3588 Commits

Author SHA1 Message Date
Ronald Cron
00be9c9b67
Merge pull request #10700 from gilles-peskine-arm/python-project-knowledge-directory-mbedtls-dev
Create Python project knowledge directory
2026-05-12 13:38:23 +00:00
Gilles Peskine
a314ada082
Merge pull request #10631 from yiwu0b11/destdir_install_env_support
Support DESTDIR for install and add build-system test
2026-04-29 14:37:29 +00:00
Valerio Setti
51b62060de
Merge pull request #10639 from valeriosetti/ecdhe-rsa-fix-check
library: check_config: remove RSA encryption requirement from ECDHE-RSA
2026-04-24 07:30:47 +00:00
Gilles Peskine
52ca15362b Update comment
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-22 17:38:48 +02:00
Gilles Peskine
cf0bbfd024 Prefer to load tf_psa_crypto_test_case_info from project_knowledge
Try to load the list of tests that TF-PSA-Crypto wants us to ignore in three
ways, depending on the age of the tf-psa-crypto submodule:

* Modern: import `tf_psa_crypto_test_case_info` as an ordinary module,
  expected to be found in `tf-psa-crypto/scripts/project_knowledge`.
* First location, quickly superseded: load
  `tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py`,
  in a hackish way because we don't want to put that directory on the
  load path.
* Oldest: there is no `tf_psa_crypto_test_case_info.py`. Use a hard-coded
  list.

Once all the TF-PSA-Crypto branches we care about (e.g. pull requests
in progress) are updated with
`tf-psa-crypto/scripts/project_knowledge/tf_psa_crypto_test_case_info.py`,
we can drop the backward compatibilty hacks and simply
`import tf_psa_crypto_test_case_info` unconditionally and use
`tf_psa_crypto_test_case_info.INTERNAL_TEST_CASES` unconditionally.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-16 19:17:02 +02:00
Gilles Peskine
d934b7b751 Add tf-psa-crypto/scripts/project_knowledge to Python load path
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-16 19:16:30 +02:00
Yi Wu
970df30a8f test: improve symlink checks
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-15 12:13:09 +01:00
Yi Wu
0c02d74a48 test: versioned symlink order fix
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-14 11:06:16 +01:00
Yi Wu
f38b17e7a0 test: reorder if-else structure
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-14 10:12:44 +01:00
Yi Wu
331ad77fe2 test: add debug output and fix for win config
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-13 15:13:52 +01:00
Yi Wu
e9e0409b11 tests: fix DESTDIR install checks and add macOS compatibility
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-04-13 12:48:01 +01:00
Gilles Peskine
806e1d365b Documentation improvements
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-08 17:22:10 +02:00
Gilles Peskine
d25f03919a INTERNAL_TEST_CASES moved to a separate data-only module
This way, when Mbed TLS's `analyze_outcomes.py` loads the python module from
TF-PSA-Crypto (because it needs to know the value of `INTERNAL_TEST_CASES`),
there's no risk that the subproject and the superproject will have different
requirements on auxiliary modules such as `mbedtls_framework.outcome_analysis`.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-08 15:47:49 +02:00
Gilles Peskine
16a90a556e Add copyright line
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-08 15:31:52 +02:00
Gilles Peskine
667a3f6442 Move test currently covered by crypto from uncovered list to ignored list
If we can't read `INTERNAL_TEST_CASES` from
`tf-psa-crypto/tests/scripts/analyze_outcomes.py` because the script doesn't
exist, hard-code the legacy value of that information.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-07 11:47:24 +02:00
Gilles Peskine
1978e1bd6b Ignore test cases that TF-PSA-Crypto tells us to ignore
If the `tf-psa-crypto` submodule has `tests/scripts/analyze_outcomes.py`,
require it to define a global variable `INTERNAL_TEST_CASES`. Those test
cases will be ignored in Mbed TLS's coverage analysis.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-07 11:47:13 +02:00
Gilles Peskine
bb5cfbbdec Move _has_word_re to the framework
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-07 11:06:39 +02:00
Gilles Peskine
68d6b07287 Rename IGNORED_TESTS to UNCOVERED_TESTS
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-04-07 11:06:39 +02:00
Minos Galanakis
6804c92d7d Merge tag 'mbedtls-4.1.0' into mbedtls-4.1.0_mergeback
Mbed TLS 4.1.0

