Cover the serialized out_cid length with the same construction as the
in_cid one, and rename the existing case to IN_CID accordingly. Give
the client and server sentinel CIDs different lengths so the two
fields can be told apart in the serialized data. Skip the CID cases
under configurations of MBEDTLS_SSL_CID_IN_LEN_MAX and
MBEDTLS_SSL_CID_OUT_LEN_MAX that the test does not support.
Signed-off-by: Naveed <naveed@bugqore.com>
The previous approach documented the in_cid_len > sizeof(in_cid) cap
as untestable, since the overflowing memcpy() lands inside the
transform structure where sanitizers cannot see it. It can be guarded
without a sanitizer: grow the in_cid field in the loaded data (keep
its bytes, pad to MBEDTLS_SSL_CID_IN_LEN_MAX + 1) and append the rest
of the serialized data untouched, so the in-buffer bounds check passes
and the cap is what must reject the length. Without the cap the
remaining data parses correctly aligned and the load succeeds, so the
test catches a regression by the return value alone.
Signed-off-by: Naveed <naveed@bugqore.com>
With the loaded data cut right after the in_cid bytes, even the
pristine in_cid length tripped the (end - p) < in_cid_len + 1u bounds
check, since the out_cid length byte it accounts for was missing: the
truncation, not the corruption, was what got rejected. Keep the
out_cid length byte in the loaded data, so the pristine length passes
the check and only the corrupted length trips it. Also document why
this pre-existing check is the only one in the in_cid path that a
regression test can guard: the in_cid_len > sizeof(in_cid) cap
protects the memcpy() destination, and without it the overflow lands
in the out_cid field inside the transform structure, where sanitizers
cannot see it.
Signed-off-by: Naveed <naveed@bugqore.com>
The corrupted in_cid length exercised the pre-existing size-cap check,
not the bounds check: the in_cid field is not the last one serialized,
and the MBEDTLS_SSL_CID_IN_LEN_MAX cap is smaller than the size of the
fields that follow it, so no corrupted length could reach past the end
of the full buffer, and reverting the bounds check did not change the
test's outcome. Truncate the loaded data right after the in_cid bytes,
load from a tightly allocated copy, and corrupt the length to one byte
past that end, so that reverting the bounds check now trips ASan with
an out-of-bounds read in the memcpy(), like the ALPN case.
Signed-off-by: Naveed <naveed@bugqore.com>
Load the serialized context once before corrupting it, to check the
data is well-formed to begin with. Shorten the second ALPN protocol so
the corrupted length overruns the serialized data by exactly one byte,
and assert that property at runtime. Document that the corrupted load
usually fails even without the bounds check, so the regression is only
caught when the suite runs under ASan or Valgrind.
Signed-off-by: Naveed <naveed@bugqore.com>
Fold ssl_context_load_rejects_oob_cid_length and
ssl_context_load_rejects_oob_alpn_length into a single parameterized
test function, since they shared most of their code.
Signed-off-by: Naveed <naveed@bugqore.com>
The serialized ALPN length was passed to memcmp() against each configured protocol without checking it against the remaining serialized data, so a malformed context could read past the end of the buffer. Bound it before the comparison, like the adjacent CID fields.
Signed-off-by: Naveed <naveed@bugqore.com>
- mbedtls_endpoint_sanity() is only used for TLS 1.2 tests, where RSA
signatures are limited to PKCS#1 v1.5. Moreover the test does not
perform a full handshake, so only being able to hold an RSA public key
is required here: PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY.
- move_handshake_to_state() is used for both TLS 1.2 and TLS 1.3 tests
and the RSA capabilities it needs depend on the handshake state being
reached, so the RSA dependency is set on test data instead.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
- Mbed TLS only implements TLS 1.2 and DTLS 1.2 (not 1.0/1.1) and there
RSA signatures are limited to PKCS#1 v1.5, so replace
PSA_HAVE_ALG_SOME_RSA_SIGN with PSA_HAVE_ALG_RSA_PKCS1V15_SIGN.
