This is similar to the already existing "component_full_no_pkparse_pkwrite".
The biggest difference is that this new component starts from "full" config
instead of "crypto_full" because we want to test also some TLS modules,
in particular "test_suite_debug" where the new function
"mbedtls_pk_write_pubkey_psa" has been introduced.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Don't print the differences: interested users can just run `git diff` (or
save the old file and run `comm`).
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Test that `scripts/data_files/config-options-current.txt` is up-to-date.
This file needs to change every time we add or remove a config option.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This script may be generalized to check other files that need lists of
current options. But for now, the script just checks
`scripts/data_files/config-options-current.txt`.
This script is identical to the file in crypto. If the file grows to support
multiple targets, we'll probably want to split it, with a generic part in
the framework and a project-specific part (probably little more than the
list of targets) in each project. But for now the file is too simple to split.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
secp192 curves are no more supported in tf-psa-crypto and also all the
temporary fixes has been removed. This one can be removed as well.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
We're going to remove ecdh.c soon, so use another way of testing whether
builtin ECDH is included in the build.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This is temporary but still required in order to have this commit merged
before the crypto#570, where these curves are really removed.
These lines will be removed in a follow-up PR once crypto#570 is merged.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
The comment was out-of-date since the addition of `component_test_aesni_m32`
in b6d39c2f8cba00eca52bc8d1081b7ddbb2c44b29 and the change from inspecting
`/proc/cpuinfo` to calling `lscpu` in a7de78d050aa62197e105d963af926a1b82a64bb.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Indicate which config file has the most relevant tweak.
Duplicate a few test cases so that both the crypto config and the mbedtls
config are tested.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Read the list of historical config options in 3.6, compare that to 1.0/4.0
and emit the appropriate checkers.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The support for TLS ciphersuites without
encryption does not rely anymore on the
MBEDTLS_CIPHER_NULL_CIPHER feature of
the cipher module. Introduce a specific
config option to enable these ciphersuites
and use it instead of MBEDTLS_CIPHER_NULL_CIPHER.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Cleanup following the removal in TF-PSA-Crypto of:
- MBEDTLS_NO_PLATFORM_ENTROPY
- MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
- MBEDTLS_ENTROPY_HARDWARE_ALT
- MBEDTLS_ENTROPY_MIN_HARDWARE
Only MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES was still
present in Mbed TLS.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
We cannot remove it completely yet.
It must remain in config.py so that it is not
included in the full configuration.
A temporary exception is required for it in
analyze_outcomes.py.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Adapt configurations to stricter compile-time checks
for entropy enablement and MBEDTLS_ENTROPY_NV_SEED
option.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Remove unnecessary passing of the crypto config filename either with the
'-f' or '-c' switch, throughout all of the all.sh component files.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Ensure that when we switch from SHA-512 to SHA-256
as the default CTR_DRBG hash, we still properly
test CTR_DRBG with SHA-512.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Remove all references to MBEDTLS_ECDSA_DETERMINISTIC from
components-configuration-crypto.sh. Replace them with
PSA_WANT_ALG_DETERMINISTIC_ECDSA.
This is safe because:
* MBEDTLS_ECDSA_DETERMINISTIC is only ever unset in components in order
to avoid errors from disabling its dependency MBEDTLS_HMAC_DRBG_C.
* MBEDTLS_ECDSA_DETERMINISTIC is only ever defined in
config_adjust_legacy_from_psa.h, and only if
PSA_WANT_ALG_DETERMINISTIC_ECDSA is defined.
Therefore PSA_WANT_ALG_DETERMINISTIC_ECDSA's dependencies are a superset
of MBEDTLS_ECDSA_DETERMINISTIC's dependencies and must include
MBEDTLS_HMAC_DRBG_C, so disabling PSA_WANT_ALG_DETERMINISTIC_ECDSA is a
sufficient substitute for disabling MBEDTLS_ECDSA_DETERMINISTIC.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
This will be needed when we change how many times some functions are
callled in ecp.c, making them more susceptible to inlining.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
Enable p192[k|r]1 curves which are disabled by default in tf-psa-crypto.