Signed-off-by: Minos Galanakis <minos.galanakis@arm.com>
2026-03-31 15:35:49 +01:00
Yi Wu
532db3d49e Test: add symlinks and dangling link check
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-03-26 09:27:41 +00:00
Ronald Cron
f285018fa3 Disable "DTLS proxy: 3d, (openssl|gnutls) client, fragmentation" tests
The tests fail intermittently on the CI with a frequency that
significantly impacts CI throughput.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-03-25 08:45:22 +01:00
Ronald Cron
ade56554a6 Revert "ssl_server2.c: DTLS: Attempt to read the response to the close notification"
This reverts commit 2e9b9681e60ff52d69a3a68b4c7be0bcbab9191b.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-03-24 18:38:37 +01:00
Gilles Peskine
aa40ca90d9 Move check_committed_generated_files to its own component
This will probably help when a framework change causes the content of these
files to change. See https://github.com/Mbed-TLS/mbedtls-test/issues/252

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-03-23 15:38:32 +01:00
Gilles Peskine
61cf7bdc90 Add Python requirements from framework/util
Any `all.sh` component that runs a script that requires a more recent
version of Python must have a `support_xxx` function that checks for the
requisite Python version or package. At this time, there is no such
requirement yet in the mbedtls repository.

The directory `framework/util` is not yet checked by `pylint` or `mypy`,
because we use older versions of these tools that don't work well with
modern Python versions.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-03-23 15:38:28 +01:00
Gilles Peskine
260992c0f4 check_committed_generated_files.py: use the new generate_files_helper module
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-03-23 15:37:45 +01:00
Gilles Peskine
4a21496d6f Prepare to generalize check_option_lists.py
We're going to have more committed generated files.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-03-23 15:37:45 +01:00
Valerio Setti
a201a74b7d tests: depends.py: extend pkalgs including PSA_WANT_ALG_RSA_PKCS1V15_SIGN
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2026-03-19 17:50:26 +01:00
Valerio Setti
63df2f79a4 tests: depends.py: fix reverse dependency for RSA
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2026-03-19 17:50:26 +01:00
Gilles Peskine
f840cb16e5 Update paths after moving some scripts to the framework
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-03-12 10:18:52 +01:00
Gilles Peskine
326fb18585 Move some scripts from mbedtls into the framework
Move a bunch of files from `scripts` and `mbedtls/scripts` to the framework.
Most are not called from any scripts invoked by the CI, but a couple are.
A subsequent commit will adapt the scripts. None of these scripts are
referenced from other repositories except in documentation.

The following files will be removed, and added to `mbedtls-framework`:

* `scripts/ecp_comb_table.py`
* `scripts/massif_max.pl`
* `tests/scripts/audit-validity-dates.py` (moved to `scripts/`)
* `tests/scripts/gen_ctr_drbg.pl` (moved to `scripts/`)
* `tests/scripts/gen_gcm_decrypt.pl` (moved to `scripts/`)
* `tests/scripts/gen_gcm_encrypt.pl` (moved to `scripts/`)
* `tests/scripts/gen_pkcs1_v21_sign_verify.pl` (moved to `scripts/`)
* `tests/scripts/generate-afl-tests.sh` (moved to `scripts/`)
* `tests/scripts/generate_server9_bad_saltlen.py` (moved to `scripts/`)
* `tests/scripts/run-metatests.sh` (moved to `scripts/`)
* `tests/scripts/run_demos.py` (moved to `scripts/`)
* `tests/scripts/test_config_script.py` (moved to `scripts/`)

