From 04eb7c032e066612badbbbfa1d4f4af821cf1522 Mon Sep 17 00:00:00 2001 From: Sergey Date: Mon, 6 Mar 2023 15:37:23 -0700 Subject: [PATCH 001/135] Fix llvm error: variable 'default_iv_length' may be used uninitialized Backport of https://github.com/Mbed-TLS/mbedtls/pull/7210 Signed-off-by: Sergey --- library/psa_crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index d8a9940453..c58fdae2cf 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -3392,7 +3392,7 @@ psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation, { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE]; - size_t default_iv_length; + size_t default_iv_length = 0; if (operation->id == 0) { status = PSA_ERROR_BAD_STATE; From a242c757c22a27dd34822b0835246a0553d7529d Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Tue, 25 Apr 2023 04:48:15 -0400 Subject: [PATCH 002/135] Document mbedtls_calloc zeroization Signed-off-by: Andrzej Kurek --- include/mbedtls/config.h | 2 +- include/mbedtls/platform.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 1381c1fd16..d9835b31d1 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -3798,7 +3798,7 @@ /* Platform options */ //#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ -//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined. Please note that it should zeroize the buffer after allocation. */ //#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ diff --git a/include/mbedtls/platform.h b/include/mbedtls/platform.h index 9033852be1..121ba3ad73 100644 --- a/include/mbedtls/platform.h +++ b/include/mbedtls/platform.h @@ -140,6 +140,7 @@ extern "C" { /* * The function pointers for calloc and free. + * mbedtls_calloc will allocate and zeroize the buffer. */ #if defined(MBEDTLS_PLATFORM_MEMORY) #if defined(MBEDTLS_PLATFORM_FREE_MACRO) && \ From 97cbff7c0dd9767b2e82c0b313e469fc823c877d Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Tue, 25 Apr 2023 05:51:34 -0400 Subject: [PATCH 003/135] Add a test for calloc zeroization Signed-off-by: Andrzej Kurek --- include/mbedtls/config.h | 2 +- programs/test/selftest.c | 23 +++++++++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index d9835b31d1..be6ad83cb6 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -3798,7 +3798,7 @@ /* Platform options */ //#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ -//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined. Please note that it should zeroize the buffer after allocation. */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined. Please note that it should zeroize the allocated buffer. */ //#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ diff --git a/programs/test/selftest.c b/programs/test/selftest.c index 229f0d80a9..3adf2e55da 100644 --- a/programs/test/selftest.c +++ b/programs/test/selftest.c @@ -167,6 +167,23 @@ static int run_test_snprintf(void) test_snprintf(5, "123", 3) != 0; } +static int run_test_mbedtls_calloc(void) +{ + unsigned int buf_size = 256; + unsigned char *buf; + int ret = -1; + buf = mbedtls_calloc(buf_size, sizeof(unsigned char)); + for (unsigned int i = 0; i < buf_size; i++) { + if (buf[i] != 0) { + ret = -1; + goto exit; + } + } + ret = 0; +exit: + mbedtls_free(buf); + return ret; +} /* * Check if a seed file is present, and if not create one for the entropy * self-test. If this fails, we attempt the test anyway, so no error is passed @@ -376,6 +393,12 @@ int main(int argc, char *argv[]) mbedtls_exit(MBEDTLS_EXIT_FAILURE); } + /* Make sure that mbedtls_calloc zeroizes the buffer */ + if (run_test_mbedtls_calloc() != 0) { + mbedtls_printf("the calloc implementation does not zeroize the buffer\n"); + mbedtls_exit(MBEDTLS_EXIT_FAILURE); + } + for (argp = argv + (argc >= 1 ? 1 : argc); *argp != NULL; ++argp) { if (strcmp(*argp, "--quiet") == 0 || strcmp(*argp, "-q") == 0) { From 2aa312b136d27f86eec0e0fdf7025553e67cfbe7 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Tue, 9 May 2023 10:50:44 +0800 Subject: [PATCH 004/135] Update server5-selfsigned.crt Signed-off-by: Jerry Yu --- tests/data_files/Makefile | 12 ++++++++++++ tests/data_files/server5-selfsigned.crt | 20 ++++++++++---------- 2 files changed, 22 insertions(+), 10 deletions(-) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 17e0f90f54..d90ec303d0 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -378,6 +378,18 @@ server5-ss-forgeca.crt: server5.key $(FAKETIME) '2015-09-01 14:08:43' $(OPENSSL) req -x509 -new -subj "/C=UK/O=mbed TLS/CN=mbed TLS Test intermediate CA 3" -set_serial 77 -config $(test_ca_config_file) -extensions noext_ca -days 3650 -sha256 -key $< -out $@ all_final += server5-ss-forgeca.crt +server5-selfsigned.crt: server5.key + openssl req -x509 -key server5.key \ + -sha256 -days 3650 -nodes \ + -addext basicConstraints=critical,CA:FALSE \ + -addext keyUsage=critical,digitalSignature \ + -addext subjectKeyIdentifier=hash \ + -addext authorityKeyIdentifier=none \ + -set_serial 0x53a2cb4b124ead837da894b2 \ + -subj "/CN=selfsigned/OU=testing/O=PolarSSL/C=NL" \ + -out $@ +all_final += server5-selfsigned.crt + server5-othername.crt: server5.key $(OPENSSL) req -x509 -new -subj "/C=UK/O=Mbed TLS/CN=Mbed TLS othername SAN" -set_serial 77 -config $(test_ca_config_file) -extensions othername_san -days 3650 -sha256 -key $< -out $@ diff --git a/tests/data_files/server5-selfsigned.crt b/tests/data_files/server5-selfsigned.crt index cb55647513..0eafe70256 100644 --- a/tests/data_files/server5-selfsigned.crt +++ b/tests/data_files/server5-selfsigned.crt @@ -1,12 +1,12 @@ -----BEGIN CERTIFICATE----- -MIIBzTCCAXKgAwIBAgIMU6LLSxJOrYN9qJSyMAoGCCqGSM49BAMCMEcxEzARBgNV -BAMTCnNlbGZzaWduZWQxEDAOBgNVBAsTB3Rlc3RpbmcxETAPBgNVBAoTCFBvbGFy -U1NMMQswCQYDVQQGEwJOTDAiGA8yMDE0MDYxOTExMzY0M1oYDzIwMjQwNjE4MTEz -NjQzWjBHMRMwEQYDVQQDEwpzZWxmc2lnbmVkMRAwDgYDVQQLEwd0ZXN0aW5nMREw -DwYDVQQKEwhQb2xhclNTTDELMAkGA1UEBhMCTkwwWTATBgcqhkjOPQIBBggqhkjO -PQMBBwNCAAQ3zFbZdgkeWnI+x1kt/yBu7nz5BpF00K0UtfdoIllikk7lANgjEf/q -L9I0XV0WvYqIwmt3DVXNiioO+gHItO3/o0AwPjAMBgNVHRMBAf8EAjAAMA8GA1Ud -DwEB/wQFAwMHgAAwHQYDVR0OBBYEFLZtURgXjmWq8uzV8wHkbFLCNB1bMAoGCCqG -SM49BAMCA0kAMEYCIQCf/bzFoge0pCOIrtHrABgc1+Cl9kjlsICpduXhdHUMOwIh -AOJ+nBHfaEGyF4PRJvn/jMDeIaH1zisinVzC2v+JQOWq +MIIBxzCCAW2gAwIBAgIMU6LLSxJOrYN9qJSyMAoGCCqGSM49BAMCMEcxEzARBgNV +BAMMCnNlbGZzaWduZWQxEDAOBgNVBAsMB3Rlc3RpbmcxETAPBgNVBAoMCFBvbGFy +U1NMMQswCQYDVQQGEwJOTDAeFw0yMzA1MDkwMjQ5NTdaFw0zMzA1MDYwMjQ5NTda +MEcxEzARBgNVBAMMCnNlbGZzaWduZWQxEDAOBgNVBAsMB3Rlc3RpbmcxETAPBgNV +BAoMCFBvbGFyU1NMMQswCQYDVQQGEwJOTDBZMBMGByqGSM49AgEGCCqGSM49AwEH +A0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA2CMR/+ov0jRd +XRa9iojCa3cNVc2KKg76Aci07f+jPzA9MAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/ +BAQDAgeAMB0GA1UdDgQWBBRQYaWP1AfZ14IBDOVlf4xjRqcTvjAKBggqhkjOPQQD +AgNIADBFAiAXiJxDrd5aLzGB/Uc3kYBIBuSUIMGvol2c8EvwmF3zmQIhAPFrKMgA +s2awzo/PBB5gFTkDub88wRYwS1R9JPYCXUO0 -----END CERTIFICATE----- From 8e0cc70e387222905f175ac7086993d8de97aef8 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Tue, 9 May 2023 14:07:56 +0800 Subject: [PATCH 005/135] Add the rule and update server6-ss-child.crt Signed-off-by: Jerry Yu --- tests/data_files/Makefile | 11 ++++++++++ tests/data_files/server6-ss-child.crt | 22 +++++++++---------- .../server6-ss-child.crt.openssl.v3_ext | 4 ++++ 3 files changed, 26 insertions(+), 11 deletions(-) create mode 100644 tests/data_files/server6-ss-child.crt.openssl.v3_ext diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index d90ec303d0..568b9ac68c 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1236,6 +1236,17 @@ server6.crt: server6.csr $(test_ca_crt_file_ec) $(test_ca_key_file_ec) -extfile server5.crt.openssl.v3_ext -set_serial 10 -days 3650 -sha256 -in $< -out $@ all_final += server6.crt +server6-ss-child.csr : server6.key + $(OPENSSL) req -new -subj "/CN=selfsigned-child/OU=testing/O=PolarSSL/C=NL" \ + -key $< -out $@ +all_intermediate += server6-ss-child.csr +server6-ss-child.crt: server6-ss-child.csr server5-selfsigned.crt server5.key server6-ss-child.crt.openssl.v3_ext + $(OPENSSL) x509 -req -CA server5-selfsigned.crt -CAkey server5.key \ + -extfile server6-ss-child.crt.openssl.v3_ext \ + -set_serial 0x53a2cb5822399474a7ec79ec \ + -days 3650 -sha256 -in $< -out $@ +all_final += server6-ss-child.crt + ################################################################ ### Generate certificates for CRT write check tests ################################################################ diff --git a/tests/data_files/server6-ss-child.crt b/tests/data_files/server6-ss-child.crt index 3c6fd4d1b0..fc28f34c2d 100644 --- a/tests/data_files/server6-ss-child.crt +++ b/tests/data_files/server6-ss-child.crt @@ -1,13 +1,13 @@ -----BEGIN CERTIFICATE----- -MIIB8jCCAZmgAwIBAgIMU6LLWCI5lHSn7HnsMAoGCCqGSM49BAMCMEcxEzARBgNV -BAMTCnNlbGZzaWduZWQxEDAOBgNVBAsTB3Rlc3RpbmcxETAPBgNVBAoTCFBvbGFy -U1NMMQswCQYDVQQGEwJOTDAiGA8yMDE0MDYxOTExMzY1NloYDzIwMjQwNjE4MTEz -NjU2WjBNMRkwFwYDVQQDExBzZWxmc2lnbmVkLWNoaWxkMRAwDgYDVQQLEwd0ZXN0 -aW5nMREwDwYDVQQKEwhQb2xhclNTTDELMAkGA1UEBhMCTkwwWTATBgcqhkjOPQIB -BggqhkjOPQMBBwNCAASBWTF2SST6Fa2roDFuDu0zEfqRJVXBsMGcA3I+mLotpHI3 -iR9DN40fjjrY8FfoL0/JAKT323MPssYElNFAOzjjo2EwXzAMBgNVHRMBAf8EAjAA -MA8GA1UdDwEB/wQFAwMHgAAwHQYDVR0OBBYEFDxZrEo+LvwCNi/afcvLnHqyiZlT -MB8GA1UdIwQYMBaAFLZtURgXjmWq8uzV8wHkbFLCNB1bMAoGCCqGSM49BAMCA0cA -MEQCIAMlQ59/NW7S0hP1cu5OTD2zqT087bEmnIfOTBYfj8UFAiBBrrz2dipODVYx -vvTsQmSCzjrm+JtQQoWa+cdnAG3w5g== +MIIB7jCCAZSgAwIBAgIMU6LLWCI5lHSn7HnsMAoGCCqGSM49BAMCMEcxEzARBgNV +BAMMCnNlbGZzaWduZWQxEDAOBgNVBAsMB3Rlc3RpbmcxETAPBgNVBAoMCFBvbGFy +U1NMMQswCQYDVQQGEwJOTDAeFw0yMzA1MDkwNjA2NDJaFw0zMzA1MDYwNjA2NDJa +ME0xGTAXBgNVBAMMEHNlbGZzaWduZWQtY2hpbGQxEDAOBgNVBAsMB3Rlc3Rpbmcx +ETAPBgNVBAoMCFBvbGFyU1NMMQswCQYDVQQGEwJOTDBZMBMGByqGSM49AgEGCCqG +SM49AwEHA0IABIFZMXZJJPoVraugMW4O7TMR+pElVcGwwZwDcj6Yui2kcjeJH0M3 +jR+OOtjwV+gvT8kApPfbcw+yxgSU0UA7OOOjYDBeMAwGA1UdEwEB/wQCMAAwDgYD +VR0PAQH/BAQDAgeAMB0GA1UdDgQWBBR+ZY8+MwMU5eG+YLLghX+M52ArezAfBgNV +HSMEGDAWgBRQYaWP1AfZ14IBDOVlf4xjRqcTvjAKBggqhkjOPQQDAgNIADBFAiAl +Y2yXg5sZunmo+McUBzvSao1wRxw+9XBSM+Dph5gfhgIhAPlI+lSvD4mzlBzn01Mg +0tMpKHbY34iadcMWBUgibMiA -----END CERTIFICATE----- diff --git a/tests/data_files/server6-ss-child.crt.openssl.v3_ext b/tests/data_files/server6-ss-child.crt.openssl.v3_ext new file mode 100644 index 0000000000..dd9cdaa739 --- /dev/null +++ b/tests/data_files/server6-ss-child.crt.openssl.v3_ext @@ -0,0 +1,4 @@ +basicConstraints = critical,CA:false +keyUsage=critical,digitalSignature +subjectKeyIdentifier=hash + From 34cfc35ce90d0bd46e2b91d06a93d1038a05e310 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Mon, 29 May 2023 10:19:09 +0800 Subject: [PATCH 006/135] Fix the rule for server5-ss-forgeca.crt Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 2 +- tests/data_files/server5-ss-forgeca.crt | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 568b9ac68c..363ac371f0 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -375,7 +375,7 @@ all_final += server5-ss-expired.crt # try to forge a copy of test-int-ca3 with different key server5-ss-forgeca.crt: server5.key - $(FAKETIME) '2015-09-01 14:08:43' $(OPENSSL) req -x509 -new -subj "/C=UK/O=mbed TLS/CN=mbed TLS Test intermediate CA 3" -set_serial 77 -config $(test_ca_config_file) -extensions noext_ca -days 3650 -sha256 -key $< -out $@ + $(OPENSSL) req -x509 -new -subj "/C=UK/O=mbed TLS/CN=mbed TLS Test intermediate CA 3" -set_serial 77 -config $(test_ca_config_file) -extensions noext_ca -days 3650 -sha256 -key $< -out $@ all_final += server5-ss-forgeca.crt server5-selfsigned.crt: server5.key diff --git a/tests/data_files/server5-ss-forgeca.crt b/tests/data_files/server5-ss-forgeca.crt index 2265bf5764..cf5bd6db91 100644 --- a/tests/data_files/server5-ss-forgeca.crt +++ b/tests/data_files/server5-ss-forgeca.crt @@ -1,11 +1,11 @@ -----BEGIN CERTIFICATE----- -MIIBlDCCATmgAwIBAgIBTTAKBggqhkjOPQQDAjBKMQswCQYDVQQGEwJVSzERMA8G +MIIBkzCCATmgAwIBAgIBTTAKBggqhkjOPQQDAjBKMQswCQYDVQQGEwJVSzERMA8G A1UECgwIbWJlZCBUTFMxKDAmBgNVBAMMH21iZWQgVExTIFRlc3QgaW50ZXJtZWRp -YXRlIENBIDMwHhcNMTUwOTAxMTEwODQzWhcNMjUwODI5MTEwODQzWjBKMQswCQYD +YXRlIENBIDMwHhcNMjMwNTE3MDkxNDIxWhcNMzMwNTE0MDkxNDIxWjBKMQswCQYD VQQGEwJVSzERMA8GA1UECgwIbWJlZCBUTFMxKDAmBgNVBAMMH21iZWQgVExTIFRl c3QgaW50ZXJtZWRpYXRlIENBIDMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ3 zFbZdgkeWnI+x1kt/yBu7nz5BpF00K0UtfdoIllikk7lANgjEf/qL9I0XV0WvYqI -wmt3DVXNiioO+gHItO3/oxAwDjAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMCA0kA -MEYCIQDBFcXh+IloVYbMiHfCFhw6cYJsj7PZXuTdDMMkNbyJNAIhALz7fBVAMYz9 -/g48bLdYT47LOc9QNuaboLIxsq5RseJL +wmt3DVXNiioO+gHItO3/oxAwDjAMBgNVHRMEBTADAQH/MAoGCCqGSM49BAMCA0gA +MEUCIQD0f3GH9cEJ7cJWPIfwAL/1cGREqO//O/1XggWZv/clnQIgQmlMzGzuUDHq +/mTgGQ9ceSAB9B9im9rcgY6DRFZULnY= -----END CERTIFICATE----- From 233c93b44d2081abf4ccae19decf31cdba0248df Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Fri, 12 May 2023 18:20:56 +0800 Subject: [PATCH 007/135] Update test-ca2.ku-*.crt Signed-off-by: Jerry Yu --- tests/data_files/Makefile | 27 ++++++++++++++++--- tests/data_files/test-ca2.ku-crl.crt | 20 +++++++------- .../test-ca2.ku-crl.crt.openssl.v3_ext | 4 +++ tests/data_files/test-ca2.ku-crt.crt | 20 +++++++------- .../test-ca2.ku-crt.crt.openssl.v3_ext | 4 +++ tests/data_files/test-ca2.ku-crt_crl.crt | 20 +++++++------- .../test-ca2.ku-crt_crl.crt.openssl.v3_ext | 4 +++ tests/data_files/test-ca2.ku-ds.crt | 20 +++++++------- .../test-ca2.ku-ds.crt.openssl.v3_ext | 4 +++ 9 files changed, 79 insertions(+), 44 deletions(-) create mode 100644 tests/data_files/test-ca2.ku-crl.crt.openssl.v3_ext create mode 100644 tests/data_files/test-ca2.ku-crt.crt.openssl.v3_ext create mode 100644 tests/data_files/test-ca2.ku-crt_crl.crt.openssl.v3_ext create mode 100644 tests/data_files/test-ca2.ku-ds.crt.openssl.v3_ext diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 363ac371f0..ce2ba6d91a 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -116,13 +116,28 @@ test_ca_crt_file_ec = test-ca2.crt test_ca_key_file_ec = test-ca2.key test-ca2.req.sha256: $(test_ca_key_file_ec) - $(MBEDTLS_CERT_REQ) output_file=$@ filename=$(test_ca_key_file_ec) subject_name="C=NL,O=PolarSSL,CN=Polarssl Test EC CA" md=SHA256 + $(MBEDTLS_CERT_REQ) output_file=$@ filename=$(test_ca_key_file_ec) \ + subject_name="C=NL,O=PolarSSL,CN=Polarssl Test EC CA" md=SHA256 all_intermediate += test-ca2.req.sha256 test-ca2.crt: $(test_ca_key_file_ec) test-ca2.req.sha256 - $(MBEDTLS_CERT_WRITE) is_ca=1 serial=13926223505202072808 request_file=test-ca2.req.sha256 selfsign=1 issuer_name="C=NL,O=PolarSSL,CN=Polarssl Test EC CA" issuer_key=$(test_ca_key_file_ec) not_before=20190210144400 not_after=20290210144400 md=SHA256 version=3 output_file=$@ + $(MBEDTLS_CERT_WRITE) is_ca=1 serial=13926223505202072808 selfsign=1 \ + request_file=test-ca2.req.sha256 \ + issuer_name="C=NL,O=PolarSSL,CN=Polarssl Test EC CA" \ + issuer_key=$(test_ca_key_file_ec) \ + not_before=20190210144400 not_after=20290210144400 \ + md=SHA256 version=3 output_file=$@ all_final += test-ca2.crt +test-ca2.ku-%.crt: test-ca2.ku-%.crt.openssl.v3_ext $(test_ca_key_file_ec) test-ca2.req.sha256 + $(OPENSSL) x509 -req -in test-ca2.req.sha256 -extfile $< \ + -signkey $(test_ca_key_file_ec) -days 3653 -out $@ + +all_final += test-ca2.ku-crl.crt \ + test-ca2.ku-crt.crt \ + test-ca2.ku-crt_crl.crt \ + test-ca2.ku-ds.crt + test-ca2-future.crt: $(test_ca_key_file_ec) test-ca2.req.sha256 $(MBEDTLS_CERT_WRITE) is_ca=1 serial=13926223505202072808 request_file=test-ca2.req.sha256 selfsign=1 \ issuer_name="C=NL,O=PolarSSL,CN=Polarssl Test EC CA" issuer_key=$(test_ca_key_file_ec) \ @@ -147,11 +162,15 @@ $(test_ca_ec_cat): all_final += $(test_ca_ec_cat) test-ca-any_policy.crt: $(test_ca_key_file_rsa) test-ca.req.sha256 - $(OPENSSL) req -x509 -config $(test_ca_config_file) -extensions v3_any_policy_ca -key $(test_ca_key_file_rsa) -passin "pass:$(test_ca_pwd_rsa)" -set_serial 0 -days 3653 -sha256 -in test-ca.req.sha256 -out $@ + $(OPENSSL) req -x509 -config $(test_ca_config_file) -extensions v3_any_policy_ca \ + -key $(test_ca_key_file_rsa) -passin "pass:$(test_ca_pwd_rsa)" \ + -set_serial 0 -days 3653 -sha256 -in test-ca.req.sha256 -out $@ all_final += test-ca-any_policy.crt test-ca-any_policy_ec.crt: $(test_ca_key_file_ec) test-ca.req_ec.sha256 - $(OPENSSL) req -x509 -config $(test_ca_config_file) -extensions v3_any_policy_ca -key $(test_ca_key_file_ec) -set_serial 0 -days 3653 -sha256 -in test-ca.req_ec.sha256 -out $@ + $(OPENSSL) req -x509 -config $(test_ca_config_file) -extensions v3_any_policy_ca \ + -key $(test_ca_key_file_ec) -set_serial 0 -days 3653 -sha256 \ + -in test-ca.req_ec.sha256 -out $@ all_final += test-ca-any_policy_ec.crt test-ca-any_policy_with_qualifier.crt: $(test_ca_key_file_rsa) test-ca.req.sha256 diff --git a/tests/data_files/test-ca2.ku-crl.crt b/tests/data_files/test-ca2.ku-crl.crt index 4fb40838ca..303a2c00b9 100644 --- a/tests/data_files/test-ca2.ku-crl.crt +++ b/tests/data_files/test-ca2.ku-crl.crt @@ -1,12 +1,12 @@ -----BEGIN CERTIFICATE----- -MIIBzDCCAVOgAwIBAgIJAP6mZLzh0IPSMAoGCCqGSM49BAMCMD4xCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBF -QyBDQTAeFw0xNDA0MDkxMTIzMzhaFw0yNDA0MDYxMTIzMzhaMD4xCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBF -QyBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMPaKzRBN1gvh1b+/Im6KUNLTuBu -ww5XUzM5WNRStJGVOQsj318XJGJI/BqVKc4sLYfCiFKAr9ZqqyHduNMcbli4yuiy -aY7zQa0pw7RfdadHb9UZKVVpmlM7ILRmFmAzHqMdMBswDAYDVR0TBAUwAwEB/zAL -BgNVHQ8EBAMCAQIwCgYIKoZIzj0EAwIDZwAwZAIwZOCKY0EHXYzI4cQsFnfOrxm1 -ufvNeZ4ZcSZWrkTBazW2OBCuCP9SLznec3SFOUvvAjAKe/qycfxkHivjieCEG1Kt -m2D4QKSJELUhTHr4zdkeqbzgui0y3iouaoyWsKvetNg= +MIIB2DCCAV6gAwIBAgIUN3DAVq0Kn9k3FPUPZGW2d3rZn28wCgYIKoZIzj0EAwIw +PjELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xh +cnNzbCBUZXN0IEVDIENBMB4XDTIzMDUxNzA3MTAzN1oXDTMzMDUxNzA3MTAzN1ow +PjELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xh +cnNzbCBUZXN0IEVDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEw9orNEE3WC+H +Vv78ibopQ0tO4G7DDldTMzlY1FK0kZU5CyPfXxckYkj8GpUpziwth8KIUoCv1mqr +Id240xxuWLjK6LJpjvNBrSnDtF91p0dv1RkpVWmaUzsgtGYWYDMeox0wGzAMBgNV +HRMEBTADAQH/MAsGA1UdDwQEAwIBAjAKBggqhkjOPQQDAgNoADBlAjAxoq/Q4PEA +8SDd3cQaVIwx8oJVEzfJo1BB2w1LnjvUXZrQydjNXMU4Jgorm/2/uLgCMQCyI6cZ +EAIgKPYlT6/zJHBj45qejs527OfI4Xn+kQ7OvHQtHaCAzQw4h7Jfx+gXaUo= -----END CERTIFICATE----- diff --git a/tests/data_files/test-ca2.ku-crl.crt.openssl.v3_ext b/tests/data_files/test-ca2.ku-crl.crt.openssl.v3_ext new file mode 100644 index 0000000000..4bc5d3c24b --- /dev/null +++ b/tests/data_files/test-ca2.ku-crl.crt.openssl.v3_ext @@ -0,0 +1,4 @@ +basicConstraints = CA:true +subjectKeyIdentifier=none +keyUsage = cRLSign + diff --git a/tests/data_files/test-ca2.ku-crt.crt b/tests/data_files/test-ca2.ku-crt.crt index edacc64c9b..5cad7b2fc1 100644 --- a/tests/data_files/test-ca2.ku-crt.crt +++ b/tests/data_files/test-ca2.ku-crt.crt @@ -1,12 +1,12 @@ -----BEGIN CERTIFICATE----- -MIIBzTCCAVOgAwIBAgIJAODh6PAeD9/vMAoGCCqGSM49BAMCMD4xCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBF -QyBDQTAeFw0xNDA0MDkxMTIzNTRaFw0yNDA0MDYxMTIzNTRaMD4xCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBF -QyBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMPaKzRBN1gvh1b+/Im6KUNLTuBu -ww5XUzM5WNRStJGVOQsj318XJGJI/BqVKc4sLYfCiFKAr9ZqqyHduNMcbli4yuiy -aY7zQa0pw7RfdadHb9UZKVVpmlM7ILRmFmAzHqMdMBswDAYDVR0TBAUwAwEB/zAL -BgNVHQ8EBAMCAgQwCgYIKoZIzj0EAwIDaAAwZQIwGGlbynd1jU3WkUx6Irhk9Lob -z2B+1eIO6+eu3En8B3rh8Ipfxo0e0hpfaRFYP1MUAjEAjxxBchRWJAzZ6/47Wg/7 -UoasRINgP5B/uJhTnftS1bqyuWHastb4LW5/YLOvPbMQ +MIIB2DCCAV6gAwIBAgIUYDcYIJ6EBbKafKeXLgPLE+RsJZowCgYIKoZIzj0EAwIw +PjELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xh +cnNzbCBUZXN0IEVDIENBMB4XDTIzMDUxMjEwMzEwNVoXDTMzMDUxMjEwMzEwNVow +PjELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xh +cnNzbCBUZXN0IEVDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEw9orNEE3WC+H +Vv78ibopQ0tO4G7DDldTMzlY1FK0kZU5CyPfXxckYkj8GpUpziwth8KIUoCv1mqr +Id240xxuWLjK6LJpjvNBrSnDtF91p0dv1RkpVWmaUzsgtGYWYDMeox0wGzAMBgNV +HRMEBTADAQH/MAsGA1UdDwQEAwICBDAKBggqhkjOPQQDAgNoADBlAjBwsfyYiZB6 +PpDgIbYRbZ4VT9GGFNE3L4C1IH8RNwzvywLvQfVp3ocRAkzEoRpmKAsCMQDOGm48 +d7zKl7IzmBuOWXYlukWDDWwpNI67z7g0JawfypKIxcPTZFiQXVtDdTdkrGY= -----END CERTIFICATE----- diff --git a/tests/data_files/test-ca2.ku-crt.crt.openssl.v3_ext b/tests/data_files/test-ca2.ku-crt.crt.openssl.v3_ext new file mode 100644 index 0000000000..997c8930bf --- /dev/null +++ b/tests/data_files/test-ca2.ku-crt.crt.openssl.v3_ext @@ -0,0 +1,4 @@ +basicConstraints = CA:true +subjectKeyIdentifier=none +keyUsage = keyCertSign + diff --git a/tests/data_files/test-ca2.ku-crt_crl.crt b/tests/data_files/test-ca2.ku-crt_crl.crt index ac74e402a0..4c69582f3e 100644 --- a/tests/data_files/test-ca2.ku-crt_crl.crt +++ b/tests/data_files/test-ca2.ku-crt_crl.crt @@ -1,12 +1,12 @@ -----BEGIN CERTIFICATE----- -MIIBzDCCAVOgAwIBAgIJAPejOupCJS65MAoGCCqGSM49BAMCMD4xCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBF -QyBDQTAeFw0xNDA0MDkxMTIyMjVaFw0yNDA0MDYxMTIyMjVaMD4xCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBF -QyBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMPaKzRBN1gvh1b+/Im6KUNLTuBu -ww5XUzM5WNRStJGVOQsj318XJGJI/BqVKc4sLYfCiFKAr9ZqqyHduNMcbli4yuiy -aY7zQa0pw7RfdadHb9UZKVVpmlM7ILRmFmAzHqMdMBswDAYDVR0TBAUwAwEB/zAL -BgNVHQ8EBAMCAQYwCgYIKoZIzj0EAwIDZwAwZAIwMKLVXB4YBQ0Ha4dEvFPcJtau -TS5Vd4UqG3xQ10YcJogweuqaGHSFgdnEUfoX+4p5AjApMnYXFfUjSmlyfJmTaswO -gaR5sUnnw33NA9j1ercem3asCYz6a8T0zo8/rR33XVU= +MIIB2TCCAV6gAwIBAgIUd5f42F4ahjkx9AIN035pcF4WFikwCgYIKoZIzj0EAwIw +PjELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xh +cnNzbCBUZXN0IEVDIENBMB4XDTIzMDUxNzA3MTAzN1oXDTMzMDUxNzA3MTAzN1ow +PjELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xh +cnNzbCBUZXN0IEVDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEw9orNEE3WC+H +Vv78ibopQ0tO4G7DDldTMzlY1FK0kZU5CyPfXxckYkj8GpUpziwth8KIUoCv1mqr +Id240xxuWLjK6LJpjvNBrSnDtF91p0dv1RkpVWmaUzsgtGYWYDMeox0wGzAMBgNV +HRMEBTADAQH/MAsGA1UdDwQEAwIBBjAKBggqhkjOPQQDAgNpADBmAjEA6IUvQwSw +vEkHjU9YNsPcUsJf0UTHUW1T8mNbgk+zCl6fzeU73oCXH6zoi5q6vLgjAjEAv63C +xknmJJ4H3Zlc+O5GlcX9VQNZDn1xV7hf2yW1Gf7wLTnSWTf5bXATaIQ6QLO1 -----END CERTIFICATE----- diff --git a/tests/data_files/test-ca2.ku-crt_crl.crt.openssl.v3_ext b/tests/data_files/test-ca2.ku-crt_crl.crt.openssl.v3_ext new file mode 100644 index 0000000000..0fd73a25ab --- /dev/null +++ b/tests/data_files/test-ca2.ku-crt_crl.crt.openssl.v3_ext @@ -0,0 +1,4 @@ +basicConstraints = CA:true +subjectKeyIdentifier=none +keyUsage = keyCertSign, cRLSign + diff --git a/tests/data_files/test-ca2.ku-ds.crt b/tests/data_files/test-ca2.ku-ds.crt index c28e17b22a..2907aa7343 100644 --- a/tests/data_files/test-ca2.ku-ds.crt +++ b/tests/data_files/test-ca2.ku-ds.crt @@ -1,12 +1,12 @@ -----BEGIN CERTIFICATE----- -MIIBzDCCAVOgAwIBAgIJAPOkPR3wsvm5MAoGCCqGSM49BAMCMD4xCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBF -QyBDQTAeFw0xNDA0MDkxMTI0MTNaFw0yNDA0MDYxMTI0MTNaMD4xCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBF -QyBDQTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMPaKzRBN1gvh1b+/Im6KUNLTuBu -ww5XUzM5WNRStJGVOQsj318XJGJI/BqVKc4sLYfCiFKAr9ZqqyHduNMcbli4yuiy -aY7zQa0pw7RfdadHb9UZKVVpmlM7ILRmFmAzHqMdMBswDAYDVR0TBAUwAwEB/zAL -BgNVHQ8EBAMCB4AwCgYIKoZIzj0EAwIDZwAwZAIwGRCmU/rWNjW13g8ITuq3pMXb -jgwTFJHVlbMDiFJwUrRvytPV9doJOfzJ8nAQ0cZ1AjAbJ8QAV2e+DmYZpWc/p6Ug -nQdac59ev+lH+ju6wET3jNDjUthUPrdgqa54+UWQ5r4= +MIIB2TCCAV6gAwIBAgIUb5xsO6FEmAz+XpGFHpW7ODFvup0wCgYIKoZIzj0EAwIw +PjELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xh +cnNzbCBUZXN0IEVDIENBMB4XDTIzMDUxNzA3MTAzN1oXDTMzMDUxNzA3MTAzN1ow +PjELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xh +cnNzbCBUZXN0IEVDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEw9orNEE3WC+H +Vv78ibopQ0tO4G7DDldTMzlY1FK0kZU5CyPfXxckYkj8GpUpziwth8KIUoCv1mqr +Id240xxuWLjK6LJpjvNBrSnDtF91p0dv1RkpVWmaUzsgtGYWYDMeox0wGzAMBgNV +HRMEBTADAQH/MAsGA1UdDwQEAwIHgDAKBggqhkjOPQQDAgNpADBmAjEA44HVvGYv +meA3SpaNJmubLKjsQlGNnEUUo1IO0NBP5yWG0dRFkX8NQ0bzH/1n6FJcAjEAm9wj +xdmEPUr6PY54c0IQJNeeF76L1/+EszXrSDQ7TLv1YC4d4uMNmqwR9EGuUX+/ -----END CERTIFICATE----- diff --git a/tests/data_files/test-ca2.ku-ds.crt.openssl.v3_ext b/tests/data_files/test-ca2.ku-ds.crt.openssl.v3_ext new file mode 100644 index 0000000000..08e49d4751 --- /dev/null +++ b/tests/data_files/test-ca2.ku-ds.crt.openssl.v3_ext @@ -0,0 +1,4 @@ +basicConstraints = CA:true +subjectKeyIdentifier=none +keyUsage = digitalSignature + From 6acdd5c6241714ae3e34af6f8dd91ca3acc306ec Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Mon, 29 May 2023 11:02:42 +0800 Subject: [PATCH 008/135] Add rule for server2-badsign.crt Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index ce2ba6d91a..4500886ae2 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1403,6 +1403,10 @@ server2-sha256.crt: server2.req.sha256 $(MBEDTLS_CERT_WRITE) request_file=server2.req.sha256 serial=2 issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) not_before=20190210144406 not_after=20290210144406 md=SHA256 version=3 output_file=$@ all_final += server2-sha256.crt +server2-badsign.crt: server2.crt + { head -n-2 $<; tail -n-2 $< | sed -e '1s/0\(=*\)$$/_\1/' -e '1s/[^_=]\(=*\)$$/0\1/' -e '1s/_/1/'; } > $@ +all_final += server2-badsign.crt + # server3* server3.crt: server3.key From 4b7447cf45ee20888af8c59d51fcba516d9d3400 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Thu, 18 May 2023 14:40:27 +0800 Subject: [PATCH 009/135] Add rules to generate server2.ku-*.crt Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 4500886ae2..9686fd8ae5 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1403,6 +1403,21 @@ server2-sha256.crt: server2.req.sha256 $(MBEDTLS_CERT_WRITE) request_file=server2.req.sha256 serial=2 issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) not_before=20190210144406 not_after=20290210144406 md=SHA256 version=3 output_file=$@ all_final += server2-sha256.crt +server2.ku-ka.crt: SERVER2_CRT_SERIAL=42 +server2.ku-ka.crt: SERVER2_KEY_USAGE=key_agreement +server2.ku-ke.crt: SERVER2_CRT_SERIAL=43 +server2.ku-ke.crt: SERVER2_KEY_USAGE=key_encipherment +server2.ku-ds.crt: SERVER2_CRT_SERIAL=44 +server2.ku-ds.crt: SERVER2_KEY_USAGE=digital_signature +server2.ku-ds_ke.crt: SERVER2_CRT_SERIAL=48 +server2.ku-ds_ke.crt: SERVER2_KEY_USAGE=digital_signature,key_encipherment +server2.ku-%.crt: server2.req.sha256 + $(MBEDTLS_CERT_WRITE) request_file=server2.req.sha256 serial=$(SERVER2_CRT_SERIAL) \ + issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) \ + key_usage="$(SERVER2_KEY_USAGE)" \ + not_before=20190210144406 not_after=20290210144406 md=SHA1 version=3 output_file=$@ +all_final += server2.ku-ka.crt server2.ku-ke.crt server2.ku-ds.crt server2.ku-ds_ke.crt + server2-badsign.crt: server2.crt { head -n-2 $<; tail -n-2 $< | sed -e '1s/0\(=*\)$$/_\1/' -e '1s/[^_=]\(=*\)$$/0\1/' -e '1s/_/1/'; } > $@ all_final += server2-badsign.crt From 5a4cc39f39e51f3dda7db18e362a1c20fbdf2c30 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Thu, 18 May 2023 14:41:32 +0800 Subject: [PATCH 010/135] Update server2.ku-*.crt Signed-off-by: Pengyu Lv --- tests/data_files/server2.ku-ds.crt | 27 +++++++++++++-------------- tests/data_files/server2.ku-ds_ke.crt | 27 +++++++++++++-------------- tests/data_files/server2.ku-ka.crt | 27 +++++++++++++-------------- tests/data_files/server2.ku-ke.crt | 27 +++++++++++++-------------- 4 files changed, 52 insertions(+), 56 deletions(-) diff --git a/tests/data_files/server2.ku-ds.crt b/tests/data_files/server2.ku-ds.crt index 3bd07d0fbe..d1e1251d98 100644 --- a/tests/data_files/server2.ku-ds.crt +++ b/tests/data_files/server2.ku-ds.crt @@ -1,21 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDijCCAnKgAwIBAgIBLDANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER -MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN -MTQwNDA5MDg0NDUxWhcNMjQwNDA2MDg0NDUxWjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN +MIIDRzCCAi+gAwIBAgIBLDANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN +MTkwMjEwMTQ0NDA2WhcNMjkwMjEwMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G +A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTN owCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKz NtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kM tQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8P hYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjya -HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaOBnzCBnDAJ -BgNVHRMEAjAAMB0GA1UdDgQWBBSlBehkuNzfYA9QEk1gqGSvTYtDkzBjBgNVHSME -XDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBggEAMAsG -A1UdDwQEAwIHgDANBgkqhkiG9w0BAQUFAAOCAQEAc4kubASrFXFtplkYp6FUcnUn -Pf/6laS1htI+3y+q1UHWe2PcagZtCHTCUGBSWLeUIiaIBheaIRqv+4sSFVuXB7hV -0PGXpO5btth4R8BHzGqCdObKvPujp5BDq3xgcAFicA3HUMNsJoTDv/RYXY7je1Q5 -ntVyVPeji0AWMUYQjcqHTQQPGBgdJrRTMaYglZh15IhJ16ICNd9rWIeBA0h/+r0y -QuFEBz0nfe7Dvpqct7gJCv+7/5tCujx4LT17z7oK8BZN5SePAGU2ykJsUXk8ZICT -ongaQQVQwS6/GJ6A5V8ecaUvFrTby1h9+2sOW8n2NRGiaaG5gkvxVeayemcmOQ== +HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaNdMFswCQYD +VR0TBAIwADAdBgNVHQ4EFgQUpQXoZLjc32APUBJNYKhkr02LQ5MwHwYDVR0jBBgw +FoAUtFrkpbPe0lL2udWmlQ/rPrzH/f8wDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3 +DQEBBQUAA4IBAQCcDy5VWW133eL1TesUkejziAz9QNBHvWkKNs0jF6+fRgWgFP5Y +EE87rQX0Z1XiyTDB4LdKfivRi3TMD7EX8o6q9C3H/ilu5anrgha8WziMrtv/s9IF +QjpyHdnXGoXmA9uDqQLtucR5yep3ux4mlwS8GG3IUkpkdysNOrVvSARm0ZagQ9tn +YZyEjGd8wP3jKYNJAB2OdnvX9OqBmEyvSmMucSidkMkdLrUcjmOtz+AkqoRGewwc +eClstlp8NEuP37q2KLYtbQMpio1Kzsr3PCey1UImKNjauypS2Dpzl1RnmBw+c5En +SdLMa+ns3odRhF0IvENDhz/mKZJvwtoz/NBz -----END CERTIFICATE----- diff --git a/tests/data_files/server2.ku-ds_ke.crt b/tests/data_files/server2.ku-ds_ke.crt index ebee7e1c31..eb23245d81 100644 --- a/tests/data_files/server2.ku-ds_ke.crt +++ b/tests/data_files/server2.ku-ds_ke.crt @@ -1,21 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDijCCAnKgAwIBAgIBMDANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER -MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN -MTQwNDA5MTAwMjQ5WhcNMjQwNDA2MTAwMjQ5WjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN +MIIDRzCCAi+gAwIBAgIBMDANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN +MTkwMjEwMTQ0NDA2WhcNMjkwMjEwMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G +A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTN owCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKz NtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kM tQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8P hYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjya -HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaOBnzCBnDAJ -BgNVHRMEAjAAMB0GA1UdDgQWBBSlBehkuNzfYA9QEk1gqGSvTYtDkzBjBgNVHSME -XDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBggEAMAsG -A1UdDwQEAwIFoDANBgkqhkiG9w0BAQUFAAOCAQEAnW7+h85xBP2KJzFSpWfGirVe -ApdC9bX0Z1sVMmD486N+ty9W6BP6kJRxLDX0fOuRc3x7mCy5qZg/Yj40+yQSoA0w -bTNwJjuR8iMqWIqLw9hWR+E9T4lYLZWyGJVjlVTkO4i5wifwhoJE9Doohh/6crn5 -ImWgEkgT/wDVIHoamciO6KU36d0iAEEP2eYgxv2/sVHvjjsseTdvYh3D3VuOmQtS -uUvFxc6H5kYoq/yodJWDaOn3RS8pEpDsiW+abcWyxNTPtHFroJV7e9aaVmhlRSzw -sYDyD/ZyIlavoPSEiD3LTT/Tp6BIpz+zb4WHOHLEvUCsZputqxPVcNoEAi9xuA== +HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaNdMFswCQYD +VR0TBAIwADAdBgNVHQ4EFgQUpQXoZLjc32APUBJNYKhkr02LQ5MwHwYDVR0jBBgw +FoAUtFrkpbPe0lL2udWmlQ/rPrzH/f8wDgYDVR0PAQH/BAQDAgWgMA0GCSqGSIb3 +DQEBBQUAA4IBAQB6u7D3tAsB75aZEcUfv2XyeLX4P99mzx2yOBSsPaIDTRyv0XoT +vbgUA7viX/F7I8b2kc6ihRXSu/98c7Vr/uSm0LfV3VMgoAXBCWNg/5c/N3c0YnZ2 +imuv0yeXw5cJI3iYQJmllawdrGgOslfPuO7kqrFt3uGaylITpVLQ7w7iDpPbAFM8 +kPpO6CMyCFi6miQYoZchTTP9X3dpbpNdB2FlSVT55J6TIvH5x4t7XCFJuvYYJxrf +8I3UFR3OnBR625zUHXJ6uV8yHG5ze+4K2n9CHcyX7zuZ+bB0e8wIS6Xf99M+1ApF +ESvXwHI0Fu8s/PJ+leD28CRJQMuAOJIYBMnS -----END CERTIFICATE----- diff --git a/tests/data_files/server2.ku-ka.crt b/tests/data_files/server2.ku-ka.crt index 90f7c4a993..ce97e8272d 100644 --- a/tests/data_files/server2.ku-ka.crt +++ b/tests/data_files/server2.ku-ka.crt @@ -1,21 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDijCCAnKgAwIBAgIBKjANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER -MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN -MTQwNDA5MDg0NDIzWhcNMjQwNDA2MDg0NDIzWjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN +MIIDRzCCAi+gAwIBAgIBKjANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN +MTkwMjEwMTQ0NDA2WhcNMjkwMjEwMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G +A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTN owCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKz NtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kM tQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8P hYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjya -HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaOBnzCBnDAJ -BgNVHRMEAjAAMB0GA1UdDgQWBBSlBehkuNzfYA9QEk1gqGSvTYtDkzBjBgNVHSME -XDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBggEAMAsG -A1UdDwQEAwIDCDANBgkqhkiG9w0BAQUFAAOCAQEAriPloIWfu7U8d1hls97C7OBI -OiE2xFh2UmuN/9hTK2CyW6MtBf8aG3l4jQDrsutHO0gUyoR67ug4yj+s+0S/zETZ -q6mPo7cBbVwjhGciQRiYgufFpdnbXR05HDgOVPK7qqjL6UOZnbu5caIEvIJgdwXn -n8WB9x/Ii4/2S9ysmRdRhDBYekzgH3Ac2UnHJTMh1XaSL817MW6B9BDKHt4xa7pW -cplDzrFKYbmxSSxzALE4Dr+zRvmDx4bcYpBkRRfOhnnR1caQBgaZzPcX/Vu+vw8e -qs2nyBW5RBu8MBCBU1DpqOSo6jl0QTpuq3NzQZIouG9fyckqDJS5ibrxQTutPw== +HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaNdMFswCQYD +VR0TBAIwADAdBgNVHQ4EFgQUpQXoZLjc32APUBJNYKhkr02LQ5MwHwYDVR0jBBgw +FoAUtFrkpbPe0lL2udWmlQ/rPrzH/f8wDgYDVR0PAQH/BAQDAgMIMA0GCSqGSIb3 +DQEBBQUAA4IBAQAxJDMtlqpFHKw5ymqzgfnm0aY51PZOXpsPfoed7Vz2PzSB2eJ0 +JQc+QuLhippy8hnPmPZg/HQ/gedbxFKPiIiYEh86GvnBFozQ+c8sE0h6tJgVOJJi +ADUNeVJoq03WIroTMqAB0uW0rHB+OFm7uRwIDFr2gWVrKZKg/KsDrxtng2wPOgbU +xvPRtNyaOZjV0GjuBhWxpPTxXw27e5Mq3MS5B9piZgPXmam5lZdOe0LNrbQShfmP +4mk4drjdQaUrL3JLpLt8S4oihZU+dOHkYdZVHSAuuGikZK7qPfEdP/yrZTCgtY54 +vXxv47xT9L+pWtiTosBmsy/ewvWprVJIxLh3 -----END CERTIFICATE----- diff --git a/tests/data_files/server2.ku-ke.crt b/tests/data_files/server2.ku-ke.crt index 8daa0c13d1..21e6cf0400 100644 --- a/tests/data_files/server2.ku-ke.crt +++ b/tests/data_files/server2.ku-ke.crt @@ -1,21 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDijCCAnKgAwIBAgIBKzANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER -MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN -MTQwNDA5MDg0NDM5WhcNMjQwNDA2MDg0NDM5WjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN +MIIDRzCCAi+gAwIBAgIBKzANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN +MTkwMjEwMTQ0NDA2WhcNMjkwMjEwMTQ0NDA2WjA0MQswCQYDVQQGEwJOTDERMA8G +A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTN owCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKz NtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kM tQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8P hYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjya -HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaOBnzCBnDAJ -BgNVHRMEAjAAMB0GA1UdDgQWBBSlBehkuNzfYA9QEk1gqGSvTYtDkzBjBgNVHSME -XDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBggEAMAsG -A1UdDwQEAwIFIDANBgkqhkiG9w0BAQUFAAOCAQEAqreLAIuxeLGKbhoEROYRqXxO -ndaC6uDcpxhgmEW7B2DW6ZtX8155v3ov61MuMas8fEQjD5STDP9qERxNTePnhW3m -kDZd2jUBE3ioHhTBv47i1PYU+DRe42kY6z0jUmNPK8TsTKfdbqTGXg9THe1KYB7q -hdljqGS08IgBl/q2lK2OOSycu27xhfb9Mo0BcLBab92WgyBu+cFPQsKiL4mD7QyJ -+73Ndb21EuANUjsRDQ3NPklssJcyJB2v85eekwk1acZUG21no3wdTvjxhVE/Xrdz -zUP9WkvAVfUrwGjUzG4YHE8wkHO7xKbKixNt+nQmDhe+tHVbztZjVwFJ8010gg== +HT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAAaNdMFswCQYD +VR0TBAIwADAdBgNVHQ4EFgQUpQXoZLjc32APUBJNYKhkr02LQ5MwHwYDVR0jBBgw +FoAUtFrkpbPe0lL2udWmlQ/rPrzH/f8wDgYDVR0PAQH/BAQDAgUgMA0GCSqGSIb3 +DQEBBQUAA4IBAQCeNpH2eSUXpq0CPlE6P1/bJW2f0vKFWMnZ6B3eFCdMCcKJ6LYV +BA1Dn5G5HEW4mBMJfyMwD5sklyEzQDCgIDjws+BRUflMr71AerfesHIGdW4jAw10 +aWwFMeszzZ54ZahX2GHPcwWfTccSf9tpSaRMlNBEIz8lfb2iEZ2HR9eAmAqYgtR1 +RbYcsNfC0oBYOCTRmvXi+wpGcUWn+VbIv6rHrQYnWXiPAuPJUqIpM0x9q0kT6NCi +LfdhaVV2DPnvBYGRcXX78JK5/MQt/sv4JSefRpvxpVQCmbo0amz7hUMHGCflAbro +FpyBlfcpj0lSRoaU9x0mCYzqwDYd+4NJZUGT -----END CERTIFICATE----- From 0158966a733704d300b64c199c42d1fc217ed8bf Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Thu, 18 May 2023 15:20:12 +0800 Subject: [PATCH 011/135] Add rules to generate server5.[e]ku-*.crt Since cert_write in mbedtls-2.28 doesn't support write ext_key_usage extension, the commands are added just for alignment with development. Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 9686fd8ae5..0df98f934a 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1244,6 +1244,32 @@ server5.req.ku.sha1: server5.key $(MBEDTLS_CERT_REQ) output_file=$@ filename=$< key_usage=digital_signature,non_repudiation subject_name="C=NL,O=PolarSSL,CN=PolarSSL Server 1" md=SHA1 all_final += server5.req.ku.sha1 +server5.ku-ds.crt: SERVER5_CRT_SERIAL=45 +server5.ku-ds.crt: SERVER5_KEY_USAGE=digital_signature +server5.ku-ka.crt: SERVER5_CRT_SERIAL=46 +server5.ku-ka.crt: SERVER5_KEY_USAGE=key_agreement +server5.ku-ke.crt: SERVER5_CRT_SERIAL=47 +server5.ku-ke.crt: SERVER5_KEY_USAGE=key_encipherment +server5.eku-cs.crt: SERVER5_CRT_SERIAL=58 +server5.eku-cs.crt: SERVER5_EXT_KEY_USAGE=codeSigning +server5.eku-cs_any.crt: SERVER5_CRT_SERIAL=59 +server5.eku-cs_any.crt: SERVER5_EXT_KEY_USAGE=codeSigning,any +server5.eku-cli.crt: SERVER5_CRT_SERIAL=60 +server5.eku-cli.crt: SERVER5_EXT_KEY_USAGE=clientAuth +server5.eku-srv_cli.crt: SERVER5_CRT_SERIAL=61 +server5.eku-srv_cli.crt: SERVER5_EXT_KEY_USAGE=serverAuth,clientAuth +server5.eku-srv.crt: SERVER5_CRT_SERIAL=62 +server5.eku-srv.crt: SERVER5_EXT_KEY_USAGE=serverAuth +server5.ku-%.crt: SERVER5_EXT_OPTS=key_usage=$(SERVER5_KEY_USAGE) +server5.eku-%.crt: SERVER5_EXT_OPTS=ext_key_usage=$(SERVER5_EXT_KEY_USAGE) +server5.%.crt: server5.key + $(MBEDTLS_CERT_WRITE) \ + subject_key=$< subject_name="C=NL,O=PolarSSL,CN=localhost" serial=$(SERVER5_CRT_SERIAL) \ + issuer_crt=$(test_ca_crt_file_ec) issuer_key=$(test_ca_key_file_ec) $(SERVER5_EXT_OPTS) \ + not_before=20190210144406 not_after=20290210144406 md=SHA256 version=3 output_file=$@ +all_final += server5.ku-ka.crt server5.ku-ke.crt server5.ku-ds.crt +all_final += server5.eku-cs.crt server5.eku-cs_any.crt server5.eku-cli.crt server5.eku-srv_cli.crt server5.eku-srv.crt + # server6* server6.csr: server6.key From fce773e0e9f85b45531820475a9657296c692f36 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Thu, 18 May 2023 15:21:11 +0800 Subject: [PATCH 012/135] Update server5.[e]ku-*.crt Signed-off-by: Pengyu Lv --- tests/data_files/server5.eku-cli.crt | 22 +++++++++++----------- tests/data_files/server5.eku-cs.crt | 22 +++++++++++----------- tests/data_files/server5.eku-cs_any.crt | 22 +++++++++++----------- tests/data_files/server5.eku-srv.crt | 22 +++++++++++----------- tests/data_files/server5.eku-srv_cli.crt | 22 +++++++++++----------- tests/data_files/server5.ku-ds.crt | 23 +++++++++++------------ tests/data_files/server5.ku-ka.crt | 23 +++++++++++------------ tests/data_files/server5.ku-ke.crt | 23 +++++++++++------------ 8 files changed, 88 insertions(+), 91 deletions(-) diff --git a/tests/data_files/server5.eku-cli.crt b/tests/data_files/server5.eku-cli.crt index 8aa2e44a03..8d04559839 100644 --- a/tests/data_files/server5.eku-cli.crt +++ b/tests/data_files/server5.eku-cli.crt @@ -1,13 +1,13 @@ -----BEGIN CERTIFICATE----- -MIIB5DCCAWmgAwIBAgIBPDAKBggqhkjOPQQDAjA+MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxHDAaBgNVBAMTE1BvbGFyc3NsIFRlc3QgRUMgQ0EwHhcN -MTQwNDEwMTcyMTIxWhcNMjQwNDA3MTcyMTIxWjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG -CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA -2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jYjBgMAkGA1UdEwQCMAAwHQYD -VR0OBBYEFFBhpY/UB9nXggEM5WV/jGNGpxO+MB8GA1UdIwQYMBaAFJ1tICRJAT8r -y3i1Gbx+JMnb+zZ8MBMGA1UdJQQMMAoGCCsGAQUFBwMCMAoGCCqGSM49BAMCA2kA -MGYCMQCzHyEvd56zm1AzfDBi3psz3rDL/m0RN2WnbRBQJxIJqjwEXOrKazko9m9q -owgau88CMQDuI0fsq5tnyiHPaDSAE21/6hlrCR6deNbwzB94OuPIbx1wIas9D1jc -//iSmKtbl8Y= +MIIB6zCCAW6gAwIBAgIBPDAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0xOTAyMTAxNDQ0MDZaFw0yOTAyMTAxNDQ0MDZaMDQxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO +5QDYIxH/6i/SNF1dFr2KiMJrdw1VzYoqDvoByLTt/6NlMGMwCQYDVR0TBAIwADAd +BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wHwYDVR0jBBgwFoAUnW0gJEkB +PyvLeLUZvH4kydv7NnwwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwIwDAYIKoZIzj0E +AwIFAANpADBmAjEAoC1Xxg8Xt3tvM2ZER4jCRv7iSYPWGgNtcYNJj3G0lb0PYi1l +Nd0cqdGxydhm7RJLAjEApAE8koD1ccIPnSFTagT7shOSz1/lOU4wwAWswcwolzt3 +xrvFlMoTeJx3sS3Zqdr8 -----END CERTIFICATE----- diff --git a/tests/data_files/server5.eku-cs.crt b/tests/data_files/server5.eku-cs.crt index db97b403e9..c00bc3bec2 100644 --- a/tests/data_files/server5.eku-cs.crt +++ b/tests/data_files/server5.eku-cs.crt @@ -1,13 +1,13 @@ -----BEGIN CERTIFICATE----- -MIIB4zCCAWmgAwIBAgIBOjAKBggqhkjOPQQDAjA+MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxHDAaBgNVBAMTE1BvbGFyc3NsIFRlc3QgRUMgQ0EwHhcN -MTQwNDEwMTcyMDQxWhcNMjQwNDA3MTcyMDQxWjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG -CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA -2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jYjBgMAkGA1UdEwQCMAAwHQYD -VR0OBBYEFFBhpY/UB9nXggEM5WV/jGNGpxO+MB8GA1UdIwQYMBaAFJ1tICRJAT8r -y3i1Gbx+JMnb+zZ8MBMGA1UdJQQMMAoGCCsGAQUFBwMDMAoGCCqGSM49BAMCA2gA -MGUCMQC294oVK6fUjH/abI1xzytTusi8dl7518L0Y19q8zi9K19OtxzPK09h7xyy -gaJRvpUCMFS6hYhrht38yqwwhSVlnmTMVtira58mEUhL6v7Qzw1sz/Dm4aXkW3s6 -JQV1kqqbRw== +MIIB6jCCAW6gAwIBAgIBOjAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0xOTAyMTAxNDQ0MDZaFw0yOTAyMTAxNDQ0MDZaMDQxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO +5QDYIxH/6i/SNF1dFr2KiMJrdw1VzYoqDvoByLTt/6NlMGMwCQYDVR0TBAIwADAd +BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wHwYDVR0jBBgwFoAUnW0gJEkB +PyvLeLUZvH4kydv7NnwwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwMwDAYIKoZIzj0E +AwIFAANoADBlAjBlMU7Fh18cel20P3rY7esvtPLDHQQKWSCO91XHHkZi1zRPq2px +nwVHayXnOS3CPRsCMQCQDYTyVMS8oEIrm0XPI6HrbCMUq2bhPwaYpelU/asOzYI3 +gOjGCDFHtyedJHVK0rs= -----END CERTIFICATE----- diff --git a/tests/data_files/server5.eku-cs_any.crt b/tests/data_files/server5.eku-cs_any.crt index 8fa8632dd0..912d929b19 100644 --- a/tests/data_files/server5.eku-cs_any.crt +++ b/tests/data_files/server5.eku-cs_any.crt @@ -1,13 +1,13 @@ -----BEGIN CERTIFICATE----- -MIIB6TCCAW+gAwIBAgIBOzAKBggqhkjOPQQDAjA+MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxHDAaBgNVBAMTE1BvbGFyc3NsIFRlc3QgRUMgQ0EwHhcN -MTQwNDEwMTcyMDU4WhcNMjQwNDA3MTcyMDU4WjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG -CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA -2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jaDBmMAkGA1UdEwQCMAAwHQYD -VR0OBBYEFFBhpY/UB9nXggEM5WV/jGNGpxO+MB8GA1UdIwQYMBaAFJ1tICRJAT8r -y3i1Gbx+JMnb+zZ8MBkGA1UdJQQSMBAGCCsGAQUFBwMDBgRVHSUAMAoGCCqGSM49 -BAMCA2gAMGUCMQCSYaq/9IKOTkzIrU/eOtpha/3af3JwT6vKh4N3cSX62ksMz0GT -Uxmq4UGMBt4VmBkCMBGpYqof6hS1o92ltNRpDSHuVQ+nke1lOsoQ1plZp4SI+bY1 -bUD/WrUSLlwikZAeng== +MIIB8DCCAXSgAwIBAgIBOzAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0xOTAyMTAxNDQ0MDZaFw0yOTAyMTAxNDQ0MDZaMDQxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO +5QDYIxH/6i/SNF1dFr2KiMJrdw1VzYoqDvoByLTt/6NrMGkwCQYDVR0TBAIwADAd +BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wHwYDVR0jBBgwFoAUnW0gJEkB +PyvLeLUZvH4kydv7NnwwHAYDVR0lAQH/BBIwEAYIKwYBBQUHAwMGBFUdJQAwDAYI +KoZIzj0EAwIFAANoADBlAjEA89+l8gNC0H75Tzdz/75W6EjGSzZ3m50S4cK5jD6+ +ZZLpRcbIqPqMT2MNkCm7ImNpAjAlTkFLVCGnTNX/q7QWOrx8aPXXAeZtY5NFxd66 +EJJb+YHTQ80hZhLWX8/QaAJjniU= -----END CERTIFICATE----- diff --git a/tests/data_files/server5.eku-srv.crt b/tests/data_files/server5.eku-srv.crt index 64312f6c49..b173afcdaa 100644 --- a/tests/data_files/server5.eku-srv.crt +++ b/tests/data_files/server5.eku-srv.crt @@ -1,13 +1,13 @@ -----BEGIN CERTIFICATE----- -MIIB5DCCAWmgAwIBAgIBPjAKBggqhkjOPQQDAjA+MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxHDAaBgNVBAMTE1BvbGFyc3NsIFRlc3QgRUMgQ0EwHhcN -MTQwNDEwMTcyMTU0WhcNMjQwNDA3MTcyMTU0WjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG -CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA -2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jYjBgMAkGA1UdEwQCMAAwHQYD -VR0OBBYEFFBhpY/UB9nXggEM5WV/jGNGpxO+MB8GA1UdIwQYMBaAFJ1tICRJAT8r -y3i1Gbx+JMnb+zZ8MBMGA1UdJQQMMAoGCCsGAQUFBwMBMAoGCCqGSM49BAMCA2kA -MGYCMQDQzjWB0xZs/8IsqJb7owYYtCiT17939Uuc/1yBF69pJRy7KV/qJlHNvlVu -qwWVTx0CMQDNW/0dlX1gU6ashrZv5Ly4sijg/g645fFpfMKCNXysEb9xiBeEj5de -2x5sX/0OSx4= +MIIB6jCCAW6gAwIBAgIBPjAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0xOTAyMTAxNDQ0MDZaFw0yOTAyMTAxNDQ0MDZaMDQxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO +5QDYIxH/6i/SNF1dFr2KiMJrdw1VzYoqDvoByLTt/6NlMGMwCQYDVR0TBAIwADAd +BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wHwYDVR0jBBgwFoAUnW0gJEkB +PyvLeLUZvH4kydv7NnwwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwEwDAYIKoZIzj0E +AwIFAANoADBlAjEAh+l47FmXR/nUxD8bfnS3sT+QTgc8pXUEqh/gXUs2xINVSoL+ +ZewgcNb2UanzCNheAjAnUY4b0M9YHp/eJjls5RzGX6JXtcWwn9JvO1HqMQnHthcy +hPEQ3lW7XG0DIQS1drk= -----END CERTIFICATE----- diff --git a/tests/data_files/server5.eku-srv_cli.crt b/tests/data_files/server5.eku-srv_cli.crt index 9f58fedd20..be2531ee22 100644 --- a/tests/data_files/server5.eku-srv_cli.crt +++ b/tests/data_files/server5.eku-srv_cli.crt @@ -1,13 +1,13 @@ -----BEGIN CERTIFICATE----- -MIIB7DCCAXOgAwIBAgIBPTAKBggqhkjOPQQDAjA+MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxHDAaBgNVBAMTE1BvbGFyc3NsIFRlc3QgRUMgQ0EwHhcN -MTQwNDEwMTcyMTQyWhcNMjQwNDA3MTcyMTQyWjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG -CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA -2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jbDBqMAkGA1UdEwQCMAAwHQYD -VR0OBBYEFFBhpY/UB9nXggEM5WV/jGNGpxO+MB8GA1UdIwQYMBaAFJ1tICRJAT8r -y3i1Gbx+JMnb+zZ8MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAKBggq -hkjOPQQDAgNnADBkAjAmQjJxxC82ZhBpH/GQkOQXDmaaV/JHRHGok1cWn3j3Xj8A -fqRZkp8JihpGIMse208CMFCMdNAfNd1tv+oPuynoK5Oh6/YlASX/otJT68voEIAN -SmsT1m9VPQMIyUo/3RtYjg== +MIIB8zCCAXigAwIBAgIBPTAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0xOTAyMTAxNDQ0MDZaFw0yOTAyMTAxNDQ0MDZaMDQxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO +5QDYIxH/6i/SNF1dFr2KiMJrdw1VzYoqDvoByLTt/6NvMG0wCQYDVR0TBAIwADAd +BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wHwYDVR0jBBgwFoAUnW0gJEkB +PyvLeLUZvH4kydv7NnwwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC +MAwGCCqGSM49BAMCBQADZwAwZAIwHu/xjSqHK91yEM+KgEFGU8Xc3o9rEVrCBFeW +ChIa3slZZdG4OuIm06Tsabf0pBLHAjBYKjoUwWEuDOOQKbbJZG8gKDzMAgEpe/RW +wAjY7i6CzZ1NKfFQ9fQdwA+yjq2fnlg= -----END CERTIFICATE----- diff --git a/tests/data_files/server5.ku-ds.crt b/tests/data_files/server5.ku-ds.crt index 58dd0714b5..dafff9b3d7 100644 --- a/tests/data_files/server5.ku-ds.crt +++ b/tests/data_files/server5.ku-ds.crt @@ -1,14 +1,13 @@ -----BEGIN CERTIFICATE----- -MIICLTCCAbKgAwIBAgIBLTAKBggqhkjOPQQDAjA+MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxHDAaBgNVBAMTE1BvbGFyc3NsIFRlc3QgRUMgQ0EwHhcN -MTQwNDA5MDg0ODM1WhcNMjQwNDA2MDg0ODM1WjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG -CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA -2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jgaowgacwCQYDVR0TBAIwADAd -BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wbgYDVR0jBGcwZYAUnW0gJEkB -PyvLeLUZvH4kydv7NnyhQqRAMD4xCzAJBgNVBAYTAk5MMREwDwYDVQQKEwhQb2xh -clNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBFQyBDQYIJAMFD4n5iQ8zoMAsG -A1UdDwQEAwIHgDAKBggqhkjOPQQDAgNpADBmAjEAzp4DkFMq7eDB0x5FeS9gYDaG -Ol8rVnWlRTLQzHZBQjKp+TcBdHZaBPoi8LyXtWA4AjEA6OWhsuTcv/qXOscQT0rL -eEh8wcCQeJK1uNd78lNvx3W0Pcxdb6cd7AhaAKgXL+r4 +MIIB4zCCAWagAwIBAgIBLTAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0xOTAyMTAxNDQ0MDZaFw0yOTAyMTAxNDQ0MDZaMDQxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO +5QDYIxH/6i/SNF1dFr2KiMJrdw1VzYoqDvoByLTt/6NdMFswCQYDVR0TBAIwADAd +BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wHwYDVR0jBBgwFoAUnW0gJEkB +PyvLeLUZvH4kydv7NnwwDgYDVR0PAQH/BAQDAgeAMAwGCCqGSM49BAMCBQADaQAw +ZgIxALHO0QR+4vz+fj4WwBQMa55oJDlp1J0PpqoJYKTf6DRx5rNuZxSbNu2wJQWz +MJ9ekQIxAMPo/Rhu4e9KRkEf9rYU9Ynd7t9/PCsXw4JZuxZfToURDsrAI/Pnqc0H +4+FA/EuPJA== -----END CERTIFICATE----- diff --git a/tests/data_files/server5.ku-ka.crt b/tests/data_files/server5.ku-ka.crt index 2447326c2e..74a4235244 100644 --- a/tests/data_files/server5.ku-ka.crt +++ b/tests/data_files/server5.ku-ka.crt @@ -1,14 +1,13 @@ -----BEGIN CERTIFICATE----- -MIICKzCCAbKgAwIBAgIBLjAKBggqhkjOPQQDAjA+MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxHDAaBgNVBAMTE1BvbGFyc3NsIFRlc3QgRUMgQ0EwHhcN -MTQwNDA5MDg0ODUwWhcNMjQwNDA2MDg0ODUwWjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG -CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA -2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jgaowgacwCQYDVR0TBAIwADAd -BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wbgYDVR0jBGcwZYAUnW0gJEkB -PyvLeLUZvH4kydv7NnyhQqRAMD4xCzAJBgNVBAYTAk5MMREwDwYDVQQKEwhQb2xh -clNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBFQyBDQYIJAMFD4n5iQ8zoMAsG -A1UdDwQEAwIDCDAKBggqhkjOPQQDAgNnADBkAjACzKQ88/NvngMQBFc9rC484+gO -BRkXP28BqRcj8sBt3EfmEGH23BuhkZuB1OFZuMICMC4/pHgbOQtaY9WZPUROUVVZ -OuO6XsVbhiE0rb/mumqmUwuOrCtC/KFdvFZol4BNGA== +MIIB4jCCAWagAwIBAgIBLjAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0xOTAyMTAxNDQ0MDZaFw0yOTAyMTAxNDQ0MDZaMDQxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO +5QDYIxH/6i/SNF1dFr2KiMJrdw1VzYoqDvoByLTt/6NdMFswCQYDVR0TBAIwADAd +BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wHwYDVR0jBBgwFoAUnW0gJEkB +PyvLeLUZvH4kydv7NnwwDgYDVR0PAQH/BAQDAgMIMAwGCCqGSM49BAMCBQADaAAw +ZQIwCVbbPiS8MJUOz8JBmgLHojKDaJOd4lSfSak0GSl02UjT8OiNyRzA+FlFWO94 +YMjyAjEA14/ubZ1ZW3/0hkiFHzhTD2SXbTfYbhDZSq2PR+9sBlUrrx1GhzWw/cOD +3jZd4DQO -----END CERTIFICATE----- diff --git a/tests/data_files/server5.ku-ke.crt b/tests/data_files/server5.ku-ke.crt index 41ae5ada31..6b4e74e240 100644 --- a/tests/data_files/server5.ku-ke.crt +++ b/tests/data_files/server5.ku-ke.crt @@ -1,14 +1,13 @@ -----BEGIN CERTIFICATE----- -MIICKzCCAbKgAwIBAgIBLzAKBggqhkjOPQQDAjA+MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxHDAaBgNVBAMTE1BvbGFyc3NsIFRlc3QgRUMgQ0EwHhcN -MTQwNDA5MDg0OTA0WhcNMjQwNDA2MDg0OTA0WjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDBZMBMGByqGSM49AgEG -CCqGSM49AwEHA0IABDfMVtl2CR5acj7HWS3/IG7ufPkGkXTQrRS192giWWKSTuUA -2CMR/+ov0jRdXRa9iojCa3cNVc2KKg76Aci07f+jgaowgacwCQYDVR0TBAIwADAd -BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wbgYDVR0jBGcwZYAUnW0gJEkB -PyvLeLUZvH4kydv7NnyhQqRAMD4xCzAJBgNVBAYTAk5MMREwDwYDVQQKEwhQb2xh -clNTTDEcMBoGA1UEAxMTUG9sYXJzc2wgVGVzdCBFQyBDQYIJAMFD4n5iQ8zoMAsG -A1UdDwQEAwIFIDAKBggqhkjOPQQDAgNnADBkAjAMl0Cjv9f45bHeJTul5XpYeJeT -52ZaOLTa/uTLy948EnEIi6sj3nFb9fvsUbsOOjECMAXAMY64KOqzixefz3y3XS/d -9miyeArPOmXU2JJ3LGuNbqqj9IbABawB1OD8v8gRmg== +MIIB4TCCAWagAwIBAgIBLzAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0xOTAyMTAxNDQ0MDZaFw0yOTAyMTAxNDQ0MDZaMDQxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C +AQYIKoZIzj0DAQcDQgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO +5QDYIxH/6i/SNF1dFr2KiMJrdw1VzYoqDvoByLTt/6NdMFswCQYDVR0TBAIwADAd +BgNVHQ4EFgQUUGGlj9QH2deCAQzlZX+MY0anE74wHwYDVR0jBBgwFoAUnW0gJEkB +PyvLeLUZvH4kydv7NnwwDgYDVR0PAQH/BAQDAgUgMAwGCCqGSM49BAMCBQADZwAw +ZAIwezTY0tigIg6u1dFl90LHYcZ+lJK4BO5Y6U9pn952NFo24NsL8qnG4nxwsL3M +VvV7AjBQ+oZyKSyNp8XRAHYC6lERH7/Gh7HrVWyTRo9iPPL6tE4x/jE7jL9ifgl+ +F6982sk= -----END CERTIFICATE----- From 5539dcb2d464b028767dd24f4cb2acedfc4b7d74 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Thu, 18 May 2023 10:10:39 +0800 Subject: [PATCH 013/135] Add rules to generate cert_example_multi_nocn.crt Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 16 ++++++++++++++++ tests/data_files/test-ca.opensslconf | 5 +++++ 2 files changed, 21 insertions(+) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 0df98f934a..a66e28d65c 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -61,6 +61,14 @@ test-ca.key.der: $(test_ca_key_file_rsa) $(OPENSSL) pkey -in $< -out $@ -inform PEM -outform DER -passin "pass:$(test_ca_pwd_rsa)" all_final += test-ca.key.der +# This is only used for generating cert_example_multi_nocn.crt +test-ca_nocn.crt: $(test_ca_key_file_rsa) + $(MBEDTLS_CERT_WRITE) is_ca=1 serial=3 selfsign=1 \ + subject_key=$(test_ca_key_file_rsa) subject_pwd=$(test_ca_pwd_rsa) subject_name="C=NL" \ + issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) issuer_name="C=NL" \ + not_before=20190210144400 not_after=20290210144400 md=SHA1 version=3 output_file=$@ +all_intermediate += test-ca_nocn.crt + test-ca-sha1.crt: $(test_ca_key_file_rsa) test-ca.req.sha256 $(MBEDTLS_CERT_WRITE) is_ca=1 serial=3 request_file=test-ca.req.sha256 selfsign=1 issuer_name="C=NL,O=PolarSSL,CN=PolarSSL Test CA" issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) not_before=20190210144400 not_after=20290210144400 md=SHA1 version=3 output_file=$@ all_final += test-ca-sha1.crt @@ -97,6 +105,14 @@ cert_example_multi.csr: rsa_pkcs1_1024_clear.pem cert_example_multi.crt: cert_example_multi.csr $(OPENSSL) x509 -req -CA $(test_ca_crt) -CAkey $(test_ca_key_file_rsa) -extfile $(test_ca_config_file) -extensions dns_alt_names -passin "pass:$(test_ca_pwd_rsa)" -set_serial 17 -days 3653 -sha256 -in $< > $@ +cert_example_multi_nocn.csr: rsa_pkcs1_1024_clear.pem + $(MBEDTLS_CERT_REQ) filename=$< output_file=$@ subject_name='C=NL' +all_intermediate += cert_example_multi_nocn.csr + +cert_example_multi_nocn.crt: cert_example_multi_nocn.csr test-ca_nocn.crt + $(OPENSSL) x509 -req -CA test-ca_nocn.crt -CAkey $(test_ca_key_file_rsa) -extfile $(test_ca_config_file) -extensions ext_multi_nocn -passin "pass:$(test_ca_pwd_rsa)" -set_serial 0xf7c67ff8e9a963f9 -days 3653 -sha1 -in $< > $@ +all_final += cert_example_multi_nocn.crt + $(test_ca_key_file_rsa_alt):test-ca.opensslconf $(OPENSSL) genrsa -out $@ 2048 test-ca-alt.csr: $(test_ca_key_file_rsa_alt) $(test_ca_config_file) diff --git a/tests/data_files/test-ca.opensslconf b/tests/data_files/test-ca.opensslconf index ff3e4c46f2..f03f5fd399 100644 --- a/tests/data_files/test-ca.opensslconf +++ b/tests/data_files/test-ca.opensslconf @@ -38,6 +38,11 @@ DNS.3=*.example.org [multiple_san] subjectAltName=@alt_names +[ext_multi_nocn] +basicConstraints = CA:false +keyUsage = digitalSignature, nonRepudiation, keyEncipherment +subjectAltName = DNS:www.shotokan-braunschweig.de,DNS:www.massimo-abate.eu,IP:192.168.1.1,IP:192.168.69.144 + [hw_module_name] hwtype = OID:1.3.6.1.4.1.17.3 hwserial = OCT:123456 From 124b75a09aa7ca5682b9c6a0ea57216498bce7a5 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Thu, 18 May 2023 10:11:30 +0800 Subject: [PATCH 014/135] Update cert_example_multi_nocn.crt Signed-off-by: Pengyu Lv --- tests/data_files/cert_example_multi_nocn.crt | 23 +++++++++++--------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/tests/data_files/cert_example_multi_nocn.crt b/tests/data_files/cert_example_multi_nocn.crt index 1634846e1b..08bf63c9d2 100644 --- a/tests/data_files/cert_example_multi_nocn.crt +++ b/tests/data_files/cert_example_multi_nocn.crt @@ -1,13 +1,16 @@ -----BEGIN CERTIFICATE----- -MIIB/TCCAWagAwIBAgIJAPfGf/jpqWP5MA0GCSqGSIb3DQEBBQUAMA0xCzAJBgNV -BAYTAk5MMB4XDTE0MDEyMjEwMDQzM1oXDTI0MDEyMjEwMDQzM1owDTELMAkGA1UE -BhMCTkwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAN0Rip+ZurBoyirqO2pt -WZftTslU5A3uzqB9oB6q6A7CuxNA24oSjokTJKXF9frY9ZDXyMrLxf6THa/aEiNz -UnlGGrqgVyt2FjGzqK/nOJsIi2OZOgol7kXSGFi6uZMa7dRYmmMbN/z3FAifhWVJ -81kybdHg6G3eUu1mtKkL2kCVAgMBAAGjZTBjMAkGA1UdEwQCMAAwCwYDVR0PBAQD +MIICfjCCAWagAwIBAgIJAPfGf/jpqWP5MA0GCSqGSIb3DQEBBQUAMA0xCzAJBgNV +BAYTAk5MMB4XDTIzMDUxODAyMDUwMVoXDTMzMDUxODAyMDUwMVowDTELMAkGA1UE +BhMCTkwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMc4ksXD9HAQCGv4EzXs +8wEciiUPlYI2HqoelhJVGqz4e3UzC3BXM5zZlfFNTEQ3yL7EoD/kZDzT88kCQz3D +fFuOeaoJhK6CEzcKv4VpvSo1Ymyx/uSs4EKyQXx75J0nFJssB2uOQz0/bHY6Rpoc +cA0lnbwIx0D82AI3Yv996/wtAgMBAAGjZTBjMAkGA1UdEwQCMAAwCwYDVR0PBAQD AgXgMEkGA1UdEQRCMECCHHd3dy5zaG90b2thbi1icmF1bnNjaHdlaWcuZGWCFHd3 -dy5tYXNzaW1vLWFiYXRlLmV1hwTAqAEBhwTAqEWQMA0GCSqGSIb3DQEBBQUAA4GB -ABjx1ytrqCyFC5/0cjWnbLK9vsvLny2ZikDewfRxqJ5zAxGWLqHOr1SmUmu2DrvB -bkT9g5z19+iMhPnzJz1x7Q2m7WTIJTuUPK+hKZJATDLNhZ86h5Nkw8k9YzKcOrPm -EIqsy55CSgLU0ntljqSBvSb4ifrF1NnIWej2lSfN6r+3 +dy5tYXNzaW1vLWFiYXRlLmV1hwTAqAEBhwTAqEWQMA0GCSqGSIb3DQEBBQUAA4IB +AQAuomKlMLwSkP3zvGuA9awDdITM/uCzfd77yi60zMNtFHDMu2YZ2npQSl0czab6 +/8fX9goaU8V3cx4KXSLMx7i9AsP1r559Uo3c/4oTZd3xBsElMAn/TXiuujZ2RwdL +RcMOJerlThOE0dtNdniJj7lPaan70CELP/CUn8KgeWgztQJj4ghfUwnLn6RnpLfl +YyM/Xq2YbwnQWHXSe3CPTy5RCWalt3SgZf6IDcD6CNq1Q2l14iR78OWnlxGTFmjP +ez3OzxNT2BZz0AiP0WvTbUtvfuxw9G3fHHe5ClsAopIA3tD246jHOAlqAnOEBC/x +IABbWjY/briP9U4R6x+mg2ck -----END CERTIFICATE----- From 4e573497d7f9767fb17af27f2e20d562b3f4bc9c Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Thu, 18 May 2023 11:14:23 +0800 Subject: [PATCH 015/135] Update v1 crt files Signed-off-by: Jerry Yu --- tests/data_files/Makefile | 50 ++++++++++++++++++-- tests/data_files/server1-v1.crt | 34 +++++++------- tests/data_files/server2-v1-chain.crt | 68 +++++++++++++-------------- tests/data_files/server2-v1.crt | 34 +++++++------- tests/data_files/test-ca-v1.crt | 34 +++++++------- 5 files changed, 132 insertions(+), 88 deletions(-) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index a66e28d65c..2d9a4dbe16 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1327,7 +1327,11 @@ test_ca_server1_config_file = test-ca.server1.opensslconf # server1* server1.crt: server1.key server1.req.sha256 $(test_ca_crt) $(test_ca_key_file_rsa) - $(MBEDTLS_CERT_WRITE) request_file=server1.req.sha256 issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) version=1 not_before=20190210144406 not_after=20290210144406 md=SHA1 version=3 output_file=$@ + $(MBEDTLS_CERT_WRITE) request_file=server1.req.sha256 \ + issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) \ + issuer_pwd=$(test_ca_pwd_rsa) version=1 \ + not_before=20190210144406 not_after=20290210144406 \ + md=SHA1 version=3 output_file=$@ server1.noauthid.crt: server1.key server1.req.sha256 $(test_ca_crt) $(test_ca_key_file_rsa) $(MBEDTLS_CERT_WRITE) request_file=server1.req.sha256 issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) not_before=20190210144406 not_after=20290210144406 md=SHA1 authority_identifier=0 version=3 output_file=$@ server1.crt.der: server1.crt @@ -1426,8 +1430,13 @@ server1.v1.der.openssl: server1.v1.crt.openssl crl.pem: $(test_ca_crt) $(test_ca_key_file_rsa) $(test_ca_config_file) $(OPENSSL) ca -gencrl -batch -cert $(test_ca_crt) -keyfile $(test_ca_key_file_rsa) -key $(test_ca_pwd_rsa) -config $(test_ca_server1_config_file) -md sha1 -crldays 3653 -out $@ -crl-futureRevocationDate.pem: $(test_ca_crt) $(test_ca_key_file_rsa) $(test_ca_config_file) test-ca.server1.future-crl.db test-ca.server1.future-crl.opensslconf - $(FAKETIME) '2028-12-31' $(OPENSSL) ca -gencrl -config test-ca.server1.future-crl.opensslconf -crldays 365 -passin "pass:$(test_ca_pwd_rsa)" -out $@ +crl-futureRevocationDate.pem: $(test_ca_crt) $(test_ca_key_file_rsa) \ + $(test_ca_config_file) \ + test-ca.server1.future-crl.db \ + test-ca.server1.future-crl.opensslconf + $(FAKETIME) -f '+10y' $(OPENSSL) ca -gencrl \ + -config test-ca.server1.future-crl.opensslconf -crldays 365 \ + -passin "pass:$(test_ca_pwd_rsa)" -out $@ server1_all: crl.pem crl-futureRevocationDate.pem server1.crt server1.noauthid.crt server1.crt.openssl server1.v1.crt server1.v1.crt.openssl server1.key_usage.crt server1.key_usage_noauthid.crt server1.key_usage.crt.openssl server1.cert_type.crt server1.cert_type_noauthid.crt server1.cert_type.crt.openssl server1.der server1.der.openssl server1.v1.der server1.v1.der.openssl server1.key_usage.der server1.key_usage.der.openssl server1.cert_type.der server1.cert_type.der.openssl @@ -1510,6 +1519,41 @@ cert_md5.crt: cert_md5.csr $(MBEDTLS_CERT_WRITE) request_file=$< serial=6 issuer_crt=$(test_ca_crt) issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) not_before=20000101121212 not_after=20300101121212 md=MD5 version=3 output_file=$@ all_final += cert_md5.crt +# - test-ca-v1.crt: v1 "CA", signs +# server1-v1.crt: v1 "intermediate CA", signs +# server2-v1*.crt: EE cert (without of with chain in same file) + +test-ca-v1.crt: $(test_ca_key_file_rsa) test-ca.req.sha256 + $(MBEDTLS_CERT_WRITE) is_ca=1 serial_hex=53a2b68e05400e555c9395e5 \ + request_file=test-ca.req.sha256 \ + selfsign=1 issuer_name="CN=PolarSSL Test CA v1,OU=testing,O=PolarSSL,C=NL" \ + issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) \ + not_before=20190210144400 not_after=20290210144400 md=SHA256 version=1 \ + output_file=$@ +all_final += test-ca-v1.crt + +server1-v1.crt: server1.key test-ca-v1.crt + $(MBEDTLS_CERT_WRITE) subject_key=$< serial_hex=53a2b6c704cd4d8ebc800bc1\ + subject_name="CN=server1/int-ca-v1,OU=testing,O=PolarSSL,C=NL" \ + issuer_crt=test-ca-v1.crt issuer_key=$(test_ca_key_file_rsa) \ + issuer_pwd=$(test_ca_pwd_rsa) \ + not_before=20190210144406 not_after=20290210144406 \ + md=SHA256 version=1 \ + output_file=$@ +all_final += server1-v1.crt + +server2-v1.crt: server2.key server1-v1.crt + $(MBEDTLS_CERT_WRITE) subject_key=$< serial_hex=53a2b6d9235dbc4573f9b76c\ + subject_name="CN=server2,OU=testing,O=PolarSSL,C=NL" \ + issuer_crt=server1-v1.crt issuer_key=server1.key \ + not_before=20190210144406 not_after=20290210144406 \ + md=SHA256 version=1 \ + output_file=$@ +all_final += server2-v1.crt + +server2-v1-chain.crt: server2-v1.crt server1-v1.crt + cat $^ > $@ + ################################################################ #### Diffie-Hellman parameters ################################################################ diff --git a/tests/data_files/server1-v1.crt b/tests/data_files/server1-v1.crt index 47f1fff1cd..8ca90078b8 100644 --- a/tests/data_files/server1-v1.crt +++ b/tests/data_files/server1-v1.crt @@ -1,19 +1,19 @@ -----BEGIN CERTIFICATE----- -MIIDITCCAgkCDFOitscEzU2OvIALwTANBgkqhkiG9w0BAQsFADBQMRwwGgYDVQQD -ExNQb2xhclNTTCBUZXN0IENBIHYxMRAwDgYDVQQLEwd0ZXN0aW5nMREwDwYDVQQK -EwhQb2xhclNTTDELMAkGA1UEBhMCTkwwIhgPMjAxNDA2MTkxMDA5MTFaGA8yMDI0 -MDYxODEwMDkxMVowTjEaMBgGA1UEAxMRc2VydmVyMS9pbnQtY2EtdjExEDAOBgNV -BAsTB3Rlc3RpbmcxETAPBgNVBAoTCFBvbGFyU1NMMQswCQYDVQQGEwJOTDCCASIw -DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKkCHz1AatVVU4v9Nu6CZS4VYV6J -v7joRZDb7ogWUtPxQ1BHlhJZZIdr/SvgRvlzvt3PkuGRW+1moG+JKXlFgNCDatVB -Q3dfOXwJBEeCsFc5cO2j7BUZHqgzCEfBBUKp/UzDtN/dBh9NEFFAZ3MTD0D4bYEl -XwqxU8YwfhU5rPla7n+SnqYFW+cTl4W1I5LZ1CQG1QkliXUH3aYajz8JGb6tZSxk -65Wb3P5BXhem2mxbacwCuhQsFiScStzN0PdSZ3PxLaAj/X70McotcMqJCwTbLqZP -cG6ezr1YieJTWZ5uWpJl4og/DJQZo93l6J2VE+0p26twEtxaymsXq1KCVLECAwEA -ATANBgkqhkiG9w0BAQsFAAOCAQEAPJl3fbVeTJ6gVAvCoLYM8JY5U7ZhrCCdBghw -WuZBS/TWwf4WLP0G/ZtTyTOENcT0gWHf0/VnXtNPw2/yBjWsLtTXxN2XQlEVf3j/ -WcQxWgSESYdx/sT/uTW6qihuONPWkTQizmx7OG6vBuGx3g54s9/oeJKXOraNqud3 -G4KBrytOazliMfoKO2hnzaeydpaDtb2tZX8apN/6KqQpTAcXsWrZRW9XEHWq2sNz -IR1nIE1F/9gnqi9Xy0HQprteLRUvM4tEQ35m4H20eS5Y9gJlE/DqXmMQ7aiU8DgP -krj+Z18pcrssO+Etv0BOiPjmU9TWWpDMj34ef7U/OH5qJxkSrA== +MIIDHTCCAgUCDFOitscEzU2OvIALwTANBgkqhkiG9w0BAQsFADBQMRwwGgYDVQQD +DBNQb2xhclNTTCBUZXN0IENBIHYxMRAwDgYDVQQLDAd0ZXN0aW5nMREwDwYDVQQK +DAhQb2xhclNTTDELMAkGA1UEBhMCTkwwHhcNMTkwMjEwMTQ0NDA2WhcNMjkwMjEw +MTQ0NDA2WjBOMRowGAYDVQQDDBFzZXJ2ZXIxL2ludC1jYS12MTEQMA4GA1UECwwH +dGVzdGluZzERMA8GA1UECgwIUG9sYXJTU0wxCzAJBgNVBAYTAk5MMIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQIfPUBq1VVTi/027oJlLhVhXom/uOhF +kNvuiBZS0/FDUEeWEllkh2v9K+BG+XO+3c+S4ZFb7Wagb4kpeUWA0INq1UFDd185 +fAkER4KwVzlw7aPsFRkeqDMIR8EFQqn9TMO0390GH00QUUBncxMPQPhtgSVfCrFT +xjB+FTms+Vruf5KepgVb5xOXhbUjktnUJAbVCSWJdQfdphqPPwkZvq1lLGTrlZvc +/kFeF6babFtpzAK6FCwWJJxK3M3Q91Jnc/EtoCP9fvQxyi1wyokLBNsupk9wbp7O +vViJ4lNZnm5akmXiiD8MlBmj3eXonZUT7Snbq3AS3FrKaxerUoJUsQIDAQABMA0G +CSqGSIb3DQEBCwUAA4IBAQBrdYAEzdH6ryyYaolYvp8Fvq0wZxp6Bdcxvi0LUGmb +TdWcNrPU9IYASc5QSrSWPj0c9vhLVbDZAONfn92thi7C2zQXok2Q3jW038ycNSXN +lVxFkdY4GYa3E6Og1LVIySyzfyyNuHKKWbB5wZCWbzOgu2Q1MHSNvPhKjbDhyGtT +Mq3Qy6TyzUFbXMRBixcJC/Cy4zsqvWBanVtBmwlvgE4Q50CUgybzSEIL5j+aPLuW +aj8j2NRB2+7vPeoWd8ry5YxEKB3DRuXHHyyFnT5O8MpWuCl764qFMc8S/i7yVcmZ +egZQw0dCmE5J4EGX0BEQEM24ll2e8SxL351hbCQ+EfvF -----END CERTIFICATE----- diff --git a/tests/data_files/server2-v1-chain.crt b/tests/data_files/server2-v1-chain.crt index 84bb6b2b93..8ac003b301 100644 --- a/tests/data_files/server2-v1-chain.crt +++ b/tests/data_files/server2-v1-chain.crt @@ -1,38 +1,38 @@ -----BEGIN CERTIFICATE----- -MIIDFTCCAf0CDFOittkjXbxFc/m3bDANBgkqhkiG9w0BAQsFADBOMRowGAYDVQQD -ExFzZXJ2ZXIxL2ludC1jYS12MTEQMA4GA1UECxMHdGVzdGluZzERMA8GA1UEChMI -UG9sYXJTU0wxCzAJBgNVBAYTAk5MMCIYDzIwMTQwNjE5MTAwOTI5WhgPMjAyNDA2 -MTgxMDA5MjlaMEQxEDAOBgNVBAMTB3NlcnZlcjIxEDAOBgNVBAsTB3Rlc3Rpbmcx -ETAPBgNVBAoTCFBvbGFyU1NMMQswCQYDVQQGEwJOTDCCASIwDQYJKoZIhvcNAQEB -BQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTNowCI -p+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKzNtSj -+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kMtQCQ -4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8PhYva -i0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjyaHT4P -6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAATANBgkqhkiG9w0B -AQsFAAOCAQEAivCCMBfC5YNeozwp8vAWpiRUakhtO8ysvCfQsZD4tWLlSkrjoUtG -3RNd9gDVDGb852GswtNMKHJC1AeZuXdh3eBoDBNTXnR/9UkHgWNBy5f+JH2irYrc -ps5ofpYJZe7K6xQjl+RLc8nfUUaVfS3dJnyLr9k5kg4in48p+hEF6oXDBu2zdufF -53k/U98FTvFkVisEDFzLXyKX0fAZxfMk4qnEoBflH4fEXfkuuaBUVdoGGIMRLNAW -GIyRxr+zj+OJL+ZjjAkY4JqtEuUuLjODn//DHI/MkqE0LANOvbb4akpgZsyvSSO3 -o38d1wQHw5+bO+YDqdfIdQXguU5mtS1xAw== +MIIDETCCAfkCDFOittkjXbxFc/m3bDANBgkqhkiG9w0BAQsFADBOMRowGAYDVQQD +DBFzZXJ2ZXIxL2ludC1jYS12MTEQMA4GA1UECwwHdGVzdGluZzERMA8GA1UECgwI +UG9sYXJTU0wxCzAJBgNVBAYTAk5MMB4XDTE5MDIxMDE0NDQwNloXDTI5MDIxMDE0 +NDQwNlowRDEQMA4GA1UEAwwHc2VydmVyMjEQMA4GA1UECwwHdGVzdGluZzERMA8G +A1UECgwIUG9sYXJTU0wxCzAJBgNVBAYTAk5MMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEAwU2j3efNHdEE10lyuJmsDnjkOjxKzzoTFtBa5M2jAIin7h5r +lqdStJDvLXJ6PiSa/LY0rCT1d+AmZIycsCh9odrqjObJHJa8/sEEUrM21KP64bF2 +2JDBYbRmUjaiJlOqq3ReB30Zgtsq2B+g2Q0cLUlm91slc0boC4pPaQy1AJDh2oIQ +Zn2uVCuLZXmRoeJhw81ASQjuaAzxi4bSRr/QuKoRAx5/VqgaHkQYDw+Fi9qLRF7i +GMZiL8dmjfpd2H3zJ4kpAcWQDj8n8TDISg7v1t7HxydrxwU9esQCPJodPg/oNJhb +y3NLUpbYEaIsgIhpOVrTD7DeWS8Rx/fqEgEwlwIDAQABMA0GCSqGSIb3DQEBCwUA +A4IBAQBmzdRQV8c0AbT8+IlPf7EpzfdhBwBtDj7N8GPEHL+NqS1hHt7TH3L7jBN3 +CqLUgrAP1LFmQrjW5IPZYNZEA+LxMMjAehvOH71pBsFGvQOpx2CwmqM86s9FIgIa +zob7L34+xVEZfmR09PsLiT7gF13ht0HkvVZ2haBU0k3vV97aEVvPtbqrlR6RfLrZ +8nXBFt5CkzGxepS4wBCW4TrGXxpMJ0WnnhcLJVnExUd6YbzGP+ewXCKegD1wDX6z +UsEVGDQV97u3tszF43kx0nu/Q5DYMCqJV0kpIsMB467xPnNqyMdGtTbZq2Is8oj6 +VA+fctBdN0CW4jo+qkOif0l/F8Az -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIIDITCCAgkCDFOitscEzU2OvIALwTANBgkqhkiG9w0BAQsFADBQMRwwGgYDVQQD -ExNQb2xhclNTTCBUZXN0IENBIHYxMRAwDgYDVQQLEwd0ZXN0aW5nMREwDwYDVQQK -EwhQb2xhclNTTDELMAkGA1UEBhMCTkwwIhgPMjAxNDA2MTkxMDA5MTFaGA8yMDI0 -MDYxODEwMDkxMVowTjEaMBgGA1UEAxMRc2VydmVyMS9pbnQtY2EtdjExEDAOBgNV -BAsTB3Rlc3RpbmcxETAPBgNVBAoTCFBvbGFyU1NMMQswCQYDVQQGEwJOTDCCASIw -DQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKkCHz1AatVVU4v9Nu6CZS4VYV6J -v7joRZDb7ogWUtPxQ1BHlhJZZIdr/SvgRvlzvt3PkuGRW+1moG+JKXlFgNCDatVB -Q3dfOXwJBEeCsFc5cO2j7BUZHqgzCEfBBUKp/UzDtN/dBh9NEFFAZ3MTD0D4bYEl -XwqxU8YwfhU5rPla7n+SnqYFW+cTl4W1I5LZ1CQG1QkliXUH3aYajz8JGb6tZSxk -65Wb3P5BXhem2mxbacwCuhQsFiScStzN0PdSZ3PxLaAj/X70McotcMqJCwTbLqZP -cG6ezr1YieJTWZ5uWpJl4og/DJQZo93l6J2VE+0p26twEtxaymsXq1KCVLECAwEA -ATANBgkqhkiG9w0BAQsFAAOCAQEAPJl3fbVeTJ6gVAvCoLYM8JY5U7ZhrCCdBghw -WuZBS/TWwf4WLP0G/ZtTyTOENcT0gWHf0/VnXtNPw2/yBjWsLtTXxN2XQlEVf3j/ -WcQxWgSESYdx/sT/uTW6qihuONPWkTQizmx7OG6vBuGx3g54s9/oeJKXOraNqud3 -G4KBrytOazliMfoKO2hnzaeydpaDtb2tZX8apN/6KqQpTAcXsWrZRW9XEHWq2sNz -IR1nIE1F/9gnqi9Xy0HQprteLRUvM4tEQ35m4H20eS5Y9gJlE/DqXmMQ7aiU8DgP -krj+Z18pcrssO+Etv0BOiPjmU9TWWpDMj34ef7U/OH5qJxkSrA== +MIIDHTCCAgUCDFOitscEzU2OvIALwTANBgkqhkiG9w0BAQsFADBQMRwwGgYDVQQD +DBNQb2xhclNTTCBUZXN0IENBIHYxMRAwDgYDVQQLDAd0ZXN0aW5nMREwDwYDVQQK +DAhQb2xhclNTTDELMAkGA1UEBhMCTkwwHhcNMTkwMjEwMTQ0NDA2WhcNMjkwMjEw +MTQ0NDA2WjBOMRowGAYDVQQDDBFzZXJ2ZXIxL2ludC1jYS12MTEQMA4GA1UECwwH +dGVzdGluZzERMA8GA1UECgwIUG9sYXJTU0wxCzAJBgNVBAYTAk5MMIIBIjANBgkq +hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqQIfPUBq1VVTi/027oJlLhVhXom/uOhF +kNvuiBZS0/FDUEeWEllkh2v9K+BG+XO+3c+S4ZFb7Wagb4kpeUWA0INq1UFDd185 +fAkER4KwVzlw7aPsFRkeqDMIR8EFQqn9TMO0390GH00QUUBncxMPQPhtgSVfCrFT +xjB+FTms+Vruf5KepgVb5xOXhbUjktnUJAbVCSWJdQfdphqPPwkZvq1lLGTrlZvc +/kFeF6babFtpzAK6FCwWJJxK3M3Q91Jnc/EtoCP9fvQxyi1wyokLBNsupk9wbp7O +vViJ4lNZnm5akmXiiD8MlBmj3eXonZUT7Snbq3AS3FrKaxerUoJUsQIDAQABMA0G +CSqGSIb3DQEBCwUAA4IBAQBrdYAEzdH6ryyYaolYvp8Fvq0wZxp6Bdcxvi0LUGmb +TdWcNrPU9IYASc5QSrSWPj0c9vhLVbDZAONfn92thi7C2zQXok2Q3jW038ycNSXN +lVxFkdY4GYa3E6Og1LVIySyzfyyNuHKKWbB5wZCWbzOgu2Q1MHSNvPhKjbDhyGtT +Mq3Qy6TyzUFbXMRBixcJC/Cy4zsqvWBanVtBmwlvgE4Q50CUgybzSEIL5j+aPLuW +aj8j2NRB2+7vPeoWd8ry5YxEKB3DRuXHHyyFnT5O8MpWuCl764qFMc8S/i7yVcmZ +egZQw0dCmE5J4EGX0BEQEM24ll2e8SxL351hbCQ+EfvF -----END CERTIFICATE----- diff --git a/tests/data_files/server2-v1.crt b/tests/data_files/server2-v1.crt index 7ef7968f59..990cd4b523 100644 --- a/tests/data_files/server2-v1.crt +++ b/tests/data_files/server2-v1.crt @@ -1,19 +1,19 @@ -----BEGIN CERTIFICATE----- -MIIDFTCCAf0CDFOittkjXbxFc/m3bDANBgkqhkiG9w0BAQsFADBOMRowGAYDVQQD -ExFzZXJ2ZXIxL2ludC1jYS12MTEQMA4GA1UECxMHdGVzdGluZzERMA8GA1UEChMI -UG9sYXJTU0wxCzAJBgNVBAYTAk5MMCIYDzIwMTQwNjE5MTAwOTI5WhgPMjAyNDA2 -MTgxMDA5MjlaMEQxEDAOBgNVBAMTB3NlcnZlcjIxEDAOBgNVBAsTB3Rlc3Rpbmcx -ETAPBgNVBAoTCFBvbGFyU1NMMQswCQYDVQQGEwJOTDCCASIwDQYJKoZIhvcNAQEB -BQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTNowCI -p+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKzNtSj -+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kMtQCQ -4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8PhYva -i0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjyaHT4P -6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcCAwEAATANBgkqhkiG9w0B -AQsFAAOCAQEAivCCMBfC5YNeozwp8vAWpiRUakhtO8ysvCfQsZD4tWLlSkrjoUtG -3RNd9gDVDGb852GswtNMKHJC1AeZuXdh3eBoDBNTXnR/9UkHgWNBy5f+JH2irYrc -ps5ofpYJZe7K6xQjl+RLc8nfUUaVfS3dJnyLr9k5kg4in48p+hEF6oXDBu2zdufF -53k/U98FTvFkVisEDFzLXyKX0fAZxfMk4qnEoBflH4fEXfkuuaBUVdoGGIMRLNAW -GIyRxr+zj+OJL+ZjjAkY4JqtEuUuLjODn//DHI/MkqE0LANOvbb4akpgZsyvSSO3 -o38d1wQHw5+bO+YDqdfIdQXguU5mtS1xAw== +MIIDETCCAfkCDFOittkjXbxFc/m3bDANBgkqhkiG9w0BAQsFADBOMRowGAYDVQQD +DBFzZXJ2ZXIxL2ludC1jYS12MTEQMA4GA1UECwwHdGVzdGluZzERMA8GA1UECgwI +UG9sYXJTU0wxCzAJBgNVBAYTAk5MMB4XDTE5MDIxMDE0NDQwNloXDTI5MDIxMDE0 +NDQwNlowRDEQMA4GA1UEAwwHc2VydmVyMjEQMA4GA1UECwwHdGVzdGluZzERMA8G +A1UECgwIUG9sYXJTU0wxCzAJBgNVBAYTAk5MMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEAwU2j3efNHdEE10lyuJmsDnjkOjxKzzoTFtBa5M2jAIin7h5r +lqdStJDvLXJ6PiSa/LY0rCT1d+AmZIycsCh9odrqjObJHJa8/sEEUrM21KP64bF2 +2JDBYbRmUjaiJlOqq3ReB30Zgtsq2B+g2Q0cLUlm91slc0boC4pPaQy1AJDh2oIQ +Zn2uVCuLZXmRoeJhw81ASQjuaAzxi4bSRr/QuKoRAx5/VqgaHkQYDw+Fi9qLRF7i +GMZiL8dmjfpd2H3zJ4kpAcWQDj8n8TDISg7v1t7HxydrxwU9esQCPJodPg/oNJhb +y3NLUpbYEaIsgIhpOVrTD7DeWS8Rx/fqEgEwlwIDAQABMA0GCSqGSIb3DQEBCwUA +A4IBAQBmzdRQV8c0AbT8+IlPf7EpzfdhBwBtDj7N8GPEHL+NqS1hHt7TH3L7jBN3 +CqLUgrAP1LFmQrjW5IPZYNZEA+LxMMjAehvOH71pBsFGvQOpx2CwmqM86s9FIgIa +zob7L34+xVEZfmR09PsLiT7gF13ht0HkvVZ2haBU0k3vV97aEVvPtbqrlR6RfLrZ +8nXBFt5CkzGxepS4wBCW4TrGXxpMJ0WnnhcLJVnExUd6YbzGP+ewXCKegD1wDX6z +UsEVGDQV97u3tszF43kx0nu/Q5DYMCqJV0kpIsMB467xPnNqyMdGtTbZq2Is8oj6 +VA+fctBdN0CW4jo+qkOif0l/F8Az -----END CERTIFICATE----- diff --git a/tests/data_files/test-ca-v1.crt b/tests/data_files/test-ca-v1.crt index e5a3b1cde4..2f10f6d860 100644 --- a/tests/data_files/test-ca-v1.crt +++ b/tests/data_files/test-ca-v1.crt @@ -1,19 +1,19 @@ -----BEGIN CERTIFICATE----- -MIIDIzCCAgsCDFOito4FQA5VXJOV5TANBgkqhkiG9w0BAQsFADBQMRwwGgYDVQQD -ExNQb2xhclNTTCBUZXN0IENBIHYxMRAwDgYDVQQLEwd0ZXN0aW5nMREwDwYDVQQK -EwhQb2xhclNTTDELMAkGA1UEBhMCTkwwIhgPMjAxNDA2MTkxMDA4MTRaGA8yMDI0 -MDYxODEwMDgxNFowUDEcMBoGA1UEAxMTUG9sYXJTU0wgVGVzdCBDQSB2MTEQMA4G -A1UECxMHdGVzdGluZzERMA8GA1UEChMIUG9sYXJTU0wxCzAJBgNVBAYTAk5MMIIB -IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwN83/Be74JadP4beljJ9RKUW -oM0h8ZnU7OrLfBhYCJSl7JvFi98aHpk4mYcee8CNOd84XXB4B9Oe2ZPouXJRxc6j -MFKp8udAcBTLRKJyC8LlQPk+5aYOs/nsSmPAuCkAdJxXO6ilBJBx8b2D2T/WpeI8 -Ko/vJ2DDxp/LuuxgfbfmhDK+T/tYJiIDW9S01fv145YucMDkLr38Lu7iQVXANC59 -JHJpy0exFECDfWf0hvYxq/F5pLK1LhL5hBfwYm8nPhNYsVQNIZpzN6Ewz2+S3Pbp -/KzbLijRfgJLI6AV8jhlZAnqDG6OGxegccizm8mr6cPyz4eWj4ACMp6ZWG+i1QID -AQABMA0GCSqGSIb3DQEBCwUAA4IBAQBoXC5AlXI5azyOPvmNse2qHhO7BrXOEjH+ -9g5P/VsrVADhsUGv6x0A2oLoWXtOjGDIWWH53BWHkCUCu4T5D5C6+I47rXWl4pAr -J+h+tQVZo6J0AJxfPse/NnrjsboUSWhunmo/iTrU6S4KJBguIKP6T1DZoD/8EYgU -x+fXDmvRO+MTesWDiY+p+FHEzsu3b9EBtG9dUiR/zzXi/ktFCfrgstKGSuW6+j7m -lcduTxsogi6Uc3tWKtn6qpSGR0uBoCz6emFO7Smmy/tIyVA88lH0+3UnxOvu4TAK -uvjYkOcZqhprDiMfhxBB7pxbfiviEANTbgSfCtZewSNz2RUJ9ocy +MIIDHzCCAgcCDFOito4FQA5VXJOV5TANBgkqhkiG9w0BAQsFADBQMRwwGgYDVQQD +DBNQb2xhclNTTCBUZXN0IENBIHYxMRAwDgYDVQQLDAd0ZXN0aW5nMREwDwYDVQQK +DAhQb2xhclNTTDELMAkGA1UEBhMCTkwwHhcNMTkwMjEwMTQ0NDAwWhcNMjkwMjEw +MTQ0NDAwWjBQMRwwGgYDVQQDDBNQb2xhclNTTCBUZXN0IENBIHYxMRAwDgYDVQQL +DAd0ZXN0aW5nMREwDwYDVQQKDAhQb2xhclNTTDELMAkGA1UEBhMCTkwwggEiMA0G +CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDA3zf8F7vglp0/ht6WMn1EpRagzSHx +mdTs6st8GFgIlKXsm8WL3xoemTiZhx57wI053zhdcHgH057Zk+i5clHFzqMwUqny +50BwFMtEonILwuVA+T7lpg6z+exKY8C4KQB0nFc7qKUEkHHxvYPZP9al4jwqj+8n +YMPGn8u67GB9t+aEMr5P+1gmIgNb1LTV+/Xjli5wwOQuvfwu7uJBVcA0Ln0kcmnL +R7EUQIN9Z/SG9jGr8XmksrUuEvmEF/Bibyc+E1ixVA0hmnM3oTDPb5Lc9un8rNsu +KNF+AksjoBXyOGVkCeoMbo4bF6BxyLObyavpw/LPh5aPgAIynplYb6LVAgMBAAEw +DQYJKoZIhvcNAQELBQADggEBAAtVAWmbymwKDj9v8m7SVLHF0mw4i3gBFVPJqYRQ +y9CnUD68kUr4qK7wyQIv/gDRYuqZVNnBq4Jwzm+tPEBHpYAF5H/7Mynpb4h+uZ3a +6kaWURXKzx53ZuFHLu1FuRov+SZU3ZtXClTYFKeyDb+fcth/8thR9V59v7ZE7zlb +8zbyL+dqfyxvmxZCUzHbNKVrliiUUFXfW53T+B7Ysxner5mnqM1aPxckhXVHEJ47 +TBoIhpBoJ/HmHCiWz8BeoowSpG7u+QOezIKk8l5Pd2f8MeqwyaqIeAy0lh2nP7pB +UtWET/0bsdiPn8SR9B3hWpKUDRvnHDDZuZiKtrdDEqsD04M= -----END CERTIFICATE----- From 7d7b735514e94c431fe1565e6dda5541b0dc6d4b Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Thu, 18 May 2023 17:32:29 +0800 Subject: [PATCH 016/135] Update server1-nospace.crt Signed-off-by: Jerry Yu --- tests/data_files/Makefile | 10 ++++++++++ tests/data_files/server1-nospace.crt | 25 ++++++++++++------------- 2 files changed, 22 insertions(+), 13 deletions(-) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 2d9a4dbe16..ccb3bfcbbb 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1372,6 +1372,16 @@ server1.ca.der: server1.ca.crt $(OPENSSL) x509 -inform PEM -in $< -outform DER -out $@ all_final += server1.ca.crt server1.ca_noauthid.crt server1.ca.der +server1-nospace.crt: server1.key test-ca.crt + $(MBEDTLS_CERT_WRITE) subject_key=$< serial=31\ + subject_name="C=NL,O=PolarSSL,CN=polarssl.example" \ + issuer_crt=test-ca.crt issuer_key=$(test_ca_key_file_rsa) \ + issuer_pwd=$(test_ca_pwd_rsa) \ + not_before=20190210144406 not_after=20290210144406 \ + md=SHA256 version=3 authority_identifier=1 \ + output_file=$@ +all_final += server1-nospace.crt + server1_ca.crt: server1.crt $(test_ca_crt) cat server1.crt $(test_ca_crt) > $@ all_final += server1_ca.crt diff --git a/tests/data_files/server1-nospace.crt b/tests/data_files/server1-nospace.crt index 932c236a5d..4c3cb90191 100644 --- a/tests/data_files/server1-nospace.crt +++ b/tests/data_files/server1-nospace.crt @@ -1,21 +1,20 @@ -----BEGIN CERTIFICATE----- -MIIDhDCCAmygAwIBAgIBHzANBgkqhkiG9w0BAQsFADA7MQswCQYDVQQGEwJOTDER -MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN -MTQwMzI2MDkyMzEyWhcNMjQwMzIzMDkyMzEyWjA7MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEHBvbGFyc3NsLmV4YW1wbGUwggEiMA0G +MIIDPjCCAiagAwIBAgIBHzANBgkqhkiG9w0BAQsFADA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN +MTkwMjEwMTQ0NDA2WhcNMjkwMjEwMTQ0NDA2WjA7MQswCQYDVQQGEwJOTDERMA8G +A1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEHBvbGFyc3NsLmV4YW1wbGUwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpAh89QGrVVVOL/TbugmUuFWFeib+4 6EWQ2+6IFlLT8UNQR5YSWWSHa/0r4Eb5c77dz5LhkVvtZqBviSl5RYDQg2rVQUN3 Xzl8CQRHgrBXOXDto+wVGR6oMwhHwQVCqf1Mw7Tf3QYfTRBRQGdzEw9A+G2BJV8K sVPGMH4VOaz5Wu5/kp6mBVvnE5eFtSOS2dQkBtUJJYl1B92mGo8/CRm+rWUsZOuV m9z+QV4XptpsW2nMAroULBYknErczdD3Umdz8S2gI/1+9DHKLXDKiQsE2y6mT3Bu ns69WIniU1meblqSZeKIPwyUGaPd5eidlRPtKdurcBLcWsprF6tSglSxAgMBAAGj -gZIwgY8wCQYDVR0TBAIwADAdBgNVHQ4EFgQUH3TWPynBdHRFOwUSLD2ovUNZAqYw -YwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNVBAYT -Ak5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wgVGVzdCBD -QYIBADANBgkqhkiG9w0BAQsFAAOCAQEAXs4vQqlIlxrMbE6IwAHLcGJuz17Ru/en -H9bUnnSh1pxa+NHMKZHBG3GT0iaxsVtXf56/tXH4+HL7ntJjrczGN1PbhMGPyt94 -556ZgDxkHT9k7KjPAIs9BrjFHvl9NyIZzcbwkiC0qGvdzjSfe3AiSYuhXI/9/Hog -uUwReH+T2U/ICEHQ5O8aV5nvpgqL3EeEmyx3bu+YXtZMWQUYzX+ya4TnKVPdqwbf -ebr6v1hLXrUFl6rZ3wEJ6MqUW3SGZRkCVNZUOD6Ky3+EiLwYFhuKGdFqSS0JAAD7 -ZO3yPu5hu3BhAQYavK4Yyfi9IQmubBqxopPwyzjG1HPw2lj+oapH0w== +TTBLMAkGA1UdEwQCMAAwHQYDVR0OBBYEFB901j8pwXR0RTsFEiw9qL1DWQKmMB8G +A1UdIwQYMBaAFLRa5KWz3tJS9rnVppUP6z68x/3/MA0GCSqGSIb3DQEBCwUAA4IB +AQC8fX3ZiHu6GoYBB5Vo1l6CXXDhHB6r43Pp+BHoOCouiiy4useiPLu5S84gmNoC +v8ZR+b9lAaysCMHAbth9vgtW+aXckBY6xKo8CsmGXcqZqujD6qrDif5q6UpXa4Oe +fr6ITkecY4Z9oN/aN5el5zzUd5zkoyQDI5Bn1gMdvV7AwM7Haq+5gTFwM7HJnphz +GZ8GLxWU1dWeAfsGm58ey6J28OjIkmfP3yL/kBKMhiQZydbH9Y8Yal7YwhayXxES +i7YwhNmPcGAgDBm5Sno7BvHiIqsNX1sssC3aZUaZvldJGY+4Y9fFZHenBwTREj/S +CnEgazC2RJ3kYg3mP/QhE0US -----END CERTIFICATE----- From 4ac61a92ccfa45f0703fa8f18d4707befe0b9491 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Wed, 17 May 2023 15:02:08 +0800 Subject: [PATCH 017/135] Add rules to generate server9*.crt Except for server9-bad-saltlen.crt and server9-bad-mgfhash.crt. Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 41 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index ccb3bfcbbb..db228b8043 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -469,6 +469,46 @@ test-int-ca3-badsign.crt: test-int-ca3.crt { head -n-2 $<; tail -n-2 $< | sed -e '1s/0\(=*\)$$/_\1/' -e '1s/[^_=]\(=*\)$$/0\1/' -e '1s/_/1/'; } > $@ all_final += test-int-ca3-badsign.crt +# server9* + +server9.csr: server9.key + $(OPENSSL) req -new -subj "/C=NL/O=PolarSSL/CN=localhost" \ + -key $< -out $@ +server9.crt: server9-sha1.crt + cp $< $@ +all_final += server9.crt +all_intermediate += server9.csr server9-sha1.crt + +server9-%.crt: server9.csr $(test_ca_crt) $(test_ca_key_file_rsa) + $(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -extensions cli-rsa \ + -passin "pass:$(test_ca_pwd_rsa)" -CA $(test_ca_crt) -CAkey $(test_ca_key_file_rsa) \ + -set_serial $(SERVER9_CRT_SERIAL) -days 3653 \ + -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:max \ + -sigopt rsa_mgf1_md:$(@:server9-%.crt=%) -$(@:server9-%.crt=%) \ + -in $< -out $@ +server9-sha1.crt: SERVER9_CRT_SERIAL=22 +server9-sha224.crt: SERVER9_CRT_SERIAL=23 +server9-sha256.crt: SERVER9_CRT_SERIAL=24 +server9-sha384.crt: SERVER9_CRT_SERIAL=25 +server9-sha512.crt: SERVER9_CRT_SERIAL=26 +all_final += server9-sha224.crt server9-sha256.crt server9-sha384.crt server9-sha512.crt + +server9-defaults.crt: server9.csr $(test_ca_crt) $(test_ca_key_file_rsa) + $(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -extensions cli-rsa \ + -passin "pass:$(test_ca_pwd_rsa)" -CA $(test_ca_crt) -CAkey $(test_ca_key_file_rsa) \ + -set_serial 72 -days 3653 \ + -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:max -sha1 \ + -in $< -o $@ +all_final += server9-defaults.crt + +server9-badsign.crt: server9.crt + { head -n-2 $<; tail -n-2 $< | sed -e '1s/0\(=*\)$$/_\1/' -e '1s/[^_=]\(=*\)$$/0\1/' -e '1s/_/1/'; } > $@ +all_final += server9-badsign.crt + +server9-with-ca.crt: server9.crt $(test_ca_crt) + cat $^ > $@ +all_final += server9-with-ca.crt + # server10* server10.crt: server10.key test-int-ca3.crt test-int-ca3.key @@ -1308,6 +1348,7 @@ server6-ss-child.crt: server6-ss-child.csr server5-selfsigned.crt server5.key se -days 3650 -sha256 -in $< -out $@ all_final += server6-ss-child.crt + ################################################################ ### Generate certificates for CRT write check tests ################################################################ From 3ed1653df434124ec595bb0bf51211a73b2d03bc Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Mon, 29 May 2023 14:49:17 +0800 Subject: [PATCH 018/135] Add server9-bad-{mgfhash,saltlen}.crt Signed-off-by: Jerry Yu Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index db228b8043..f43b86b7ed 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -509,6 +509,25 @@ server9-with-ca.crt: server9.crt $(test_ca_crt) cat $^ > $@ all_final += server9-with-ca.crt +# FIXME: this file expected a bad-saltlen, but it create a good saltlen. +server9-bad-saltlen.crt: server9.csr $(test_ca_crt) $(test_ca_key_file_rsa) + $(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -extensions cli-rsa \ + -passin "pass:$(test_ca_pwd_rsa)" -CA $(test_ca_crt) -CAkey $(test_ca_key_file_rsa) \ + -set_serial 24 -days 3653 \ + -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:max \ + -sigopt rsa_mgf1_md:sha256 -sha256 \ + -in $< -out $@ +all_final += server9-bad-saltlen.crt + +server9-bad-mgfhash.crt: server9.csr $(test_ca_crt) $(test_ca_key_file_rsa) + $(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -extensions cli-rsa \ + -passin "pass:$(test_ca_pwd_rsa)" -CA $(test_ca_crt) -CAkey $(test_ca_key_file_rsa) \ + -set_serial 24 -days 3653 \ + -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:max \ + -sigopt rsa_mgf1_md:sha224 -sha256 \ + -in $< -out $@ +all_final += server9-bad-mgfhash.crt + # server10* server10.crt: server10.key test-int-ca3.crt test-int-ca3.key From 33536d170ef9305c43613a58517eda18476da493 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Mon, 29 May 2023 15:15:02 +0800 Subject: [PATCH 019/135] Update server9*.crt Signed-off-by: Pengyu Lv --- tests/data_files/server9-bad-mgfhash.crt | 37 ++++---- tests/data_files/server9-bad-saltlen.crt | 37 ++++---- tests/data_files/server9-badsign.crt | 26 +++--- tests/data_files/server9-defaults.crt | 27 +++--- tests/data_files/server9-sha224.crt | 37 ++++---- tests/data_files/server9-sha256.crt | 37 ++++---- tests/data_files/server9-sha384.crt | 37 ++++---- tests/data_files/server9-sha512.crt | 37 ++++---- tests/data_files/server9-with-ca.crt | 110 ++++++----------------- tests/data_files/server9.crt | 26 +++--- 10 files changed, 178 insertions(+), 233 deletions(-) diff --git a/tests/data_files/server9-bad-mgfhash.crt b/tests/data_files/server9-bad-mgfhash.crt index 34ef69e031..ad299423b0 100644 --- a/tests/data_files/server9-bad-mgfhash.crt +++ b/tests/data_files/server9-bad-mgfhash.crt @@ -1,20 +1,21 @@ -----BEGIN CERTIFICATE----- -MIIDWzCCAhKgAwIBAgIBGDA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAaEa -MBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgSiBAICAN4wOzELMAkGA1UEBhMCTkwx -ETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBMB4X -DTE0MDEyMDEzNTc0NVoXDTI0MDExODEzNTc0NVowNDELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRIwEAYDVQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcN -AQEBBQADgY0AMIGJAoGBAN0Rip+ZurBoyirqO2ptWZftTslU5A3uzqB9oB6q6A7C -uxNA24oSjokTJKXF9frY9ZDXyMrLxf6THa/aEiNzUnlGGrqgVyt2FjGzqK/nOJsI -i2OZOgol7kXSGFi6uZMa7dRYmmMbN/z3FAifhWVJ81kybdHg6G3eUu1mtKkL2kCV -AgMBAAGjgZIwgY8wCQYDVR0TBAIwADAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy -36fOvVEwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJ -BgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wg -VGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAaEaMBgGCSqG -SIb3DQEBCDALBglghkgBZQMEAgSiBAICAN4DggEBAIfliohNjz4CLGbHWgWRBFQ3 -Difn027ZnULTvokT67ii1sJzESzqaIakyyu8GRwfoFRNh/rbGfe4C6e9SkwKbnDg -WE9SWbK6ukIQbMy69C+CVqFlRUHbONw/dmcneAWyZYGx/2Sf4D5kkpIWNDBeKuaV -H69XPZCeN3QAACmdAfo4NYW0I69a1OSaUrTyGT1nBOrzQ8Y0aJBnCJAte49bhQEW -KJv0kMj+8ZG1X0RoSdklf3GqdLUbsfJ2txu14GGAxy4C1gl2JWzoBHN5LMLf0cZ9 -uEYui7N/5bkSv8KXdbGvSzgn6zZ0MiCJMiiGEf0L1FxBiBCVsK4C2idpiZH+e28= +MIIDYzCCAhagAwIBAgIBGDBCBgkqhkiG9w0BAQowNaAPMA0GCWCGSAFlAwQCAQUA +oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCBAUAogQCAgDeMDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QTAeFw0yMzA1MTcwODM5NDhaFw0zMzA1MTcwODM5NDhaMDQxCzAJBgNVBAYTAk5M +MREwDwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQDdEYqfmbqwaMoq6jtqbVmX7U7JVOQN7s6gfaAe +qugOwrsTQNuKEo6JEySlxfX62PWQ18jKy8X+kx2v2hIjc1J5Rhq6oFcrdhYxs6iv +5zibCItjmToKJe5F0hhYurmTGu3UWJpjGzf89xQIn4VlSfNZMm3R4Oht3lLtZrSp +C9pAlQIDAQABo4GSMIGPMB0GA1UdDgQWBBTu88f1HxWlTUeJwdMiY7Lfp869UTBj +BgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMC +TkwxETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENB +ggEDMAkGA1UdEwQCMAAwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgEFAKEc +MBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgQFAKIEAgIA3gOCAQEAaQlf1GPhvPHp +hFgTdIB5x5zACVb4a4ONuySVckfMpWk2nlkRSu3Kgv4j8l/jfNpfr+we4lG72xEn +FV3em8dEzxvXd5jXCfR/hWJKYVoWh0055qWw7FpG20vRFKttU8UFclL7KvMs4InZ +vDpbPs5EwBQXTg/manL9TD9t/zqWAUJj1yHWiIISYzfWmsaoTi8jNxSR1+lkmPPP +ZWQwyUJrh82Mw3VwNGxXOfpGIwmjXPia8MafjjH/RtHNx7ukCk+6q1ZlH57NolZJ +dlQTJv21+vxyYr6GZdHXzdJwWMnFSof6VGwayNzetSnVhJb0SQqTBt8Vu5xQtXGa +QcCjGyCAIg== -----END CERTIFICATE----- diff --git a/tests/data_files/server9-bad-saltlen.crt b/tests/data_files/server9-bad-saltlen.crt index f4da8832ff..78298e98b9 100644 --- a/tests/data_files/server9-bad-saltlen.crt +++ b/tests/data_files/server9-bad-saltlen.crt @@ -1,20 +1,21 @@ -----BEGIN CERTIFICATE----- -MIIDWzCCAhKgAwIBAgIBGDA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAaEa -MBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgGiBAICAN4wOzELMAkGA1UEBhMCTkwx -ETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBMB4X -DTE0MDEyMDEzNTc0NVoXDTI0MDExODEzNTc0NVowNDELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRIwEAYDVQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcN -AQEBBQADgY0AMIGJAoGBAN0Rip+ZurBoyirqO2ptWZftTslU5A3uzqB9oB6q6A7C -uxNA24oSjokTJKXF9frY9ZDXyMrLxf6THa/aEiNzUnlGGrqgVyt2FjGzqK/nOJsI -i2OZOgol7kXSGFi6uZMa7dRYmmMbN/z3FAifhWVJ81kybdHg6G3eUu1mtKkL2kCV -AgMBAAGjgZIwgY8wCQYDVR0TBAIwADAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy -36fOvVEwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJ -BgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wg -VGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAaEaMBgGCSqG -SIb3DQEBCDALBglghkgBZQMEAgGiBAICAN4DggEBAE7T54cyUf0ByNr34JaojFam -hV0T9QSc4wJ17sX67rxYIorXU8MynaneJzFxD9utOD3dq2TON18VswhT2McDgefl -XMwivCC0nWod8Pk638QaHxbaqC7XSq0QRBfOMXwV7knLNxI8smc9UJaco39VEcGD -yCkq4By/VCWTpvJ+1hx4zZ8WoXpFJFM5m5y9oEz4lgNv/6Wu7ILztyOk2yJiSR8r -YooC4zVeUOZuDO6At/NXZuSvmKmr+tfFrFA1AA/7yR5odQbqFVNSJ+u0x1Jv8Ra6 -JXA4cXsnaDaRe+Wm0L0p+2PtQWXE5npXYIbFHAA9EOC3Ab8oaP9M/F6yQMa/2is= +MIIDYzCCAhagAwIBAgIBGDBCBgkqhkiG9w0BAQowNaAPMA0GCWCGSAFlAwQCAQUA +oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogQCAgDeMDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QTAeFw0yMzA1MTcwODMzNDJaFw0zMzA1MTcwODMzNDJaMDQxCzAJBgNVBAYTAk5M +MREwDwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQDdEYqfmbqwaMoq6jtqbVmX7U7JVOQN7s6gfaAe +qugOwrsTQNuKEo6JEySlxfX62PWQ18jKy8X+kx2v2hIjc1J5Rhq6oFcrdhYxs6iv +5zibCItjmToKJe5F0hhYurmTGu3UWJpjGzf89xQIn4VlSfNZMm3R4Oht3lLtZrSp +C9pAlQIDAQABo4GSMIGPMB0GA1UdDgQWBBTu88f1HxWlTUeJwdMiY7Lfp869UTBj +BgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMC +TkwxETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENB +ggEDMAkGA1UdEwQCMAAwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgEFAKEc +MBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIEAgIA3gOCAQEALIe0VtQaT92x +fNkzIdRHkv+3C6P4URzFP9cBMm+ulX86ld/Szl4J2eUywtzQz22UZE5ZT23xutCx +pUC3AZyzRNiDAdsPvofvf88MJtxDROe7v/MgmXqKxx2t+/N62Mf2mzd9Wu9ibBcO +DrawRQtlUgUkwlzdTtWUxu/VYMEhdeXMPHRSzX0ODAQOA9EydR/BvPmuvMYIvb8M +L1ifzupTm+W92v6kB1AmEXjtvcPEba6rvfZylKISJPmRH3wTdt1+s/1j/PjdUfIa +WbjiucXRSk3NBsza+w5cS4CQu3dbZaY2lBhBkoWvxZm+XU4mfxmjCW6jl59NAmMD +X7c2Uua8SA== -----END CERTIFICATE----- diff --git a/tests/data_files/server9-badsign.crt b/tests/data_files/server9-badsign.crt index 9e565419ee..8656b1a47a 100644 --- a/tests/data_files/server9-badsign.crt +++ b/tests/data_files/server9-badsign.crt @@ -1,19 +1,19 @@ -----BEGIN CERTIFICATE----- MIIDBTCCAeegAwIBAgIBFjATBgkqhkiG9w0BAQowBqIEAgIA6jA7MQswCQYDVQQG -EwJOTDERMA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3Qg -Q0EwHhcNMTQwMTIwMTMzODE2WhcNMjQwMTE4MTMzODE2WjA0MQswCQYDVQQGEwJO -TDERMA8GA1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCBnzANBgkq +EwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3Qg +Q0EwHhcNMjMwNTE3MDgwNDAwWhcNMzMwNTE3MDgwNDAwWjA0MQswCQYDVQQGEwJO +TDERMA8GA1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCBnzANBgkq hkiG9w0BAQEFAAOBjQAwgYkCgYEA3RGKn5m6sGjKKuo7am1Zl+1OyVTkDe7OoH2g HqroDsK7E0DbihKOiRMkpcX1+tj1kNfIysvF/pMdr9oSI3NSeUYauqBXK3YWMbOo r+c4mwiLY5k6CiXuRdIYWLq5kxrt1FiaYxs3/PcUCJ+FZUnzWTJt0eDobd5S7Wa0 -qQvaQJUCAwEAAaOBkjCBjzAJBgNVHRMEAjAAMB0GA1UdDgQWBBTu88f1HxWlTUeJ -wdMiY7Lfp869UTBjBgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0w -OzELMAkGA1UEBhMCTkwxETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xh -clNTTCBUZXN0IENBggEAMBMGCSqGSIb3DQEBCjAGogQCAgDqA4IBAQDAog/jXydR -vDIugTzBXtfVK0CEX8iyQ4cVzQmXWSne8204v943K5D2hktSBkjdQUdcnVvVgLR6 -te50jV89ptN/NofX+fo9fhSRN9vGgQVWzOOFiO0zcThy749pirJu1Kq5OJdthIyW -Pu0UCz5G0k3kTp0JPevGlsNc8S9Ak1tFuB0IPJjrbfODWHS2LDuO+dB6gpkNTdrj -88ogYtBsN4D5gsXBRUfobXokUwejBwLrD6XwyQx+0bMwSCxgHEhxvuUkx1vdlXGw -JG3aF92u8mIxoKSAPaPdqy930mQvmpUWcN5Y1IMbtEGoQCKMYgosFcazJpJcjnX1 -o4Hl/lqjwCFG +qQvaQJUCAwEAAaOBkjCBjzAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy36fOvVEw +YwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QYIBAzAJBgNVHRMEAjAAMBMGCSqGSIb3DQEBCjAGogQCAgDqA4IBAQC2DLHQ05x6 +imJNztE/Tnk/lPQ01Pw6Girdbk4bgxcGwGj+1u5wAIHNpJ50TOggg3HxTyb7p344 +/tVMxz7nrHZQ5ASdn2kDCyCmEqhmj48isWAIml+7J9cBeImJoEfYqjtqtoVkGxFy +SuoZAQWkkqDpyFhKhIjLQ8JuSE6wWMX/kc6TFSSxepnZU1SFOXfCiaVr5tFQzBP7 +loppIANLjKeMjpOdU86PmRQ2LyzaCH1OMnjVndeqNmZt0NyzZ18cFPvm6+DVVVuP +Q+6nReShCdAlU+dJqsqj8JsQneNMTxjv4OBoXVmE/kZTj/DBTtwmxkVi7K4aYMFi +UYUZ4RiwG1/0 -----END CERTIFICATE----- diff --git a/tests/data_files/server9-defaults.crt b/tests/data_files/server9-defaults.crt index 4ce5c87326..8613f5237f 100644 --- a/tests/data_files/server9-defaults.crt +++ b/tests/data_files/server9-defaults.crt @@ -1,19 +1,18 @@ -----BEGIN CERTIFICATE----- -MIIDBjCCAe6gAwIBAgIBSDANBgkqhkiG9w0BAQowADA7MQswCQYDVQQGEwJOTDER -MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN -MTQwNjA1MTU1NjUzWhcNMjQwNjAyMTU1NjUzWjA0MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCBnzANBgkqhkiG9w0B +MIIC+TCCAeGgAwIBAgIBSDANBgkqhkiG9w0BAQowADA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN +MjMwNTE3MDcxMDM3WhcNMzMwNTE3MDcxMDM3WjA0MQswCQYDVQQGEwJOTDERMA8G +A1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCBnzANBgkqhkiG9w0B AQEFAAOBjQAwgYkCgYEA3RGKn5m6sGjKKuo7am1Zl+1OyVTkDe7OoH2gHqroDsK7 E0DbihKOiRMkpcX1+tj1kNfIysvF/pMdr9oSI3NSeUYauqBXK3YWMbOor+c4mwiL Y5k6CiXuRdIYWLq5kxrt1FiaYxs3/PcUCJ+FZUnzWTJt0eDobd5S7Wa0qQvaQJUC -AwEAAaOBnzCBnDAJBgNVHRMEAjAAMB0GA1UdDgQWBBTu88f1HxWlTUeJwdMiY7Lf -p869UTBjBgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkG -A1UEBhMCTkwxETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBU -ZXN0IENBggEAMAsGA1UdDwQEAwIFoDANBgkqhkiG9w0BAQowAAOCAQEAGUdim4uy -/rBDFMF8qhjH1qsv0o8ON4HgP3YXbdKdIMfd+p5KtoqHQnrkixWxaIvfORnR4mGm -f8H5BimwIkNLxy7zS88TVDOYel8g7B2yl0nq4biki83NStNBYZJjxKT0ud5O5mGd -jHdy9vTEc7h8q+SHzRdgpNFXyKY5OQYng1LHco8h1UR8/nmPMuDtocHMnmMXu68a -69+TtZxx90/V4gJZOoL1iCi8HEsKoJzm/L8ji54OYt7FxgFfE3VmLsXeMaWYO8GS -BUxh5kqZ25O8hQXK5ywfuVK83Do/SsoClbgx9mboybseGVFIJaxs9e66GFDMoI3B -09JqWv4DoLNnwg== +AwEAAaOBkjCBjzAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy36fOvVEwYwYDVR0j +BFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBDQYIBAzAJ +BgNVHRMEAjAAMA0GCSqGSIb3DQEBCjAAA4IBAQASsc5y7sDP4prOLGAl2EB5d+Gg +w/Vk9+g3KXpeIUCL6gmECNLENmmBe6zZR8/Ax6R1hUe/Cbflepxsx627Eg29NCZK +Bo/AQoz658kwEzr4jhF8M6y9sdsf5/OauoRxDLcMEywIkgmuFvZIpyEwXix6arsK +mNWnW0FwSr2NaXozD7OquGwTEAvAbtei+5JAeVvvGi1u32D2JPVHk3zv05LXtx8b +8bEmzZLthFk3GbSkGHC3K5rjNgTMwY0BhNBW6qFyY5mL0bHVDbZQxD9RRwDifGty +fTo7odJDAHU1xucWF6dOU5nAqiFKlc3eITdBKt+d10yBSr7qXciHkHpAzCvh -----END CERTIFICATE----- diff --git a/tests/data_files/server9-sha224.crt b/tests/data_files/server9-sha224.crt index 1b05f313a4..ed648c8c0e 100644 --- a/tests/data_files/server9-sha224.crt +++ b/tests/data_files/server9-sha224.crt @@ -1,20 +1,21 @@ -----BEGIN CERTIFICATE----- -MIIDWzCCAhKgAwIBAgIBFzA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCBKEa -MBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgSiBAICAOIwOzELMAkGA1UEBhMCTkwx -ETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBMB4X -DTE0MDEyMDEzNTczNloXDTI0MDExODEzNTczNlowNDELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRIwEAYDVQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcN -AQEBBQADgY0AMIGJAoGBAN0Rip+ZurBoyirqO2ptWZftTslU5A3uzqB9oB6q6A7C -uxNA24oSjokTJKXF9frY9ZDXyMrLxf6THa/aEiNzUnlGGrqgVyt2FjGzqK/nOJsI -i2OZOgol7kXSGFi6uZMa7dRYmmMbN/z3FAifhWVJ81kybdHg6G3eUu1mtKkL2kCV -AgMBAAGjgZIwgY8wCQYDVR0TBAIwADAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy -36fOvVEwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJ -BgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wg -VGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCBKEaMBgGCSqG -SIb3DQEBCDALBglghkgBZQMEAgSiBAICAOIDggEBADJExjfWWvL28lgj+GGgviqo -PHZLxI0pLQUnFJQ9Kpu6jxfICseBF00Z6BJE/RcYDpIie5GDt/8u/i6xB6Li29Pm -g5nANgd/Y3fFnW7d0ydVjiSnetlPuf/jTlWQl6mQTH2xqYu8J8d3JRxQdRiDYbVm -uywW2d6rksiqm6dPD5l4A5DcemcYo8f/1Ifj5WNDCV8/OHex+AnW2ccDvWAnVgSR -B2VpOXJzVFuBsuf4tGVm/2TUMSB6NcvFc6TeJk1kzbZxii4QjKXtH1SfrVP59iEe -l17NYAEWARjBpQWBiutRG+QM2et0sNiUBuWxTkvd0eSgencNysVAOsZqrqaX3CY= +MIIDYzCCAhagAwIBAgIBFzBCBgkqhkiG9w0BAQowNaAPMA0GCWCGSAFlAwQCBAUA +oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCBAUAogQCAgDiMDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QTAeFw0yMzA1MTcwNzEwMzdaFw0zMzA1MTQwNzEwMzdaMDQxCzAJBgNVBAYTAk5M +MREwDwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQDdEYqfmbqwaMoq6jtqbVmX7U7JVOQN7s6gfaAe +qugOwrsTQNuKEo6JEySlxfX62PWQ18jKy8X+kx2v2hIjc1J5Rhq6oFcrdhYxs6iv +5zibCItjmToKJe5F0hhYurmTGu3UWJpjGzf89xQIn4VlSfNZMm3R4Oht3lLtZrSp +C9pAlQIDAQABo4GSMIGPMAkGA1UdEwQCMAAwHQYDVR0OBBYEFO7zx/UfFaVNR4nB +0yJjst+nzr1RMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnVppUP6z68x/3/oT+kPTA7 +MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFy +U1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgQFAKEc +MBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgQFAKIEAgIA4gOCAQEAjG73ZOe2pQn6 +jqiTHALGM0IG8BBCamo3gzbCjZPz3ZnTpZii1pQSFPGEBaKCgrtKrjvoP21ZDUnq +3HjTUzGtGbHk3h+UJcVYgFuONidguUDaALGtXIPWUlqBBeJL+Y+01zJRnMpC2hV7 +JUOM3es02te8RM6srCdW1fP9x+Lx4G2Kjj7kEzKafEbwFesS4LbBXsWkID8xDPHO +DLKvg66tPeksDBT4n7f7H51eNlyIwwMDKTc+N9Ri5OeW1HOqtbyo/yJlHvQqnCld +E8gW+AVoeZmN6n/4yemnCEkFRqgbRSIGVoPmOY9d/FfGLmClcaZFPcH+w1JDhF71 +3egYnUY/9g== -----END CERTIFICATE----- diff --git a/tests/data_files/server9-sha256.crt b/tests/data_files/server9-sha256.crt index 7d0aa39567..ef37b3f6a9 100644 --- a/tests/data_files/server9-sha256.crt +++ b/tests/data_files/server9-sha256.crt @@ -1,20 +1,21 @@ -----BEGIN CERTIFICATE----- -MIIDWzCCAhKgAwIBAgIBGDA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAaEa -MBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgGiBAICAN4wOzELMAkGA1UEBhMCTkwx -ETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBMB4X -DTE0MDEyMDEzNTc0NVoXDTI0MDExODEzNTc0NVowNDELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRIwEAYDVQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcN -AQEBBQADgY0AMIGJAoGBAN0Rip+ZurBoyirqO2ptWZftTslU5A3uzqB9oB6q6A7C -uxNA24oSjokTJKXF9frY9ZDXyMrLxf6THa/aEiNzUnlGGrqgVyt2FjGzqK/nOJsI -i2OZOgol7kXSGFi6uZMa7dRYmmMbN/z3FAifhWVJ81kybdHg6G3eUu1mtKkL2kCV -AgMBAAGjgZIwgY8wCQYDVR0TBAIwADAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy -36fOvVEwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJ -BgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wg -VGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAaEaMBgGCSqG -SIb3DQEBCDALBglghkgBZQMEAgGiBAICAN4DggEBAH0+knqkcLaxeDkenBQgd4Qg -3ZyAhtpiLU689mw+3cXB/uzFrCIxEL5aGh1eSj+DszB+FtsZ06ux7JVQqVOA2Wm9 -yLxC6wF8OOYj0nBa91BWLhRAHLhmIdWsVk7Hl9KojZd4TwV2N+ZEV/BLxyoRvK4H -V4xCpzgDSiTPe8Etk4r+0akbr6bsOUBayPb7MGLHubZKq8NsFAmmynp+fPmHd3SE -0ooJdiZ1MmKPKLE5Og/hXCI8qeiXQUR6oQ7b2XONsrI2HIj2SA9dA5qmHwE5PbMu -zqxQ3R83boqLXbkFORn+UiYLmffqdoWuNy00BHMCrxRA9DUv+WyN4npLMF8rOJw= +MIIDYzCCAhagAwIBAgIBFzBCBgkqhkiG9w0BAQowNaAPMA0GCWCGSAFlAwQCAQUA +oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogQCAgDeMDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QTAeFw0yMzA1MTcwNzEwMzdaFw0zMzA1MTQwNzEwMzdaMDQxCzAJBgNVBAYTAk5M +MREwDwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQDdEYqfmbqwaMoq6jtqbVmX7U7JVOQN7s6gfaAe +qugOwrsTQNuKEo6JEySlxfX62PWQ18jKy8X+kx2v2hIjc1J5Rhq6oFcrdhYxs6iv +5zibCItjmToKJe5F0hhYurmTGu3UWJpjGzf89xQIn4VlSfNZMm3R4Oht3lLtZrSp +C9pAlQIDAQABo4GSMIGPMAkGA1UdEwQCMAAwHQYDVR0OBBYEFO7zx/UfFaVNR4nB +0yJjst+nzr1RMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnVppUP6z68x/3/oT+kPTA7 +MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFy +U1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgEFAKEc +MBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIEAgIA3gOCAQEAXcWlfbIjRJX3 +eCkj03eKLvhawFndN6mWMOTVvr20Vdhhn57wngSKYgtsbOZhpT+pIXTTpxhku7uS +Pg6NDU0W13xbrcIsYxkZRcN6AYcnV0NxnhdfkmxwDjLyohgm8IdgvHb04r73OP0j +KmnZfJJpnxkVGD8NFGj2hBCR7ynbVBAfJegl0Lruxc4AlrniG6MW9xfkmE3EfOQg +dwZv3UuhxzEhLmR933BCijwfhBVfyzarGjDtZjQYNwWKhRl+OXM+L14Ofq7htSxz +kSM5KJfCAzLFNd6N2YU84IhqwTS4CZ/bE1HchEYPtXm97bj8Vldrfv2up/4Rc0kF +a8P+xLLmug== -----END CERTIFICATE----- diff --git a/tests/data_files/server9-sha384.crt b/tests/data_files/server9-sha384.crt index aaa63e6ed2..2ea0108d43 100644 --- a/tests/data_files/server9-sha384.crt +++ b/tests/data_files/server9-sha384.crt @@ -1,20 +1,21 @@ -----BEGIN CERTIFICATE----- -MIIDWzCCAhKgAwIBAgIBGTA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAqEa -MBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiBAICAM4wOzELMAkGA1UEBhMCTkwx -ETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBMB4X -DTE0MDEyMDEzNTc1OFoXDTI0MDExODEzNTc1OFowNDELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRIwEAYDVQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcN -AQEBBQADgY0AMIGJAoGBAN0Rip+ZurBoyirqO2ptWZftTslU5A3uzqB9oB6q6A7C -uxNA24oSjokTJKXF9frY9ZDXyMrLxf6THa/aEiNzUnlGGrqgVyt2FjGzqK/nOJsI -i2OZOgol7kXSGFi6uZMa7dRYmmMbN/z3FAifhWVJ81kybdHg6G3eUu1mtKkL2kCV -AgMBAAGjgZIwgY8wCQYDVR0TBAIwADAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy -36fOvVEwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJ -BgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wg -VGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCAqEaMBgGCSqG -SIb3DQEBCDALBglghkgBZQMEAgKiBAICAM4DggEBABf8Gyq2VYuN1EBW1nOapDQp -B/KuafNW2GEJ7FmQKNyA7MIj1Yqo2MtJ6/OQojRQ3F5rnO4yjmvIPsXeQaMxJBiI -aaoAlLpH++F+oXMq/0aS0WSZrSLrsh2Fpay9cBDGwek2rDOX9kM+ZcPzGitVwWKX -TnOW22hpcl7u95CpZH+JZTcto5nL3tTyV9pIy+tSKQQfjPB+G0TAZCsOkbCGPLug -qdjvqFQwOf15VxQMj7NRiXjlqJvsx+I7B2AIhrs4DzQMEyiWq9S/PzpQuFU5v/Kg -s2iMLJ5ygv5aN3PYqGlE1ZmvgyRp5h/LaTGI2L6lzRTnecOhtPv30N2tyaDAEfo= +MIIDYzCCAhagAwIBAgIBFzBCBgkqhkiG9w0BAQowNaAPMA0GCWCGSAFlAwQCAgUA +oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAgUAogQCAgDOMDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QTAeFw0yMzA1MTcwNzEwMzdaFw0zMzA1MTQwNzEwMzdaMDQxCzAJBgNVBAYTAk5M +MREwDwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQDdEYqfmbqwaMoq6jtqbVmX7U7JVOQN7s6gfaAe +qugOwrsTQNuKEo6JEySlxfX62PWQ18jKy8X+kx2v2hIjc1J5Rhq6oFcrdhYxs6iv +5zibCItjmToKJe5F0hhYurmTGu3UWJpjGzf89xQIn4VlSfNZMm3R4Oht3lLtZrSp +C9pAlQIDAQABo4GSMIGPMAkGA1UdEwQCMAAwHQYDVR0OBBYEFO7zx/UfFaVNR4nB +0yJjst+nzr1RMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnVppUP6z68x/3/oT+kPTA7 +MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFy +U1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgIFAKEc +MBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgIFAKIEAgIAzgOCAQEAmTU2HqAA7gbB +tJlDAve8nGbdCim4YjRXWceHGCpoFIWrs6onlHCvnZ2Wr8iPk+wnd7ShIpp8vGb/ +476y8pfaA2n8vYWhQKDCTTUXJN4tUc7i8Uz4RGdK48vHVvZCtCT/8MmPPouOIZcU +/Kkenw2jv5R/CpiirVUsjNx6BYcdu1zzEU+uoBLom6sZ6LGRlIB0prFWcxrVjfzx +2C8ZxMW8NWj6EQipQJ2U+CCycA2HkbCmt3FnEXmN5OWThvnKdshoPkMn2HwhAOzn +cjZQhQT3WSufvZ9bYe7HZ5e1e7k6aMXBvW89ECxc12mZfSjlYmlvfHZuO8D2sP2i +RidkcXFMxQ== -----END CERTIFICATE----- diff --git a/tests/data_files/server9-sha512.crt b/tests/data_files/server9-sha512.crt index a211b921dc..4abdf68133 100644 --- a/tests/data_files/server9-sha512.crt +++ b/tests/data_files/server9-sha512.crt @@ -1,20 +1,21 @@ -----BEGIN CERTIFICATE----- -MIIDWzCCAhKgAwIBAgIBGjA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCA6Ea -MBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgOiBAICAL4wOzELMAkGA1UEBhMCTkwx -ETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBMB4X -DTE0MDEyMDEzNTgxMloXDTI0MDExODEzNTgxMlowNDELMAkGA1UEBhMCTkwxETAP -BgNVBAoTCFBvbGFyU1NMMRIwEAYDVQQDEwlsb2NhbGhvc3QwgZ8wDQYJKoZIhvcN -AQEBBQADgY0AMIGJAoGBAN0Rip+ZurBoyirqO2ptWZftTslU5A3uzqB9oB6q6A7C -uxNA24oSjokTJKXF9frY9ZDXyMrLxf6THa/aEiNzUnlGGrqgVyt2FjGzqK/nOJsI -i2OZOgol7kXSGFi6uZMa7dRYmmMbN/z3FAifhWVJ81kybdHg6G3eUu1mtKkL2kCV -AgMBAAGjgZIwgY8wCQYDVR0TBAIwADAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy -36fOvVEwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJ -BgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wg -VGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCGSAFlAwQCA6EaMBgGCSqG -SIb3DQEBCDALBglghkgBZQMEAgOiBAICAL4DggEBACdVozFq6rUiXo+ib5Y2oPsR -6xxl4Ydn3LpUoYrPpTOrhcXJWW/tOLHGuCF/mSRfUzKaMIfL418cZHYnvumvuttu -6z3tp5E1VsiZCU2MWJnzjKSxFBOss43AmpJHHoapGFZu2pxObBPqegAKHYkKWOLk -tJDj47PurWgEek9j1nL7Pc1tVf59fm/ySp4fWkXLLvQiKid1516VioLyacUvK3zU -6Egz8jMt7D5c9KpaExLRTANVsThqO5/dmR36bOwm3Hpbde7DNdgxru41tiLMqJs/ -5pX3ceaJ1XQ/l0idj5/9ipvqHHUguyk7H22HwQHQdSD9oIha8kEM3P6CjpfE7yY= +MIIDYzCCAhagAwIBAgIBFzBCBgkqhkiG9w0BAQowNaAPMA0GCWCGSAFlAwQCAwUA +oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAwUAogQCAgC+MDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QTAeFw0yMzA1MTcwNzEwMzdaFw0zMzA1MTQwNzEwMzdaMDQxCzAJBgNVBAYTAk5M +MREwDwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqG +SIb3DQEBAQUAA4GNADCBiQKBgQDdEYqfmbqwaMoq6jtqbVmX7U7JVOQN7s6gfaAe +qugOwrsTQNuKEo6JEySlxfX62PWQ18jKy8X+kx2v2hIjc1J5Rhq6oFcrdhYxs6iv +5zibCItjmToKJe5F0hhYurmTGu3UWJpjGzf89xQIn4VlSfNZMm3R4Oht3lLtZrSp +C9pAlQIDAQABo4GSMIGPMAkGA1UdEwQCMAAwHQYDVR0OBBYEFO7zx/UfFaVNR4nB +0yJjst+nzr1RMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnVppUP6z68x/3/oT+kPTA7 +MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFy +U1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgMFAKEc +MBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgMFAKIEAgIAvgOCAQEAVut9oL/0V/vo +f9VKxAZfyy0zFy+LOHzV1H5qQaPKJnXIAUp/sDtvOjugqHKjamg6dCIVy292Yxcx +rW8WcMR1Bj9MQ5Qrv++TZ0a1e0qet1GYxj4MQkU30XlJq/Jh7ede9Vh/yBxKTQq7 +oaJ6fOTFWcz1JZDrZrKffBOqIp5jQWPARilUDN6FiRNYV3/14aWVGnNbqGfoY8CC +WvpC0iAvrQxjdQQf6nIYrzcGNzvrpRbhpzBPUyUIrM1o+nyiNAJPlyncjFwmfw9g +80FP1XnRIIKmlTTG7ivkjHKzE6WXZSQPjArg0jxQAX1uLKJGFhu+ueKyoPOHQXS0 +O1z3OQn3+w== -----END CERTIFICATE----- diff --git a/tests/data_files/server9-with-ca.crt b/tests/data_files/server9-with-ca.crt index 0478cff85d..51c0ada849 100644 --- a/tests/data_files/server9-with-ca.crt +++ b/tests/data_files/server9-with-ca.crt @@ -1,99 +1,39 @@ -----BEGIN CERTIFICATE----- MIIDBTCCAeegAwIBAgIBFjATBgkqhkiG9w0BAQowBqIEAgIA6jA7MQswCQYDVQQG -EwJOTDERMA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3Qg -Q0EwHhcNMTQwMTIwMTMzODE2WhcNMjQwMTE4MTMzODE2WjA0MQswCQYDVQQGEwJO -TDERMA8GA1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCBnzANBgkq +EwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3Qg +Q0EwHhcNMjMwNTE3MDgwNDAwWhcNMzMwNTE3MDgwNDAwWjA0MQswCQYDVQQGEwJO +TDERMA8GA1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCBnzANBgkq hkiG9w0BAQEFAAOBjQAwgYkCgYEA3RGKn5m6sGjKKuo7am1Zl+1OyVTkDe7OoH2g HqroDsK7E0DbihKOiRMkpcX1+tj1kNfIysvF/pMdr9oSI3NSeUYauqBXK3YWMbOo r+c4mwiLY5k6CiXuRdIYWLq5kxrt1FiaYxs3/PcUCJ+FZUnzWTJt0eDobd5S7Wa0 -qQvaQJUCAwEAAaOBkjCBjzAJBgNVHRMEAjAAMB0GA1UdDgQWBBTu88f1HxWlTUeJ -wdMiY7Lfp869UTBjBgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0w -OzELMAkGA1UEBhMCTkwxETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xh -clNTTCBUZXN0IENBggEAMBMGCSqGSIb3DQEBCjAGogQCAgDqA4IBAQDAog/jXydR -vDIugTzBXtfVK0CEX8iyQ4cVzQmXWSne8204v943K5D2hktSBkjdQUdcnVvVgLR6 -te50jV89ptN/NofX+fo9fhSRN9vGgQVWzOOFiO0zcThy749pirJu1Kq5OJdthIyW -Pu0UCz5G0k3kTp0JPevGlsNc8S9Ak1tFuB0IPJjrbfODWHS2LDuO+dB6gpkNTdrj -88ogYtBsN4D5gsXBRUfobXokUwejBwLrD6XwyQx+0bMwSCxgHEhxvuUkx1vdlXGw -JG3aF92u8mIxoKSAPaPdqy930mQvmpUWcN5Y1IMbtEGoQCKMYgosFcazJpJcjnX1 -o4Hl/lqjwCEG +qQvaQJUCAwEAAaOBkjCBjzAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy36fOvVEw +YwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QYIBAzAJBgNVHRMEAjAAMBMGCSqGSIb3DQEBCjAGogQCAgDqA4IBAQC2DLHQ05x6 +imJNztE/Tnk/lPQ01Pw6Girdbk4bgxcGwGj+1u5wAIHNpJ50TOggg3HxTyb7p344 +/tVMxz7nrHZQ5ASdn2kDCyCmEqhmj48isWAIml+7J9cBeImJoEfYqjtqtoVkGxFy +SuoZAQWkkqDpyFhKhIjLQ8JuSE6wWMX/kc6TFSSxepnZU1SFOXfCiaVr5tFQzBP7 +loppIANLjKeMjpOdU86PmRQ2LyzaCH1OMnjVndeqNmZt0NyzZ18cFPvm6+DVVVuP +Q+6nReShCdAlU+dJqsqj8JsQneNMTxjv4OBoXVmE/kZTj/DBTtwmxkVi7K4aYMFi +UYUZ4RiwG1/7 -----END CERTIFICATE----- -Certificate: - Data: - Version: 3 (0x2) - Serial Number: 0 (0x0) - Signature Algorithm: sha1WithRSAEncryption - Issuer: C=NL, O=PolarSSL, CN=PolarSSL Test CA - Validity - Not Before: Feb 12 14:44:00 2011 GMT - Not After : Feb 12 14:44:00 2021 GMT - Subject: C=NL, O=PolarSSL, CN=PolarSSL Test CA - Subject Public Key Info: - Public Key Algorithm: rsaEncryption - RSA Public Key: (2048 bit) - Modulus (2048 bit): - 00:c0:df:37:fc:17:bb:e0:96:9d:3f:86:de:96:32: - 7d:44:a5:16:a0:cd:21:f1:99:d4:ec:ea:cb:7c:18: - 58:08:94:a5:ec:9b:c5:8b:df:1a:1e:99:38:99:87: - 1e:7b:c0:8d:39:df:38:5d:70:78:07:d3:9e:d9:93: - e8:b9:72:51:c5:ce:a3:30:52:a9:f2:e7:40:70:14: - cb:44:a2:72:0b:c2:e5:40:f9:3e:e5:a6:0e:b3:f9: - ec:4a:63:c0:b8:29:00:74:9c:57:3b:a8:a5:04:90: - 71:f1:bd:83:d9:3f:d6:a5:e2:3c:2a:8f:ef:27:60: - c3:c6:9f:cb:ba:ec:60:7d:b7:e6:84:32:be:4f:fb: - 58:26:22:03:5b:d4:b4:d5:fb:f5:e3:96:2e:70:c0: - e4:2e:bd:fc:2e:ee:e2:41:55:c0:34:2e:7d:24:72: - 69:cb:47:b1:14:40:83:7d:67:f4:86:f6:31:ab:f1: - 79:a4:b2:b5:2e:12:f9:84:17:f0:62:6f:27:3e:13: - 58:b1:54:0d:21:9a:73:37:a1:30:cf:6f:92:dc:f6: - e9:fc:ac:db:2e:28:d1:7e:02:4b:23:a0:15:f2:38: - 65:64:09:ea:0c:6e:8e:1b:17:a0:71:c8:b3:9b:c9: - ab:e9:c3:f2:cf:87:96:8f:80:02:32:9e:99:58:6f: - a2:d5 - Exponent: 65537 (0x10001) - X509v3 extensions: - X509v3 Basic Constraints: - CA:TRUE - X509v3 Subject Key Identifier: - B4:5A:E4:A5:B3:DE:D2:52:F6:B9:D5:A6:95:0F:EB:3E:BC:C7:FD:FF - X509v3 Authority Key Identifier: - keyid:B4:5A:E4:A5:B3:DE:D2:52:F6:B9:D5:A6:95:0F:EB:3E:BC:C7:FD:FF - DirName:/C=NL/O=PolarSSL/CN=PolarSSL Test CA - serial:00 - - Signature Algorithm: sha1WithRSAEncryption - b8:fd:54:d8:00:54:90:8b:25:b0:27:dd:95:cd:a2:f7:84:07: - 1d:87:89:4a:c4:78:11:d8:07:b5:d7:22:50:8e:48:eb:62:7a: - 32:89:be:63:47:53:ff:b6:be:f1:2e:8c:54:c0:99:3f:a0:b9: - 37:23:72:5f:0d:46:59:8f:d8:47:cd:97:4c:9f:07:0c:12:62: - 09:3a:24:e4:36:d9:e9:2c:da:38:d0:73:75:61:d7:c1:6c:26: - 8b:9b:e0:d5:dc:67:ed:8c:6b:33:d7:74:22:3c:4c:db:b5:8d: - 2a:ce:2c:0d:08:59:05:09:05:a6:39:9f:b3:67:1b:e2:83:e5: - e1:8f:53:f6:67:93:c7:f9:6f:76:44:58:12:e8:3a:d4:97:e7: - e9:c0:3e:a8:7a:72:3d:87:53:1f:e5:2c:84:84:e7:9a:9e:7f: - 66:d9:1f:9b:f5:13:48:b0:4d:14:d1:de:b2:24:d9:78:7d:f5: - 35:cc:58:19:d1:d2:99:ef:4d:73:f8:1f:89:d4:5a:d0:52:ce: - 09:f5:b1:46:51:6a:00:8e:3b:cc:6f:63:01:00:99:ed:9d:a6: - 08:60:cd:32:18:d0:73:e0:58:71:d9:e5:d2:53:d7:8d:d0:ca: - e9:5d:2a:0a:0d:5d:55:ec:21:50:17:16:e6:06:4a:cd:5e:de: - f7:e0:e9:54 -----BEGIN CERTIFICATE----- -MIIDhzCCAm+gAwIBAgIBADANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER -MA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwHhcN -MTEwMjEyMTQ0NDAwWhcNMjEwMjEyMTQ0NDAwWjA7MQswCQYDVQQGEwJOTDERMA8G -A1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3QgQ0EwggEiMA0G +MIIDRDCCAiygAwIBAgIBAzANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN +MTkwMjEwMTQ0NDAwWhcNMjkwMjEwMTQ0NDAwWjA7MQswCQYDVQQGEwJOTDERMA8G +A1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDA3zf8F7vglp0/ht6WMn1EpRagzSHx mdTs6st8GFgIlKXsm8WL3xoemTiZhx57wI053zhdcHgH057Zk+i5clHFzqMwUqny 50BwFMtEonILwuVA+T7lpg6z+exKY8C4KQB0nFc7qKUEkHHxvYPZP9al4jwqj+8n YMPGn8u67GB9t+aEMr5P+1gmIgNb1LTV+/Xjli5wwOQuvfwu7uJBVcA0Ln0kcmnL R7EUQIN9Z/SG9jGr8XmksrUuEvmEF/Bibyc+E1ixVA0hmnM3oTDPb5Lc9un8rNsu KNF+AksjoBXyOGVkCeoMbo4bF6BxyLObyavpw/LPh5aPgAIynplYb6LVAgMBAAGj -gZUwgZIwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUtFrkpbPe0lL2udWmlQ/rPrzH -/f8wYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNV -BAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wgVGVz -dCBDQYIBADANBgkqhkiG9w0BAQUFAAOCAQEAuP1U2ABUkIslsCfdlc2i94QHHYeJ -SsR4EdgHtdciUI5I62J6Mom+Y0dT/7a+8S6MVMCZP6C5NyNyXw1GWY/YR82XTJ8H -DBJiCTok5DbZ6SzaONBzdWHXwWwmi5vg1dxn7YxrM9d0IjxM27WNKs4sDQhZBQkF -pjmfs2cb4oPl4Y9T9meTx/lvdkRYEug61Jfn6cA+qHpyPYdTH+UshITnmp5/Ztkf -m/UTSLBNFNHesiTZeH31NcxYGdHSme9Nc/gfidRa0FLOCfWxRlFqAI47zG9jAQCZ -7Z2mCGDNMhjQc+BYcdnl0lPXjdDK6V0qCg1dVewhUBcW5gZKzV7e9+DpVA== +UzBRMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLRa5KWz3tJS9rnVppUP6z68 +x/3/MB8GA1UdIwQYMBaAFLRa5KWz3tJS9rnVppUP6z68x/3/MA0GCSqGSIb3DQEB +BQUAA4IBAQCz557ZZmWv5UTTHebzTyVzku5ldpcicJPqKHP3xZ4tPPY52JQyJg/T +hsRB44yTyNo3/jo9or2KgVnc+/nCmnlvTq22a/j26DtKZ7wD9MWxunpkqRwExtA/ +G816msrl6X6m50WwdLXTvaVJGXCYp8TPVLx5YY3WPIVoX0CPN7Hs9iNJNiEWo4Qf +7dAqjWBB/QpusmWhjaDSc4+cFhT24Yo9HuS1yrkUTrBtJaj0AykTsiyFm6SBVDNH +9XIxCgYy9QrYbDKNtJXhuevpN0yUMV/aUnIkU2wTTouhOzZisjNk0sS1guqmSHzf +hlf8qotOhNvFXpEsCGwZUywayo7c4DtO -----END CERTIFICATE----- diff --git a/tests/data_files/server9.crt b/tests/data_files/server9.crt index a6f9fbc76c..26567aee91 100644 --- a/tests/data_files/server9.crt +++ b/tests/data_files/server9.crt @@ -1,19 +1,19 @@ -----BEGIN CERTIFICATE----- MIIDBTCCAeegAwIBAgIBFjATBgkqhkiG9w0BAQowBqIEAgIA6jA7MQswCQYDVQQG -EwJOTDERMA8GA1UEChMIUG9sYXJTU0wxGTAXBgNVBAMTEFBvbGFyU1NMIFRlc3Qg -Q0EwHhcNMTQwMTIwMTMzODE2WhcNMjQwMTE4MTMzODE2WjA0MQswCQYDVQQGEwJO -TDERMA8GA1UEChMIUG9sYXJTU0wxEjAQBgNVBAMTCWxvY2FsaG9zdDCBnzANBgkq +EwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3Qg +Q0EwHhcNMjMwNTE3MDgwNDAwWhcNMzMwNTE3MDgwNDAwWjA0MQswCQYDVQQGEwJO +TDERMA8GA1UECgwIUG9sYXJTU0wxEjAQBgNVBAMMCWxvY2FsaG9zdDCBnzANBgkq hkiG9w0BAQEFAAOBjQAwgYkCgYEA3RGKn5m6sGjKKuo7am1Zl+1OyVTkDe7OoH2g HqroDsK7E0DbihKOiRMkpcX1+tj1kNfIysvF/pMdr9oSI3NSeUYauqBXK3YWMbOo r+c4mwiLY5k6CiXuRdIYWLq5kxrt1FiaYxs3/PcUCJ+FZUnzWTJt0eDobd5S7Wa0 -qQvaQJUCAwEAAaOBkjCBjzAJBgNVHRMEAjAAMB0GA1UdDgQWBBTu88f1HxWlTUeJ -wdMiY7Lfp869UTBjBgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0w -OzELMAkGA1UEBhMCTkwxETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xh -clNTTCBUZXN0IENBggEAMBMGCSqGSIb3DQEBCjAGogQCAgDqA4IBAQDAog/jXydR -vDIugTzBXtfVK0CEX8iyQ4cVzQmXWSne8204v943K5D2hktSBkjdQUdcnVvVgLR6 -te50jV89ptN/NofX+fo9fhSRN9vGgQVWzOOFiO0zcThy749pirJu1Kq5OJdthIyW -Pu0UCz5G0k3kTp0JPevGlsNc8S9Ak1tFuB0IPJjrbfODWHS2LDuO+dB6gpkNTdrj -88ogYtBsN4D5gsXBRUfobXokUwejBwLrD6XwyQx+0bMwSCxgHEhxvuUkx1vdlXGw -JG3aF92u8mIxoKSAPaPdqy930mQvmpUWcN5Y1IMbtEGoQCKMYgosFcazJpJcjnX1 -o4Hl/lqjwCEG +qQvaQJUCAwEAAaOBkjCBjzAdBgNVHQ4EFgQU7vPH9R8VpU1HicHTImOy36fOvVEw +YwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNVBAYT +Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD +QYIBAzAJBgNVHRMEAjAAMBMGCSqGSIb3DQEBCjAGogQCAgDqA4IBAQC2DLHQ05x6 +imJNztE/Tnk/lPQ01Pw6Girdbk4bgxcGwGj+1u5wAIHNpJ50TOggg3HxTyb7p344 +/tVMxz7nrHZQ5ASdn2kDCyCmEqhmj48isWAIml+7J9cBeImJoEfYqjtqtoVkGxFy +SuoZAQWkkqDpyFhKhIjLQ8JuSE6wWMX/kc6TFSSxepnZU1SFOXfCiaVr5tFQzBP7 +loppIANLjKeMjpOdU86PmRQ2LyzaCH1OMnjVndeqNmZt0NyzZ18cFPvm6+DVVVuP +Q+6nReShCdAlU+dJqsqj8JsQneNMTxjv4OBoXVmE/kZTj/DBTtwmxkVi7K4aYMFi +UYUZ4RiwG1/7 -----END CERTIFICATE----- From a69934f2490686ad8aa75f7032ca8cd09de4796d Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Fri, 19 May 2023 23:07:09 +0800 Subject: [PATCH 020/135] upgrade server9-bad-saltlen.crt Upgrade scripts ```python import subprocess from asn1crypto import pem, x509,core output_filename="server9-bad-saltlen.crt" tmp_filename="server9-bad-saltlen.crt.tmp" tmp1_filename="server9-bad-saltlen.crt.tmp1" subprocess.check_call(rf''' openssl x509 -req -extfile server5.crt.openssl.v3_ext \ -passin "pass:PolarSSLTest" -CA test-ca.crt -CAkey test-ca.key \ -set_serial 24 -days 3650 \ -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:max \ -sigopt rsa_mgf1_md:sha256 -sha256 \ -in server9.csr -out {output_filename} ''',shell=True) with open(output_filename,'rb') as f: _,_,der_bytes=pem.unarmor(f.read()) target_certificate=x509.Certificate.load(der_bytes) with open(tmp_filename,'wb') as f: f.write(target_certificate['tbs_certificate'].dump()) subprocess.check_call(rf'openssl dgst -sign test-ca.key -passin "pass:PolarSSLTest" \ -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:32 \ -sigopt rsa_mgf1_md:sha256 -out {tmp1_filename} {tmp_filename}', shell=True) with open(tmp1_filename,'rb') as f: signature_value= core.OctetBitString(f.read()) with open(output_filename,'wb') as f: target_certificate['signature_value']=signature_value f.write(pem.armor('CERTIFICATE',target_certificate.dump())) ``` Signed-off-by: Jerry Yu --- tests/data_files/Makefile | 10 ++-------- tests/data_files/server9-bad-saltlen.crt | 24 ++++++++++++------------ 2 files changed, 14 insertions(+), 20 deletions(-) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index f43b86b7ed..40654a074a 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -509,15 +509,9 @@ server9-with-ca.crt: server9.crt $(test_ca_crt) cat $^ > $@ all_final += server9-with-ca.crt -# FIXME: this file expected a bad-saltlen, but it create a good saltlen. +# FIXME: This file needs special sequence. It should be update manually server9-bad-saltlen.crt: server9.csr $(test_ca_crt) $(test_ca_key_file_rsa) - $(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -extensions cli-rsa \ - -passin "pass:$(test_ca_pwd_rsa)" -CA $(test_ca_crt) -CAkey $(test_ca_key_file_rsa) \ - -set_serial 24 -days 3653 \ - -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:max \ - -sigopt rsa_mgf1_md:sha256 -sha256 \ - -in $< -out $@ -all_final += server9-bad-saltlen.crt + false server9-bad-mgfhash.crt: server9.csr $(test_ca_crt) $(test_ca_key_file_rsa) $(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -extensions cli-rsa \ diff --git a/tests/data_files/server9-bad-saltlen.crt b/tests/data_files/server9-bad-saltlen.crt index 78298e98b9..45bf20e274 100644 --- a/tests/data_files/server9-bad-saltlen.crt +++ b/tests/data_files/server9-bad-saltlen.crt @@ -2,20 +2,20 @@ MIIDYzCCAhagAwIBAgIBGDBCBgkqhkiG9w0BAQowNaAPMA0GCWCGSAFlAwQCAQUA oRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogQCAgDeMDsxCzAJBgNVBAYT Ak5MMREwDwYDVQQKDAhQb2xhclNTTDEZMBcGA1UEAwwQUG9sYXJTU0wgVGVzdCBD -QTAeFw0yMzA1MTcwODMzNDJaFw0zMzA1MTcwODMzNDJaMDQxCzAJBgNVBAYTAk5M +QTAeFw0yMzA1MjIwNzMwMDZaFw0zMzA1MTkwNzMwMDZaMDQxCzAJBgNVBAYTAk5M MREwDwYDVQQKDAhQb2xhclNTTDESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqG SIb3DQEBAQUAA4GNADCBiQKBgQDdEYqfmbqwaMoq6jtqbVmX7U7JVOQN7s6gfaAe qugOwrsTQNuKEo6JEySlxfX62PWQ18jKy8X+kx2v2hIjc1J5Rhq6oFcrdhYxs6iv 5zibCItjmToKJe5F0hhYurmTGu3UWJpjGzf89xQIn4VlSfNZMm3R4Oht3lLtZrSp -C9pAlQIDAQABo4GSMIGPMB0GA1UdDgQWBBTu88f1HxWlTUeJwdMiY7Lfp869UTBj -BgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMC -TkwxETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENB -ggEDMAkGA1UdEwQCMAAwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgEFAKEc -MBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIEAgIA3gOCAQEALIe0VtQaT92x -fNkzIdRHkv+3C6P4URzFP9cBMm+ulX86ld/Szl4J2eUywtzQz22UZE5ZT23xutCx -pUC3AZyzRNiDAdsPvofvf88MJtxDROe7v/MgmXqKxx2t+/N62Mf2mzd9Wu9ibBcO -DrawRQtlUgUkwlzdTtWUxu/VYMEhdeXMPHRSzX0ODAQOA9EydR/BvPmuvMYIvb8M -L1ifzupTm+W92v6kB1AmEXjtvcPEba6rvfZylKISJPmRH3wTdt1+s/1j/PjdUfIa -WbjiucXRSk3NBsza+w5cS4CQu3dbZaY2lBhBkoWvxZm+XU4mfxmjCW6jl59NAmMD -X7c2Uua8SA== +C9pAlQIDAQABo4GSMIGPMAkGA1UdEwQCMAAwHQYDVR0OBBYEFO7zx/UfFaVNR4nB +0yJjst+nzr1RMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnVppUP6z68x/3/oT+kPTA7 +MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFy +U1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgEFAKEc +MBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIEAgIA3gOCAQEAlQo9OnchZbLQ +PTXs9NgXDoQb4JvUG/Fsq09/e8ivWaHkE7mKeNRrP8qMdAw914Bs1NQf9F75CWJe +5YtmLcE5gSbVj3qa6zVuQWEcrseKz6wpAFLsHKbF6kKfUgcI56xmD2DhhIHny+5B +9ObM0RQpCmAYXjU2CvknXeBzpX2cGOLD/Nexk1oBF6PI0rDUBqg3cexsJ5XfJwYg +tkjkZ321s9N09BsioauH6d9x9/Ysz7Qp7Bqpb1E7dV4bDuT5vwPWwPIUAav897Vt +s0uMZHoVasj57UwqDv8tm0db6f2VOL7r5GBMjbp6newW8Me47uXSBXKy8tFJMolj +yKuEQkKKyA== -----END CERTIFICATE----- From ea8027921bfbf5e8cdd55ba67a0164e1ac215893 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Mon, 29 May 2023 15:32:31 +0800 Subject: [PATCH 021/135] Update crl-rsa-pss-*.pem manually The rules will be in a seperate PR. Signed-off-by: Pengyu Lv --- tests/data_files/crl-rsa-pss-sha1-badsign.pem | 22 +++++++-------- tests/data_files/crl-rsa-pss-sha1.pem | 22 +++++++-------- tests/data_files/crl-rsa-pss-sha224.pem | 28 +++++++++---------- tests/data_files/crl-rsa-pss-sha256.pem | 28 +++++++++---------- tests/data_files/crl-rsa-pss-sha384.pem | 28 +++++++++---------- tests/data_files/crl-rsa-pss-sha512.pem | 28 +++++++++---------- 6 files changed, 78 insertions(+), 78 deletions(-) diff --git a/tests/data_files/crl-rsa-pss-sha1-badsign.pem b/tests/data_files/crl-rsa-pss-sha1-badsign.pem index 7e2a59677a..d236910d90 100644 --- a/tests/data_files/crl-rsa-pss-sha1-badsign.pem +++ b/tests/data_files/crl-rsa-pss-sha1-badsign.pem @@ -1,14 +1,14 @@ -----BEGIN X509 CRL----- MIICJDCCAQYCAQEwEwYJKoZIhvcNAQEKMAaiBAICAOowOzELMAkGA1UEBhMCTkwx -ETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBFw0x -NDAxMjAxMzQ2MzVaFw0yNDAxMTgxMzQ2MzVaMCgwEgIBChcNMTMwOTI0MTYyODM4 -WjASAgEWFw0xNDAxMjAxMzQzMDVaoGcwZTBjBgNVHSMEXDBagBS0WuSls97SUva5 -1aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMCTkwxETAPBgNVBAoTCFBvbGFyU1NM -MRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBggEAMBMGCSqGSIb3DQEBCjAGogQC -AgDqA4IBAQB8ZBX0BEgRcx0lfk1ctELRu1AYoJ5BnsmQpq23Ca4YIP2yb2kTN1ZS -4fR4SgYcNctgo2JJiNiUkCu1ZnRUOJUy8UlEio0+aeumTNz6CbeJEDhr5NC3oiV0 -MzvLn9rJVLPetOT9UrvvIy8iz5Pn1d8mu5rkt9BKQRq9NQx8riKnSIoTc91NLCMo -mkCCB55DVbazODSWK19e6yQ0JS454RglOsqRtLJ/EDbi6lCsLXotFt3GEGMrob1O -7Qck1Z59boaHxGYFEVnx90+4M3/qikVtwZdcBjLEmfuwYvszFw8J2y6Xwmg/HtUa -y6li0JzWNHtkKUlCv2+SESZbD3NU8GQY +ETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENBFw0y +MzA1MTcwODA3NDlaFw0zMzA1MTcwODA3NDlaMCgwEgIBChcNMjMwNTE3MDgwNzQ5 +WjASAgEWFw0yMzA1MTcwODA3NDlaoGcwZTBjBgNVHSMEXDBagBS0WuSls97SUva5 +1aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NM +MRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENBggEDMBMGCSqGSIb3DQEBCjAGogQC +AgDqA4IBAQCMUepEfAXs1G3hDE7rcIPT/AFv/oLQSVwRE8O2G5r4j0CgzN6CSGNi +8qfFVX6f7ds+QM4pxAXk5FH4QJJkev0ZBQxmA/ZDLEFmmCEfPMsA69nG//Xeq+Xz +ZOqJpAewmXoP2UUxV5rRpAIr9g9NvDkTT012eQEpoGkJlpxOln1VW+Dk24PCZFWf +Nf8GMUzUsXfXm7ZdCeuc8ZDYNma0nWAMR9Jw6qaEhyH4Fd/scFvXiF/i4cpVp8Rk +M71wSrCC0pkFzw4/bYMnf0aHle/lNg5e78SAT+/6PA8pXL7Urc0IufOfxCGwqY27 +IXSTrZJj4WeQMk289pIccMHj5DUSo4u0 -----END X509 CRL----- diff --git a/tests/data_files/crl-rsa-pss-sha1.pem b/tests/data_files/crl-rsa-pss-sha1.pem index 59ca4f703e..c129c0c813 100644 --- a/tests/data_files/crl-rsa-pss-sha1.pem +++ b/tests/data_files/crl-rsa-pss-sha1.pem @@ -1,14 +1,14 @@ -----BEGIN X509 CRL----- MIICJDCCAQYCAQEwEwYJKoZIhvcNAQEKMAaiBAICAOowOzELMAkGA1UEBhMCTkwx -ETAPBgNVBAoTCFBvbGFyU1NMMRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBFw0x -NDAxMjAxMzQ2MzVaFw0yNDAxMTgxMzQ2MzVaMCgwEgIBChcNMTMwOTI0MTYyODM4 -WjASAgEWFw0xNDAxMjAxMzQzMDVaoGcwZTBjBgNVHSMEXDBagBS0WuSls97SUva5 -1aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMCTkwxETAPBgNVBAoTCFBvbGFyU1NM -MRkwFwYDVQQDExBQb2xhclNTTCBUZXN0IENBggEAMBMGCSqGSIb3DQEBCjAGogQC -AgDqA4IBAQB8ZBX0BEgRcx0lfk1ctELRu1AYoJ5BnsmQpq23Ca4YIP2yb2kTN1ZS -4fR4SgYcNctgo2JJiNiUkCu1ZnRUOJUy8UlEio0+aeumTNz6CbeJEDhr5NC3oiV0 -MzvLn9rJVLPetOT9UrvvIy8iz5Pn1d8mu5rkt9BKQRq9NQx8riKnSIoTc91NLCMo -mkCCB55DVbazODSWK19e6yQ0JS454RglOsqRtLJ/EDbi6lCsLXotFt3GEGMrob1O -7Qck1Z59boaHxGYFEVnx90+4M3/qikVtwZdcBjLEmfuwYvszFw8J2y6Xwmg/HtUa -y6li0JzWNHtkKUlCv2+SESZbD3NU8GQZ +ETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENBFw0y +MzA1MTcwODA3NDlaFw0zMzA1MTcwODA3NDlaMCgwEgIBChcNMjMwNTE3MDgwNzQ5 +WjASAgEWFw0yMzA1MTcwODA3NDlaoGcwZTBjBgNVHSMEXDBagBS0WuSls97SUva5 +1aaVD+s+vMf9/6E/pD0wOzELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NM +MRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENBggEDMBMGCSqGSIb3DQEBCjAGogQC +AgDqA4IBAQCMUepEfAXs1G3hDE7rcIPT/AFv/oLQSVwRE8O2G5r4j0CgzN6CSGNi +8qfFVX6f7ds+QM4pxAXk5FH4QJJkev0ZBQxmA/ZDLEFmmCEfPMsA69nG//Xeq+Xz +ZOqJpAewmXoP2UUxV5rRpAIr9g9NvDkTT012eQEpoGkJlpxOln1VW+Dk24PCZFWf +Nf8GMUzUsXfXm7ZdCeuc8ZDYNma0nWAMR9Jw6qaEhyH4Fd/scFvXiF/i4cpVp8Rk +M71wSrCC0pkFzw4/bYMnf0aHle/lNg5e78SAT+/6PA8pXL7Urc0IufOfxCGwqY27 +IXSTrZJj4WeQMk289pIccMHj5DUSo4uO -----END X509 CRL----- diff --git a/tests/data_files/crl-rsa-pss-sha224.pem b/tests/data_files/crl-rsa-pss-sha224.pem index a51d5d9113..1108b3ddba 100644 --- a/tests/data_files/crl-rsa-pss-sha224.pem +++ b/tests/data_files/crl-rsa-pss-sha224.pem @@ -1,16 +1,16 @@ -----BEGIN X509 CRL----- -MIICejCCATECAQEwPgYJKoZIhvcNAQEKMDGgDTALBglghkgBZQMEAgShGjAYBgkq -hkiG9w0BAQgwCwYJYIZIAWUDBAIEogQCAgDiMDsxCzAJBgNVBAYTAk5MMREwDwYD -VQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wgVGVzdCBDQRcNMTQwMTIw -MTM1NjA2WhcNMjQwMTE4MTM1NjA2WjAoMBICAQoXDTEzMDkyNDE2MjgzOFowEgIB -FhcNMTQwMTIwMTM0MzA1WqBnMGUwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/r -PrzH/f+hP6Q9MDsxCzAJBgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcG -A1UEAxMQUG9sYXJTU0wgVGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCG -SAFlAwQCBKEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgSiBAICAOIDggEBAEJI -i9sQOzMvvOTksN48+X+kk/wkLMKRGI222lqU6y6tP1LX3OE/+KN8gPXR+lCC+e0v -TsRTJkpKEcmHZoP/8kOtZnLb9PdITKGMQnZ+dmn5MFEzZI/zyrYWuJTuK1Q83w0e -Mc88cAhu8i4PTk/WnsWDphK1Q2YRupmmwWSUpp1Z2rpR+YSCedC01TVrtSUJUBw9 -NSqKDhyWYJIbS6/bFaERswC8xlMRhyLHUvikjmAK36TbIdhTnEffHOPW75sEOEEB -f0A3VtlZ7y5yt2/a6vOauJCivxKt/PutdHfBqH43QQmoVLWC2FmT9ADTJwcsZB3D -a6JSqCIMRCQY2JOUn0A= +MIICgjCCATUCAQEwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgQFAKEcMBoG +CSqGSIb3DQEBCDANBglghkgBZQMEAgQFAKIEAgIA4jA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EXDTIz +MDUxNzA4MDc0OVoXDTMzMDUxNzA4MDc0OVowKDASAgEKFw0yMzA1MTcwODA3NDla +MBICARYXDTIzMDUxNzA4MDc0OVqgZzBlMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnV +ppUP6z68x/3/oT+kPTA7MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wx +GTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzAN +BglghkgBZQMEAgQFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgQFAKIEAgIA +4gOCAQEANsElK5qMavcgBXsqgysCIIwEPj+dXdBOwXW17HWh2jcSwAssFNRxhiIc +PoUjj2fNlbOWXLPoxXBitgkJ31UAYCteGSv3j5P3WEuriVwCG889JEoMWn9U4+f9 +f5jSVNfynyiAOiwpA0TrOhZOAs9SEj742S1pzhsb9yaOXeQXNnDv8HYe3uX9/D9w +ynot+/EwCYEuvK8XQ6qnV6588NHEAd9x+OcV9pxWrmUE8Muz1KffBwD5+SOW+Taj +4fKQPcKJoRXOKyLXpOz7yMl/6fCf6h3Qj/H4YI/2gsWI0iduKoXDsuQkMEdPTZvk +7P88YK3/4MReaZS3sDyhhUrojELPXw== -----END X509 CRL----- diff --git a/tests/data_files/crl-rsa-pss-sha256.pem b/tests/data_files/crl-rsa-pss-sha256.pem index f16a49118e..26f7935ccc 100644 --- a/tests/data_files/crl-rsa-pss-sha256.pem +++ b/tests/data_files/crl-rsa-pss-sha256.pem @@ -1,16 +1,16 @@ -----BEGIN X509 CRL----- -MIICejCCATECAQEwPgYJKoZIhvcNAQEKMDGgDTALBglghkgBZQMEAgGhGjAYBgkq -hkiG9w0BAQgwCwYJYIZIAWUDBAIBogQCAgDeMDsxCzAJBgNVBAYTAk5MMREwDwYD -VQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wgVGVzdCBDQRcNMTQwMTIw -MTM1NjE2WhcNMjQwMTE4MTM1NjE2WjAoMBICAQoXDTEzMDkyNDE2MjgzOFowEgIB -FhcNMTQwMTIwMTM0MzA1WqBnMGUwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/r -PrzH/f+hP6Q9MDsxCzAJBgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcG -A1UEAxMQUG9sYXJTU0wgVGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCG -SAFlAwQCAaEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgGiBAICAN4DggEBAEZ4 -oqp9i5eXrN6aCSTaU1j07MVTFW/U1jQAq6GseB6bEvoEXFMUHJsgAObqCK9flfEC -FEqXqWSo33hhPU7AKKttbDLjUYRNnQAPRUnRIl1/a1+UjqgKchWWD9ityeW8ICxo -IdATX9reYmPDLIMqTC7zuflYkvrvdEOuBORQP5mn4j8t84MSQF/p4qzaU0XxLo4X -ckzZCcHpa45AApCDjJMd9onhFVCYsykiYrF9NQFO8TI4lQ5jv79GoufEzvhY1SPB -r1xz4sMpfyaoPaa3SM2/nD65E5jzXell2u2VWNGKv4zAQP0E5yGel+1rklBltadb -XLdJyyak33CLBKu+nJc= +MIICgjCCATUCAQEwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgEFAKEcMBoG +CSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIEAgIA3jA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EXDTIz +MDUxNzA4MDc0OVoXDTMzMDUxNzA4MDc0OVowKDASAgEKFw0yMzA1MTcwODA3NDla +MBICARYXDTIzMDUxNzA4MDc0OVqgZzBlMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnV +ppUP6z68x/3/oT+kPTA7MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wx +GTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzAN +BglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIEAgIA +3gOCAQEAHLzvRF0RVQL48ZGVFnTk1nsOHXVHS0UVMItsILurXJ4XrOgN1I7iTzu2 +wYNtgr+T15jwsPdgU+Gg3127vb2Djm0IUX0dCfYpSFRUv8BjaK962ZPjM0rkWhC6 +JUTWSLMAMy4ScqcoC7e4vuN2h4kPOzlvDBIhzWKA03+taAtuIOWjXZu2/Cyeggxs +oXARKI8BEv4b94xwiFJMoMuzcYAkuDIH4MRYANVgOS/zncCRS9D5ZerfoBt70LKX +nzJtT4a0XoxbUJeU8MZ0fR5aAHUQulAPA9CMmBsHkSx7pzAAhCwx/vXbnWPyhA6G +XG6gCKcDR5PZQvQNgi29SLlhRTT5TA== -----END X509 CRL----- diff --git a/tests/data_files/crl-rsa-pss-sha384.pem b/tests/data_files/crl-rsa-pss-sha384.pem index 50f7e4cd24..45431f0133 100644 --- a/tests/data_files/crl-rsa-pss-sha384.pem +++ b/tests/data_files/crl-rsa-pss-sha384.pem @@ -1,16 +1,16 @@ -----BEGIN X509 CRL----- -MIICejCCATECAQEwPgYJKoZIhvcNAQEKMDGgDTALBglghkgBZQMEAgKhGjAYBgkq -hkiG9w0BAQgwCwYJYIZIAWUDBAICogQCAgDOMDsxCzAJBgNVBAYTAk5MMREwDwYD -VQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wgVGVzdCBDQRcNMTQwMTIw -MTM1NjI4WhcNMjQwMTE4MTM1NjI4WjAoMBICAQoXDTEzMDkyNDE2MjgzOFowEgIB -FhcNMTQwMTIwMTM0MzA1WqBnMGUwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/r -PrzH/f+hP6Q9MDsxCzAJBgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcG -A1UEAxMQUG9sYXJTU0wgVGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCG -SAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiBAICAM4DggEBAAco -SntUGDLBOAu0IIZaVea5Nt1NMsMcppC0hWPuH1LKAwyUODBqpT+0+AuALK0eIdYR -a7mAB+cv2fFwmwxnQWJ1Fvx4ft/N2AAfB83VRKpSo3xR8bxloHfTWKmyxJHmH9j1 -EYmLS86rj3Nhjf4m/YlQQ3Im5HwOgSgBOE8glq5D+0Wmsi9LsNEZXEzMw7TMUgbs -y9o/ghYF/shKU4mewK3DeM9gQiTcH5A4ISXR87hBQ08AKJRAG1CLvTyzqWiUUY+k -q8iZDYF17sHrPi2yn8q9c4zdxiaWDGDdL0Lh90wXGTAageoGEq25TMuL5FpX+u1u -KUH/xf1jEnNzbYNGiZw= +MIICgjCCATUCAQEwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgIFAKEcMBoG +CSqGSIb3DQEBCDANBglghkgBZQMEAgIFAKIEAgIAzjA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EXDTIz +MDUxNzA4MDc1MFoXDTMzMDUxNzA4MDc1MFowKDASAgEKFw0yMzA1MTcwODA3NTBa +MBICARYXDTIzMDUxNzA4MDc1MFqgZzBlMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnV +ppUP6z68x/3/oT+kPTA7MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wx +GTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzAN +BglghkgBZQMEAgIFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgIFAKIEAgIA +zgOCAQEAnZvMo3nmKXPV+q4m1CdMA7jUtdanJBHDAv2+LZLq4T1QpyN+nmLEB1yX +ARN8/5Px47zm7XyZw6HI1Il34MjblAKIPBVXoswj4YLRceijwiG1bxkh1Kz3lcV0 +GCNPNo7tMPii9iATWlVzWBCzx2rLmt/ys0DtNRCMISOYGW1HkyuO28dwA6nUJwSS +Ddjr3iilavnBdpzddH9AiN5Fm0sfrFBANx79Qyp0/r8hqrv7rT33maeRKj3S4e9G +zpO6uHPAh9Obo93DxpKpXoMwxDiHv+bwHPO4J1YOiryy/KZmHhzUMPfvP09pGg9f +zGO/bOyiHGH0Lf4F9JVMxpfitdbtwg== -----END X509 CRL----- diff --git a/tests/data_files/crl-rsa-pss-sha512.pem b/tests/data_files/crl-rsa-pss-sha512.pem index 0f1d6510bc..71f2b7cd50 100644 --- a/tests/data_files/crl-rsa-pss-sha512.pem +++ b/tests/data_files/crl-rsa-pss-sha512.pem @@ -1,16 +1,16 @@ -----BEGIN X509 CRL----- -MIICejCCATECAQEwPgYJKoZIhvcNAQEKMDGgDTALBglghkgBZQMEAgOhGjAYBgkq -hkiG9w0BAQgwCwYJYIZIAWUDBAIDogQCAgC+MDsxCzAJBgNVBAYTAk5MMREwDwYD -VQQKEwhQb2xhclNTTDEZMBcGA1UEAxMQUG9sYXJTU0wgVGVzdCBDQRcNMTQwMTIw -MTM1NjM4WhcNMjQwMTE4MTM1NjM4WjAoMBICAQoXDTEzMDkyNDE2MjgzOFowEgIB -FhcNMTQwMTIwMTM0MzA1WqBnMGUwYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/r -PrzH/f+hP6Q9MDsxCzAJBgNVBAYTAk5MMREwDwYDVQQKEwhQb2xhclNTTDEZMBcG -A1UEAxMQUG9sYXJTU0wgVGVzdCBDQYIBADA+BgkqhkiG9w0BAQowMaANMAsGCWCG -SAFlAwQCA6EaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgOiBAICAL4DggEBAB9F -ywBfxOjetxNbCFhOYoPY2jvFCFVdlowMGuxEhX/LktqiBXqRc2r5naQSzuHqO8Iq -1zACtiDLri0CvgSHlravBNeY4c2wj//ueFE89tY5pK9E6vZp7cV+RfMx2YfGPAA2 -t7tWZ2rJWzELg8cZ8hpjSwFH7JmgJzjE5gi2gADhBYO6Vv5S3SOgqNjiN1OM31AU -p6GHK5Y1jurF5Zwzs+w3wXoXgpOxxwEC4eiS86c9kNSudwTLvDTU0bYEQE1cF+K0 -sB8QWABFJfuO5kjD2w3rWgmAiOKsZoxd1xrda+WD3JhDXnoVq3oVBIVlWVz6YID8 -enMfMvwScA5AImzu9xA= +MIICgjCCATUCAQEwQgYJKoZIhvcNAQEKMDWgDzANBglghkgBZQMEAgMFAKEcMBoG +CSqGSIb3DQEBCDANBglghkgBZQMEAgMFAKIEAgIAvjA7MQswCQYDVQQGEwJOTDER +MA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EXDTIz +MDUxNzA4MDc1MFoXDTMzMDUxNzA4MDc1MFowKDASAgEKFw0yMzA1MTcwODA3NTBa +MBICARYXDTIzMDUxNzA4MDc1MFqgZzBlMGMGA1UdIwRcMFqAFLRa5KWz3tJS9rnV +ppUP6z68x/3/oT+kPTA7MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wx +GTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0GCAQMwQgYJKoZIhvcNAQEKMDWgDzAN +BglghkgBZQMEAgMFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgMFAKIEAgIA +vgOCAQEAtMPpQMet9BfMRLg0AW9QfL3QkktV7xk++BqYFOYynBiqxjQH4AKu3wU8 +eiGd3+2xNpQd2/sG7UUNo1Vnl9gCHRiT4bje6+CdvvqaZKSgpmsiztbgBAYORriF +flKOKOOQTxaikqJ4t7vp727JmstADuyizTgOBE0k3V1glas8B0G122YheeHF02S4 ++33Nss4hbfbTilR0RccOaqiXzF9bkFsTlD5KgyUFZbFtdy+1zHZLnRUAJA1HmDeP +r5p2mJxKwXmZzLnw/FPa8fUH665TKYk08AuIpN+VHdPwiBoYHJ2YZJWgM+1qHq1y +tlyoAOC6beqsh9OfxcQZaEiWbUI9yQ== -----END X509 CRL----- From 343ff1200dbf76f134a9f90aae62cf52b457e5d4 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Thu, 8 Jun 2023 09:20:16 +0800 Subject: [PATCH 022/135] Fix typo and long line format Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 40654a074a..6006509d1a 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -110,7 +110,9 @@ cert_example_multi_nocn.csr: rsa_pkcs1_1024_clear.pem all_intermediate += cert_example_multi_nocn.csr cert_example_multi_nocn.crt: cert_example_multi_nocn.csr test-ca_nocn.crt - $(OPENSSL) x509 -req -CA test-ca_nocn.crt -CAkey $(test_ca_key_file_rsa) -extfile $(test_ca_config_file) -extensions ext_multi_nocn -passin "pass:$(test_ca_pwd_rsa)" -set_serial 0xf7c67ff8e9a963f9 -days 3653 -sha1 -in $< > $@ + $(OPENSSL) x509 -req -CA test-ca_nocn.crt -CAkey $(test_ca_key_file_rsa) \ + -extfile $(test_ca_config_file) -extensions ext_multi_nocn -passin "pass:$(test_ca_pwd_rsa)" \ + -set_serial 0xf7c67ff8e9a963f9 -days 3653 -sha1 -in $< > $@ all_final += cert_example_multi_nocn.crt $(test_ca_key_file_rsa_alt):test-ca.opensslconf @@ -410,7 +412,9 @@ all_final += server5-ss-expired.crt # try to forge a copy of test-int-ca3 with different key server5-ss-forgeca.crt: server5.key - $(OPENSSL) req -x509 -new -subj "/C=UK/O=mbed TLS/CN=mbed TLS Test intermediate CA 3" -set_serial 77 -config $(test_ca_config_file) -extensions noext_ca -days 3650 -sha256 -key $< -out $@ + $(OPENSSL) req -x509 -new -subj "/C=UK/O=mbed TLS/CN=mbed TLS Test intermediate CA 3" \ + -set_serial 77 -config $(test_ca_config_file) -extensions noext_ca \ + -days 3650 -sha256 -key $< -out $@ all_final += server5-ss-forgeca.crt server5-selfsigned.crt: server5.key @@ -498,7 +502,7 @@ server9-defaults.crt: server9.csr $(test_ca_crt) $(test_ca_key_file_rsa) -passin "pass:$(test_ca_pwd_rsa)" -CA $(test_ca_crt) -CAkey $(test_ca_key_file_rsa) \ -set_serial 72 -days 3653 \ -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:max -sha1 \ - -in $< -o $@ + -in $< -out $@ all_final += server9-defaults.crt server9-badsign.crt: server9.crt From 0e93877b66941257a54b4326d7a7d1680ca6c81c Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Fri, 23 Jun 2023 23:19:40 +0100 Subject: [PATCH 023/135] Reword the description of mbedtls_net_free() This makes it clearer that the context itself is not being freed. Signed-off-by: David Horstmann --- include/mbedtls/net_sockets.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/mbedtls/net_sockets.h b/include/mbedtls/net_sockets.h index c8bcde0698..7a0148bfd8 100644 --- a/include/mbedtls/net_sockets.h +++ b/include/mbedtls/net_sockets.h @@ -280,16 +280,16 @@ int mbedtls_net_recv_timeout(void *ctx, unsigned char *buf, size_t len, uint32_t timeout); /** - * \brief Closes down the connection and free associated data + * \brief Close down the connection and clear the context * * \param ctx The context to close */ void mbedtls_net_close(mbedtls_net_context *ctx); /** - * \brief Gracefully shutdown the connection and free associated data + * \brief Gracefully shutdown the connection and clear the context * - * \param ctx The context to free + * \param ctx The context to gracefully shutdown */ void mbedtls_net_free(mbedtls_net_context *ctx); From 4184e5c9267b77c3080da3acde91eb8ba7b26429 Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Tue, 27 Jun 2023 12:20:32 +0100 Subject: [PATCH 024/135] Move clarification to a separate note Signed-off-by: David Horstmann --- include/mbedtls/net_sockets.h | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/include/mbedtls/net_sockets.h b/include/mbedtls/net_sockets.h index 7a0148bfd8..6bcd9208f9 100644 --- a/include/mbedtls/net_sockets.h +++ b/include/mbedtls/net_sockets.h @@ -280,16 +280,24 @@ int mbedtls_net_recv_timeout(void *ctx, unsigned char *buf, size_t len, uint32_t timeout); /** - * \brief Close down the connection and clear the context + * \brief Closes down the connection and free associated data * * \param ctx The context to close + * + * \note This function frees and clears data associated with the + * context but does not free the memory pointed to by \p ctx. + * This memory is the responsibility of the caller. */ void mbedtls_net_close(mbedtls_net_context *ctx); /** - * \brief Gracefully shutdown the connection and clear the context + * \brief Gracefully shutdown the connection and free associated data * - * \param ctx The context to gracefully shutdown + * \param ctx The context to free + * + * \note This function frees and clears data associated with the + * context but does not free the memory pointed to by \p ctx. + * This memory is the responsibility of the caller. */ void mbedtls_net_free(mbedtls_net_context *ctx); From a3d315a216eda4d27c5714fafaed6c56a92b0c2f Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 17 Feb 2022 06:32:22 -0500 Subject: [PATCH 025/135] doxygen: remove unnecessary description Due to the nature of CTR, there is no mode parameter. Signed-off-by: Andrzej Kurek --- include/mbedtls/aria.h | 4 ---- 1 file changed, 4 deletions(-) diff --git a/include/mbedtls/aria.h b/include/mbedtls/aria.h index 9856a1cae7..d307ff9e47 100644 --- a/include/mbedtls/aria.h +++ b/include/mbedtls/aria.h @@ -274,10 +274,6 @@ int mbedtls_aria_crypt_cfb128(mbedtls_aria_context *ctx, * \brief This function performs an ARIA-CTR encryption or decryption * operation. * - * This function performs the operation defined in the \p mode - * parameter (encrypt/decrypt), on the input data buffer - * defined in the \p input parameter. - * * Due to the nature of CTR, you must use the same key schedule * for both encryption and decryption operations. Therefore, you * must use the context initialized with mbedtls_aria_setkey_enc() From a490042f1cd8ffd8db1a473450230ad7b4ae426d Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 17 Feb 2022 10:06:44 -0500 Subject: [PATCH 026/135] Fix documentation - parameter name mistakes Signed-off-by: Andrzej Kurek --- include/mbedtls/asn1.h | 4 ++-- include/mbedtls/bignum.h | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/include/mbedtls/asn1.h b/include/mbedtls/asn1.h index 540cdcc469..82aaee8f30 100644 --- a/include/mbedtls/asn1.h +++ b/include/mbedtls/asn1.h @@ -453,7 +453,7 @@ void mbedtls_asn1_sequence_free(mbedtls_asn1_sequence *seq); * on a successful invocation. * \param end The end of the ASN.1 SEQUENCE container. * \param tag_must_mask A mask to be applied to the ASN.1 tags found within - * the SEQUENCE before comparing to \p tag_must_value. + * the SEQUENCE before comparing to \p tag_must_val. * \param tag_must_val The required value of each ASN.1 tag found in the * SEQUENCE, after masking with \p tag_must_mask. * Mismatching tags lead to an error. @@ -462,7 +462,7 @@ void mbedtls_asn1_sequence_free(mbedtls_asn1_sequence *seq); * while a value of \c 0xFF for \p tag_must_mask means * that \p tag_must_val is the only allowed tag. * \param tag_may_mask A mask to be applied to the ASN.1 tags found within - * the SEQUENCE before comparing to \p tag_may_value. + * the SEQUENCE before comparing to \p tag_may_val. * \param tag_may_val The desired value of each ASN.1 tag found in the * SEQUENCE, after masking with \p tag_may_mask. * Mismatching tags will be silently ignored. diff --git a/include/mbedtls/bignum.h b/include/mbedtls/bignum.h index f66379d46a..cbed25984e 100644 --- a/include/mbedtls/bignum.h +++ b/include/mbedtls/bignum.h @@ -533,7 +533,7 @@ int mbedtls_mpi_write_file(const char *p, const mbedtls_mpi *X, * \param X The destination MPI. This must point to an initialized MPI. * \param buf The input buffer. This must be a readable buffer of length * \p buflen Bytes. - * \param buflen The length of the input buffer \p p in Bytes. + * \param buflen The length of the input buffer \p buf in Bytes. * * \return \c 0 if successful. * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -548,7 +548,7 @@ int mbedtls_mpi_read_binary(mbedtls_mpi *X, const unsigned char *buf, * \param X The destination MPI. This must point to an initialized MPI. * \param buf The input buffer. This must be a readable buffer of length * \p buflen Bytes. - * \param buflen The length of the input buffer \p p in Bytes. + * \param buflen The length of the input buffer \p buf in Bytes. * * \return \c 0 if successful. * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed. @@ -986,8 +986,8 @@ int mbedtls_mpi_gcd(mbedtls_mpi *G, const mbedtls_mpi *A, * \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if a memory allocation failed. * \return #MBEDTLS_ERR_MPI_BAD_INPUT_DATA if \p N is less than * or equal to one. - * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p has no modular inverse - * with respect to \p N. + * \return #MBEDTLS_ERR_MPI_NOT_ACCEPTABLE if \p A has no modular + * inverse with respect to \p N. */ int mbedtls_mpi_inv_mod(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *N); From 96ce1b04ead1cd9669215cbc36ebb19c12ef96d0 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 05:22:42 -0400 Subject: [PATCH 027/135] doxygen: fix parameter name typos and misused \p commands \p is reserved for function parameters. \c is used to describe other values and variables. Signed-off-by: Andrzej Kurek --- include/mbedtls/camellia.h | 2 +- include/mbedtls/cipher.h | 6 +++--- include/mbedtls/config.h | 4 ++-- include/mbedtls/ecdsa.h | 8 ++++---- include/mbedtls/ecp.h | 4 ++-- include/mbedtls/hmac_drbg.h | 8 ++++---- include/mbedtls/pk.h | 4 ++-- include/mbedtls/rsa.h | 6 +++--- include/mbedtls/ssl.h | 10 +++++----- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/include/mbedtls/camellia.h b/include/mbedtls/camellia.h index 05397d2316..b136fd2dbb 100644 --- a/include/mbedtls/camellia.h +++ b/include/mbedtls/camellia.h @@ -231,7 +231,7 @@ int mbedtls_camellia_crypt_cfb128(mbedtls_camellia_context *ctx, * *note Due to the nature of CTR mode, you should use the same * key for both encryption and decryption. In particular, calls * to this function should be preceded by a key-schedule via - * mbedtls_camellia_setkey_enc() regardless of whether \p mode + * mbedtls_camellia_setkey_enc() regardless of whether \c mode * is #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. * * \warning You must never reuse a nonce value with the same key. Doing so diff --git a/include/mbedtls/cipher.h b/include/mbedtls/cipher.h index aa155d7bf8..2a2b64a291 100644 --- a/include/mbedtls/cipher.h +++ b/include/mbedtls/cipher.h @@ -427,7 +427,7 @@ const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values(const mbedtls_ciphe const mbedtls_cipher_mode_t mode); /** - * \brief This function initializes a \p cipher_context as NONE. + * \brief This function initializes a \p ctx as NONE. * * \param ctx The context to be initialized. This must not be \c NULL. */ @@ -602,7 +602,7 @@ static inline const char *mbedtls_cipher_get_name( * \param ctx The context of the cipher. This must be initialized. * * \return The key length of the cipher in bits. - * \return #MBEDTLS_KEY_LENGTH_NONE if ctx \p has not been + * \return #MBEDTLS_KEY_LENGTH_NONE if \p ctx has not been * initialized. */ static inline int mbedtls_cipher_get_key_bitlen( @@ -779,7 +779,7 @@ int mbedtls_cipher_update(mbedtls_cipher_context_t *ctx, * \param ctx The generic cipher context. This must be initialized and * bound to a key. * \param output The buffer to write data to. This needs to be a writable - * buffer of at least \p block_size Bytes. + * buffer of at least \c block_size Bytes. * \param olen The length of the data written to the \p output buffer. * This may not be \c NULL. * diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 1381c1fd16..04acc1c343 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -1458,8 +1458,8 @@ * ); * ``` * The \c context value is initialized to 0 before the first call. - * The function must fill the \c output buffer with \p output_size bytes - * of random data and set \c *output_length to \p output_size. + * The function must fill the \c output buffer with \c output_size bytes + * of random data and set \c *output_length to \c output_size. * * Requires: MBEDTLS_PSA_CRYPTO_C * diff --git a/include/mbedtls/ecdsa.h b/include/mbedtls/ecdsa.h index e42d114c42..4e251c04a3 100644 --- a/include/mbedtls/ecdsa.h +++ b/include/mbedtls/ecdsa.h @@ -344,7 +344,7 @@ int mbedtls_ecdsa_verify(mbedtls_ecp_group *grp, * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). * \param md_alg The message digest that was used to hash the message. * \param hash The message hash to be signed. This must be a readable - * buffer of length \p blen Bytes. + * buffer of length \p hlen Bytes. * \param hlen The length of the hash \p hash in Bytes. * \param sig The buffer to which to write the signature. This must be a * writable buffer of length at least twice as large as the @@ -386,7 +386,7 @@ int mbedtls_ecdsa_write_signature(mbedtls_ecdsa_context *ctx, * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). * \param md_alg The message digest that was used to hash the message. * \param hash The message hash to be signed. This must be a readable - * buffer of length \p blen Bytes. + * buffer of length \p hlen Bytes. * \param hlen The length of the hash \p hash in Bytes. * \param sig The buffer to which to write the signature. This must be a * writable buffer of length at least twice as large as the @@ -490,7 +490,7 @@ int mbedtls_ecdsa_write_signature_det(mbedtls_ecdsa_context *ctx, * \param ctx The ECDSA context to use. This must be initialized * and have a group and public key bound to it. * \param hash The message hash that was signed. This must be a readable - * buffer of length \p size Bytes. + * buffer of length \p hlen Bytes. * \param hlen The size of the hash \p hash. * \param sig The signature to read and verify. This must be a readable * buffer of length \p slen Bytes. @@ -520,7 +520,7 @@ int mbedtls_ecdsa_read_signature(mbedtls_ecdsa_context *ctx, * \param ctx The ECDSA context to use. This must be initialized * and have a group and public key bound to it. * \param hash The message hash that was signed. This must be a readable - * buffer of length \p size Bytes. + * buffer of length \p hlen Bytes. * \param hlen The size of the hash \p hash. * \param sig The signature to read and verify. This must be a readable * buffer of length \p slen Bytes. diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h index 5402e74b00..d56069ec4e 100644 --- a/include/mbedtls/ecp.h +++ b/include/mbedtls/ecp.h @@ -1081,7 +1081,7 @@ int mbedtls_ecp_muladd_restartable( * * It only checks that the point is non-zero, has * valid coordinates and lies on the curve. It does not verify - * that it is indeed a multiple of \p G. This additional + * that it is indeed a multiple of \c G. This additional * check is computationally more expensive, is not required * by standards, and should not be necessary if the group * used has a small cofactor. In particular, it is useless for @@ -1106,7 +1106,7 @@ int mbedtls_ecp_check_pubkey(const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt); /** - * \brief This function checks that an \p mbedtls_mpi is a + * \brief This function checks that an \c mbedtls_mpi is a * valid private key for this curve. * * \note This function uses bare components rather than an diff --git a/include/mbedtls/hmac_drbg.h b/include/mbedtls/hmac_drbg.h index 3ccf61c7fd..6b2248531b 100644 --- a/include/mbedtls/hmac_drbg.h +++ b/include/mbedtls/hmac_drbg.h @@ -186,8 +186,8 @@ void mbedtls_hmac_drbg_init(mbedtls_hmac_drbg_context *ctx); * \param len The length of the personalization string. * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT * and also at most - * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len * 3 / 2 - * where \p entropy_len is the entropy length + * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len * 3 / 2 + * where \c entropy_len is the entropy length * described above. * * \return \c 0 if successful. @@ -316,8 +316,8 @@ int mbedtls_hmac_drbg_update_ret(mbedtls_hmac_drbg_context *ctx, * \param len The length of the additional data. * This must be at most #MBEDTLS_HMAC_DRBG_MAX_INPUT * and also at most - * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \p entropy_len - * where \p entropy_len is the entropy length + * #MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT - \c entropy_len + * where \c entropy_len is the entropy length * (see mbedtls_hmac_drbg_set_entropy_len()). * * \return \c 0 if successful. diff --git a/include/mbedtls/pk.h b/include/mbedtls/pk.h index ec83551368..0e9d58aec6 100644 --- a/include/mbedtls/pk.h +++ b/include/mbedtls/pk.h @@ -395,7 +395,7 @@ int mbedtls_pk_can_do(const mbedtls_pk_context *ctx, mbedtls_pk_type_t type); * * \return 0 on success (signature is valid), * #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - * signature in sig but its length is less than \p siglen, + * signature in \p sig but its length is less than \p sig_len, * or a specific error code. * * \note For RSA keys, the default padding type is PKCS#1 v1.5. @@ -459,7 +459,7 @@ int mbedtls_pk_verify_restartable(mbedtls_pk_context *ctx, * #MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can't be * used for this type of signatures, * #MBEDTLS_ERR_PK_SIG_LEN_MISMATCH if there is a valid - * signature in sig but its length is less than \p siglen, + * signature in \p sig but its length is less than \p sig_len, * or a specific error code. * * \note If hash_len is 0, then the length associated with md_alg diff --git a/include/mbedtls/rsa.h b/include/mbedtls/rsa.h index f8725ffb1e..a1d0c16e2f 100644 --- a/include/mbedtls/rsa.h +++ b/include/mbedtls/rsa.h @@ -537,7 +537,7 @@ int mbedtls_rsa_check_pub_priv(const mbedtls_rsa_context *pub, * \note This function does not handle message padding. * * \note Make sure to set \p input[0] = 0 or ensure that - * input is smaller than \p N. + * input is smaller than \c N. * * \return \c 0 on success. * \return An \c MBEDTLS_ERR_RSA_XXX error code on failure. @@ -1109,8 +1109,8 @@ int mbedtls_rsa_rsassa_pss_sign(mbedtls_rsa_context *ctx, * verification using the mode from the context. * * \note For PKCS#1 v2.1 encoding, see comments on - * mbedtls_rsa_rsassa_pss_verify() about \p md_alg and - * \p hash_id. + * mbedtls_rsa_rsassa_pss_verify() about \c md_alg and + * \c hash_id. * * \deprecated It is deprecated and discouraged to call this function * in #MBEDTLS_RSA_PRIVATE mode. Future versions of the library diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index 26e4ec400c..e3f8c8f395 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -1746,10 +1746,10 @@ void mbedtls_ssl_set_bio(mbedtls_ssl_context *ssl, * \param own_cid The address of the readable buffer holding the CID we want * the peer to use when sending encrypted messages to us. * This may be \c NULL if \p own_cid_len is \c 0. - * This parameter is unused if \p enabled is set to + * This parameter is unused if \p enable is set to * MBEDTLS_SSL_CID_DISABLED. * \param own_cid_len The length of \p own_cid. - * This parameter is unused if \p enabled is set to + * This parameter is unused if \p enable is set to * MBEDTLS_SSL_CID_DISABLED. * * \note The value of \p own_cid_len must match the value of the @@ -2573,8 +2573,8 @@ int mbedtls_ssl_session_load(mbedtls_ssl_session *session, * * \param session The session structure to be saved. * \param buf The buffer to write the serialized data to. It must be a - * writeable buffer of at least \p len bytes, or may be \c - * NULL if \p len is \c 0. + * writeable buffer of at least \p olen bytes, or may be \c + * NULL if \p olen is \c 0. * \param buf_len The number of bytes available for writing in \p buf. * \param olen The size in bytes of the data that has been or would have * been written. It must point to a valid \c size_t. @@ -2659,7 +2659,7 @@ void mbedtls_ssl_conf_ciphersuites(mbedtls_ssl_config *conf, * record headers. * * \return \c 0 on success. - * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p own_cid_len + * \return #MBEDTLS_ERR_SSL_BAD_INPUT_DATA if \p len * is too large. */ int mbedtls_ssl_conf_cid(mbedtls_ssl_config *conf, size_t len, From 0cbfbd96c163d56222fcda6f1b8e663b2e9f9056 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 18 Feb 2022 08:10:37 -0500 Subject: [PATCH 028/135] doxygen: fix misused \p commands in rsa.h Signed-off-by: Andrzej Kurek --- include/mbedtls/rsa.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/include/mbedtls/rsa.h b/include/mbedtls/rsa.h index a1d0c16e2f..37f07c0766 100644 --- a/include/mbedtls/rsa.h +++ b/include/mbedtls/rsa.h @@ -260,15 +260,15 @@ int mbedtls_rsa_import_raw(mbedtls_rsa_context *ctx, * \brief This function completes an RSA context from * a set of imported core parameters. * - * To setup an RSA public key, precisely \p N and \p E + * To setup an RSA public key, precisely \c N and \c E * must have been imported. * * To setup an RSA private key, sufficient information must * be present for the other parameters to be derivable. * * The default implementation supports the following: - *
  • Derive \p P, \p Q from \p N, \p D, \p E.
    • - *
  • Derive \p N, \p D from \p P, \p Q, \p E.
+ *
  • Derive \c P, \c Q from \c N, \c D, \c E.
    • + *
  • Derive \c N, \c D from \c P, \c Q, \c E.
