coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-30 16:26:33 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,704 Commits 183 Branches 286 Tags Multiple Licenses 215 MiB
Commit Graph

7238 Commits

Author SHA1 Message Date
Gabor Mezei
5814e3e566
Remove MBEDTLS_KEY_EXCHANGE_RSA key exchange type 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2025-03-20 17:53:07 +01:00
Gabor Mezei
e1e27300a2
Remove MBEDTLS_KEY_EXCHANGE_RSA_ENABLED config option 
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
 2025-03-20 17:53:01 +01:00
Manuel Pégourié-Gonnard
4515d10163
Merge pull request #10039 from bjwtaylor/remove-rng-from-ssl 
Remove RNG parameters from public SSL APIs
 2025-03-19 11:27:51 +00:00
Gilles Peskine
c4dd970386
Merge pull request #9096 from noahp/noahp/mbedtls_net_send-api-desc-tweak 
mbedtls_net_send API description typo fix
 2025-03-13 16:22:55 +00:00
Bence Szépkúti
906d3cdff5
Merge pull request #10020 from bensze01/msvc-format-size-macros 
Fix preprocessor guards for C99 format size specifiers
 2025-03-13 10:09:06 +00:00
Bence Szépkúti
011b6cb1c5 Fix comments 
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2025-03-12 17:11:42 +01:00
Minos Galanakis
a2a0c2cbe7 Merge remote-tracking branch 'origin/features/tls-defragmentation/development' into feature_merge_defragmentation_dev 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2025-03-12 15:25:06 +00:00
Bence Szépkúti
cd1ece7846 Never use %zu on MinGW 
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2025-03-12 16:18:35 +01:00
Bence Szépkúti
becb21e668 Fix MSVC version guard for C99 format size specifiers 
Visual Studio 2013 (_MSC_VER == 1800) doesn't support %zu - only use it
on 2015 and above (_MSC_VER >= 1900).

%ldd works on Visual Studio 2013, but this patch keeps the two macro
definitions together, for simplicity's sake.

Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
 2025-03-12 16:16:20 +01:00
Gilles Peskine
2b78a5abfa State globally that the limitations don't apply to DTLS 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-03-12 10:07:33 +01:00
Gilles Peskine
d9c858039e Clarify DTLS 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-03-11 13:47:49 +01:00
Gilles Peskine
80facedad9 ClientHello may be fragmented in renegotiation 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-03-11 13:47:14 +01:00
Gilles Peskine
d8f9e22b5e Move the defragmentation documentation to mbedtls_ssl_handshake 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-03-11 13:45:27 +01:00
Ben Taylor
0cfe54e4e0 remove RNG parameters from SSL API's 
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2025-03-10 13:24:31 +00:00
Gilles Peskine
36edd48c61 Document the limitations of TLS handshake message defragmentation 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-03-05 17:41:59 +01:00
Valerio Setti
15fd5c9925 ssl: remove support for MBEDTLS_DHM_C 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-03-05 10:11:23 +01:00
Gilles Peskine
eb2d29eb6b Document the need to call mbedtls_ssl_set_hostname 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-02-24 18:48:49 +01:00
Gilles Peskine
96073fb997 Improve documentation of mbedtls_ssl_set_hostname 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-02-24 18:48:49 +01:00
Gilles Peskine
825c3d075a Add a note about calling mbedtls_ssl_set_hostname to mbedtls_ssl_setup 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-02-24 18:48:49 +01:00
Gilles Peskine
59a5117072 Create error code for mbedtls_ssl_set_hostname not called 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-02-24 18:48:49 +01:00
Gilles Peskine
434016e2eb Keep track of whether mbedtls_ssl_set_hostname() has been called 
No behavior change apart from now emitting a different log message depending
on whether mbedtls_ssl_set_hostname() has been called with NULL or not at all.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-02-24 18:47:44 +01:00
Manuel Pégourié-Gonnard
28f8e205eb
Merge pull request #9872 from rojer/tls_hs_defrag_in 
Defragment incoming TLS handshake messages
 2025-02-24 09:28:11 +01:00
Gilles Peskine
95fe2a6df4 Add a flags field to mbedtls_ssl_context 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-02-20 19:24:16 +01:00
Gilles Peskine
aa2594a52e Make ticket_alpn field private 
An omission in 3.x.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-02-20 18:51:14 +01:00
Deomid rojer Ryabkov
dd14c0a11e Remove in_hshdr 
The first fragment of a fragmented handshake message always starts at the beginning of the buffer so there's no need to store it.

