From a038dc45802cc08d241b919e9a7c4d3b20f694ca Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Wed, 29 Jun 2022 11:23:30 +0800 Subject: [PATCH 1/6] fix test fail when seedfile not created when MBEDTLS_ENTROPY_NV_SEED enabled, it depends on `seedfile`. This patch tests if the file exists and create it. Signed-off-by: Jerry Yu --- programs/ssl/ssl_client2.c | 5 ++++ programs/ssl/ssl_server2.c | 5 ++++ programs/ssl/ssl_test_common_source.c | 36 +++++++++++++++++++++++++++ 3 files changed, 46 insertions(+) diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c index f6a6bb6d9d..c21c44f9b3 100644 --- a/programs/ssl/ssl_client2.c +++ b/programs/ssl/ssl_client2.c @@ -840,6 +840,11 @@ int main(int argc, char *argv[]) #endif #if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) +#if defined(MBEDTLS_ENTROPY_C) && \ + defined(MBEDTLS_ENTROPY_NV_SEED) && \ + !defined(MBEDTLS_NO_PLATFORM_ENTROPY) + create_entropy_seed_file(); +#endif status = psa_crypto_init(); if (status != PSA_SUCCESS) { mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n", diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index 3e2360ed6b..6c46582935 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -1650,6 +1650,11 @@ int main(int argc, char *argv[]) #endif #if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) +#if defined(MBEDTLS_ENTROPY_C) && \ + defined(MBEDTLS_ENTROPY_NV_SEED) && \ + !defined(MBEDTLS_NO_PLATFORM_ENTROPY) + create_entropy_seed_file(); +#endif status = psa_crypto_init(); if (status != PSA_SUCCESS) { mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n", diff --git a/programs/ssl/ssl_test_common_source.c b/programs/ssl/ssl_test_common_source.c index 1ff2077d4a..f5a33535dc 100644 --- a/programs/ssl/ssl_test_common_source.c +++ b/programs/ssl/ssl_test_common_source.c @@ -373,3 +373,39 @@ void mbedtls_print_supported_sig_algs(void) mbedtls_printf("ecdsa_sha1\n"); mbedtls_printf("\n"); } +#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) +#if defined(MBEDTLS_ENTROPY_C) && \ + defined(MBEDTLS_ENTROPY_NV_SEED) && \ + !defined(MBEDTLS_NO_PLATFORM_ENTROPY) +static void create_entropy_seed_file(void) +{ + int result; + size_t output_len = 0; + unsigned char seed_value[MBEDTLS_ENTROPY_BLOCK_SIZE]; + + /* Attempt to read the entropy seed file. If this fails - attempt to write + * to the file to ensure one is present. */ + result = mbedtls_platform_std_nv_seed_read(seed_value, + MBEDTLS_ENTROPY_BLOCK_SIZE); + if (0 == result) { + return; + } + + result = mbedtls_platform_entropy_poll(NULL, + seed_value, + MBEDTLS_ENTROPY_BLOCK_SIZE, + &output_len); + if (0 != result) { + return; + } + + if (MBEDTLS_ENTROPY_BLOCK_SIZE != output_len) { + return; + } + + mbedtls_platform_std_nv_seed_write(seed_value, MBEDTLS_ENTROPY_BLOCK_SIZE); +} +#endif /* MBEDTLS_ENTROPY_C && + MBEDTLS_ENTROPY_NV_SEED && + !MBEDTLS_NO_PLATFORM_ENTROPY */ +#endif From 461e8d288d1854b4b4575931792a089d40f2a9f0 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Thu, 30 Jun 2022 13:57:19 +0800 Subject: [PATCH 2/6] Revert "fix test fail when seedfile not created" This reverts commit 0b473dbd471e6c128c6fa3a8651c6d783927d182. Signed-off-by: Jerry Yu --- programs/ssl/ssl_client2.c | 5 ---- programs/ssl/ssl_server2.c | 5 ---- programs/ssl/ssl_test_common_source.c | 36 --------------------------- 3 files changed, 46 deletions(-) diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c index c21c44f9b3..f6a6bb6d9d 100644 --- a/programs/ssl/ssl_client2.c +++ b/programs/ssl/ssl_client2.c @@ -840,11 +840,6 @@ int main(int argc, char *argv[]) #endif #if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) -#if defined(MBEDTLS_ENTROPY_C) && \ - defined(MBEDTLS_ENTROPY_NV_SEED) && \ - !defined(MBEDTLS_NO_PLATFORM_ENTROPY) - create_entropy_seed_file(); -#endif status = psa_crypto_init(); if (status != PSA_SUCCESS) { mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n", diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index 