* Alternative implementations need not support these. * * If this function runs successfully, it guarantees that From c00fb7f37930a6badc7a669a958d45c9ccc28f0c Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 05:29:20 -0400 Subject: [PATCH 029/135] doxygen: fix parameter name typos and misused \p commands Signed-off-by: Andrzej Kurek --- include/mbedtls/ecdsa.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/include/mbedtls/ecdsa.h b/include/mbedtls/ecdsa.h index 4e251c04a3..cbb6d32cb5 100644 --- a/include/mbedtls/ecdsa.h +++ b/include/mbedtls/ecdsa.h @@ -266,8 +266,9 @@ int mbedtls_ecdsa_sign_det(mbedtls_ecp_group *grp, mbedtls_mpi *r, * \param md_alg The hash algorithm used to hash the original data. * \param f_rng_blind The RNG function used for blinding. This must not be * \c NULL. - * \param p_rng_blind The RNG context to be passed to \p f_rng. This may be - * \c NULL if \p f_rng doesn't need a context parameter. + * \param p_rng_blind The RNG context to be passed to \p f_rng_blind. This + * may be \c NULL if \p f_rng_blind doesn't need + * a context parameter. * * \return \c 0 on success. * \return An \c MBEDTLS_ERR_ECP_XXX or \c MBEDTLS_MPI_XXX From 532ec209833236fda091c5829e9e6d7c2f51fbba Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Sat, 6 May 2023 09:57:40 -0400 Subject: [PATCH 030/135] doxygen: \p commands misuse - review comments Apply comments suggested in review. Signed-off-by: Andrzej Kurek --- include/mbedtls/camellia.h | 2 +- include/mbedtls/cipher.h | 2 +- include/mbedtls/ssl.h | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/include/mbedtls/camellia.h b/include/mbedtls/camellia.h index b136fd2dbb..e840947d4b 100644 --- a/include/mbedtls/camellia.h +++ b/include/mbedtls/camellia.h @@ -231,7 +231,7 @@ int mbedtls_camellia_crypt_cfb128(mbedtls_camellia_context *ctx, * *note Due to the nature of CTR mode, you should use the same * key for both encryption and decryption. In particular, calls * to this function should be preceded by a key-schedule via - * mbedtls_camellia_setkey_enc() regardless of whether \c mode + * mbedtls_camellia_setkey_enc() regardless of whether the mode * is #MBEDTLS_CAMELLIA_ENCRYPT or #MBEDTLS_CAMELLIA_DECRYPT. * * \warning You must never reuse a nonce value with the same key. Doing so diff --git a/include/mbedtls/cipher.h b/include/mbedtls/cipher.h index 2a2b64a291..56fc2d828a 100644 --- a/include/mbedtls/cipher.h +++ b/include/mbedtls/cipher.h @@ -779,7 +779,7 @@ int mbedtls_cipher_update(mbedtls_cipher_context_t *ctx, * \param ctx The generic cipher context. This must be initialized and * bound to a key. * \param output The buffer to write data to. This needs to be a writable - * buffer of at least \c block_size Bytes. + * buffer of at least block_size Bytes. * \param olen The length of the data written to the \p output buffer. * This may not be \c NULL. * diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index e3f8c8f395..e07da11596 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -2573,8 +2573,8 @@ int mbedtls_ssl_session_load(mbedtls_ssl_session *session, * * \param session The session structure to be saved. * \param buf The buffer to write the serialized data to. It must be a - * writeable buffer of at least \p olen bytes, or may be \c - * NULL if \p olen is \c 0. + * writeable buffer of at least \p buf_len bytes, or may be \c + * NULL if \p buf_len is \c 0. * \param buf_len The number of bytes available for writing in \p buf. * \param olen The size in bytes of the data that has been or would have * been written. It must point to a valid \c size_t. From db54dbdc56941d84bb4006086e8bd8582f76c42d Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 05:35:38 -0400 Subject: [PATCH 031/135] Fix \p misuses in documentation Signed-off-by: Andrzej Kurek --- include/mbedtls/ecdsa.h | 2 +- include/mbedtls/x509_crt.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/mbedtls/ecdsa.h b/include/mbedtls/ecdsa.h index cbb6d32cb5..b7029d7d56 100644 --- a/include/mbedtls/ecdsa.h +++ b/include/mbedtls/ecdsa.h @@ -454,7 +454,7 @@ int mbedtls_ecdsa_write_signature_restartable(mbedtls_ecdsa_context *ctx, * and have a group and private key bound to it, for example * via mbedtls_ecdsa_genkey() or mbedtls_ecdsa_from_keypair(). * \param hash The message hash to be signed. This must be a readable - * buffer of length \p blen Bytes. + * buffer of length \p hlen Bytes. * \param hlen The length of the hash \p hash in Bytes. * \param sig The buffer to which to write the signature. This must be a * writable buffer of length at least twice as large as the diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h index 466611f797..d436635a5e 100644 --- a/include/mbedtls/x509_crt.h +++ b/include/mbedtls/x509_crt.h @@ -509,7 +509,7 @@ int mbedtls_x509_crt_parse_path(mbedtls_x509_crt *chain, const char *path); * \param san_buf The buffer holding the raw data item of the subject * alternative name. * \param san The target structure to populate with the parsed presentation - * of the subject alternative name encoded in \p san_raw. + * of the subject alternative name encoded in \p san_buf. * * \note Only "dnsName" and "otherName" of type hardware_module_name * as defined in RFC 4180 is supported. @@ -517,7 +517,7 @@ int mbedtls_x509_crt_parse_path(mbedtls_x509_crt *chain, const char *path); * \note This function should be called on a single raw data of * subject alternative name. For example, after successful * certificate parsing, one must iterate on every item in the - * \p crt->subject_alt_names sequence, and pass it to + * \c crt->subject_alt_names sequence, and pass it to * this function. * * \warning The target structure contains pointers to the raw data of the From dc11cd166897118db1f7b5f96339bef3ea6a8eaf Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 09:47:05 -0400 Subject: [PATCH 032/135] Extend mbedtls_calloc and mbedtls_free documentation Co-authored-by: Gilles Peskine Signed-off-by: Andrzej Kurek --- include/mbedtls/config.h | 23 +++++++++++++++++++---- include/mbedtls/platform.h | 3 ++- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index be6ad83cb6..aaa150833a 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -3798,8 +3798,23 @@ /* Platform options */ //#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ -//#define MBEDTLS_PLATFORM_STD_CALLOC calloc /**< Default allocator to use, can be undefined. Please note that it should zeroize the allocated buffer. */ -//#define MBEDTLS_PLATFORM_STD_FREE free /**< Default free to use, can be undefined */ +/** \def MBEDTLS_PLATFORM_STD_CALLOC + * + * Default allocator to use, can be undefined. + * It should initialize the allocated buffer memory to zeroes. + * The size of the buffer is the product of the two parameters. + * The behavior is undefined if the product of the two parameters overflows size_t. + * If the product is 0, the function may either return NULL or a valid pointer to an array of size 0 which is a valid input to the deallocation function. + * The corresponding deallocation function is MBEDTLS_PLATFORM_STD_FREE. + */ +//#define MBEDTLS_PLATFORM_STD_CALLOC calloc +/** \def MBEDTLS_PLATFORM_STD_FREE + * + * Default free to use, can be undefined. + * NULL is a valid parameter, and the function must do nothing. + * A non-null parameter will always be a pointer previously returned by MBEDTLS_PLATFORM_STD_CALLOC and not yet freed. + */ +//#define MBEDTLS_PLATFORM_STD_FREE free //#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ //#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */ @@ -3814,8 +3829,8 @@ /* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */ /* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ -//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined */ -//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined */ +//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_CALLOC for requirements. */ +//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_FREE for requirements. */ //#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ //#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ //#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ diff --git a/include/mbedtls/platform.h b/include/mbedtls/platform.h index 121ba3ad73..08c0172e00 100644 --- a/include/mbedtls/platform.h +++ b/include/mbedtls/platform.h @@ -140,7 +140,8 @@ extern "C" { /* * The function pointers for calloc and free. - * mbedtls_calloc will allocate and zeroize the buffer. + * please see MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE + * in mbedtls_config.h for more information about behaviour and requirements. */ #if defined(MBEDTLS_PLATFORM_MEMORY) #if defined(MBEDTLS_PLATFORM_FREE_MACRO) && \ From 5ffea9dc77a676b8d8dbe43cfc2fee2cad398ac0 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 09:53:08 -0400 Subject: [PATCH 033/135] Rework the calloc buffer initialization test in selftest.c This way it's more in line with development. Signed-off-by: Andrzej Kurek --- programs/test/selftest.c | 68 ++++++++++++++++++++++++---------------- 1 file changed, 41 insertions(+), 27 deletions(-) diff --git a/programs/test/selftest.c b/programs/test/selftest.c index 3adf2e55da..be97a586fa 100644 --- a/programs/test/selftest.c +++ b/programs/test/selftest.c @@ -77,23 +77,49 @@ static int calloc_self_test(int verbose) void *empty2 = mbedtls_calloc(0, 1); void *buffer1 = mbedtls_calloc(1, 1); void *buffer2 = mbedtls_calloc(1, 1); + unsigned int buf_size = 256; + unsigned char *buffer3 = mbedtls_calloc(buf_size, sizeof(unsigned char)); if (empty1 == NULL && empty2 == NULL) { if (verbose) { - mbedtls_printf(" CALLOC(0): passed (NULL)\n"); + mbedtls_printf(" CALLOC(0,1): passed (NULL)\n"); } } else if (empty1 == NULL || empty2 == NULL) { if (verbose) { - mbedtls_printf(" CALLOC(0): failed (mix of NULL and non-NULL)\n"); + mbedtls_printf(" CALLOC(0,1): failed (mix of NULL and non-NULL)\n"); } ++failures; } else if (empty1 == empty2) { if (verbose) { - mbedtls_printf(" CALLOC(0): passed (same non-null)\n"); + mbedtls_printf(" CALLOC(0,1): passed (same non-null)\n"); } } else { if (verbose) { - mbedtls_printf(" CALLOC(0): passed (distinct non-null)\n"); + mbedtls_printf(" CALLOC(0,1): passed (distinct non-null)\n"); + } + } + + mbedtls_free(empty1); + mbedtls_free(empty2); + + empty1 = mbedtls_calloc(1, 0); + empty2 = mbedtls_calloc(1, 0); + if (empty1 == NULL && empty2 == NULL) { + if (verbose) { + mbedtls_printf(" CALLOC(1,0): passed (NULL)\n"); + } + } else if (empty1 == NULL || empty2 == NULL) { + if (verbose) { + mbedtls_printf(" CALLOC(1,0): failed (mix of NULL and non-NULL)\n"); + } + ++failures; + } else if (empty1 == empty2) { + if (verbose) { + mbedtls_printf(" CALLOC(1,0): passed (same non-null)\n"); + } + } else { + if (verbose) { + mbedtls_printf(" CALLOC(1,0): passed (distinct non-null)\n"); } } @@ -126,6 +152,16 @@ static int calloc_self_test(int verbose) } } + for (unsigned int i = 0; i < buf_size; i++) { + if (buffer3[i] != 0) { + ++failures; + if (verbose) { + mbedtls_printf(" CALLOC(%u): failed (memory not initialized to 0)\n", buf_size); + } + break; + } + } + if (verbose) { mbedtls_printf("\n"); } @@ -133,6 +169,7 @@ static int calloc_self_test(int verbose) mbedtls_free(empty2); mbedtls_free(buffer1); mbedtls_free(buffer2); + mbedtls_free(buffer3); return failures; } #endif /* MBEDTLS_SELF_TEST */ @@ -167,23 +204,6 @@ static int run_test_snprintf(void) test_snprintf(5, "123", 3) != 0; } -static int run_test_mbedtls_calloc(void) -{ - unsigned int buf_size = 256; - unsigned char *buf; - int ret = -1; - buf = mbedtls_calloc(buf_size, sizeof(unsigned char)); - for (unsigned int i = 0; i < buf_size; i++) { - if (buf[i] != 0) { - ret = -1; - goto exit; - } - } - ret = 0; -exit: - mbedtls_free(buf); - return ret; -} /* * Check if a seed file is present, and if not create one for the entropy * self-test. If this fails, we attempt the test anyway, so no error is passed @@ -393,12 +413,6 @@ int main(int argc, char *argv[]) mbedtls_exit(MBEDTLS_EXIT_FAILURE); } - /* Make sure that mbedtls_calloc zeroizes the buffer */ - if (run_test_mbedtls_calloc() != 0) { - mbedtls_printf("the calloc implementation does not zeroize the buffer\n"); - mbedtls_exit(MBEDTLS_EXIT_FAILURE); - } - for (argp = argv + (argc >= 1 ? 1 : argc); *argp != NULL; ++argp) { if (strcmp(*argp, "--quiet") == 0 || strcmp(*argp, "-q") == 0) { From ba16859cc67a27710f638d376237cb880dbb667e Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 09:56:02 -0400 Subject: [PATCH 034/135] Documentation and cosmetic fixes Signed-off-by: Andrzej Kurek --- include/mbedtls/config.h | 10 +++++----- include/mbedtls/platform.h | 2 +- programs/test/selftest.c | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index aaa150833a..218bf484af 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -3801,18 +3801,18 @@ /** \def MBEDTLS_PLATFORM_STD_CALLOC * * Default allocator to use, can be undefined. - * It should initialize the allocated buffer memory to zeroes. + * It must initialize the allocated buffer memory to zeroes. * The size of the buffer is the product of the two parameters. - * The behavior is undefined if the product of the two parameters overflows size_t. + * The calloc function returns either a null pointer or a pointer to the allocated space. * If the product is 0, the function may either return NULL or a valid pointer to an array of size 0 which is a valid input to the deallocation function. - * The corresponding deallocation function is MBEDTLS_PLATFORM_STD_FREE. + * The corresponding deallocation function is #MBEDTLS_PLATFORM_STD_FREE. */ //#define MBEDTLS_PLATFORM_STD_CALLOC calloc /** \def MBEDTLS_PLATFORM_STD_FREE * * Default free to use, can be undefined. * NULL is a valid parameter, and the function must do nothing. - * A non-null parameter will always be a pointer previously returned by MBEDTLS_PLATFORM_STD_CALLOC and not yet freed. + * A non-null parameter will always be a pointer previously returned by #MBEDTLS_PLATFORM_STD_CALLOC and not yet freed. */ //#define MBEDTLS_PLATFORM_STD_FREE free //#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ @@ -3827,7 +3827,7 @@ //#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ //#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */ -/* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */ +/* To use the following function macros, MBEDTLS_PLATFORM_C must be enabled. */ /* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ //#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_CALLOC for requirements. */ //#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_FREE for requirements. */ diff --git a/include/mbedtls/platform.h b/include/mbedtls/platform.h index 08c0172e00..5e2e490de5 100644 --- a/include/mbedtls/platform.h +++ b/include/mbedtls/platform.h @@ -140,7 +140,7 @@ extern "C" { /* * The function pointers for calloc and free. - * please see MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE + * Please see MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE * in mbedtls_config.h for more information about behaviour and requirements. */ #if defined(MBEDTLS_PLATFORM_MEMORY) diff --git a/programs/test/selftest.c b/programs/test/selftest.c index be97a586fa..1c6f50b684 100644 --- a/programs/test/selftest.c +++ b/programs/test/selftest.c @@ -78,7 +78,7 @@ static int calloc_self_test(int verbose) void *buffer1 = mbedtls_calloc(1, 1); void *buffer2 = mbedtls_calloc(1, 1); unsigned int buf_size = 256; - unsigned char *buffer3 = mbedtls_calloc(buf_size, sizeof(unsigned char)); + unsigned char *buffer3 = mbedtls_calloc(buf_size, 1); if (empty1 == NULL && empty2 == NULL) { if (verbose) { From c8bf05954bc86fd39cf03ce35c6e6c79f1d41cca Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Thu, 4 May 2023 17:29:55 -0400 Subject: [PATCH 035/135] Add a calloc selftest for more than a page Signed-off-by: Andrzej Kurek --- programs/test/selftest.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/programs/test/selftest.c b/programs/test/selftest.c index 1c6f50b684..f45eb8539a 100644 --- a/programs/test/selftest.c +++ b/programs/test/selftest.c @@ -77,8 +77,10 @@ static int calloc_self_test(int verbose) void *empty2 = mbedtls_calloc(0, 1); void *buffer1 = mbedtls_calloc(1, 1); void *buffer2 = mbedtls_calloc(1, 1); - unsigned int buf_size = 256; - unsigned char *buffer3 = mbedtls_calloc(buf_size, 1); + unsigned int buffer_3_size = 256; + unsigned int buffer_4_size = 4097; /* Allocate more than the usual page size */ + unsigned char *buffer3 = mbedtls_calloc(buffer_3_size, 1); + unsigned char *buffer4 = mbedtls_calloc(buffer_4_size, 1); if (empty1 == NULL && empty2 == NULL) { if (verbose) { @@ -152,11 +154,23 @@ static int calloc_self_test(int verbose) } } - for (unsigned int i = 0; i < buf_size; i++) { + for (unsigned int i = 0; i < buffer_3_size; i++) { if (buffer3[i] != 0) { ++failures; if (verbose) { - mbedtls_printf(" CALLOC(%u): failed (memory not initialized to 0)\n", buf_size); + mbedtls_printf(" CALLOC(%u): failed (memory not initialized to 0)\n", + buffer_3_size); + } + break; + } + } + + for (unsigned int i = 0; i < buffer_4_size; i++) { + if (buffer4[i] != 0) { + ++failures; + if (verbose) { + mbedtls_printf(" CALLOC(%u): failed (memory not initialized to 0)\n", + buffer_4_size); } break; } @@ -170,6 +184,7 @@ static int calloc_self_test(int verbose) mbedtls_free(buffer1); mbedtls_free(buffer2); mbedtls_free(buffer3); + mbedtls_free(buffer4); return failures; } #endif /* MBEDTLS_SELF_TEST */ From c83d49ebc270ff38589dc8e891071b8b1efdfc95 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 09:58:17 -0400 Subject: [PATCH 036/135] Add a description of how mbedtls_calloc is determined Signed-off-by: Andrzej Kurek --- include/mbedtls/config.h | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 218bf484af..3792c9b7d2 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -3798,9 +3798,39 @@ /* Platform options */ //#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ + +/* An overview of how the value of mbedtls_calloc is determined: + * + * if !MBEDTLS_PLATFORM_MEMORY + * mbedtls_calloc = calloc + * if MBEDTLS_PLATFORM_MEMORY + * if (MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): + * mbedtls_calloc = MBEDTLS_PLATFORM_CALLOC_MACRO + * if !(MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): + * Dynamic setup via mbedtls_platform_set_calloc_free is now possible with a default value MBEDTLS_PLATFORM_STD_CALLOC. + * How is MBEDTLS_PLATFORM_STD_CALLOC handled? + * if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: + * MBEDTLS_PLATFORM_STD_CALLOC is not set to anything; + * MBEDTLS_PLATFORM_STD_MEM_HDR can be included if present; + * if !MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: + * if MBEDTLS_PLATFORM_STD_CALLOC is present: + * User-defined MBEDTLS_PLATFORM_STD_CALLOC is respected; + * if !MBEDTLS_PLATFORM_STD_CALLOC: + * MBEDTLS_PLATFORM_STD_CALLOC = calloc + * + * At this point the presence of MBEDTLS_PLATFORM_STD_CALLOC is checked. + * if !MBEDTLS_PLATFORM_STD_CALLOC + * MBEDTLS_PLATFORM_STD_CALLOC = uninitialized_calloc + * + * mbedtls_calloc = MBEDTLS_PLATFORM_STD_CALLOC. + * + * Defining MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible. + * MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time. + * MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. + */ /** \def MBEDTLS_PLATFORM_STD_CALLOC * - * Default allocator to use, can be undefined. + * Default allocator to use, can be undefined. See the description above for details. * It must initialize the allocated buffer memory to zeroes. * The size of the buffer is the product of the two parameters. * The calloc function returns either a null pointer or a pointer to the allocated space. From 8ca66a0795fa5581e5238b808f0a717078061225 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 10:01:10 -0400 Subject: [PATCH 037/135] Add an mbedtls_calloc(SIZE_MAX/2, SIZE_MAX/2) test It should return NULL and not a valid pointer. Signed-off-by: Andrzej Kurek --- include/mbedtls/config.h | 5 +++-- programs/test/selftest.c | 13 ++++++++++++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 3792c9b7d2..7e73c6229f 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -3826,7 +3826,8 @@ * * Defining MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible. * MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time. - * MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. + * MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, + * dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. */ /** \def MBEDTLS_PLATFORM_STD_CALLOC * @@ -3840,7 +3841,7 @@ //#define MBEDTLS_PLATFORM_STD_CALLOC calloc /** \def MBEDTLS_PLATFORM_STD_FREE * - * Default free to use, can be undefined. + * Default free to use, can be undefined. See the description above for more details (same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply). * NULL is a valid parameter, and the function must do nothing. * A non-null parameter will always be a pointer previously returned by #MBEDTLS_PLATFORM_STD_CALLOC and not yet freed. */ diff --git a/programs/test/selftest.c b/programs/test/selftest.c index f45eb8539a..68c712dcc5 100644 --- a/programs/test/selftest.c +++ b/programs/test/selftest.c @@ -81,7 +81,10 @@ static int calloc_self_test(int verbose) unsigned int buffer_4_size = 4097; /* Allocate more than the usual page size */ unsigned char *buffer3 = mbedtls_calloc(buffer_3_size, 1); unsigned char *buffer4 = mbedtls_calloc(buffer_4_size, 1); - +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Walloc-size-larger-than=" + unsigned char *buffer5 = mbedtls_calloc(SIZE_MAX/2, SIZE_MAX/2); +#pragma GCC diagnostic pop if (empty1 == NULL && empty2 == NULL) { if (verbose) { mbedtls_printf(" CALLOC(0,1): passed (NULL)\n"); @@ -176,6 +179,13 @@ static int calloc_self_test(int verbose) } } + if (buffer5 != NULL) { + ++failures; + if (verbose) { + mbedtls_printf(" CALLOC(SIZE_MAX/2, SIZE_MAX/2): failed (returned a valid pointer)\n"); + } + } + if (verbose) { mbedtls_printf("\n"); } @@ -185,6 +195,7 @@ static int calloc_self_test(int verbose) mbedtls_free(buffer2); mbedtls_free(buffer3); mbedtls_free(buffer4); + mbedtls_free(buffer5); return failures; } #endif /* MBEDTLS_SELF_TEST */ From f35490e7af248a3624c20a8d913b5c68b13e0bed Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 10:12:11 -0400 Subject: [PATCH 038/135] Move the overallocation test to test suites This way the compiler does not complain about an overly large allocation made. Signed-off-by: Andrzej Kurek --- programs/test/selftest.c | 13 +------------ tests/suites/test_suite_debug.data | 3 +++ tests/suites/test_suite_debug.function | 12 ++++++++++++ 3 files changed, 16 insertions(+), 12 deletions(-) diff --git a/programs/test/selftest.c b/programs/test/selftest.c index 68c712dcc5..f45eb8539a 100644 --- a/programs/test/selftest.c +++ b/programs/test/selftest.c @@ -81,10 +81,7 @@ static int calloc_self_test(int verbose) unsigned int buffer_4_size = 4097; /* Allocate more than the usual page size */ unsigned char *buffer3 = mbedtls_calloc(buffer_3_size, 1); unsigned char *buffer4 = mbedtls_calloc(buffer_4_size, 1); -#pragma GCC diagnostic push -#pragma GCC diagnostic ignored "-Walloc-size-larger-than=" - unsigned char *buffer5 = mbedtls_calloc(SIZE_MAX/2, SIZE_MAX/2); -#pragma GCC diagnostic pop + if (empty1 == NULL && empty2 == NULL) { if (verbose) { mbedtls_printf(" CALLOC(0,1): passed (NULL)\n"); @@ -179,13 +176,6 @@ static int calloc_self_test(int verbose) } } - if (buffer5 != NULL) { - ++failures; - if (verbose) { - mbedtls_printf(" CALLOC(SIZE_MAX/2, SIZE_MAX/2): failed (returned a valid pointer)\n"); - } - } - if (verbose) { mbedtls_printf("\n"); } @@ -195,7 +185,6 @@ static int calloc_self_test(int verbose) mbedtls_free(buffer2); mbedtls_free(buffer3); mbedtls_free(buffer4); - mbedtls_free(buffer5); return failures; } #endif /* MBEDTLS_SELF_TEST */ diff --git a/tests/suites/test_suite_debug.data b/tests/suites/test_suite_debug.data index 0092774ee0..59526238f1 100644 --- a/tests/suites/test_suite_debug.data +++ b/tests/suites/test_suite_debug.data @@ -65,3 +65,6 @@ mbedtls_debug_print_crt:"data_files/server1.crt":"MyFile":999:"PREFIX_":"MyFile( Debug print certificate #2 (EC) depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_BASE64_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_SHA256_C mbedtls_debug_print_crt:"data_files/test-ca2.crt":"MyFile":999:"PREFIX_":"MyFile(0999)\: PREFIX_ #1\:\nMyFile(0999)\: cert. version \: 3\nMyFile(0999)\: serial number \: C1\:43\:E2\:7E\:62\:43\:CC\:E8\nMyFile(0999)\: issuer name \: C=NL, O=PolarSSL, CN=Polarssl Test EC CA\nMyFile(0999)\: subject name \: C=NL, O=PolarSSL, CN=Polarssl Test EC CA\nMyFile(0999)\: issued on \: 2019-02-10 14\:44\:00\nMyFile(0999)\: expires on \: 2029-02-10 14\:44\:00\nMyFile(0999)\: signed using \: ECDSA with SHA256\nMyFile(0999)\: EC key size \: 384 bits\nMyFile(0999)\: basic constraints \: CA=true\nMyFile(0999)\: value of 'crt->eckey.Q(X)' (384 bits) is\:\nMyFile(0999)\: c3 da 2b 34 41 37 58 2f 87 56 fe fc 89 ba 29 43\nMyFile(0999)\: 4b 4e e0 6e c3 0e 57 53 33 39 58 d4 52 b4 91 95\nMyFile(0999)\: 39 0b 23 df 5f 17 24 62 48 fc 1a 95 29 ce 2c 2d\nMyFile(0999)\: value of 'crt->eckey.Q(Y)' (384 bits) is\:\nMyFile(0999)\: 87 c2 88 52 80 af d6 6a ab 21 dd b8 d3 1c 6e 58\nMyFile(0999)\: b8 ca e8 b2 69 8e f3 41 ad 29 c3 b4 5f 75 a7 47\nMyFile(0999)\: 6f d5 19 29 55 69 9a 53 3b 20 b4 66 16 60 33 1e\n" + +Check mbedtls_calloc overallocation +check_mbedtls_calloc_overallocation:SIZE_MAX/2:SIZE_MAX/2 diff --git a/tests/suites/test_suite_debug.function b/tests/suites/test_suite_debug.function index cbb3a63f1a..227586687e 100644 --- a/tests/suites/test_suite_debug.function +++ b/tests/suites/test_suite_debug.function @@ -195,3 +195,15 @@ exit: mbedtls_ssl_config_free(&conf); } /* END_CASE */ + +/* BEGIN_CASE */ +void check_mbedtls_calloc_overallocation(int num, int size) +{ + unsigned char *buf; + buf = mbedtls_calloc((size_t) num, (size_t) size); + TEST_ASSERT(buf == NULL); + +exit: + mbedtls_free(buf); +} +/* END_CASE */ From d95b8edf29f476a2239f83edcb075df9a3041c93 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Tue, 27 Jun 2023 10:02:09 -0400 Subject: [PATCH 039/135] Disable asan errors on null allocation in all.sh Such error was raised in platform tests, and it's a valid test case. Signed-off-by: Andrzej Kurek --- tests/scripts/all.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 87defc0ce8..8356ab978e 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -188,6 +188,9 @@ pre_initialize_variables () { # default to -O2, use -Ox _after_ this if you want another level ASAN_CFLAGS='-O2 -Werror -fsanitize=address,undefined -fno-sanitize-recover=all' + # Platform tests have an allocation that returns null + export ASAN_OPTIONS="allocator_may_return_null=1" + # Gather the list of available components. These are the functions # defined in this script whose name starts with "component_". # Parse the script with sed. This way we get the functions in the order From 33b1222c88d953b50b7f99609356df7ad88b7070 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 10:14:29 -0400 Subject: [PATCH 040/135] Enable certain documented defines only when generating doxygen Avoid an "unrecognized define" error. Signed-off-by: Andrzej Kurek --- doxygen/mbedtls.doxyfile | 1 + include/mbedtls/config.h | 2 ++ include/mbedtls/platform.h | 9 +++++++++ 3 files changed, 12 insertions(+) diff --git a/doxygen/mbedtls.doxyfile b/doxygen/mbedtls.doxyfile index 78299ed5bf..6cb51132e1 100644 --- a/doxygen/mbedtls.doxyfile +++ b/doxygen/mbedtls.doxyfile @@ -51,4 +51,5 @@ PREDEFINED = "MBEDTLS_CHECK_RETURN_CRITICAL=" \ "MBEDTLS_CHECK_RETURN_TYPICAL=" \ "MBEDTLS_CHECK_RETURN_OPTIONAL=" \ "MBEDTLS_PRINTF_ATTRIBUTE(a,b)=" \ + "__DOXYGEN__" \ diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 7e73c6229f..9cd833b783 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -3829,6 +3829,7 @@ * MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, * dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. */ + /** \def MBEDTLS_PLATFORM_STD_CALLOC * * Default allocator to use, can be undefined. See the description above for details. @@ -3839,6 +3840,7 @@ * The corresponding deallocation function is #MBEDTLS_PLATFORM_STD_FREE. */ //#define MBEDTLS_PLATFORM_STD_CALLOC calloc + /** \def MBEDTLS_PLATFORM_STD_FREE * * Default free to use, can be undefined. See the description above for more details (same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply). diff --git a/include/mbedtls/platform.h b/include/mbedtls/platform.h index 5e2e490de5..5d4e69eeb5 100644 --- a/include/mbedtls/platform.h +++ b/include/mbedtls/platform.h @@ -135,6 +135,15 @@ extern "C" { #endif #endif /* MBEDTLS_PLATFORM_NO_STD_FUNCTIONS */ +/* Enable certain documented defines only when generating doxygen to avoid + * an "unrecognized define" error. */ +#if defined(__DOXYGEN__) && !defined(MBEDTLS_PLATFORM_STD_CALLOC) +#define MBEDTLS_PLATFORM_STD_CALLOC +#endif + +#if defined(__DOXYGEN__) && !defined(MBEDTLS_PLATFORM_STD_FREE) +#define MBEDTLS_PLATFORM_STD_FREE +#endif /** \} name SECTION: Module settings */ From f1e61fcb09352c40080ea84f158ce5ee4b4297fd Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 10:16:00 -0400 Subject: [PATCH 041/135] Add a dummy usage of a pointer in tests This way clang with O1 doesn't optimize it. Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_debug.function | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/suites/test_suite_debug.function b/tests/suites/test_suite_debug.function index 227586687e..617dd8885a 100644 --- a/tests/suites/test_suite_debug.function +++ b/tests/suites/test_suite_debug.function @@ -201,6 +201,8 @@ void check_mbedtls_calloc_overallocation(int num, int size) { unsigned char *buf; buf = mbedtls_calloc((size_t) num, (size_t) size); + /* Dummy usage of the pointer to prevent optimizing it */ + mbedtls_printf("calloc pointer : %p\n", buf); TEST_ASSERT(buf == NULL); exit: From 6e4a9beb2bb4e88c3a6d3f426b454ac252e42bf5 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Wed, 5 Jul 2023 08:32:43 -0400 Subject: [PATCH 042/135] Disable msan errors on null allocation in all.sh Such error was raised in platform tests, and it's a valid test case. Signed-off-by: Andrzej Kurek --- tests/scripts/all.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 8356ab978e..fb929b1c0d 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -190,6 +190,7 @@ pre_initialize_variables () { # Platform tests have an allocation that returns null export ASAN_OPTIONS="allocator_may_return_null=1" + export MSAN_OPTIONS="allocator_may_return_null=1" # Gather the list of available components. These are the functions # defined in this script whose name starts with "component_". From 710e54e2d61f78b1491c5a50e30b9d3d5780be13 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 10:17:32 -0400 Subject: [PATCH 043/135] Add msan and asan env variables to .travis.yml This way the CI tests don't fail on a null allocation. Signed-off-by: Andrzej Kurek --- .travis.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.travis.yml b/.travis.yml index ada8fc5c67..0ffe249a53 100644 --- a/.travis.yml +++ b/.travis.yml @@ -34,6 +34,10 @@ jobs: packages: - clang-10 - gnutls-bin + env: + # Platform tests have an allocation that returns null + - ASAN_OPTIONS="allocator_may_return_null=1" + - MSAN_OPTIONS="allocator_may_return_null=1" script: # Do a manual build+test sequence rather than using all.sh, # because there's no all.sh component that does what we want, From 3f87d63c71ca443a17ce6dd5b41af33ed78d22bf Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 10:22:34 -0400 Subject: [PATCH 044/135] Improve the documentation of MBEDTLS_PLATFORM_MEMORY Introduce requests from review comments. Signed-off-by: Andrzej Kurek --- include/mbedtls/config.h | 75 +++++++++++++++++++++------------------- 1 file changed, 40 insertions(+), 35 deletions(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 9cd833b783..4651e267c3 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -167,15 +167,47 @@ * This allows different allocators (self-implemented or provided) to be * provided to the platform abstraction layer. * - * Enabling MBEDTLS_PLATFORM_MEMORY without the + * Enabling #MBEDTLS_PLATFORM_MEMORY without the * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and * free() function pointer at runtime. * - * Enabling MBEDTLS_PLATFORM_MEMORY and specifying + * Enabling #MBEDTLS_PLATFORM_MEMORY and specifying * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the * alternate function at compile time. * + * An overview of how the value of mbedtls_calloc is determined: + * + * - if !MBEDTLS_PLATFORM_MEMORY + * - mbedtls_calloc = calloc + * - if MBEDTLS_PLATFORM_MEMORY + * - if (MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): + * - mbedtls_calloc = MBEDTLS_PLATFORM_CALLOC_MACRO + * - if !(MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): + * - Dynamic setup via mbedtls_platform_set_calloc_free is now possible with a default value MBEDTLS_PLATFORM_STD_CALLOC. + * - How is MBEDTLS_PLATFORM_STD_CALLOC handled? + * - if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: + * - MBEDTLS_PLATFORM_STD_CALLOC is not set to anything; + * - MBEDTLS_PLATFORM_STD_MEM_HDR can be included if present; + * - if !MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: + * - if MBEDTLS_PLATFORM_STD_CALLOC is present: + * - User-defined MBEDTLS_PLATFORM_STD_CALLOC is respected; + * - if !MBEDTLS_PLATFORM_STD_CALLOC: + * - MBEDTLS_PLATFORM_STD_CALLOC = calloc + * + * - At this point the presence of MBEDTLS_PLATFORM_STD_CALLOC is checked. + * - if !MBEDTLS_PLATFORM_STD_CALLOC + * - MBEDTLS_PLATFORM_STD_CALLOC = uninitialized_calloc + * + * - mbedtls_calloc = MBEDTLS_PLATFORM_STD_CALLOC. + * + * Defining MBEDTLS_PLATFORM_CALLOC_MACRO and #MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible. + * MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time. + * #MBEDTLS_PLATFORM_STD_CALLOC and #MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, + * dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. + * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer. + * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything. + * * Requires: MBEDTLS_PLATFORM_C * * Enable this layer to allow use of alternative memory allocators. @@ -3799,53 +3831,26 @@ /* Platform options */ //#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ -/* An overview of how the value of mbedtls_calloc is determined: - * - * if !MBEDTLS_PLATFORM_MEMORY - * mbedtls_calloc = calloc - * if MBEDTLS_PLATFORM_MEMORY - * if (MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): - * mbedtls_calloc = MBEDTLS_PLATFORM_CALLOC_MACRO - * if !(MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): - * Dynamic setup via mbedtls_platform_set_calloc_free is now possible with a default value MBEDTLS_PLATFORM_STD_CALLOC. - * How is MBEDTLS_PLATFORM_STD_CALLOC handled? - * if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: - * MBEDTLS_PLATFORM_STD_CALLOC is not set to anything; - * MBEDTLS_PLATFORM_STD_MEM_HDR can be included if present; - * if !MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: - * if MBEDTLS_PLATFORM_STD_CALLOC is present: - * User-defined MBEDTLS_PLATFORM_STD_CALLOC is respected; - * if !MBEDTLS_PLATFORM_STD_CALLOC: - * MBEDTLS_PLATFORM_STD_CALLOC = calloc - * - * At this point the presence of MBEDTLS_PLATFORM_STD_CALLOC is checked. - * if !MBEDTLS_PLATFORM_STD_CALLOC - * MBEDTLS_PLATFORM_STD_CALLOC = uninitialized_calloc - * - * mbedtls_calloc = MBEDTLS_PLATFORM_STD_CALLOC. - * - * Defining MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible. - * MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time. - * MBEDTLS_PLATFORM_STD_CALLOC and MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, - * dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. - */ - /** \def MBEDTLS_PLATFORM_STD_CALLOC * - * Default allocator to use, can be undefined. See the description above for details. + * Default allocator to use, can be undefined. * It must initialize the allocated buffer memory to zeroes. * The size of the buffer is the product of the two parameters. * The calloc function returns either a null pointer or a pointer to the allocated space. * If the product is 0, the function may either return NULL or a valid pointer to an array of size 0 which is a valid input to the deallocation function. + * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer. + * See the description of #MBEDTLS_PLATFORM_MEMORY for more details. * The corresponding deallocation function is #MBEDTLS_PLATFORM_STD_FREE. */ //#define MBEDTLS_PLATFORM_STD_CALLOC calloc /** \def MBEDTLS_PLATFORM_STD_FREE * - * Default free to use, can be undefined. See the description above for more details (same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply). + * Default free to use, can be undefined. * NULL is a valid parameter, and the function must do nothing. * A non-null parameter will always be a pointer previously returned by #MBEDTLS_PLATFORM_STD_CALLOC and not yet freed. + * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything. + * See the description of #MBEDTLS_PLATFORM_MEMORY for more details (same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply). */ //#define MBEDTLS_PLATFORM_STD_FREE free //#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ From 0841b5a17832ea5adb5492be8a5ca976cc9146a2 Mon Sep 17 00:00:00 2001 From: Andrzej Kurek Date: Fri, 14 Jul 2023 15:16:35 -0400 Subject: [PATCH 045/135] Add a workaround for max test suite parameter sizes int isn't enough for SIZE_MAX/2. Hardcoding the value will make the compilers complain. Signed-off-by: Andrzej Kurek --- tests/suites/test_suite_debug.data | 2 +- tests/suites/test_suite_debug.function | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/suites/test_suite_debug.data b/tests/suites/test_suite_debug.data index 59526238f1..87ec67c8ce 100644 --- a/tests/suites/test_suite_debug.data +++ b/tests/suites/test_suite_debug.data @@ -67,4 +67,4 @@ depends_on:MBEDTLS_PEM_PARSE_C:MBEDTLS_BASE64_C:MBEDTLS_ECDSA_C:MBEDTLS_ECP_C:MB mbedtls_debug_print_crt:"data_files/test-ca2.crt":"MyFile":999:"PREFIX_":"MyFile(0999)\: PREFIX_ #1\:\nMyFile(0999)\: cert. version \: 3\nMyFile(0999)\: serial number \: C1\:43\:E2\:7E\:62\:43\:CC\:E8\nMyFile(0999)\: issuer name \: C=NL, O=PolarSSL, CN=Polarssl Test EC CA\nMyFile(0999)\: subject name \: C=NL, O=PolarSSL, CN=Polarssl Test EC CA\nMyFile(0999)\: issued on \: 2019-02-10 14\:44\:00\nMyFile(0999)\: expires on \: 2029-02-10 14\:44\:00\nMyFile(0999)\: signed using \: ECDSA with SHA256\nMyFile(0999)\: EC key size \: 384 bits\nMyFile(0999)\: basic constraints \: CA=true\nMyFile(0999)\: value of 'crt->eckey.Q(X)' (384 bits) is\:\nMyFile(0999)\: c3 da 2b 34 41 37 58 2f 87 56 fe fc 89 ba 29 43\nMyFile(0999)\: 4b 4e e0 6e c3 0e 57 53 33 39 58 d4 52 b4 91 95\nMyFile(0999)\: 39 0b 23 df 5f 17 24 62 48 fc 1a 95 29 ce 2c 2d\nMyFile(0999)\: value of 'crt->eckey.Q(Y)' (384 bits) is\:\nMyFile(0999)\: 87 c2 88 52 80 af d6 6a ab 21 dd b8 d3 1c 6e 58\nMyFile(0999)\: b8 ca e8 b2 69 8e f3 41 ad 29 c3 b4 5f 75 a7 47\nMyFile(0999)\: 6f d5 19 29 55 69 9a 53 3b 20 b4 66 16 60 33 1e\n" Check mbedtls_calloc overallocation -check_mbedtls_calloc_overallocation:SIZE_MAX/2:SIZE_MAX/2 +check_mbedtls_calloc_overallocation:1:1 diff --git a/tests/suites/test_suite_debug.function b/tests/suites/test_suite_debug.function index 617dd8885a..34e006f10d 100644 --- a/tests/suites/test_suite_debug.function +++ b/tests/suites/test_suite_debug.function @@ -200,7 +200,7 @@ exit: void check_mbedtls_calloc_overallocation(int num, int size) { unsigned char *buf; - buf = mbedtls_calloc((size_t) num, (size_t) size); + buf = mbedtls_calloc((size_t) num * SIZE_MAX/2, (size_t) size * SIZE_MAX/2); /* Dummy usage of the pointer to prevent optimizing it */ mbedtls_printf("calloc pointer : %p\n", buf); TEST_ASSERT(buf == NULL); From 27e2989840eb1e21beffeecd57120fef2c4553fd Mon Sep 17 00:00:00 2001 From: Agathiyan Bragadeesh Date: Fri, 14 Jul 2023 17:28:27 +0100 Subject: [PATCH 046/135] Back port TEST_FAIL Signed-off-by: Agathiyan Bragadeesh --- tests/include/test/macros.h | 10 ++++++++++ tests/src/psa_exercise_key.c | 8 ++++---- tests/suites/test_suite_asn1write.function | 2 +- tests/suites/test_suite_psa_crypto.function | 2 +- .../test_suite_psa_crypto_se_driver_hal.function | 2 +- .../test_suite_psa_crypto_slot_management.function | 2 +- 6 files changed, 18 insertions(+), 8 deletions(-) diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h index 95bca239c6..26df442c3a 100644 --- a/tests/include/test/macros.h +++ b/tests/include/test/macros.h @@ -71,6 +71,16 @@ } \ } while (0) +/** This macro asserts fails the test with given output message. + * + * \param MESSAGE The message to be outputed on assertion + */ +#define TEST_FAIL(MESSAGE) \ + do { \ + mbedtls_test_fail(MESSAGE, __LINE__, __FILE__); \ + goto exit; \ + } while (0) \ + /** Evaluate two integer expressions and fail the test case if they have * different values. * diff --git a/tests/src/psa_exercise_key.c b/tests/src/psa_exercise_key.c index 6b734866d6..f8ed7846f2 100644 --- a/tests/src/psa_exercise_key.c +++ b/tests/src/psa_exercise_key.c @@ -308,7 +308,7 @@ static int exercise_signature_key(mbedtls_svc_key_id_t key, hash_alg = KNOWN_MBEDTLS_SUPPORTED_HASH_ALG; alg ^= PSA_ALG_ANY_HASH ^ hash_alg; #else - TEST_ASSERT(!"No hash algorithm for hash-and-sign testing"); + TEST_FAIL("No hash algorithm for hash-and-sign testing"); #endif } @@ -437,7 +437,7 @@ int mbedtls_test_psa_setup_key_derivation_wrap( PSA_KEY_DERIVATION_INPUT_LABEL, input2, input2_length)); } else { - TEST_ASSERT(!"Key derivation algorithm not supported"); + TEST_FAIL("Key derivation algorithm not supported"); } if (capacity != SIZE_MAX) { @@ -767,7 +767,7 @@ int mbedtls_test_psa_exported_key_sanity_check( { (void) exported; - TEST_ASSERT(!"Sanity check not implemented for this key type"); + TEST_FAIL("Sanity check not implemented for this key type"); } #if defined(MBEDTLS_DES_C) @@ -912,7 +912,7 @@ int mbedtls_test_psa_exercise_key(mbedtls_svc_key_id_t key, } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) { ok = exercise_key_agreement_key(key, usage, alg); } else { - TEST_ASSERT(!"No code to exercise this category of algorithm"); + TEST_FAIL("No code to exercise this category of algorithm"); } ok = ok && exercise_export_key(key, usage); diff --git a/tests/suites/test_suite_asn1write.function b/tests/suites/test_suite_asn1write.function index 06b9edf65f..81e3c1248e 100644 --- a/tests/suites/test_suite_asn1write.function +++ b/tests/suites/test_suite_asn1write.function @@ -316,7 +316,7 @@ void mbedtls_asn1_write_algorithm_identifier(data_t *oid, buf_complete[data_len + 2] = (unsigned char) (expected_params_len >> 8); buf_complete[data_len + 3] = (unsigned char) (expected_params_len); } else { - TEST_ASSERT(!"Bad test data: invalid length of ASN.1 element"); + TEST_FAIL("Bad test data: invalid length of ASN.1 element"); } unsigned char *p = buf_complete; TEST_EQUAL(mbedtls_asn1_get_alg(&p, end_complete, diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 5bd7b36e5b..c457cdfba9 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -5577,7 +5577,7 @@ void persistent_key_load_key_from_storage(data_t *data, break; default: - TEST_ASSERT(!"generation_method not implemented in test"); + TEST_FAIL("generation_method not implemented in test"); break; } psa_reset_key_attributes(&attributes); diff --git a/tests/suites/test_suite_psa_crypto_se_driver_hal.function b/tests/suites/test_suite_psa_crypto_se_driver_hal.function index aeced54798..513dd8760e 100644 --- a/tests/suites/test_suite_psa_crypto_se_driver_hal.function +++ b/tests/suites/test_suite_psa_crypto_se_driver_hal.function @@ -1321,7 +1321,7 @@ void sign_verify(int flow, key_management.p_export_public = ram_export_public; break; default: - TEST_ASSERT(!"unsupported flow (should be SIGN_IN_xxx)"); + TEST_FAIL("unsupported flow (should be SIGN_IN_xxx)"); break; } asymmetric.p_verify = ram_verify; diff --git a/tests/suites/test_suite_psa_crypto_slot_management.function b/tests/suites/test_suite_psa_crypto_slot_management.function index e3bb0d34fd..905be03eaf 100644 --- a/tests/suites/test_suite_psa_crypto_slot_management.function +++ b/tests/suites/test_suite_psa_crypto_slot_management.function @@ -775,7 +775,7 @@ void invalid_handle(int handle_construction, mbedtls_svc_key_id_make(0, PSA_KEY_ID_VENDOR_MAX + 1); break; default: - TEST_ASSERT(!"unknown handle construction"); + TEST_FAIL("unknown handle construction"); } /* Attempt to use the invalid handle. */ From 9a9d5eea5382befa06a939de5f1718f46d6ce532 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 28 Apr 2023 21:00:28 +0200 Subject: [PATCH 047/135] Fix a build error when MBEDTLS_PSA_INJECT_ENTROPY is enabled Signed-off-by: Gilles Peskine --- ChangeLog.d/inject-entropy.txt | 2 ++ library/psa_crypto.c | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 ChangeLog.d/inject-entropy.txt diff --git a/ChangeLog.d/inject-entropy.txt b/ChangeLog.d/inject-entropy.txt new file mode 100644 index 0000000000..7626629693 --- /dev/null +++ b/ChangeLog.d/inject-entropy.txt @@ -0,0 +1,2 @@ +Bugfix + * Fix the build with MBEDTLS_PSA_INJECT_ENTROPY. Fixes #7516. diff --git a/library/psa_crypto.c b/library/psa_crypto.c index bad7f46978..fdcdd43d50 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -5066,6 +5066,10 @@ exit: /* Random generation */ /****************************************************************/ +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) +#include "mbedtls/entropy_poll.h" +#endif + /** Initialize the PSA random generator. */ static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng) @@ -5200,8 +5204,6 @@ int mbedtls_psa_get_random(void *p_rng, #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ #if defined(MBEDTLS_PSA_INJECT_ENTROPY) -#include "mbedtls/entropy_poll.h" - psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed, size_t seed_size) { From 73521b071531049265904552109dd7d52d25b4c3 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 28 Apr 2023 21:01:49 +0200 Subject: [PATCH 048/135] Tests: provide necessary functions for MBEDTLS_PSA_INJECT_ENTROPY The build option MBEDTLS_PSA_INJECT_ENTROPY requires some extra platform functions, for historical reasons. To enable us to test this option, provide a version of these functions for testing. (These versions would actually work in production, but providing them in the library in a way that doesn't break existing users might be slightly tricky, so it's out of scope of this commit.) Signed-off-by: Gilles Peskine --- scripts/config.py | 2 +- tests/configs/user-config-for-test.h | 20 ++++++++++++++++ tests/include/test/psa_crypto_helpers.h | 19 +++++++++++++++ tests/src/psa_crypto_helpers.c | 31 +++++++++++++++++++++++++ 4 files changed, 71 insertions(+), 1 deletion(-) diff --git a/scripts/config.py b/scripts/config.py index 9bf82c9afd..2db67efaa9 100755 --- a/scripts/config.py +++ b/scripts/config.py @@ -200,7 +200,7 @@ EXCLUDE_FROM_FULL = frozenset([ 'MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG', # behavior change + build dependency 'MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER', # incompatible with USE_PSA_CRYPTO 'MBEDTLS_PSA_CRYPTO_SPM', # platform dependency (PSA SPM) - 'MBEDTLS_PSA_INJECT_ENTROPY', # build dependency (hook functions) + 'MBEDTLS_PSA_INJECT_ENTROPY', # conflicts with platform entropy sources 'MBEDTLS_REMOVE_3DES_CIPHERSUITES', # removes a feature 'MBEDTLS_REMOVE_ARC4_CIPHERSUITES', # removes a feature 'MBEDTLS_RSA_NO_CRT', # influences the use of RSA in X.509 and TLS diff --git a/tests/configs/user-config-for-test.h b/tests/configs/user-config-for-test.h index 6e7c154bae..fbec4f4c60 100644 --- a/tests/configs/user-config-for-test.h +++ b/tests/configs/user-config-for-test.h @@ -57,3 +57,23 @@ #define MBEDTLS_PSA_ACCEL_ALG_HMAC #endif /* PSA_CRYPTO_DRIVER_TEST_ALL */ + + + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) +/* The #MBEDTLS_PSA_INJECT_ENTROPY feature requires two extra platform + * functions, which must be configured as #MBEDTLS_PLATFORM_NV_SEED_READ_MACRO + * and #MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO. The job of these functions + * is to read and write from the entropy seed file, which is located + * in the PSA ITS file whose uid is #PSA_CRYPTO_ITS_RANDOM_SEED_UID. + * (These could have been provided as library functions, but for historical + * reasons, they weren't, and so each integrator has to provide a copy + * of these functions.) + * + * Provide implementations of these functions for testing. */ +#include +int mbedtls_test_inject_entropy_seed_read(unsigned char *buf, size_t len); +int mbedtls_test_inject_entropy_seed_write(unsigned char *buf, size_t len); +#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_test_inject_entropy_seed_read +#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_test_inject_entropy_seed_write +#endif /* MBEDTLS_PSA_INJECT_ENTROPY */ diff --git a/tests/include/test/psa_crypto_helpers.h b/tests/include/test/psa_crypto_helpers.h index f8b98c07bc..fd06874d59 100644 --- a/tests/include/test/psa_crypto_helpers.h +++ b/tests/include/test/psa_crypto_helpers.h @@ -201,6 +201,25 @@ psa_key_usage_t mbedtls_test_update_key_usage_flags(psa_key_usage_t usage_flags) */ int mbedtls_test_fail_if_psa_leaking(int line_no, const char *filename); + + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) +/* The #MBEDTLS_PSA_INJECT_ENTROPY feature requires two extra platform + * functions, which must be configured as #MBEDTLS_PLATFORM_NV_SEED_READ_MACRO + * and #MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO. The job of these functions + * is to read and write from the entropy seed file, which is located + * in the PSA ITS file whose uid is #PSA_CRYPTO_ITS_RANDOM_SEED_UID. + * (These could have been provided as library functions, but for historical + * reasons, they weren't, and so each integrator has to provide a copy + * of these functions.) + * + * Provide implementations of these functions for testing. */ +int mbedtls_test_inject_entropy_seed_read(unsigned char *buf, size_t len); +int mbedtls_test_inject_entropy_seed_write(unsigned char *buf, size_t len); +#endif /* MBEDTLS_PSA_INJECT_ENTROPY */ + + + /** Skip a test case if the given key is a 192 bits AES key and the AES * implementation is at least partially provided by an accelerator or * alternative implementation. diff --git a/tests/src/psa_crypto_helpers.c b/tests/src/psa_crypto_helpers.c index 77c2f89764..7861185ee8 100644 --- a/tests/src/psa_crypto_helpers.c +++ b/tests/src/psa_crypto_helpers.c @@ -149,4 +149,35 @@ int mbedtls_test_fail_if_psa_leaking(int line_no, const char *filename) } } +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) + +#include +#include + +int mbedtls_test_inject_entropy_seed_read(unsigned char *buf, size_t len) +{ + size_t actual_len = 0; + psa_status_t status = psa_its_get(PSA_CRYPTO_ITS_RANDOM_SEED_UID, + 0, len, buf, &actual_len); + if (status != 0) { + return MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR; + } + if (actual_len != len) { + return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED; + } + return 0; +} + +int mbedtls_test_inject_entropy_seed_write(unsigned char *buf, size_t len) +{ + psa_status_t status = psa_its_set(PSA_CRYPTO_ITS_RANDOM_SEED_UID, + len, buf, 0); + if (status != 0) { + return MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR; + } + return 0; +} + +#endif /* MBEDTLS_PSA_INJECT_ENTROPY */ + #endif /* MBEDTLS_PSA_CRYPTO_C */ From 4f8bf3cc548174502033e37191121cf8f9313747 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 28 Apr 2023 23:39:45 +0200 Subject: [PATCH 049/135] MBEDTLS_PSA_INJECT_ENTROPY: Make sure the seed file exist when running tests The seed file must exist before running tests. Because the location is somewhat platform- and configuration-dependent, and to be friendly to developers who run test suites individually and aren't familiar with this feature, rely on the test framework code rather than on test scripts to create the seed file. Signed-off-by: Gilles Peskine --- tests/include/test/psa_crypto_helpers.h | 16 ++++++++++++++++ tests/src/helpers.c | 18 ++++++++++++++++++ tests/src/psa_crypto_helpers.c | 14 ++++++++++++++ .../test_suite_psa_crypto_entropy.function | 4 ++-- 4 files changed, 50 insertions(+), 2 deletions(-) diff --git a/tests/include/test/psa_crypto_helpers.h b/tests/include/test/psa_crypto_helpers.h index fd06874d59..8ac09c802b 100644 --- a/tests/include/test/psa_crypto_helpers.h +++ b/tests/include/test/psa_crypto_helpers.h @@ -216,6 +216,22 @@ int mbedtls_test_fail_if_psa_leaking(int line_no, const char *filename); * Provide implementations of these functions for testing. */ int mbedtls_test_inject_entropy_seed_read(unsigned char *buf, size_t len); int mbedtls_test_inject_entropy_seed_write(unsigned char *buf, size_t len); + + +/** Make sure that the injected entropy is present. + * + * When MBEDTLS_PSA_INJECT_ENTROPY is enabled, psa_crypto_init() + * will fail if the PSA entropy seed is not present. + * This function must be called at least once in a test suite or other + * program before any call to psa_crypto_init(). + * It does not need to be called in each test case. + * + * The test framework calls this function before running any test case. + * + * The few tests that might remove the entropy file must call this function + * in their cleanup. + */ +int mbedtls_test_inject_entropy_restore(void); #endif /* MBEDTLS_PSA_INJECT_ENTROPY */ diff --git a/tests/src/helpers.c b/tests/src/helpers.c index 6c215d1c0a..198a9c01e2 100644 --- a/tests/src/helpers.c +++ b/tests/src/helpers.c @@ -24,6 +24,11 @@ #include #endif +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) +#include +#include +#endif + /*----------------------------------------------------------------------------*/ /* Static global variables */ @@ -52,9 +57,22 @@ mbedtls_test_info_t mbedtls_test_info; int mbedtls_test_platform_setup(void) { int ret = 0; + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) + /* Make sure that injected entropy is present. Otherwise + * psa_crypto_init() will fail. This is not necessary for test suites + * that don't use PSA, but it's harmless (except for leaving a file + * behind). */ + ret = mbedtls_test_inject_entropy_restore(); + if (ret != 0) { + return ret; + } +#endif + #if defined(MBEDTLS_PLATFORM_C) ret = mbedtls_platform_setup(&platform_ctx); #endif /* MBEDTLS_PLATFORM_C */ + return ret; } diff --git a/tests/src/psa_crypto_helpers.c b/tests/src/psa_crypto_helpers.c index 7861185ee8..cab96ab967 100644 --- a/tests/src/psa_crypto_helpers.c +++ b/tests/src/psa_crypto_helpers.c @@ -178,6 +178,20 @@ int mbedtls_test_inject_entropy_seed_write(unsigned char *buf, size_t len) return 0; } +int mbedtls_test_inject_entropy_restore(void) +{ + unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE]; + for (size_t i = 0; i < sizeof(buf); i++) { + buf[i] = (unsigned char) i; + } + psa_status_t status = mbedtls_psa_inject_entropy(buf, sizeof(buf)); + /* It's ok if the file was just created, or if it already exists. */ + if (status != PSA_SUCCESS && status != PSA_ERROR_NOT_PERMITTED) { + return status; + } + return PSA_SUCCESS; +} + #endif /* MBEDTLS_PSA_INJECT_ENTROPY */ #endif /* MBEDTLS_PSA_CRYPTO_C */ diff --git a/tests/suites/test_suite_psa_crypto_entropy.function b/tests/suites/test_suite_psa_crypto_entropy.function index 26ce0d3f5d..f099438203 100644 --- a/tests/suites/test_suite_psa_crypto_entropy.function +++ b/tests/suites/test_suite_psa_crypto_entropy.function @@ -153,8 +153,8 @@ void validate_entropy_seed_injection(int seed_length_a, TEST_ASSERT(memcmp(output, zeros, sizeof(output)) != 0); exit: mbedtls_free(seed); - remove_seed_file(); PSA_DONE(); + mbedtls_test_inject_entropy_restore(); } /* END_CASE */ @@ -186,7 +186,7 @@ void run_entropy_inject_with_crypto_init() status = mbedtls_psa_inject_entropy(seed, sizeof(seed)); TEST_EQUAL(status, PSA_ERROR_NOT_PERMITTED); exit: - remove_seed_file(); PSA_DONE(); + mbedtls_test_inject_entropy_restore(); } /* END_CASE */ From bfda1a96bbbd70bee4e55e197a665c818d03252b Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 28 Apr 2023 23:41:38 +0200 Subject: [PATCH 050/135] MBEDTLS_PSA_INJECT_ENTROPY: Skip incompatible tests When MBEDTLS_PSA_INJECT_ENTROPY is enabled, we disable standard entropy sources, so mbedtls_entropy_func() doesn't work out of the box. Disable tests that rely on it. MBEDTLS_PSA_INJECT_ENTROPY is intended for PSA-only environments anyway, so it doesn't matter if some legacy features don't work normally. Signed-off-by: Gilles Peskine --- tests/suites/test_suite_entropy.function | 2 +- tests/suites/test_suite_psa_crypto_init.data | 3 +++ tests/suites/test_suite_random.function | 4 ++-- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_entropy.function b/tests/suites/test_suite_entropy.function index b04ed543c7..5d8487c599 100644 --- a/tests/suites/test_suite_entropy.function +++ b/tests/suites/test_suite_entropy.function @@ -135,7 +135,7 @@ int read_nv_seed(unsigned char *buf, size_t buf_len) /* END_HEADER */ /* BEGIN_DEPENDENCIES - * depends_on:MBEDTLS_ENTROPY_C + * depends_on:MBEDTLS_ENTROPY_C:!MBEDTLS_PSA_INJECT_ENTROPY * END_DEPENDENCIES */ diff --git a/tests/suites/test_suite_psa_crypto_init.data b/tests/suites/test_suite_psa_crypto_init.data index 9620a642a0..8c5b41d6cb 100644 --- a/tests/suites/test_suite_psa_crypto_init.data +++ b/tests/suites/test_suite_psa_crypto_init.data @@ -25,7 +25,10 @@ validate_module_init_key_based:1 Custom entropy sources: all standard custom_entropy_sources:0x0000ffff:PSA_SUCCESS +# MBEDTLS_PSA_INJECT_ENTROPY means that a source of entropy (the seed file) +# is effectively always available. Custom entropy sources: none +depends_on:!MBEDTLS_PSA_INJECT_ENTROPY custom_entropy_sources:0:PSA_ERROR_INSUFFICIENT_ENTROPY Fake entropy: never returns anything diff --git a/tests/suites/test_suite_random.function b/tests/suites/test_suite_random.function index 0f0c7fa7e1..905ee78f3f 100644 --- a/tests/suites/test_suite_random.function +++ b/tests/suites/test_suite_random.function @@ -18,7 +18,7 @@ /* END_HEADER */ -/* BEGIN_CASE depends_on:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:MBEDTLS_CTR_DRBG_C */ +/* BEGIN_CASE depends_on:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:!MBEDTLS_PSA_INJECT_ENTROPY:MBEDTLS_CTR_DRBG_C */ void random_twice_with_ctr_drbg() { mbedtls_entropy_context entropy; @@ -57,7 +57,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:MBEDTLS_HMAC_DRBG_C */ +/* BEGIN_CASE depends_on:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:!MBEDTLS_PSA_INJECT_ENTROPY:MBEDTLS_HMAC_DRBG_C */ void random_twice_with_hmac_drbg(int md_type) { mbedtls_entropy_context entropy; From 55e89985f0f2b2bdbd77f792a51c1963fd8bc182 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 28 Apr 2023 21:04:28 +0200 Subject: [PATCH 051/135] Test MBEDTLS_PSA_INJECT_ENTROPY Until now, we were never enabling this option in any test. MBEDTLS_PSA_INJECT_ENTROPY requires MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES, so it cannot be enabled in the full config and it gets its own component. Test with MBEDTLS_USE_PSA_CRYPTO enabled, since MBEDTLS_PSA_INJECT_ENTROPY is a very PSA feature (which can break non-PSA applications), and Mbed OS (for whch MBEDTLS_PSA_INJECT_ENTROPY was designed) enables MBEDTLS_USE_PSA_CRYPTO when it enables MBEDTLS_PSA_INJECT_ENTROPY. Signed-off-by: Gilles Peskine --- tests/scripts/all.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 9eb5c39311..73aa292482 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -1244,6 +1244,21 @@ component_test_psa_external_rng_use_psa_crypto () { tests/ssl-opt.sh -f 'Default\|opaque' } +component_test_psa_inject_entropy () { + msg "build: full + MBEDTLS_PSA_INJECT_ENTROPY" + scripts/config.py full + scripts/config.py set MBEDTLS_PSA_INJECT_ENTROPY + scripts/config.py set MBEDTLS_ENTROPY_NV_SEED + scripts/config.py set MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES + scripts/config.py unset MBEDTLS_PLATFORM_NV_SEED_ALT + scripts/config.py unset MBEDTLS_PLATFORM_STD_NV_SEED_READ + scripts/config.py unset MBEDTLS_PLATFORM_STD_NV_SEED_WRITE + make CFLAGS="$ASAN_CFLAGS '-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'" LDFLAGS="$ASAN_CFLAGS" + + msg "test: full + MBEDTLS_PSA_INJECT_ENTROPY" + make test +} + component_test_ecp_no_internal_rng () { msg "build: Default plus ECP_NO_INTERNAL_RNG minus DRBG modules" scripts/config.py set MBEDTLS_ECP_NO_INTERNAL_RNG From cf21e944f6f7ee566a8eeaf169169e74011a5e38 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 28 Apr 2023 21:07:07 +0200 Subject: [PATCH 052/135] Modernize remove_seed_file() This function was written before the PSA storage layer switched to the PSA ITS API as its storage abstraction. Now we can just call PSA ITS functions unconditionally. Signed-off-by: Gilles Peskine --- .../test_suite_psa_crypto_entropy.function | 22 +++++-------------- 1 file changed, 5 insertions(+), 17 deletions(-) diff --git a/tests/suites/test_suite_psa_crypto_entropy.function b/tests/suites/test_suite_psa_crypto_entropy.function index f099438203..b109eeecce 100644 --- a/tests/suites/test_suite_psa_crypto_entropy.function +++ b/tests/suites/test_suite_psa_crypto_entropy.function @@ -12,28 +12,16 @@ MBEDTLS_ENTROPY_BLOCK_SIZE) #if defined(MBEDTLS_PSA_INJECT_ENTROPY) +#include -#if defined(MBEDTLS_PSA_ITS_FILE_C) -#include -#else -#include -#endif -/* Remove the entropy seed file. Since the library does not expose a way - * to do this (it would be a security risk if such a function was ever - * accessible in production), implement this functionality in a white-box - * manner. */ +/* Remove the entropy seed file. + * + * See check_random_seed_file() regarding abstraction boundaries. + */ psa_status_t remove_seed_file(void) { -#if defined(MBEDTLS_PSA_ITS_FILE_C) - if (remove("00000000ffffff52.psa_its") == 0) { - return PSA_SUCCESS; - } else { - return PSA_ERROR_DOES_NOT_EXIST; - } -#else return psa_its_remove(PSA_CRYPTO_ITS_RANDOM_SEED_UID); -#endif } #endif /* MBEDTLS_PSA_INJECT_ENTROPY */ From 154dadfae82d48812a5d8aebdf856f1bddc3578e Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 28 Apr 2023 21:08:46 +0200 Subject: [PATCH 053/135] MBEDTLS_PSA_INJECT_ENTROPY: check the lifecycle of the seed file The seed file is part of the stable interface of PSA_CRYPTO_INJECT_ENTROPY, because it has to survive a library upgrade on a device. So check that its existence and content are as expected at each point in the tested life cycle. Signed-off-by: Gilles Peskine --- .../test_suite_psa_crypto_entropy.function | 65 +++++++++++++++++++ 1 file changed, 65 insertions(+) diff --git a/tests/suites/test_suite_psa_crypto_entropy.function b/tests/suites/test_suite_psa_crypto_entropy.function index b109eeecce..5184611f2d 100644 --- a/tests/suites/test_suite_psa_crypto_entropy.function +++ b/tests/suites/test_suite_psa_crypto_entropy.function @@ -14,6 +14,40 @@ #if defined(MBEDTLS_PSA_INJECT_ENTROPY) #include +/* Check the entropy seed file. + * + * \param expected_size Expected size in bytes. + * If 0, the file must not exist. + * + * \retval 0 Either \p expected_size is nonzero and + * the entropy seed file exists and has exactly this size, + * or \p expected_size is zero and the file does not exist. + * \retval 1 Either \p expected_size is nonzero and + * the entropy seed file exists, + * or \p expected_size is zero and the file exists. + * In this case, the test case is marked as failed. + * + * \note We enforce that the seed is in a specific ITS file. + * This must not change, otherwise we break backward compatibility if + * the library is upgraded on a device with an existing seed. + */ +int check_random_seed_file(size_t expected_size) +{ + struct psa_storage_info_t info = { 0, 0 }; + psa_status_t status = psa_its_get_info(PSA_CRYPTO_ITS_RANDOM_SEED_UID, + &info); + + if (expected_size == 0) { + TEST_EQUAL(status, PSA_ERROR_DOES_NOT_EXIST); + } else { + TEST_EQUAL(status, PSA_SUCCESS); + TEST_EQUAL(info.size, expected_size); + } + return 1; + +exit: + return 0; +} /* Remove the entropy seed file. * @@ -131,14 +165,30 @@ void validate_entropy_seed_injection(int seed_length_a, status = remove_seed_file(); TEST_ASSERT((status == PSA_SUCCESS) || (status == PSA_ERROR_DOES_NOT_EXIST)); + if (!check_random_seed_file(0)) { + goto exit; + } + status = mbedtls_psa_inject_entropy(seed, seed_length_a); TEST_EQUAL(status, expected_status_a); + if (!check_random_seed_file(expected_status_a == PSA_SUCCESS ? seed_length_a : + 0)) { + goto exit; + } + status = mbedtls_psa_inject_entropy(seed, seed_length_b); TEST_EQUAL(status, expected_status_b); + if (!check_random_seed_file(expected_status_a == PSA_SUCCESS ? seed_length_a : + expected_status_b == PSA_SUCCESS ? seed_length_b : + 0)) { + goto exit; + } + PSA_ASSERT(psa_crypto_init()); PSA_ASSERT(psa_generate_random(output, sizeof(output))); TEST_ASSERT(memcmp(output, zeros, sizeof(output)) != 0); + exit: mbedtls_free(seed); PSA_DONE(); @@ -156,23 +206,38 @@ void run_entropy_inject_with_crypto_init() for (i = 0; i < sizeof(seed); ++i) { seed[i] = i; } + status = remove_seed_file(); TEST_ASSERT((status == PSA_SUCCESS) || (status == PSA_ERROR_DOES_NOT_EXIST)); + if (!check_random_seed_file(0)) { + goto exit; + } status = mbedtls_psa_inject_entropy(seed, sizeof(seed)); PSA_ASSERT(status); + TEST_ASSERT(check_random_seed_file(sizeof(seed))); status = remove_seed_file(); TEST_EQUAL(status, PSA_SUCCESS); + if (!check_random_seed_file(0)) { + goto exit; + } + status = psa_crypto_init(); TEST_EQUAL(status, PSA_ERROR_INSUFFICIENT_ENTROPY); status = mbedtls_psa_inject_entropy(seed, sizeof(seed)); PSA_ASSERT(status); + if (!check_random_seed_file(sizeof(seed))) { + goto exit; + } + status = psa_crypto_init(); PSA_ASSERT(status); PSA_DONE(); + /* The seed is written by nv_seed callback functions therefore the injection will fail */ status = mbedtls_psa_inject_entropy(seed, sizeof(seed)); TEST_EQUAL(status, PSA_ERROR_NOT_PERMITTED); + exit: PSA_DONE(); mbedtls_test_inject_entropy_restore(); From 58d085419cd2c8175673761e7dd4cae17367efec Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 28 Apr 2023 21:13:43 +0200 Subject: [PATCH 054/135] MBEDTLS_PSA_INJECT_ENTROPY: check the seed file UID The seed file UID is part of the library's stable interface. Signed-off-by: Gilles Peskine --- tests/suites/test_suite_psa_crypto_entropy.function | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/suites/test_suite_psa_crypto_entropy.function b/tests/suites/test_suite_psa_crypto_entropy.function index 5184611f2d..973740dca9 100644 --- a/tests/suites/test_suite_psa_crypto_entropy.function +++ b/tests/suites/test_suite_psa_crypto_entropy.function @@ -33,6 +33,12 @@ */ int check_random_seed_file(size_t expected_size) { + /* The value of the random seed UID must not change. Otherwise that would + * break upgrades of the library on devices that already contain a seed + * file. If this test assertion fails, you've presumably broken backward + * compatibility! */ + TEST_EQUAL(PSA_CRYPTO_ITS_RANDOM_SEED_UID, 0xFFFFFF52); + struct psa_storage_info_t info = { 0, 0 }; psa_status_t status = psa_its_get_info(PSA_CRYPTO_ITS_RANDOM_SEED_UID, &info); From 581c6e12ce7f423e4559243ad9b914ba2002d4c4 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sat, 29 Apr 2023 00:32:34 +0200 Subject: [PATCH 055/135] MBEDTLS_PSA_INJECT_ENTROPY: ignore seed file The test framework leaves the seed file behind (like it does with the corresponding file in the legacy API, namely seedfile), so ignore it. Signed-off-by: Gilles Peskine --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index f2c4a3bc0c..54b3c5496d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,7 @@ # Random seed file created by test scripts and sample programs seedfile +# MBEDTLS_PSA_INJECT_ENTROPY seed file created by the test framework +00000000ffffff52.psa_its # CMake build artifacts: CMakeCache.txt From 24d01248680c15be07229fe7d52daba19fd7a9d7 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 20 Jul 2023 17:54:19 +0200 Subject: [PATCH 056/135] Fix copypasta in function documentation Signed-off-by: Gilles Peskine --- tests/suites/test_suite_psa_crypto_entropy.function | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_psa_crypto_entropy.function b/tests/suites/test_suite_psa_crypto_entropy.function index 973740dca9..0c8f2d5bc2 100644 --- a/tests/suites/test_suite_psa_crypto_entropy.function +++ b/tests/suites/test_suite_psa_crypto_entropy.function @@ -19,12 +19,12 @@ * \param expected_size Expected size in bytes. * If 0, the file must not exist. * - * \retval 0 Either \p expected_size is nonzero and + * \retval 1 Either \p expected_size is nonzero and * the entropy seed file exists and has exactly this size, * or \p expected_size is zero and the file does not exist. - * \retval 1 Either \p expected_size is nonzero and - * the entropy seed file exists, - * or \p expected_size is zero and the file exists. + * \retval 0 Either \p expected_size is nonzero but + * the entropy seed file does not exist or has a different size, + * or \p expected_size is zero but the file exists. * In this case, the test case is marked as failed. * * \note We enforce that the seed is in a specific ITS file. From 1fc71160b1a7d2a9dda4a18133a852e9ce97d654 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 20 Jul 2023 20:04:00 +0200 Subject: [PATCH 057/135] Add missing dependencies on real entropy Tests that call mbedtls_test_ssl_endpoint_init() need mbedtls_entropy_func() to work. Signed-off-by: Gilles Peskine --- tests/suites/test_suite_ssl.function | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index bc999f10a7..6bcde710ba 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -2126,7 +2126,7 @@ void ssl_session_serialize_version_check(int corrupt_major, } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED:MBEDTLS_CERTS_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_ENTROPY_C:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C:MBEDTLS_SHA256_C */ +/* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED:MBEDTLS_CERTS_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:!MBEDTLS_PSA_INJECT_ENTROPY:MBEDTLS_CTR_DRBG_C:MBEDTLS_SHA256_C */ void mbedtls_endpoint_sanity(int endpoint_type) { enum { BUFFSIZE = 1024 }; @@ -2151,7 +2151,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED:MBEDTLS_CERTS_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_ENTROPY_C:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C:MBEDTLS_SHA256_C */ +/* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED:MBEDTLS_CERTS_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:!MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:!MBEDTLS_PSA_INJECT_ENTROPY:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C:MBEDTLS_SHA256_C */ void move_handshake_to_state(int endpoint_type, int state, int need_pass) { enum { BUFFSIZE = 1024 }; @@ -2408,7 +2408,7 @@ void resize_buffers_renegotiate_mfl(int mfl, int legacy_renegotiation, } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED:MBEDTLS_CERTS_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ENTROPY_C:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C:MBEDTLS_ECDSA_C */ +/* BEGIN_CASE depends_on:MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED:MBEDTLS_CERTS_C:MBEDTLS_USE_PSA_CRYPTO:MBEDTLS_PKCS1_V15:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:!MBEDTLS_PSA_INJECT_ENTROPY:MBEDTLS_RSA_C:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_CTR_DRBG_C:MBEDTLS_ECP_C:MBEDTLS_ECDSA_C */ void raw_key_agreement_fail(int bad_server_ecdhe_key) { enum { BUFFSIZE = 17000 }; From 1dd20a32e236376bd865b75724293549bb172a1e Mon Sep 17 00:00:00 2001 From: Agathiyan Bragadeesh Date: Fri, 21 Jul 2023 17:07:00 +0100 Subject: [PATCH 058/135] Remove trailing backslash Signed-off-by: Agathiyan Bragadeesh --- tests/include/test/macros.