Signed-off-by: Deomid rojer Ryabkov <rojer@rojer.me>
 2025-02-13 13:41:51 +03:00
Valerio Setti
d137f15e1b mbedtls_config.h: remove definition of MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-02-06 10:12:02 +01:00
Valerio Setti
02ae66830e check_config.h: remove checks for DHE-RSA 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-02-06 10:05:58 +01:00
Valerio Setti
b7e2eccf1f ssl_ciphersuites: remove MBEDTLS_KEY_EXCHANGE_SOME_XXDH_1_2_ENABLED 
This symbol is unused in the code so it can be removed.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-02-06 10:05:58 +01:00
Valerio Setti
b8621b6f9d ssl_ciphersuites: remove references to DHE-RSA key exchanges 
In this commit also MBEDTLS_KEY_EXCHANGE_SOME_DHE_ENABLED is removed.
This cause some code in "ssl_ciphersuites_internal.h" and
"ssl_tls12_server.c" to became useless, so these blocks are removed
as well.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-02-06 10:05:58 +01:00
Valerio Setti
89743b5db5 ssl_tls: remove code related to DHE-RSA 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-02-06 10:05:58 +01:00
David Horstmann
be658c47c8
Merge pull request #9938 from bjwtaylor/ssl-ticket-api 
Move ssl_ticket to the PSA API
 2025-02-05 10:41:09 +00:00
Ben Taylor
d0498803a1 Correct typos in comments 
Correct the typos in the mbedtls_ssl_ticket_setup function docs

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2025-02-03 11:35:34 +00:00
Harry Ramsey
2547ae9fcc Move SSL macro checks from TF-PSA-Crypto to Mbed TLS 
This commit moves macro checks specifically for Mbed TLS from
TF-PSA-Crypto to Mbed TLS where they more approriately belong.

Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
 2025-01-31 13:58:43 +00:00
Ben Taylor
0c29cf87b1 Move ssl_ticket to the PSA API 
Convert the mbedtl_ssl_ticket_setup function to use the TF_PSA_Crypto
API.

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
 2025-01-30 08:22:40 +00:00
Manuel Pégourié-Gonnard
28905b76fa Remove mention of USE_PSA_CRYPTO in documentation 
This was the last occurrence found by:

    git grep -c 'MBEDTLS_USE_PSA_CRYPTO' library include

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2025-01-28 16:44:08 +01:00
Manuel Pégourié-Gonnard
48e0e3a356 Rm dead !USE_PSA code: check_config.h 
Manual, as most expressions were too complex for unifdef. Most of those
were or had a part like "we need XXX or USE_PSA" (where XXX was Cipher
or MD) and those are always satisfied now.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2025-01-28 16:15:21 +01:00
Manuel Pégourié-Gonnard
11ae619e77 Rm dead !USE_PSA code: SSL headers (part 1) 
unifdef -m -DMBEDTLS_USE_PSA_CRYPTO {library,include/mbedtls}/ssl*.h

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2025-01-28 16:15:04 +01:00
Manuel Pégourié-Gonnard
873816129e Rm dead !USE_PSA code: SSL ciphersuite (part 2) 
Manual removal as unifdef doesn't handle non-trivial expressions.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2025-01-28 16:14:56 +01:00
Manuel Pégourié-Gonnard
b18c8b957b Rm dead !USE_PSA code: SSL hooks 
unifdef -m -DMBEDTLS_USE_PSA_CRYPTO {library,include/mbedtls}/ssl_{ticket,cookie}.[ch]

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2025-01-28 16:14:43 +01:00
Ronald Cron
189dcf630f
Merge pull request #9910 from valeriosetti/issue9684 
Remove DHE-PSK key exchange
 2025-01-27 11:15:10 +00:00
Manuel Pégourié-Gonnard
7e1154c959
Merge pull request #9906 from mpg/rm-conf-curves 
[dev] Remove deprecated function mbedtls_ssl_conf_curves()
 2025-01-27 08:21:27 +00:00
Valerio Setti
6ba324de02 mbedtls_config: remove MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED 
This commit also removes its disabling from config_adjust_ssl.h

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-01-24 11:49:59 +01:00
Valerio Setti
a07345247e check_config: remove checks for DHE-PSK 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-01-24 11:49:59 +01:00
Valerio Setti
6348b46c0b ssl_ciphersuites: remove references/usages of DHE-PSK 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-01-24 11:49:59 +01:00
Valerio Setti
48659a1f9c ssl_tls: remove usage of DHE-PSK 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-01-24 11:49:59 +01:00
Valerio Setti
6b64a1ba37 x509: remove definition and implementation of x509write_crt_set_serial 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2025-01-16 15:00:10 +01:00
Manuel Pégourié-Gonnard
6b720161ca Remove mbedtls_ssl_conf::curve_list 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2025-01-14 12:17:20 +01:00
Manuel Pégourié-Gonnard
93d4591255 Remove deprecated function mbedtls_ssl_conf_curves() 
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
 2025-01-14 12:06:31 +01:00
Gilles Peskine
bc7c523420 Remove uses of secp244k1 
Remove all code guarded by `PSA_WANT_ECC_SECP_K1_224`, which is not and will
not be implemented. (It would be K1_225 anyway, but we don't intend to
implement it anyway.)