This is required to get the proper test coverage otherwise there are
tests in 'test_suite_psa_crypto_op_fail' that would never be executed.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Some EC/DH group might be disabled in default configuration in
"crypto_config.h" so before running "helper_get_psa_key_type_list" and/or
"helper_get_psa_curve_list" it's better to set/unset what's required
for that test component and only then parse the enabled groups.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
These reverse dependencies will be removed once tf-psa-crypto will
remove the corresponding build symbols.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Disable MBEDTLS_GENPRIME in the
test_psa_crypto_config_accel_rsa_crypto component.
This should likely have been the case already,
as all RSA crypto in this component is expected
to be provided by the test driver.
This change is necessary following the previous
commit to prevent analyze_outcomes.py from
complaining that, as MBEDTLS_GENPRIME tests are
passing in both the driver and reference
components, they should not be ignored.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
For the component test_psa_crypto_config_accel_rsa_crypto,
ignore the test cases depending on MBEDTLS_GENPRIME being
enabled. When all RSA crypto is provided by drivers
MBEDTLS_GENPRIME will not be enabled when it is not
a configuration option anymore.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Add warning log when disabling a configuration
option that does not exist.
When the removal of the legacy crypto config
options is completed, the warning will be
reverted to an error.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
In preparation of the removal of the configuration
option MBEDTLS_POLY1305_C, disable it in
test_psa_crypto_config_accel_cipher_aead_cmac as
it will be not possible to enable it when
CHACHA20_POLY1305 is accelerated.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Remove dependencies on MBEDTLS_CIPHER_MODE_CBC and
MBEDTLS_AES_C, as these options will no longer be
available once they are removed from the configuration.
The affected tests rely on the built-in CBC and AES
implementations. With the removal of
MBEDTLS_CIPHER_MODE_CBC and MBEDTLS_AES_C as
configuration options, there is no longer a mechanism
in ssl-opt.sh to express these dependencies.
As a result, filter out these tests at the all.sh
component level when the built-in CBC and AES
implementations are not available.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
To ease the removal of legacy crypto options, do not
fail in depends.py when disabling a non-existing option.
This mimics the behavior of 'config.py unset'.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
The SW implementation is guarded with the `MBEDTLS_PSA_BUILTIN_ALG_SHA3`
macros and not enabled when driver accelaration is set. So disabling
the `PSA_WANT` macros is not needed.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
With the removal of MBEDTLS_SHA3_C the test cases with disabled SHA3
dependency are never executed. Adding a temporary `all.sh` component
which disabling the `PSA_WANT_ALG_SHA3_*` macros to cover
these test cases.
Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
The goal of testing with GCC 15 is to validate fixes for
https://github.com/Mbed-TLS/mbedtls/issues/9814 . The bug is present in
multiple places, and some of them affect third-party drivers but not our
built-in implementation. (The bug is that driver contexts might not be
zero-initialized, but some of our built-in implementations happen not to
care about this.) Thus, enable the test drivers in the test component that
uses GCC 15, to gain the extra checks performed in the driver wrappers.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This is a new warning in GCC 15 that our code base triggers in many places.
Silence it for the time being.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Import component_test_platform_get_entropy_alt() from its counterpart
in TF-PSA-Crypto repo.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Use the proper Clang C++ compiler to build C++ code otherwise the C
compiler will fail because std::cout() is unknown in
"cpp_dummy_build.cpp".
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Use alternative implementation of mbedtls_platform_get_entropy() since
the default one lives in "platform.c" and that one is excluded in
this test component.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
By default C++ code would be compiled with GNU while C with Clang and
this can create problems at link time. In order to prevent this we
use Clang for both.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This is necessary to let entropy being able to gather entropy data from
the native platform source.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