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-03-12 10:18:33 +01:00
Gilles Peskine
23318bde24 Remove PSA status coverage log test
We haven't used this in years. It's obsolete because this functionality
should now be provided by the more general PSA function
wrappers (`PSALoggingWrapper` generator), although that work is unfinished.
It belongs in TF-PSA-Crypto anyway. So remove it, it's one less little
amount of baggage.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-03-12 10:18:33 +01:00
Gilles Peskine
b9ff81c4c5 Merge remote-tracking branch 'development' into merge-development-restricted-20260311 2026-03-11 12:32:56 +01:00
Ronald Cron
b5749b88f6
Merge pull request #10576 from ronald-cron-arm/dtls-client-hello-defragmentation
Add support for (D)TLS 1.2 client hello defragmentation
2026-03-10 14:46:07 +00:00
Ronald Cron
269b390bb4 components-platform.sh: Fix path of compiler directory
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-03-09 08:28:51 +01:00
Ronald Cron
a400a3bb8a Adapt list_internal_identifiers.py for upcoming directory changes
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-03-09 08:28:51 +01:00
Ronald Cron
24bf98156a components*.sh: Handle current and upcoming object paths
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-03-09 08:28:51 +01:00
Ronald Cron
03ee085e10 Remove duplicated recursion tests
The recursion tests for the crypto code
are run in a TF-PSA-Crypto component.
No need to run them in an Mbed TLS
component as well.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-03-09 08:28:51 +01:00
Yi Wu
b6ef9ec78f Support DESTDIR for install and add build-system test
Signed-off-by: Yi Wu <yi.wu2@arm.com>
2026-03-05 17:32:51 +00:00
Gilles Peskine
3d4b7cd3f9 Merge remote-tracking branch 'development' into development-restricted 2026-03-03 19:00:20 +01:00
Bence Szépkúti
c2cb8565a5
Merge pull request #10607 from gilles-peskine-arm/timing-use-mstime
Simplify MBEDTLS_TIMING_C to use mbedtls_ms_time()
2026-02-26 14:38:50 +00:00
Ronald Cron
6e270c0465 ssl-opt.sh: Add tests with CH fragmented with DTLS in default config
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-02-23 12:12:36 +01:00
Ronald Cron
2e9b9681e6 ssl_server2.c: DTLS: Attempt to read the response to the close notification
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-02-23 12:12:36 +01:00
Valerio Setti
b41c8f6e04
Merge pull request #10608 from bjwtaylor/DriverVsReference_removal
Remove DriverVsReference tasks from analyze_outcomes.py
2026-02-23 09:01:25 +00:00
Gilles Peskine
99c4159681 Disable Unix-like integration code in baremetal builds in all.sh
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-02-21 21:20:36 +01:00
Ben Taylor
d507b46684 Remove DriverVsReference tasks from analyze_outcomes.py
Signed-off-by: Ben Taylor <ben.taylor@linaro.org>
2026-02-20 15:08:33 +00:00
Ronald Cron
57b29c2fe5 Introduce branch specific make_generated_files.py
Introduce branch specific make_generated_files.py
and use it in the development branch.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2026-02-18 13:02:26 +01:00
Gilles Peskine
d3a8582606 Actually check committed generated files
We were accidentally running the check in TF-PSA-Crypto instead of in Mbed TLS.

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-02-12 13:16:18 +01:00
Janos Follath
346720d674 Add ASan to test_sw_inet_pton
Signed-off-by: Janos Follath <janos.follath@arm.com>
2026-02-12 08:11:37 +00:00
Manuel Pégourié-Gonnard
499e3d13f7 Fix more paths for "not grep"
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2026-01-22 10:23:03 +01:00
Valerio Setti
4e2584d681 tests: scripts: remove set_psa_test_dependencies.py
This script was used in the past, but it has since been replaced with
other scripts and nowadays it's no more used anywhere.

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2026-01-14 13:34:32 +01:00