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2025-01-08 16:51:23 +01:00
Deomid rojer Ryabkov
ac2cf1f26c Defragment incoming TLS handshake messages 
Signed-off-by: Deomid rojer Ryabkov <rojer@rojer.me>
 2024-12-25 14:34:17 +02:00
Minos Galanakis
1bf85a8634 mbedtls_config: Cleaned up legacy sections. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-16 08:53:48 +00:00
Minos Galanakis
80e76b66af Moved options to new sections. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-16 08:53:47 +00:00
Minos Galanakis
acd560f887 mbedtls_config: Added new section placeholders. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-16 08:53:47 +00:00
Ronald Cron
51f228cc1b Switch to actual TF-PSA-Crypto build_info.h 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-11 22:32:45 +01:00
Ronald Cron
e11ae17c60 Split check_config.h 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-11 22:32:45 +01:00
Ronald Cron
ce3c2dd30c
Merge pull request #9806 from ronald-cron-arm/finalize-split-preparation-1 
Finalize split preparation-1
 2024-12-05 13:23:09 +00:00
Ronald Cron
6924564970 Move back timing.c to mbedtls 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-04 14:25:02 +01:00
Ronald Cron
18047f0b01 Move config_adjust_legacy_crypto.h to tf-psa-crypto 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-04 14:25:02 +01:00
Ronald Cron
80963c64eb Move hkdf.h to tf-psa-crypto 
Move hkdf.h to tf-psa-crypto as
hkdf.c was.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-12-04 14:25:02 +01:00
Minos Galanakis
4f619e12e7 Renamed MBEDTLS_PSA_CRYPTO_CONFIG_FILE & MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE 
Files have been renamed respectively to:
- TF_PSA_CRYPTO_CONFIG_FILE
- TF_PSA_CRYPTO_USER_CONFIG_FILE

As per design proposal:
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:57:56 +00:00
Minos Galanakis
1f0d469e1d Cleaned up MbedTLS/tf-psa-crypto configs. 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:57:56 +00:00
Minos Galanakis
861b90c257 Migrated General and test configuration options (contd). 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:50:53 +00:00
Minos Galanakis
cb32d084aa crypto_config: Migrated newer configuration options. 
This commit, moves configuration entries that were not present
during the design-review.

It also updates the proposal accordingly.

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:50:09 +00:00
Minos Galanakis
f33250fcc1 crypto_config: Migrated MBEDTLS_NULL_CIPHER in legacy-crypto 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:49:55 +00:00
Minos Galanakis
127ffb507c crypto_config: Migrated legacy-crypto selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:49:08 +00:00
Minos Galanakis
a19e07fd14 crypto_config: Migrated crypto-drivers selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:38:02 +00:00
Minos Galanakis
626439ae50 crypto_config: Migrated PSA core selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:29:30 +00:00
Minos Galanakis
14489499e7 crypto_config: Migrated data format selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:29:15 +00:00
Minos Galanakis
45544e0bc3 crypto_config: Migrated cryptographic mechanism selection options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:29:04 +00:00
Minos Galanakis
2056958eb3 crypto_config: Migrated General and test configuration options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:28:51 +00:00
Minos Galanakis
25ae42e677 crypto_config: Migrated Platform options. 
Moved configuration entries in-line with the design proposal.
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/proposed/config-split.md

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-12-04 09:28:23 +00:00
Janos Follath
2761d18c00 Add issue reference for ECP_RESTARTABLE limitations 
Add reference to github issues to give a way for users to track
progress and express interest.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 13:58:15 +00:00
Janos Follath
745e561d2d Move the psa_init() warnings to _CLI and _SRV 
Now that USA_PSA_CRYPTO is always on, users need to call psa_init() with
all protocol versions.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 13:22:34 +00:00
Janos Follath
582ecd0ce1 Remove USE_PSA references from X509 documentation 
MBEDTLS_USE_PSA_CRYPTO is now always enabled we need to update the
documentation accordingly.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 12:53:05 +00:00
Janos Follath
130ece0b6e Remove USE_PSA references from SSL documentation 
MBEDTLS_USE_PSA_CRYPTO is now always enabled we need to update the
documentation accordingly.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 12:53:05 +00:00
Janos Follath
277bba89fb Remove USE_PSA references from config documentation 
MBEDTLS_USE_PSA_CRYPTO is now always enabled we need to update the
documentation accordingly.

