From c7b630ffa1d5e5604183dce96479c27374489bf2 Mon Sep 17 00:00:00 2001 From: Yi Wu Date: Mon, 30 Mar 2026 16:07:45 +0100 Subject: [PATCH 1/7] tests: remove remaining FFDH code in compat.sh Signed-off-by: Yi Wu --- tests/compat.sh | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/tests/compat.sh b/tests/compat.sh index 2b6f454127..6ca88b977f 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -541,19 +541,6 @@ setup_arguments() G_SERVER_ARGS="-p $PORT --http $G_MODE" G_SERVER_PRIO="NORMAL:${G_PRIO_CCM}+NULL:+MD5:+PSK:+ECDHE-PSK:+SHA256:+SHA384:-VERS-TLS-ALL:$G_PRIO_MODE" - # The default prime for `openssl s_server` depends on the version: - # * OpenSSL <= 1.0.2a: 512-bit - # * OpenSSL 1.0.2b to 1.1.1b: 1024-bit - # * OpenSSL >= 1.1.1c: 2048-bit - # Mbed TLS wants >=1024, so force that for older versions. Don't force - # it for newer versions, which reject a 1024-bit prime. Indifferently - # force it or not for intermediate versions. - case $($OPENSSL version) in - "OpenSSL 1.0"*) - O_SERVER_ARGS="$O_SERVER_ARGS -dhparam $DATA_FILES_PATH/dhparams.pem" - ;; - esac - # with OpenSSL 1.0.1h, -www, -WWW and -HTTP break DTLS handshakes if is_dtls "$MODE"; then O_SERVER_ARGS="$O_SERVER_ARGS" From 23538fd56254ce86212bc0ec87bb14a037bee246 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 29 Apr 2026 16:57:55 +0200 Subject: [PATCH 2/7] include mbedtls_platform_requirements.h in mbedtls_config.c This is required because if the user defined configuration file (not the default one provided by mbedtls) includes files from the standard C library then __STDC_WANT_LIB_EXT1__ won't be defined there which cause weird build failures. Signed-off-by: Valerio Setti --- library/mbedtls_config.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/library/mbedtls_config.c b/library/mbedtls_config.c index 48be660015..e3e6cde3cc 100644 --- a/library/mbedtls_config.c +++ b/library/mbedtls_config.c @@ -6,6 +6,8 @@ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later */ +#include "mbedtls_platform_requirements.h" + /* We are a special snowflake: we don't include "mbedtls_common.h", * because that would pull and we need to * tune the way it works. */ From cfb07a923d0eae3cf9ee86639d32d0d1e38648a6 Mon Sep 17 00:00:00 2001 From: Valerio Setti Date: Wed, 29 Apr 2026 17:05:51 +0200 Subject: [PATCH 3/7] changelog: add note about fix of issue 10740 Signed-off-by: Valerio Setti --- ChangeLog.d/issue10740.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/issue10740.txt diff --git a/ChangeLog.d/issue10740.txt b/ChangeLog.d/issue10740.txt new file mode 100644 index 0000000000..eb7a36c063 --- /dev/null +++ b/ChangeLog.d/issue10740.txt @@ -0,0 +1,3 @@ +Bugfix + * Fixed a bug which prevented the inclusion of standard C library header + files from the user provided configuration file. Fixes #10740. From da2b5d6f42283bbbe4a5a5acf84db4cf6a08369d Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 16 Apr 2026 19:16:30 +0200 Subject: [PATCH 4/7] Add tf-psa-crypto/scripts/project_knowledge to Python load path Signed-off-by: Gilles Peskine --- .mypy.ini | 2 +- .pylintrc | 2 +- scripts/framework_scripts_path.py | 3 +++ tests/scripts/scripts_path.py | 3 +++ 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.mypy.ini b/.mypy.ini index f727cc20e7..23b4ada4ce 100644 --- a/.mypy.ini +++ b/.mypy.ini @@ -1,4 +1,4 @@ [mypy] -mypy_path = framework/scripts:scripts +mypy_path = framework/scripts:scripts:tf-psa-crypto/scripts/project_knowledge namespace_packages = True warn_unused_configs = True diff --git a/.pylintrc b/.pylintrc index 4a1b6e555f..721958b3c8 100644 --- a/.pylintrc +++ b/.pylintrc @@ -1,5 +1,5 @@ [MASTER] -init-hook='import sys; sys.path.append("scripts"); sys.path.append("framework/scripts")' +init-hook='import sys; sys.path += ["scripts", "framework/scripts", "tf-psa-crypto/scripts/project_knowledge"]' min-similarity-lines=10 [BASIC] diff --git a/scripts/framework_scripts_path.py b/scripts/framework_scripts_path.py index 4d4a440c23..88493f12a7 100644 --- a/scripts/framework_scripts_path.py +++ b/scripts/framework_scripts_path.py @@ -15,3 +15,6 @@ import sys sys.path.append(os.path.join(os.path.dirname(__file__), os.path.pardir, 'framework', 'scripts')) +sys.path.append(os.path.join(os.path.dirname(__file__), + os.path.pardir, + 'tf-psa-crypto', 'scripts', 'project_knowledge')) diff --git a/tests/scripts/scripts_path.py b/tests/scripts/scripts_path.py index ce2afcfc36..56c18ef9d3 100644 --- a/tests/scripts/scripts_path.py +++ b/tests/scripts/scripts_path.py @@ -18,3 +18,6 @@ sys.path.append(os.path.join(os.path.dirname(__file__), sys.path.append(os.path.join(os.path.dirname(__file__), os.path.pardir, os.path.pardir, 'framework', 'scripts')) +sys.path.append(os.path.join(os.path.dirname(__file__), + os.path.pardir, os.path.pardir, + 'tf-psa-crypto', 'scripts', 'project_knowledge')) From c7b1c86e6b26e00785a291d8302851a179856791 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 16 Apr 2026 19:17:02 +0200 Subject: [PATCH 5/7] Prefer to load tf_psa_crypto_test_case_info from project_knowledge Try to load the list of tests that TF-PSA-Crypto wants us to ignore in three ways, depending on the age of the tf-psa-crypto submodule: * Modern: import `tf_psa_crypto_test_case_info` as an ordinary module, expected to be found in `tf-psa-crypto/scripts/project_knowledge`. * First location, quickly superseded: load `tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py`, in a hackish way because we don't want to put that directory on the load path. * Oldest: there is no `tf_psa_crypto_test_case_info.py`. Use a hard-coded list. Once all the TF-PSA-Crypto branches we care about (e.g. pull requests in progress) are updated with `tf-psa-crypto/scripts/project_knowledge/tf_psa_crypto_test_case_info.py`, we can drop the backward compatibilty hacks and simply `import tf_psa_crypto_test_case_info` unconditionally and use `tf_psa_crypto_test_case_info.INTERNAL_TEST_CASES` unconditionally. Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 44 +++++++++++++++---------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 1a73a2a619..5c6d71acdd 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -14,23 +14,21 @@ import importlib.machinery import importlib.util import os import re +import sys +import types import typing import scripts_path # pylint: disable=unused-import from mbedtls_framework import outcome_analysis -from mbedtls_framework import typing_util - -class CryptoAnalyzeOutcomesType(typing_util.Protocol): - """Our expectations on tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py. - - See CoverageTask._load_crypto_module(). - """ - #pylint: disable=too-few-public-methods - - # Test cases that are about internal aspects of TF-PSA-Crypto, - # which Mbed TLS is therefore not required to cover. - INTERNAL_TEST_CASES: outcome_analysis.TestCaseSetDescription +# Until all TF-PSA-Crypto branches we care about have +# scripts/project_knowledge/tf_psa_crypto_test_case_info.py, +# fall back to its previous location where we load it manually +# (see the _load_crypto_module method below). +try: + import tf_psa_crypto_test_case_info #type: ignore #pylint: disable=unused-import +except ImportError: + pass class CoverageTask(outcome_analysis.CoverageTask): @@ -224,33 +222,35 @@ class CoverageTask(outcome_analysis.CoverageTask): ], } - def _load_crypto_module(self) -> None: + @staticmethod + def _load_crypto_module() -> typing.Optional[types.ModuleType]: """Try to load the information about test cases from the tf-psa-crypto