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h index 26df442c3a..750fe33e69 100644 --- a/tests/include/test/macros.h +++ b/tests/include/test/macros.h @@ -78,8 +78,8 @@ #define TEST_FAIL(MESSAGE) \ do { \ mbedtls_test_fail(MESSAGE, __LINE__, __FILE__); \ - goto exit; \ - } while (0) \ + goto exit; \ + } while (0) /** Evaluate two integer expressions and fail the test case if they have * different values. From f6ba9ce5852bdfc82e4bf82f96dfd449623902a8 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Wed, 26 Jul 2023 11:44:45 +0100 Subject: [PATCH 059/135] Have a single source of truth for licensing information MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We had information in both README.md and CONTRIBUTING.md about Mbed TLS licensing, but the information in CONTRIBUTING.md was missing that authors still need to accept that their contributions may be distributed under both Apache 2.0 and GPLv2-or-later. Move all but the most high-level “Mbed TLS files are provided under the Apache-2.0 license” statement to CONTRIBUTING.md, and tidy up the text a bit. Signed-off-by: Tom Cosgrove --- CONTRIBUTING.md | 10 ++++++++-- README.md | 2 +- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a7bf198dab..fab42fdcbc 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -84,8 +84,14 @@ Mbed TLS is well documented, but if you think documentation is needed, speak out License and Copyright --------------------- -All new files should include the [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) standard license header where possible. For licensing details, please see the [License section of the README](README.md#License). +Unless specifically indicated otherwise in a file, Mbed TLS files are provided under the [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) license. See the [LICENSE](LICENSE) file for the full text of this license. + +Contributors must accept that their contributions are made under both the Apache-2.0 AND [GPL-2.0-or-later](https://spdx.org/licenses/GPL-2.0-or-later.html) licenses. This enables LTS (Long Term Support) branches of the software to be provided under either the Apache-2.0 or GPL-2.0-or-later licenses. + +All new files should include the [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) standard license header where possible. The copyright on contributions is retained by the original authors of the code. Where possible for new files, this should be noted in a comment at the top of the file in the form: "Copyright The Mbed TLS Contributors". -When contributing code to us, the committer and all authors are required to make the submission under the terms of the [Developer Certificate of Origin](dco.txt), confirming that the code submitted can (legally) become part of the project, and be subject to the same Apache 2.0 license. This is done by including the standard Git `Signed-off-by:` line in every commit message. If more than one person contributed to the commit, they should also add their own `Signed-off-by:` line. +When contributing code to us, the committer and all authors are required to make the submission under the terms of the [Developer Certificate of Origin](dco.txt), confirming that the code submitted can (legally) become part of the project, and be subject to either or both the Apache 2.0 and/or GPL-2.0-or-later licenses. + +This is done by including the standard Git `Signed-off-by:` line in every commit message. If more than one person contributed to the commit, they should also add their own `Signed-off-by:` line. diff --git a/README.md b/README.md index d5b6c125c4..875e6bf350 100644 --- a/README.md +++ b/README.md @@ -249,7 +249,7 @@ Future releases of this library will include: License ------- -Unless specifically indicated otherwise in a file, Mbed TLS files are provided under the [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) license. See the [LICENSE](LICENSE) file for the full text of this license. Contributors must accept that their contributions are made under both the Apache-2.0 AND [GPL-2.0-or-later](https://spdx.org/licenses/GPL-2.0-or-later.html) licenses. This enables LTS (Long Term Support) branches of the software to be provided under either the Apache-2.0 OR GPL-2.0-or-later licenses. +Unless specifically indicated otherwise in a file, Mbed TLS files are provided under the [Apache-2.0](https://spdx.org/licenses/Apache-2.0.html) license. See the [LICENSE](LICENSE) file for the full text of this license, and [the 'License and Copyright' section in the contributing guidelines](CONTRIBUTING.md#License-and-Copyright) for more information. Contributing ------------ From e5507d5f20354d24e03ff94864da610860f3912c Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Sun, 25 Jun 2023 21:41:58 +0200 Subject: [PATCH 060/135] Fix empty union when TLS is disabled When all TLS 1.2 support is disabled, union mbedtls_ssl_premaster_secret was empty, which is not valid C even if the union is never used. Fixes #6628. Signed-off-by: Gilles Peskine --- ChangeLog.d/ssl_premaster_secret-empty.txt | 3 +++ include/mbedtls/ssl.h | 1 + 2 files changed, 4 insertions(+) create mode 100644 ChangeLog.d/ssl_premaster_secret-empty.txt diff --git a/ChangeLog.d/ssl_premaster_secret-empty.txt b/ChangeLog.d/ssl_premaster_secret-empty.txt new file mode 100644 index 0000000000..0ce5f36ead --- /dev/null +++ b/ChangeLog.d/ssl_premaster_secret-empty.txt @@ -0,0 +1,3 @@ +Bugfix + * Fix a compilation error on some platforms when including mbedtls/ssl.h + with all TLS support disabled. Fixes #6628. diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h index e07da11596..cc9a27082b 100644 --- a/include/mbedtls/ssl.h +++ b/include/mbedtls/ssl.h @@ -494,6 +494,7 @@ /* Dummy type used only for its size */ union mbedtls_ssl_premaster_secret { + unsigned char dummy; /* Make the union non-empty even with SSL disabled */ #if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) unsigned char _pms_rsa[48]; /* RFC 5246 8.1.1 */ #endif From 1e3af2485fbaa745938a6cb5392234431a53f1aa Mon Sep 17 00:00:00 2001 From: Gowtham Suresh Kumar Date: Wed, 19 Jul 2023 08:39:20 +0100 Subject: [PATCH 061/135] Update test scripts to use latest/earliest compilers The Ubuntu 16.04 and 22.04 docker images have been updated with earliest and latest versions of gcc and clang respectively. This patch adds the necessary component and support functions required for the CI to run these compilers. For FreeBSD we invoke the function by name so a condition is added to disable the existing test_clang_opt function for linux. Signed-off-by: Gowtham Suresh Kumar --- scripts/output_env.sh | 12 +++++++++++ tests/scripts/all.sh | 47 +++++++++++++++++++++++++++++++++++++++---- 2 files changed, 55 insertions(+), 4 deletions(-) diff --git a/scripts/output_env.sh b/scripts/output_env.sh index 1d9e0faebe..ce2c500656 100755 --- a/scripts/output_env.sh +++ b/scripts/output_env.sh @@ -105,9 +105,21 @@ echo print_version "gcc" "--version" "" "head -n 1" echo +print_version "gcc-earliest" "--version" "" "head -n 1" +echo + +print_version "gcc-latest" "--version" "" "head -n 1" +echo + print_version "clang" "--version" "" "head -n 2" echo +print_version "clang-earliest" "--version" "" "head -n 2" +echo + +print_version "clang-latest" "--version" "" "head -n 2" +echo + print_version "ldd" "--version" "" "head -n 1" echo diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 9eb5c39311..bf69517113 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -194,6 +194,13 @@ pre_initialize_variables () { # they are defined. ALL_COMPONENTS=$(sed -n 's/^ *component_\([0-9A-Z_a-z]*\) *().*/\1/p' <"$0") + # For Linux platforms we run latest/earliest versions of clang and the + # test_clang_opt function is only for FreeBSD. This condition removes + # test_clang_opt element from the ALL_COMPONENTS array for Linux. + if [[ $(uname) == "Linux" ]]; then + ALL_COMPONENTS=( "${ALL_COMPONENTS[@]/test_clang_opt}" ) + fi + # Exclude components that are not supported on this platform. SUPPORTED_COMPONENTS= for component in $ALL_COMPONENTS; do @@ -2931,6 +2938,7 @@ component_test_cmake_shared () { test_build_opt () { info=$1 cc=$2; shift 2 + $cc --version for opt in "$@"; do msg "build/test: $cc $opt, $info" # ~ 30s make CC="$cc" CFLAGS="$opt -std=c99 -pedantic -Wall -Wextra -Werror" @@ -2943,14 +2951,45 @@ test_build_opt () { done } -component_test_clang_opt () { +# For FreeBSD we invoke the function by name so this condition is added +# to disable the existing test_clang_opt function for linux. +if [[ $(uname) != "Linux" ]]; then + component_test_clang_opt () { + scripts/config.py full + test_build_opt 'full config' clang -O0 -Os -O2 + } +fi + +component_test_clang_latest_opt () { scripts/config.py full - test_build_opt 'full config' clang -O0 -Os -O2 + test_build_opt 'full config' clang-latest -O0 -Os -O2 +} +support_test_clang_latest_opt () { + type clang-latest >/dev/null 2>/dev/null } -component_test_gcc_opt () { +component_test_clang_earliest_opt () { scripts/config.py full - test_build_opt 'full config' gcc -O0 -Os -O2 + test_build_opt 'full config' clang-earliest -O0 +} +support_test_clang_earliest_opt () { + type clang-earliest >/dev/null 2>/dev/null +} + +component_test_gcc_latest_opt () { + scripts/config.py full + test_build_opt 'full config' gcc-latest -O0 -Os -O2 +} +support_test_gcc_latest_opt () { + type gcc-latest >/dev/null 2>/dev/null +} + +component_test_gcc_earliest_opt () { + scripts/config.py full + test_build_opt 'full config' gcc-earliest -O0 +} +support_test_gcc_earliest_opt () { + type gcc-earliest >/dev/null 2>/dev/null } component_build_mbedtls_config_file () { From 34d8bd37d9bc95291b20e67942c1f6f59bc4dc53 Mon Sep 17 00:00:00 2001 From: Gowtham Suresh Kumar Date: Wed, 26 Jul 2023 17:18:55 +0100 Subject: [PATCH 062/135] Fix warnings from clang-16 Running clang-16 on mbedtls reports warnings of type "-Wstrict-prototypes". This patch fixes these warnings by adding void to functions with no arguments. The generate_test_code.py is modified to insert void into test functions with no arguments in *.function files. Signed-off-by: Gowtham Suresh Kumar --- programs/fuzz/common.c | 2 +- programs/fuzz/common.h | 2 +- programs/ssl/ssl_context_info.c | 6 +++--- programs/test/udp_proxy.c | 2 +- tests/scripts/generate_test_code.py | 5 +++++ tests/scripts/test_generate_test_code.py | 12 ++++++------ 6 files changed, 17 insertions(+), 12 deletions(-) diff --git a/programs/fuzz/common.c b/programs/fuzz/common.c index 56b9a13cc5..96a24f7575 100644 --- a/programs/fuzz/common.c +++ b/programs/fuzz/common.c @@ -13,7 +13,7 @@ mbedtls_time_t dummy_constant_time(mbedtls_time_t *time) } #endif -void dummy_init() +void dummy_init(void) { #if defined(MBEDTLS_PLATFORM_TIME_ALT) mbedtls_platform_set_time(dummy_constant_time); diff --git a/programs/fuzz/common.h b/programs/fuzz/common.h index 6b5b5154b4..d5b098fce6 100644 --- a/programs/fuzz/common.h +++ b/programs/fuzz/common.h @@ -19,7 +19,7 @@ typedef struct fuzzBufferOffset { #if defined(MBEDTLS_HAVE_TIME) mbedtls_time_t dummy_constant_time(mbedtls_time_t *time); #endif -void dummy_init(); +void dummy_init(void); int dummy_send(void *ctx, const unsigned char *buf, size_t len); int fuzz_recv(void *ctx, unsigned char *buf, size_t len); diff --git a/programs/ssl/ssl_context_info.c b/programs/ssl/ssl_context_info.c index d503fab569..ebdef4f72b 100644 --- a/programs/ssl/ssl_context_info.c +++ b/programs/ssl/ssl_context_info.c @@ -128,12 +128,12 @@ const char buf_ln_err[] = "Buffer does not have enough data to complete the pars /* * Basic printing functions */ -void print_version() +void print_version(void) { printf("%s v%d.%d\n", PROG_NAME, VER_MAJOR, VER_MINOR); } -void print_usage() +void print_usage(void) { print_version(); printf("\nThis program is used to deserialize an Mbed TLS SSL session from the base64 code provided\n" @@ -182,7 +182,7 @@ void printf_err(const char *str, ...) /* * Exit from the program in case of error */ -void error_exit() +void error_exit(void) { if (NULL != b64_file) { fclose(b64_file); diff --git a/programs/test/udp_proxy.c b/programs/test/udp_proxy.c index cc0bf79fb1..d31947a351 100644 --- a/programs/test/udp_proxy.c +++ b/programs/test/udp_proxy.c @@ -645,7 +645,7 @@ void delay_packet(packet *delay) memcpy(&prev[prev_len++], delay, sizeof(packet)); } -int send_delayed() +int send_delayed(void) { uint8_t offset; int ret; diff --git a/tests/scripts/generate_test_code.py b/tests/scripts/generate_test_code.py index 839fccdddd..96e967eeb8 100755 --- a/tests/scripts/generate_test_code.py +++ b/tests/scripts/generate_test_code.py @@ -654,6 +654,11 @@ def parse_function_code(funcs_f, dependencies, suite_dependencies): code = code.replace(name, 'test_' + name, 1) name = 'test_' + name + # If a test function has no arguments then add 'void' argument to + # avoid "-Wstrict-prototypes" warnings from clang-16 + if len(args) == 0: + code = code.replace('()', '(void)', 1) + for line in funcs_f: if re.search(END_CASE_REGEX, line): break diff --git a/tests/scripts/test_generate_test_code.py b/tests/scripts/test_generate_test_code.py index fe748aeb46..b32d18423b 100755 --- a/tests/scripts/test_generate_test_code.py +++ b/tests/scripts/test_generate_test_code.py @@ -647,7 +647,7 @@ void func() self.assertEqual(arg, []) expected = '''#line 1 "test_suite_ut.function" -void test_func() +void test_func(void) { ba ba black sheep have you any wool @@ -690,7 +690,7 @@ exit: expected = '''#line 1 "test_suite_ut.function" -void test_func() +void test_func(void) { ba ba black sheep have you any wool @@ -750,7 +750,7 @@ exit: void -test_func() +test_func(void) { ba ba black sheep have you any wool @@ -803,7 +803,7 @@ exit: -void test_func() +void test_func(void) { ba ba black sheep have you any wool @@ -1139,7 +1139,7 @@ void func2() #if defined(MBEDTLS_ENTROPY_NV_SEED) #if defined(MBEDTLS_FS_IO) #line 13 "test_suite_ut.function" -void test_func1() +void test_func1(void) { exit: ; @@ -1156,7 +1156,7 @@ void test_func1_wrapper( void ** params ) #if defined(MBEDTLS_ENTROPY_NV_SEED) #if defined(MBEDTLS_FS_IO) #line 19 "test_suite_ut.function" -void test_func2() +void test_func2(void) { exit: ; From 7b0ee1e655c3bf2204e979aeb858e6fe2505667f Mon Sep 17 00:00:00 2001 From: Agathiyan Bragadeesh Date: Thu, 27 Jul 2023 15:51:46 +0100 Subject: [PATCH 063/135] Fix control bypass warnings Declarations have been moved to the top of functions to fix this Signed-off-by: Agathiyan Bragadeesh --- library/ecp.c | 3 ++- library/psa_crypto.c | 34 +++++++++++++++++++--------- tests/src/test_helpers/ssl_helpers.c | 6 +++-- 3 files changed, 29 insertions(+), 14 deletions(-) diff --git a/library/ecp.c b/library/ecp.c index 2d80b6f33f..1cf242ae2d 100644 --- a/library/ecp.c +++ b/library/ecp.c @@ -2593,6 +2593,7 @@ static int ecp_mul_mxz(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, void *p_rng) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; + int have_rng; size_t i; unsigned char b; mbedtls_ecp_point RP; @@ -2626,7 +2627,7 @@ static int ecp_mul_mxz(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, MOD_ADD(RP.X); /* Randomize coordinates of the starting point */ - int have_rng = 1; + have_rng = 1; #if defined(MBEDTLS_ECP_NO_INTERNAL_RNG) if (f_rng == NULL) { have_rng = 0; diff --git a/library/psa_crypto.c b/library/psa_crypto.c index fdcdd43d50..d1e6b5cc46 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -1472,6 +1472,7 @@ psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key, { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; + psa_key_attributes_t attributes; psa_key_slot_t *slot; /* Reject a zero-length output buffer now, since this can never be a @@ -1498,7 +1499,7 @@ psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key, goto exit; } - psa_key_attributes_t attributes = { + attributes = (psa_key_attributes_t) { .core = slot->attr }; status = psa_driver_wrapper_export_public_key( @@ -2406,6 +2407,7 @@ static psa_status_t psa_mac_setup(psa_mac_operation_t *operation, { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; + psa_key_attributes_t attributes; psa_key_slot_t *slot = NULL; /* A context must be freshly initialized before it can be set up. */ @@ -2423,7 +2425,7 @@ static psa_status_t psa_mac_setup(psa_mac_operation_t *operation, goto exit; } - psa_key_attributes_t attributes = { + attributes = (psa_key_attributes_t) { .core = slot->attr }; @@ -2594,6 +2596,7 @@ static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key, { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; + psa_key_attributes_t attributes; psa_key_slot_t *slot; uint8_t operation_mac_size = 0; @@ -2606,7 +2609,7 @@ static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key, goto exit; } - psa_key_attributes_t attributes = { + attributes = (psa_key_attributes_t) { .core = slot->attr }; @@ -2732,6 +2735,7 @@ static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key, { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; + psa_key_attributes_t attributes; psa_key_slot_t *slot; *signature_length = 0; @@ -2764,7 +2768,7 @@ static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key, goto exit; } - psa_key_attributes_t attributes = { + attributes = (psa_key_attributes_t) { .core = slot->attr }; @@ -3303,6 +3307,7 @@ static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation, { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; + psa_key_attributes_t attributes; psa_key_slot_t *slot = NULL; psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ? PSA_KEY_USAGE_ENCRYPT : @@ -3338,7 +3343,7 @@ static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation, } operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg); - psa_key_attributes_t attributes = { + attributes = (psa_key_attributes_t) { .core = slot->attr }; @@ -3561,6 +3566,7 @@ psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key, { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; + psa_key_attributes_t attributes; psa_key_slot_t *slot = NULL; uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE]; size_t default_iv_length = 0; @@ -3577,7 +3583,7 @@ psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key, goto exit; } - psa_key_attributes_t attributes = { + attributes = (psa_key_attributes_t) { .core = slot->attr }; @@ -3633,6 +3639,7 @@ psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key, { psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; + psa_key_attributes_t attributes; psa_key_slot_t *slot = NULL; if (!PSA_ALG_IS_CIPHER(alg)) { @@ -3647,7 +3654,7 @@ psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key, goto exit; } - psa_key_attributes_t attributes = { + attributes = (psa_key_attributes_t) { .core = slot->attr }; @@ -4251,6 +4258,7 @@ static psa_status_t psa_generate_derived_key_internal( uint8_t *data = NULL; size_t bytes = PSA_BITS_TO_BYTES(bits); psa_status_t status; + psa_key_attributes_t attributes; if (!key_type_is_raw_bytes(slot->attr.type)) { return PSA_ERROR_INVALID_ARGUMENT; @@ -4279,7 +4287,7 @@ static psa_status_t psa_generate_derived_key_internal( } slot->attr.bits = (psa_key_bits_t) bits; - psa_key_attributes_t attributes = { + attributes = (psa_key_attributes_t) { .core = slot->attr }; @@ -4891,14 +4899,15 @@ static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg, size_t shared_secret_size, size_t *shared_secret_length) { + mbedtls_ecp_keypair *ecp = NULL; + psa_status_t status; switch (alg) { #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) case PSA_ALG_ECDH: if (!PSA_KEY_TYPE_IS_ECC_KEY_PAIR(private_key->attr.type)) { return PSA_ERROR_INVALID_ARGUMENT; } - mbedtls_ecp_keypair *ecp = NULL; - psa_status_t status = mbedtls_psa_ecp_load_representation( + status = mbedtls_psa_ecp_load_representation( private_key->attr.type, private_key->attr.bits, private_key->key.data, @@ -4916,6 +4925,8 @@ static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg, return status; #endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */ default: + (void) ecp; + (void) status; (void) private_key; (void) peer_key; (void) peer_key_length; @@ -5011,6 +5022,7 @@ psa_status_t psa_raw_key_agreement(psa_algorithm_t alg, psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; psa_key_slot_t *slot = NULL; + size_t expected_length; if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) { status = PSA_ERROR_INVALID_ARGUMENT; @@ -5030,7 +5042,7 @@ psa_status_t psa_raw_key_agreement(psa_algorithm_t alg, * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot. * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily * be exact for it as well. */ - size_t expected_length = + expected_length = PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits); if (output_size < expected_length) { status = PSA_ERROR_BUFFER_TOO_SMALL; diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c index bc9a204983..52759aac9f 100644 --- a/tests/src/test_helpers/ssl_helpers.c +++ b/tests/src/test_helpers/ssl_helpers.c @@ -806,13 +806,14 @@ int mbedtls_ssl_write_fragment(mbedtls_ssl_context *ssl, int *written, const int expected_fragments) { + int ret; /* Verify that calling mbedtls_ssl_write with a NULL buffer and zero length is * a valid no-op for TLS connections. */ if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { TEST_ASSERT(mbedtls_ssl_write(ssl, NULL, 0) == 0); } - int ret = mbedtls_ssl_write(ssl, buf + *written, buf_len - *written); + ret = mbedtls_ssl_write(ssl, buf + *written, buf_len - *written); if (ret > 0) { *written += ret; } @@ -852,13 +853,14 @@ int mbedtls_ssl_read_fragment(mbedtls_ssl_context *ssl, int *read, int *fragments, const int expected_fragments) { + int ret; /* Verify that calling mbedtls_ssl_write with a NULL buffer and zero length is * a valid no-op for TLS connections. */ if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { TEST_ASSERT(mbedtls_ssl_read(ssl, NULL, 0) == 0); } - int ret = mbedtls_ssl_read(ssl, buf + *read, buf_len - *read); + ret = mbedtls_ssl_read(ssl, buf + *read, buf_len - *read); if (ret > 0) { (*fragments)++; *read += ret; From b96dbc6486cf70018077fe068f2bf9851aafc506 Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Thu, 27 Jul 2023 14:22:34 +0100 Subject: [PATCH 064/135] Make code_style.py -s more precise Signed-off-by: Dave Rodgman --- scripts/code_style.py | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/scripts/code_style.py b/scripts/code_style.py index 7de93b085e..89263cec06 100755 --- a/scripts/code_style.py +++ b/scripts/code_style.py @@ -81,11 +81,15 @@ def get_src_files(since: Optional[str]) -> List[str]: universal_newlines=True) src_files = output.split() if since: - output = subprocess.check_output(["git", "diff", "--name-only", - since, "--"] + - src_files, - universal_newlines=True) - src_files = output.split() + # get all files changed in commits since the starting point + cmd = ["git", "log", since + "..HEAD", "--name-only", "--pretty=", "--" ] + src_files + output = subprocess.check_output(cmd, universal_newlines=True) + committed_changed_files = output.split() + # and also get all files with uncommitted changes + cmd = ["git", "diff", "--name-only", "--" ] + src_files + output = subprocess.check_output(cmd, universal_newlines=True) + uncommitted_changed_files = output.split() + src_files = set(committed_changed_files + uncommitted_changed_files) generated_files = list_generated_files() # Don't correct style for third-party files (and, for simplicity, From 73b87e39d69c17a65222fabef3505102e3056d4b Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Thu, 27 Jul 2023 14:22:55 +0100 Subject: [PATCH 065/135] Make code_style.py -s default to -s=mbedtls-2.28 Signed-off-by: Dave Rodgman --- scripts/code_style.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/scripts/code_style.py b/scripts/code_style.py index 89263cec06..8a1889ea5a 100755 --- a/scripts/code_style.py +++ b/scripts/code_style.py @@ -193,9 +193,10 @@ def main() -> int: parser.add_argument('-f', '--fix', action='store_true', help=('modify source files to fix the code style ' '(default: print diff, do not modify files)')) - parser.add_argument('-s', '--since', metavar='COMMIT', + parser.add_argument('-s', '--since', metavar='COMMIT', const='mbedtls-2.28', nargs='?', help=('only check files modified since the specified commit' - ' (e.g. --since=HEAD~3 or --since=development)')) + ' (e.g. --since=HEAD~3 or --since=mbedtls-2.28). If no' + ' commit is specified, default to mbedtls-2.28.')) # --subset is almost useless: it only matters if there are no files # ('code_style.py' without arguments checks all files known to Git, # 'code_style.py --subset' does nothing). In particular, From e67ffd6d209ddb17f30e962b3835588dc6254daf Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Thu, 27 Jul 2023 18:50:50 +0100 Subject: [PATCH 066/135] pylint tidy-up Signed-off-by: Dave Rodgman --- scripts/code_style.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/code_style.py b/scripts/code_style.py index 8a1889ea5a..0ef06673a0 100755 --- a/scripts/code_style.py +++ b/scripts/code_style.py @@ -82,14 +82,14 @@ def get_src_files(since: Optional[str]) -> List[str]: src_files = output.split() if since: # get all files changed in commits since the starting point - cmd = ["git", "log", since + "..HEAD", "--name-only", "--pretty=", "--" ] + src_files + cmd = ["git", "log", since + "..HEAD", "--name-only", "--pretty=", "--"] + src_files output = subprocess.check_output(cmd, universal_newlines=True) committed_changed_files = output.split() # and also get all files with uncommitted changes cmd = ["git", "diff", "--name-only", "--" ] + src_files output = subprocess.check_output(cmd, universal_newlines=True) uncommitted_changed_files = output.split() - src_files = set(committed_changed_files + uncommitted_changed_files) + src_files = list(set(committed_changed_files + uncommitted_changed_files)) generated_files = list_generated_files() # Don't correct style for third-party files (and, for simplicity, From dd7b24c3bf148f534c044b431c84f704e34283d9 Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Thu, 27 Jul 2023 20:00:41 +0100 Subject: [PATCH 067/135] whitespace fix Signed-off-by: Dave Rodgman --- scripts/code_style.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/code_style.py b/scripts/code_style.py index 0ef06673a0..54b516867e 100755 --- a/scripts/code_style.py +++ b/scripts/code_style.py @@ -86,7 +86,7 @@ def get_src_files(since: Optional[str]) -> List[str]: output = subprocess.check_output(cmd, universal_newlines=True) committed_changed_files = output.split() # and also get all files with uncommitted changes - cmd = ["git", "diff", "--name-only", "--" ] + src_files + cmd = ["git", "diff", "--name-only", "--"] + src_files output = subprocess.check_output(cmd, universal_newlines=True) uncommitted_changed_files = output.split() src_files = list(set(committed_changed_files + uncommitted_changed_files)) From 5521b4ce37b2b7768a66c3a2b5a2fcff200ca11a Mon Sep 17 00:00:00 2001 From: Agathiyan Bragadeesh Date: Mon, 31 Jul 2023 16:15:56 +0100 Subject: [PATCH 068/135] Assign have_rng in declaration of ecp_mul_mxz Signed-off-by: Agathiyan Bragadeesh --- library/ecp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/library/ecp.c b/library/ecp.c index 1cf242ae2d..5b60291cc8 100644 --- a/library/ecp.c +++ b/library/ecp.c @@ -2593,7 +2593,7 @@ static int ecp_mul_mxz(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, void *p_rng) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - int have_rng; + int have_rng = 1; size_t i; unsigned char b; mbedtls_ecp_point RP; @@ -2626,9 +2626,8 @@ static int ecp_mul_mxz(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, /* RP.X might be slightly larger than P, so reduce it */ MOD_ADD(RP.X); - /* Randomize coordinates of the starting point */ - have_rng = 1; #if defined(MBEDTLS_ECP_NO_INTERNAL_RNG) + /* Derandomize coordinates of the starting point */ if (f_rng == NULL) { have_rng = 0; } From e7eb8052befbce14917cc1dbe8e7a8bdc854f245 Mon Sep 17 00:00:00 2001 From: Agathiyan Bragadeesh Date: Mon, 31 Jul 2023 16:16:38 +0100 Subject: [PATCH 069/135] Seperate declarations from function body Signed-off-by: Agathiyan Bragadeesh --- library/psa_crypto.c | 1 + tests/src/test_helpers/ssl_helpers.c | 2 ++ 2 files changed, 3 insertions(+) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index d1e6b5cc46..fade286ecd 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -4901,6 +4901,7 @@ static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg, { mbedtls_ecp_keypair *ecp = NULL; psa_status_t status; + switch (alg) { #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) case PSA_ALG_ECDH: diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c index 52759aac9f..bd1f46c968 100644 --- a/tests/src/test_helpers/ssl_helpers.c +++ b/tests/src/test_helpers/ssl_helpers.c @@ -807,6 +807,7 @@ int mbedtls_ssl_write_fragment(mbedtls_ssl_context *ssl, const int expected_fragments) { int ret; + /* Verify that calling mbedtls_ssl_write with a NULL buffer and zero length is * a valid no-op for TLS connections. */ if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { @@ -854,6 +855,7 @@ int mbedtls_ssl_read_fragment(mbedtls_ssl_context *ssl, const int expected_fragments) { int ret; + /* Verify that calling mbedtls_ssl_write with a NULL buffer and zero length is * a valid no-op for TLS connections. */ if (ssl->conf->transport != MBEDTLS_SSL_TRANSPORT_DATAGRAM) { From f5257c06d1fa95fe2c0130f4497645993b58a3be Mon Sep 17 00:00:00 2001 From: Marek Jansta Date: Mon, 31 Jul 2023 14:49:38 +0200 Subject: [PATCH 070/135] Cherry picked required prerequisites from dev branch, git hash 0167244b Signed-off-by: Marek Jansta --- include/mbedtls/asn1write.h | 21 +++++++++++++++++++++ library/asn1write.c | 23 ++++++++++++++++------- 2 files changed, 37 insertions(+), 7 deletions(-) diff --git a/include/mbedtls/asn1write.h b/include/mbedtls/asn1write.h index a439268b0e..f453169e2e 100644 --- a/include/mbedtls/asn1write.h +++ b/include/mbedtls/asn1write.h @@ -158,6 +158,27 @@ int mbedtls_asn1_write_algorithm_identifier(unsigned char **p, const char *oid, size_t oid_len, size_t par_len); +/** + * \brief Write an AlgorithmIdentifier sequence in ASN.1 format. + * + * \note This function works backwards in data buffer. + * + * \param p The reference to the current position pointer. + * \param start The start of the buffer, for bounds-checking. + * \param oid The OID of the algorithm to write. + * \param oid_len The length of the algorithm's OID. + * \param par_len The length of the parameters, which must be already written. + * \param has_par If there are any parameters. If 0, par_len must be 0. If 1 + * and \p par_len is 0, NULL parameters are added. + * + * \return The number of bytes written to \p p on success. + * \return A negative \c MBEDTLS_ERR_ASN1_XXX error code on failure. + */ +int mbedtls_asn1_write_algorithm_identifier_ext(unsigned char **p, + unsigned char *start, + const char *oid, size_t oid_len, + size_t par_len, int has_par); + /** * \brief Write a boolean tag (#MBEDTLS_ASN1_BOOLEAN) and value * in ASN.1 format. diff --git a/library/asn1write.c b/library/asn1write.c index 0b487dceaa..f9c3830564 100644 --- a/library/asn1write.c +++ b/library/asn1write.c @@ -194,25 +194,34 @@ int mbedtls_asn1_write_oid(unsigned char **p, unsigned char *start, int mbedtls_asn1_write_algorithm_identifier(unsigned char **p, unsigned char *start, const char *oid, size_t oid_len, size_t par_len) +{ + return mbedtls_asn1_write_algorithm_identifier_ext(p, start, oid, oid_len, par_len, 1); +} + +int mbedtls_asn1_write_algorithm_identifier_ext(unsigned char **p, unsigned char *start, + const char *oid, size_t oid_len, + size_t par_len, int has_par) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; size_t len = 0; - if (par_len == 0) { - MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_null(p, start)); - } else { - len += par_len; + if (has_par) { + if (par_len == 0) { + MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_null(p, start)); + } else { + len += par_len; + } } MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_oid(p, start, oid, oid_len)); MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len)); MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start, - MBEDTLS_ASN1_CONSTRUCTED | - MBEDTLS_ASN1_SEQUENCE)); + MBEDTLS_ASN1_CONSTRUCTED | + MBEDTLS_ASN1_SEQUENCE)); return (int) len; -} + } int mbedtls_asn1_write_bool(unsigned char **p, unsigned char *start, int boolean) { From 0a6743b2debd107ecb2f6e99be529049e37ff9de Mon Sep 17 00:00:00 2001 From: Marek Jansta Date: Mon, 7 Nov 2022 12:38:38 +0100 Subject: [PATCH 071/135] Fixed AlgorithmIdentifier parameters when used with ECDSA signature algorithm in x509 certificate Signed-off-by: Marek Jansta --- .../x509-ec-algorithm-identifier-fix.txt | 4 ++++ include/mbedtls/x509.h | 3 ++- library/asn1write.c | 6 +++--- library/x509_create.c | 19 +++++++++++++++--- library/x509write_crt.c | 20 +++++++++++++++---- library/x509write_csr.c | 2 +- tests/data_files/Makefile | 2 +- tests/data_files/Readme-x509.txt | 4 ++++ .../parse_input/server5-non-compliant.crt | 12 +++++++++++ tests/data_files/server5.req.ku.sha1 | 6 +++--- tests/suites/test_suite_x509parse.data | 8 ++++++++ 11 files changed, 70 insertions(+), 16 deletions(-) create mode 100644 ChangeLog.d/x509-ec-algorithm-identifier-fix.txt create mode 100644 tests/data_files/parse_input/server5-non-compliant.crt diff --git a/ChangeLog.d/x509-ec-algorithm-identifier-fix.txt b/ChangeLog.d/x509-ec-algorithm-identifier-fix.txt new file mode 100644 index 0000000000..c1de491e60 --- /dev/null +++ b/ChangeLog.d/x509-ec-algorithm-identifier-fix.txt @@ -0,0 +1,4 @@ +Bugfix + * Fix x509 certificate generation to conform to RFC 5480 / RFC 5758 when + using ECC key. The certificate was rejected by some crypto frameworks. + Fixes #2924. diff --git a/include/mbedtls/x509.h b/include/mbedtls/x509.h index 8fd321a020..f00f3a6679 100644 --- a/include/mbedtls/x509.h +++ b/include/mbedtls/x509.h @@ -361,7 +361,8 @@ int mbedtls_x509_write_names(unsigned char **p, unsigned char *start, mbedtls_asn1_named_data *first); int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start, const char *oid, size_t oid_len, - unsigned char *sig, size_t size); + unsigned char *sig, size_t size, + mbedtls_pk_type_t pk_alg); #define MBEDTLS_X509_SAFE_SNPRINTF \ do { \ diff --git a/library/asn1write.c b/library/asn1write.c index f9c3830564..a499bead45 100644 --- a/library/asn1write.c +++ b/library/asn1write.c @@ -217,11 +217,11 @@ int mbedtls_asn1_write_algorithm_identifier_ext(unsigned char **p, unsigned char MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(p, start, len)); MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(p, start, - MBEDTLS_ASN1_CONSTRUCTED | - MBEDTLS_ASN1_SEQUENCE)); + MBEDTLS_ASN1_CONSTRUCTED | + MBEDTLS_ASN1_SEQUENCE)); return (int) len; - } +} int mbedtls_asn1_write_bool(unsigned char **p, unsigned char *start, int boolean) { diff --git a/library/x509_create.c b/library/x509_create.c index cdfc82aa5d..bd772d3ac7 100644 --- a/library/x509_create.c +++ b/library/x509_create.c @@ -285,9 +285,11 @@ int mbedtls_x509_write_names(unsigned char **p, unsigned char *start, int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start, const char *oid, size_t oid_len, - unsigned char *sig, size_t size) + unsigned char *sig, size_t size, + mbedtls_pk_type_t pk_alg) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; + int write_null_par; size_t len = 0; if (*p < start || (size_t) (*p - start) < size) { @@ -310,8 +312,19 @@ int mbedtls_x509_write_sig(unsigned char **p, unsigned char *start, // Write OID // - MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_algorithm_identifier(p, start, oid, - oid_len, 0)); + if (pk_alg == MBEDTLS_PK_ECDSA) { + /* + * The AlgorithmIdentifier's parameters field must be absent for DSA/ECDSA signature + * algorithms, see https://www.rfc-editor.org/rfc/rfc5480#page-17 and + * https://www.rfc-editor.org/rfc/rfc5758#section-3. + */ + write_null_par = 0; + } else { + write_null_par = 1; + } + MBEDTLS_ASN1_CHK_ADD(len, + mbedtls_asn1_write_algorithm_identifier_ext(p, start, oid, oid_len, + 0, write_null_par)); return (int) len; } diff --git a/library/x509write_crt.c b/library/x509write_crt.c index a8f4c286ee..e9944110e7 100644 --- a/library/x509write_crt.c +++ b/library/x509write_crt.c @@ -342,6 +342,7 @@ int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx, size_t sub_len = 0, pub_len = 0, sig_and_oid_len = 0, sig_len; size_t len = 0; mbedtls_pk_type_t pk_alg; + int write_sig_null_par; /* * Prepare data to be signed at the end of the target buffer @@ -433,9 +434,20 @@ int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx, /* * Signature ::= AlgorithmIdentifier */ + if (pk_alg == MBEDTLS_PK_ECDSA) { + /* + * The AlgorithmIdentifier's parameters field must be absent for DSA/ECDSA signature + * algorithms, see https://www.rfc-editor.org/rfc/rfc5480#page-17 and + * https://www.rfc-editor.org/rfc/rfc5758#section-3. + */ + write_sig_null_par = 0; + } else { + write_sig_null_par = 1; + } MBEDTLS_ASN1_CHK_ADD(len, - mbedtls_asn1_write_algorithm_identifier(&c, buf, - sig_oid, strlen(sig_oid), 0)); + mbedtls_asn1_write_algorithm_identifier_ext(&c, buf, + sig_oid, strlen(sig_oid), + 0, write_sig_null_par)); /* * Serial ::= INTEGER @@ -492,8 +504,8 @@ int mbedtls_x509write_crt_der(mbedtls_x509write_cert *ctx, * into the CRT buffer. */ c2 = buf + size; MBEDTLS_ASN1_CHK_ADD(sig_and_oid_len, mbedtls_x509_write_sig(&c2, c, - sig_oid, sig_oid_len, sig, - sig_len)); + sig_oid, sig_oid_len, + sig, sig_len, pk_alg)); /* * Memory layout after this step: diff --git a/library/x509write_csr.c b/library/x509write_csr.c index a421fde97e..178b166df1 100644 --- a/library/x509write_csr.c +++ b/library/x509write_csr.c @@ -265,7 +265,7 @@ static int x509write_csr_der_internal(mbedtls_x509write_csr *ctx, c2 = buf + size; MBEDTLS_ASN1_CHK_ADD(sig_and_oid_len, mbedtls_x509_write_sig(&c2, buf + len, sig_oid, sig_oid_len, - sig, sig_len)); + sig, sig_len, pk_alg)); /* * Compact the space between the CSR data and signature by moving the diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 17e0f90f54..222988ccdd 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1210,7 +1210,7 @@ all_final += server5-badsign.crt # The use of 'Server 1' in the DN is intentional here, as the DN is hardcoded in the x509_write test suite.' server5.req.ku.sha1: server5.key - $(MBEDTLS_CERT_REQ) output_file=$@ filename=$< key_usage=digital_signature,non_repudiation subject_name="C=NL,O=PolarSSL,CN=PolarSSL Server 1" md=SHA1 + $(OPENSSL) req -key $< -out $@ -new -nodes -subj "/C=NL/O=PolarSSL/CN=PolarSSL Server 1" -sha1 -addext keyUsage=digitalSignature,nonRepudiation all_final += server5.req.ku.sha1 # server6* diff --git a/tests/data_files/Readme-x509.txt b/tests/data_files/Readme-x509.txt index 84c775fd91..82f93d2306 100644 --- a/tests/data_files/Readme-x509.txt +++ b/tests/data_files/Readme-x509.txt @@ -76,6 +76,10 @@ List of certificates: -badsign.crt: S5 with corrupted signature -expired.crt: S5 with "not after" date in the past -future.crt: S5 with "not before" date in the future + -non-compliant.crt: S5, RFC non-compliant + (with forbidden EC algorithm identifier NULL parameter) + generated by (before fix): + cert_write subject_key=server5.key subject_name="CN=Test EC RFC non-compliant" issuer_crt=test-ca2.crt issuer_key=test-ca2.key -selfsigned.crt: Self-signed cert with S5 key -ss-expired.crt: Self-signed cert with S5 key, expired -ss-forgeca.crt: Copy of test-int-ca3 self-signed with S5 key diff --git a/tests/data_files/parse_input/server5-non-compliant.crt b/tests/data_files/parse_input/server5-non-compliant.crt new file mode 100644 index 0000000000..abea17ddc7 --- /dev/null +++ b/tests/data_files/parse_input/server5-non-compliant.crt @@ -0,0 +1,12 @@ +-----BEGIN CERTIFICATE----- +MIIBwjCCAUagAwIBAgIBATAMBggqhkjOPQQDAgUAMD4xCzAJBgNVBAYTAk5MMREw +DwYDVQQKDAhQb2xhclNTTDEcMBoGA1UEAwwTUG9sYXJzc2wgVGVzdCBFQyBDQTAe +Fw0wMTAxMDEwMDAwMDBaFw0zMDEyMzEyMzU5NTlaMCQxIjAgBgNVBAMMGVRlc3Qg +RUMgUkZDIG5vbi1jb21wbGlhbnQwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQ3 +zFbZdgkeWnI+x1kt/yBu7nz5BpF00K0UtfdoIllikk7lANgjEf/qL9I0XV0WvYqI +wmt3DVXNiioO+gHItO3/o00wSzAJBgNVHRMEAjAAMB0GA1UdDgQWBBRQYaWP1AfZ +14IBDOVlf4xjRqcTvjAfBgNVHSMEGDAWgBSdbSAkSQE/K8t4tRm8fiTJ2/s2fDAM +BggqhkjOPQQDAgUAA2gAMGUCMAJ3J/DooFSaBG2OhzyWai32q6INDZfoS2bToSKf +gy6hbJiIX/G9eFts5+BJQ3QpjgIxALRmIgdR91BDdqpeF5JCmhgjbfbgMQ7mrMeS +ZGfNyFyjS75QnIA6nKryQmgPXo+sCQ== +-----END CERTIFICATE----- diff --git a/tests/data_files/server5.req.ku.sha1 b/tests/data_files/server5.req.ku.sha1 index 3281c94608..c73a0e27d8 100644 --- a/tests/data_files/server5.req.ku.sha1 +++ b/tests/data_files/server5.req.ku.sha1 @@ -1,8 +1,8 @@ -----BEGIN CERTIFICATE REQUEST----- -MIIBFjCBvAIBADA8MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGjAY +MIIBFDCBvAIBADA8MQswCQYDVQQGEwJOTDERMA8GA1UECgwIUG9sYXJTU0wxGjAY BgNVBAMMEVBvbGFyU1NMIFNlcnZlciAxMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD QgAEN8xW2XYJHlpyPsdZLf8gbu58+QaRdNCtFLX3aCJZYpJO5QDYIxH/6i/SNF1d Fr2KiMJrdw1VzYoqDvoByLTt/6AeMBwGCSqGSIb3DQEJDjEPMA0wCwYDVR0PBAQD -AgbAMAsGByqGSM49BAEFAANIADBFAiEAnIKF+xKk0iEuN4MHd4FZWNvrznLQgkeg -2n8ejjreTzcCIAH34z2TycuMpWQRhpV+YT988pBWR67LAg7REyZnjSAB +AgbAMAkGByqGSM49BAEDSAAwRQIhAJyChfsSpNIhLjeDB3eBWVjb685y0IJHoNp/ +Ho463k83AiAB9+M9k8nLjKVkEYaVfmE/fPKQVkeuywIO0RMmZ40gAQ== -----END CERTIFICATE REQUEST----- diff --git a/tests/suites/test_suite_x509parse.data b/tests/suites/test_suite_x509parse.data index c796cddf3c..406a06385a 100644 --- a/tests/suites/test_suite_x509parse.data +++ b/tests/suites/test_suite_x509parse.data @@ -2890,6 +2890,14 @@ X509 File parse (Algorithm Params Tag mismatch) depends_on:MBEDTLS_SHA256_C:MBEDTLS_RSA_C mbedtls_x509_crt_parse_file:"data_files/parse_input/cli-rsa-sha256-badalg.crt.der":MBEDTLS_ERR_X509_SIG_MISMATCH:0 +X509 File parse (does not conform to RFC 5480 / RFC 5758 - AlgorithmIdentifier's parameters field is present, mbedTLS generated before bugfix, OK) +depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C +x509parse_crt_file:"data_files/parse_input/server5-non-compliant.crt":0 + +X509 File parse (conforms to RFC 5480 / RFC 5758 - AlgorithmIdentifier's parameters field must be absent for ECDSA) +depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_SHA256_C +x509parse_crt_file:"data_files/parse_input/server5.crt":0 + X509 Get time (UTC no issues) depends_on:MBEDTLS_X509_USE_C x509_get_time:MBEDTLS_ASN1_UTC_TIME:"500101000000Z":0:1950:1:1:0:0:0 From dcaa5ea4e5383362c63c60e5b4f2c9f3a0ae3660 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Wed, 26 Jul 2023 12:32:34 +0100 Subject: [PATCH 072/135] Update CONTRIBUTING.md Signed-off-by: Tom Cosgrove --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index fab42fdcbc..8bbcdcb670 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -92,6 +92,6 @@ All new files should include the [Apache-2.0](https://spdx.org/licenses/Apache-2 The copyright on contributions is retained by the original authors of the code. Where possible for new files, this should be noted in a comment at the top of the file in the form: "Copyright The Mbed TLS Contributors". -When contributing code to us, the committer and all authors are required to make the submission under the terms of the [Developer Certificate of Origin](dco.txt), confirming that the code submitted can (legally) become part of the project, and be subject to either or both the Apache 2.0 and/or GPL-2.0-or-later licenses. +When contributing code to us, the committer and all authors are required to make the submission under the terms of the [Developer Certificate of Origin](dco.txt), confirming that the code submitted can (legally) become part of the project, and is submitted under both the Apache-2.0 AND GPL-2.0-or-later licenses. This is done by including the standard Git `Signed-off-by:` line in every commit message. If more than one person contributed to the commit, they should also add their own `Signed-off-by:` line. From 53453cf250597cc9a1bb1929690026a8d73f6e9b Mon Sep 17 00:00:00 2001 From: Gowtham Suresh Kumar Date: Fri, 28 Jul 2023 16:36:25 +0100 Subject: [PATCH 073/135] Remove test_clang_opt check The component functions in all.sh will be listed using compgen instead of sed so this check is not needed. Signed-off-by: Gowtham Suresh Kumar --- tests/scripts/all.sh | 7 ------- 1 file changed, 7 deletions(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index bf69517113..ca7f45517f 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -194,13 +194,6 @@ pre_initialize_variables () { # they are defined. ALL_COMPONENTS=$(sed -n 's/^ *component_\([0-9A-Z_a-z]*\) *().*/\1/p' <"$0") - # For Linux platforms we run latest/earliest versions of clang and the - # test_clang_opt function is only for FreeBSD. This condition removes - # test_clang_opt element from the ALL_COMPONENTS array for Linux. - if [[ $(uname) == "Linux" ]]; then - ALL_COMPONENTS=( "${ALL_COMPONENTS[@]/test_clang_opt}" ) - fi - # Exclude components that are not supported on this platform. SUPPORTED_COMPONENTS= for component in $ALL_COMPONENTS; do From 13850f387b8c2983aa99a581ffec6d81544598e7 Mon Sep 17 00:00:00 2001 From: Gowtham Suresh Kumar Date: Fri, 28 Jul 2023 16:41:21 +0100 Subject: [PATCH 074/135] Use compgen to gather components in all.sh Signed-off-by: Gowtham Suresh Kumar --- tests/scripts/all.sh | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index ca7f45517f..b5c8cd3742 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -190,9 +190,7 @@ pre_initialize_variables () { # Gather the list of available components. These are the functions # defined in this script whose name starts with "component_". - # Parse the script with sed. This way we get the functions in the order - # they are defined. - ALL_COMPONENTS=$(sed -n 's/^ *component_\([0-9A-Z_a-z]*\) *().*/\1/p' <"$0") + ALL_COMPONENTS=$(compgen -A function component_ | sed 's/component_//') # Exclude components that are not supported on this platform. SUPPORTED_COMPONENTS= From 2afb24f96a2b6a60b9ecbfecb0d241c40313928b Mon Sep 17 00:00:00 2001 From: Gowtham Suresh Kumar Date: Tue, 1 Aug 2023 09:45:57 +0100 Subject: [PATCH 075/135] Use variables for selecting compilers The latest and earliest clang/GCC compilers are now used through variables instead of symlinks and also the all.sh script is updated to support options for overriding the default values. Signed-off-by: Gowtham Suresh Kumar --- scripts/output_env.sh | 24 ++++++++++++++++++++---- tests/scripts/all.sh | 28 ++++++++++++++++++++-------- 2 files changed, 40 insertions(+), 12 deletions(-) diff --git a/scripts/output_env.sh b/scripts/output_env.sh index ce2c500656..535613298e 100755 --- a/scripts/output_env.sh +++ b/scripts/output_env.sh @@ -105,19 +105,35 @@ echo print_version "gcc" "--version" "" "head -n 1" echo -print_version "gcc-earliest" "--version" "" "head -n 1" +if [ -n "${GCC_EARLIEST+set}" ]; then + print_version "${GCC_EARLIEST}" "--version" "" "head -n 1" +else + echo " GCC_EARLIEST : Not configured." +fi echo -print_version "gcc-latest" "--version" "" "head -n 1" +if [ -n "${GCC_LATEST+set}" ]; then + print_version "${GCC_LATEST}" "--version" "" "head -n 1" +else + echo " GCC_LATEST : Not configured." +fi echo print_version "clang" "--version" "" "head -n 2" echo -print_version "clang-earliest" "--version" "" "head -n 2" +if [ -n "${CLANG_EARLIEST+set}" ]; then + print_version "${CLANG_EARLIEST}" "--version" "" "head -n 2" +else + echo " CLANG_EARLIEST : Not configured." +fi echo -print_version "clang-latest" "--version" "" "head -n 2" +if [ -n "${CLANG_LATEST+set}" ]; then + print_version "${CLANG_LATEST}" "--version" "" "head -n 2" +else + echo " CLANG_LATEST : Not configured." +fi echo print_version "ldd" "--version" "" "head -n 1" diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index b5c8cd3742..4a59026a86 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -175,6 +175,10 @@ pre_initialize_variables () { : ${ARMC6_BIN_DIR:=/usr/bin} : ${ARM_NONE_EABI_GCC_PREFIX:=arm-none-eabi-} : ${ARM_LINUX_GNUEABI_GCC_PREFIX:=arm-linux-gnueabi-} + : ${CLANG_LATEST:="clang-16"} + : ${CLANG_EARLIEST:="clang-3.5"} + : ${GCC_LATEST:="gcc-12"} + : ${GCC_EARLIEST:="gcc-4.7"} # if MAKEFLAGS is not set add the -j option to speed up invocations of make if [ -z "${MAKEFLAGS+set}" ]; then @@ -272,6 +276,10 @@ General options: Tool path options: --armc5-bin-dir= ARM Compiler 5 bin directory. --armc6-bin-dir= ARM Compiler 6 bin directory. + --clang-earliest= Earliest version of clang available + --clang-latest= Latest version of clang available + --gcc-earliest= Earliest version of GCC available + --gcc-latest= Latest version of GCC available --gnutls-cli= GnuTLS client executable to use for most tests. --gnutls-serv= GnuTLS server executable to use for most tests. --gnutls-legacy-cli= GnuTLS client executable to use for legacy tests. @@ -415,9 +423,13 @@ pre_parse_command_line () { --armcc) no_armcc=;; --armc5-bin-dir) shift; ARMC5_BIN_DIR="$1";; --armc6-bin-dir) shift; ARMC6_BIN_DIR="$1";; + --clang-earliest) shift; CLANG_EARLIEST="$1";; + --clang-latest) shift; CLANG_LATEST="$1";; --error-test) error_test=$((error_test + 1));; --except) all_except=1;; --force|-f) FORCE=1;; + --gcc-earliest) shift; GCC_EARLIEST="$1";; + --gcc-latest) shift; GCC_LATEST="$1";; --gnutls-cli) shift; GNUTLS_CLI="$1";; --gnutls-legacy-cli) shift; GNUTLS_LEGACY_CLI="$1";; --gnutls-legacy-serv) shift; GNUTLS_LEGACY_SERV="$1";; @@ -2953,34 +2965,34 @@ fi component_test_clang_latest_opt () { scripts/config.py full - test_build_opt 'full config' clang-latest -O0 -Os -O2 + test_build_opt 'full config' "$CLANG_LATEST" -O0 -Os -O2 } support_test_clang_latest_opt () { - type clang-latest >/dev/null 2>/dev/null + type "$CLANG_LATEST" >/dev/null 2>/dev/null } component_test_clang_earliest_opt () { scripts/config.py full - test_build_opt 'full config' clang-earliest -O0 + test_build_opt 'full config' "$CLANG_EARLIEST" -O0 } support_test_clang_earliest_opt () { - type clang-earliest >/dev/null 2>/dev/null + type "$CLANG_EARLIEST" >/dev/null 2>/dev/null } component_test_gcc_latest_opt () { scripts/config.py full - test_build_opt 'full config' gcc-latest -O0 -Os -O2 + test_build_opt 'full config' "$GCC_LATEST" -O0 -Os -O2 } support_test_gcc_latest_opt () { - type gcc-latest >/dev/null 2>/dev/null + type "$GCC_LATEST" >/dev/null 2>/dev/null } component_test_gcc_earliest_opt () { scripts/config.py full - test_build_opt 'full config' gcc-earliest -O0 + test_build_opt 'full config' "$GCC_EARLIEST" -O0 } support_test_gcc_earliest_opt () { - type gcc-earliest >/dev/null 2>/dev/null + type "$GCC_EARLIEST" >/dev/null 2>/dev/null } component_build_mbedtls_config_file () { From cc029afbd0311d1fe054245230ab509ee1be587d Mon Sep 17 00:00:00 2001 From: Gowtham Suresh Kumar Date: Tue, 1 Aug 2023 09:48:32 +0100 Subject: [PATCH 076/135] Update default variable values for compilers Signed-off-by: Gowtham Suresh Kumar --- tests/scripts/all.sh | 8 ++++---- tests/scripts/generate_test_code.py | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 4a59026a86..3e95645e69 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -175,10 +175,10 @@ pre_initialize_variables () { : ${ARMC6_BIN_DIR:=/usr/bin} : ${ARM_NONE_EABI_GCC_PREFIX:=arm-none-eabi-} : ${ARM_LINUX_GNUEABI_GCC_PREFIX:=arm-linux-gnueabi-} - : ${CLANG_LATEST:="clang-16"} - : ${CLANG_EARLIEST:="clang-3.5"} - : ${GCC_LATEST:="gcc-12"} - : ${GCC_EARLIEST:="gcc-4.7"} + : ${CLANG_LATEST:="clang-latest"} + : ${CLANG_EARLIEST:="clang-earliest"} + : ${GCC_LATEST:="gcc-latest"} + : ${GCC_EARLIEST:="gcc-earliest"} # if MAKEFLAGS is not set add the -j option to speed up invocations of make if [ -z "${MAKEFLAGS+set}" ]; then diff --git a/tests/scripts/generate_test_code.py b/tests/scripts/generate_test_code.py index 96e967eeb8..ed784492f6 100755 --- a/tests/scripts/generate_test_code.py +++ b/tests/scripts/generate_test_code.py @@ -655,7 +655,7 @@ def parse_function_code(funcs_f, dependencies, suite_dependencies): name = 'test_' + name # If a test function has no arguments then add 'void' argument to - # avoid "-Wstrict-prototypes" warnings from clang-16 + # avoid "-Wstrict-prototypes" warnings from clang if len(args) == 0: code = code.replace('()', '(void)', 1) From 06d5e109897fdba032415ef26afef7cf784f8968 Mon Sep 17 00:00:00 2001 From: Agathiyan Bragadeesh Date: Tue, 1 Aug 2023 14:23:01 +0100 Subject: [PATCH 077/135] Fix IAR warning about unnecessary type quantifier Signed-off-by: Agathiyan Bragadeesh --- library/ecp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/ecp.c b/library/ecp.c index 2d80b6f33f..1dff3925b5 100644 --- a/library/ecp.c +++ b/library/ecp.c @@ -166,7 +166,7 @@ static int ecp_drbg_seed(ecp_drbg_context *ctx, unsigned char secret_bytes[MBEDTLS_ECP_MAX_BYTES]; /* The list starts with strong hashes */ const mbedtls_md_type_t md_type = - (const mbedtls_md_type_t) (mbedtls_md_list()[0]); + (mbedtls_md_type_t) (mbedtls_md_list()[0]); const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type); if (secret_len > MBEDTLS_ECP_MAX_BYTES) { From 973494d19303606a769e9bc8e8b55baacdcfa95b Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Wed, 2 Aug 2023 13:01:14 +0100 Subject: [PATCH 078/135] Clarify changelog not needed for compiler warnings Signed-off-by: Dave Rodgman --- ChangeLog.d/00README.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog.d/00README.md b/ChangeLog.d/00README.md index d2ea73d1c2..2fbc989dee 100644 --- a/ChangeLog.d/00README.md +++ b/ChangeLog.d/00README.md @@ -21,6 +21,9 @@ We generally don't include changelog entries for: * Performance improvements, unless they are particularly significant. * Changes to parts of the code base that users don't interact with directly, such as test code and test data. +* Fixes for compiler warnings. Releases typically contain a number of fixes + of this kind, so we will only mention them in the Changelog if they are + particularly significant. Until Mbed TLS 2.24.0, we required changelog entries in more cases. Looking at older changelog entries is good practice for how to write a From ccba2b7507a0e90c1a88750cbb417086efcaba97 Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Wed, 2 Aug 2023 14:47:25 +0100 Subject: [PATCH 079/135] Assemble 2.28.4 changelog Signed-off-by: Dave Rodgman --- ChangeLog | 26 +++++++++++++++++++ ChangeLog.d/armclang-compile-fix.txt | 5 ---- ChangeLog.d/bugfix_iar_typo.txt | 3 --- .../cmake-pass-through-config-defines.txt | 3 --- .../fix-crypt_and_hash-decrypt-issue.txt | 4 --- ChangeLog.d/fix-string-to-names-retcode.txt | 3 --- ChangeLog.d/fix-tfm-build.txt | 3 --- ChangeLog.d/fix-win32-llvm-build.txt | 2 -- ChangeLog.d/inject-entropy.txt | 2 -- ChangeLog.d/programs_psa_fix.txt | 3 --- ChangeLog.d/ssl_premaster_secret-empty.txt | 3 --- 11 files changed, 26 insertions(+), 31 deletions(-) delete mode 100644 ChangeLog.d/armclang-compile-fix.txt delete mode 100644 ChangeLog.d/bugfix_iar_typo.txt delete mode 100644 ChangeLog.d/cmake-pass-through-config-defines.txt delete mode 100644 ChangeLog.d/fix-crypt_and_hash-decrypt-issue.txt delete mode 100644 ChangeLog.d/fix-string-to-names-retcode.txt delete mode 100644 ChangeLog.d/fix-tfm-build.txt delete mode 100644 ChangeLog.d/fix-win32-llvm-build.txt delete mode 100644 ChangeLog.d/inject-entropy.txt delete mode 100644 ChangeLog.d/programs_psa_fix.txt delete mode 100644 ChangeLog.d/ssl_premaster_secret-empty.txt diff --git a/ChangeLog b/ChangeLog index 4033839d99..67b72fc661 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,31 @@ Mbed TLS ChangeLog (Sorted per branch, date) += Mbed TLS 2.28.4 branch released 2023-08-04 + +Features + * Allow MBEDTLS_CONFIG_FILE and MBEDTLS_USER_CONFIG_FILE to be set by + setting the CMake variable of the same name at configuration time. + +Bugfix + * Fix crypt_and_hash decryption fail when used with a stream cipher + mode of operation, due to the input not being a multiple of the block + size. Resolves #7417. + * Fix a bug where mbedtls_x509_string_to_names() would return success + when given a invalid name string, if it did not contain '=' or ','. + * Fix missing PSA initialization in sample programs when + MBEDTLS_USE_PSA_CRYPTO is enabled. + * Fix clang and armclang compilation error when targeting certain Arm + M-class CPUs (Cortex-M0, Cortex-M0+, Cortex-M1, Cortex-M23, + SecurCore SC000). Fixes #1077. + * Fixed an issue that caused compile errors when using CMake and the IAR + toolchain. + * Fix the build with MBEDTLS_PSA_INJECT_ENTROPY. Fixes #7516. + * Fix builds on Windows with clang. + * Fix compilation warnings in aes.c for certain combinations + of configuration options. + * Fix a compilation error on some platforms when including mbedtls/ssl.h + with all TLS support disabled. Fixes #6628. + = Mbed TLS 2.28.3 branch released 2023-03-28 Features diff --git a/ChangeLog.d/armclang-compile-fix.txt b/ChangeLog.d/armclang-compile-fix.txt deleted file mode 100644 index 93ad6af889..0000000000 --- a/ChangeLog.d/armclang-compile-fix.txt +++ /dev/null @@ -1,5 +0,0 @@ -Bugfix - * Fix clang and armclang compilation error when targeting certain Arm - M-class CPUs (Cortex-M0, Cortex-M0+, Cortex-M1, Cortex-M23, - SecurCore SC000). Fixes #1077. - diff --git a/ChangeLog.d/bugfix_iar_typo.txt b/ChangeLog.d/bugfix_iar_typo.txt deleted file mode 100644 index 95f97b1cb2..0000000000 --- a/ChangeLog.d/bugfix_iar_typo.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fixed an issue that caused compile errors when using CMake and the IAR - toolchain. diff --git a/ChangeLog.d/cmake-pass-through-config-defines.txt b/ChangeLog.d/cmake-pass-through-config-defines.txt deleted file mode 100644 index 6122f37d2d..0000000000 --- a/ChangeLog.d/cmake-pass-through-config-defines.txt +++ /dev/null @@ -1,3 +0,0 @@ -Features - * Allow MBEDTLS_CONFIG_FILE and MBEDTLS_USER_CONFIG_FILE to be set by - setting the CMake variable of the same name at configuration time. diff --git a/ChangeLog.d/fix-crypt_and_hash-decrypt-issue.txt b/ChangeLog.d/fix-crypt_and_hash-decrypt-issue.txt deleted file mode 100644 index ded9b2d47b..0000000000 --- a/ChangeLog.d/fix-crypt_and_hash-decrypt-issue.txt +++ /dev/null @@ -1,4 +0,0 @@ -Bugfix - * Fix crypt_and_hash decryption fail when used with a stream cipher - mode of operation due to the input not being multiple of block size. - Resolves #7417. diff --git a/ChangeLog.d/fix-string-to-names-retcode.txt b/ChangeLog.d/fix-string-to-names-retcode.txt deleted file mode 100644 index ac4b3d176e..0000000000 --- a/ChangeLog.d/fix-string-to-names-retcode.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fix a bug in which mbedtls_x509_string_to_names() would return success - when given a invalid name string if it did not contain '=' or ','. diff --git a/ChangeLog.d/fix-tfm-build.txt b/ChangeLog.d/fix-tfm-build.txt deleted file mode 100644 index a63bc2fa4d..0000000000 --- a/ChangeLog.d/fix-tfm-build.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fix compilation warnings in aes.c for certain combinations - of configuration options. diff --git a/ChangeLog.d/fix-win32-llvm-build.txt b/ChangeLog.d/fix-win32-llvm-build.txt deleted file mode 100644 index 826551ccfd..0000000000 --- a/ChangeLog.d/fix-win32-llvm-build.txt +++ /dev/null @@ -1,2 +0,0 @@ -Bugfix - * Fix builds on Windows with clang diff --git a/ChangeLog.d/inject-entropy.txt b/ChangeLog.d/inject-entropy.txt deleted file mode 100644 index 7626629693..0000000000 --- a/ChangeLog.d/inject-entropy.txt +++ /dev/null @@ -1,2 +0,0 @@ -Bugfix - * Fix the build with MBEDTLS_PSA_INJECT_ENTROPY. Fixes #7516. diff --git a/ChangeLog.d/programs_psa_fix.txt b/ChangeLog.d/programs_psa_fix.txt deleted file mode 100644 index fe2099ecc3..0000000000 --- a/ChangeLog.d/programs_psa_fix.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fix missing PSA initialization in sample programs when - MBEDTLS_USE_PSA_CRYPTO is enabled. diff --git a/ChangeLog.d/ssl_premaster_secret-empty.txt b/ChangeLog.d/ssl_premaster_secret-empty.txt deleted file mode 100644 index 0ce5f36ead..0000000000 --- a/ChangeLog.d/ssl_premaster_secret-empty.txt +++ /dev/null @@ -1,3 +0,0 @@ -Bugfix - * Fix a compilation error on some platforms when including mbedtls/ssl.h - with all TLS support disabled. Fixes #6628. From 403ce0a6ccd4f388f4ffdeac1d01956900c232dc Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Wed, 2 Aug 2023 15:35:45 +0100 Subject: [PATCH 080/135] Bump version numbers Signed-off-by: Dave Rodgman --- doxygen/input/doc_mainpage.h | 2 +- doxygen/mbedtls.doxyfile | 2 +- include/mbedtls/version.h | 8 ++++---- library/CMakeLists.txt | 6 +++--- tests/suites/test_suite_version.data | 4 ++-- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/doxygen/input/doc_mainpage.h b/doxygen/input/doc_mainpage.h index bbf4ea2f4b..d19f93e711 100644 --- a/doxygen/input/doc_mainpage.h +++ b/doxygen/input/doc_mainpage.h @@ -22,7 +22,7 @@ */ /** - * @mainpage Mbed TLS v2.28.3 API Documentation + * @mainpage Mbed TLS v2.28.4 API Documentation * * This documentation describes the internal structure of Mbed TLS. It was * automatically generated from specially formatted comment blocks in diff --git a/doxygen/mbedtls.doxyfile b/doxygen/mbedtls.doxyfile index 78299ed5bf..2f22e3fe83 100644 --- a/doxygen/mbedtls.doxyfile +++ b/doxygen/mbedtls.doxyfile @@ -1,4 +1,4 @@ -PROJECT_NAME = "mbed TLS v2.28.3" +PROJECT_NAME = "mbed TLS v2.28.4" OUTPUT_DIRECTORY = ../apidoc/ FULL_PATH_NAMES = NO OPTIMIZE_OUTPUT_FOR_C = YES diff --git a/include/mbedtls/version.h b/include/mbedtls/version.h index 0ef52138fd..1ae06e6868 100644 --- a/include/mbedtls/version.h +++ b/include/mbedtls/version.h @@ -38,16 +38,16 @@ */ #define MBEDTLS_VERSION_MAJOR 2 #define MBEDTLS_VERSION_MINOR 28 -#define MBEDTLS_VERSION_PATCH 3 +#define MBEDTLS_VERSION_PATCH 4 /** * The single version number has the following structure: * MMNNPP00 * Major version | Minor version | Patch version */ -#define MBEDTLS_VERSION_NUMBER 0x021C0300 -#define MBEDTLS_VERSION_STRING "2.28.3" -#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.28.3" +#define MBEDTLS_VERSION_NUMBER 0x021C0400 +#define MBEDTLS_VERSION_STRING "2.28.4" +#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.28.4" #if defined(MBEDTLS_VERSION_C) diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt index a15925198d..147caafd50 100644 --- a/library/CMakeLists.txt +++ b/library/CMakeLists.txt @@ -204,15 +204,15 @@ endif(USE_STATIC_MBEDTLS_LIBRARY) if(USE_SHARED_MBEDTLS_LIBRARY) set(CMAKE_LIBRARY_PATH ${CMAKE_CURRENT_BINARY_DIR}) add_library(${mbedcrypto_target} SHARED ${src_crypto}) - set_target_properties(${mbedcrypto_target} PROPERTIES VERSION 2.28.3 SOVERSION 7) + set_target_properties(${mbedcrypto_target} PROPERTIES VERSION 2.28.4 SOVERSION 7) target_link_libraries(${mbedcrypto_target} PUBLIC ${libs}) add_library(${mbedx509_target} SHARED ${src_x509}) - set_target_properties(${mbedx509_target} PROPERTIES VERSION 2.28.3 SOVERSION 1) + set_target_properties(${mbedx509_target} PROPERTIES VERSION 2.28.4 SOVERSION 1) target_link_libraries(${mbedx509_target} PUBLIC ${libs} ${mbedcrypto_target}) add_library(${mbedtls_target} SHARED ${src_tls}) - set_target_properties(${mbedtls_target} PROPERTIES VERSION 2.28.3 SOVERSION 14) + set_target_properties(${mbedtls_target} PROPERTIES VERSION 2.28.4 SOVERSION 14) target_link_libraries(${mbedtls_target} PUBLIC ${libs} ${mbedx509_target}) endif(USE_SHARED_MBEDTLS_LIBRARY) diff --git a/tests/suites/test_suite_version.data b/tests/suites/test_suite_version.data index 4b57192f0d..8226a6840b 100644 --- a/tests/suites/test_suite_version.data +++ b/tests/suites/test_suite_version.data @@ -1,8 +1,8 @@ Check compile time library version -check_compiletime_version:"2.28.3" +check_compiletime_version:"2.28.4" Check runtime library version -check_runtime_version:"2.28.3" +check_runtime_version:"2.28.4" Check for MBEDTLS_VERSION_C check_feature:"MBEDTLS_VERSION_C":0 From 8abc2e61127255ca2c797bb04e6b3f4e9cf6b37b Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Wed, 2 Aug 2023 15:36:46 +0100 Subject: [PATCH 081/135] Update BRANCHES.md Signed-off-by: Dave Rodgman --- BRANCHES.