Signed-off-by: Janos Follath <janos.follath@arm.com>
 2024-12-02 12:52:59 +00:00
Ronald Cron
93ba625b96 Remove MBEDTLS_PSA_CRYPTO_CONFIG configuration option 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-11-21 15:52:06 +01:00
Gilles Peskine
0068fceba3 Note the equivalence of two macros, thanks to RSA-PSK removal 
Removing the now-duplicate internal macro is left for future work.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:12 +01:00
Gilles Peskine
91e7ebebfe Remove RSA_PSK suites from cipher suite lists 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:12 +01:00
Gilles Peskine
b3ec125580 Remove mentions of RSA-PSK key exchange from documentation 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:12 +01:00
Gilles Peskine
712e9a1c3e Remove MBEDTLS_KEY_EXCHANGE_RSA_PSK 
Remove mentions of MBEDTLS_KEY_EXCHANGE_RSA_PSK that were not guarded by the
configuration option MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED. This finishes the
removal of library code that supports the RSA-PSK key exchange in TLS 1.2.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:12 +01:00
Gilles Peskine
ac767e5c69 Remove MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED 
Remove the configuration option MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED and all
code guarded by it. This remove support for the RSA-PSK key exchange in TLS
1.2.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-11-05 15:49:01 +01:00
Gilles Peskine
9863b04dec Make MBEDTLS_USE_PSA_CRYPTO no longer a selectable option 
The macro MBEDTLS_USE_PSA_CRYPTO is now always defined. It is no longer a
configuration option.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-10-30 14:23:16 +01:00
Gilles Peskine
8ed4d94166
Merge pull request #9614 from gilles-peskine-arm/use_psa_crypto-always_on 
Always enable MBEDTLS_USE_PSA_CRYPTO in all.sh
 2024-10-29 14:58:55 +00:00
Ronald Cron
5f6e69dae5
Merge pull request #9693 from Harry-Ramsey/split-revert-error-development 
Split error.h and move back error.c to mbedtls
 2024-10-25 13:12:58 +00:00
Gilles Peskine
43b4264cd8 Enable MBEDTLS_USE_PSA_CRYPTO by default 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-10-22 22:10:42 +02:00
Valerio Setti
83778d7aa9 Documentation: fix some nits 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
a006b8f6c1 check_config: prevent fully dynamic and static key stores to be enabled simultaneously 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
c2a6e8b3a9 mbedtls_config: fix/improve descriptions of PSA_STATIC_KEY_SLOT symbols 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
933b7693f4 mbedtls_config: fix descriptions for PSA static key slots 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
a7ce589fbc mbedtls_config: move MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE to the correct place 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Valerio Setti
678e0fb3e5 psa: allow to use static key buffers instead of dynamic ones 
This helps reducing heap memory usage and, if heap memory is
not used anywhere else in an embedded device, it also reduces
code footprint since there is no need for heap management code
in this case.

A new build symbol is added for this purpose, named
MBEDTLS_PSA_STATIC_KEY_SLOTS. It's disabled by default so that
normal usage of Mbed TLS library is not affected.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-10-22 17:56:36 +02:00
Harry Ramsey
90724f7f54 Move error.h from tf-psa-crypto to Mbed TLS 
This commit moves error.h from tf-psa-crypto to Mbed TLS for 4.0
release.

Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
 2024-10-18 08:19:50 +01:00
Harry Ramsey
468c0aede9 Revert move of version.h to tf-psa-crypto libray 
This commit moves version.h back into /include/mbedtls from
tf-psa-crypto/drivers/builtin/include. This commit also changes the
necessary build files and scripts to generate version_features.c

Signed-off-by: Harry Ramsey <harry.ramsey@arm.com>
 2024-10-04 13:37:42 +01:00
Ronald Cron
96c6f5eb36
Merge pull request #9492 from eleuzi01/remove-legacy-symbol-definitions 
Remove definitions of legacy symbols
 2024-10-01 10:33:06 +00:00
Elena Uziunaite
9b0bdd0590 Remove MBEDTLS_ECP_HAVE_xxx and MBEDTLS_MD_CAN_xxx 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
7f85f1f958 Cosmetic changes 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
feb105c042 Address review comment 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
05fe6e472e Remove MBEDTLS_MD_CAN_SHA512 from header files 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
3b84b2e28c Remove legacy symbol definitions pt 2 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
c0d6943b7f Replace legacy symbols in config files 
Replace symbols that were left over in config_adjust_*.h and
check_config.h

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
Elena Uziunaite
e4669a5753 Remove legacy symbol definitions pt 1 
Remove straightforward definitions that only appear in
config_adjust_legacy_crypto.h

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-26 14:48:59 +01:00
David Horstmann
b268d270ed
Merge pull request #9413 from sezrab/split_numeric_string_conversions_oid-development 
Split numeric string conversions out of the OID module
 2024-09-26 12:50:37 +00:00
David Horstmann
bae154d76c
Merge pull request #9385 from eleuzi01/replace-ecdsa-some 
Replace MBEDTLS_PK_HAVE_ECDSA* with PSA_WANT counterparts
 2024-09-19 13:53:18 +00:00
Sam Berry
f8db5b6f72 Move the function declarations to x509.h 
This commit moves the function declarations for
mbedtls_oid_get_numeric_string and mbedtls_oid_from_numeric_string from
oid.h to x509.h.

