Commit Graph

7032 Commits

Author SHA1 Message Date
Jaeden Amero
a47f32b9b9 Merge remote-tracking branch 'origin/pr/1976' into mbedtls-2.7
* origin/pr/1976:
  Move ChangeLog entry from Bugfix to Changes section
  Adapt ChangeLog
  Return from debugging functions if SSL context is unset
2019-03-05 16:28:59 +00:00
Jaeden Amero
6ee6f181ff Merge remote-tracking branch 'origin/pr/2435' into mbedtls-2.7
* origin/pr/2435:
  Use certificates from data_files and refer them
  Specify server certificate to use in SHA-1 test
  refactor CA and SRV certificates into separate blocks
  refactor SHA-1 certificate defintions and assignment
  refactor server SHA-1 certificate definition into a new block
  define TEST_SRV_CRT_RSA_SOME in similar logic to TEST_CA_CRT_RSA_SOME
  server SHA-256 certificate now follows the same logic as CA SHA-256 certificate
  add entry to ChangeLog
2019-03-05 16:25:53 +00:00
Hanno Becker
0f1e53f6fe Adapt ChangeLog 2019-03-05 16:23:19 +00:00
Hanno Becker
beaf3d0eaa ssl_server2: Fail gracefully if no PEM-encoded CRTs are available 2019-03-05 16:22:55 +00:00
Hanno Becker
d6bbf05f7c ssl_server2: Skip CA setup if ca_path or ca_file argument "none"
This allows to test PSK-based ciphersuites via ssl_server2 in builds
which have MBEDTLS_X509_CRT_PARSE_C enabled but both MBEDTLS_FS_IO and
MBEDTLS_CERTS_C disabled.
2019-03-05 16:22:39 +00:00
Hanno Becker
37e7db23d3 ssl_client2: Fail gracefully if no PEM-encoded CRTs are available 2019-03-05 16:16:16 +00:00
Hanno Becker
f74f5ce88d ssl_client2: Skip CA setup if ca_path or ca_file argument "none"
This allows to test PSK-based ciphersuites via ssl_client2 in builds
which have MBEDTLS_X509_CRT_PARSE_C enabled but both MBEDTLS_FS_IO and
MBEDTLS_CERTS_C disabled.

A similar change is applied to the `crt_file` and `key_file` arguments.
2019-03-05 16:16:06 +00:00
Gilles Peskine
5f3387bf79 Ignore more generated files: seedfile, apidoc 2019-03-04 18:24:42 +01:00
Gilles Peskine
30dc1bf1ef Improve .gitignore grouping and documentation 2019-03-04 18:24:42 +01:00
Gilles Peskine
4b0c4c9c0d Generate tags for Vi, for Emacs and with Global 2019-03-04 18:23:06 +01:00
Simon Butcher
fb85576f05 Merge remote-tracking branch 'restricted/pr/529' into mbedtls-2.7
* restricted/pr/529:
  Fix order of sections in the ChangeLog
  Fix failure in SSLv3 per-version suites test
  Adjust DES exclude lists in test scripts
  Clarify 3DES changes in ChangeLog
  Fix documentation for 3DES removal
  Exclude 3DES tests in test scripts
  Fix wording of ChangeLog and 3DES_REMOVE docs
  Reduce priority of 3DES ciphersuites
2019-03-03 10:08:12 +00:00
Simon Butcher
6728797f02 Merge remote-tracking branch 'public/pr/2148' into mbedtls-2.7
* public/pr/2148:
  Add ChangeLog entry for unused bits in bitstrings
  Improve docs for ASN.1 bitstrings and their usage
  Add tests for (named) bitstring to suite_asn1write
  Fix ASN1 bitstring writing
2019-03-01 13:09:04 +00:00
Manuel Pégourié-Gonnard
47237346d4 Fix order of sections in the ChangeLog 2019-03-01 10:34:21 +01:00
Manuel Pégourié-Gonnard
a82d38dc7c Fix failure in SSLv3 per-version suites test
The test used 3DES as the suite for SSLv3, which now makes the handshake fails
with "no ciphersuite in common", failing the test as well. Use Camellia
instead (as there are not enough AES ciphersuites before TLS 1.2 to
distinguish between the 3 versions).

Document some dependencies, but not all. Just trying to avoid introducing new
issues by using a new cipher here, not trying to make it perfect, which is a
much larger task out of scope of this commit.
2019-03-01 10:33:58 +01:00
Gilles Peskine
de12823a18 check-files.py: readability improvement in permission check 2019-02-26 16:37:42 +01:00
Gilles Peskine
fb8c373a15 check-files.py: use class fields for class-wide constants
In an issue tracker, heading and files_exemptions are class-wide
constants, so make them so instead of being per-instance fields.
2019-02-26 16:37:26 +01:00
Gilles Peskine
7194ecb3fb check-files.py: clean up class structure
Line issue trackers are conceptually a subclass of file issue
trackers: they're file issue trackers where issues arise from checking
each line independently. So make it an actual subclass.

Pylint pointed out the design smell: there was an abstract method that
wasn't always overridden in concrete child classes.
2019-02-26 16:35:35 +01:00
Gilles Peskine
4fb6678da5 check-files.py: document some classes and methods
Document all classes and longer methods.

Declare a static method as such. Pointed out by pylint.
2019-02-26 16:35:27 +01:00
Andres Amaya Garcia
fea3d0a3d0 Adjust DES exclude lists in test scripts 2019-02-26 12:46:16 +01:00
Gilles Peskine
b46f1bd451 Fix too small buffer in a test 2019-02-22 11:30:14 +01:00
Gilles Peskine
0efa8567d8 Add changelog entry for mbedtls_ecdh_get_params robustness 2019-02-21 18:17:05 +01:00
Gilles Peskine
f58078c7c5 Fix ecdh_get_params with mismatching group
If mbedtls_ecdh_get_params is called with keys belonging to
different groups, make it return an error the second time, rather than
silently interpret the first key as being on the second curve.

