest to run if MBEDTLS_PEM_PARSE_C is unset
If MBEDTLS_PEM_PARSE_C is unset, the DHM selftest fails because
it uses PEM encoded test data.

This commit fixes this by providing the DER encoded form of the
test data instead in case MBEDTLS_PEM_PARSE_C is unset.
2019-05-31 17:28:59 +01:00
Jaeden Amero
3b025ac52b test: Always use make clean by itself
When running make with parallelization, running both "clean" and "lib"
with a single make invocation can lead to each target building in
parallel. It's bad if lib is partially done building something, and then
clean deletes what was built. This can lead to errors later on in the
lib target.

    $ make -j9 clean lib
      CC    aes.c
      CC    aesni.c
      CC    arc4.c
      CC    aria.c
      CC    asn1parse.c
      CC    ./library/error.c
      CC    ./library/version.c
      CC    ./library/version_features.c
      AR    libmbedcrypto.a
    ar: aes.o: No such file or directory
    Makefile:120: recipe for target 'libmbedcrypto.a' failed
    make[2]: *** [libmbedcrypto.a] Error 1
    Makefile:152: recipe for target 'libmbedcrypto.a' failed
    make[1]: *** [libmbedcrypto.a] Error 2
    Makefile:19: recipe for target 'lib' failed
    make: *** [lib] Error 2
    make: *** Waiting for unfinished jobs....

To avoid this sort of trouble, always invoke clean by itself without
other targets throughout the library. Don't run clean in parallel with
other rules. The only place where clean was run in parallel with other
targets was in list-symbols.sh.
2019-05-31 12:47:07 +01:00
Hanno Becker
136512b810 Correct placement of ChangeLog entry 2019-05-30 11:16:49 +01:00
Hanno Becker
41a740d492 Adapt ChangeLog 2019-05-30 11:16:39 +01:00
Hanno Becker
01346c645b Use SHA-256 instead of MD2 in X.509 CRT parsing tests
- Replace 'RSA with MD2' OID '2a864886f70d010102' by
  'RSA with SHA-256' OID '2a864886f70d01010b':
  Only the last byte determines the hash, and
  `MBEDTLS_OID_PKCS1_MD2 == MBEDTLS_OID_PKCS1 "\x02"`
  `MBEDTLS_OID_PKCS1_SHA256 == MBEDTLS_OID_PKCS1 "\x0b"`
  See oid.h.
- Replace MD2 dependency by SHA256 dependency.
- Adapt expected CRT info output.
2019-05-30 11:16:39 +01:00
Hanno Becker
d0d78d7c4a Consistently use lower case hex data in X.509 parsing tests 2019-05-30 11:16:39 +01:00
confusedsushi
670ed7232d
Merge branch 'development' into development 2019-05-29 14:44:16 +02:00
Darryl Green
f2688e2fe2 Remove all abi dumps, not just ones shared between versions
While the abi-checking script handled comparing only the modules
that were shared between the old and new versions correctly, the
cleanup of the abi dumps only removed what was shared. Change the
cleanup logic to remove all abi dumps instead.
2019-05-29 11:29:08 +01:00
Gilles Peskine
54f544581a Pacify Pylint
Pass Pylint by cleaning up the code where possible and silencing
Pylint where I know better.

No behavior change.
2019-05-29 09:58:59 +02:00
Gilles Peskine
42a0a0aeea Obey Python naming and method structure conventions
* Rename internal methods and fields to start with an underscore.
* Rename global constants to uppercase.
* Change methods that don't use self to be class methods or static
  methods as appropriate.

No behavior change in this commit.
2019-05-29 09:58:59 +02:00
Gilles Peskine
9d4d750041 Add a bit of documentation 2019-05-29 09:58:59 +02:00
Gilles Peskine
0bbad741f4 Switch script to Python3
generate_psa_constants.py was accidentally declared with an
implicitly-Python2 shebang.
2019-05-29 09:58:59 +02:00
Gilles Peskine
6f3c30e9db Merge follow-up: remove unused code from the development branch 2019-05-29 09:58:59 +02:00
Gilles Peskine
2938268fb4 Merge remote-tracking branch 'upstream-crypto/development' into psa-api-1.0-beta-merge_development_20190524
Conflicts:
* library/ssl_cli.c, library/ssl_tls.c:
  Removed on the development branch. Keep them removed.
* include/psa/crypto_extra.h, library/psa_crypto_storage.c,
  tests/suites/test_suite_psa_crypto.data,
  tests/suites/test_suite_psa_crypto.function,
  tests/suites/test_suite_psa_crypto_persistent_key.data,
  tests/suites/test_suite_psa_crypto_slot_management.data,
  tests/suites/test_suite_psa_crypto_slot_management.function:
  Modified on the development branch only to implement the enrollment
  algorithm, which has been reimplemented on the API branch.
  Keep the API branch.
2019-05-29 09:57:29 +02:00
Gilles Peskine
6562dd32ee
Merge pull request #128 from gilles-peskine-arm/psa-policy_alg2-api
Implementation-specific extension: Keys may allow a second algorithm