Signed-off-by: Sam Berry <sam.berry@arm.com>
 2024-09-18 21:23:09 +01:00
David Horstmann
7ba04a298c Bump version to 4.0.0 
Signed-off-by: David Horstmann <david.horstmann@arm.com>
 2024-09-10 10:43:14 +02:00
Elena Uziunaite
9c6476461f Remove definitions of MBEDTLS_PK_CAN/HAVE_ECDSA* 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-09 11:18:10 +01:00
Elena Uziunaite
bed21b55a6 Replace MBEDTLS_PK_CAN_ECDSA_VERIFY with PSA_HAVE_ALG_ECDSA_VERIFY 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-09 11:18:10 +01:00
Elena Uziunaite
39c7d5dc4b Replace MBEDTLS_PK_CAN_ECDSA_SIGN with PSA_HAVE_ALG_ECDSA_SIGN 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-09 11:18:08 +01:00
Ronald Cron
8c95999b38
Merge pull request #9544 from eleuzi01/replace-224k1 
Replace MBEDTLS_ECP_HAVE_SECP224K1 with PSA_WANT_ECC_SECP_K1_224
 2024-09-06 15:15:35 +00:00
Elena Uziunaite
63cb13e494 Replace MBEDTLS_ECP_HAVE_SECP224K1 with PSA_WANT_ECC_SECP_K1_224 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-05 12:43:14 +01:00
Elena Uziunaite
9fc5be09cb Replace MBEDTLS_MD_CAN_SHA1 with PSA_WANT_ALG_SHA_1 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-09-04 18:12:59 +01:00
Manuel Pégourié-Gonnard
f3cd97dd2e
Merge pull request #9327 from eleuzi01/issue-9319 
Remove hacks about asm vs constant-flow testing
 2024-09-03 07:37:02 +00:00
Manuel Pégourié-Gonnard
0b0f090b6e Merge remote-tracking branch 'restricted/development-restricted' into dev-mergeback 
* restricted/development-restricted: (30 commits)
  Tiny fix in ChangeLog pt 2
  Tiny fix in ChangeLog
  Changelog entry for the RSA memory leak
  Edit ChangeLog entry
  Update ChangeLog
  Add test cases for extKeyUsage
  Rationalize extKeyUsage tests
  Use P_CLI when O_CLI's status is not reliable
  Rationalize keyUsage testing, round 2
  Always print detailed cert errors in test programs
  Fix 1.3 failure to update flags for (ext)KeyUsage
  Rationalize ssl-opt tests for keyUsage
  Test cert alert KEY_USAGE -> UNSUPPORTED_CERT
  Free allocated memory where methods were returning without freeing
  Force MBEDTLS_PSA_HMAC_DRBG_MD_TYPE based on CTR_DRBG
  Document that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not force HMAC
  Clean up constant-flow memsan testing
  Improve description of who is affected
  More diversified sizes in tests
  Fix stack buffer overflow in ECDSA signature format conversions
  ...
 2024-09-02 09:18:34 +02:00
Gilles Peskine
ab0af45d11
Merge pull request #9464 from gilles-peskine-arm/psa-keystore-dynamic-development 
dynamically sized key store
 2024-08-26 10:47:00 +00:00
Gilles Peskine
0a2b6e2945 Merge remote-tracking branch 'development' into development-restricted 2024-08-23 11:14:11 +02:00
Bence Szépkúti
88f3dd9f78
Merge pull request #9402 from tom-daubney-arm/remove_function_level_alt_interface 
Remove function level alt interface
 2024-08-09 17:59:51 +00:00
Gilles Peskine
9e9e1f60e2 Dynamic key store: new compilation option 
Create a new compilation option for a dynamically resized key store. The
implementation will follow in subsequent commits.