6c46582935..3e2360ed6b 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -1650,11 +1650,6 @@ int main(int argc, char *argv[]) #endif #if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) -#if defined(MBEDTLS_ENTROPY_C) && \ - defined(MBEDTLS_ENTROPY_NV_SEED) && \ - !defined(MBEDTLS_NO_PLATFORM_ENTROPY) - create_entropy_seed_file(); -#endif status = psa_crypto_init(); if (status != PSA_SUCCESS) { mbedtls_fprintf(stderr, "Failed to initialize PSA Crypto implementation: %d\n", diff --git a/programs/ssl/ssl_test_common_source.c b/programs/ssl/ssl_test_common_source.c index f5a33535dc..1ff2077d4a 100644 --- a/programs/ssl/ssl_test_common_source.c +++ b/programs/ssl/ssl_test_common_source.c @@ -373,39 +373,3 @@ void mbedtls_print_supported_sig_algs(void) mbedtls_printf("ecdsa_sha1\n"); mbedtls_printf("\n"); } -#if defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3) -#if defined(MBEDTLS_ENTROPY_C) && \ - defined(MBEDTLS_ENTROPY_NV_SEED) && \ - !defined(MBEDTLS_NO_PLATFORM_ENTROPY) -static void create_entropy_seed_file(void) -{ - int result; - size_t output_len = 0; - unsigned char seed_value[MBEDTLS_ENTROPY_BLOCK_SIZE]; - - /* Attempt to read the entropy seed file. If this fails - attempt to write - * to the file to ensure one is present. */ - result = mbedtls_platform_std_nv_seed_read(seed_value, - MBEDTLS_ENTROPY_BLOCK_SIZE); - if (0 == result) { - return; - } - - result = mbedtls_platform_entropy_poll(NULL, - seed_value, - MBEDTLS_ENTROPY_BLOCK_SIZE, - &output_len); - if (0 != result) { - return; - } - - if (MBEDTLS_ENTROPY_BLOCK_SIZE != output_len) { - return; - } - - mbedtls_platform_std_nv_seed_write(seed_value, MBEDTLS_ENTROPY_BLOCK_SIZE); -} -#endif /* MBEDTLS_ENTROPY_C && - MBEDTLS_ENTROPY_NV_SEED && - !MBEDTLS_NO_PLATFORM_ENTROPY */ -#endif From 21ee650d3d93e0b03bd88dacc57175b74d61a2b3 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Thu, 30 Jun 2022 14:50:25 +0800 Subject: [PATCH 3/6] fix ssl-opt.sh test fail ssl-opt.sh depends on seedfile when MBEDTLS_ENTROPY_C && MBEDTLS_ENTROPY_NV_SEED && !MBEDTLS_NO_PLATFORM_ENTROPY Signed-off-by: Jerry Yu --- tests/ssl-opt.sh | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index ec8b0dc0c0..5c35d5df80 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -303,11 +303,10 @@ get_config_value_or_default() { # Note that if the configuration is not defined or is defined to nothing, # the output of this function will be an empty string. if [ "$LIST_TESTS" -eq 0 ];then - ${P_SRV} "query_config=${1}" + ${P_QUERY} "${1}" else echo "1" fi - } requires_config_value_at_least() { @@ -2005,6 +2004,19 @@ CLI_OUT="cli_out.$$" PXY_OUT="pxy_out.$$" SESSION="session.$$" +# If MBEDTLS_ENTROPY_C && MBEDTLS_ENTROPY_NV_SEED && !MBEDTLS_NO_PLATFORM_ENTROPY +# create seedfile to fix test fail. +requires_config_enabled MBEDTLS_ENTROPY_C +requires_config_enabled MBEDTLS_ENTROPY_NV_SEED +requires_config_disabled MBEDTLS_NO_PLATFORM_ENTROPY +create_seedfile() +{ + [ -f $1 ] || dd if=/dev/urandom of=$1 bs=64 count=1 2>/dev/null +} +if [ "${SKIP_NEXT:-}" != "YES" ]; then + eval "create_seedfile `$P_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE`" +fi + SKIP_NEXT="NO" trap cleanup INT TERM HUP From 54331fa3e84aa835c520d2f94069c66e4f72be7b Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Mon, 4 Jul 2022 09:25:18 +0000 Subject: [PATCH 4/6] fix various issues Signed-off-by: Jerry Yu --- tests/ssl-opt.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 5c35d5df80..81749c990b 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -2006,14 +2006,18 @@ SESSION="session.