- move_handshake_to_state() sets options.pk_alg = MBEDTLS_PK_RSA, so some
minimal support for RSA keys is always needed: at least an RSA public
key. Stricter requirements only apply depending on the protocol version
(TLS 1.2 vs 1.3) and on the handshake state reached by the test (ex:
initial phase vs ending phase), so they are set per test case.
- Test cases already requiring MBEDTLS_X509_RSASSA_PSS_SUPPORT don't need
PSA_WANT_ALG_RSA_PSS too, since the former depends on the latter.
- Add a comment to the handshake_psk_cipher test cases to explain why a
test which is ideally about PSK has requirements on RSA and EC keys.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
PKCS7 supports ECC as well so the test function should not be guarded or
limited to RSA build symbols. Those guards are now set on the test data
as required by each test itself. This allows for test extension to also
include ECC testing (not present now).
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
pkcs7_verify() is about to lose its blanket RSA guard, so each test case
must declare what it actually needs:
- cases that really validate an RSA signature require
PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY. This includes the cases which used
to pass accidentally because the certificate is invalid and the code
never gets to verify the signature: using the same dependency as the
valid cases is more uniform;
- cases which are expected to fail before reaching signature
verification only require PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
- Tests that only parse a certificate/CRL/CSR without verifying any
signature only need to be able to hold an RSA public key, so replace
PSA_HAVE_ALG_SOME_RSA_VERIFY with PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY.
PSA_HAVE_ALG_SOME_RSA_VERIFY is kept in x509_verify tests, which do
verify signatures.
- x509_parse_rsassa_pss_params tests don't need any explicit RSA
dependency: the test function already depends on
MBEDTLS_X509_RSASSA_PSS_SUPPORT which itself depends on
PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC, i.e. something "stronger" than
PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
MBEDTLS_X509_RSASSA_PSS_SUPPORT depends on PSA_WANT_ALG_RSA_PSS, so add
the corresponding reverse dependency and include PSA_WANT_ALG_RSA_PSS in
the 'pkalgs' ComplementaryDomain in order to also test builds where
RSA-PSS is disabled.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This is useful for debugging purposes because, for example, the user
only want to build a specific suite and/or only run it instead of
building and testing everything for all the jobs.
For this scope the custom command can be a bash script that's executed
instead of 'make' + 'make test'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Following recent removal for '_reference' and '_use_psa' functions we
ended up having 2 very similar test components named
'component_test_psa_crypto_config_accel_hash', one using 'default'
configuration and the other one using the 'full' one.
Let's keep the 'full' configuration version and get rid of the 'default'
case.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
'ssl-opt.sh' and 'compat.sh' in accel components were mostly useful back
when the accelerated components were to be compared against the reference
ones to ensure proper test coverage. Now that the reference components
have been removed it doesn't make sense to keep 'ssl-opt.sh' and
'compat.sh' around because they take a lot of simulation time for almost
no benefit. From TLS point of view we can rely on normal 'test_suite_'
testing to be sure that the crypto mechanism works as expected.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Nowadays USE_PSA_CRYPTO is always enabled and there is no way to disable
it. It doesn't give more information to know that we're setting that
build symbol. Remove that.
While at this remove also '_use_psa' from some test component still using
it in the name for the same reason.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
These were useful in the 3.6 days when 'analyze_outcomes.py' was used to
check that driver acceleration was providing the same coverage as the
reference legacy modules. Since this check has recently been removed
from 'analyze_outcomes.py' all the '_reference' component can be
removed as they are just wasting CI time.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Align to recent changes in TLS group ID related functions:
- 'mbedtls_ssl_get_ecp_group_id_from_tls_id' renamed to
'mbedtls_ssl_is_tls_id_supported'.
- 'mbedtls_ssl_get_tls_id_from_ecp_group_id' renamed to
'mbedtls_ssl_get_tls_id_from_ecp_group_id'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Previously this was tested indirectly by comparing driver vs reference
components in analyze-outcomes.py, but now that the number of exceptions
is low, it's much more efficient to test this directly.
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
Also remove the "no USE_PSA" tests: they are not executed, and are not
useful for the future - when we add support for restartable ECDH in TLS,
we can just use the existing tests and update the assertions, which
we'll have to do anyway (the tests being removed were asserting about
a legacy crypto function that no longer exists).
Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