submodule..""" # All this complexity is because we don't want to add the directory # to the import path. - if self.crypto_module is not None: - return + if 'tf_psa_crypto_test_case_info' in sys.modules: + return sys.modules['tf_psa_crypto_test_case_info'] crypto_script_path = 'tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py' if not os.path.exists(crypto_script_path): # During a transition period, while the crypto script is not # yet present in all branches we care about, allow it not to # exist. - return + return None crypto_spec = importlib.util.spec_from_file_location( 'tf_psa_crypto_test_case_info', crypto_script_path) # Assertions and type annotation to help mypy. assert crypto_spec is not None assert crypto_spec.loader is not None - self.crypto_module: typing.Optional[CryptoAnalyzeOutcomesType] = \ - importlib.util.module_from_spec(crypto_spec) - crypto_spec.loader.exec_module(self.crypto_module) + crypto_module = importlib.util.module_from_spec(crypto_spec) + crypto_spec.loader.exec_module(crypto_module) + sys.modules['tf_psa_crypto_test_case_info'] = crypto_module + return crypto_module def _load_crypto_instructions(self) -> None: """Try to load instructions from the tf-psa-crypto submodule's outcome analysis.""" - self._load_crypto_module() - if self.crypto_module is not None: - crypto_internal_test_cases = self.crypto_module.INTERNAL_TEST_CASES + crypto_module = self._load_crypto_module() + if crypto_module is not None: + crypto_internal_test_cases = crypto_module.INTERNAL_TEST_CASES else: # Legacy set of tests covered by TF-PSA-Crypto only, # from before Mbed TLS's outcome analysis read that information From 4f149ffc0248e5678dcdd64a3d4ad7cae97e8b36 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 22 Apr 2026 17:38:48 +0200 Subject: [PATCH 6/7] Update comment Signed-off-by: Gilles Peskine --- tests/scripts/analyze_outcomes.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 5c6d71acdd..1ab27b9347 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -225,8 +225,12 @@ class CoverageTask(outcome_analysis.CoverageTask): @staticmethod def _load_crypto_module() -> typing.Optional[types.ModuleType]: """Try to load the information about test cases from the tf-psa-crypto submodule..""" - # All this complexity is because we don't want to add the directory - # to the import path. + # All this complexity is because we didn't want to add + # `tf-psa-crypto/tests/scripts/` to the import path. + # The new location `tf-psa-crypto/scripts/project_knowledge` is + # on the import path. So once we can assume that all crypto + # branches have the new location, this whole function can go away. + # https://github.com/Mbed-TLS/mbedtls/issues/10699. if 'tf_psa_crypto_test_case_info' in sys.modules: return sys.modules['tf_psa_crypto_test_case_info'] crypto_script_path = 'tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py' From a982231904db145f743b1529873dccc216611ae4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Wed, 3 Jun 2026 10:33:29 +0200 Subject: [PATCH 7/7] Update broken link MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I believe the existing link was to the TF wiki which has been retired for some time now. Signed-off-by: Manuel Pégourié-Gonnard --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index b485d0112e..56e7980d16 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -7,8 +7,8 @@ send an email to the security team at ## Security Incident Handling Process Our security process is detailed in our -[security -center](https://developer.trustedfirmware.org/w/mbed-tls/security-center/). +[online +documentation](https://mbed-tls.readthedocs.io/en/latest/project/vulnerabilities/). Its primary goal is to ensure fixes are ready to be deployed when the issue goes public.