diff --git a/.mypy.ini b/.mypy.ini index f727cc20e7..23b4ada4ce 100644 --- a/.mypy.ini +++ b/.mypy.ini @@ -1,4 +1,4 @@ [mypy] -mypy_path = framework/scripts:scripts +mypy_path = framework/scripts:scripts:tf-psa-crypto/scripts/project_knowledge namespace_packages = True warn_unused_configs = True diff --git a/.pylintrc b/.pylintrc index 4a1b6e555f..721958b3c8 100644 --- a/.pylintrc +++ b/.pylintrc @@ -1,5 +1,5 @@ [MASTER] -init-hook='import sys; sys.path.append("scripts"); sys.path.append("framework/scripts")' +init-hook='import sys; sys.path += ["scripts", "framework/scripts", "tf-psa-crypto/scripts/project_knowledge"]' min-similarity-lines=10 [BASIC] diff --git a/ChangeLog.d/issue10740.txt b/ChangeLog.d/issue10740.txt new file mode 100644 index 0000000000..eb7a36c063 --- /dev/null +++ b/ChangeLog.d/issue10740.txt @@ -0,0 +1,3 @@ +Bugfix + * Fixed a bug which prevented the inclusion of standard C library header + files from the user provided configuration file. Fixes #10740. diff --git a/SECURITY.md b/SECURITY.md index b485d0112e..56e7980d16 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,8 +7,8 @@ send an email to the security team at ## Security Incident Handling Process Our security process is detailed in our -[security -center](https://developer.trustedfirmware.org/w/mbed-tls/security-center/). +[online +documentation](https://mbed-tls.readthedocs.io/en/latest/project/vulnerabilities/). Its primary goal is to ensure fixes are ready to be deployed when the issue goes public. diff --git a/library/mbedtls_config.c b/library/mbedtls_config.c index 48be660015..e3e6cde3cc 100644 --- a/library/mbedtls_config.c +++ b/library/mbedtls_config.c @@ -6,6 +6,8 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ +#include "mbedtls_platform_requirements.h" + /* We are a special snowflake: we don't include "mbedtls_common.h", * because that would pull and we need to * tune the way it works. */ diff --git a/scripts/framework_scripts_path.py b/scripts/framework_scripts_path.py index 4d4a440c23..88493f12a7 100644 --- a/scripts/framework_scripts_path.py +++ b/scripts/framework_scripts_path.py @@ -15,3 +15,6 @@ import sys sys.path.append(os.path.join(os.path.dirname(__file__), os.path.pardir, 'framework', 'scripts')) +sys.path.append(os.path.join(os.path.dirname(__file__), + os.path.pardir, + 'tf-psa-crypto', 'scripts', 'project_knowledge')) diff --git a/tests/compat.sh b/tests/compat.sh index 2b6f454127..6ca88b977f 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -541,19 +541,6 @@ setup_arguments() G_SERVER_ARGS="-p $PORT --http $G_MODE" G_SERVER_PRIO="NORMAL:${G_PRIO_CCM}+NULL:+MD5:+PSK:+ECDHE-PSK:+SHA256:+SHA384:-VERS-TLS-ALL:$G_PRIO_MODE" - # The default prime for `openssl s_server` depends on the version: - # * OpenSSL <= 1.0.2a: 512-bit - # * OpenSSL 1.0.2b to 1.1.1b: 1024-bit - # * OpenSSL >= 1.1.1c: 2048-bit - # Mbed TLS wants >=1024, so force that for older versions. Don't force - # it for newer versions, which reject a 1024-bit prime. Indifferently - # force it or not for intermediate versions. - case $($OPENSSL version) in - "OpenSSL 1.0"*) - O_SERVER_ARGS="$O_SERVER_ARGS -dhparam $DATA_FILES_PATH/dhparams.pem" - ;; - esac - # with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes if is_dtls "$MODE"; then O_SERVER_ARGS="$O_SERVER_ARGS" diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 1a73a2a619..1ab27b9347 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -14,23 +14,21 @@ import importlib.machinery import importlib.util import os import re +import sys +import types import typing import scripts_path # pylint: disable=unused-import from mbedtls_framework import outcome_analysis -from mbedtls_framework import typing_util - -class CryptoAnalyzeOutcomesType(typing_util.Protocol): - """Our expectations on tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py. - - See CoverageTask._load_crypto_module(). - """ - #pylint: disable=too-few-public-methods - - # Test cases that are about internal aspects of TF-PSA-Crypto, - # which Mbed TLS is therefore not required to cover. - INTERNAL_TEST_CASES: outcome_analysis.TestCaseSetDescription +# Until all TF-PSA-Crypto branches we care about have +# scripts/project_knowledge/tf_psa_crypto_test_case_info.py, +# fall back to its previous location where we load it manually +# (see the _load_crypto_module method below). +try: + import tf_psa_crypto_test_case_info #type: ignore #pylint: disable=unused-import +except ImportError: + pass class CoverageTask(outcome_analysis.CoverageTask): @@ -224,33 +222,39 @@ class CoverageTask(outcome_analysis.CoverageTask): ], } - def _load_crypto_module(self) -> None: + @staticmethod + def _load_crypto_module() -> typing.Optional[types.ModuleType]: """Try to load the information about test cases from the tf-psa-crypto submodule..""" - # All this complexity is because we don't want to add the directory - # to the import path. - if self.crypto_module is not None: - return + # All this complexity is because we didn't want to add + # `tf-psa-crypto/tests/scripts/` to the import path. + # The new location `tf-psa-crypto/scripts/project_knowledge` is + # on the import path. So once we can assume that all crypto + # branches have the new location, this whole function can go away. + # https://github.com/Mbed-TLS/mbedtls/issues/10699. + if 'tf_psa_crypto_test_case_info' in sys.modules: + return sys.modules['tf_psa_crypto_test_case_info'] crypto_script_path = 'tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py' if not os.path.exists(crypto_script_path): # During a transition period, while the crypto script is not # yet present in all branches we care about, allow it not to # exist. - return + return None crypto_spec = importlib.util.spec_from_file_location( 'tf_psa_crypto_test_case_info', crypto_script_path) # Assertions and type annotation to help mypy. assert crypto_spec is not None assert crypto_spec.loader is not None - self.crypto_module: typing.Optional[CryptoAnalyzeOutcomesType] = \ - importlib.util.module_from_spec(crypto_spec) - crypto_spec.loader.exec_module(self.crypto_module) + crypto_module = importlib.util.module_from_spec(crypto_spec) + crypto_spec.loader.exec_module(crypto_module) + sys.modules['tf_psa_crypto_test_case_info'] = crypto_module + return crypto_module def _load_crypto_instructions(self) -> None: """Try to load instructions from the tf-psa-crypto submodule's outcome analysis.""" - self._load_crypto_module() - if self.crypto_module is not None: - crypto_internal_test_cases = self.crypto_module.INTERNAL_TEST_CASES + crypto_module = self._load_crypto_module() + if crypto_module is not None: + crypto_internal_test_cases = crypto_module.INTERNAL_TEST_CASES else: # Legacy set of tests covered by TF-PSA-Crypto only, # from before Mbed TLS's outcome analysis read that information diff --git a/tests/scripts/scripts_path.py b/tests/scripts/scripts_path.py index ce2afcfc36..56c18ef9d3 100644 --- a/tests/scripts/scripts_path.py +++ b/tests/scripts/scripts_path.py @@ -18,3 +18,6 @@ sys.path.append(os.path.join(os.path.dirname(__file__), sys.path.append(os.path.join(os.path.dirname(__file__), os.path.pardir, os.path.pardir, 'framework', 'scripts')) +sys.path.append(os.path.join(os.path.dirname(__file__), + os.path.pardir, os.path.pardir, + 'tf-psa-crypto', 'scripts', 'project_knowledge'))