- mbedtls_endpoint_sanity() is only used for TLS 1.2 tests, where RSA
signatures are limited to PKCS#1 v1.5. Moreover the test does not
perform a full handshake, so only being able to hold an RSA public key
is required here: PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY.
- move_handshake_to_state() is used for both TLS 1.2 and TLS 1.3 tests
and the RSA capabilities it needs depend on the handshake state being
reached, so the RSA dependency is set on test data instead.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
- Mbed TLS only implements TLS 1.2 and DTLS 1.2 (not 1.0/1.1) and there
RSA signatures are limited to PKCS#1 v1.5, so replace
PSA_HAVE_ALG_SOME_RSA_SIGN with PSA_HAVE_ALG_RSA_PKCS1V15_SIGN.
- move_handshake_to_state() sets options.pk_alg = MBEDTLS_PK_RSA, so some
minimal support for RSA keys is always needed: at least an RSA public
key. Stricter requirements only apply depending on the protocol version
(TLS 1.2 vs 1.3) and on the handshake state reached by the test (ex:
initial phase vs ending phase), so they are set per test case.
- Test cases already requiring MBEDTLS_X509_RSASSA_PSS_SUPPORT don't need
PSA_WANT_ALG_RSA_PSS too, since the former depends on the latter.
- Add a comment to the handshake_psk_cipher test cases to explain why a
test which is ideally about PSK has requirements on RSA and EC keys.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
PKCS7 supports ECC as well so the test function should not be guarded or
limited to RSA build symbols. Those guards are now set on the test data
as required by each test itself. This allows for test extension to also
include ECC testing (not present now).
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
pkcs7_verify() is about to lose its blanket RSA guard, so each test case
must declare what it actually needs:
- cases that really validate an RSA signature require
PSA_HAVE_ALG_RSA_PKCS1V15_VERIFY. This includes the cases which used
to pass accidentally because the certificate is invalid and the code
never gets to verify the signature: using the same dependency as the
valid cases is more uniform;
- cases which are expected to fail before reaching signature
verification only require PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
- Tests that only parse a certificate/CRL/CSR without verifying any
signature only need to be able to hold an RSA public key, so replace
PSA_HAVE_ALG_SOME_RSA_VERIFY with PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY.
PSA_HAVE_ALG_SOME_RSA_VERIFY is kept in x509_verify tests, which do
verify signatures.
- x509_parse_rsassa_pss_params tests don't need any explicit RSA
dependency: the test function already depends on
MBEDTLS_X509_RSASSA_PSS_SUPPORT which itself depends on
PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC, i.e. something "stronger" than
PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Cover the serialized out_cid length with the same construction as the
in_cid one, and rename the existing case to IN_CID accordingly. Give
the client and server sentinel CIDs different lengths so the two
fields can be told apart in the serialized data. Skip the CID cases
under configurations of MBEDTLS_SSL_CID_IN_LEN_MAX and
MBEDTLS_SSL_CID_OUT_LEN_MAX that the test does not support.
Signed-off-by: Naveed <naveed@bugqore.com>
The previous approach documented the in_cid_len > sizeof(in_cid) cap
as untestable, since the overflowing memcpy() lands inside the
transform structure where sanitizers cannot see it. It can be guarded
without a sanitizer: grow the in_cid field in the loaded data (keep
its bytes, pad to MBEDTLS_SSL_CID_IN_LEN_MAX + 1) and append the rest
of the serialized data untouched, so the in-buffer bounds check passes
and the cap is what must reject the length. Without the cap the
remaining data parses correctly aligned and the load succeeds, so the
test catches a regression by the return value alone.
Signed-off-by: Naveed <naveed@bugqore.com>
With the loaded data cut right after the in_cid bytes, even the
pristine in_cid length tripped the (end - p) < in_cid_len + 1u bounds
check, since the out_cid length byte it accounts for was missing: the
truncation, not the corruption, was what got rejected. Keep the
out_cid length byte in the loaded data, so the pristine length passes
the check and only the corrupted length trips it. Also document why
this pre-existing check is the only one in the in_cid path that a
regression test can guard: the in_cid_len > sizeof(in_cid) cap
protects the memcpy() destination, and without it the overflow lands
in the out_cid field inside the transform structure, where sanitizers
cannot see it.
Signed-off-by: Naveed <naveed@bugqore.com>
The corrupted in_cid length exercised the pre-existing size-cap check,
not the bounds check: the in_cid field is not the last one serialized,
and the MBEDTLS_SSL_CID_IN_LEN_MAX cap is smaller than the size of the
fields that follow it, so no corrupted length could reach past the end
of the full buffer, and reverting the bounds check did not change the
test's outcome. Truncate the loaded data right after the in_cid bytes,
load from a tightly allocated copy, and corrupt the length to one byte
past that end, so that reverting the bounds check now trips ASan with
an out-of-bounds read in the memcpy(), like the ALPN case.
Signed-off-by: Naveed <naveed@bugqore.com>
Load the serialized context once before corrupting it, to check the
data is well-formed to begin with. Shorten the second ALPN protocol so
the corrupted length overruns the serialized data by exactly one byte,
and assert that property at runtime. Document that the corrupted load
usually fails even without the bounds check, so the regression is only
caught when the suite runs under ASan or Valgrind.
Signed-off-by: Naveed <naveed@bugqore.com>
Fold ssl_context_load_rejects_oob_cid_length and
ssl_context_load_rejects_oob_alpn_length into a single parameterized
test function, since they shared most of their code.
Signed-off-by: Naveed <naveed@bugqore.com>
The serialized ALPN length was passed to memcmp() against each configured protocol without checking it against the remaining serialized data, so a malformed context could read past the end of the buffer. Bound it before the comparison, like the adjacent CID fields.
Signed-off-by: Naveed <naveed@bugqore.com>
Align to recent changes in TLS group ID related functions:
- 'mbedtls_ssl_get_ecp_group_id_from_tls_id' renamed to
'mbedtls_ssl_is_tls_id_supported'.
- 'mbedtls_ssl_get_tls_id_from_ecp_group_id' renamed to
'mbedtls_ssl_get_tls_id_from_ecp_group_id'.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
After crypto#827 some PK error codes changed from
MBEDTLS_ERR_PK_INVALID_PUBKEY to MBEDTLS_ERR_PK_INVALID_ALG.
This commit adjusts failing test cases.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
RFC 8446 (TLS 1.3 specification), Section 5.1, states:
Handshake messages MAY be coalesced into a single TLSPlaintext record
or fragmented across several records, provided that:
...
-Handshake messages MUST NOT span key changes. Implementations
MUST verify that all messages immediately preceding a key change
align with a record boundary; if not, then they MUST terminate the
connection with an "unexpected_message" alert. Because the
ClientHello, EndOfEarlyData, ServerHello, Finished, and KeyUpdate
messages can immediately precede a key change, implementations
MUST send these messages in alignment with a record boundary.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Move functions in "ssl_helpers.h" that depend on internal headers to
"ssl_helpers_internal.h". This allows to include "ssl_helpers.h" also
in programs (which do not have access to internal headers).
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