$$" # If MBEDTLS_ENTROPY_C && MBEDTLS_ENTROPY_NV_SEED && !MBEDTLS_NO_PLATFORM_ENTROPY # create seedfile to fix test fail. +SKIP_NEXT="NO" requires_config_enabled MBEDTLS_ENTROPY_C requires_config_enabled MBEDTLS_ENTROPY_NV_SEED requires_config_disabled MBEDTLS_NO_PLATFORM_ENTROPY create_seedfile() { - [ -f $1 ] || dd if=/dev/urandom of=$1 bs=64 count=1 2>/dev/null + dd if=/dev/urandom of=$1 bs=64 count=1 2>/dev/null } if [ "${SKIP_NEXT:-}" != "YES" ]; then + # `$P_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE` will return `"seedfile"` and + # `dd` will create file with double quotes. That's not expected, with `eval` + # we can remove double quotes eval "create_seedfile `$P_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE`" fi From 4070b42cdaeb263fef4a3169771bd476af74525a Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Sun, 24 Jul 2022 11:57:19 +0800 Subject: [PATCH 5/6] fix segment fault when psa init fail Signed-off-by: Jerry Yu --- tests/suites/test_suite_ssl.function | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index a19e08ac95..1e6faa9629 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -3150,6 +3150,8 @@ void raw_key_agreement_fail(int bad_server_ecdhe_key) &(server.socket), BUFFSIZE), 0); + USE_PSA_INIT(); + TEST_EQUAL(mbedtls_test_move_handshake_to_state( &(client.ssl), &(server.ssl), MBEDTLS_SSL_CLIENT_KEY_EXCHANGE), 0); @@ -3165,6 +3167,7 @@ void raw_key_agreement_fail(int bad_server_ecdhe_key) (client.ssl).handshake->xxdh_psa_peerkey[0] ^= 0x02; } + TEST_EQUAL(mbedtls_test_move_handshake_to_state( &(client.ssl), &(server.ssl), MBEDTLS_SSL_HANDSHAKE_OVER), bad_server_ecdhe_key ? MBEDTLS_ERR_SSL_HW_ACCEL_FAILED : 0); From e579a4d6d555a0869210f0ab20a1dc349dd15c32 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Thu, 20 Oct 2022 02:02:19 +0000 Subject: [PATCH 6/6] create seedfile in compat.sh And remove configuration option dependency. It only depends on if `MBEDTLS_PLATFORM_STD_NV_SEED_FILE` now. Signed-off-by: Jerry Yu --- tests/compat.sh | 10 ++++++++++ tests/ssl-opt.sh | 24 +++++++++--------------- 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/tests/compat.sh b/tests/compat.sh index ac29e50c35..ba187839ff 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -33,6 +33,7 @@ SRVMEM=0 : ${M_SRV:=../programs/ssl/ssl_server2} : ${M_CLI:=../programs/ssl/ssl_client2} : ${OPENSSL:=openssl} +: ${M_QUERY:=../programs/test/query_compile_time_config} : ${GNUTLS_CLI:=gnutls-cli} : ${GNUTLS_SERV:=gnutls-serv} @@ -1089,6 +1090,15 @@ else DOG_DELAY=10 fi +# `$M_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE` will return `"seedfile"` and +# `dd` will create file with double quotes. That's not expected, with `eval` +# we can remove double quotes +NV_SEED_FILE=$(eval "echo `$M_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE`") +if [ -n "$NV_SEED_FILE" ] && [ ! -f $NV_SEED_FILE ] +then + dd if=/dev/urandom of=$NV_SEED_FILE bs=64 count=1 2>/dev/null +fi + SKIP_NEXT="NO" trap cleanup INT TERM HUP diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index 81749c990b..8fd26850d4 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -2004,23 +2004,17 @@ CLI_OUT="cli_out.$$" PXY_OUT="pxy_out.$$" SESSION="session.$$" -# If MBEDTLS_ENTROPY_C && MBEDTLS_ENTROPY_NV_SEED && !MBEDTLS_NO_PLATFORM_ENTROPY -# create seedfile to fix test fail. -SKIP_NEXT="NO" -requires_config_enabled MBEDTLS_ENTROPY_C -requires_config_enabled MBEDTLS_ENTROPY_NV_SEED -requires_config_disabled MBEDTLS_NO_PLATFORM_ENTROPY -create_seedfile() -{ - dd if=/dev/urandom of=$1 bs=64 count=1 2>/dev/null -} -if [ "${SKIP_NEXT:-}" != "YES" ]; then - # `$P_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE` will return `"seedfile"` and - # `dd` will create file with double quotes. That's not expected, with `eval` - # we can remove double quotes - eval "create_seedfile `$P_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE`" + +# `$P_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE` will return `"seedfile"` and +# `dd` will create file with double quotes. That's not expected, with `eval` +# we can remove double quotes +NV_SEED_FILE=$(eval "echo `$P_QUERY MBEDTLS_PLATFORM_STD_NV_SEED_FILE`") +if [ -n "$NV_SEED_FILE" ] && [ ! -f $NV_SEED_FILE ] +then + dd if=/dev/urandom of=$NV_SEED_FILE bs=64 count=1 2>/dev/null fi + SKIP_NEXT="NO" trap cleanup INT TERM HUP