This makes the non-regression test added by the previous commit pass.
2019-02-21 18:17:05 +01:00
Gilles Peskine
496c9e053d Add test case for ecdh_get_params with mismatching group
Add a test case for doing an ECDH calculation by calling
mbedtls_ecdh_get_params on both keys, with keys belonging to
different groups. This should fail, but currently passes.
2019-02-21 18:17:05 +01:00
Gilles Peskine
390bbd08f7 Add test case for ecdh_calc_secret
Add a test case for doing an ECDH calculation by calling
mbedtls_ecdh_get_params on both keys, then mbedtls_ecdh_calc_secret.
2019-02-21 18:16:55 +01:00
Jaeden Amero
f054f8b3dc Merge remote-tracking branch 'origin/pr/2384' into mbedtls-2.7 2019-02-21 12:00:43 +00:00
Andres Amaya Garcia
493a0dc333 Clarify 3DES changes in ChangeLog 2019-02-19 21:07:03 +00:00
Antonin Décimo
8fd9156a4a Fix #2370, minor typos and spelling mistakes 2019-02-18 15:57:54 +00:00
Ron Eldor
de0c841b94 Use certificates from data_files and refer them
Use the server certificate from `data_files` folder, for formality,
and refer to the source, for easier reproduction.
2019-02-13 16:00:07 +02:00
Andres Amaya Garcia
b7c22ecc74 Fix documentation for 3DES removal 2019-02-13 10:00:02 +00:00
Andres Amaya Garcia
0a0e5b12a9 Exclude 3DES tests in test scripts 2019-02-13 09:59:06 +00:00
Andres Amaya Garcia
f9b2ed062f Fix wording of ChangeLog and 3DES_REMOVE docs 2019-02-13 09:53:59 +00:00
Andres Amaya Garcia
21ade06ef8 Reduce priority of 3DES ciphersuites 2019-02-13 09:52:46 +00:00
Ron Eldor
664623ebbc Specify server certificate to use in SHA-1 test
Specify the SHA-1 server certificate to use in the SHA-1 test,
because now the default certificates use SHA256 certificates.
2019-02-12 15:39:42 +02:00
ILUXONCHIK
be3d1ee4ac refactor CA and SRV certificates into separate blocks 2019-02-12 15:38:22 +02:00
ILUXONCHIK
231385568e refactor SHA-1 certificate defintions and assignment
As per refactoring suggestion that I made in #1520.
2019-02-12 15:38:12 +02:00
ILUXONCHIK
62f9aec184 refactor server SHA-1 certificate definition into a new block 2019-02-12 15:38:03 +02:00
ILUXONCHIK
e3be6723b0 define TEST_SRV_CRT_RSA_SOME in similar logic to TEST_CA_CRT_RSA_SOME 2019-02-12 15:37:48 +02:00
ILUXONCHIK
4d8325eceb server SHA-256 certificate now follows the same logic as CA SHA-256 certificate 2019-02-12 15:37:39 +02:00
ILUXONCHIK
5d45f8c54e add entry to ChangeLog 2019-02-12 15:35:04 +02:00
Andres Amaya Garcia
fc547ffb92 Add ChangeLog entry for unused bits in bitstrings 2019-02-11 21:10:55 +00:00
Andres Amaya Garcia
e730ff68ee Improve docs for ASN.1 bitstrings and their usage 2019-02-11 21:10:55 +00:00
Andres Amaya Garcia
abb7622d08 Add tests for (named) bitstring to suite_asn1write 2019-02-11 21:10:55 +00:00
Andres Amaya Garcia
04ee5e0bbd Fix ASN1 bitstring writing
Refactor the function mbedtls_asn1_write_bitstring() that removes
trailing 0s at the end of DER encoded bitstrings. The function is
implemented according to Hanno Becker's suggestions.

This commit also changes the functions x509write_crt_set_ns_cert_type
and crt_set_key_usage to call the new function as the use named
bitstrings instead of the regular bitstrings.
2019-02-11 21:10:48 +00:00
k-stachowiak
0fd3021204 Update change log 2019-02-11 09:41:23 +01:00
Peter Kolbus
16015ddd59 all.sh: Test MBEDTLS_MPI_WINDOW_SIZE=1
There were no tests for a non-default MPI window size. Add one.

Change-Id: Ic08fbc9161d0b3ee67eb3c91f9baf602646c9dfe
2019-02-05 16:42:45 +01:00
Peter Kolbus
f5d153daf0 Fix DEADCODE in mbedtls_mpi_exp_mod()
In mbedtls_mpi_exp_mod(), the limit check on wsize is never true when
MBEDTLS_MPI_WINDOW_SIZE is at least 6. Wrap in a preprocessor guard
to remove the dead code and resolve a Coverity finding from the
DEADCODE checker.

Change-Id: Ice7739031a9e8249283a04de11150565b613ae89
2019-02-05 16:42:27 +01:00
k-stachowiak
4d2982091b Correct code formatting in the timing test suites 2019-02-05 10:03:31 +01:00
k-stachowiak
16373da579 Apply imperiative style in the changelog entry 2019-02-05 10:03:20 +01:00
Christian Walther
5d662dc018 Add ChangeLog entry 2019-01-31 19:21:24 +02:00
Christian Walther
42aa453de8 Fix private DER output shifted by one byte. 2019-01-31 19:20:37 +02:00