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/BRANCHES.md b/BRANCHES.md index 6d2e5c0e4e..f912e95be9 100644 --- a/BRANCHES.md +++ b/BRANCHES.md @@ -76,6 +76,6 @@ The following branches are currently maintained: - [`development`](https://github.com/Mbed-TLS/mbedtls/) - [`mbedtls-2.28`](https://github.com/Mbed-TLS/mbedtls/tree/mbedtls-2.28) maintained until at least the end of 2024, see - . + . Users are urged to always use the latest version of a maintained branch. From b0eedb4017c8195fba8c58440ef310a697071638 Mon Sep 17 00:00:00 2001 From: Dave Rodgman Date: Thu, 3 Aug 2023 13:29:22 +0100 Subject: [PATCH 082/135] Update Changelog to cover certificate updates Signed-off-by: Dave Rodgman --- ChangeLog | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 67b72fc661..c977a68151 100644 --- a/ChangeLog +++ b/ChangeLog @@ -26,6 +26,10 @@ Bugfix * Fix a compilation error on some platforms when including mbedtls/ssl.h with all TLS support disabled. Fixes #6628. +Changes + * Update test data to avoid failures of unit tests after 2023-08-07, and + update expiring certififcates in the certs module. + = Mbed TLS 2.28.3 branch released 2023-03-28 Features From aaec13793a72484ebeddd859db5724553d8ec205 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 4 Aug 2023 13:53:36 +0100 Subject: [PATCH 083/135] Update links to Rijndael paper and NIST SP 800-90 DRBGs The link to the DRBG paper points to the March 2007 version, the same as the original link (rather than the latest version). The amended Rijndael paper has a two-page "Note on naming" prefix. Fixes #7193 Signed-off-by: Tom Cosgrove --- library/aes.c | 2 +- library/ctr_drbg.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/library/aes.c b/library/aes.c index c506709500..d5a45fd34a 100644 --- a/library/aes.c +++ b/library/aes.c @@ -19,7 +19,7 @@ /* * The AES block cipher was designed by Vincent Rijmen and Joan Daemen. * - * http://csrc.nist.gov/encryption/aes/rijndael/Rijndael.pdf + * https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf */ diff --git a/library/ctr_drbg.c b/library/ctr_drbg.c index 45d925437e..6f553dca66 100644 --- a/library/ctr_drbg.c +++ b/library/ctr_drbg.c @@ -19,7 +19,7 @@ /* * The NIST SP 800-90 DRBGs are described in the following publication. * - * http://csrc.nist.gov/publications/nistpubs/800-90/SP800-90revised_March2007.pdf + * https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-90r.pdf */ #include "common.h" From 12f6f28e1536d962bfb3c058556c6ed4ccbddc27 Mon Sep 17 00:00:00 2001 From: Chien Wong Date: Wed, 9 Aug 2023 22:15:14 +0800 Subject: [PATCH 084/135] Improve doc on special use of A in ecp group structure Signed-off-by: Chien Wong --- ...-on-ecp-curve-optimized-representation.txt | 3 ++ include/mbedtls/ecp.h | 48 ++++++++++++++++++- 2 files changed, 49 insertions(+), 2 deletions(-) create mode 100644 ChangeLog.d/improve-doc-on-ecp-curve-optimized-representation.txt diff --git a/ChangeLog.d/improve-doc-on-ecp-curve-optimized-representation.txt b/ChangeLog.d/improve-doc-on-ecp-curve-optimized-representation.txt new file mode 100644 index 0000000000..8fdc588b13 --- /dev/null +++ b/ChangeLog.d/improve-doc-on-ecp-curve-optimized-representation.txt @@ -0,0 +1,3 @@ +Features + * The documentation of mbedtls_ecp_group now describes the optimized + representation of A for some curves. Fixes #8045. diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h index d56069ec4e..0e2d47fcd1 100644 --- a/include/mbedtls/ecp.h +++ b/include/mbedtls/ecp.h @@ -236,6 +236,27 @@ mbedtls_ecp_point; * odd prime as mbedtls_ecp_mul() requires an odd number, and * mbedtls_ecdsa_sign() requires that it is prime for blinding purposes. * + * The default implementation only initializes \p A without setting it to the + * authentic value for curves with A = -3(SECP256R1, etc), in which + * case you need to load \p A by yourself when using domain parameters directly, + * for example: + * \code + * mbedtls_mpi_init(&A); + * mbedtls_ecp_group_init(&grp); + * CHECK_RETURN(mbedtls_ecp_group_load(&grp, grp_id)); + * if (mbedtls_ecp_group_a_is_minus_3(&grp)) { + * CHECK_RETURN(mbedtls_mpi_sub_int(&A, &grp.P, 3)); + * } else { + * CHECK_RETURN(mbedtls_mpi_copy(&A, &grp.A)); + * } + * + * do_something_with_a(&A); + * + * cleanup: + * mbedtls_mpi_free(&A); + * mbedtls_ecp_group_free(&grp); + * \endcode + * * For Montgomery curves, we do not store \p A, but (A + 2) / 4, * which is the quantity used in the formulas. Additionally, \p nbits is * not the size of \p N but the required size for private keys. @@ -256,8 +277,11 @@ mbedtls_ecp_point; typedef struct mbedtls_ecp_group { mbedtls_ecp_group_id id; /*!< An internal group identifier. */ mbedtls_mpi P; /*!< The prime modulus of the base field. */ - mbedtls_mpi A; /*!< For Short Weierstrass: \p A in the equation. For - Montgomery curves: (A + 2) / 4. */ + mbedtls_mpi A; /*!< For Short Weierstrass: \p A in the equation. Note that + \p A is not set to the authentic value in some cases. + Refer to detailed description of ::mbedtls_ecp_group if + using domain parameters in the structure. + For Montgomery curves: (A + 2) / 4. */ mbedtls_mpi B; /*!< For Short Weierstrass: \p B in the equation. For Montgomery curves: unused. */ mbedtls_ecp_point G; /*!< The generator of the subgroup used. */ @@ -989,6 +1013,26 @@ int mbedtls_ecp_mul_restartable(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, mbedtls_ecp_restart_ctx *rs_ctx); #if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) +/** + * \brief This function checks if domain parameter A of the curve is + * \c -3. + * + * \note This function is only defined for short Weierstrass curves. + * It may not be included in builds without any short + * Weierstrass curve. + * + * \param grp The ECP group to use. + * This must be initialized and have group parameters + * set, for example through mbedtls_ecp_group_load(). + * + * \return \c 1 if A = -3. + * \return \c 0 Otherwise. + */ +static inline int mbedtls_ecp_group_a_is_minus_3(const mbedtls_ecp_group *grp) +{ + return grp->A.p == NULL; +} + /** * \brief This function performs multiplication and addition of two * points by integers: \p R = \p m * \p P + \p n * \p Q From 8aa8d78ed9128b01ccbafb3591010c1deb62ac12 Mon Sep 17 00:00:00 2001 From: Chien Wong Date: Thu, 10 Aug 2023 12:24:43 +0800 Subject: [PATCH 085/135] Add potential missing inline definition Signed-off-by: Chien Wong --- include/mbedtls/ecp.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h index 0e2d47fcd1..23ebe9bc9a 100644 --- a/include/mbedtls/ecp.h +++ b/include/mbedtls/ecp.h @@ -42,6 +42,11 @@ #include "mbedtls/bignum.h" +#if (defined(__ARMCC_VERSION) || defined(_MSC_VER)) && \ + !defined(inline) && !defined(__cplusplus) +#define inline __inline +#endif + /* * ECP error codes */ From 96d0ef4f081ab221779aa566cafc8da21bae4958 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Wed, 16 Aug 2023 11:43:51 +0800 Subject: [PATCH 086/135] Fix invalid generation commands `serial_hex` option is not supported by `cert_write` in 2.28, use `serial` option instead. Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index 6006509d1a..b9a8e48908 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1592,7 +1592,7 @@ all_final += cert_md5.crt # server2-v1*.crt: EE cert (without of with chain in same file) test-ca-v1.crt: $(test_ca_key_file_rsa) test-ca.req.sha256 - $(MBEDTLS_CERT_WRITE) is_ca=1 serial_hex=53a2b68e05400e555c9395e5 \ + $(MBEDTLS_CERT_WRITE) is_ca=1 serial=25883963888465069501131757029 \ request_file=test-ca.req.sha256 \ selfsign=1 issuer_name="CN=PolarSSL Test CA v1,OU=testing,O=PolarSSL,C=NL" \ issuer_key=$(test_ca_key_file_rsa) issuer_pwd=$(test_ca_pwd_rsa) \ @@ -1601,7 +1601,7 @@ test-ca-v1.crt: $(test_ca_key_file_rsa) test-ca.req.sha256 all_final += test-ca-v1.crt server1-v1.crt: server1.key test-ca-v1.crt - $(MBEDTLS_CERT_WRITE) subject_key=$< serial_hex=53a2b6c704cd4d8ebc800bc1\ + $(MBEDTLS_CERT_WRITE) subject_key=$< serial=25883964939897181595909491649 \ subject_name="CN=server1/int-ca-v1,OU=testing,O=PolarSSL,C=NL" \ issuer_crt=test-ca-v1.crt issuer_key=$(test_ca_key_file_rsa) \ issuer_pwd=$(test_ca_pwd_rsa) \ @@ -1611,7 +1611,7 @@ server1-v1.crt: server1.key test-ca-v1.crt all_final += server1-v1.crt server2-v1.crt: server2.key server1-v1.crt - $(MBEDTLS_CERT_WRITE) subject_key=$< serial_hex=53a2b6d9235dbc4573f9b76c\ + $(MBEDTLS_CERT_WRITE) subject_key=$< serial=25883965274140956871506900844 \ subject_name="CN=server2,OU=testing,O=PolarSSL,C=NL" \ issuer_crt=server1-v1.crt issuer_key=server1.key \ not_before=20190210144406 not_after=20290210144406 \ From ac9e3402ab9aa0020a9d33e80b89d70c657dd896 Mon Sep 17 00:00:00 2001 From: TTornblom Date: Thu, 16 Apr 2020 13:53:38 +0200 Subject: [PATCH 087/135] BUILD: Update For IAR support Applied the same change as in mbed-crypto for using this as a sub project with the IAR toolchain. Use __asm generic ,and avoid empty enum. Avoid declaration of array with null size. This is a porting of the original patch contributed to trusted-firmware-m. Signed-off-by: TTornblom Signed-off-by: Michel Jaouen Signed-off-by: Antonio de Angelis --- CMakeLists.txt | 4 +++- library/psa_crypto.c | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 30cef2fea0..52814ba6b1 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -223,7 +223,9 @@ if(CMAKE_COMPILER_IS_CLANG) endif(CMAKE_COMPILER_IS_CLANG) if(CMAKE_COMPILER_IS_IAR) - set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} --warn_about_c_style_casts -Ohz") + set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} --warn_about_c_style_casts") + set(CMAKE_C_FLAGS_RELEASE "-Ohz") + set(CMAKE_C_FLAGS_DEBUG "--debug -On") endif(CMAKE_COMPILER_IS_IAR) if(CMAKE_COMPILER_IS_MSVC) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index fade286ecd..3c21ae71d1 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -4948,8 +4948,13 @@ static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *o size_t peer_key_length) { psa_status_t status; +#if PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE != 0 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE]; + size_t shared_secret_length = sizeof(shared_secret); +#else + uint8_t *shared_secret = NULL; size_t shared_secret_length = 0; +#endif psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg); /* Step 1: run the secret agreement algorithm to generate the shared @@ -4958,7 +4963,7 @@ static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *o private_key, peer_key, peer_key_length, shared_secret, - sizeof(shared_secret), + shared_secret_length, &shared_secret_length); if (status != PSA_SUCCESS) { goto exit; From 1505d3232db98eb9826b05c4199109af2b6ff030 Mon Sep 17 00:00:00 2001 From: Antonio de Angelis Date: Wed, 16 Aug 2023 16:27:46 +0100 Subject: [PATCH 088/135] Fix error strings without quotes Some of the error strings that should be printed with the error preprocessor directive are missing quotes Signed-off-by: Antonio de Angelis --- library/psa_crypto_storage.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/psa_crypto_storage.h b/library/psa_crypto_storage.h index 04768f8a43..edd9b947cd 100644 --- a/library/psa_crypto_storage.h +++ b/library/psa_crypto_storage.h @@ -39,7 +39,7 @@ extern "C" { /* Sanity check: a file size must fit in 32 bits. Allow a generous * 64kB of metadata. */ #if PSA_CRYPTO_MAX_STORAGE_SIZE > 0xffff0000 -#error PSA_CRYPTO_MAX_STORAGE_SIZE > 0xffff0000 +#error "PSA_CRYPTO_MAX_STORAGE_SIZE > 0xffff0000" #endif /** The maximum permitted persistent slot number. From e453f9df107f58f596486fd96969abbf678e5e74 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Thu, 17 Aug 2023 16:32:34 +0800 Subject: [PATCH 089/135] Add description for invalid commands Signed-off-by: Pengyu Lv --- tests/data_files/Makefile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index b9a8e48908..1e285db849 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1334,6 +1334,8 @@ server5.eku-srv_cli.crt: SERVER5_EXT_KEY_USAGE=serverAuth,clientAuth server5.eku-srv.crt: SERVER5_CRT_SERIAL=62 server5.eku-srv.crt: SERVER5_EXT_KEY_USAGE=serverAuth server5.ku-%.crt: SERVER5_EXT_OPTS=key_usage=$(SERVER5_KEY_USAGE) +# The commands for server5.eku-*.crt is invalid because `ext_key_usage` was not supported by +# `cert_write` in 2.28. This would be fixed by #8083. server5.eku-%.crt: SERVER5_EXT_OPTS=ext_key_usage=$(SERVER5_EXT_KEY_USAGE) server5.%.crt: server5.key $(MBEDTLS_CERT_WRITE) \ From 20d54e31156fa961a55dd96f38c66a0ddd5ba71e Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 10 Aug 2023 15:59:28 +0200 Subject: [PATCH 090/135] mbedtls_mpi_exp_mod: remove spurious copy of the output variable Clear some confusion between `X` as the output variable and "X" as a name given to the accumulator. Previous iterations of the code used the variable `X` as the accumulator, but now that the accumulator is `W[x_index]`, some of the comments didn't make sense. Remove the copy of the initial value of `X` into `W[x_index]`, which was meaningless: the initial value of an output variable should not, and did not, matter. `W[x_index]` is later overridden unconditionally to take the value `RR`. Signed-off-by: Gilles Peskine --- library/bignum.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/library/bignum.c b/library/bignum.c index 5dca3a9177..08d0828bf5 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -2121,8 +2121,9 @@ int mbedtls_mpi_exp_mod(mbedtls_mpi *X, const mbedtls_mpi *A, * and squarings. Firstly, when multiplying by an element of the window * W[i], we do a constant-trace table lookup to obfuscate i. This leaves * squarings as having a different memory access patterns from other - * multiplications. So secondly, we put the accumulator X in the table as - * well, and also do a constant-trace table lookup to multiply by X. + * multiplications. So secondly, we put the accumulator in the table as + * well, and also do a constant-trace table lookup to multiply by the + * accumulator which is W[x_index]. * * This way, all multiplications take the form of a lookup-and-multiply. * The number of lookup-and-multiply operations inside each iteration of @@ -2135,19 +2136,16 @@ int mbedtls_mpi_exp_mod(mbedtls_mpi *X, const mbedtls_mpi *A, * observe both memory accesses and branches. However, branch prediction * exploitation typically requires many traces of execution over the same * data, which is defeated by randomized blinding. - * - * To achieve this, we make a copy of X and we use the table entry in each - * calculation from this point on. */ const size_t x_index = 0; mbedtls_mpi_init(&W[x_index]); - mbedtls_mpi_copy(&W[x_index], X); j = N->n + 1; - /* All W[i] and X must have at least N->n limbs for the mpi_montmul() - * and mpi_montred() calls later. Here we ensure that W[1] and X are - * large enough, and later we'll grow other W[i] to the same length. - * They must not be shrunk midway through this function! + /* All W[i] including the accumulator must have at least N->n limbs for + * the mpi_montmul() and mpi_montred() calls later. Here we ensure that + * W[1] and the accumulator W[x_index] are large enough. later we'll grow + * other W[i] to the same length. They must not be shrunk midway through + * this function! */ MBEDTLS_MPI_CHK(mbedtls_mpi_grow(&W[x_index], j)); MBEDTLS_MPI_CHK(mbedtls_mpi_grow(&W[1], j)); From 0118a1d7126e4f52bf7573507adffbb4c2cf0417 Mon Sep 17 00:00:00 2001 From: Chien Wong Date: Tue, 1 Aug 2023 21:38:46 +0800 Subject: [PATCH 091/135] Fix a few unchecked return values Signed-off-by: Chien Wong --- ChangeLog.d/fix-a-few-unchecked-return.txt | 3 +++ library/bignum.c | 2 +- library/ecdsa.c | 4 ++-- library/rsa_internal.c | 2 +- 4 files changed, 7 insertions(+), 4 deletions(-) create mode 100644 ChangeLog.d/fix-a-few-unchecked-return.txt diff --git a/ChangeLog.d/fix-a-few-unchecked-return.txt b/ChangeLog.d/fix-a-few-unchecked-return.txt new file mode 100644 index 0000000000..aadde36315 --- /dev/null +++ b/ChangeLog.d/fix-a-few-unchecked-return.txt @@ -0,0 +1,3 @@ +Bugfix + * Fix some cases where mbedtls_mpi_mod_exp, RSA key construction or ECDSA + signature can silently return an incorrect result in low memory conditions. diff --git a/library/bignum.c b/library/bignum.c index 5dca3a9177..67add492f3 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -2328,7 +2328,7 @@ int mbedtls_mpi_exp_mod(mbedtls_mpi *X, const mbedtls_mpi *A, /* * Load the result in the output variable. */ - mbedtls_mpi_copy(X, &W[x_index]); + MBEDTLS_MPI_CHK(mbedtls_mpi_copy(X, &W[x_index])); cleanup: diff --git a/library/ecdsa.c b/library/ecdsa.c index 1f0b37dfd4..3ede933b49 100644 --- a/library/ecdsa.c +++ b/library/ecdsa.c @@ -366,7 +366,7 @@ modn: #if defined(MBEDTLS_ECP_RESTARTABLE) if (rs_ctx != NULL && rs_ctx->sig != NULL) { - mbedtls_mpi_copy(r, pr); + MBEDTLS_MPI_CHK(mbedtls_mpi_copy(r, pr)); } #endif @@ -457,7 +457,7 @@ static int ecdsa_sign_det_restartable(mbedtls_ecp_group *grp, MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(d, data, grp_len)); MBEDTLS_MPI_CHK(derive_mpi(grp, &h, buf, blen)); MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&h, data + grp_len, grp_len)); - mbedtls_hmac_drbg_seed_buf(p_rng, md_info, data, 2 * grp_len); + MBEDTLS_MPI_CHK(mbedtls_hmac_drbg_seed_buf(p_rng, md_info, data, 2 * grp_len)); #if defined(MBEDTLS_ECP_RESTARTABLE) if (rs_ctx != NULL && rs_ctx->det != NULL) { diff --git a/library/rsa_internal.c b/library/rsa_internal.c index 2ff51c34b7..41ceff06c0 100644 --- a/library/rsa_internal.c +++ b/library/rsa_internal.c @@ -126,7 +126,7 @@ int mbedtls_rsa_deduce_primes(mbedtls_mpi const *N, } for (; attempt < num_primes; ++attempt) { - mbedtls_mpi_lset(&K, primes[attempt]); + MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&K, primes[attempt])); /* Check if gcd(K,N) = 1 */ MBEDTLS_MPI_CHK(mbedtls_mpi_gcd(P, &K, N)); From 431e5c419951f2a49d005cefb03cc02418f65aaa Mon Sep 17 00:00:00 2001 From: Antonio de Angelis Date: Thu, 17 Aug 2023 15:36:19 +0100 Subject: [PATCH 092/135] Remove workaround for non-zero shared_secret array PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE is always greater than 1 so no need for the workaround on the original patch Signed-off-by: Antonio de Angelis --- library/psa_crypto.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index 3c21ae71d1..fade286ecd 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -4948,13 +4948,8 @@ static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *o size_t peer_key_length) { psa_status_t status; -#if PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE != 0 uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE]; - size_t shared_secret_length = sizeof(shared_secret); -#else - uint8_t *shared_secret = NULL; size_t shared_secret_length = 0; -#endif psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg); /* Step 1: run the secret agreement algorithm to generate the shared @@ -4963,7 +4958,7 @@ static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *o private_key, peer_key, peer_key_length, shared_secret, - shared_secret_length, + sizeof(shared_secret), &shared_secret_length); if (status != PSA_SUCCESS) { goto exit; From 4a46d23a36528816af28bf64abd3349d9841ada8 Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Fri, 18 Aug 2023 18:36:02 +0100 Subject: [PATCH 093/135] Fix: Set type_id in x509_get_other_name() When parsing a subject alternative name of type otherName, retain the type-id field of the otherName. Previously this was not copied to the mbedtls_x509_san_other_name struct when it should have been. Signed-off-by: David Horstmann --- library/x509_crt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/library/x509_crt.c b/library/x509_crt.c index 5b51694740..3578c4af81 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -1741,6 +1741,7 @@ static int x509_get_other_name(const mbedtls_x509_buf *subject_alt_name, if (MBEDTLS_OID_CMP(MBEDTLS_OID_ON_HW_MODULE_NAME, &cur_oid) != 0) { return MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE; } + other_name->type_id = cur_oid; p += len; if ((ret = mbedtls_asn1_get_tag(&p, end, &len, From dcf73265baa54c3306efc203deada066decddbb9 Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Fri, 18 Aug 2023 19:12:59 +0100 Subject: [PATCH 094/135] Fix incorrect detection of HardwareModuleName The hardware module name otherName SAN contains 2 OIDs: OtherName ::= SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY DEFINED BY type-id } HardwareModuleName ::= SEQUENCE { hwType OBJECT IDENTIFIER, hwSerialNum OCTET STRING } The first, type-id, is the one that identifies the otherName as a HardwareModuleName. The second, hwType, identifies the type of hardware. This change fixes 2 issues: 1. We were erroneously trying to identify HardwareModuleNames by looking at hwType, not type-id. 2. We accidentally inverted the check so that we were checking that hwType did NOT match HardwareModuleName. This fix ensures that type-id is correctly checked to make sure that it matches the OID for HardwareModuleName. Signed-off-by: David Horstmann --- library/x509_crt.c | 2 +- tests/suites/test_suite_x509parse.function | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/library/x509_crt.c b/library/x509_crt.c index 3578c4af81..0e91bd83b2 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -1830,7 +1830,7 @@ static int x509_info_subject_alt_name(char **buf, size_t *size, MBEDTLS_X509_SAFE_SNPRINTF; if (MBEDTLS_OID_CMP(MBEDTLS_OID_ON_HW_MODULE_NAME, - &other_name->value.hardware_module_name.oid) != 0) { + &other_name->type_id) == 0) { ret = mbedtls_snprintf(p, n, "\n%s hardware module name :", prefix); MBEDTLS_X509_SAFE_SNPRINTF; ret = diff --git a/tests/suites/test_suite_x509parse.function b/tests/suites/test_suite_x509parse.function index 377f9e8875..09a9d12874 100644 --- a/tests/suites/test_suite_x509parse.function +++ b/tests/suites/test_suite_x509parse.function @@ -240,7 +240,7 @@ int verify_parse_san(mbedtls_x509_subject_alternative_name *san, MBEDTLS_X509_SAFE_SNPRINTF; if (MBEDTLS_OID_CMP(MBEDTLS_OID_ON_HW_MODULE_NAME, - &san->san.other_name.value.hardware_module_name.oid) != 0) { + &san->san.other_name.type_id) == 0) { ret = mbedtls_snprintf(p, n, " hardware module name :"); MBEDTLS_X509_SAFE_SNPRINTF; ret = mbedtls_snprintf(p, n, " hardware type : "); From 869609f2283c61359b137052b522bbdcd685b32f Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Fri, 18 Aug 2023 19:01:10 +0100 Subject: [PATCH 095/135] Add ChangeLog entry for otherName SAN fixes Signed-off-by: David Horstmann --- ChangeLog.d/initialize-struct-get-other-name.txt | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 ChangeLog.d/initialize-struct-get-other-name.txt diff --git a/ChangeLog.d/initialize-struct-get-other-name.txt b/ChangeLog.d/initialize-struct-get-other-name.txt new file mode 100644 index 0000000000..6bba4cbcc5 --- /dev/null +++ b/ChangeLog.d/initialize-struct-get-other-name.txt @@ -0,0 +1,8 @@ +Bugfix + * Fix an issue when parsing an otherName subject alternative name into a + mbedtls_x509_san_other_name struct. The type-id of the otherName was not + copied to the struct. This meant that the struct had incomplete + information about the otherName SAN and contained uninitialized memory. + * Fix the detection of HardwareModuleName otherName SANs. These were being + detected by comparing the wrong field and the check was erroneously + inverted. \ No newline at end of file From d81f75bbbf5106d411e91dc80a1cdd266ea4d5de Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Mon, 21 Aug 2023 17:34:45 +0100 Subject: [PATCH 096/135] Fixup incorrectly-formatted ChangeLog entry Signed-off-by: David Horstmann --- ChangeLog.d/initialize-struct-get-other-name.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog.d/initialize-struct-get-other-name.txt b/ChangeLog.d/initialize-struct-get-other-name.txt index 6bba4cbcc5..dc8395d408 100644 --- a/ChangeLog.d/initialize-struct-get-other-name.txt +++ b/ChangeLog.d/initialize-struct-get-other-name.txt @@ -1,8 +1,8 @@ Bugfix * Fix an issue when parsing an otherName subject alternative name into a mbedtls_x509_san_other_name struct. The type-id of the otherName was not - copied to the struct. This meant that the struct had incomplete + copied to the struct. This meant that the struct had incomplete information about the otherName SAN and contained uninitialized memory. * Fix the detection of HardwareModuleName otherName SANs. These were being detected by comparing the wrong field and the check was erroneously - inverted. \ No newline at end of file + inverted. From 0aab8a878f6239b329c6ec1d1aeaa647c57c491f Mon Sep 17 00:00:00 2001 From: Agathiyan Bragadeesh Date: Tue, 22 Aug 2023 15:29:02 +0100 Subject: [PATCH 097/135] Add changelog entry for 2.28 IAR warning fixes Signed-off-by: Agathiyan Bragadeesh --- ChangeLog.d/fix-iar-compiler-warnings.txt | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 ChangeLog.d/fix-iar-compiler-warnings.txt diff --git a/ChangeLog.d/fix-iar-compiler-warnings.txt b/ChangeLog.d/fix-iar-compiler-warnings.txt new file mode 100644 index 0000000000..50f1dcaad5 --- /dev/null +++ b/ChangeLog.d/fix-iar-compiler-warnings.txt @@ -0,0 +1,2 @@ +Bugfix + * Fix IAR compiler warnings. Fixes #7873, #4300. From 2fdd503c4e8ad26b20708c3092953b4d894b419a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1s=20Gonz=C3=A1lez?= Date: Wed, 23 Aug 2023 16:43:26 +0100 Subject: [PATCH 098/135] Add allow list for non-executed test cases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The allow list explicits which test cases are allowed to not be executed when testing. This may be, for example, because a feature is yet to be developed but the test for that feature is already in our code base. Signed-off-by: Tomás González --- tests/scripts/analyze_outcomes.py | 64 ++++++++++++++++++++++++++----- 1 file changed, 55 insertions(+), 9 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index d06a0596f3..390cbbc729 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -9,6 +9,7 @@ less likely to be useful. import argparse import sys import traceback +import re import check_test_cases @@ -50,20 +51,23 @@ class TestCaseOutcomes: """ return len(self.successes) + len(self.failures) -def analyze_coverage(results, outcomes): +def analyze_coverage(results, outcomes, allow_list): """Check that all available test cases are executed at least once.""" available = check_test_cases.collect_available_test_cases() for key in available: hits = outcomes[key].hits() if key in outcomes else 0 - if hits == 0: + if hits == 0 and key not in allow_list: # Make this a warning, not an error, as long as we haven't # fixed this branch to have full coverage of test cases. results.warning('Test case not executed: {}', key) + elif hits != 0 and key in allow_list: + # Test Case should be removed from the allow list. + results.warning('Allow listed test case was executed: {}', key) -def analyze_outcomes(outcomes): +def analyze_outcomes(outcomes, allow_list): """Run all analyses on the given outcome collection.""" results = Results() - analyze_coverage(results, outcomes) + analyze_coverage(results, outcomes, allow_list) return results def read_outcome_file(outcome_file): @@ -87,20 +91,62 @@ by a semicolon. outcomes[key].failures.append(setup) return outcomes -def analyze_outcome_file(outcome_file): - """Analyze the given outcome file.""" +def do_analyze_coverage(outcome_file, args): + """Perform coverage analysis.""" outcomes = read_outcome_file(outcome_file) - return analyze_outcomes(outcomes) + Results.log("\n*** Analyze coverage ***\n") + results = analyze_outcomes(outcomes, args['allow_list']) + return results.error_count == 0 + +# List of tasks with a function that can handle this task and additional arguments if required +TASKS = { + 'analyze_coverage': { + 'test_function': do_analyze_coverage, + 'args': { + 'allow_list': [], + } + }, +} def main(): try: parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('outcomes', metavar='OUTCOMES.CSV', help='Outcome file to analyze') + parser.add_argument('task', default='all', nargs='?', + help='Analysis to be done. By default, run all tasks. ' + 'With one or more TASK, run only those. ' + 'TASK can be the name of a single task or ' + 'comma/space-separated list of tasks. ') + parser.add_argument('--list', action='store_true', + help='List all available tasks and exit.') options = parser.parse_args() - results = analyze_outcome_file(options.outcomes) - if results.error_count > 0: + + if options.list: + for task in TASKS: + Results.log(task) + sys.exit(0) + + result = True + + if options.task == 'all': + tasks = TASKS.keys() + else: + tasks = re.split(r'[, ]+', options.task) + + for task in tasks: + if task not in TASKS: + Results.log('Error: invalid task: {}'.format(task)) + sys.exit(1) + + for task in TASKS: + if task in tasks: + if not TASKS[task]['test_function'](options.outcomes, TASKS[task]['args']): + result = False + + if result is False: sys.exit(1) + Results.log("SUCCESS :-)") except Exception: # pylint: disable=broad-except # Print the backtrace and exit explicitly with our chosen status. traceback.print_exc() From 45d49595b7080a9d6a978a92dc6649814438071e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1s=20Gonz=C3=A1lez?= Date: Fri, 11 Aug 2023 15:22:04 +0100 Subject: [PATCH 099/135] Add a flag for requiring full coverage in coverage tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce the --require-full-coverage in analyze_outcomes.py so that when analyze_outcomes.py --require-full-coverage is called, those tests that are not executed and are not in the allowed list issue an error instead of a warning. Note that it is useful to run analyze_outcomes.py on incomplete test results, so this error mode needs to remain optional in the long term. Signed-off-by: Tomás González --- tests/scripts/analyze_outcomes.py | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 390cbbc729..14a9b864ec 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -51,23 +51,25 @@ class TestCaseOutcomes: """ return len(self.successes) + len(self.failures) -def analyze_coverage(results, outcomes, allow_list): +def analyze_coverage(results, outcomes, allow_list, full_coverage): """Check that all available test cases are executed at least once.""" available = check_test_cases.collect_available_test_cases() for key in available: hits = outcomes[key].hits() if key in outcomes else 0 if hits == 0 and key not in allow_list: - # Make this a warning, not an error, as long as we haven't - # fixed this branch to have full coverage of test cases. - results.warning('Test case not executed: {}', key) + if full_coverage: + results.error('Test case not executed: {}', key) + else: + results.warning('Test case not executed: {}', key) elif hits != 0 and key in allow_list: # Test Case should be removed from the allow list. results.warning('Allow listed test case was executed: {}', key) -def analyze_outcomes(outcomes, allow_list): +def analyze_outcomes(outcomes, args): """Run all analyses on the given outcome collection.""" results = Results() - analyze_coverage(results, outcomes, allow_list) + analyze_coverage(results, outcomes, args['allow_list'], + args['full_coverage']) return results def read_outcome_file(outcome_file): @@ -95,7 +97,7 @@ def do_analyze_coverage(outcome_file, args): """Perform coverage analysis.""" outcomes = read_outcome_file(outcome_file) Results.log("\n*** Analyze coverage ***\n") - results = analyze_outcomes(outcomes, args['allow_list']) + results = analyze_outcomes(outcomes, args) return results.error_count == 0 # List of tasks with a function that can handle this task and additional arguments if required @@ -104,6 +106,7 @@ TASKS = { 'test_function': do_analyze_coverage, 'args': { 'allow_list': [], + 'full_coverage': False, } }, } @@ -120,6 +123,11 @@ def main(): 'comma/space-separated list of tasks. ') parser.add_argument('--list', action='store_true', help='List all available tasks and exit.') + parser.add_argument('--require-full-coverage', action='store_true', + dest='full_coverage', help="Require all available " + "test cases to be executed and issue an error " + "otherwise. This flag is ignored if 'task' is " + "neither 'all' nor 'analyze_coverage'") options = parser.parse_args() if options.list: @@ -139,6 +147,9 @@ def main(): Results.log('Error: invalid task: {}'.format(task)) sys.exit(1) + TASKS['analyze_coverage']['args']['full_coverage'] = \ + options.full_coverage + for task in TASKS: if task in tasks: if not TASKS[task]['test_function'](options.outcomes, TASKS[task]['args']): From c8957333498b14ab8a83dca0708848dae535d720 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1s=20Gonz=C3=A1lez?= Date: Mon, 14 Aug 2023 15:43:46 +0100 Subject: [PATCH 100/135] Add EdDSA and XTS to the allow list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit As specified in https://github.com/Mbed-TLS/mbedtls/issues/5390#issuecomment-1669585707 EdDSA and XTS tests are legitimately never executed, so add them to the allow list. Signed-off-by: Tomás González --- tests/scripts/analyze_outcomes.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 14a9b864ec..4f381bd6bc 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -105,7 +105,12 @@ TASKS = { 'analyze_coverage': { 'test_function': do_analyze_coverage, 'args': { - 'allow_list': [], + 'allow_list': [ + # Algorithm not supported yet + 'test_suite_psa_crypto_metadata;Asymmetric signature: pure EdDSA', + # Algorithm not supported yet + 'test_suite_psa_crypto_metadata;Cipher: XTS', + ], 'full_coverage': False, } }, From 14b36ef54a581391f86d161ab4ff61457684f9ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1s=20Gonz=C3=A1lez?= Date: Tue, 22 Aug 2023 09:40:23 +0100 Subject: [PATCH 101/135] Make non-executed tests that are not in the allow list an error MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Turn the warnings produced when finding non-executed tests that are not in the allow list into errors. Signed-off-by: Tomás González --- tests/scripts/analyze_outcomes.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 4f381bd6bc..0bdfcf98af 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -63,7 +63,10 @@ def analyze_coverage(results, outcomes, allow_list, full_coverage): results.warning('Test case not executed: {}', key) elif hits != 0 and key in allow_list: # Test Case should be removed from the allow list. - results.warning('Allow listed test case was executed: {}', key) + if full_coverage: + results.error('Allow listed test case was executed: {}', key) + else: + results.warning('Allow listed test case was executed: {}', key) def analyze_outcomes(outcomes, args): """Run all analyses on the given outcome collection.""" From 1cf437bc579f1b5220ffeaa430fc9372a56379e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1s=20Gonz=C3=A1lez?= Date: Thu, 24 Aug 2023 09:27:28 +0100 Subject: [PATCH 102/135] Correct analyze_outcomes identation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Tomás González --- tests/scripts/analyze_outcomes.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/scripts/analyze_outcomes.py b/tests/scripts/analyze_outcomes.py index 0bdfcf98af..d50a04e612 100755 --- a/tests/scripts/analyze_outcomes.py +++ b/tests/scripts/analyze_outcomes.py @@ -113,7 +113,7 @@ TASKS = { 'test_suite_psa_crypto_metadata;Asymmetric signature: pure EdDSA', # Algorithm not supported yet 'test_suite_psa_crypto_metadata;Cipher: XTS', - ], + ], 'full_coverage': False, } }, From dd21fc97baf54e8797ecb8372069bbc5a42f4d72 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Thu, 23 Feb 2023 10:04:58 +0800 Subject: [PATCH 103/135] compat.sh: add --list-test-case The option --list-test-case lists all potential test cases without executing them. The test case description is identical with $TITLE during test case execution. Signed-off-by: Yanray Wang --- tests/compat.sh | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/tests/compat.sh b/tests/compat.sh index 75d5461599..a2283039a4 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -128,10 +128,40 @@ print_usage() { printf " \tAlso available: GnuTLS (needs v3.2.15 or higher)\n" printf " -M|--memcheck\tCheck memory leaks and errors.\n" printf " -v|--verbose\tSet verbose output.\n" + printf " --list-test-case\tList all potential test cases (No Execution)\n" printf " --outcome-file\tFile where test outcomes are written\n" printf " \t(default: \$MBEDTLS_TEST_OUTCOME_FILE, none if empty)\n" } +# print_test_title +print_test_title() { + for i in $3; do + TITLE="$1->$2 $MODE,$VERIF $i" + echo "$TITLE" + done +} + +list_test_case() { + reset_ciphersuites + for TYPE in $TYPES; do + add_common_ciphersuites + add_openssl_ciphersuites + add_gnutls_ciphersuites + add_mbedtls_ciphersuites + done + + for VERIFY in $VERIFIES; do + VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]') + for MODE in $MODES; do + print_test_title m o "$O_CIPHERS" + print_test_title o m "$O_CIPHERS" + print_test_title m g "$G_CIPHERS" + print_test_title g m "$G_CIPHERS" + print_test_title m m "$M_CIPHERS" + done + done +} + get_options() { while [ $# -gt 0 ]; do case "$1" in @@ -159,6 +189,10 @@ get_options() { -M|--memcheck) MEMCHECK=1 ;; + --list-test-case) + list_test_case + exit 0 + ;; --outcome-file) shift; MBEDTLS_TEST_OUTCOME_FILE=$1 ;; From baced97929ebb083e664d0edd33c2570c1890c42 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Fri, 24 Feb 2023 14:53:29 +0800 Subject: [PATCH 104/135] check_test_cases.py: support checking test coverage in compat.sh Test case description in compat.sh is in format of [ogm]->[ogm] TLSmode, VERIFY CIPHERSUITE_NAME This program calls compat.sh to list all potential test case descriptions then checks test case duplication. Signed-off-by: Yanray Wang --- tests/scripts/check_test_cases.py | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/tests/scripts/check_test_cases.py b/tests/scripts/check_test_cases.py index c9f5e11dd8..86506f5e59 100755 --- a/tests/scripts/check_test_cases.py +++ b/tests/scripts/check_test_cases.py @@ -25,6 +25,7 @@ import argparse import glob import os import re +import subprocess import sys class Results: @@ -111,6 +112,24 @@ state may override this method. self.process_test_case(descriptions, file_name, line_number, description) + def walk_compat_sh(self, file_name): + """Iterate over the test cases compat.sh with a similar format.""" + descriptions = self.new_per_file_state() # pylint: disable=assignment-from-none + compat_cmd = ['sh', file_name, '--list-test-case'] + result = subprocess.run(compat_cmd, + stdout=subprocess.PIPE, + check=False) + if result.returncode != 0: + print(*compat_cmd, 'returned', str(result.returncode)) + return + else: + # Pattern: g->m dtls12,no TLS_DHE_PSK_WITH_AES_128_CBC_SHA\n + m = re.findall(br'[^ogm]*((?:[ogm]->[ogm]\s*\w*.\w*\s\w*)*)\n', + result.stdout) + if m: + for i in m: + self.process_test_case(descriptions, file_name, 1, i) + @staticmethod def collect_test_directories(): """Get the relative path for the TLS and Crypto test directories.""" @@ -133,6 +152,9 @@ state may override this method. ssl_opt_sh = os.path.join(directory, 'ssl-opt.sh') if os.path.exists(ssl_opt_sh): self.walk_ssl_opt_sh(ssl_opt_sh) + compat_sh = os.path.join(directory, 'compat.sh') + if os.path.exists(compat_sh): + self.walk_compat_sh(compat_sh) class TestDescriptions(TestDescriptionExplorer): """Collect the available test cases.""" From 7e1c0c7f79f6993a2857d18d45e92cbfbc6f9893 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Fri, 24 Feb 2023 17:07:47 +0800 Subject: [PATCH 105/135] compat.sh: uniform test description Test case description is printed by different block of code. This causes code maintenance harder since we need to maintain two parts of code with same functionality. print_test_title is used to control test case description in compat.sh Signed-off-by: Yanray Wang --- tests/compat.sh | 26 +++++++++++++------------- tests/scripts/check_test_cases.py | 4 ++-- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/tests/compat.sh b/tests/compat.sh index a2283039a4..7e58cac2b3 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -40,6 +40,7 @@ TESTS=0 FAILED=0 SKIPPED=0 SRVMEM=0 +LIST_TEST_CASE=0 # default commands, can be overridden by the environment : ${M_SRV:=../programs/ssl/ssl_server2} @@ -133,14 +134,6 @@ print_usage() { printf " \t(default: \$MBEDTLS_TEST_OUTCOME_FILE, none if empty)\n" } -# print_test_title -print_test_title() { - for i in $3; do - TITLE="$1->$2 $MODE,$VERIF $i" - echo "$TITLE" - done -} - list_test_case() { reset_ciphersuites for TYPE in $TYPES; do @@ -190,6 +183,7 @@ get_options() { MEMCHECK=1 ;; --list-test-case) + LIST_TEST_CASE=1 list_test_case exit 0 ;; @@ -1233,15 +1227,21 @@ report_fail() { fi } +# print_test_title +print_test_title() { + for i in $3; do + TITLE="$1->$2 $MODE,$VERIF $i" + DOTS72="........................................................................" + printf "%s %.*s " "$TITLE" "$((71 - ${#TITLE}))" "$DOTS72" + [ $LIST_TEST_CASE -eq 1 ] && printf "\n" + done +} + # run_client run_client() { # announce what we're going to do TESTS=$(( $TESTS + 1 )) - TITLE="`echo $1 | head -c1`->`echo $SERVER_NAME | head -c1`" - TITLE="$TITLE $MODE,$VERIF $2" - printf "%s " "$TITLE" - LEN=$(( 72 - `echo "$TITLE" | wc -c` )) - for i in `seq 1 $LEN`; do printf '.'; done; printf ' ' + print_test_title ${1%"${1#?}"} ${SERVER_NAME%"${SERVER_NAME#?}"} $2 # should we skip? if [ "X$SKIP_NEXT" = "XYES" ]; then diff --git a/tests/scripts/check_test_cases.py b/tests/scripts/check_test_cases.py index 86506f5e59..28f0f0a5fe 100755 --- a/tests/scripts/check_test_cases.py +++ b/tests/scripts/check_test_cases.py @@ -123,8 +123,8 @@ state may override this method. print(*compat_cmd, 'returned', str(result.returncode)) return else: - # Pattern: g->m dtls12,no TLS_DHE_PSK_WITH_AES_128_CBC_SHA\n - m = re.findall(br'[^ogm]*((?:[ogm]->[ogm]\s*\w*.\w*\s\w*)*)\n', + # Pattern: g->m dtls12,no TLS_DHE_PSK_WITH_AES_128_CBC_SHA .......... \n + m = re.findall(br'[^ogm]*((?:[ogm]->[ogm]\s*\w*.\w*\s\w*)*)\s*\.*\s*\n', result.stdout) if m: for i in m: From a81131d358d72f702b831637274f06bec6662c84 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Thu, 2 Mar 2023 11:41:26 +0800 Subject: [PATCH 106/135] compat.sh: fix uncompatiable name of peers in --list-test-case Signed-off-by: Yanray Wang --- tests/compat.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/compat.sh b/tests/compat.sh index 7e58cac2b3..cedf232eb4 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -146,10 +146,10 @@ list_test_case() { for VERIFY in $VERIFIES; do VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]') for MODE in $MODES; do - print_test_title m o "$O_CIPHERS" - print_test_title o m "$O_CIPHERS" - print_test_title m g "$G_CIPHERS" - print_test_title g m "$G_CIPHERS" + print_test_title m O "$O_CIPHERS" + print_test_title O m "$O_CIPHERS" + print_test_title m G "$G_CIPHERS" + print_test_title G m "$G_CIPHERS" print_test_title m m "$M_CIPHERS" done done From f0dbde1bdc402a39db3340767236c8f71f2bc655 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Thu, 2 Mar 2023 11:55:55 +0800 Subject: [PATCH 107/135] compat.sh: uniform TITLE format for --list-test-case and run_client uniform_title is used to print identical format of $TITLE between --list-test-case and run_client. In such way, no matter how $TITLE is developed, --list-test-case will in the same format of test case description as stored in OUTCOME.CSV. Signed-off-by: Yanray Wang --- tests/compat.sh | 38 ++++++++++++++++++++++---------------- 1 file changed, 22 insertions(+), 16 deletions(-) diff --git a/tests/compat.sh b/tests/compat.sh index cedf232eb4..3724bda6a7 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -40,7 +40,6 @@ TESTS=0 FAILED=0 SKIPPED=0 SRVMEM=0 -LIST_TEST_CASE=0 # default commands, can be overridden by the environment : ${M_SRV:=../programs/ssl/ssl_server2} @@ -134,6 +133,14 @@ print_usage() { printf " \t(default: \$MBEDTLS_TEST_OUTCOME_FILE, none if empty)\n" } +# print_test_case +print_test_case() { + for i in $3; do + uniform_title $1 $2 $i + echo $TITLE + done +} + list_test_case() { reset_ciphersuites for TYPE in $TYPES; do @@ -146,11 +153,11 @@ list_test_case() { for VERIFY in $VERIFIES; do VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]') for MODE in $MODES; do - print_test_title m O "$O_CIPHERS" - print_test_title O m "$O_CIPHERS" - print_test_title m G "$G_CIPHERS" - print_test_title G m "$G_CIPHERS" - print_test_title m m "$M_CIPHERS" + print_test_case m O "$O_CIPHERS" + print_test_case O m "$O_CIPHERS" + print_test_case m G "$G_CIPHERS" + print_test_case G m "$G_CIPHERS" + print_test_case m m "$M_CIPHERS" done done } @@ -183,7 +190,6 @@ get_options() { MEMCHECK=1 ;; --list-test-case) - LIST_TEST_CASE=1 list_test_case exit 0 ;; @@ -1227,21 +1233,21 @@ report_fail() { fi } -# print_test_title -print_test_title() { - for i in $3; do - TITLE="$1->$2 $MODE,$VERIF $i" - DOTS72="........................................................................" - printf "%s %.*s " "$TITLE" "$((71 - ${#TITLE}))" "$DOTS72" - [ $LIST_TEST_CASE -eq 1 ] && printf "\n" - done +# uniform_title +# $TITLE is considered as test case description for both --list-test-case and +# MBEDTLS_TEST_OUTCOME_FILE. This function aims to control the format of +# each test case description. +uniform_title() { + TITLE="$1->$2 $MODE,$VERIF $3" } # run_client run_client() { # announce what we're going to do TESTS=$(( $TESTS + 1 )) - print_test_title ${1%"${1#?}"} ${SERVER_NAME%"${SERVER_NAME#?}"} $2 + uniform_title "${1%"${1#?}"}" "${SERVER_NAME%"${SERVER_NAME#?}"}" $2 + DOTS72="........................................................................" + printf "%s %.*s " "$TITLE" "$((71 - ${#TITLE}))" "$DOTS72" # should we skip? if [ "X$SKIP_NEXT" = "XYES" ]; then From 9412a46ab68d738f4183be2cf47109a228949e35 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Thu, 2 Mar 2023 14:45:01 +0800 Subject: [PATCH 108/135] check_test_cases.py: simplify how to store test case description Signed-off-by: Yanray Wang --- tests/scripts/check_test_cases.py | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/tests/scripts/check_test_cases.py b/tests/scripts/check_test_cases.py index 28f0f0a5fe..5f7ffb8612 100755 --- a/tests/scripts/check_test_cases.py +++ b/tests/scripts/check_test_cases.py @@ -123,12 +123,11 @@ state may override this method. print(*compat_cmd, 'returned', str(result.returncode)) return else: - # Pattern: g->m dtls12,no TLS_DHE_PSK_WITH_AES_128_CBC_SHA .......... \n - m = re.findall(br'[^ogm]*((?:[ogm]->[ogm]\s*\w*.\w*\s\w*)*)\s*\.*\s*\n', - result.stdout) - if m: - for i in m: - self.process_test_case(descriptions, file_name, 1, i) + # Assume compat.sh is responsible for printing identical format of + # test case description between --list-test-case and its OUTCOME.CSV + description = result.stdout.strip().split(b'\n') + for idx, descrip in enumerate(description): + self.process_test_case(descriptions, file_name, idx, descrip) @staticmethod def collect_test_directories(): From 88448445823df8c4a60c42bcbf63add1e3a9a762 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Fri, 3 Mar 2023 17:12:29 +0800 Subject: [PATCH 109/135] check_test_cases.py: use check_output to capture error and return This commit includes: - use subprocess.check_output to report error and capture return value - add comment as a reminder for option --list-test-case Signed-off-by: Yanray Wang --- tests/compat.sh | 3 +++ tests/scripts/check_test_cases.py | 19 +++++++------------ 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/tests/compat.sh b/tests/compat.sh index 3724bda6a7..44c3480102 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -141,6 +141,7 @@ print_test_case() { done } +# list_test_case lists all potential test cases in compat.sh without execution list_test_case() { reset_ciphersuites for TYPE in $TYPES; do @@ -189,6 +190,8 @@ get_options() { -M|--memcheck) MEMCHECK=1 ;; + # Please check scripts/check_test_cases.py correspondingly + # if you have to modify option, --list-test-case --list-test-case) list_test_case exit 0 diff --git a/tests/scripts/check_test_cases.py b/tests/scripts/check_test_cases.py index 5f7ffb8612..76465169af 100755 --- a/tests/scripts/check_test_cases.py +++ b/tests/scripts/check_test_cases.py @@ -116,18 +116,13 @@ state may override this method. """Iterate over the test cases compat.sh with a similar format.""" descriptions = self.new_per_file_state() # pylint: disable=assignment-from-none compat_cmd = ['sh', file_name, '--list-test-case'] - result = subprocess.run(compat_cmd, - stdout=subprocess.PIPE, - check=False) - if result.returncode != 0: - print(*compat_cmd, 'returned', str(result.returncode)) - return - else: - # Assume compat.sh is responsible for printing identical format of - # test case description between --list-test-case and its OUTCOME.CSV - description = result.stdout.strip().split(b'\n') - for idx, descrip in enumerate(description): - self.process_test_case(descriptions, file_name, idx, descrip) + compat_output = subprocess.check_output(compat_cmd, + stderr=subprocess.STDOUT) + # Assume compat.sh is responsible for printing identical format of + # test case description between --list-test-case and its OUTCOME.CSV + description = compat_output.strip().split(b'\n') + for idx, descrip in enumerate(description): + self.process_test_case(descriptions, file_name, idx, descrip) @staticmethod def collect_test_directories(): From 67fe2644ae596eabb458b906b35d85452fe07f3d Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Mon, 6 Mar 2023 19:35:04 +0800 Subject: [PATCH 110/135] check_test_cases.py: do not redirect stderr to stdout Signed-off-by: Yanray Wang --- tests/scripts/check_test_cases.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tests/scripts/check_test_cases.py b/tests/scripts/check_test_cases.py index 76465169af..6069a666aa 100755 --- a/tests/scripts/check_test_cases.py +++ b/tests/scripts/check_test_cases.py @@ -116,8 +116,7 @@ state may override this method. """Iterate over the test cases compat.sh with a similar format.""" descriptions = self.new_per_file_state() # pylint: disable=assignment-from-none compat_cmd = ['sh', file_name, '--list-test-case'] - compat_output = subprocess.check_output(compat_cmd, - stderr=subprocess.STDOUT) + compat_output = subprocess.check_output(compat_cmd) # Assume compat.sh is responsible for printing identical format of # test case description between --list-test-case and its OUTCOME.CSV description = compat_output.strip().split(b'\n') From 8aba83bf22cdc3d7cf77b97e88f6bd0cc16253aa Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Mon, 6 Mar 2023 19:37:07 +0800 Subject: [PATCH 111/135] compat.sh: return $? in option --list-test-case to handle error case Signed-off-by: Yanray Wang --- tests/compat.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/compat.sh b/tests/compat.sh index 44c3480102..dff693b80b 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -194,7 +194,7 @@ get_options() { # if you have to modify option, --list-test-case --list-test-case) list_test_case - exit 0 + exit $? ;; --outcome-file) shift; MBEDTLS_TEST_OUTCOME_FILE=$1 From b2cd07ce09f6b4c7376cd372dfbb8c963baa4688 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Wed, 30 Aug 2023 12:07:26 +0800 Subject: [PATCH 112/135] compat: list all test cases properly When calling `add_xxx_ciphersuites`, we have to set MODE properly. This commit adjusts order to address this issue in list_test_case which matches what we do in a normal execution. Signed-off-by: Yanray Wang --- tests/compat.sh | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/tests/compat.sh b/tests/compat.sh index dff693b80b..952997537f 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -143,22 +143,21 @@ print_test_case() { # list_test_case lists all potential test cases in compat.sh without execution list_test_case() { - reset_ciphersuites - for TYPE in $TYPES; do - add_common_ciphersuites - add_openssl_ciphersuites - add_gnutls_ciphersuites - add_mbedtls_ciphersuites - done - - for VERIFY in $VERIFIES; do - VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]') - for MODE in $MODES; do - print_test_case m O "$O_CIPHERS" - print_test_case O m "$O_CIPHERS" - print_test_case m G "$G_CIPHERS" - print_test_case G m "$G_CIPHERS" - print_test_case m m "$M_CIPHERS" + for MODE in $MODES; do + for TYPE in $TYPES; do + for VERIFY in $VERIFIES; do + VERIF=$(echo $VERIFY | tr '[:upper:]' '[:lower:]') + reset_ciphersuites + add_common_ciphersuites + add_openssl_ciphersuites + add_gnutls_ciphersuites + add_mbedtls_ciphersuites + print_test_case m O "$O_CIPHERS" + print_test_case O m "$O_CIPHERS" + print_test_case m G "$G_CIPHERS" + print_test_case G m "$G_CIPHERS" + print_test_case m m "$M_CIPHERS" + done done done } From 930cbeeb5bcbed4cb673012581b24ce6da30f276 Mon Sep 17 00:00:00 2001 From: Yanray Wang Date: Wed, 30 Aug 2023 18:31:35 +0800 Subject: [PATCH 113/135] check_test_cases: add a comment to explain idx in walk_compat_sh Signed-off-by: Yanray Wang --- tests/scripts/check_test_cases.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/scripts/check_test_cases.py b/tests/scripts/check_test_cases.py index 6069a666aa..213708b624 100755 --- a/tests/scripts/check_test_cases.py +++ b/tests/scripts/check_test_cases.py @@ -120,6 +120,8 @@ state may override this method. # Assume compat.sh is responsible for printing identical format of # test case description between --list-test-case and its OUTCOME.CSV description = compat_output.strip().split(b'\n') + # idx indicates the number of test case since there is no line number + # in `compat.sh` for each test case. for idx, descrip in enumerate(description): self.process_test_case(descriptions, file_name, idx, descrip) From 1804a15342f12e69cce11f179a74f2673569223a Mon Sep 17 00:00:00 2001 From: David Horstmann Date: Wed, 30 Aug 2023 15:34:34 +0100 Subject: [PATCH 114/135] Fix unnecessary header prefix in tests Remove unnecessary "../library" prefix from test suite include. This aligns the test suite with the development branch Signed-off-by: David Horstmann --- tests/suites/test_suite_psa_its.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index 7864b9c882..2f8b8f97ad 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -10,7 +10,7 @@ * before changing how test data is constructed or validated. */ -#include "../library/psa_crypto_its.h" +#include "psa_crypto_its.h" #include "test/psa_helpers.h" From 43210b56f349bcb330e04756aa83c13125293b53 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 1 Sep 2023 09:53:42 +0100 Subject: [PATCH 115/135] Add the ability to verify mbedtls_platform_zeroize() calls with -Wsizeof-pointer-memaccess Signed-off-by: Tom Cosgrove --- include/mbedtls/platform_util.h | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/include/mbedtls/platform_util.h b/include/mbedtls/platform_util.h index 55fc431131..55eb77dc75 100644 --- a/include/mbedtls/platform_util.h +++ b/include/mbedtls/platform_util.h @@ -243,7 +243,28 @@ MBEDTLS_DEPRECATED typedef int mbedtls_deprecated_numeric_constant_t; * \param len Length of the buffer in bytes * */ +#if defined(MBEDTLS_PLATFORM_ZEROIZE_CHECK_UNSAFE) +#define MBEDTLS_PLATFORM_ZEROIZE_ALT +#define mbedtls_platform_zeroize(buf, len) memset(buf, 0, len) +#include +#else void mbedtls_platform_zeroize(void *buf, size_t len); +#endif + +/* MBEDTLS_PLATFORM_ZEROIZE_CHECK_UNSAFE + * + * Replaces calls to mbedtls_platform_zeroize() with calls to memset(), + * to allow compiler analysis to check for invalid length arguments (e.g. + * specifying sizeof(pointer) rather than sizeof(pointee)). + * + * Note that this option is meant for internal use only and must not be used + * in production builds, because that would lead to zeroization calls being + * optimised out by the compiler. + * + * It is only intended to be used in CFLAGS, with -Wsizeof-pointer-memaccess, + * to check for those incorrect calls to mbedtls_platform_zeroize(). + */ +//#define MBEDTLS_PLATFORM_ZEROIZE_CHECK_UNSAFE #if defined(MBEDTLS_HAVE_TIME_DATE) /** From f7829b099d4c9a348f02d3236957924ad6738f7b Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 1 Sep 2023 09:54:04 +0100 Subject: [PATCH 116/135] Fix incorrect use of mbedtls_platform_zeroize() in tests Signed-off-by: Tom Cosgrove --- tests/suites/test_suite_pkwrite.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function index c5391ba391..fb71d347ec 100644 --- a/tests/suites/test_suite_pkwrite.function +++ b/tests/suites/test_suite_pkwrite.function @@ -154,7 +154,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) pub_key_raw, pub_key_len); #if defined(MBEDTLS_USE_PSA_CRYPTO) - mbedtls_platform_zeroize(derived_key_raw, sizeof(derived_key_raw)); + mbedtls_platform_zeroize(derived_key_raw, derived_key_len); TEST_EQUAL(mbedtls_pk_wrap_as_opaque(&priv_key, &opaque_key_id, PSA_ALG_NONE), 0); From 5117062bb619345f81ac40e1f91626f8887a0d0c Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 1 Sep 2023 10:40:15 +0100 Subject: [PATCH 117/135] Add a build to all.sh to check mbedtls_platform_zeroize() calls Signed-off-by: Tom Cosgrove --- tests/scripts/all.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 5cbf19ed63..f57895700b 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -3536,6 +3536,16 @@ support_build_cmake_custom_config_file () { } +component_build_zeroize_checks () { + msg "build: check for obviously wrong calls to mbedtls_platform_zeroize()" + + scripts/config.py full + + # Only compile - we're looking for sizeof-pointer-memaccess warnings + make CC=gcc CFLAGS='-Werror -DMBEDTLS_PLATFORM_ZEROIZE_CHECK_UNSAFE -Wsizeof-pointer-memaccess' +} + + component_test_zeroize () { # Test that the function mbedtls_platform_zeroize() is not optimized away by # different combinations of compilers and optimization flags by using an From 73285cc075ecafaaf1470055abb9c838bac8dcd5 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 1 Sep 2023 13:07:39 +0100 Subject: [PATCH 118/135] Define all PSA_xxx macros to 1 rather than have them empty, for consistency Signed-off-by: Tom Cosgrove --- include/mbedtls/config_psa.h | 28 ++++++++++++++-------------- library/psa_crypto_storage.h | 2 +- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/include/mbedtls/config_psa.h b/include/mbedtls/config_psa.h index 8a5c68f5c5..1e74a1b5b9 100644 --- a/include/mbedtls/config_psa.h +++ b/include/mbedtls/config_psa.h @@ -617,7 +617,7 @@ extern "C" { #if defined(MBEDTLS_MD_C) #define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 #define PSA_WANT_ALG_HMAC 1 -#define PSA_WANT_KEY_TYPE_HMAC +#define PSA_WANT_KEY_TYPE_HMAC 1 #define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1 #define PSA_WANT_ALG_TLS12_PRF 1 #define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1 @@ -755,69 +755,69 @@ extern "C" { #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1 -#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1 #endif #if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1 -#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1 #endif #if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1 -#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 +#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1 #endif #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1 -#define PSA_WANT_ECC_MONTGOMERY_255 +#define PSA_WANT_ECC_MONTGOMERY_255 1 #endif /* Curve448 is not yet supported via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/4249) */ #if 0 && defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1 -#define PSA_WANT_ECC_MONTGOMERY_448 +#define PSA_WANT_ECC_MONTGOMERY_448 1 #endif #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1 -#define PSA_WANT_ECC_SECP_R1_192 +#define PSA_WANT_ECC_SECP_R1_192 1 #endif #if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1 -#define PSA_WANT_ECC_SECP_R1_224 +#define PSA_WANT_ECC_SECP_R1_224 1 #endif #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1 -#define PSA_WANT_ECC_SECP_R1_256 +#define PSA_WANT_ECC_SECP_R1_256 1 #endif #if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1 -#define PSA_WANT_ECC_SECP_R1_384 +#define PSA_WANT_ECC_SECP_R1_384 1 #endif #if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1 -#define PSA_WANT_ECC_SECP_R1_521 +#define PSA_WANT_ECC_SECP_R1_521 1 #endif #if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1 -#define PSA_WANT_ECC_SECP_K1_192 +#define PSA_WANT_ECC_SECP_K1_192 1 #endif /* SECP224K1 is buggy via the PSA API (https://github.com/Mbed-TLS/mbedtls/issues/3541) */ #if 0 && defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_224 1 -#define PSA_WANT_ECC_SECP_K1_224 +#define PSA_WANT_ECC_SECP_K1_224 1 #endif #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) #define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1 -#define PSA_WANT_ECC_SECP_K1_256 +#define PSA_WANT_ECC_SECP_K1_256 1 #endif #endif /* MBEDTLS_PSA_CRYPTO_CONFIG */ diff --git a/library/psa_crypto_storage.h b/library/psa_crypto_storage.h index edd9b947cd..37ca46e283 100644 --- a/library/psa_crypto_storage.h +++ b/library/psa_crypto_storage.h @@ -202,7 +202,7 @@ psa_status_t psa_parse_key_data_from_storage(const uint8_t *storage_data, #if defined(MBEDTLS_PSA_CRYPTO_SE_C) /** This symbol is defined if transaction support is required. */ -#define PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS +#define PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS 1 #endif #if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS) From 7f18f440536021e9867d5e4dacba3f05c4d56c56 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 1 Sep 2023 13:55:39 +0100 Subject: [PATCH 119/135] Move zeroize-as-memset into a config file under tests/ Signed-off-by: Tom Cosgrove --- include/mbedtls/platform_util.h | 23 ++++---------- tests/configs/config-wrapper-zeroize-memset.h | 31 +++++++++++++++++++ tests/scripts/all.sh | 2 +- 3 files changed, 38 insertions(+), 18 deletions(-) create mode 100644 tests/configs/config-wrapper-zeroize-memset.h diff --git a/include/mbedtls/platform_util.h b/include/mbedtls/platform_util.h index 55eb77dc75..70dc51a8b7 100644 --- a/include/mbedtls/platform_util.h +++ b/include/mbedtls/platform_util.h @@ -243,28 +243,17 @@ MBEDTLS_DEPRECATED typedef int mbedtls_deprecated_numeric_constant_t; * \param len Length of the buffer in bytes * */ -#if defined(MBEDTLS_PLATFORM_ZEROIZE_CHECK_UNSAFE) -#define MBEDTLS_PLATFORM_ZEROIZE_ALT -#define mbedtls_platform_zeroize(buf, len) memset(buf, 0, len) -#include -#else +#if !defined(MBEDTLS_TEST_DEFINES_ZEROIZE) void mbedtls_platform_zeroize(void *buf, size_t len); #endif -/* MBEDTLS_PLATFORM_ZEROIZE_CHECK_UNSAFE +/* MBEDTLS_TEST_DEFINES_ZEROIZE * - * Replaces calls to mbedtls_platform_zeroize() with calls to memset(), - * to allow compiler analysis to check for invalid length arguments (e.g. - * specifying sizeof(pointer) rather than sizeof(pointee)). - * - * Note that this option is meant for internal use only and must not be used - * in production builds, because that would lead to zeroization calls being - * optimised out by the compiler. - * - * It is only intended to be used in CFLAGS, with -Wsizeof-pointer-memaccess, - * to check for those incorrect calls to mbedtls_platform_zeroize(). + * Indicates that the library is being built by the test framework, and the + * framework is going to provide a replacement mbedtls_platform_zeroize() + * using a pre-processor macro, so the function declaration should be omitted. */ -//#define MBEDTLS_PLATFORM_ZEROIZE_CHECK_UNSAFE +//#define MBEDTLS_TEST_DEFINES_ZEROIZE #if defined(MBEDTLS_HAVE_TIME_DATE) /** diff --git a/tests/configs/config-wrapper-zeroize-memset.h b/tests/configs/config-wrapper-zeroize-memset.h new file mode 100644 index 0000000000..d1bfa17171 --- /dev/null +++ b/tests/configs/config-wrapper-zeroize-memset.h @@ -0,0 +1,31 @@ +/* mbedtls_config.h wrapper that defines mbedtls_platform_zeroize() to be + * memset(), so that the compile can check arguments for us. + * Used for testing. + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 + * + * Licensed under the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT + * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "mbedtls/mbedtls_config.h" + +#include + +/* Define _ALT so we don't get the built-in implementation. The test code will + * also need to define MBEDTLS_TEST_DEFINES_ZEROIZE so we don't get the + * declaration. */ +#define MBEDTLS_PLATFORM_ZEROIZE_ALT + +#define mbedtls_platform_zeroize(buf, len) memset(buf, 0, len) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index f57895700b..0232711a55 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -3542,7 +3542,7 @@ component_build_zeroize_checks () { scripts/config.py full # Only compile - we're looking for sizeof-pointer-memaccess warnings - make CC=gcc CFLAGS='-Werror -DMBEDTLS_PLATFORM_ZEROIZE_CHECK_UNSAFE -Wsizeof-pointer-memaccess' + make CC=gcc CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/config-wrapper-zeroize-memset.h\"' -DMBEDTLS_TEST_DEFINES_ZEROIZE -Werror -Wsizeof-pointer-memaccess" } From 95b5d79cbfde05ea51e4c1ae715a419700cc1f39 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 1 Sep 2023 14:34:37 +0100 Subject: [PATCH 120/135] Move the description of MBEDTLS_TEST_DEFINES_ZEROIZE to before its use Signed-off-by: Tom Cosgrove --- include/mbedtls/platform_util.h | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/include/mbedtls/platform_util.h b/include/mbedtls/platform_util.h index 70dc51a8b7..62f6d70388 100644 --- a/include/mbedtls/platform_util.h +++ b/include/mbedtls/platform_util.h @@ -221,6 +221,11 @@ MBEDTLS_DEPRECATED typedef int mbedtls_deprecated_numeric_constant_t; #define MBEDTLS_IGNORE_RETURN(result) ((void) !(result)) #endif +/* If the following macro is defined, the library is being built by the test + * framework, and the framework is going to provide a replacement + * mbedtls_platform_zeroize() using a preprocessor macro, so the function + * declaration should be omitted. */ +#if !defined(MBEDTLS_TEST_DEFINES_ZEROIZE) //no-check-names /** * \brief Securely zeroize a buffer * @@ -243,18 +248,9 @@ MBEDTLS_DEPRECATED typedef int mbedtls_deprecated_numeric_constant_t; * \param len Length of the buffer in bytes * */ -#if !defined(MBEDTLS_TEST_DEFINES_ZEROIZE) void mbedtls_platform_zeroize(void *buf, size_t len); #endif -/* MBEDTLS_TEST_DEFINES_ZEROIZE - * - * Indicates that the library is being built by the test framework, and the - * framework is going to provide a replacement mbedtls_platform_zeroize() - * using a pre-processor macro, so the function declaration should be omitted. - */ -//#define MBEDTLS_TEST_DEFINES_ZEROIZE - #if defined(MBEDTLS_HAVE_TIME_DATE) /** * \brief Platform-specific implementation of gmtime_r() From 5ffb19741d27b0fe62bf30483940a8425e2b5a12 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 1 Sep 2023 14:40:21 +0100 Subject: [PATCH 121/135] config-wrapper-zeroize-memset.h should be user-config-zeroize-memset.h and not include mbedtls_config.h Signed-off-by: Tom Cosgrove --- ...