This option is off by default with custom configuration files, which is best
for typical deployments on highly constrained platforms. This option is on
by default with the provided configuration file, which is best for typical
deployments on relatively high-end platforms.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-08-09 15:41:10 +02:00
Minos Galanakis
123a625386 Resolved merge conflicts caused by file moved in #8226 
Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
 2024-08-08 14:11:53 +01:00
Thomas Daubney
a0cdde3588 Remove outdated documentation 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-07 17:07:49 +01:00
Gilles Peskine
2cb03a5532 Improve the documentation of MBEDTLS_PSA_KEY_SLOT_COUNT 
The description was misleading: setting the option doesn't “restrict” the
number of slots, that restriction exists anyway. Setting the option merely
determines the value of the limit.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-08-07 12:39:05 +02:00
Thomas Daubney
28647d8669 Remove MBEDTLS_ECDSA_GENKEY_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
4864424fea Remove MBEDTLS_ECDSA_SIGN_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
e3013da240 Remove MBEDTLS_ECDSA_VERIFY_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
ce5ed8555c Remove MBEDTLS_ECDH_COMPUTE_SHARED_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
51b90fb6b1 Remove MBEDTLS_ECDH_GEN_PUBLIC_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:06 +01:00
Thomas Daubney
7c0b4adfa2 Remove MBEDTLS_AES_DECRYPT_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:20:03 +01:00
Thomas Daubney
6cf05f9322 Remove MBEDTLS_AES_ENCRYPT_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:15:51 +01:00
Thomas Daubney
955ce58142 Remove MBEDTLS_AES_SETKEY_DEC_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:15:08 +01:00
Thomas Daubney
742a2e3619 Remove MBEDTLS_AES_SETKEY_ENC_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-06 15:09:16 +01:00
Thomas Daubney
2bcf805284 Remove MBEDTLS_DES3_CRYPT_ECB_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
29561ec658 Remove MBEDTLS_DES_CRYPT_ECB_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
43874e0a84 Remove MBEDTLS_DES_SETKEY_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
3ab1b2d00b Remove MBEDTLS_SHA512_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
297b026d0a Remove MBEDTLS_SHA256_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
2106f79c49 Remove MBEDTLS_SHA1_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
64988680c5 Remove MBEDTLS_RIPEMD160_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Thomas Daubney
72a88e7255 Remove MBEDTLS_MD5_PROCESS_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-08-05 15:56:09 +01:00
Elena Uziunaite
3e81411122 Remove test_valgrind_constant_flow_psa_no_asm 
+ typo fix

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-08-05 15:55:44 +01:00
Elena Uziunaite
969e9e1af0 Alter constant-flow memsan testing 
Disable asm in memsan constant-flow testing and add a check in
check_config.h

Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-08-05 15:48:19 +01:00
Elena Uziunaite
83a0d9deec Replace MBEDTLS_SSL_HAVE_GCM with PSA_WANT_ALG_GCM 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-08-02 09:52:20 +01:00
Gilles Peskine
726e57f6f0
Merge pull request #1249 from gilles-peskine-arm/psa-drbg-no-hmac-document 
Document that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not force HMAC
 2024-07-31 16:47:27 +02:00
Elena Uziunaite
6121a344dd Replace MBEDTLS_SSL_HAVE_AES with PSA_WANT_KEY_TYPE_AES 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-07-30 18:42:19 +01:00
Paul Elliott
3962a38fa6
Merge pull request #9287 from Wenxing-hou/fix_some_typo 
Fix some typo for include folder
 2024-07-17 13:11:45 +00:00
Thomas Daubney
75246c0bea Remove irrelevant documentation notes 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:15:32 +01:00
Thomas Daubney
25bcf27c1a Remove MBEDTLS_SHA512_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:15:29 +01:00
Thomas Daubney
b248a93b3d Remove MBEDTLS_MD5_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:15:06 +01:00
Thomas Daubney
efc65e1168 Remove MBEDTLS_CMAC_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:14:43 +01:00
Thomas Daubney
027535c8a5 Remove MBEDTLS_SHA256_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:13:45 +01:00
Thomas Daubney
30c7701a1d Remove MBEDTLS_RIPEMD160_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:13:22 +01:00
Thomas Daubney
2cd12de614 Remove MBEDTLS_SHA1_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-15 12:05:07 +01:00
Thomas Daubney
25e2be16db Remove MBEDTLS_NIST_KW_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:55 +01:00
Thomas Daubney
a9ea6f8dd2 Remove MBEDTLS_DES_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:55 +01:00
Thomas Daubney
064f1df98f Remove MBEDTLS_ARIA_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:51 +01:00
Thomas Daubney
e9fe311ea6 Remove MBEDTLS_CAMELLIA_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:34 +01:00
Thomas Daubney
c7cb810c22 Remove MBEDTLS_GCM_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:07 +01:00
Thomas Daubney
b4914cfeb5 Remove MBEDTLS_CCM_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:15:04 +01:00
Thomas Daubney
4137609776 Remove MBEDTLS_AES_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-12 16:13:37 +01:00
Bence Szépkúti
3f2d9b6a4d
Merge pull request #9268 from tom-daubney-arm/remove_symmetric_crypto_alt_interface 
Remove symmetric crypto alt interface
 2024-07-12 13:27:04 +00:00
Wenxing Hou
b4d03cc179 Fix some typo for include folder 
Signed-off-by: Wenxing Hou <wenxing.hou@intel.com>
 2024-07-12 15:16:33 +08:00
Elena Uziunaite
4e6a3681e1 Replace MBEDTLS_MD_CAN_SHA256 in md.h, ssl.h, and entropy.h 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-07-11 11:13:35 +03:00
Thomas Daubney
f60ff02cf3 Remove MBEDTLS_CHACHA20_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-11 09:13:28 +01:00
Thomas Daubney
af28a17bb6 Remove MBEDTLS_CHACHAPOLY_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-11 09:13:28 +01:00
Thomas Daubney
f7ca94aea6 Remove MBEDTLS_POLY1305_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-11 09:13:28 +01:00
Thomas Daubney
9da1769237 Remove MBEDTLS_ECP_ALT and associated options 
Also removed are all options of the form
MBEDTLS_ECP_XXX_ALT as well as
MBEDTLS_ECP_NO_FALLBACK.

Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-05 14:35:10 +01:00
Thomas Daubney
e647d8f77a Remove MBEDTLS_ECJPAKE_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-05 14:35:10 +01:00
Thomas Daubney
5edad7f89f Remove MBEDTLS_DHM_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-05 14:35:10 +01:00
Thomas Daubney
f47b66eca5 Remove MBEDTLS_RSA_ALT 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-07-05 14:35:10 +01:00
Elena Uziunaite
cf5e3dd9f0 Replace MBEDTLS_MD_CAN_SHA384 in md.h and ssl.h 
Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
 2024-07-03 10:20:48 +01:00
Gilles Peskine
868d2524b8 Document that MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does not force HMAC 
MBEDTLS_PSA_HMAC_DRBG_MD_TYPE was documented and announced as causing the
PSA DRBG to be HMAC_DRBG. However, that was never actually implemented:
CTR_DRBG is prioritized if enabled.

Since there is a simple workaround of disabling MBEDTLS_CTR_DRBG_C if you
want to use HMAC_DRBG, we have decided to accept the actual behavior and fix
the documentation.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-07-02 16:31:28 +02:00
Ronald Cron
550a18d4d6 Move Mbed TLS crypto headers 
Move all the header files (roughly the crypto
and platform ones) necessary to build the
crypto library to
tf-psa-crypto/drivers/builtin/include/mbedtls.

Exceptions:
. some configuration related files that will not
be necessary anymore when the work on the
configuration file(s) is completed.
. build_info.h as TF-PSA-Crypto will have its
own when we had its CMake build system.

For the time being all headers are kept public
but eventually all headers in
tf-psa-crypto/drivers/builtin/include/mbedtls
will be private and the ones that remain
public (e.g. lms.h, pk.h probably ...) will be
moved to tf-psa-crypto/include/tf-psa-crypto/.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-07-01 14:59:35 +02:00
Ronald Cron
f0481f562a
Merge pull request #9258 from tom-daubney-arm/drop_padlock_support 
Drop support for VIA Padlock
 2024-06-26 07:36:04 +00:00
Thomas Daubney
4e5d183d78 Correct pluralisation errors in comments 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-06-25 15:21:48 +01:00
Manuel Pégourié-Gonnard
82658eb90c
Merge pull request #9138 from valeriosetti/issue9126 
Do not perform adjustments on legacy crypto from PSA, when MBEDTLS_PSA_CRYPTO_CLIENT && !MBEDTLS_PSA_CRYPTO_C
 2024-06-24 07:30:32 +00:00
Thomas Daubney
0d915a90ea Remove final references to padlock 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-06-20 16:45:51 +01:00
Ronald Cron
de0d7e6cd0
Merge pull request #9247 from ronald-cron-arm/move-psa-headers 
Move PSA headers to a new tf-psa-crypto directory
 2024-06-18 18:48:24 +00:00
Valerio Setti
0c0e418d63 config_psa: do not update legacy symbols in client-only PSA build 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-06-14 16:44:12 +02:00
Thomas Daubney
62af02c063 Drop support for VIA Padlock 
Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
 2024-06-14 10:37:13 +01:00
Ronald Cron
2581d91fda Adapt libraries installation 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-06-13 09:02:30 +02:00
Ronald Cron
d80134b56d Move PSA headers 
Move PSA headers to tf-psa-crypto
directory.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-06-12 15:22:26 +02:00
Sam Berry
3504c88916 Fix incorrect array length in function prototype 
Issue #9179 (MBEDTLS_SSL_CID_OUT_LEN_MAX changed to
MBEDTLS_SSL_CID_IN_LEN_MAX in library\ssl.h and library\ssl_tls.c)

