From fcdebbeeb00ea4dc358508b3f6585ab4c0b547f6 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 21 Nov 2024 22:06:39 +0100 Subject: [PATCH 1/5] Fix `make dir/file` not rebuilding existing files Running `make library/foo`, `make programs/foo` or `make tests/foo` only rebuilt the given target if it was not an existing file, because the toplevel makefile does not know the file's dependencies and thus thought that every such target had empty dependencies. Fix this by always invoking make recursively. Signed-off-by: Gilles Peskine --- Makefile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 4615a44f6a..db53a4cf33 100644 --- a/Makefile +++ b/Makefile @@ -46,11 +46,14 @@ tests: lib mbedtls_test mbedtls_test: $(MAKE) -C tests mbedtls_test -library/%: +.PHONY: FORCE +FORCE: + +library/%: FORCE $(MAKE) -C library $* -programs/%: +programs/%: FORCE $(MAKE) -C programs $* -tests/%: +tests/%: FORCE $(MAKE) -C tests $* .PHONY: generated_files From edb89ff9c907347c8d3f5780e1f1815c54047a0d Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 21 Nov 2024 22:11:44 +0100 Subject: [PATCH 2/5] Create a new Python module used by generate_psa_tests.py Signed-off-by: Gilles Peskine --- framework | 2 +- tests/CMakeLists.txt | 1 + tests/Makefile | 1 + 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/framework b/framework index beb5dadbf2..0555f71d91 160000 --- a/framework +++ b/framework @@ -1 +1 @@ -Subproject commit beb5dadbf26156f434ea58dce5c5a3182df4c60f +Subproject commit 0555f71d91cb9d69ef2b14fb47de4799cc9e7043 diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index c13d6439b4..98973c9231 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -156,6 +156,7 @@ if(GEN_FILES) ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/mbedtls_framework/macro_collector.py ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/mbedtls_framework/psa_information.py ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/mbedtls_framework/psa_storage.py + ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/mbedtls_framework/psa_test_case.py ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/mbedtls_framework/test_case.py ${CMAKE_CURRENT_SOURCE_DIR}/../framework/scripts/mbedtls_framework/test_data_generation.py ${CMAKE_CURRENT_SOURCE_DIR}/../include/psa/crypto_config.h diff --git a/tests/Makefile b/tests/Makefile index baeb7f7c2f..92029c7d44 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -120,6 +120,7 @@ generated_psa_test_data: ../framework/scripts/mbedtls_framework/crypto_knowledge generated_psa_test_data: ../framework/scripts/mbedtls_framework/macro_collector.py generated_psa_test_data: ../framework/scripts/mbedtls_framework/psa_information.py generated_psa_test_data: ../framework/scripts/mbedtls_framework/psa_storage.py +generated_psa_test_data: ../framework/scripts/mbedtls_framework/psa_test_case.py generated_psa_test_data: ../framework/scripts/mbedtls_framework/test_case.py generated_psa_test_data: ../framework/scripts/mbedtls_framework/test_data_generation.py ## The generated file only depends on the options that are present in From f8fdea0fd48e076be454054b9953fb301fb2a15a Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 21 Nov 2024 22:26:32 +0100 Subject: [PATCH 3/5] Update framework Signed-off-by: Gilles Peskine --- framework | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/framework b/framework index 0555f71d91..e1f38eb599 160000 --- a/framework +++ b/framework @@ -1 +1 @@ -Subproject commit 0555f71d91cb9d69ef2b14fb47de4799cc9e7043 +Subproject commit e1f38eb599fffb6b3ac14b087a5f38306d89279f From bc3f917fb363fe86715181993270a035038a8be8 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 24 Dec 2024 11:32:39 +0100 Subject: [PATCH 4/5] crypto_config.h: Don't list mechanisms that are not implemented Don't list mechanisms that are not implemented in `include/psa/crypto_config.h`, even commented out. Uncommenting them wouldn't help anyway: they don't work. Having them listed, even commented out, causes `find_dependencies_not_implemented()` in `psa_test_case.py` to consider those mechanisms to be implemented, and thus causes `generate_psa_tests.py` to generate test cases that cannot be executed. The affected mechanisms are: * `PSA_ALG_CBC_MAC` (`PSA_WANT_ALG_CBC_MAC`) * `PSA_ALG_XTS` (`PSA_WANT_ALG_XTS`) * `PSA_ECC_FAMILY_SECP_K1` 224-bit (`PSA_WANT_ECC_SECP_K1_224`) Also remove the affected mechanisms from configuration adjustment files, since that is code that can never be triggered. There were already no generated test cases for SECP224K1 because `PSA_WANT_ECC_SECP_K1_224` was already detected as a dependency that cannot be implemented, because that is not a valid size: PSA defines SECP224K1 as 225-bit, and `crypto_knowledge.py` follows suite, so `generate_psa_tests.py` saw `PSA_WANT_ECC_SECP_K1_225` in its enumeration but skipped it because it was never mentioned in `crypto_config.h`. This causes generated PSA tests to no longer include positive test cases for `PSA_ALG_CBC_MAC` and `PSA_ALG_XTS`. Signed-off-by: Gilles Peskine --- .../mbedtls/config_adjust_legacy_from_psa.h | 19 --------------- .../config_adjust_psa_superset_legacy.h | 7 ------ include/psa/crypto_config.h | 14 ----------- library/psa_crypto_cipher.c | 3 --- scripts/config.py | 11 +-------- .../crypto_config_test_driver_extension.h | 24 ------------------- 6 files changed, 1 insertion(+), 77 deletions(-) diff --git a/include/mbedtls/config_adjust_legacy_from_psa.h b/include/mbedtls/config_adjust_legacy_from_psa.h index 04bdae61bb..48f1bab1ed 100644 --- a/include/mbedtls/config_adjust_legacy_from_psa.h +++ b/include/mbedtls/config_adjust_legacy_from_psa.h @@ -69,7 +69,6 @@ (defined(PSA_WANT_ECC_SECP_R1_384) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384)) || \ (defined(PSA_WANT_ECC_SECP_R1_521) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521)) || \ (defined(PSA_WANT_ECC_SECP_K1_192) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192)) || \ - (defined(PSA_WANT_ECC_SECP_K1_224) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224)) || \ (defined(PSA_WANT_ECC_SECP_K1_256) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256)) #define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES #define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES @@ -225,17 +224,6 @@ #endif /* missing accel */ #endif /* PSA_WANT_ECC_SECP_K1_192 */ -#if defined(PSA_WANT_ECC_SECP_K1_224) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1 -#define MBEDTLS_ECP_DP_SECP224K1_ENABLED -/* https://github.com/Mbed-TLS/mbedtls/issues/3541 */ -#error "SECP224K1 is buggy via the PSA API in Mbed TLS." -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_K1_224 */ - #if defined(PSA_WANT_ECC_SECP_K1_256) #if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) || \ defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ @@ -782,13 +770,6 @@ #define PSA_HAVE_SOFT_BLOCK_CIPHER 1 #endif -#if defined(PSA_WANT_ALG_CBC_MAC) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_MAC) -#error "CBC-MAC is not yet supported via the PSA API in Mbed TLS." -#define MBEDTLS_PSA_BUILTIN_ALG_CBC_MAC 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_CBC_MAC */ -#endif /* PSA_WANT_ALG_CBC_MAC */ - #if defined(PSA_WANT_ALG_CMAC) #if !