-wrapper-zeroize-memset.h => user-config-zeroize-memset.h} | 4 +--- tests/scripts/all.sh | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-) rename tests/configs/{config-wrapper-zeroize-memset.h => user-config-zeroize-memset.h} (90%) diff --git a/tests/configs/config-wrapper-zeroize-memset.h b/tests/configs/user-config-zeroize-memset.h similarity index 90% rename from tests/configs/config-wrapper-zeroize-memset.h rename to tests/configs/user-config-zeroize-memset.h index d1bfa17171..fcdd1f099d 100644 --- a/tests/configs/config-wrapper-zeroize-memset.h +++ b/tests/configs/user-config-zeroize-memset.h @@ -1,4 +1,4 @@ -/* mbedtls_config.h wrapper that defines mbedtls_platform_zeroize() to be +/* mbedtls_config.h modifier that defines mbedtls_platform_zeroize() to be * memset(), so that the compile can check arguments for us. * Used for testing. */ @@ -19,8 +19,6 @@ * limitations under the License. */ -#include "mbedtls/mbedtls_config.h" - #include /* Define _ALT so we don't get the built-in implementation. The test code will diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 0232711a55..4ed1949a2c 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -3542,7 +3542,7 @@ component_build_zeroize_checks () { scripts/config.py full # Only compile - we're looking for sizeof-pointer-memaccess warnings - make CC=gcc CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/config-wrapper-zeroize-memset.h\"' -DMBEDTLS_TEST_DEFINES_ZEROIZE -Werror -Wsizeof-pointer-memaccess" + make CC=gcc CFLAGS="'-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-zeroize-memset.h\"' -DMBEDTLS_TEST_DEFINES_ZEROIZE -Werror -Wsizeof-pointer-memaccess" } From f88ee8b007e4b8259a692c51f59b5ef2278d381d Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Mon, 4 Sep 2023 11:04:40 +0100 Subject: [PATCH 122/135] For tests, rename ASSERT_COMPARE() to TEST_BUFFERS_EQUAL() Signed-off-by: Tom Cosgrove --- tests/include/test/macros.h | 16 +- tests/suites/test_suite_aes.function | 2 +- tests/suites/test_suite_aria.function | 16 +- tests/suites/test_suite_asn1write.function | 12 +- tests/suites/test_suite_chacha20.function | 6 +- tests/suites/test_suite_cipher.function | 4 +- .../suites/test_suite_constant_time.function | 2 +- .../test_suite_constant_time_hmac.function | 2 +- tests/suites/test_suite_ecp.function | 8 +- tests/suites/test_suite_hkdf.function | 6 +- tests/suites/test_suite_md.function | 20 +-- tests/suites/test_suite_mps.function | 164 +++++++++--------- tests/suites/test_suite_pkcs12.function | 2 +- tests/suites/test_suite_pkcs1_v21.function | 8 +- tests/suites/test_suite_pkwrite.function | 6 +- .../test_suite_platform_printf.function | 6 +- tests/suites/test_suite_poly1305.function | 8 +- tests/suites/test_suite_psa_crypto.function | 74 ++++---- ..._suite_psa_crypto_driver_wrappers.function | 36 ++-- .../test_suite_psa_crypto_hash.function | 6 +- ...t_suite_psa_crypto_persistent_key.function | 6 +- ...st_suite_psa_crypto_se_driver_hal.function | 4 +- ..._suite_psa_crypto_slot_management.function | 18 +- ...t_suite_psa_crypto_storage_format.function | 4 +- tests/suites/test_suite_psa_its.function | 10 +- tests/suites/test_suite_ssl.function | 14 +- 26 files changed, 231 insertions(+), 229 deletions(-) diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h index 750fe33e69..76b4668d18 100644 --- a/tests/include/test/macros.h +++ b/tests/include/test/macros.h @@ -186,14 +186,16 @@ * \param size2 Size of the second buffer in bytes. * This expression may be evaluated multiple times. */ -#define ASSERT_COMPARE(p1, size1, p2, size2) \ - do \ - { \ +#define TEST_BUFFERS_EQUAL(p1, size1, p2, size2) \ + do { \ TEST_EQUAL((size1), (size2)); \ - if ((size1) != 0) \ - TEST_ASSERT(memcmp((p1), (p2), (size1)) == 0); \ - } \ - while (0) + if ((size1) != 0) { \ + TEST_ASSERT(memcmp((p1), (p2), (size1)) == 0); \ + } \ + } while (0) + +/* For backwards compatibility */ +#define ASSERT_COMPARE(p1, size1, p2, size2) TEST_BUFFERS_EQUAL(p1, size1, p2, size2) /** * \brief This macro tests the expression passed to it and skips the diff --git a/tests/suites/test_suite_aes.function b/tests/suites/test_suite_aes.function index e96e40790d..c88f4c34d6 100644 --- a/tests/suites/test_suite_aes.function +++ b/tests/suites/test_suite_aes.function @@ -34,7 +34,7 @@ static int test_ctx_alignment(const data_t *key, // Decrypt TEST_ASSERT(mbedtls_aes_crypt_ecb(dec, MBEDTLS_AES_DECRYPT, ciphertext, output) == 0); - ASSERT_COMPARE(plaintext, 16, output, 16); + TEST_BUFFERS_EQUAL(plaintext, 16, output, 16); mbedtls_aes_free(dec); diff --git a/tests/suites/test_suite_aria.function b/tests/suites/test_suite_aria.function index ed3338943c..8b5eac1c97 100644 --- a/tests/suites/test_suite_aria.function +++ b/tests/suites/test_suite_aria.function @@ -224,7 +224,7 @@ void aria_encrypt_ecb(data_t *key_str, data_t *src_str, output + i) == 0); } - ASSERT_COMPARE(output, expected_output->len, + TEST_BUFFERS_EQUAL(output, expected_output->len, expected_output->x, expected_output->len); } @@ -252,7 +252,7 @@ void aria_decrypt_ecb(data_t *key_str, data_t *src_str, output + i) == 0); } - ASSERT_COMPARE(output, expected_output->len, + TEST_BUFFERS_EQUAL(output, expected_output->len, expected_output->x, expected_output->len); } @@ -277,7 +277,7 @@ void aria_encrypt_cbc(data_t *key_str, data_t *iv_str, src_str->len, iv_str->x, src_str->x, output) == cbc_result); if (cbc_result == 0) { - ASSERT_COMPARE(output, expected_output->len, + TEST_BUFFERS_EQUAL(output, expected_output->len, expected_output->x, expected_output->len); } @@ -302,7 +302,7 @@ void aria_decrypt_cbc(data_t *key_str, data_t *iv_str, src_str->len, iv_str->x, src_str->x, output) == cbc_result); if (cbc_result == 0) { - ASSERT_COMPARE(output, expected_output->len, + TEST_BUFFERS_EQUAL(output, expected_output->len, expected_output->x, expected_output->len); } @@ -329,7 +329,7 @@ void aria_encrypt_cfb128(data_t *key_str, data_t *iv_str, iv_str->x, src_str->x, output) == result); - ASSERT_COMPARE(output, expected_output->len, + TEST_BUFFERS_EQUAL(output, expected_output->len, expected_output->x, expected_output->len); exit: @@ -355,7 +355,7 @@ void aria_decrypt_cfb128(data_t *key_str, data_t *iv_str, iv_str->x, src_str->x, output) == result); - ASSERT_COMPARE(output, expected_output->len, + TEST_BUFFERS_EQUAL(output, expected_output->len, expected_output->x, expected_output->len); exit: @@ -381,7 +381,7 @@ void aria_encrypt_ctr(data_t *key_str, data_t *iv_str, iv_str->x, blk, src_str->x, output) == result); - ASSERT_COMPARE(output, expected_output->len, + TEST_BUFFERS_EQUAL(output, expected_output->len, expected_output->x, expected_output->len); exit: @@ -407,7 +407,7 @@ void aria_decrypt_ctr(data_t *key_str, data_t *iv_str, iv_str->x, blk, src_str->x, output) == result); - ASSERT_COMPARE(output, expected_output->len, + TEST_BUFFERS_EQUAL(output, expected_output->len, expected_output->x, expected_output->len); exit: diff --git a/tests/suites/test_suite_asn1write.function b/tests/suites/test_suite_asn1write.function index 81e3c1248e..478067c6de 100644 --- a/tests/suites/test_suite_asn1write.function +++ b/tests/suites/test_suite_asn1write.function @@ -37,7 +37,7 @@ int generic_write_finish_step(generic_write_data_t *data, TEST_EQUAL(ret, data->end - data->p); TEST_ASSERT(data->p >= data->start); TEST_ASSERT(data->p <= data->end); - ASSERT_COMPARE(data->p, (size_t) (data->end - data->p), + TEST_BUFFERS_EQUAL(data->p, (size_t) (data->end - data->p), expected->x, expected->len); } ok = 1; @@ -322,7 +322,7 @@ void mbedtls_asn1_write_algorithm_identifier(data_t *oid, TEST_EQUAL(mbedtls_asn1_get_alg(&p, end_complete, &alg, ¶ms), 0); TEST_EQUAL(alg.tag, MBEDTLS_ASN1_OID); - ASSERT_COMPARE(alg.p, alg.len, oid->x, oid->len); + TEST_BUFFERS_EQUAL(alg.p, alg.len, oid->x, oid->len); TEST_EQUAL(params.tag, expected_params_tag); TEST_EQUAL(params.len, expected_params_len); mbedtls_free(buf_complete); @@ -440,7 +440,7 @@ void test_asn1_write_bitstrings(data_t *bitstring, int bits, mbedtls_asn1_bitstring read = { 0, 0, NULL }; TEST_EQUAL(mbedtls_asn1_get_bitstring(&data.p, data.end, &read), 0); - ASSERT_COMPARE(read.p, read.len, + TEST_BUFFERS_EQUAL(read.p, read.len, masked_bitstring, byte_length); TEST_EQUAL(read.unused_bits, 8 * byte_length - value_bits); } @@ -545,7 +545,7 @@ void store_named_data_val_found(int old_len, int new_len) TEST_ASSERT(found == head); if (new_val != NULL) { - ASSERT_COMPARE(found->val.p, found->val.len, + TEST_BUFFERS_EQUAL(found->val.p, found->val.len, new_val, (size_t) new_len); } if (new_len == 0) { @@ -580,14 +580,14 @@ void store_named_data_val_new(int new_len, int set_new_val) TEST_ASSERT(found != NULL); TEST_ASSERT(found == head); TEST_ASSERT(found->oid.p != oid); - ASSERT_COMPARE(found->oid.p, found->oid.len, oid, oid_len); + TEST_BUFFERS_EQUAL(found->oid.p, found->oid.len, oid, oid_len); if (new_len == 0) { TEST_ASSERT(found->val.p == NULL); } else if (new_val == NULL) { TEST_ASSERT(found->val.p != NULL); } else { TEST_ASSERT(found->val.p != new_val); - ASSERT_COMPARE(found->val.p, found->val.len, + TEST_BUFFERS_EQUAL(found->val.p, found->val.len, new_val, (size_t) new_len); } diff --git a/tests/suites/test_suite_chacha20.function b/tests/suites/test_suite_chacha20.function index 7f49561764..5d7d0891c1 100644 --- a/tests/suites/test_suite_chacha20.function +++ b/tests/suites/test_suite_chacha20.function @@ -29,7 +29,7 @@ void chacha20_crypt(data_t *key_str, TEST_ASSERT(mbedtls_chacha20_crypt(key_str->x, nonce_str->x, counter, src_str->len, src_str->x, output) == 0); - ASSERT_COMPARE(output, expected_output_str->len, + TEST_BUFFERS_EQUAL(output, expected_output_str->len, expected_output_str->x, expected_output_str->len); /* @@ -44,7 +44,7 @@ void chacha20_crypt(data_t *key_str, memset(output, 0x00, sizeof(output)); TEST_ASSERT(mbedtls_chacha20_update(&ctx, src_str->len, src_str->x, output) == 0); - ASSERT_COMPARE(output, expected_output_str->len, + TEST_BUFFERS_EQUAL(output, expected_output_str->len, expected_output_str->x, expected_output_str->len); /* @@ -60,7 +60,7 @@ void chacha20_crypt(data_t *key_str, TEST_ASSERT(mbedtls_chacha20_update(&ctx, src_str->len - 1, src_str->x + 1, output + 1) == 0); - ASSERT_COMPARE(output, expected_output_str->len, + TEST_BUFFERS_EQUAL(output, expected_output_str->len, expected_output_str->x, expected_output_str->len); mbedtls_chacha20_free(&ctx); diff --git a/tests/suites/test_suite_cipher.function b/tests/suites/test_suite_cipher.function index ef9ff0aa2f..3c2bd26b9a 100644 --- a/tests/suites/test_suite_cipher.function +++ b/tests/suites/test_suite_cipher.function @@ -1274,7 +1274,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, TEST_ASSERT(buffer_is_all_zero(decrypt_buf, decrypt_buf_len)); } else { TEST_ASSERT(ret == 0); - ASSERT_COMPARE(decrypt_buf, outlen, clear->x, clear->len); + TEST_BUFFERS_EQUAL(decrypt_buf, outlen, clear->x, clear->len); } /* Free this, but keep cipher_plus_tag for deprecated function with PSA */ @@ -1390,7 +1390,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, } else { /* authentic message: is the plaintext correct? */ TEST_ASSERT(ret == 0); - ASSERT_COMPARE(decrypt_buf, outlen, clear->x, clear->len); + TEST_BUFFERS_EQUAL(decrypt_buf, outlen, clear->x, clear->len); } mbedtls_free(decrypt_buf); diff --git a/tests/suites/test_suite_constant_time.function b/tests/suites/test_suite_constant_time.function index a40149ab43..03c5a67c6a 100644 --- a/tests/suites/test_suite_constant_time.function +++ b/tests/suites/test_suite_constant_time.function @@ -38,7 +38,7 @@ void ssl_cf_memcpy_offset(int offset_min, int offset_max, int len) TEST_CF_PUBLIC(&secret, sizeof(secret)); TEST_CF_PUBLIC(dst, len); - ASSERT_COMPARE(dst, len, src + secret, len); + TEST_BUFFERS_EQUAL(dst, len, src + secret, len); } exit: diff --git a/tests/suites/test_suite_constant_time_hmac.function b/tests/suites/test_suite_constant_time_hmac.function index 57d5a4e4ff..394f8cae97 100644 --- a/tests/suites/test_suite_constant_time_hmac.function +++ b/tests/suites/test_suite_constant_time_hmac.function @@ -84,7 +84,7 @@ void ssl_cf_hmac(int hash) TEST_EQUAL(0, mbedtls_md_hmac_reset(&ref_ctx)); /* Compare */ - ASSERT_COMPARE(out, out_len, ref_out, out_len); + TEST_BUFFERS_EQUAL(out, out_len, ref_out, out_len); } mbedtls_free(data); diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function index 53c3f874ac..391761706c 100644 --- a/tests/suites/test_suite_ecp.function +++ b/tests/suites/test_suite_ecp.function @@ -852,7 +852,7 @@ void ecp_muladd(int id, &len, actual_result, sizeof(actual_result))); TEST_ASSERT(len <= MBEDTLS_ECP_MAX_PT_LEN); - ASSERT_COMPARE(expected_result->x, expected_result->len, + TEST_BUFFERS_EQUAL(expected_result->x, expected_result->len, actual_result, len); exit: @@ -1356,7 +1356,7 @@ void mbedtls_ecp_read_key(int grp_id, data_t *in_key, int expected, int canonica ret = mbedtls_ecp_write_key(&key, buf, in_key->len); TEST_ASSERT(ret == 0); - ASSERT_COMPARE(in_key->x, in_key->len, + TEST_BUFFERS_EQUAL(in_key->x, in_key->len, buf, in_key->len); } else { unsigned char export1[MBEDTLS_ECP_MAX_BYTES]; @@ -1371,7 +1371,7 @@ void mbedtls_ecp_read_key(int grp_id, data_t *in_key, int expected, int canonica ret = mbedtls_ecp_write_key(&key2, export2, in_key->len); TEST_ASSERT(ret == 0); - ASSERT_COMPARE(export1, in_key->len, + TEST_BUFFERS_EQUAL(export1, in_key->len, export2, in_key->len); } } @@ -1448,7 +1448,7 @@ void genkey_mx_known_answer(int bits, data_t *seed, data_t *expected) * (can be enforced by checking these bits). * - Other bits must be random (by testing with different RNG outputs, * we validate that those bits are indeed influenced by the RNG). */ - ASSERT_COMPARE(expected->x, expected->len, + TEST_BUFFERS_EQUAL(expected->x, expected->len, actual, expected->len); } diff --git a/tests/suites/test_suite_hkdf.function b/tests/suites/test_suite_hkdf.function index 2bfbf3cc67..f52108ecdb 100644 --- a/tests/suites/test_suite_hkdf.function +++ b/tests/suites/test_suite_hkdf.function @@ -24,7 +24,7 @@ void test_hkdf(int md_alg, data_t *ikm, data_t *salt, data_t *info, info->x, info->len, okm, expected_okm->len); TEST_ASSERT(ret == 0); - ASSERT_COMPARE(okm, expected_okm->len, + TEST_BUFFERS_EQUAL(okm, expected_okm->len, expected_okm->x, expected_okm->len); } /* END_CASE */ @@ -53,7 +53,7 @@ void test_hkdf_extract(int md_alg, char *hex_ikm_string, ret = mbedtls_hkdf_extract(md, salt, salt_len, ikm, ikm_len, output_prk); TEST_ASSERT(ret == 0); - ASSERT_COMPARE(output_prk, output_prk_len, prk, prk_len); + TEST_BUFFERS_EQUAL(output_prk, output_prk_len, prk, prk_len); exit: mbedtls_free(ikm); @@ -89,7 +89,7 @@ void test_hkdf_expand(int md_alg, char *hex_info_string, ret = mbedtls_hkdf_expand(md, prk, prk_len, info, info_len, output_okm, OKM_LEN); TEST_ASSERT(ret == 0); - ASSERT_COMPARE(output_okm, okm_len, okm, okm_len); + TEST_BUFFERS_EQUAL(output_okm, okm_len, okm, okm_len); exit: mbedtls_free(info); diff --git a/tests/suites/test_suite_md.function b/tests/suites/test_suite_md.function index c1cf8ec830..0ad6e96a19 100644 --- a/tests/suites/test_suite_md.function +++ b/tests/suites/test_suite_md.function @@ -139,7 +139,7 @@ void md_text(int md_type, char *text_src_string, data_t *hash) TEST_EQUAL(0, mbedtls_md(md_info, src, src_len, output)); - ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); } /* END_CASE */ @@ -155,7 +155,7 @@ void md_hex(int md_type, data_t *src_str, data_t *hash) TEST_EQUAL(0, mbedtls_md(md_info, src_str->x, src_str->len, output)); - ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); } /* END_CASE */ @@ -188,14 +188,14 @@ void md_text_multi(int md_type, char *text_src_string, TEST_EQUAL(0, mbedtls_md_update(&ctx, src + halfway, src_len - halfway)); TEST_EQUAL(0, mbedtls_md_finish(&ctx, output)); - ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); /* Test clone */ memset(output, 0x00, sizeof(output)); TEST_EQUAL(0, mbedtls_md_update(&ctx_copy, src + halfway, src_len - halfway)); TEST_EQUAL(0, mbedtls_md_finish(&ctx_copy, output)); - ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); exit: mbedtls_md_free(&ctx); @@ -228,14 +228,14 @@ void md_hex_multi(int md_type, data_t *src_str, data_t *hash) TEST_EQUAL(0, mbedtls_md_update(&ctx, src_str->x + halfway, src_str->len - halfway)); TEST_EQUAL(0, mbedtls_md_finish(&ctx, output)); - ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); /* Test clone */ memset(output, 0x00, sizeof(output)); TEST_EQUAL(0, mbedtls_md_update(&ctx_copy, src_str->x + halfway, src_str->len - halfway)); TEST_EQUAL(0, mbedtls_md_finish(&ctx_copy, output)); - ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); exit: mbedtls_md_free(&ctx); @@ -258,7 +258,7 @@ void mbedtls_md_hmac(int md_type, int trunc_size, TEST_EQUAL(0, mbedtls_md_hmac(md_info, key_str->x, key_str->len, src_str->x, src_str->len, output)); - ASSERT_COMPARE(output, trunc_size, hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, trunc_size, hash->x, hash->len); } /* END_CASE */ @@ -285,7 +285,7 @@ void md_hmac_multi(int md_type, int trunc_size, data_t *key_str, TEST_EQUAL(0, mbedtls_md_hmac_update(&ctx, src_str->x + halfway, src_str->len - halfway)); TEST_EQUAL(0, mbedtls_md_hmac_finish(&ctx, output)); - ASSERT_COMPARE(output, trunc_size, hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, trunc_size, hash->x, hash->len); /* Test again, for reset() */ memset(output, 0x00, sizeof(output)); @@ -295,7 +295,7 @@ void md_hmac_multi(int md_type, int trunc_size, data_t *key_str, TEST_EQUAL(0, mbedtls_md_hmac_update(&ctx, src_str->x + halfway, src_str->len - halfway)); TEST_EQUAL(0, mbedtls_md_hmac_finish(&ctx, output)); - ASSERT_COMPARE(output, trunc_size, hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, trunc_size, hash->x, hash->len); exit: mbedtls_md_free(&ctx); @@ -314,6 +314,6 @@ void mbedtls_md_file(int md_type, char *filename, TEST_EQUAL(0, mbedtls_md_file(md_info, filename, output)); - ASSERT_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); } /* END_CASE */ diff --git a/tests/suites/test_suite_mps.function b/tests/suites/test_suite_mps.function index a9ccf22a77..06d8ec2548 100644 --- a/tests/suites/test_suite_mps.function +++ b/tests/suites/test_suite_mps.function @@ -60,7 +60,7 @@ void mbedtls_mps_reader_no_pausing_single_step_single_round(int with_acc) /* Consumption (upper layer) */ /* Consume exactly what's available */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 100, bufA, 100); + TEST_BUFFERS_EQUAL(tmp, 100, bufA, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup (lower layer) */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, &paused) == 0); @@ -108,14 +108,14 @@ void mbedtls_mps_reader_no_pausing_single_step_multiple_rounds(int with_acc) /* Consumption (upper layer) */ /* Consume exactly what's available */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 100, bufA, 100); + TEST_BUFFERS_EQUAL(tmp, 100, bufA, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Preparation */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufB, sizeof(bufB)) == 0); /* Consumption */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 100, bufB, 100); + TEST_BUFFERS_EQUAL(tmp, 100, bufB, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup (lower layer) */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); @@ -162,11 +162,11 @@ void mbedtls_mps_reader_no_pausing_multiple_steps_single_round(int with_acc) TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, buf, 10); + TEST_BUFFERS_EQUAL(tmp, 10, buf, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 70, buf + 10, 70); + TEST_BUFFERS_EQUAL(tmp, 70, buf + 10, 70); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, &tmp_len) == 0); - ASSERT_COMPARE(tmp, tmp_len, buf + 80, 20); + TEST_BUFFERS_EQUAL(tmp, tmp_len, buf + 80, 20); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup (lower layer) */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); @@ -202,18 +202,18 @@ void mbedtls_mps_reader_no_pausing_multiple_steps_multiple_rounds(int with_acc) TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufA, sizeof(bufA)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 70, bufA + 10, 70); + TEST_BUFFERS_EQUAL(tmp, 70, bufA + 10, 70); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, &tmp_len) == 0); - ASSERT_COMPARE(tmp, tmp_len, bufA + 80, 20); + TEST_BUFFERS_EQUAL(tmp, tmp_len, bufA + 80, 20); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Preparation */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufB, sizeof(bufB)) == 0); /* Consumption */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 100, bufB, 100); + TEST_BUFFERS_EQUAL(tmp, 100, bufB, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); @@ -243,7 +243,7 @@ void mbedtls_mps_reader_pausing_needed_disabled() TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 50, buf, 50); + TEST_BUFFERS_EQUAL(tmp, 50, buf, 50); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -284,10 +284,10 @@ void mbedtls_mps_reader_pausing_needed_buffer_too_small() TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 50, buf, 50); + TEST_BUFFERS_EQUAL(tmp, 50, buf, 50); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, buf + 50, 10); + TEST_BUFFERS_EQUAL(tmp, 10, buf + 50, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); /* Wrapup (lower layer) */ @@ -295,7 +295,7 @@ void mbedtls_mps_reader_pausing_needed_buffer_too_small() MBEDTLS_ERR_MPS_READER_ACCUMULATOR_TOO_SMALL); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, &tmp_len) == 0); - ASSERT_COMPARE(tmp, tmp_len, buf + 50, 50); + TEST_BUFFERS_EQUAL(tmp, tmp_len, buf + 50, 50); mbedtls_mps_reader_free(&rd); } @@ -325,7 +325,7 @@ void mbedtls_mps_reader_reclaim_overflow() TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 50, buf, 50); + TEST_BUFFERS_EQUAL(tmp, 50, buf, 50); /* Excess request */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, (mbedtls_mps_size_t) -1, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -376,10 +376,10 @@ void mbedtls_mps_reader_pausing(int option) /* Consumption (upper layer) */ /* Ask for more than what's available. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 80, bufA, 80); + TEST_BUFFERS_EQUAL(tmp, 80, bufA, 80); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); switch (option) { case 0: /* Single uncommitted fetch at pausing */ case 1: @@ -400,50 +400,50 @@ void mbedtls_mps_reader_pausing(int option) switch (option) { case 0: /* Single fetch at pausing, re-fetch with commit. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); break; case 1: /* Single fetch at pausing, re-fetch without commit. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); break; case 2: /* Multiple fetches at pausing, repeat without commit. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); break; case 3: /* Multiple fetches at pausing, repeat with commit 1. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); break; case 4: /* Multiple fetches at pausing, repeat with commit 2. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); break; case 5: /* Multiple fetches at pausing, repeat with commit 3. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); break; @@ -453,7 +453,7 @@ void mbedtls_mps_reader_pausing(int option) /* In all cases, fetch the rest of the second buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 90, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 90, bufB + 10, 90); + TEST_BUFFERS_EQUAL(tmp, 90, bufB + 10, 90); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ @@ -498,7 +498,7 @@ void mbedtls_mps_reader_pausing_multiple_feeds(int option) /* Consumption (upper layer) */ /* Ask for more than what's available. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 80, bufA, 80); + TEST_BUFFERS_EQUAL(tmp, 80, bufA, 80); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* 20 left, ask for 70 -> 50 overhead */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == @@ -538,8 +538,8 @@ void mbedtls_mps_reader_pausing_multiple_feeds(int option) /* Consumption */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 20, bufA + 80, 20); - ASSERT_COMPARE(tmp + 20, 50, bufB, 50); + TEST_BUFFERS_EQUAL(tmp, 20, bufA + 80, 20); + TEST_BUFFERS_EQUAL(tmp + 20, 50, bufB, 50); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 1000, &tmp, &fetch_len) == 0); switch (option) { case 0: @@ -591,14 +591,14 @@ void mbedtls_mps_reader_reclaim_data_left(int option) /* Fetch (but not commit) the entire buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf), &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 100, buf, 100); + TEST_BUFFERS_EQUAL(tmp, 100, buf, 100); break; case 1: /* Fetch (but not commit) parts of the buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2); + TEST_BUFFERS_EQUAL(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2); break; case 2: @@ -606,11 +606,11 @@ void mbedtls_mps_reader_reclaim_data_left(int option) * fetch but not commit the rest of the buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2); + TEST_BUFFERS_EQUAL(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, sizeof(buf) / 2, + TEST_BUFFERS_EQUAL(tmp, sizeof(buf) / 2, buf + sizeof(buf) / 2, sizeof(buf) / 2); break; @@ -646,16 +646,16 @@ void mbedtls_mps_reader_reclaim_data_left_retry() TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 50, buf, 50); + TEST_BUFFERS_EQUAL(tmp, 50, buf, 50); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 50, buf + 50, 50); + TEST_BUFFERS_EQUAL(tmp, 50, buf + 50, 50); /* Preparation */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == MBEDTLS_ERR_MPS_READER_DATA_LEFT); /* Consumption */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 50, buf + 50, 50); + TEST_BUFFERS_EQUAL(tmp, 50, buf + 50, 50); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); @@ -699,10 +699,10 @@ void mbedtls_mps_reader_multiple_pausing(int option) /* Consumption (upper layer) */ /* Ask for more than what's available. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 80, bufA, 80); + TEST_BUFFERS_EQUAL(tmp, 80, bufA, 80); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -717,10 +717,10 @@ void mbedtls_mps_reader_multiple_pausing(int option) /* Consume */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, &tmp_len) == 0); - ASSERT_COMPARE(tmp, tmp_len, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, tmp_len, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -731,18 +731,18 @@ void mbedtls_mps_reader_multiple_pausing(int option) /* Consume */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufB + 10, 10); - ASSERT_COMPARE(tmp + 10, 10, bufC, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufB + 10, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufC, 10); break; case 1: /* Fetch same chunks, commit afterwards, and * then exceed bounds of new buffer; accumulator * not large enough. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 51, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -756,10 +756,10 @@ void mbedtls_mps_reader_multiple_pausing(int option) * then exceed bounds of new buffer; accumulator * large enough. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -769,19 +769,19 @@ void mbedtls_mps_reader_multiple_pausing(int option) /* Consume */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 20, bufA + 80, 20); - ASSERT_COMPARE(tmp + 20, 20, bufB, 20); - ASSERT_COMPARE(tmp + 40, 10, bufC, 10); + TEST_BUFFERS_EQUAL(tmp, 20, bufA + 80, 20); + TEST_BUFFERS_EQUAL(tmp + 20, 20, bufB, 20); + TEST_BUFFERS_EQUAL(tmp + 40, 10, bufC, 10); break; case 3: /* Fetch same chunks, don't commit afterwards, and * then exceed bounds of new buffer; accumulator * not large enough. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 80, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 10, bufA + 90, 10); - ASSERT_COMPARE(tmp + 10, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); + TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 21, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -1005,16 +1005,16 @@ void mbedtls_reader_inconsistent_usage(int option) case 0: /* Ask for buffered data in a single chunk, no commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 20, bufA + 80, 20); - ASSERT_COMPARE(tmp + 20, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 20, bufA + 80, 20); + TEST_BUFFERS_EQUAL(tmp + 20, 10, bufB, 10); success = 1; break; case 1: /* Ask for buffered data in a single chunk, with commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 20, bufA + 80, 20); - ASSERT_COMPARE(tmp + 20, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 20, bufA + 80, 20); + TEST_BUFFERS_EQUAL(tmp + 20, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); success = 1; break; @@ -1035,7 +1035,7 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data in different * chunks than before CAN fail. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 15, bufA + 80, 15); + TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_INCONSISTENT_REQUESTS); break; @@ -1044,10 +1044,10 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data different chunks * than before NEED NOT fail - no commits */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 15, bufA + 80, 15); + TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 5, bufA + 95, 5); - ASSERT_COMPARE(tmp + 5, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 5, bufA + 95, 5); + TEST_BUFFERS_EQUAL(tmp + 5, 10, bufB, 10); success = 1; break; @@ -1055,11 +1055,11 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data different chunks * than before NEED NOT fail - intermediate commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 15, bufA + 80, 15); + TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 5, bufA + 95, 5); - ASSERT_COMPARE(tmp + 5, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 5, bufA + 95, 5); + TEST_BUFFERS_EQUAL(tmp + 5, 10, bufB, 10); success = 1; break; @@ -1067,10 +1067,10 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data different chunks * than before NEED NOT fail - end commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 15, bufA + 80, 15); + TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 5, bufA + 95, 5); - ASSERT_COMPARE(tmp + 5, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 5, bufA + 95, 5); + TEST_BUFFERS_EQUAL(tmp + 5, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); success = 1; break; @@ -1079,11 +1079,11 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data different chunks * than before NEED NOT fail - intermediate & end commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 15, bufA + 80, 15); + TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); - ASSERT_COMPARE(tmp, 5, bufA + 95, 5); - ASSERT_COMPARE(tmp + 5, 10, bufB, 10); + TEST_BUFFERS_EQUAL(tmp, 5, bufA + 95, 5); + TEST_BUFFERS_EQUAL(tmp + 5, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); success = 1; break; @@ -1096,7 +1096,7 @@ void mbedtls_reader_inconsistent_usage(int option) if (success == 1) { /* In all succeeding cases, fetch the rest of the second buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 90, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 90, bufB + 10, 90); + TEST_BUFFERS_EQUAL(tmp, 90, bufB + 10, 90); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ @@ -1131,7 +1131,7 @@ void mbedtls_mps_reader_feed_empty() /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - ASSERT_COMPARE(tmp, 100, buf, 100); + TEST_BUFFERS_EQUAL(tmp, 100, buf, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ diff --git a/tests/suites/test_suite_pkcs12.function b/tests/suites/test_suite_pkcs12.function index 17d2ed705c..e125532020 100644 --- a/tests/suites/test_suite_pkcs12.function +++ b/tests/suites/test_suite_pkcs12.function @@ -57,7 +57,7 @@ void pkcs12_derive_key(int md_type, int key_size_arg, TEST_EQUAL(ret, expected_status); if (expected_status == 0) { - ASSERT_COMPARE(expected_output->x, expected_output->len, + TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, output_data, key_size); } diff --git a/tests/suites/test_suite_pkcs1_v21.function b/tests/suites/test_suite_pkcs1_v21.function index bf99df692e..5dfe5bbb21 100644 --- a/tests/suites/test_suite_pkcs1_v21.function +++ b/tests/suites/test_suite_pkcs1_v21.function @@ -42,7 +42,7 @@ void pkcs1_rsaes_oaep_encrypt(int mod, data_t *input_N, data_t *input_E, message_str->len, message_str->x, output) == result); if (result == 0) { - ASSERT_COMPARE(output, ctx.len, result_str->x, result_str->len); + TEST_BUFFERS_EQUAL(output, ctx.len, result_str->x, result_str->len); } exit: @@ -98,7 +98,7 @@ void pkcs1_rsaes_oaep_decrypt(int mod, data_t *input_P, data_t *input_Q, output, sizeof(output)) == result); if (result == 0) { - ASSERT_COMPARE(output, output_len, result_str->x, result_str->len); + TEST_BUFFERS_EQUAL(output, output_len, result_str->x, result_str->len); } } @@ -154,7 +154,7 @@ void pkcs1_rsassa_pss_sign(int mod, data_t *input_P, data_t *input_Q, &info, MBEDTLS_RSA_PRIVATE, digest, 0, hash_result, output) == result); if (result == 0) { - ASSERT_COMPARE(output, ctx.len, result_str->x, result_str->len); + TEST_BUFFERS_EQUAL(output, ctx.len, result_str->x, result_str->len); } info.buf = rnd_buf->x; @@ -165,7 +165,7 @@ void pkcs1_rsassa_pss_sign(int mod, data_t *input_P, data_t *input_Q, &info, digest, 0, hash_result, fixed_salt_length, output) == result); if (result == 0) { - ASSERT_COMPARE(output, ctx.len, result_str->x, result_str->len); + TEST_BUFFERS_EQUAL(output, ctx.len, result_str->x, result_str->len); } exit: diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function index fb71d347ec..8c77150de9 100644 --- a/tests/suites/test_suite_pkwrite.function +++ b/tests/suites/test_suite_pkwrite.function @@ -94,7 +94,7 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der) start_buf = buf; } - ASSERT_COMPARE(start_buf, buf_len, check_buf, check_buf_len); + TEST_BUFFERS_EQUAL(start_buf, buf_len, check_buf, check_buf_len); exit: mbedtls_free(buf); @@ -150,7 +150,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) TEST_EQUAL(mbedtls_pk_write_pubkey_der(&priv_key, derived_key_raw, derived_key_len), pub_key_len); - ASSERT_COMPARE(derived_key_raw, derived_key_len, + TEST_BUFFERS_EQUAL(derived_key_raw, derived_key_len, pub_key_raw, pub_key_len); #if defined(MBEDTLS_USE_PSA_CRYPTO) @@ -162,7 +162,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) TEST_EQUAL(mbedtls_pk_write_pubkey_der(&priv_key, derived_key_raw, derived_key_len), pub_key_len); - ASSERT_COMPARE(derived_key_raw, derived_key_len, + TEST_BUFFERS_EQUAL(derived_key_raw, derived_key_len, pub_key_raw, pub_key_len); #endif /* MBEDTLS_USE_PSA_CRYPTO */ diff --git a/tests/suites/test_suite_platform_printf.function b/tests/suites/test_suite_platform_printf.function index 3c816fe33b..e687eb1b7c 100644 --- a/tests/suites/test_suite_platform_printf.function +++ b/tests/suites/test_suite_platform_printf.function @@ -34,7 +34,7 @@ void printf_int(char *format, /* any format expecting one int argument, e.g. "%d /* Nominal case: buffer just large enough */ ASSERT_ALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, x)); - ASSERT_COMPARE(result, n + 1, output, n + 1); + TEST_BUFFERS_EQUAL(result, n + 1, output, n + 1); mbedtls_free(output); output = NULL; @@ -59,7 +59,7 @@ void printf_long_max(const char *format, /* "%lx" or longer type */ ASSERT_ALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, value)); - ASSERT_COMPARE(expected, n + 1, output, n + 1); + TEST_BUFFERS_EQUAL(expected, n + 1, output, n + 1); mbedtls_free(output); output = NULL; @@ -79,7 +79,7 @@ void printf_char2(char *format, /* "%c%c" */ /* Nominal case: buffer just large enough */ ASSERT_ALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, arg1, arg2)); - ASSERT_COMPARE(result, n + 1, output, n + 1); + TEST_BUFFERS_EQUAL(result, n + 1, output, n + 1); mbedtls_free(output); output = NULL; diff --git a/tests/suites/test_suite_poly1305.function b/tests/suites/test_suite_poly1305.function index 1a0e38834d..adee1d88ac 100644 --- a/tests/suites/test_suite_poly1305.function +++ b/tests/suites/test_suite_poly1305.function @@ -22,7 +22,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_mac(key->x, src_str->x, src_str->len, mac) == 0); - ASSERT_COMPARE(mac, expected_mac->len, + TEST_BUFFERS_EQUAL(mac, expected_mac->len, expected_mac->x, expected_mac->len); /* @@ -36,7 +36,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); - ASSERT_COMPARE(mac, expected_mac->len, + TEST_BUFFERS_EQUAL(mac, expected_mac->len, expected_mac->x, expected_mac->len); /* @@ -53,7 +53,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); - ASSERT_COMPARE(mac, expected_mac->len, + TEST_BUFFERS_EQUAL(mac, expected_mac->len, expected_mac->x, expected_mac->len); } @@ -69,7 +69,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); - ASSERT_COMPARE(mac, expected_mac->len, + TEST_BUFFERS_EQUAL(mac, expected_mac->len, expected_mac->x, expected_mac->len); } diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index c457cdfba9..daeadca42b 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -623,7 +623,7 @@ void import_export(data_t *data, } if (canonical_input) { - ASSERT_COMPARE(data->x, data->len, exported, exported_length); + TEST_BUFFERS_EQUAL(data->x, data->len, exported, exported_length); } else { mbedtls_svc_key_id_t key2 = MBEDTLS_SVC_KEY_ID_INIT; PSA_ASSERT(psa_import_key(&attributes, exported, exported_length, @@ -632,7 +632,7 @@ void import_export(data_t *data, reexported, export_size, &reexported_length)); - ASSERT_COMPARE(exported, exported_length, + TEST_BUFFERS_EQUAL(exported, exported_length, reexported, reexported_length); PSA_ASSERT(psa_destroy_key(key2)); } @@ -703,7 +703,7 @@ void import_export_public_key(data_t *data, PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_type, bits)); TEST_LE_U(expected_public_key->len, PSA_EXPORT_PUBLIC_KEY_MAX_SIZE); - ASSERT_COMPARE(expected_public_key->x, expected_public_key->len, + TEST_BUFFERS_EQUAL(expected_public_key->x, expected_public_key->len, exported, exported_length); } @@ -1449,7 +1449,7 @@ void copy_success(int source_usage_arg, ASSERT_ALLOC(export_buffer, material->len); PSA_ASSERT(psa_export_key(target_key, export_buffer, material->len, &length)); - ASSERT_COMPARE(material->x, material->len, + TEST_BUFFERS_EQUAL(material->x, material->len, export_buffer, length); } @@ -1650,7 +1650,7 @@ void hash_compute_compare(int alg_arg, data_t *input, output, PSA_HASH_LENGTH(alg), &output_length)); TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg)); - ASSERT_COMPARE(output, output_length, + TEST_BUFFERS_EQUAL(output, output_length, expected_output->x, expected_output->len); /* Compute with larger buffer */ @@ -1658,7 +1658,7 @@ void hash_compute_compare(int alg_arg, data_t *input, output, sizeof(output), &output_length)); TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg)); - ASSERT_COMPARE(output, output_length, + TEST_BUFFERS_EQUAL(output, output_length, expected_output->x, expected_output->len); /* Compare with correct hash */ @@ -2195,7 +2195,7 @@ void mac_sign(int key_type_arg, actual_mac, output_size, &mac_length), expected_status); if (expected_status == PSA_SUCCESS) { - ASSERT_COMPARE(expected_mac->x, expected_mac->len, + TEST_BUFFERS_EQUAL(expected_mac->x, expected_mac->len, actual_mac, mac_length); } @@ -2214,7 +2214,7 @@ void mac_sign(int key_type_arg, PSA_ASSERT(psa_mac_abort(&operation)); if (expected_status == PSA_SUCCESS) { - ASSERT_COMPARE(expected_mac->x, expected_mac->len, + TEST_BUFFERS_EQUAL(expected_mac->x, expected_mac->len, actual_mac, mac_length); } mbedtls_free(actual_mac); @@ -2697,7 +2697,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, output_buffer_size - output_length, &length)); output_length += length; - ASSERT_COMPARE(ciphertext->x, ciphertext->len, + TEST_BUFFERS_EQUAL(ciphertext->x, ciphertext->len, output, output_length); /* Multipart encryption */ @@ -2715,7 +2715,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, output_buffer_size - output_length, &length)); output_length += length; - ASSERT_COMPARE(plaintext->x, plaintext->len, + TEST_BUFFERS_EQUAL(plaintext->x, plaintext->len, output, output_length); /* One-shot encryption */ @@ -2723,7 +2723,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, PSA_ASSERT(psa_cipher_encrypt(key, alg, plaintext->x, plaintext->len, output, output_buffer_size, &output_length)); - ASSERT_COMPARE(ciphertext->x, ciphertext->len, + TEST_BUFFERS_EQUAL(ciphertext->x, ciphertext->len, output, output_length); /* One-shot decryption */ @@ -2731,7 +2731,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, PSA_ASSERT(psa_cipher_decrypt(key, alg, ciphertext->x, ciphertext->len, output, output_buffer_size, &output_length)); - ASSERT_COMPARE(plaintext->x, plaintext->len, + TEST_BUFFERS_EQUAL(plaintext->x, plaintext->len, output, output_length); exit: @@ -2850,7 +2850,7 @@ void cipher_encrypt_validation(int alg_arg, output2_length += function_output_length; PSA_ASSERT(psa_cipher_abort(&operation)); - ASSERT_COMPARE(output1 + iv_size, output1_length - iv_size, + TEST_BUFFERS_EQUAL(output1 + iv_size, output1_length - iv_size, output2, output2_length); exit: @@ -2949,7 +2949,7 @@ void cipher_encrypt_multipart(int alg_arg, int key_type_arg, if (expected_status == PSA_SUCCESS) { PSA_ASSERT(psa_cipher_abort(&operation)); - ASSERT_COMPARE(expected_output->x, expected_output->len, + TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, output, total_output_length); } @@ -3049,7 +3049,7 @@ void cipher_decrypt_multipart(int alg_arg, int key_type_arg, if (expected_status == PSA_SUCCESS) { PSA_ASSERT(psa_cipher_abort(&operation)); - ASSERT_COMPARE(expected_output->x, expected_output->len, + TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, output, total_output_length); } @@ -3160,7 +3160,7 @@ void cipher_decrypt(int alg_arg, TEST_LE_U(output_length, PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(input_buffer_size)); - ASSERT_COMPARE(expected_output->x, expected_output->len, + TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, output, output_length); exit: mbedtls_free(input); @@ -3217,7 +3217,7 @@ void cipher_verify_output(int alg_arg, TEST_LE_U(output2_length, PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(output1_length)); - ASSERT_COMPARE(input->x, input->len, output2, output2_length); + TEST_BUFFERS_EQUAL(input->x, input->len, output2, output2_length); exit: mbedtls_free(output1); @@ -3357,7 +3357,7 @@ void cipher_verify_output_multipart(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation2)); - ASSERT_COMPARE(input->x, input->len, output2, output2_length); + TEST_BUFFERS_EQUAL(input->x, input->len, output2, output2_length); exit: psa_cipher_abort(&operation1); @@ -3452,7 +3452,7 @@ void aead_encrypt_decrypt(int key_type_arg, data_t *key_data, &output_length2), expected_result); - ASSERT_COMPARE(input_data->x, input_data->len, + TEST_BUFFERS_EQUAL(input_data->x, input_data->len, output_data2, output_length2); } @@ -3519,7 +3519,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, } PSA_ASSERT(status); - ASSERT_COMPARE(expected_result->x, expected_result->len, + TEST_BUFFERS_EQUAL(expected_result->x, expected_result->len, output_data, output_length); exit: @@ -3592,7 +3592,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, TEST_EQUAL(status, expected_result); if (expected_result == PSA_SUCCESS) { - ASSERT_COMPARE(expected_data->x, expected_data->len, + TEST_BUFFERS_EQUAL(expected_data->x, expected_data->len, output_data, output_length); } @@ -3663,7 +3663,7 @@ void sign_hash_deterministic(int key_type_arg, data_t *key_data, signature, signature_size, &signature_length)); /* Verify that the signature is what is expected. */ - ASSERT_COMPARE(output_data->x, output_data->len, + TEST_BUFFERS_EQUAL(output_data->x, output_data->len, signature, signature_length); #if defined(MBEDTLS_TEST_DEPRECATED) @@ -3673,7 +3673,7 @@ void sign_hash_deterministic(int key_type_arg, data_t *key_data, input_data->x, input_data->len, signature, signature_size, &signature_length)); - ASSERT_COMPARE(output_data->x, output_data->len, + TEST_BUFFERS_EQUAL(output_data->x, output_data->len, signature, signature_length); #endif /* MBEDTLS_TEST_DEPRECATED */ @@ -3933,7 +3933,7 @@ void sign_message_deterministic(int key_type_arg, signature, signature_size, &signature_length)); - ASSERT_COMPARE(output_data->x, output_data->len, + TEST_BUFFERS_EQUAL(output_data->x, output_data->len, signature, signature_length); exit: @@ -4271,7 +4271,7 @@ void asymmetric_encrypt_decrypt(int key_type_arg, label->x, label->len, output2, output2_size, &output2_length)); - ASSERT_COMPARE(input_data->x, input_data->len, + TEST_BUFFERS_EQUAL(input_data->x, input_data->len, output2, output2_length); exit: @@ -4328,7 +4328,7 @@ void asymmetric_decrypt(int key_type_arg, output, output_size, &output_length)); - ASSERT_COMPARE(expected_data->x, expected_data->len, + TEST_BUFFERS_EQUAL(expected_data->x, expected_data->len, output, output_length); /* If the label is empty, the test framework puts a non-null pointer @@ -4344,7 +4344,7 @@ void asymmetric_decrypt(int key_type_arg, output, output_size, &output_length)); - ASSERT_COMPARE(expected_data->x, expected_data->len, + TEST_BUFFERS_EQUAL(expected_data->x, expected_data->len, output, output_length); } @@ -4756,7 +4756,7 @@ void derive_output(int alg_arg, /* Success. Check the read data. */ PSA_ASSERT(status); if (output_sizes[i] != 0) { - ASSERT_COMPARE(output_buffer, output_sizes[i], + TEST_BUFFERS_EQUAL(output_buffer, output_sizes[i], expected_outputs[i], output_sizes[i]); } /* Check the operation status. */ @@ -4982,7 +4982,7 @@ void derive_key_export(int alg_arg, TEST_EQUAL(length, bytes2); /* Compare the outputs from the two runs. */ - ASSERT_COMPARE(output_buffer, bytes1 + bytes2, + TEST_BUFFERS_EQUAL(output_buffer, bytes1 + bytes2, export_buffer, capacity); exit: @@ -5133,7 +5133,7 @@ void raw_key_agreement(int alg_arg, peer_key_data->x, peer_key_data->len, output, expected_output->len, &output_length)); - ASSERT_COMPARE(output, output_length, + TEST_BUFFERS_EQUAL(output, output_length, expected_output->x, expected_output->len); mbedtls_free(output); output = NULL; @@ -5145,7 +5145,7 @@ void raw_key_agreement(int alg_arg, peer_key_data->x, peer_key_data->len, output, expected_output->len + 1, &output_length)); - ASSERT_COMPARE(output, output_length, + TEST_BUFFERS_EQUAL(output, output_length, expected_output->x, expected_output->len); mbedtls_free(output); output = NULL; @@ -5268,13 +5268,13 @@ void key_agreement_output(int alg_arg, PSA_ASSERT(psa_key_derivation_output_bytes(&operation, actual_output, expected_output1->len)); - ASSERT_COMPARE(actual_output, expected_output1->len, + TEST_BUFFERS_EQUAL(actual_output, expected_output1->len, expected_output1->x, expected_output1->len); if (expected_output2->len != 0) { PSA_ASSERT(psa_key_derivation_output_bytes(&operation, actual_output, expected_output2->len)); - ASSERT_COMPARE(actual_output, expected_output2->len, + TEST_BUFFERS_EQUAL(actual_output, expected_output2->len, expected_output2->x, expected_output2->len); } @@ -5443,7 +5443,7 @@ void generate_key_rsa(int bits_arg, if (is_default_public_exponent) { TEST_EQUAL(e_read_length, 0); } else { - ASSERT_COMPARE(e_read_buffer, e_read_length, e_arg->x, e_arg->len); + TEST_BUFFERS_EQUAL(e_read_buffer, e_read_length, e_arg->x, e_arg->len); } /* Do something with the key according to its type and permitted usage. */ @@ -5479,7 +5479,7 @@ void generate_key_rsa(int bits_arg, TEST_EQUAL(p[1], 0); TEST_EQUAL(p[2], 1); } else { - ASSERT_COMPARE(p, len, e_arg->x, e_arg->len); + TEST_BUFFERS_EQUAL(p, len, e_arg->x, e_arg->len); } } @@ -5588,7 +5588,7 @@ void persistent_key_load_key_from_storage(data_t *data, first_export, export_size, &first_exported_length)); if (generation_method == IMPORT_KEY) { - ASSERT_COMPARE(data->x, data->len, + TEST_BUFFERS_EQUAL(data->x, data->len, first_export, first_exported_length); } } @@ -5615,7 +5615,7 @@ void persistent_key_load_key_from_storage(data_t *data, PSA_ASSERT(psa_export_key(key, second_export, export_size, &second_exported_length)); - ASSERT_COMPARE(first_export, first_exported_length, + TEST_BUFFERS_EQUAL(first_export, first_exported_length, second_export, second_exported_length); } diff --git a/tests/suites/test_suite_psa_crypto_driver_wrappers.function b/tests/suites/test_suite_psa_crypto_driver_wrappers.function index 953b9ffbce..28afbb75fa 100644 --- a/tests/suites/test_suite_psa_crypto_driver_wrappers.function +++ b/tests/suites/test_suite_psa_crypto_driver_wrappers.function @@ -64,7 +64,7 @@ void sign_hash(int key_type_arg, &signature_length); TEST_EQUAL(actual_status, expected_status); if (expected_status == PSA_SUCCESS) { - ASSERT_COMPARE(signature, signature_length, + TEST_BUFFERS_EQUAL(signature, signature_length, expected_output->x, expected_output->len); } TEST_EQUAL(mbedtls_test_driver_signature_sign_hooks.hits, 1); @@ -191,7 +191,7 @@ void sign_message(int key_type_arg, &signature_length); TEST_EQUAL(actual_status, expected_status); if (expected_status == PSA_SUCCESS) { - ASSERT_COMPARE(signature, signature_length, + TEST_BUFFERS_EQUAL(signature, signature_length, expected_output->x, expected_output->len); } /* In the builtin algorithm the driver is called twice. */ @@ -313,7 +313,7 @@ void generate_key(int force_status_arg, psa_export_key(key, actual_output, sizeof(actual_output), &actual_output_length); if (fake_output->len > 0) { - ASSERT_COMPARE(actual_output, actual_output_length, + TEST_BUFFERS_EQUAL(actual_output, actual_output_length, expected_output, expected_output_length); } else { size_t zeroes = 0; @@ -445,7 +445,7 @@ void export_key(int force_status_arg, } if (actual_status == PSA_SUCCESS) { - ASSERT_COMPARE(actual_output, actual_output_length, + TEST_BUFFERS_EQUAL(actual_output, actual_output_length, expected_output_ptr, expected_output_length); } exit: @@ -527,7 +527,7 @@ void cipher_encrypt_validation(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation)); // driver function should've been called as part of the finish() core routine TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); - ASSERT_COMPARE(output1 + iv_size, output1_length - iv_size, + TEST_BUFFERS_EQUAL(output1 + iv_size, output1_length - iv_size, output2, output2_length); exit: @@ -655,7 +655,7 @@ void cipher_encrypt_multipart(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation)); TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); - ASSERT_COMPARE(expected_output->x, expected_output->len, + TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, output, total_output_length); } @@ -784,7 +784,7 @@ void cipher_decrypt_multipart(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation)); TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); - ASSERT_COMPARE(expected_output->x, expected_output->len, + TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, output, total_output_length); } @@ -856,7 +856,7 @@ void cipher_decrypt(int alg_arg, TEST_EQUAL(status, expected_status); if (expected_status == PSA_SUCCESS) { - ASSERT_COMPARE(expected_output->x, expected_output->len, + TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, output, output_length); } @@ -1141,7 +1141,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, PSA_SUCCESS : forced_status); if (status == PSA_SUCCESS) { - ASSERT_COMPARE(expected_result->x, expected_result->len, + TEST_BUFFERS_EQUAL(expected_result->x, expected_result->len, output_data, output_length); } @@ -1204,7 +1204,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, PSA_SUCCESS : forced_status); if (status == PSA_SUCCESS) { - ASSERT_COMPARE(expected_data->x, expected_data->len, + TEST_BUFFERS_EQUAL(expected_data->x, expected_data->len, output_data, output_length); } @@ -1326,7 +1326,7 @@ void mac_sign(int key_type_arg, } if (forced_status == PSA_SUCCESS) { - ASSERT_COMPARE(expected_mac->x, expected_mac->len, + TEST_BUFFERS_EQUAL(expected_mac->x, expected_mac->len, actual_mac, mac_length); } @@ -1477,7 +1477,7 @@ void builtin_key_export(int builtin_key_id_arg, if (expected_status == PSA_SUCCESS) { PSA_ASSERT(actual_status); TEST_EQUAL(output_size, expected_output->len); - ASSERT_COMPARE(output_buffer, output_size, + TEST_BUFFERS_EQUAL(output_buffer, output_size, expected_output->x, expected_output->len); PSA_ASSERT(psa_get_key_attributes(key, &attributes)); @@ -1528,7 +1528,7 @@ void builtin_pubkey_export(int builtin_key_id_arg, if (expected_status == PSA_SUCCESS) { PSA_ASSERT(actual_status); TEST_EQUAL(output_size, expected_output->len); - ASSERT_COMPARE(output_buffer, output_size, + TEST_BUFFERS_EQUAL(output_buffer, output_size, expected_output->x, expected_output->len); PSA_ASSERT(psa_get_key_attributes(key, &attributes)); @@ -1573,7 +1573,7 @@ void hash_compute(int alg_arg, TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status); if (expected_status == PSA_SUCCESS) { - ASSERT_COMPARE(output, output_length, hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); } exit: @@ -1619,7 +1619,7 @@ void hash_multipart_setup(int alg_arg, forced_status == PSA_ERROR_NOT_SUPPORTED ? 1 : 4); TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status); - ASSERT_COMPARE(output, output_length, hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); } exit: @@ -1674,7 +1674,7 @@ void hash_multipart_update(int alg_arg, TEST_EQUAL(mbedtls_test_driver_hash_hooks.hits, 2); TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, PSA_SUCCESS); - ASSERT_COMPARE(output, output_length, hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); } exit: @@ -1727,7 +1727,7 @@ void hash_multipart_finish(int alg_arg, TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status); if (forced_status == PSA_SUCCESS) { - ASSERT_COMPARE(output, output_length, hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); } exit: @@ -1786,7 +1786,7 @@ void hash_clone(int alg_arg, TEST_EQUAL(mbedtls_test_driver_hash_hooks.hits, 3); TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, PSA_SUCCESS); - ASSERT_COMPARE(output, output_length, hash->x, hash->len); + TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); } exit: diff --git a/tests/suites/test_suite_psa_crypto_hash.function b/tests/suites/test_suite_psa_crypto_hash.function index f12541d686..fce293a9b3 100644 --- a/tests/suites/test_suite_psa_crypto_hash.function +++ b/tests/suites/test_suite_psa_crypto_hash.function @@ -25,7 +25,7 @@ void hash_finish(int alg_arg, data_t *input, data_t *expected_hash) PSA_ASSERT(psa_hash_finish(&operation, actual_hash, sizeof(actual_hash), &actual_hash_length)); - ASSERT_COMPARE(expected_hash->x, expected_hash->len, + TEST_BUFFERS_EQUAL(expected_hash->x, expected_hash->len, actual_hash, actual_hash_length); exit: @@ -83,13 +83,13 @@ void hash_multi_part(int alg_arg, data_t *input, data_t *expected_hash) PSA_ASSERT(psa_hash_finish(&operation, actual_hash, sizeof(actual_hash), &actual_hash_length)); - ASSERT_COMPARE(expected_hash->x, expected_hash->len, + TEST_BUFFERS_EQUAL(expected_hash->x, expected_hash->len, actual_hash, actual_hash_length); PSA_ASSERT(psa_hash_finish(&operation2, actual_hash, sizeof(actual_hash), &actual_hash_length)); - ASSERT_COMPARE(expected_hash->x, expected_hash->len, + TEST_BUFFERS_EQUAL(expected_hash->x, expected_hash->len, actual_hash, actual_hash_length); } while (len++ != input->len); diff --git a/tests/suites/test_suite_psa_crypto_persistent_key.function b/tests/suites/test_suite_psa_crypto_persistent_key.function index db99d7993d..4d852384d7 100644 --- a/tests/suites/test_suite_psa_crypto_persistent_key.function +++ b/tests/suites/test_suite_psa_crypto_persistent_key.function @@ -66,7 +66,7 @@ void format_storage_data_check(data_t *key_data, &attributes.core, file_data); - ASSERT_COMPARE(expected_file_data->x, expected_file_data->len, + TEST_BUFFERS_EQUAL(expected_file_data->x, expected_file_data->len, file_data, file_data_length); exit: @@ -111,7 +111,7 @@ void parse_storage_data_check(data_t *file_data, (uint32_t) expected_key_alg); TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), (uint32_t) expected_key_alg2); - ASSERT_COMPARE(expected_key_data->x, expected_key_data->len, + TEST_BUFFERS_EQUAL(expected_key_data->x, expected_key_data->len, key_data, key_data_length); exit: @@ -307,7 +307,7 @@ void import_export_persistent_key(data_t *data, int type_arg, PSA_ASSERT(psa_export_key(key_id, exported, export_size, &exported_length)); - ASSERT_COMPARE(data->x, data->len, exported, exported_length); + TEST_BUFFERS_EQUAL(data->x, data->len, exported, exported_length); /* Destroy the key */ PSA_ASSERT(psa_destroy_key(key_id)); diff --git a/tests/suites/test_suite_psa_crypto_se_driver_hal.function b/tests/suites/test_suite_psa_crypto_se_driver_hal.function index 513dd8760e..9d62d645df 100644 --- a/tests/suites/test_suite_psa_crypto_se_driver_hal.function +++ b/tests/suites/test_suite_psa_crypto_se_driver_hal.function @@ -603,7 +603,7 @@ static int check_persistent_data(psa_key_location_t location, PSA_ASSERT(psa_its_get_info(uid, &info)); ASSERT_ALLOC(loaded, info.size); PSA_ASSERT(psa_its_get(uid, 0, info.size, loaded, NULL)); - ASSERT_COMPARE(expected_data, size, loaded, info.size); + TEST_BUFFERS_EQUAL(expected_data, size, loaded, info.size); ok = 1; exit: @@ -958,7 +958,7 @@ void key_creation_import_export(int lifetime_arg, int min_slot, int restart) PSA_ASSERT(psa_export_key(returned_id, exported, sizeof(exported), &exported_length)); - ASSERT_COMPARE(key_material, sizeof(key_material), + TEST_BUFFERS_EQUAL(key_material, sizeof(key_material), exported, exported_length); PSA_ASSERT(psa_destroy_key(returned_id)); diff --git a/tests/suites/test_suite_psa_crypto_slot_management.function b/tests/suites/test_suite_psa_crypto_slot_management.function index 905be03eaf..72c8e0f78d 100644 --- a/tests/suites/test_suite_psa_crypto_slot_management.function +++ b/tests/suites/test_suite_psa_crypto_slot_management.function @@ -307,7 +307,7 @@ void persistent_slot_lifecycle(int lifetime_arg, int owner_id_arg, int id_arg, if (usage_flags & PSA_KEY_USAGE_EXPORT) { PSA_ASSERT(psa_export_key(id, reexported, key_data->len, &reexported_length)); - ASSERT_COMPARE(key_data->x, key_data->len, + TEST_BUFFERS_EQUAL(key_data->x, key_data->len, reexported, reexported_length); } else { TEST_EQUAL(psa_export_key(id, reexported, @@ -402,7 +402,7 @@ void create_existent(int lifetime_arg, int owner_id_arg, int id_arg, PSA_ASSERT(psa_export_key(id, reexported, sizeof(reexported), &reexported_length)); - ASSERT_COMPARE(material1, sizeof(material1), + TEST_BUFFERS_EQUAL(material1, sizeof(material1), reexported, reexported_length); PSA_ASSERT(psa_close_key(id)); @@ -578,7 +578,7 @@ void copy_across_lifetimes(int source_lifetime_arg, int source_owner_id_arg, ASSERT_ALLOC(export_buffer, material->len); PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, material->len, &length)); - ASSERT_COMPARE(material->x, material->len, + TEST_BUFFERS_EQUAL(material->x, material->len, export_buffer, length); } else { size_t length; @@ -692,7 +692,7 @@ void copy_to_occupied(int source_lifetime_arg, int source_id_arg, ASSERT_ALLOC(export_buffer, target_material->len); PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, target_material->len, &length)); - ASSERT_COMPARE(target_material->x, target_material->len, + TEST_BUFFERS_EQUAL(target_material->x, target_material->len, export_buffer, length); } @@ -840,7 +840,7 @@ void many_transient_keys(int max_keys_arg) PSA_ASSERT(psa_export_key(keys[i], exported, sizeof(exported), &exported_length)); - ASSERT_COMPARE(exported, exported_length, + TEST_BUFFERS_EQUAL(exported, exported_length, (uint8_t *) &i, sizeof(i)); } PSA_ASSERT(psa_close_key(keys[i - 1])); @@ -917,7 +917,7 @@ void key_slot_eviction_to_import_new_key(int lifetime_arg) PSA_ASSERT(psa_export_key(key, exported, sizeof(exported), &exported_length)); - ASSERT_COMPARE(exported, exported_length, + TEST_BUFFERS_EQUAL(exported, exported_length, (uint8_t *) &i, sizeof(i)); PSA_ASSERT(psa_destroy_key(key)); } @@ -988,7 +988,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() exported, sizeof(exported), &exported_length)); i = MBEDTLS_PSA_KEY_SLOT_COUNT - 1; - ASSERT_COMPARE(exported, exported_length, (uint8_t *) &i, sizeof(i)); + TEST_BUFFERS_EQUAL(exported, exported_length, (uint8_t *) &i, sizeof(i)); PSA_ASSERT(psa_destroy_key(keys[MBEDTLS_PSA_KEY_SLOT_COUNT - 1])); /* @@ -1016,7 +1016,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() PSA_ASSERT(psa_export_key(keys[i], exported, sizeof(exported), &exported_length)); - ASSERT_COMPARE(exported, exported_length, + TEST_BUFFERS_EQUAL(exported, exported_length, (uint8_t *) &i, sizeof(i)); PSA_ASSERT(psa_destroy_key(keys[i])); } @@ -1028,7 +1028,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() PSA_ASSERT(psa_export_key(persistent_key, exported, sizeof(exported), &exported_length)); - ASSERT_COMPARE(exported, exported_length, + TEST_BUFFERS_EQUAL(exported, exported_length, (uint8_t *) &persistent_key, sizeof(persistent_key)); exit: /* diff --git a/tests/suites/test_suite_psa_crypto_storage_format.function b/tests/suites/test_suite_psa_crypto_storage_format.function index ee66f7d734..403ac53ab8 100644 --- a/tests/suites/test_suite_psa_crypto_storage_format.function +++ b/tests/suites/test_suite_psa_crypto_storage_format.function @@ -39,7 +39,7 @@ static int test_written_key(const psa_key_attributes_t *attributes, ASSERT_ALLOC(actual_representation, storage_info.size); PSA_ASSERT(psa_its_get(uid, 0, storage_info.size, actual_representation, &length)); - ASSERT_COMPARE(expected_representation->x, expected_representation->len, + TEST_BUFFERS_EQUAL(expected_representation->x, expected_representation->len, actual_representation, length); ok = 1; @@ -272,7 +272,7 @@ static int test_read_key(const psa_key_attributes_t *expected_attributes, PSA_ASSERT(psa_export_key(key_id, exported_material, expected_material->len, &length)); - ASSERT_COMPARE(expected_material->x, expected_material->len, + TEST_BUFFERS_EQUAL(expected_material->x, expected_material->len, exported_material, length); } diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index 2f8b8f97ad..6a55bf5a2a 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -100,7 +100,7 @@ void set_get_remove(int uid_arg, int flags_arg, data_t *data) TEST_ASSERT(info.size == data->len); TEST_ASSERT(info.flags == flags); PSA_ASSERT(psa_its_get(uid, 0, data->len, buffer, &ret_len)); - ASSERT_COMPARE(data->x, data->len, buffer, ret_len); + TEST_BUFFERS_EQUAL(data->x, data->len, buffer, ret_len); PSA_ASSERT(psa_its_remove(uid)); @@ -129,7 +129,7 @@ void set_overwrite(int uid_arg, TEST_ASSERT(info.size == data1->len); TEST_ASSERT(info.flags == flags1); PSA_ASSERT(psa_its_get(uid, 0, data1->len, buffer, &ret_len)); - ASSERT_COMPARE(data1->x, data1->len, buffer, ret_len); + TEST_BUFFERS_EQUAL(data1->x, data1->len, buffer, ret_len); PSA_ASSERT(psa_its_set_wrap(uid, data2->len, data2->x, flags2)); PSA_ASSERT(psa_its_get_info(uid, &info)); @@ -137,7 +137,7 @@ void set_overwrite(int uid_arg, TEST_ASSERT(info.flags == flags2); ret_len = 0; PSA_ASSERT(psa_its_get(uid, 0, data2->len, buffer, &ret_len)); - ASSERT_COMPARE(data2->x, data2->len, buffer, ret_len); + TEST_BUFFERS_EQUAL(data2->x, data2->len, buffer, ret_len); PSA_ASSERT(psa_its_remove(uid)); @@ -167,7 +167,7 @@ void set_multiple(int first_id, int count) mbedtls_snprintf(stored, sizeof(stored), "Content of file 0x%08lx", (unsigned long) uid); PSA_ASSERT(psa_its_get(uid, 0, sizeof(stored), retrieved, &ret_len)); - ASSERT_COMPARE(retrieved, ret_len, + TEST_BUFFERS_EQUAL(retrieved, ret_len, stored, sizeof(stored)); PSA_ASSERT(psa_its_remove(uid)); TEST_ASSERT(psa_its_get(uid, 0, 0, NULL, NULL) == @@ -223,7 +223,7 @@ void get_at(int uid_arg, data_t *data, status = psa_its_get(uid, offset, length_arg, buffer, &ret_len); TEST_ASSERT(status == (psa_status_t) expected_status); if (status == PSA_SUCCESS) { - ASSERT_COMPARE(data->x + offset, (size_t) length_arg, + TEST_BUFFERS_EQUAL(data->x + offset, (size_t) length_arg, buffer, ret_len); } for (i = 0; i < 16; i++) { diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 6bcde710ba..621f626b01 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -1689,7 +1689,7 @@ void ssl_tls1_3_hkdf_expand_label(int hash_alg, ctx->x, ctx->len, dst, desired_length) == 0); - ASSERT_COMPARE(dst, (size_t) desired_length, + TEST_BUFFERS_EQUAL(dst, (size_t) desired_length, expected->x, (size_t) expected->len); } /* END_CASE */ @@ -1724,19 +1724,19 @@ void ssl_tls1_3_traffic_key_generation(int hash_alg, desired_key_len, desired_iv_len, &keys) == 0); - ASSERT_COMPARE(keys.client_write_key, + TEST_BUFFERS_EQUAL(keys.client_write_key, keys.key_len, expected_client_write_key->x, (size_t) desired_key_len); - ASSERT_COMPARE(keys.server_write_key, + TEST_BUFFERS_EQUAL(keys.server_write_key, keys.key_len, expected_server_write_key->x, (size_t) desired_key_len); - ASSERT_COMPARE(keys.client_write_iv, + TEST_BUFFERS_EQUAL(keys.client_write_iv, keys.iv_len, expected_client_write_iv->x, (size_t) desired_iv_len); - ASSERT_COMPARE(keys.server_write_iv, + TEST_BUFFERS_EQUAL(keys.server_write_iv, keys.iv_len, expected_server_write_iv->x, (size_t) desired_iv_len); @@ -1778,7 +1778,7 @@ void ssl_tls1_3_derive_secret(int hash_alg, already_hashed, dst, desired_length) == 0); - ASSERT_COMPARE(dst, desired_length, + TEST_BUFFERS_EQUAL(dst, desired_length, expected->x, desired_length); } /* END_CASE */ @@ -1797,7 +1797,7 @@ void ssl_tls1_3_key_evolution(int hash_alg, input->len ? input->x : NULL, input->len, secret_new) == 0); - ASSERT_COMPARE(secret_new, (size_t) expected->len, + TEST_BUFFERS_EQUAL(secret_new, (size_t) expected->len, expected->x, (size_t) expected->len); } /* END_CASE */ From 1357502bcac087ca2c136c6ad2d2e87f2303e931 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Mon, 4 Sep 2023 11:05:59 +0100 Subject: [PATCH 123/135] For tests, rename ASSERT_ALLOC() to TEST_CALLOC_OR_FAIL() Signed-off-by: Tom Cosgrove --- tests/include/test/macros.h | 24 ++--- tests/src/psa_exercise_key.c | 10 +- tests/src/test_helpers/ssl_helpers.c | 6 +- tests/suites/test_suite_aes.function | 16 +-- tests/suites/test_suite_asn1parse.function | 12 +-- tests/suites/test_suite_asn1write.function | 10 +- tests/suites/test_suite_bignum.function | 2 +- tests/suites/test_suite_cipher.function | 18 ++-- .../suites/test_suite_constant_time.function | 4 +- .../test_suite_constant_time_hmac.function | 4 +- tests/suites/test_suite_ecp.function | 2 +- tests/suites/test_suite_mps.function | 8 +- tests/suites/test_suite_pk.function | 2 +- tests/suites/test_suite_pkcs12.function | 2 +- tests/suites/test_suite_pkwrite.function | 4 +- .../test_suite_platform_printf.function | 8 +- tests/suites/test_suite_psa_crypto.function | 102 +++++++++--------- ..._suite_psa_crypto_driver_wrappers.function | 38 +++---- .../test_suite_psa_crypto_entropy.function | 6 +- .../test_suite_psa_crypto_init.function | 2 +- ...t_suite_psa_crypto_persistent_key.function | 6 +- ...st_suite_psa_crypto_se_driver_hal.function | 2 +- ..._suite_psa_crypto_slot_management.function | 10 +- ...t_suite_psa_crypto_storage_format.function | 4 +- tests/suites/test_suite_psa_its.function | 6 +- tests/suites/test_suite_random.function | 2 +- tests/suites/test_suite_ssl.function | 8 +- 27 files changed, 159 insertions(+), 159 deletions(-) diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h index 76b4668d18..5a7c2e4f30 100644 --- a/tests/include/test/macros.h +++ b/tests/include/test/macros.h @@ -143,22 +143,22 @@ * This expression may be evaluated multiple times. * */ -#define ASSERT_ALLOC(pointer, length) \ - do \ - { \ - TEST_ASSERT((pointer) == NULL); \ - if ((length) != 0) \ - { \ - (pointer) = mbedtls_calloc(sizeof(*(pointer)), \ +#define TEST_CALLOC_OR_FAIL(pointer, length) \ + do { \ + TEST_ASSERT((pointer) == NULL); \ + if ((length) != 0) { \ + (pointer) = mbedtls_calloc(sizeof(*(pointer)), \ (length)); \ - TEST_ASSERT((pointer) != NULL); \ - } \ - } \ - while (0) + TEST_ASSERT((pointer) != NULL); \ + } \ + } while (0) + +/* For backwards compatibility */ +#define ASSERT_ALLOC(pointer, length) TEST_CALLOC_OR_FAIL(pointer, length) /** Allocate memory dynamically. If the allocation fails, skip the test case. * - * This macro behaves like #ASSERT_ALLOC, except that if the allocation + * This macro behaves like #TEST_CALLOC_OR_FAIL, except that if the allocation * fails, it marks the test as skipped rather than failed. */ #define ASSERT_ALLOC_WEAK(pointer, length) \ diff --git a/tests/src/psa_exercise_key.c b/tests/src/psa_exercise_key.c index f8ed7846f2..ff43780bab 100644 --- a/tests/src/psa_exercise_key.c +++ b/tests/src/psa_exercise_key.c @@ -505,7 +505,7 @@ psa_status_t mbedtls_test_psa_key_agreement_with_self( key_bits = psa_get_key_bits(&attributes); public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(private_key_type); public_key_length = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_key_type, key_bits); - ASSERT_ALLOC(public_key, public_key_length); + TEST_CALLOC_OR_FAIL(public_key, public_key_length); PSA_ASSERT(psa_export_public_key(key, public_key, public_key_length, &public_key_length)); @@ -547,7 +547,7 @@ psa_status_t mbedtls_test_psa_raw_key_agreement_with_self( key_bits = psa_get_key_bits(&attributes); public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(private_key_type); public_key_length = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_key_type, key_bits); - ASSERT_ALLOC(public_key, public_key_length); + TEST_CALLOC_OR_FAIL(public_key, public_key_length); PSA_ASSERT(psa_export_public_key(key, public_key, public_key_length, &public_key_length)); @@ -807,7 +807,7 @@ static int exercise_export_key(mbedtls_svc_key_id_t key, exported_size = PSA_EXPORT_KEY_OUTPUT_SIZE( psa_get_key_type(&attributes), psa_get_key_bits(&attributes)); - ASSERT_ALLOC(exported, exported_size); + TEST_CALLOC_OR_FAIL(exported, exported_size); if ((usage & PSA_KEY_USAGE_EXPORT) == 0 && !PSA_KEY_TYPE_IS_PUBLIC_KEY(psa_get_key_type(&attributes))) { @@ -850,7 +850,7 @@ static int exercise_export_public_key(mbedtls_svc_key_id_t key) exported_size = PSA_EXPORT_KEY_OUTPUT_SIZE( psa_get_key_type(&attributes), psa_get_key_bits(&attributes)); - ASSERT_ALLOC(exported, exported_size); + TEST_CALLOC_OR_FAIL(exported, exported_size); TEST_EQUAL(psa_export_public_key(key, exported, exported_size, &exported_length), @@ -863,7 +863,7 @@ static int exercise_export_public_key(mbedtls_svc_key_id_t key) psa_get_key_type(&attributes)); exported_size = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_type, psa_get_key_bits(&attributes)); - ASSERT_ALLOC(exported, exported_size); + TEST_CALLOC_OR_FAIL(exported, exported_size); PSA_ASSERT(psa_export_public_key(key, exported, exported_size, diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c index bd1f46c968..e346ca0ceb 100644 --- a/tests/src/test_helpers/ssl_helpers.c +++ b/tests/src/test_helpers/ssl_helpers.c @@ -566,9 +566,9 @@ int mbedtls_test_ssl_endpoint_certificate_init(mbedtls_test_ssl_endpoint *ep, } cert = &(ep->cert); - ASSERT_ALLOC(cert->ca_cert, 1); - ASSERT_ALLOC(cert->cert, 1); - ASSERT_ALLOC(cert->pkey, 1); + TEST_CALLOC_OR_FAIL(cert->ca_cert, 1); + TEST_CALLOC_OR_FAIL(cert->cert, 1); + TEST_CALLOC_OR_FAIL(cert->pkey, 1); mbedtls_x509_crt_init(cert->ca_cert); mbedtls_x509_crt_init(cert->cert); diff --git a/tests/suites/test_suite_aes.function b/tests/suites/test_suite_aes.function index c88f4c34d6..36859bd0cf 100644 --- a/tests/suites/test_suite_aes.function +++ b/tests/suites/test_suite_aes.function @@ -688,8 +688,8 @@ void aes_ecb_context_alignment(data_t *key) struct align1 *dec1 = NULL; /* All peak alignment */ - ASSERT_ALLOC(enc0, 1); - ASSERT_ALLOC(dec0, 1); + TEST_CALLOC_OR_FAIL(enc0, 1); + TEST_CALLOC_OR_FAIL(dec0, 1); if (!test_ctx_alignment(key, &enc0->ctx, &dec0->ctx)) { goto exit; } @@ -699,8 +699,8 @@ void aes_ecb_context_alignment(data_t *key) dec0 = NULL; /* Enc aligned, dec not */ - ASSERT_ALLOC(enc0, 1); - ASSERT_ALLOC(dec1, 1); + TEST_CALLOC_OR_FAIL(enc0, 1); + TEST_CALLOC_OR_FAIL(dec1, 1); if (!test_ctx_alignment(key, &enc0->ctx, &dec1->ctx)) { goto exit; } @@ -710,8 +710,8 @@ void aes_ecb_context_alignment(data_t *key) dec1 = NULL; /* Dec aligned, enc not */ - ASSERT_ALLOC(enc1, 1); - ASSERT_ALLOC(dec0, 1); + TEST_CALLOC_OR_FAIL(enc1, 1); + TEST_CALLOC_OR_FAIL(dec0, 1); if (!test_ctx_alignment(key, &enc1->ctx, &dec0->ctx)) { goto exit; } @@ -721,8 +721,8 @@ void aes_ecb_context_alignment(data_t *key) dec0 = NULL; /* Both shifted */ - ASSERT_ALLOC(enc1, 1); - ASSERT_ALLOC(dec1, 1); + TEST_CALLOC_OR_FAIL(enc1, 1); + TEST_CALLOC_OR_FAIL(dec1, 1); if (!test_ctx_alignment(key, &enc1->ctx, &dec1->ctx)) { goto exit; } diff --git a/tests/suites/test_suite_asn1parse.function b/tests/suites/test_suite_asn1parse.function index 7c546c10f9..1a163024a4 100644 --- a/tests/suites/test_suite_asn1parse.function +++ b/tests/suites/test_suite_asn1parse.function @@ -135,7 +135,7 @@ int get_len_step(const data_t *input, size_t buffer_size, /* Allocate a new buffer of exactly the length to parse each time. * This gives memory sanitizers a chance to catch buffer overreads. */ if (buffer_size == 0) { - ASSERT_ALLOC(buf, 1); + TEST_CALLOC_OR_FAIL(buf, 1); end = buf + 1; p = end; } else { @@ -247,7 +247,7 @@ void parse_prefixes(const data_t *input, mbedtls_test_set_step(buffer_size); /* Allocate a new buffer of exactly the length to parse each time. * This gives memory sanitizers a chance to catch buffer overreads. */ - ASSERT_ALLOC(buf, buffer_size); + TEST_CALLOC_OR_FAIL(buf, buffer_size); memcpy(buf, input->x, buffer_size); p = buf; ret = nested_parse(&p, buf + buffer_size); @@ -506,7 +506,7 @@ void get_mpi_too_large() mbedtls_mpi_init(&actual_mpi); - ASSERT_ALLOC(buf, size); + TEST_CALLOC_OR_FAIL(buf, size); buf[0] = 0x02; /* tag: INTEGER */ buf[1] = 0x84; /* 4-octet length */ buf[2] = (too_many_octets >> 24) & 0xff; @@ -729,10 +729,10 @@ void free_named_data(int with_oid, int with_val, int with_next) { { 0x06, 0, NULL }, { 0, 0, NULL }, NULL, 0 }; if (with_oid) { - ASSERT_ALLOC(head.oid.p, 1); + TEST_CALLOC_OR_FAIL(head.oid.p, 1); } if (with_val) { - ASSERT_ALLOC(head.val.p, 1); + TEST_CALLOC_OR_FAIL(head.val.p, 1); } if (with_next) { head.next = &next; @@ -758,7 +758,7 @@ void free_named_data_list(int length) for (i = 0; i < length; i++) { mbedtls_asn1_named_data *new = NULL; - ASSERT_ALLOC(new, 1); + TEST_CALLOC_OR_FAIL(new, 1); new->next = head; head = new; } diff --git a/tests/suites/test_suite_asn1write.function b/tests/suites/test_suite_asn1write.function index 478067c6de..6ddd285af9 100644 --- a/tests/suites/test_suite_asn1write.function +++ b/tests/suites/test_suite_asn1write.function @@ -17,7 +17,7 @@ int generic_write_start_step(generic_write_data_t *data) mbedtls_test_set_step(data->size); mbedtls_free(data->output); data->output = NULL; - ASSERT_ALLOC(data->output, data->size == 0 ? 