Signed-off-by: Sam Berry <sam.berry@arm.com>
 2024-06-11 14:46:31 +01:00
Tom Cosgrove
98ffc8e7c3
Merge pull request #9178 from valeriosetti/fix-psa-cmac 
adjust_legacy_crypto: enable CIPHER_C when PSA CMAC is builtin
 2024-06-03 15:35:32 +00:00
Valerio Setti
351efa0ece crypto.h: fix documentation for some functions 
Some functions has input parameters which are erroneously
reported as "param[out]" in the documentation. This commit
fixes them.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-06-03 11:17:37 +02:00
Gilles Peskine
c8d45cd3fc Error on unexpectedly defined symbols 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
9df7806b37 Tweak wording 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
690fb5e0b0 Warn if mbedtls_config.h is included manually 
Some projects using Mbed TLS have migrated their configuration
file (config.h -> mbedtls_config.h, or MBEDTLS_CONFIG_FILE) from Mbed TLS
2.x, and kept including check_config.h. This is unnecessary since Mbed TLS
3.0, and increasingly in 3.x it may report spurious errors because the
configuration adjustments have not been done yet.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
0b8ece6beb Error out if *adjust* headers are included manually 
Some projects using Mbed TLS have migrated their configuration
file (config.h -> mbedtls_config.h, or MBEDTLS_CONFIG_FILE) from Mbed TLS
2.x, and kept including check_config.h. This is unnecessary since Mbed TLS
3.0, and increasingly in 3.x it may report spurious errors because the
configuration adjustments have not been done yet. This has led some
projects to include configuration adjustment headers manually, but only
partially or in the wrong order, which can result in silent inconsistencies.
Error out if this happens, with a message mentioning check_config.h since
that's the likely root cause.

```
perl -i -pe '$name = $ARGV; $name =~ s!include/!!; $name =~ s!_adjust_.*!_adjust_*.h!; $_ .= "\n#if !defined(MBEDTLS_CONFIG_FILES_READ)\n#error \"Do not include $name manually! This can lead to problems, \" \\\n    \"up to and including runtime errors such as buffer overflows. \" \\\n    \"If you're trying to fix a complaint from check_config.h, just remove it \" \\\n    \"from your configuration file: since Mbed TLS 3.0, it is included \" \\\n    \"automatically at the right time.\"\n#endif /* !MBEDTLS_CONFIG_FILES_READ */\n" if /^#define .*_H$/' include/*/*adjust*.h
```

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
d33eb55cce Macros to indicate the finalization level of the configuration 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Gilles Peskine
975e74cb1f Document check-config.h and *adjust*.h as internal headers 
Including *adjust*.h directly is likely to cause them to be applied at the
wrong time, resulting in an invalid or unintended configuration.

Including check_config.h at the wrong time is likely to cause spurious
errors.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
 2024-05-29 09:44:20 +02:00
Valerio Setti
a37ea269a9 adjust_legacy_crypto: enable CIPHER_C when PSA CMAC is builtin 
psa_crypto_mac.c uses mbedtls_cipher_xxx() functions to perform
CMAC operations. Therefore we need to enable CIPHER_C when
PSA CMAC is builtin.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-05-24 14:37:05 +02:00
Ronald Cron
b48c8704e6 Fix crypto_adjust_config_dependencies.h documentation 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-17 14:34:11 +02:00
Ronald Cron
c4c8bdf32e Fix PBKDF2_AES_CMAC_PRF_128 dependencies 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-17 14:34:06 +02:00
Ronald Cron
97f0ea7611 Fix the resolution of dependencies on HMAC 
The Mbed TLS implementations of ALG_TLS12_PRF,
ALG_TLS12_PSK_TO_MS, ALG_HKDF, ALG_HKDF_EXTRACT,
ALG_HKDF_EXPAND and ALG_PBKDF2 rely on HMAC
operations through the driver interface. Thus
if one of these algorithms is enabled and not
accelerated, we need ALG_HMAC to be enabled
(PSA_WANT_ALG_HMAC and PSA_WANT_KEY_TYPE_HMAC
defined). As HMAC operations occur through
the driver interface, HMAC operations can be
accelerated even if the caller algorithm
is not.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-17 14:33:44 +02:00
Ronald Cron
a33a824d8a Resolve PBKDF2_AES_CMAC_PRF_128 dependencies 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-16 08:12:03 +02:00
Ronald Cron
b0c96f47e7 Resolve some HMAC dependencies automatically 
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-05-16 08:12:03 +02:00
Noah Pendleton
9d1e3f6a00 mbedtls_net_send API description typo fix 
Signed-off-by: Noah Pendleton <noah.pendleton@gmail.com>
 2024-05-03 11:02:22 -04:00
Valerio Setti
89f5af84af adjust_legacy_crypto: enable ASN1_[PARSE|WRITE]_C when RSA_C 
RSA needs ASN1 functions to parse/write private and public keys,
but there is no guards in the code for that. So we need to enable
ASN1 support whenever RSA is enabled.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
 2024-04-18 18:47:34 +02:00
Manuel Pégourié-Gonnard
a4b773d3bb
Merge pull request #6955 from inorick/nofa_no_session_tickets 
Guard ticket specific TLS 1.3 function with macro
 2024-04-08 08:56:17 +00:00
Ronald Cron
fe15d90f72 tls13: Fix doc of mbedtls_ssl_session_set() - 2 
Fix documentation of mbedtls_ssl_session_set()
regarding its dependency on MBEDTLS_SSL_SESSION_TICKETS
in TLS 1.3 case.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
 2024-04-04 15:52:34 +02:00
Bence Szépkúti
a376f84eb1
Merge pull request #8937 from valeriosetti/issue8712 
Clarify the documentation of mbedtls_pk_setup_opaque
 2024-04-04 13:40:57 +00:00