Implemented over API 1.0 beta3.
2019-05-29 09:45:53 +02:00
Gilles Peskine
3027ba6429 Enrollment algorithm in policy: add tests of psa_copy_key 2019-05-27 14:08:28 +02:00
Gilles Peskine
bcdd44b9be Enrollment algorithm in policy: add support in psa_copy_key tests
Add parameters to psa_copy_key tests for the enrollment algorithm (alg2).

This commit only tests with alg2=0, which is equivalent to not setting
an enrollment algorithm.
2019-05-27 14:08:28 +02:00
Gilles Peskine
b4e0cda8db Enrollment algorithm in policy: update persistent key tests
The storage format has changed, so update the test data accordingly.
2019-05-27 14:08:28 +02:00
Gilles Peskine
110aff4c38 Enrollment algorithm in policy: implement persistent keys 2019-05-27 14:08:28 +02:00
Gilles Peskine
183442c854 Enrollment algorithm in policy: test persistent keys 2019-05-27 14:08:27 +02:00
Gilles Peskine
f25c9ec02e Minor documentation improvements 2019-05-27 14:08:27 +02:00
Gilles Peskine
96f0b3b1d3 Keys may allow a second algorithm
Add a second permitted algorithm to key policies.

This commit includes smoke tests that do not cover psa_copy_key.
2019-05-27 14:08:27 +02:00
Gilles Peskine
d3bb7bb2f2 Persistent key reload: test more metadata
In the tests for opening a persistent key after closing it, also read
back and check the key data if permitted by policy, and the key
policy.
2019-05-24 17:02:25 +02:00
Gilles Peskine
1ecf92c2f8 Align test functions to usage/alg parameter order
Manually cherry-picked from ca5bed742f
by taking that patch, replacing KEYPAIR by KEY_PAIR
throughout (renaming applied in this branch), and discarding parts
about import_twice in test_suite_psa_crypto (this test function was
removed from this branch).
2019-05-24 16:38:14 +02:00
Jaeden Amero
f479aaef9b
Merge pull request #125 from gilles-peskine-arm/readme-fix-api-links
Fix PSA Crypto API links in README
2019-05-24 11:15:40 +01:00
Gilles Peskine
f81f87f4cc API spec HTML: Use Github Pages rather than htmlpreview
htmlpreview.github.io breaks some links: in index.html viewed through
this service, the links that should go to from_doxygen.html are shown
as internal links, so the meat of the document is invisible.

Link to Github pages instead. This relies on the documentation being
available on the `master` branch of the mbed-crypto repository.

This has the added benefit of not depending on a third-party service.
2019-05-23 19:34:06 +02:00
Gilles Peskine
58501e5ecc API spec PDF: link to the actual PDF
Link to the PDF file, not to a page with an embedded PDF reader
2019-05-23 19:33:45 +02:00
Renz Christian Bagaporo
d8a40b5725 Create link to include/mbedtls only when testing is enabled 2019-05-23 18:48:13 +08:00
Jaeden Amero
2ab5cf658f Merge remote-tracking branch 'origin/pr/2403' into development
* origin/pr/2403: (24 commits)
  crypto: Update to Mbed Crypto 8907b019e7
  Create seedfile before running tests
  crypto: Update to Mbed Crypto 81f9539037
  ssl_cli.c : add explicit casting to unsigned char
  Generating visualc files - let Mbed TLS take precedence over crypto
  Add a link to the seedfile for out-of-tree cmake builds
  Adjust visual studio file generation to always use the crypto submodule
  all.sh: unparallelize mingw tests
  all.sh - disable parallelization for shared target tests
  config.pl: disable PSA_ITS_FILE and PSA_CRYPTO_STORAGE for baremetal
  all.sh: unset crypto storage define in a psa full config cmake asan test
  all.sh: unset FS_IO-dependent defines for tests that do not have it
  curves.pl - change test script to not depend on the implementation
  Export the submodule flag to sub-cmakes
  Disable MBEDTLS_ECP_RESTARTABLE in full config
  Export the submodule flag to sub-makes
  Force the usage of crypto submodule
  Fix crypto submodule usage in Makefile
  Documentation rewording
  Typo fixes in documentation
  ...
2019-05-23 09:08:55 +01:00