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC) || \ defined(PSA_HAVE_SOFT_BLOCK_CIPHER) diff --git a/include/mbedtls/config_adjust_psa_superset_legacy.h b/include/mbedtls/config_adjust_psa_superset_legacy.h index ef65cce0d9..1a232cbb81 100644 --- a/include/mbedtls/config_adjust_psa_superset_legacy.h +++ b/include/mbedtls/config_adjust_psa_superset_legacy.h @@ -136,13 +136,6 @@ #endif /* PSA_WANT_ECC_SECP_K1_192 */ #endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */ -/* SECP224K1 is buggy via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/3541) */ -#if 0 && defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) -#if !defined(PSA_WANT_ECC_SECP_K1_224) -#define PSA_WANT_ECC_SECP_K1_224 1 -#endif /* PSA_WANT_ECC_SECP_K1_224 */ -#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */ - #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) #if !defined(PSA_WANT_ECC_SECP_K1_256) #define PSA_WANT_ECC_SECP_K1_256 1 diff --git a/include/psa/crypto_config.h b/include/psa/crypto_config.h index 36e937ad35..e0a8d60606 100644 --- a/include/psa/crypto_config.h +++ b/include/psa/crypto_config.h @@ -38,10 +38,6 @@ #ifndef PSA_CRYPTO_CONFIG_H #define PSA_CRYPTO_CONFIG_H -/* - * CBC-MAC is not yet supported via the PSA API in Mbed TLS. - */ -//#define PSA_WANT_ALG_CBC_MAC 1 #define PSA_WANT_ALG_CBC_NO_PADDING 1 #define PSA_WANT_ALG_CBC_PKCS7 1 #define PSA_WANT_ALG_CCM 1 @@ -84,22 +80,12 @@ #define PSA_WANT_ALG_TLS12_PSK_TO_MS 1 #define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 1 -/* XTS is not yet supported via the PSA API in Mbed TLS. - * Note: when adding support, also adjust include/mbedtls/config_psa.h */ -//#define PSA_WANT_ALG_XTS 1 - #define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1 #define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1 #define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1 #define PSA_WANT_ECC_MONTGOMERY_255 1 #define PSA_WANT_ECC_MONTGOMERY_448 1 #define PSA_WANT_ECC_SECP_K1_192 1 -/* - * SECP224K1 is buggy via the PSA API in Mbed TLS - * (https://github.com/Mbed-TLS/mbedtls/issues/3541). Thus, do not enable it by - * default. - */ -//#define PSA_WANT_ECC_SECP_K1_224 1 #define PSA_WANT_ECC_SECP_K1_256 1 #define PSA_WANT_ECC_SECP_R1_192 1 #define PSA_WANT_ECC_SECP_R1_224 1 diff --git a/library/psa_crypto_cipher.c b/library/psa_crypto_cipher.c index 3216c94898..efc5813ff0 100644 --- a/library/psa_crypto_cipher.c +++ b/library/psa_crypto_cipher.c @@ -71,9 +71,6 @@ static psa_status_t mbedtls_cipher_validate_values( #if !defined(PSA_WANT_ALG_OFB) MBEDTLS_ASSUME(alg != PSA_ALG_OFB); #endif -#if !defined(PSA_WANT_ALG_XTS) - MBEDTLS_ASSUME(alg != PSA_ALG_XTS); -#endif #if !defined(PSA_WANT_ALG_ECB_NO_PADDING) MBEDTLS_ASSUME(alg != PSA_ALG_ECB_NO_PADDING); #endif diff --git a/scripts/config.py b/scripts/config.py index ef13062936..957127e5d4 100755 --- a/scripts/config.py +++ b/scripts/config.py @@ -48,8 +48,6 @@ def realfull_adapter(_name, _value, _active): return True PSA_UNSUPPORTED_FEATURE = frozenset([ - 'PSA_WANT_ALG_CBC_MAC', - 'PSA_WANT_ALG_XTS', 'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE', 'PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE' ]) @@ -59,13 +57,8 @@ PSA_DEPRECATED_FEATURE = frozenset([ 'PSA_WANT_KEY_TYPE_RSA_KEY_PAIR' ]) -PSA_UNSTABLE_FEATURE = frozenset([ - 'PSA_WANT_ECC_SECP_K1_224' -]) - EXCLUDE_FROM_CRYPTO = PSA_UNSUPPORTED_FEATURE | \ - PSA_DEPRECATED_FEATURE | \ - PSA_UNSTABLE_FEATURE + PSA_DEPRECATED_FEATURE # The goal of the full configuration is to have everything that can be tested # together. This includes deprecated or insecure options. It excludes: @@ -357,8 +350,6 @@ class CryptoConfig(config_common.Config): if name in PSA_UNSUPPORTED_FEATURE: raise ValueError(f'Feature is unsupported: \'{name}\'') - if name in PSA_UNSTABLE_FEATURE: - raise ValueError(f'Feature is unstable: \'{name}\'') if