The compile time guards were too restrictive, excluding builds with
drivers, updating them will allow driver tests to run as well.
Signed-off-by: Janos Follath <janos.follath@arm.com>
When we are doing PSK, we'd like to set verify_result to
0 to indicate success. Previously this was done in
mbedtls_ssl_set_hs_psk() but this is inadequate since this function may
be called for early data (where certificate verification happens later
in the handshake).
Instead, set this value after writing / processing the encrypted
extensions on the server / client respectively, so that we know whether
we are doing certificate verification or not for sure. This change is
effective only for TLS 1.3 as TLS 1.2 sets verify_result for PSK in
ssl_parse_certificate_coordinate().
Signed-off-by: David Horstmann <david.horstmann@arm.com>
In builds with only a nonvolatile seed but no actual entropy source, the
naive protection against fork() by reseeding in the child doesn't work:
every child forked from the same RNG state gets the same RNG state. To make
the child's RNG state unique in that case, use a public but unique
personalization string.
The personalization string includes the time. Use `mbedtls_ms_time()` if
available. Fall back to the classic (but obsolescent) `gettimeofday()`
otherwise.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
If a process forks with the PSA subsystem active, the PSA RNG state is
duplicated. This led to the parent process and the child process generating
the same sequence of random numbers.
Fix this by forcing a reseed if the value of `getpid()` changes. This is the
same technique used in OpenSSL ≥1.1.1d.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Assert that two forked children have distinct RNG states, and also that the
state is distinct from their parent.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit fixes two problems:
1. In 3.6 the SSL unit test framework ignores option.cipher, we need to
enforce it manually
2. In 3.6 we still have RSA key exchange and we need to condition the
RSA test on the presence of ECDHE_RSA key exchange modes as well
Signed-off-by: Janos Follath <janos.follath@arm.com>
In 3.6 we still have RSA key exchange and the existing preprocessor
guards are insufficient. Use the same macro to guard the definition that
guards the call.
Signed-off-by: Janos Follath <janos.follath@arm.com>
Simplify and improve error reporting and remove unnecessary
initialisation (the caller is responsible for initialising those
values).
Signed-off-by: Janos Follath <janos.follath@arm.com>
DEBUG_C supposed to have been removed from the test dependencies, still
being there is an oversight. Removing it was the sole purpose of
3e58109fbd.
Signed-off-by: Janos Follath <janos.follath@arm.com>
The caller is returning MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER if
ssl_parse_signature_algorithm() fails, but
ssl_parse_signature_algorithm() returns
MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE upon failure. There is no good reason
for this mismatch and better to be aligned.
Signed-off-by: Janos Follath <janos.follath@arm.com>
After the recent refactoring ssl_parse_signature_algorithm() sends an
alert on failure, but the caller also sends an alert on failure. Sending
two alerts is at least a protocol violation, and might not leave the SSL
context in a good state.
It is simpler to have the caller read the two bytes, and pass them to
this function.
Signed-off-by: Janos Follath <janos.follath@arm.com>
The unit test framework always loads the client key as well, which
requires a different curve and a hash than the server key.
Signed-off-by: Janos Follath <janos.follath@arm.com>
Add a test case with a successful handshake for each test case that
causes the desired handshake failure, with minimal differences between
the two.
The reason is to have more assurance that the handshake is failing for
the desired reason (as opposed to not having done something correctly in
the test code).
Signed-off-by: Janos Follath <janos.follath@arm.com>
There are other issues that can fail with the same error code. Make sure
that the handshake fails exactly the way we want it to fail by analysing
the client logs.
Signed-off-by: Janos Follath <janos.follath@arm.com>
The logic was easier to follow before 693a47a, which removed the
ssl_parse_signature_algorithm function and introduced the bug being
fixed in this PR.
When validating multiple conditions, it's easier to read, easier to
debug and, as we can see, easier to get right if you validate them
separately.
Signed-off-by: Janos Follath <janos.follath@arm.com>
We usually follow the pattern that a zero-initialised struct is safe to
free. This wasn't the case here.
Signed-off-by: Janos Follath <janos.follath@arm.com>