name not in self.settings: self._get_configfile().templates.append((name, '', '#define ' + name + ' ')) diff --git a/tests/configs/crypto_config_test_driver_extension.h b/tests/configs/crypto_config_test_driver_extension.h index 66378e7def..879e29eb3f 100644 --- a/tests/configs/crypto_config_test_driver_extension.h +++ b/tests/configs/crypto_config_test_driver_extension.h @@ -127,14 +127,6 @@ #endif #endif -#if defined(PSA_WANT_ECC_SECP_K1_224) -#if defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224) -#undef MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224 -#else -#define MBEDTLS_PSA_ACCEL_ECC_SECP_K1_224 1 -#endif -#endif - #if defined(PSA_WANT_ECC_SECP_K1_256) #if defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) #undef MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256 @@ -367,14 +359,6 @@ #endif #endif -#if defined(PSA_WANT_ALG_XTS) -#if defined(MBEDTLS_PSA_ACCEL_ALG_XTS) -#undef MBEDTLS_PSA_ACCEL_ALG_XTS -#else -#define MBEDTLS_PSA_ACCEL_ALG_XTS 1 -#endif -#endif - #if defined(PSA_WANT_ALG_CHACHA20_POLY1305) #if defined(MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305) #undef MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 @@ -600,14 +584,6 @@ #endif #endif -#if defined(PSA_WANT_ALG_CBC_MAC) -#if defined(MBEDTLS_PSA_ACCEL_ALG_CBC_MAC) -#undef MBEDTLS_PSA_ACCEL_ALG_CBC_MAC -#else -#define MBEDTLS_PSA_ACCEL_ALG_CBC_MAC 1 -#endif -#endif - #if defined(PSA_WANT_ALG_HMAC) #if defined(MBEDTLS_PSA_ACCEL_ALG_HMAC) #undef MBEDTLS_PSA_ACCEL_ALG_HMAC From b62279d9608944a15f750581d2c1974e60ca7b7b Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 24 Dec 2024 17:17:03 +0100 Subject: [PATCH 5/5] Remove test coverage exceptions that are no longer needed Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 20 -------------------- 1 file changed, 20 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 09e1245868..31d678d19c 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -211,16 +211,6 @@ class CoverageTask(outcome_analysis.CoverageTask): # https://github.com/Mbed-TLS/mbedtls/issues/9592 re.compile(r'.*ECDSA.*only deterministic supported'), ], - 'test_suite_psa_crypto_generate_key.generated': [ - # Ignore mechanisms that are not implemented, except - # for public keys for which we always test that - # psa_generate_key() returns PSA_ERROR_INVALID_ARGUMENT - # regardless of whether the specific key type is supported. - _has_word_re((mech - for mech in _PSA_MECHANISMS_NOT_IMPLEMENTED - if not mech.startswith('ECC_PUB')), - exclude=r'ECC_PUB'), - ], 'test_suite_psa_crypto_metadata': [ # Algorithms declared but not supported. # https://github.com/Mbed-TLS/mbedtls/issues/9579 @@ -234,10 +224,6 @@ class CoverageTask(outcome_analysis.CoverageTask): 'MAC: CBC_MAC-AES-256', ], 'test_suite_psa_crypto_not_supported.generated': [ - # It is a bug that not-supported test cases aren't getting - # run for never-implemented key types. - # https://github.com/Mbed-TLS/mbedtls/issues/7915 - PSA_MECHANISM_NOT_IMPLEMENTED_SEARCH_RE, # We never test with DH key support disabled but support # for a DH group enabled. The dependencies of these test # cases don't really make sense. @@ -285,12 +271,6 @@ class CoverageTask(outcome_analysis.CoverageTask): # https://github.com/Mbed-TLS/mbedtls/issues/9592 'PSA sign DETERMINISTIC_ECDSA(SHA_256): !ECDSA but DETERMINISTIC_ECDSA with ECC_KEY_PAIR(SECP_R1)', #pylint: disable=line-too-long ], - 'test_suite_psa_crypto_storage_format.current': [ - PSA_MECHANISM_NOT_IMPLEMENTED_SEARCH_RE, - ], - 'test_suite_psa_crypto_storage_format.v0': [ - PSA_MECHANISM_NOT_IMPLEMENTED_SEARCH_RE, - ], 'tls13-misc': [ # Disabled due to OpenSSL bug. # https://github.com/openssl/openssl/issues/10714