1 : data->size); + TEST_CALLOC_OR_FAIL(data->output, data->size == 0 ? 1 : data->size); data->end = data->output + data->size; data->p = data->end; data->start = data->end - data->size; @@ -296,7 +296,7 @@ void mbedtls_asn1_write_algorithm_identifier(data_t *oid, size_t len_complete = data_len + par_len; unsigned char expected_params_tag; size_t expected_params_len; - ASSERT_ALLOC(buf_complete, len_complete); + TEST_CALLOC_OR_FAIL(buf_complete, len_complete); unsigned char *end_complete = buf_complete + len_complete; memcpy(buf_complete, data.p, data_len); if (par_len == 0) { @@ -404,7 +404,7 @@ void test_asn1_write_bitstrings(data_t *bitstring, int bits, TEST_ASSERT(bitstring->len >= byte_length); #if defined(MBEDTLS_ASN1_PARSE_C) - ASSERT_ALLOC(masked_bitstring, byte_length); + TEST_CALLOC_OR_FAIL(masked_bitstring, byte_length); if (byte_length != 0) { memcpy(masked_bitstring, bitstring->x, byte_length); if (bits % 8 != 0) { @@ -477,7 +477,7 @@ void store_named_data_find(data_t *oid0, data_t *oid1, } pointers[ARRAY_LENGTH(nd)] = NULL; for (i = 0; i < ARRAY_LENGTH(nd); i++) { - ASSERT_ALLOC(nd[i].oid.p, oid[i]->len); + TEST_CALLOC_OR_FAIL(nd[i].oid.p, oid[i]->len); memcpy(nd[i].oid.p, oid[i]->x, oid[i]->len); nd[i].oid.len = oid[i]->len; nd[i].next = pointers[i+1]; @@ -529,7 +529,7 @@ void store_named_data_val_found(int old_len, int new_len) unsigned char *new_val = (unsigned char *) "new value"; if (old_len != 0) { - ASSERT_ALLOC(nd.val.p, (size_t) old_len); + TEST_CALLOC_OR_FAIL(nd.val.p, (size_t) old_len); old_val = nd.val.p; nd.val.len = old_len; memset(old_val, 'x', old_len); diff --git a/tests/suites/test_suite_bignum.function b/tests/suites/test_suite_bignum.function index e088a733ac..db9c2e75e5 100644 --- a/tests/suites/test_suite_bignum.function +++ b/tests/suites/test_suite_bignum.function @@ -1507,7 +1507,7 @@ void mpi_random_many(int min, data_t *bound_bytes, int iterations) full_stats = 0; stats_len = n_bits; } - ASSERT_ALLOC(stats, stats_len); + TEST_CALLOC_OR_FAIL(stats, stats_len); for (i = 0; i < (size_t) iterations; i++) { mbedtls_test_set_step(i); diff --git a/tests/suites/test_suite_cipher.function b/tests/suites/test_suite_cipher.function index 3c2bd26b9a..bf7f421a5f 100644 --- a/tests/suites/test_suite_cipher.function +++ b/tests/suites/test_suite_cipher.function @@ -1229,7 +1229,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, * (we need the tag appended to the ciphertext) */ cipher_plus_tag_len = cipher->len + tag->len; - ASSERT_ALLOC(cipher_plus_tag, cipher_plus_tag_len); + TEST_CALLOC_OR_FAIL(cipher_plus_tag, cipher_plus_tag_len); memcpy(cipher_plus_tag, cipher->x, cipher->len); memcpy(cipher_plus_tag + cipher->len, tag->x, tag->len); @@ -1247,7 +1247,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, * Try decrypting to a buffer that's 1B too small */ if (decrypt_buf_len != 0) { - ASSERT_ALLOC(decrypt_buf, decrypt_buf_len - 1); + TEST_CALLOC_OR_FAIL(decrypt_buf, decrypt_buf_len - 1); outlen = 0; ret = mbedtls_cipher_auth_decrypt_ext(&ctx, iv->x, iv->len, @@ -1262,7 +1262,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, /* * Authenticate and decrypt, and check result */ - ASSERT_ALLOC(decrypt_buf, decrypt_buf_len); + TEST_CALLOC_OR_FAIL(decrypt_buf, decrypt_buf_len); outlen = 0; ret = mbedtls_cipher_auth_decrypt_ext(&ctx, iv->x, iv->len, @@ -1306,7 +1306,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, /* * Try encrypting with an output buffer that's 1B too small */ - ASSERT_ALLOC(encrypt_buf, encrypt_buf_len - 1); + TEST_CALLOC_OR_FAIL(encrypt_buf, encrypt_buf_len - 1); outlen = 0; ret = mbedtls_cipher_auth_encrypt_ext(&ctx, iv->x, iv->len, @@ -1320,7 +1320,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, /* * Encrypt and check the result */ - ASSERT_ALLOC(encrypt_buf, encrypt_buf_len); + TEST_CALLOC_OR_FAIL(encrypt_buf, encrypt_buf_len); outlen = 0; ret = mbedtls_cipher_auth_encrypt_ext(&ctx, iv->x, iv->len, @@ -1374,7 +1374,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, * Authenticate and decrypt, and check result */ - ASSERT_ALLOC(decrypt_buf, cipher->len); + TEST_CALLOC_OR_FAIL(decrypt_buf, cipher->len); outlen = 0; ret = mbedtls_cipher_auth_decrypt(&ctx, iv->x, iv->len, ad->x, ad->len, tmp_cipher, cipher->len, decrypt_buf, &outlen, @@ -1411,14 +1411,14 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, /* prepare buffers for encryption */ #if defined(MBEDTLS_USE_PSA_CRYPTO) if (use_psa) { - ASSERT_ALLOC(cipher_plus_tag, cipher->len + tag->len); + TEST_CALLOC_OR_FAIL(cipher_plus_tag, cipher->len + tag->len); tmp_cipher = cipher_plus_tag; tmp_tag = cipher_plus_tag + cipher->len; } else #endif /* MBEDTLS_USE_PSA_CRYPTO */ { - ASSERT_ALLOC(encrypt_buf, cipher->len); - ASSERT_ALLOC(tag_buf, tag->len); + TEST_CALLOC_OR_FAIL(encrypt_buf, cipher->len); + TEST_CALLOC_OR_FAIL(tag_buf, tag->len); tmp_cipher = encrypt_buf; tmp_tag = tag_buf; } diff --git a/tests/suites/test_suite_constant_time.function b/tests/suites/test_suite_constant_time.function index 03c5a67c6a..d67e46bec8 100644 --- a/tests/suites/test_suite_constant_time.function +++ b/tests/suites/test_suite_constant_time.function @@ -23,8 +23,8 @@ void ssl_cf_memcpy_offset(int offset_min, int offset_max, int len) size_t src_len = offset_max + len; size_t secret; - ASSERT_ALLOC(dst, len); - ASSERT_ALLOC(src, src_len); + TEST_CALLOC_OR_FAIL(dst, len); + TEST_CALLOC_OR_FAIL(src, src_len); /* Fill src in a way that we can detect if we copied the right bytes */ mbedtls_test_rnd_std_rand(NULL, src, src_len); diff --git a/tests/suites/test_suite_constant_time_hmac.function b/tests/suites/test_suite_constant_time_hmac.function index 394f8cae97..2ca1047d6a 100644 --- a/tests/suites/test_suite_constant_time_hmac.function +++ b/tests/suites/test_suite_constant_time_hmac.function @@ -35,7 +35,7 @@ void ssl_cf_hmac(int hash) block_size = hash == MBEDTLS_MD_SHA384 ? 128 : 64; /* Use allocated out buffer to catch overwrites */ - ASSERT_ALLOC(out, out_len); + TEST_CALLOC_OR_FAIL(out, out_len); /* Set up contexts with the given hash and a dummy key */ TEST_EQUAL(0, mbedtls_md_setup(&ctx, md_info, 1)); @@ -54,7 +54,7 @@ void ssl_cf_hmac(int hash) mbedtls_test_set_step(max_in_len * 10000); /* Use allocated in buffer to catch overreads */ - ASSERT_ALLOC(data, max_in_len); + TEST_CALLOC_OR_FAIL(data, max_in_len); min_in_len = max_in_len > 255 ? max_in_len - 255 : 0; for (in_len = min_in_len; in_len <= max_in_len; in_len++) { diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function index 391761706c..e12873b8e9 100644 --- a/tests/suites/test_suite_ecp.function +++ b/tests/suites/test_suite_ecp.function @@ -1426,7 +1426,7 @@ void genkey_mx_known_answer(int bits, data_t *seed, data_t *expected) rnd_info.fallback_f_rng = NULL; rnd_info.fallback_p_rng = NULL; - ASSERT_ALLOC(actual, expected->len); + TEST_CALLOC_OR_FAIL(actual, expected->len); ret = mbedtls_ecp_gen_privkey_mx(bits, &d, mbedtls_test_rnd_buffer_rand, &rnd_info); diff --git a/tests/suites/test_suite_mps.function b/tests/suites/test_suite_mps.function index 06d8ec2548..c04a651d5e 100644 --- a/tests/suites/test_suite_mps.function +++ b/tests/suites/test_suite_mps.function @@ -844,15 +844,15 @@ void mbedtls_mps_reader_random_usage(int num_out_chunks, mbedtls_mps_reader rd; if (acc_size > 0) { - ASSERT_ALLOC(acc, acc_size); + TEST_CALLOC_OR_FAIL(acc, acc_size); } /* This probably needs to be changed because we want * our tests to be deterministic. */ // srand( time( NULL ) ); - ASSERT_ALLOC(outgoing, num_out_chunks * max_chunk_size); - ASSERT_ALLOC(incoming, num_out_chunks * max_chunk_size); + TEST_CALLOC_OR_FAIL(outgoing, num_out_chunks * max_chunk_size); + TEST_CALLOC_OR_FAIL(incoming, num_out_chunks * max_chunk_size); mbedtls_mps_reader_init(&rd, acc, acc_size); @@ -884,7 +884,7 @@ void mbedtls_mps_reader_random_usage(int num_out_chunks, } tmp_size = (rand() % max_chunk_size) + 1; - ASSERT_ALLOC(tmp, tmp_size); + TEST_CALLOC_OR_FAIL(tmp, tmp_size); TEST_ASSERT(mbedtls_test_rnd_std_rand(NULL, tmp, tmp_size) == 0); ret = mbedtls_mps_reader_feed(&rd, tmp, tmp_size); diff --git a/tests/suites/test_suite_pk.function b/tests/suites/test_suite_pk.function index da79062028..90647d5b73 100644 --- a/tests/suites/test_suite_pk.function +++ b/tests/suites/test_suite_pk.function @@ -915,7 +915,7 @@ void pk_sign_verify(int type, int parameter, int sign_ret, int verify_ret) #endif hash_len = mbedtls_md_get_size(mbedtls_md_info_from_type(md)); - ASSERT_ALLOC(hash, hash_len); + TEST_CALLOC_OR_FAIL(hash, hash_len); mbedtls_pk_init(&pk); USE_PSA_INIT(); diff --git a/tests/suites/test_suite_pkcs12.function b/tests/suites/test_suite_pkcs12.function index e125532020..c4df8ab739 100644 --- a/tests/suites/test_suite_pkcs12.function +++ b/tests/suites/test_suite_pkcs12.function @@ -42,7 +42,7 @@ void pkcs12_derive_key(int md_type, int key_size_arg, salt_len = salt_arg->len; - ASSERT_ALLOC(output_data, key_size); + TEST_CALLOC_OR_FAIL(output_data, key_size); int ret = mbedtls_pkcs12_derivation(output_data, key_size, diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function index 8c77150de9..764c55c0d0 100644 --- a/tests/suites/test_suite_pkwrite.function +++ b/tests/suites/test_suite_pkwrite.function @@ -58,7 +58,7 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der) } TEST_ASSERT(check_buf_len > 0); - ASSERT_ALLOC(buf, check_buf_len); + TEST_CALLOC_OR_FAIL(buf, check_buf_len); if (is_public_key) { TEST_EQUAL(mbedtls_pk_parse_public_keyfile(&key, key_file), 0); @@ -145,7 +145,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) &pub_key_len), 0); derived_key_len = pub_key_len; - ASSERT_ALLOC(derived_key_raw, derived_key_len); + TEST_CALLOC_OR_FAIL(derived_key_raw, derived_key_len); TEST_EQUAL(mbedtls_pk_write_pubkey_der(&priv_key, derived_key_raw, derived_key_len), pub_key_len); diff --git a/tests/suites/test_suite_platform_printf.function b/tests/suites/test_suite_platform_printf.function index e687eb1b7c..14fa604364 100644 --- a/tests/suites/test_suite_platform_printf.function +++ b/tests/suites/test_suite_platform_printf.function @@ -32,7 +32,7 @@ void printf_int(char *format, /* any format expecting one int argument, e.g. "%d const size_t n = strlen(result); /* Nominal case: buffer just large enough */ - ASSERT_ALLOC(output, n + 1); + TEST_CALLOC_OR_FAIL(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, x)); TEST_BUFFERS_EQUAL(result, n + 1, output, n + 1); mbedtls_free(output); @@ -53,11 +53,11 @@ void printf_long_max(const char *format, /* "%lx" or longer type */ const size_t n = sizeof(value) * 2; /* We assume that long has no padding bits! */ - ASSERT_ALLOC(expected, n + 1); + TEST_CALLOC_OR_FAIL(expected, n + 1); expected[0] = '7'; memset(expected + 1, 'f', sizeof(value) * 2 - 1); - ASSERT_ALLOC(output, n + 1); + TEST_CALLOC_OR_FAIL(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, value)); TEST_BUFFERS_EQUAL(expected, n + 1, output, n + 1); mbedtls_free(output); @@ -77,7 +77,7 @@ void printf_char2(char *format, /* "%c%c" */ const size_t n = strlen(result); /* Nominal case: buffer just large enough */ - ASSERT_ALLOC(output, n + 1); + TEST_CALLOC_OR_FAIL(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, arg1, arg2)); TEST_BUFFERS_EQUAL(result, n + 1, output, n + 1); mbedtls_free(output); diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index daeadca42b..4dda1d7679 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -533,7 +533,7 @@ void import_rsa_made_up(int bits_arg, int keypair, int expected_status_arg) psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; PSA_ASSERT(psa_crypto_init()); - ASSERT_ALLOC(buffer, buffer_size); + TEST_CALLOC_OR_FAIL(buffer, buffer_size); TEST_ASSERT((ret = construct_fake_rsa_key(buffer, buffer_size, &p, bits, keypair)) >= 0); @@ -578,9 +578,9 @@ void import_export(data_t *data, psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT; export_size = (ptrdiff_t) data->len + export_size_delta; - ASSERT_ALLOC(exported, export_size); + TEST_CALLOC_OR_FAIL(exported, export_size); if (!canonical_input) { - ASSERT_ALLOC(reexported, export_size); + TEST_CALLOC_OR_FAIL(reexported, export_size); } PSA_ASSERT(psa_crypto_init()); @@ -687,7 +687,7 @@ void import_export_public_key(data_t *data, PSA_ASSERT(psa_import_key(&attributes, data->x, data->len, &key)); /* Export the public key */ - ASSERT_ALLOC(exported, export_size); + TEST_CALLOC_OR_FAIL(exported, export_size); status = psa_export_public_key(key, exported, export_size, &exported_length); @@ -1081,7 +1081,7 @@ void asymmetric_encryption_key_policy(int policy_usage_arg, key_bits = psa_get_key_bits(&attributes); buffer_length = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, exercise_alg); - ASSERT_ALLOC(buffer, buffer_length); + TEST_CALLOC_OR_FAIL(buffer, buffer_length); status = psa_asymmetric_encrypt(key, exercise_alg, NULL, 0, @@ -1446,7 +1446,7 @@ void copy_success(int source_usage_arg, psa_get_key_enrollment_algorithm(&target_attributes)); if (expected_usage & PSA_KEY_USAGE_EXPORT) { size_t length; - ASSERT_ALLOC(export_buffer, material->len); + TEST_CALLOC_OR_FAIL(export_buffer, material->len); PSA_ASSERT(psa_export_key(target_key, export_buffer, material->len, &length)); TEST_BUFFERS_EQUAL(material->x, material->len, @@ -1599,7 +1599,7 @@ void hash_compute_fail(int alg_arg, data_t *input, psa_status_t expected_status = expected_status_arg; psa_status_t status; - ASSERT_ALLOC(output, output_size); + TEST_CALLOC_OR_FAIL(output, output_size); PSA_ASSERT(psa_crypto_init()); @@ -2187,7 +2187,7 @@ void mac_sign(int key_type_arg, PSA_ERROR_BUFFER_TOO_SMALL); mbedtls_test_set_step(output_size); - ASSERT_ALLOC(actual_mac, output_size); + TEST_CALLOC_OR_FAIL(actual_mac, output_size); /* Calculate the MAC, one-shot case. */ TEST_EQUAL(psa_mac_compute(key, alg, @@ -2283,7 +2283,7 @@ void mac_verify(int key_type_arg, PSA_ERROR_INVALID_SIGNATURE); /* Test a MAC that's too long, one-shot case. */ - ASSERT_ALLOC(perturbed_mac, expected_mac->len + 1); + TEST_CALLOC_OR_FAIL(perturbed_mac, expected_mac->len + 1); memcpy(perturbed_mac, expected_mac->x, expected_mac->len); TEST_EQUAL(psa_mac_verify(key, alg, input->x, input->len, @@ -2608,7 +2608,7 @@ void cipher_encrypt_fail(int alg_arg, output_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -2662,7 +2662,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, &key)); output_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, plaintext->len); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); /* set_iv() is not allowed */ PSA_ASSERT(psa_cipher_encrypt_setup(&operation, key, alg)); @@ -2811,8 +2811,8 @@ void cipher_encrypt_validation(int alg_arg, output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); output2_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) + PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg); - ASSERT_ALLOC(output1, output1_buffer_size); - ASSERT_ALLOC(output2, output2_buffer_size); + TEST_CALLOC_OR_FAIL(output1, output1_buffer_size); + TEST_CALLOC_OR_FAIL(output2, output2_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -2903,7 +2903,7 @@ void cipher_encrypt_multipart(int alg_arg, int key_type_arg, output_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) + PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); TEST_LE_U(first_part_size, input->len); PSA_ASSERT(psa_cipher_update(&operation, input->x, first_part_size, @@ -3002,7 +3002,7 @@ void cipher_decrypt_multipart(int alg_arg, int key_type_arg, output_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) + PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); TEST_LE_U(first_part_size, input->len); PSA_ASSERT(psa_cipher_update(&operation, @@ -3095,13 +3095,13 @@ void cipher_decrypt_fail(int alg_arg, /* Allocate input buffer and copy the iv and the plaintext */ input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len); if (input_buffer_size > 0) { - ASSERT_ALLOC(input, input_buffer_size); + TEST_CALLOC_OR_FAIL(input, input_buffer_size); memcpy(input, iv->x, iv->len); memcpy(input + iv->len, input_arg->x, input_arg->len); } output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); status = psa_cipher_decrypt(key, alg, input, input_buffer_size, output, output_buffer_size, &output_length); @@ -3142,13 +3142,13 @@ void cipher_decrypt(int alg_arg, /* Allocate input buffer and copy the iv and the plaintext */ input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len); if (input_buffer_size > 0) { - ASSERT_ALLOC(input, input_buffer_size); + TEST_CALLOC_OR_FAIL(input, input_buffer_size); memcpy(input, iv->x, iv->len); memcpy(input + iv->len, input_arg->x, input_arg->len); } output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -3196,7 +3196,7 @@ void cipher_verify_output(int alg_arg, PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); output1_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); - ASSERT_ALLOC(output1, output1_size); + TEST_CALLOC_OR_FAIL(output1, output1_size); PSA_ASSERT(psa_cipher_encrypt(key, alg, input->x, input->len, output1, output1_size, @@ -3207,7 +3207,7 @@ void cipher_verify_output(int alg_arg, PSA_CIPHER_ENCRYPT_OUTPUT_MAX_SIZE(input->len)); output2_size = output1_length; - ASSERT_ALLOC(output2, output2_size); + TEST_CALLOC_OR_FAIL(output2, output2_size); PSA_ASSERT(psa_cipher_decrypt(key, alg, output1, output1_length, output2, output2_size, @@ -3273,7 +3273,7 @@ void cipher_verify_output_multipart(int alg_arg, output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); TEST_LE_U(output1_buffer_size, PSA_CIPHER_ENCRYPT_OUTPUT_MAX_SIZE(input->len)); - ASSERT_ALLOC(output1, output1_buffer_size); + TEST_CALLOC_OR_FAIL(output1, output1_buffer_size); TEST_LE_U(first_part_size, input->len); @@ -3316,7 +3316,7 @@ void cipher_verify_output_multipart(int alg_arg, PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, output1_length)); TEST_LE_U(output2_buffer_size, PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(output1_length)); - ASSERT_ALLOC(output2, output2_buffer_size); + TEST_CALLOC_OR_FAIL(output2, output2_buffer_size); if (iv_length > 0) { PSA_ASSERT(psa_cipher_set_iv(&operation2, @@ -3412,7 +3412,7 @@ void aead_encrypt_decrypt(int key_type_arg, data_t *key_data, TEST_ASSERT(output_size <= PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len)); } - ASSERT_ALLOC(output_data, output_size); + TEST_CALLOC_OR_FAIL(output_data, output_size); status = psa_aead_encrypt(key, alg, nonce->x, nonce->len, @@ -3433,7 +3433,7 @@ void aead_encrypt_decrypt(int key_type_arg, data_t *key_data, TEST_EQUAL(status, expected_result); if (PSA_SUCCESS == expected_result) { - ASSERT_ALLOC(output_data2, output_length); + TEST_CALLOC_OR_FAIL(output_data2, output_length); /* For all currently defined algorithms, PSA_AEAD_DECRYPT_OUTPUT_SIZE * should be exact. */ @@ -3501,7 +3501,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, PSA_AEAD_ENCRYPT_OUTPUT_SIZE(key_type, alg, input_data->len)); TEST_ASSERT(output_size <= PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len)); - ASSERT_ALLOC(output_data, output_size); + TEST_CALLOC_OR_FAIL(output_data, output_size); status = psa_aead_encrypt(key, alg, nonce->x, nonce->len, @@ -3571,7 +3571,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, TEST_ASSERT(output_size <= PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(input_data->len)); } - ASSERT_ALLOC(output_data, output_size); + TEST_CALLOC_OR_FAIL(output_data, output_size); status = psa_aead_decrypt(key, alg, nonce->x, nonce->len, @@ -3655,7 +3655,7 @@ void sign_hash_deterministic(int key_type_arg, data_t *key_data, key_bits, alg); TEST_ASSERT(signature_size != 0); TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE); - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); /* Perform the signature. */ PSA_ASSERT(psa_sign_hash(key, alg, @@ -3705,7 +3705,7 @@ void sign_hash_fail(int key_type_arg, data_t *key_data, size_t signature_length = 0xdeadbeef; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); PSA_ASSERT(psa_crypto_init()); @@ -3775,7 +3775,7 @@ void sign_verify_hash(int key_type_arg, data_t *key_data, key_bits, alg); TEST_ASSERT(signature_size != 0); TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE); - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); /* Perform the signature. */ PSA_ASSERT(psa_sign_hash(key, alg, @@ -3926,7 +3926,7 @@ void sign_message_deterministic(int key_type_arg, signature_size = PSA_SIGN_OUTPUT_SIZE(key_type, key_bits, alg); TEST_ASSERT(signature_size != 0); TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE); - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); PSA_ASSERT(psa_sign_message(key, alg, input_data->x, input_data->len, @@ -3964,7 +3964,7 @@ void sign_message_fail(int key_type_arg, size_t signature_length = 0xdeadbeef; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); PSA_ASSERT(psa_crypto_init()); @@ -4024,7 +4024,7 @@ void sign_verify_message(int key_type_arg, signature_size = PSA_SIGN_OUTPUT_SIZE(key_type, key_bits, alg); TEST_ASSERT(signature_size != 0); TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE); - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); PSA_ASSERT(psa_sign_message(key, alg, input_data->x, input_data->len, @@ -4164,7 +4164,7 @@ void asymmetric_encrypt(int key_type_arg, output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg); TEST_LE_U(output_size, PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE); - ASSERT_ALLOC(output, output_size); + TEST_CALLOC_OR_FAIL(output, output_size); /* Encrypt the input */ actual_status = psa_asymmetric_encrypt(key, alg, @@ -4246,13 +4246,13 @@ void asymmetric_encrypt_decrypt(int key_type_arg, output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg); TEST_LE_U(output_size, PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE); - ASSERT_ALLOC(output, output_size); + TEST_CALLOC_OR_FAIL(output, output_size); output2_size = input_data->len; TEST_LE_U(output2_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg)); TEST_LE_U(output2_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE); - ASSERT_ALLOC(output2, output2_size); + TEST_CALLOC_OR_FAIL(output2, output2_size); /* We test encryption by checking that encrypt-then-decrypt gives back * the original plaintext because of the non-optional random @@ -4320,7 +4320,7 @@ void asymmetric_decrypt(int key_type_arg, /* Determine the maximum ciphertext length */ output_size = PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg); TEST_LE_U(output_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE); - ASSERT_ALLOC(output, output_size); + TEST_CALLOC_OR_FAIL(output, output_size); PSA_ASSERT(psa_asymmetric_decrypt(key, alg, input_data->x, input_data->len, @@ -4375,7 +4375,7 @@ void asymmetric_decrypt_fail(int key_type_arg, psa_status_t expected_status = expected_status_arg; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - ASSERT_ALLOC(output, output_size); + TEST_CALLOC_OR_FAIL(output, output_size); PSA_ASSERT(psa_crypto_init()); @@ -4694,7 +4694,7 @@ void derive_output(int alg_arg, expected_outputs[i] = NULL; } } - ASSERT_ALLOC(output_buffer, output_buffer_size); + TEST_CALLOC_OR_FAIL(output_buffer, output_buffer_size); PSA_ASSERT(psa_crypto_init()); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE); @@ -4931,8 +4931,8 @@ void derive_key_export(int alg_arg, psa_key_attributes_t derived_attributes = PSA_KEY_ATTRIBUTES_INIT; size_t length; - ASSERT_ALLOC(output_buffer, capacity); - ASSERT_ALLOC(export_buffer, capacity); + TEST_CALLOC_OR_FAIL(output_buffer, capacity); + TEST_CALLOC_OR_FAIL(export_buffer, capacity); PSA_ASSERT(psa_crypto_init()); psa_set_key_usage_flags(&base_attributes, PSA_KEY_USAGE_DERIVE); @@ -5128,7 +5128,7 @@ void raw_key_agreement(int alg_arg, PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE); /* Good case with exact output size */ - ASSERT_ALLOC(output, expected_output->len); + TEST_CALLOC_OR_FAIL(output, expected_output->len); PSA_ASSERT(psa_raw_key_agreement(alg, our_key, peer_key_data->x, peer_key_data->len, output, expected_output->len, @@ -5140,7 +5140,7 @@ void raw_key_agreement(int alg_arg, output_length = ~0; /* Larger buffer */ - ASSERT_ALLOC(output, expected_output->len + 1); + TEST_CALLOC_OR_FAIL(output, expected_output->len + 1); PSA_ASSERT(psa_raw_key_agreement(alg, our_key, peer_key_data->x, peer_key_data->len, output, expected_output->len + 1, @@ -5152,7 +5152,7 @@ void raw_key_agreement(int alg_arg, output_length = ~0; /* Buffer too small */ - ASSERT_ALLOC(output, expected_output->len - 1); + TEST_CALLOC_OR_FAIL(output, expected_output->len - 1); TEST_EQUAL(psa_raw_key_agreement(alg, our_key, peer_key_data->x, peer_key_data->len, output, expected_output->len - 1, @@ -5241,7 +5241,7 @@ void key_agreement_output(int alg_arg, psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; uint8_t *actual_output = NULL; - ASSERT_ALLOC(actual_output, MAX(expected_output1->len, + TEST_CALLOC_OR_FAIL(actual_output, MAX(expected_output1->len, expected_output2->len)); PSA_ASSERT(psa_crypto_init()); @@ -5297,8 +5297,8 @@ void generate_random(int bytes_arg) TEST_ASSERT(bytes_arg >= 0); - ASSERT_ALLOC(output, bytes); - ASSERT_ALLOC(changed, bytes); + TEST_CALLOC_OR_FAIL(output, bytes); + TEST_CALLOC_OR_FAIL(changed, bytes); PSA_ASSERT(psa_crypto_init()); @@ -5416,8 +5416,8 @@ void generate_key_rsa(int bits_arg, is_default_public_exponent = 1; e_read_size = 0; } - ASSERT_ALLOC(e_read_buffer, e_read_size); - ASSERT_ALLOC(exported, exported_size); + TEST_CALLOC_OR_FAIL(e_read_buffer, e_read_size); + TEST_CALLOC_OR_FAIL(exported, exported_size); PSA_ASSERT(psa_crypto_init()); @@ -5519,8 +5519,8 @@ void persistent_key_load_key_from_storage(data_t *data, size_t second_exported_length; if (usage_flags & PSA_KEY_USAGE_EXPORT) { - ASSERT_ALLOC(first_export, export_size); - ASSERT_ALLOC(second_export, export_size); + TEST_CALLOC_OR_FAIL(first_export, export_size); + TEST_CALLOC_OR_FAIL(second_export, export_size); } PSA_ASSERT(psa_crypto_init()); diff --git a/tests/suites/test_suite_psa_crypto_driver_wrappers.function b/tests/suites/test_suite_psa_crypto_driver_wrappers.function index 28afbb75fa..f7c5c3354b 100644 --- a/tests/suites/test_suite_psa_crypto_driver_wrappers.function +++ b/tests/suites/test_suite_psa_crypto_driver_wrappers.function @@ -56,7 +56,7 @@ void sign_hash(int key_type_arg, TEST_ASSERT(signature_size != 0); TEST_ASSERT(signature_size <= PSA_SIGNATURE_MAX_SIZE); - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); actual_status = psa_sign_hash(key, alg, data_input->x, data_input->len, @@ -183,7 +183,7 @@ void sign_message(int key_type_arg, TEST_ASSERT(signature_size != 0); TEST_ASSERT(signature_size <= PSA_SIGNATURE_MAX_SIZE); - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); actual_status = psa_sign_message(key, alg, data_input->x, data_input->len, @@ -487,8 +487,8 @@ void cipher_encrypt_validation(int alg_arg, output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); output2_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) + PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg); - ASSERT_ALLOC(output1, output1_buffer_size); - ASSERT_ALLOC(output2, output2_buffer_size); + TEST_CALLOC_OR_FAIL(output1, output1_buffer_size); + TEST_CALLOC_OR_FAIL(output2, output2_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -605,7 +605,7 @@ void cipher_encrypt_multipart(int alg_arg, output_buffer_size = ((size_t) input->len + PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type)); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); if (mock_output_arg) { mbedtls_test_driver_cipher_hooks.forced_output = expected_output->x; @@ -733,7 +733,7 @@ void cipher_decrypt_multipart(int alg_arg, output_buffer_size = ((size_t) input->len + PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type)); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); if (mock_output_arg) { mbedtls_test_driver_cipher_hooks.forced_output = expected_output->x; @@ -832,13 +832,13 @@ void cipher_decrypt(int alg_arg, /* Allocate input buffer and copy the iv and the plaintext */ input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len); if (input_buffer_size > 0) { - ASSERT_ALLOC(input, input_buffer_size); + TEST_CALLOC_OR_FAIL(input, input_buffer_size); memcpy(input, iv->x, iv->len); memcpy(input + iv->len, input_arg->x, input_arg->len); } output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size); - ASSERT_ALLOC(output, output_buffer_size); + TEST_CALLOC_OR_FAIL(output, output_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -885,7 +885,7 @@ void cipher_entry_points(int alg_arg, int key_type_arg, psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; mbedtls_test_driver_cipher_hooks = mbedtls_test_driver_cipher_hooks_init(); - ASSERT_ALLOC(output, input->len + 16); + TEST_CALLOC_OR_FAIL(output, input->len + 16); output_buffer_size = input->len + 16; PSA_ASSERT(psa_crypto_init()); @@ -1125,7 +1125,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, PSA_AEAD_ENCRYPT_OUTPUT_SIZE(key_type, alg, input_data->len)); TEST_ASSERT(output_size <= PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len)); - ASSERT_ALLOC(output_data, output_size); + TEST_CALLOC_OR_FAIL(output_data, output_size); mbedtls_test_driver_aead_hooks.forced_status = forced_status; status = psa_aead_encrypt(key, alg, @@ -1187,7 +1187,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, output_size = input_data->len - PSA_AEAD_TAG_LENGTH(key_type, key_bits, alg); - ASSERT_ALLOC(output_data, output_size); + TEST_CALLOC_OR_FAIL(output_data, output_size); mbedtls_test_driver_aead_hooks.forced_status = forced_status; status = psa_aead_decrypt(key, alg, @@ -1250,7 +1250,7 @@ void mac_sign(int key_type_arg, PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); - ASSERT_ALLOC(actual_mac, mac_buffer_size); + TEST_CALLOC_OR_FAIL(actual_mac, mac_buffer_size); mbedtls_test_driver_mac_hooks.forced_status = forced_status; /* @@ -1470,7 +1470,7 @@ void builtin_key_export(int builtin_key_id_arg, psa_status_t actual_status; PSA_ASSERT(psa_crypto_init()); - ASSERT_ALLOC(output_buffer, expected_output->len); + TEST_CALLOC_OR_FAIL(output_buffer, expected_output->len); actual_status = psa_export_key(key, output_buffer, expected_output->len, &output_size); @@ -1521,7 +1521,7 @@ void builtin_pubkey_export(int builtin_key_id_arg, psa_status_t actual_status; PSA_ASSERT(psa_crypto_init()); - ASSERT_ALLOC(output_buffer, expected_output->len); + TEST_CALLOC_OR_FAIL(output_buffer, expected_output->len); actual_status = psa_export_public_key(key, output_buffer, expected_output->len, &output_size); @@ -1564,7 +1564,7 @@ void hash_compute(int alg_arg, mbedtls_test_driver_hash_hooks.forced_status = forced_status; PSA_ASSERT(psa_crypto_init()); - ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); TEST_EQUAL(psa_hash_compute(alg, input->x, input->len, output, PSA_HASH_LENGTH(alg), @@ -1597,7 +1597,7 @@ void hash_multipart_setup(int alg_arg, size_t output_length; mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init(); - ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); PSA_ASSERT(psa_crypto_init()); @@ -1642,7 +1642,7 @@ void hash_multipart_update(int alg_arg, size_t output_length; mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init(); - ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); PSA_ASSERT(psa_crypto_init()); @@ -1697,7 +1697,7 @@ void hash_multipart_finish(int alg_arg, size_t output_length; mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init(); - ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); PSA_ASSERT(psa_crypto_init()); @@ -1751,7 +1751,7 @@ void hash_clone(int alg_arg, size_t output_length; mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init(); - ASSERT_ALLOC(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); PSA_ASSERT(psa_crypto_init()); diff --git a/tests/suites/test_suite_psa_crypto_entropy.function b/tests/suites/test_suite_psa_crypto_entropy.function index 0c8f2d5bc2..6f65f8fd92 100644 --- a/tests/suites/test_suite_psa_crypto_entropy.function +++ b/tests/suites/test_suite_psa_crypto_entropy.function @@ -114,8 +114,8 @@ void external_rng_failure_sign(int key_type, data_t *key_data, int alg, size_t signature_size = PSA_SIGNATURE_MAX_SIZE; size_t signature_length; - ASSERT_ALLOC(input, input_size); - ASSERT_ALLOC(signature, signature_size); + TEST_CALLOC_OR_FAIL(input, input_size); + TEST_CALLOC_OR_FAIL(signature, signature_size); PSA_ASSERT(psa_crypto_init()); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, @@ -163,7 +163,7 @@ void validate_entropy_seed_injection(int seed_length_a, } else { seed_size = seed_length_b; } - ASSERT_ALLOC(seed, seed_size); + TEST_CALLOC_OR_FAIL(seed, seed_size); /* fill seed with some data */ for (i = 0; i < seed_size; ++i) { seed[i] = i; diff --git a/tests/suites/test_suite_psa_crypto_init.function b/tests/suites/test_suite_psa_crypto_init.function index 7345ad1445..78f80a13ae 100644 --- a/tests/suites/test_suite_psa_crypto_init.function +++ b/tests/suites/test_suite_psa_crypto_init.function @@ -289,7 +289,7 @@ void entropy_from_nv_seed(int seed_size_arg, uint8_t *seed = NULL; size_t seed_size = seed_size_arg; - ASSERT_ALLOC(seed, seed_size); + TEST_CALLOC_OR_FAIL(seed, seed_size); TEST_ASSERT(mbedtls_nv_seed_write(seed, seed_size) >= 0); custom_entropy_sources_mask = ENTROPY_SOURCE_NV_SEED; diff --git a/tests/suites/test_suite_psa_crypto_persistent_key.function b/tests/suites/test_suite_psa_crypto_persistent_key.function index 4d852384d7..4b4b00d1df 100644 --- a/tests/suites/test_suite_psa_crypto_persistent_key.function +++ b/tests/suites/test_suite_psa_crypto_persistent_key.function @@ -61,7 +61,7 @@ void format_storage_data_check(data_t *key_data, psa_set_key_algorithm(&attributes, key_alg); psa_set_key_enrollment_algorithm(&attributes, key_alg2); - ASSERT_ALLOC(file_data, file_data_length); + TEST_CALLOC_OR_FAIL(file_data, file_data_length); psa_format_key_data_for_storage(key_data->x, key_data->len, &attributes.core, file_data); @@ -127,7 +127,7 @@ void save_large_persistent_key(int data_length_arg, int expected_status) size_t data_length = data_length_arg; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - ASSERT_ALLOC(data, data_length); + TEST_CALLOC_OR_FAIL(data, data_length); PSA_ASSERT(psa_crypto_init()); @@ -267,7 +267,7 @@ void import_export_persistent_key(data_t *data, int type_arg, size_t exported_length; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - ASSERT_ALLOC(exported, export_size); + TEST_CALLOC_OR_FAIL(exported, export_size); PSA_ASSERT(psa_crypto_init()); diff --git a/tests/suites/test_suite_psa_crypto_se_driver_hal.function b/tests/suites/test_suite_psa_crypto_se_driver_hal.function index 9d62d645df..a8977369db 100644 --- a/tests/suites/test_suite_psa_crypto_se_driver_hal.function +++ b/tests/suites/test_suite_psa_crypto_se_driver_hal.function @@ -601,7 +601,7 @@ static int check_persistent_data(psa_key_location_t location, int ok = 0; PSA_ASSERT(psa_its_get_info(uid, &info)); - ASSERT_ALLOC(loaded, info.size); + TEST_CALLOC_OR_FAIL(loaded, info.size); PSA_ASSERT(psa_its_get(uid, 0, info.size, loaded, NULL)); TEST_BUFFERS_EQUAL(expected_data, size, loaded, info.size); ok = 1; diff --git a/tests/suites/test_suite_psa_crypto_slot_management.function b/tests/suites/test_suite_psa_crypto_slot_management.function index 72c8e0f78d..6868c8854e 100644 --- a/tests/suites/test_suite_psa_crypto_slot_management.function +++ b/tests/suites/test_suite_psa_crypto_slot_management.function @@ -303,7 +303,7 @@ void persistent_slot_lifecycle(int lifetime_arg, int owner_id_arg, int id_arg, psa_get_key_type(&read_attributes)); TEST_EQUAL(psa_get_key_bits(&attributes), psa_get_key_bits(&read_attributes)); - ASSERT_ALLOC(reexported, key_data->len); + TEST_CALLOC_OR_FAIL(reexported, key_data->len); if (usage_flags & PSA_KEY_USAGE_EXPORT) { PSA_ASSERT(psa_export_key(id, reexported, key_data->len, &reexported_length)); @@ -575,7 +575,7 @@ void copy_across_lifetimes(int source_lifetime_arg, int source_owner_id_arg, psa_get_key_enrollment_algorithm(&target_attributes)); if (expected_usage & PSA_KEY_USAGE_EXPORT) { size_t length; - ASSERT_ALLOC(export_buffer, material->len); + TEST_CALLOC_OR_FAIL(export_buffer, material->len); PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, material->len, &length)); TEST_BUFFERS_EQUAL(material->x, material->len, @@ -689,7 +689,7 @@ void copy_to_occupied(int source_lifetime_arg, int source_id_arg, psa_get_key_algorithm(&attributes2)); if (target_usage & PSA_KEY_USAGE_EXPORT) { size_t length; - ASSERT_ALLOC(export_buffer, target_material->len); + TEST_CALLOC_OR_FAIL(export_buffer, target_material->len); PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, target_material->len, &length)); TEST_BUFFERS_EQUAL(target_material->x, target_material->len, @@ -813,7 +813,7 @@ void many_transient_keys(int max_keys_arg) uint8_t exported[sizeof(size_t)]; size_t exported_length; - ASSERT_ALLOC(keys, max_keys); + TEST_CALLOC_OR_FAIL(keys, max_keys); PSA_ASSERT(psa_crypto_init()); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT); @@ -942,7 +942,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() TEST_ASSERT(MBEDTLS_PSA_KEY_SLOT_COUNT >= 1); - ASSERT_ALLOC(keys, MBEDTLS_PSA_KEY_SLOT_COUNT); + TEST_CALLOC_OR_FAIL(keys, MBEDTLS_PSA_KEY_SLOT_COUNT); PSA_ASSERT(psa_crypto_init()); psa_set_key_usage_flags(&attributes, diff --git a/tests/suites/test_suite_psa_crypto_storage_format.function b/tests/suites/test_suite_psa_crypto_storage_format.function index 403ac53ab8..b68107cd73 100644 --- a/tests/suites/test_suite_psa_crypto_storage_format.function +++ b/tests/suites/test_suite_psa_crypto_storage_format.function @@ -36,7 +36,7 @@ static int test_written_key(const psa_key_attributes_t *attributes, /* Check that the key is represented as expected. */ PSA_ASSERT(psa_its_get_info(uid, &storage_info)); TEST_EQUAL(storage_info.size, expected_representation->len); - ASSERT_ALLOC(actual_representation, storage_info.size); + TEST_CALLOC_OR_FAIL(actual_representation, storage_info.size); PSA_ASSERT(psa_its_get(uid, 0, storage_info.size, actual_representation, &length)); TEST_BUFFERS_EQUAL(expected_representation->x, expected_representation->len, @@ -268,7 +268,7 @@ static int test_read_key(const psa_key_attributes_t *expected_attributes, TEST_EQUAL(psa_get_key_enrollment_algorithm(expected_attributes), psa_get_key_enrollment_algorithm(&actual_attributes)); if (can_export(expected_attributes)) { - ASSERT_ALLOC(exported_material, expected_material->len); + TEST_CALLOC_OR_FAIL(exported_material, expected_material->len); PSA_ASSERT(psa_export_key(key_id, exported_material, expected_material->len, &length)); diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index 6a55bf5a2a..5e86a0cc6c 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -92,7 +92,7 @@ void set_get_remove(int uid_arg, int flags_arg, data_t *data) unsigned char *buffer = NULL; size_t ret_len = 0; - ASSERT_ALLOC(buffer, data->len); + TEST_CALLOC_OR_FAIL(buffer, data->len); PSA_ASSERT(psa_its_set_wrap(uid, data->len, data->x, flags)); @@ -122,7 +122,7 @@ void set_overwrite(int uid_arg, unsigned char *buffer = NULL; size_t ret_len = 0; - ASSERT_ALLOC(buffer, MAX(data1->len, data2->len)); + TEST_CALLOC_OR_FAIL(buffer, MAX(data1->len, data2->len)); PSA_ASSERT(psa_its_set_wrap(uid, data1->len, data1->x, flags1)); PSA_ASSERT(psa_its_get_info(uid, &info)); @@ -214,7 +214,7 @@ void get_at(int uid_arg, data_t *data, size_t i; size_t ret_len = 0; - ASSERT_ALLOC(buffer, length + 16); + TEST_CALLOC_OR_FAIL(buffer, length + 16); trailer = buffer + length; memset(trailer, '-', 16); diff --git a/tests/suites/test_suite_random.function b/tests/suites/test_suite_random.function index 905ee78f3f..f2da0ced22 100644 --- a/tests/suites/test_suite_random.function +++ b/tests/suites/test_suite_random.function @@ -163,7 +163,7 @@ void mbedtls_psa_get_random_length(int n) unsigned char *output = NULL; PSA_ASSERT(psa_crypto_init()); - ASSERT_ALLOC(output, n); + TEST_CALLOC_OR_FAIL(output, n); TEST_EQUAL(0, mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, output, n)); diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 621f626b01..1dc2313da1 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -147,7 +147,7 @@ void test_callback_buffer(int size, int put1, int put1_ret, if (input_len == 0) { input_len = 1; } - ASSERT_ALLOC(input, input_len); + TEST_CALLOC_OR_FAIL(input, input_len); output_len = 0; for (j = 0; j < ROUNDS; j++) { @@ -161,7 +161,7 @@ void test_callback_buffer(int size, int put1, int put1_ret, if (output_len == 0) { output_len = 1; } - ASSERT_ALLOC(output, output_len); + TEST_CALLOC_OR_FAIL(output, output_len); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ @@ -1516,8 +1516,8 @@ void ssl_decrypt_non_etm_cbc(int cipher_type, int hash_id, int trunc_hmac, + plaintext_len + t0.maclen + padlen + 1; - ASSERT_ALLOC(buf, buflen); - ASSERT_ALLOC(buf_save, buflen); + TEST_CALLOC_OR_FAIL(buf, buflen); + TEST_CALLOC_OR_FAIL(buf_save, buflen); /* Prepare a dummy record header */ memset(rec.ctr, 0, sizeof(rec.ctr)); From 20e27de0bb7a0ddc29043a6dd65375f0e01bd06b Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Mon, 4 Sep 2023 11:09:08 +0100 Subject: [PATCH 124/135] For tests, rename ASSERT_ALLOC_WEAK() to TEST_CALLOC_OR_SKIP() Signed-off-by: Tom Cosgrove --- tests/include/test/macros.h | 22 ++++++++++----------- tests/suites/test_suite_asn1parse.function | 2 +- tests/suites/test_suite_ccm.function | 2 +- tests/suites/test_suite_psa_crypto.function | 2 +- 4 files changed, 14 insertions(+), 14 deletions(-) diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h index 5a7c2e4f30..1bba43696c 100644 --- a/tests/include/test/macros.h +++ b/tests/include/test/macros.h @@ -161,18 +161,18 @@ * This macro behaves like #TEST_CALLOC_OR_FAIL, except that if the allocation * fails, it marks the test as skipped rather than failed. */ -#define ASSERT_ALLOC_WEAK(pointer, length) \ - do \ - { \ - TEST_ASSERT((pointer) == NULL); \ - if ((length) != 0) \ - { \ - (pointer) = mbedtls_calloc(sizeof(*(pointer)), \ +#define TEST_CALLOC_OR_SKIP(pointer, length) \ + do { \ + TEST_ASSERT((pointer) == NULL); \ + if ((length) != 0) { \ + (pointer) = mbedtls_calloc(sizeof(*(pointer)), \ (length)); \ - TEST_ASSUME((pointer) != NULL); \ - } \ - } \ - while (0) + TEST_ASSUME((pointer) != NULL); \ + } \ + } while (0) + +/* For backwards compatibility */ +#define ASSERT_ALLOC_WEAK(pointer, length) TEST_CALLOC_OR_SKIP(pointer, length) /** Compare two buffers and fail the test case if they differ. * diff --git a/tests/suites/test_suite_asn1parse.function b/tests/suites/test_suite_asn1parse.function index 1a163024a4..9cef8aa023 100644 --- a/tests/suites/test_suite_asn1parse.function +++ b/tests/suites/test_suite_asn1parse.function @@ -139,7 +139,7 @@ int get_len_step(const data_t *input, size_t buffer_size, end = buf + 1; p = end; } else { - ASSERT_ALLOC_WEAK(buf, buffer_size); + TEST_CALLOC_OR_SKIP(buf, buffer_size); if (buffer_size > input->len) { memcpy(buf, input->x, input->len); memset(buf + input->len, 'A', buffer_size - input->len); diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function index 735c9aa283..8e5952884c 100644 --- a/tests/suites/test_suite_ccm.function +++ b/tests/suites/test_suite_ccm.function @@ -48,7 +48,7 @@ void ccm_lengths(int msg_len, int iv_len, int add_len, int tag_len, int res) mbedtls_ccm_init(&ctx); - ASSERT_ALLOC_WEAK(add, add_len); + TEST_CALLOC_OR_SKIP(add, add_len); memset(key, 0, sizeof(key)); memset(msg, 0, sizeof(msg)); memset(iv, 0, sizeof(iv)); diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 4dda1d7679..d2b3c718c2 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -471,7 +471,7 @@ void import_large_key(int type_arg, int byte_size_arg, /* Skip the test case if the target running the test cannot * accommodate large keys due to heap size constraints */ - ASSERT_ALLOC_WEAK(buffer, buffer_size); + TEST_CALLOC_OR_SKIP(buffer, buffer_size); memset(buffer, 'K', byte_size); PSA_ASSERT(psa_crypto_init()); From 30ceb23f3e7ab5fa1c9e81751fcf3f71b40b8e5d Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Mon, 4 Sep 2023 11:20:19 +0100 Subject: [PATCH 125/135] For tests, rename TEST_CALLOC_OR_FAIL() to just TEST_CALLOC() Signed-off-by: Tom Cosgrove --- tests/include/test/macros.h | 6 +- tests/src/psa_exercise_key.c | 10 +- tests/src/test_helpers/ssl_helpers.c | 6 +- tests/suites/test_suite_aes.function | 16 +-- tests/suites/test_suite_asn1parse.function | 12 +-- tests/suites/test_suite_asn1write.function | 10 +- tests/suites/test_suite_bignum.function | 2 +- tests/suites/test_suite_cipher.function | 18 ++-- .../suites/test_suite_constant_time.function | 4 +- .../test_suite_constant_time_hmac.function | 4 +- tests/suites/test_suite_ecp.function | 2 +- tests/suites/test_suite_mps.function | 8 +- tests/suites/test_suite_pk.function | 2 +- tests/suites/test_suite_pkcs12.function | 2 +- tests/suites/test_suite_pkwrite.function | 4 +- .../test_suite_platform_printf.function | 8 +- tests/suites/test_suite_psa_crypto.function | 102 +++++++++--------- ..._suite_psa_crypto_driver_wrappers.function | 38 +++---- .../test_suite_psa_crypto_entropy.function | 6 +- .../test_suite_psa_crypto_init.function | 2 +- ...t_suite_psa_crypto_persistent_key.function | 6 +- ...st_suite_psa_crypto_se_driver_hal.function | 2 +- ..._suite_psa_crypto_slot_management.function | 10 +- ...t_suite_psa_crypto_storage_format.function | 4 +- tests/suites/test_suite_psa_its.function | 6 +- tests/suites/test_suite_random.function | 2 +- tests/suites/test_suite_ssl.function | 8 +- 27 files changed, 150 insertions(+), 150 deletions(-) diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h index 1bba43696c..83b2a076a8 100644 --- a/tests/include/test/macros.h +++ b/tests/include/test/macros.h @@ -143,7 +143,7 @@ * This expression may be evaluated multiple times. * */ -#define TEST_CALLOC_OR_FAIL(pointer, length) \ +#define TEST_CALLOC(pointer, length) \ do { \ TEST_ASSERT((pointer) == NULL); \ if ((length) != 0) { \ @@ -154,11 +154,11 @@ } while (0) /* For backwards compatibility */ -#define ASSERT_ALLOC(pointer, length) TEST_CALLOC_OR_FAIL(pointer, length) +#define ASSERT_ALLOC(pointer, length) TEST_CALLOC(pointer, length) /** Allocate memory dynamically. If the allocation fails, skip the test case. * - * This macro behaves like #TEST_CALLOC_OR_FAIL, except that if the allocation + * This macro behaves like #TEST_CALLOC, except that if the allocation * fails, it marks the test as skipped rather than failed. */ #define TEST_CALLOC_OR_SKIP(pointer, length) \ diff --git a/tests/src/psa_exercise_key.c b/tests/src/psa_exercise_key.c index ff43780bab..7c70fa85c8 100644 --- a/tests/src/psa_exercise_key.c +++ b/tests/src/psa_exercise_key.c @@ -505,7 +505,7 @@ psa_status_t mbedtls_test_psa_key_agreement_with_self( key_bits = psa_get_key_bits(&attributes); public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(private_key_type); public_key_length = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_key_type, key_bits); - TEST_CALLOC_OR_FAIL(public_key, public_key_length); + TEST_CALLOC(public_key, public_key_length); PSA_ASSERT(psa_export_public_key(key, public_key, public_key_length, &public_key_length)); @@ -547,7 +547,7 @@ psa_status_t mbedtls_test_psa_raw_key_agreement_with_self( key_bits = psa_get_key_bits(&attributes); public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(private_key_type); public_key_length = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_key_type, key_bits); - TEST_CALLOC_OR_FAIL(public_key, public_key_length); + TEST_CALLOC(public_key, public_key_length); PSA_ASSERT(psa_export_public_key(key, public_key, public_key_length, &public_key_length)); @@ -807,7 +807,7 @@ static int exercise_export_key(mbedtls_svc_key_id_t key, exported_size = PSA_EXPORT_KEY_OUTPUT_SIZE( psa_get_key_type(&attributes), psa_get_key_bits(&attributes)); - TEST_CALLOC_OR_FAIL(exported, exported_size); + TEST_CALLOC(exported, exported_size); if ((usage & PSA_KEY_USAGE_EXPORT) == 0 && !PSA_KEY_TYPE_IS_PUBLIC_KEY(psa_get_key_type(&attributes))) { @@ -850,7 +850,7 @@ static int exercise_export_public_key(mbedtls_svc_key_id_t key) exported_size = PSA_EXPORT_KEY_OUTPUT_SIZE( psa_get_key_type(&attributes), psa_get_key_bits(&attributes)); - TEST_CALLOC_OR_FAIL(exported, exported_size); + TEST_CALLOC(exported, exported_size); TEST_EQUAL(psa_export_public_key(key, exported, exported_size, &exported_length), @@ -863,7 +863,7 @@ static int exercise_export_public_key(mbedtls_svc_key_id_t key) psa_get_key_type(&attributes)); exported_size = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_type, psa_get_key_bits(&attributes)); - TEST_CALLOC_OR_FAIL(exported, exported_size); + TEST_CALLOC(exported, exported_size); PSA_ASSERT(psa_export_public_key(key, exported, exported_size, diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c index e346ca0ceb..2fea014ac9 100644 --- a/tests/src/test_helpers/ssl_helpers.c +++ b/tests/src/test_helpers/ssl_helpers.c @@ -566,9 +566,9 @@ int mbedtls_test_ssl_endpoint_certificate_init(mbedtls_test_ssl_endpoint *ep, } cert = &(ep->cert); - TEST_CALLOC_OR_FAIL(cert->ca_cert, 1); - TEST_CALLOC_OR_FAIL(cert->cert, 1); - TEST_CALLOC_OR_FAIL(cert->pkey, 1); + TEST_CALLOC(cert->ca_cert, 1); + TEST_CALLOC(cert->cert, 1); + TEST_CALLOC(cert->pkey, 1); mbedtls_x509_crt_init(cert->ca_cert); mbedtls_x509_crt_init(cert->cert); diff --git a/tests/suites/test_suite_aes.function b/tests/suites/test_suite_aes.function index 36859bd0cf..ead883e370 100644 --- a/tests/suites/test_suite_aes.function +++ b/tests/suites/test_suite_aes.function @@ -688,8 +688,8 @@ void aes_ecb_context_alignment(data_t *key) struct align1 *dec1 = NULL; /* All peak alignment */ - TEST_CALLOC_OR_FAIL(enc0, 1); - TEST_CALLOC_OR_FAIL(dec0, 1); + TEST_CALLOC(enc0, 1); + TEST_CALLOC(dec0, 1); if (!test_ctx_alignment(key, &enc0->ctx, &dec0->ctx)) { goto exit; } @@ -699,8 +699,8 @@ void aes_ecb_context_alignment(data_t *key) dec0 = NULL; /* Enc aligned, dec not */ - TEST_CALLOC_OR_FAIL(enc0, 1); - TEST_CALLOC_OR_FAIL(dec1, 1); + TEST_CALLOC(enc0, 1); + TEST_CALLOC(dec1, 1); if (!test_ctx_alignment(key, &enc0->ctx, &dec1->ctx)) { goto exit; } @@ -710,8 +710,8 @@ void aes_ecb_context_alignment(data_t *key) dec1 = NULL; /* Dec aligned, enc not */ - TEST_CALLOC_OR_FAIL(enc1, 1); - TEST_CALLOC_OR_FAIL(dec0, 1); + TEST_CALLOC(enc1, 1); + TEST_CALLOC(dec0, 1); if (!test_ctx_alignment(key, &enc1->ctx, &dec0->ctx)) { goto exit; } @@ -721,8 +721,8 @@ void aes_ecb_context_alignment(data_t *key) dec0 = NULL; /* Both shifted */ - TEST_CALLOC_OR_FAIL(enc1, 1); - TEST_CALLOC_OR_FAIL(dec1, 1); + TEST_CALLOC(enc1, 1); + TEST_CALLOC(dec1, 1); if (!test_ctx_alignment(key, &enc1->ctx, &dec1->ctx)) { goto exit; } diff --git a/tests/suites/test_suite_asn1parse.function b/tests/suites/test_suite_asn1parse.function index 9cef8aa023..77f268c53c 100644 --- a/tests/suites/test_suite_asn1parse.function +++ b/tests/suites/test_suite_asn1parse.function @@ -135,7 +135,7 @@ int get_len_step(const data_t *input, size_t buffer_size, /* Allocate a new buffer of exactly the length to parse each time. * This gives memory sanitizers a chance to catch buffer overreads. */ if (buffer_size == 0) { - TEST_CALLOC_OR_FAIL(buf, 1); + TEST_CALLOC(buf, 1); end = buf + 1; p = end; } else { @@ -247,7 +247,7 @@ void parse_prefixes(const data_t *input, mbedtls_test_set_step(buffer_size); /* Allocate a new buffer of exactly the length to parse each time. * This gives memory sanitizers a chance to catch buffer overreads. */ - TEST_CALLOC_OR_FAIL(buf, buffer_size); + TEST_CALLOC(buf, buffer_size); memcpy(buf, input->x, buffer_size); p = buf; ret = nested_parse(&p, buf + buffer_size); @@ -506,7 +506,7 @@ void get_mpi_too_large() mbedtls_mpi_init(&actual_mpi); - TEST_CALLOC_OR_FAIL(buf, size); + TEST_CALLOC(buf, size); buf[0] = 0x02; /* tag: INTEGER */ buf[1] = 0x84; /* 4-octet length */ buf[2] = (too_many_octets >> 24) & 0xff; @@ -729,10 +729,10 @@ void free_named_data(int with_oid, int with_val, int with_next) { { 0x06, 0, NULL }, { 0, 0, NULL }, NULL, 0 }; if (with_oid) { - TEST_CALLOC_OR_FAIL(head.oid.p, 1); + TEST_CALLOC(head.oid.p, 1); } if (with_val) { - TEST_CALLOC_OR_FAIL(head.val.p, 1); + TEST_CALLOC(head.val.p, 1); } if (with_next) { head.next = &next; @@ -758,7 +758,7 @@ void free_named_data_list(int length) for (i = 0; i < length; i++) { mbedtls_asn1_named_data *new = NULL; - TEST_CALLOC_OR_FAIL(new, 1); + TEST_CALLOC(new, 1); new->next = head; head = new; } diff --git a/tests/suites/test_suite_asn1write.function b/tests/suites/test_suite_asn1write.function index 6ddd285af9..583ddc9fe5 100644 --- a/tests/suites/test_suite_asn1write.function +++ b/tests/suites/test_suite_asn1write.function @@ -17,7 +17,7 @@ int generic_write_start_step(generic_write_data_t *data) mbedtls_test_set_step(data->size); mbedtls_free(data->output); data->output = NULL; - TEST_CALLOC_OR_FAIL(data->output, data->size == 0 ? 1 : data->size); + TEST_CALLOC(data->output, data->size == 0 ? 1 : data->size); data->end = data->output + data->size; data->p = data->end; data->start = data->end - data->size; @@ -296,7 +296,7 @@ void mbedtls_asn1_write_algorithm_identifier(data_t *oid, size_t len_complete = data_len + par_len; unsigned char expected_params_tag; size_t expected_params_len; - TEST_CALLOC_OR_FAIL(buf_complete, len_complete); + TEST_CALLOC(buf_complete, len_complete); unsigned char *end_complete = buf_complete + len_complete; memcpy(buf_complete, data.p, data_len); if (par_len == 0) { @@ -404,7 +404,7 @@ void test_asn1_write_bitstrings(data_t *bitstring, int bits, TEST_ASSERT(bitstring->len >= byte_length); #if defined(MBEDTLS_ASN1_PARSE_C) - TEST_CALLOC_OR_FAIL(masked_bitstring, byte_length); + TEST_CALLOC(masked_bitstring, byte_length); if (byte_length != 0) { memcpy(masked_bitstring, bitstring->x, byte_length); if (bits % 8 != 0) { @@ -477,7 +477,7 @@ void store_named_data_find(data_t *oid0, data_t *oid1, } pointers[ARRAY_LENGTH(nd)] = NULL; for (i = 0; i < ARRAY_LENGTH(nd); i++) { - TEST_CALLOC_OR_FAIL(nd[i].oid.p, oid[i]->len); + TEST_CALLOC(nd[i].oid.p, oid[i]->len); memcpy(nd[i].oid.p, oid[i]->x, oid[i]->len); nd[i].oid.len = oid[i]->len; nd[i].next = pointers[i+1]; @@ -529,7 +529,7 @@ void store_named_data_val_found(int old_len, int new_len) unsigned char *new_val = (unsigned char *) "new value"; if (old_len != 0) { - TEST_CALLOC_OR_FAIL(nd.val.p, (size_t) old_len); + TEST_CALLOC(nd.val.p, (size_t) old_len); old_val = nd.val.p; nd.val.len = old_len; memset(old_val, 'x', old_len); diff --git a/tests/suites/test_suite_bignum.function b/tests/suites/test_suite_bignum.function index db9c2e75e5..a65a4897b5 100644 --- a/tests/suites/test_suite_bignum.function +++ b/tests/suites/test_suite_bignum.function @@ -1507,7 +1507,7 @@ void mpi_random_many(int min, data_t *bound_bytes, int iterations) full_stats = 0; stats_len = n_bits; } - TEST_CALLOC_OR_FAIL(stats, stats_len); + TEST_CALLOC(stats, stats_len); for (i = 0; i < (size_t) iterations; i++) { mbedtls_test_set_step(i); diff --git a/tests/suites/test_suite_cipher.function b/tests/suites/test_suite_cipher.function index bf7f421a5f..fffc5139a6 100644 --- a/tests/suites/test_suite_cipher.function +++ b/tests/suites/test_suite_cipher.function @@ -1229,7 +1229,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, * (we need the tag appended to the ciphertext) */ cipher_plus_tag_len = cipher->len + tag->len; - TEST_CALLOC_OR_FAIL(cipher_plus_tag, cipher_plus_tag_len); + TEST_CALLOC(cipher_plus_tag, cipher_plus_tag_len); memcpy(cipher_plus_tag, cipher->x, cipher->len); memcpy(cipher_plus_tag + cipher->len, tag->x, tag->len); @@ -1247,7 +1247,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, * Try decrypting to a buffer that's 1B too small */ if (decrypt_buf_len != 0) { - TEST_CALLOC_OR_FAIL(decrypt_buf, decrypt_buf_len - 1); + TEST_CALLOC(decrypt_buf, decrypt_buf_len - 1); outlen = 0; ret = mbedtls_cipher_auth_decrypt_ext(&ctx, iv->x, iv->len, @@ -1262,7 +1262,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, /* * Authenticate and decrypt, and check result */ - TEST_CALLOC_OR_FAIL(decrypt_buf, decrypt_buf_len); + TEST_CALLOC(decrypt_buf, decrypt_buf_len); outlen = 0; ret = mbedtls_cipher_auth_decrypt_ext(&ctx, iv->x, iv->len, @@ -1306,7 +1306,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, /* * Try encrypting with an output buffer that's 1B too small */ - TEST_CALLOC_OR_FAIL(encrypt_buf, encrypt_buf_len - 1); + TEST_CALLOC(encrypt_buf, encrypt_buf_len - 1); outlen = 0; ret = mbedtls_cipher_auth_encrypt_ext(&ctx, iv->x, iv->len, @@ -1320,7 +1320,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, /* * Encrypt and check the result */ - TEST_CALLOC_OR_FAIL(encrypt_buf, encrypt_buf_len); + TEST_CALLOC(encrypt_buf, encrypt_buf_len); outlen = 0; ret = mbedtls_cipher_auth_encrypt_ext(&ctx, iv->x, iv->len, @@ -1374,7 +1374,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, * Authenticate and decrypt, and check result */ - TEST_CALLOC_OR_FAIL(decrypt_buf, cipher->len); + TEST_CALLOC(decrypt_buf, cipher->len); outlen = 0; ret = mbedtls_cipher_auth_decrypt(&ctx, iv->x, iv->len, ad->x, ad->len, tmp_cipher, cipher->len, decrypt_buf, &outlen, @@ -1411,14 +1411,14 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, /* prepare buffers for encryption */ #if defined(MBEDTLS_USE_PSA_CRYPTO) if (use_psa) { - TEST_CALLOC_OR_FAIL(cipher_plus_tag, cipher->len + tag->len); + TEST_CALLOC(cipher_plus_tag, cipher->len + tag->len); tmp_cipher = cipher_plus_tag; tmp_tag = cipher_plus_tag + cipher->len; } else #endif /* MBEDTLS_USE_PSA_CRYPTO */ { - TEST_CALLOC_OR_FAIL(encrypt_buf, cipher->len); - TEST_CALLOC_OR_FAIL(tag_buf, tag->len); + TEST_CALLOC(encrypt_buf, cipher->len); + TEST_CALLOC(tag_buf, tag->len); tmp_cipher = encrypt_buf; tmp_tag = tag_buf; } diff --git a/tests/suites/test_suite_constant_time.function b/tests/suites/test_suite_constant_time.function index d67e46bec8..bbd8382756 100644 --- a/tests/suites/test_suite_constant_time.function +++ b/tests/suites/test_suite_constant_time.function @@ -23,8 +23,8 @@ void ssl_cf_memcpy_offset(int offset_min, int offset_max, int len) size_t src_len = offset_max + len; size_t secret; - TEST_CALLOC_OR_FAIL(dst, len); - TEST_CALLOC_OR_FAIL(src, src_len); + TEST_CALLOC(dst, len); + TEST_CALLOC(src, src_len); /* Fill src in a way that we can detect if we copied the right bytes */ mbedtls_test_rnd_std_rand(NULL, src, src_len); diff --git a/tests/suites/test_suite_constant_time_hmac.function b/tests/suites/test_suite_constant_time_hmac.function index 2ca1047d6a..2cc5005407 100644 --- a/tests/suites/test_suite_constant_time_hmac.function +++ b/tests/suites/test_suite_constant_time_hmac.function @@ -35,7 +35,7 @@ void ssl_cf_hmac(int hash) block_size = hash == MBEDTLS_MD_SHA384 ? 128 : 64; /* Use allocated out buffer to catch overwrites */ - TEST_CALLOC_OR_FAIL(out, out_len); + TEST_CALLOC(out, out_len); /* Set up contexts with the given hash and a dummy key */ TEST_EQUAL(0, mbedtls_md_setup(&ctx, md_info, 1)); @@ -54,7 +54,7 @@ void ssl_cf_hmac(int hash) mbedtls_test_set_step(max_in_len * 10000); /* Use allocated in buffer to catch overreads */ - TEST_CALLOC_OR_FAIL(data, max_in_len); + TEST_CALLOC(data, max_in_len); min_in_len = max_in_len > 255 ? max_in_len - 255 : 0; for (in_len = min_in_len; in_len <= max_in_len; in_len++) { diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function index e12873b8e9..39c9ddee01 100644 --- a/tests/suites/test_suite_ecp.function +++ b/tests/suites/test_suite_ecp.function @@ -1426,7 +1426,7 @@ void genkey_mx_known_answer(int bits, data_t *seed, data_t *expected) rnd_info.fallback_f_rng = NULL; rnd_info.fallback_p_rng = NULL; - TEST_CALLOC_OR_FAIL(actual, expected->len); + TEST_CALLOC(actual, expected->len); ret = mbedtls_ecp_gen_privkey_mx(bits, &d, mbedtls_test_rnd_buffer_rand, &rnd_info); diff --git a/tests/suites/test_suite_mps.function b/tests/suites/test_suite_mps.function index c04a651d5e..ecb7e31aa6 100644 --- a/tests/suites/test_suite_mps.function +++ b/tests/suites/test_suite_mps.function @@ -844,15 +844,15 @@ void mbedtls_mps_reader_random_usage(int num_out_chunks, mbedtls_mps_reader rd; if (acc_size > 0) { - TEST_CALLOC_OR_FAIL(acc, acc_size); + TEST_CALLOC(acc, acc_size); } /* This probably needs to be changed because we want * our tests to be deterministic. */ // srand( time( NULL ) ); - TEST_CALLOC_OR_FAIL(outgoing, num_out_chunks * max_chunk_size); - TEST_CALLOC_OR_FAIL(incoming, num_out_chunks * max_chunk_size); + TEST_CALLOC(outgoing, num_out_chunks * max_chunk_size); + TEST_CALLOC(incoming, num_out_chunks * max_chunk_size); mbedtls_mps_reader_init(&rd, acc, acc_size); @@ -884,7 +884,7 @@ void mbedtls_mps_reader_random_usage(int num_out_chunks, } tmp_size = (rand() % max_chunk_size) + 1; - TEST_CALLOC_OR_FAIL(tmp, tmp_size); + TEST_CALLOC(tmp, tmp_size); TEST_ASSERT(mbedtls_test_rnd_std_rand(NULL, tmp, tmp_size) == 0); ret = mbedtls_mps_reader_feed(&rd, tmp, tmp_size); diff --git a/tests/suites/test_suite_pk.function b/tests/suites/test_suite_pk.function index 90647d5b73..c17037f079 100644 --- a/tests/suites/test_suite_pk.function +++ b/tests/suites/test_suite_pk.function @@ -915,7 +915,7 @@ void pk_sign_verify(int type, int parameter, int sign_ret, int verify_ret) #endif hash_len = mbedtls_md_get_size(mbedtls_md_info_from_type(md)); - TEST_CALLOC_OR_FAIL(hash, hash_len); + TEST_CALLOC(hash, hash_len); mbedtls_pk_init(&pk); USE_PSA_INIT(); diff --git a/tests/suites/test_suite_pkcs12.function b/tests/suites/test_suite_pkcs12.function index c4df8ab739..7bd6fc0d79 100644 --- a/tests/suites/test_suite_pkcs12.function +++ b/tests/suites/test_suite_pkcs12.function @@ -42,7 +42,7 @@ void pkcs12_derive_key(int md_type, int key_size_arg, salt_len = salt_arg->len; - TEST_CALLOC_OR_FAIL(output_data, key_size); + TEST_CALLOC(output_data, key_size); int ret = mbedtls_pkcs12_derivation(output_data, key_size, diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function index 764c55c0d0..88d0dd28d7 100644 --- a/tests/suites/test_suite_pkwrite.function +++ b/tests/suites/test_suite_pkwrite.function @@ -58,7 +58,7 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der) } TEST_ASSERT(check_buf_len > 0); - TEST_CALLOC_OR_FAIL(buf, check_buf_len); + TEST_CALLOC(buf, check_buf_len); if (is_public_key) { TEST_EQUAL(mbedtls_pk_parse_public_keyfile(&key, key_file), 0); @@ -145,7 +145,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) &pub_key_len), 0); derived_key_len = pub_key_len; - TEST_CALLOC_OR_FAIL(derived_key_raw, derived_key_len); + TEST_CALLOC(derived_key_raw, derived_key_len); TEST_EQUAL(mbedtls_pk_write_pubkey_der(&priv_key, derived_key_raw, derived_key_len), pub_key_len); diff --git a/tests/suites/test_suite_platform_printf.function b/tests/suites/test_suite_platform_printf.function index 14fa604364..8739dc0a5e 100644 --- a/tests/suites/test_suite_platform_printf.function +++ b/tests/suites/test_suite_platform_printf.function @@ -32,7 +32,7 @@ void printf_int(char *format, /* any format expecting one int argument, e.g. "%d const size_t n = strlen(result); /* Nominal case: buffer just large enough */ - TEST_CALLOC_OR_FAIL(output, n + 1); + TEST_CALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, x)); TEST_BUFFERS_EQUAL(result, n + 1, output, n + 1); mbedtls_free(output); @@ -53,11 +53,11 @@ void printf_long_max(const char *format, /* "%lx" or longer type */ const size_t n = sizeof(value) * 2; /* We assume that long has no padding bits! */ - TEST_CALLOC_OR_FAIL(expected, n + 1); + TEST_CALLOC(expected, n + 1); expected[0] = '7'; memset(expected + 1, 'f', sizeof(value) * 2 - 1); - TEST_CALLOC_OR_FAIL(output, n + 1); + TEST_CALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, value)); TEST_BUFFERS_EQUAL(expected, n + 1, output, n + 1); mbedtls_free(output); @@ -77,7 +77,7 @@ void printf_char2(char *format, /* "%c%c" */ const size_t n = strlen(result); /* Nominal case: buffer just large enough */ - TEST_CALLOC_OR_FAIL(output, n + 1); + TEST_CALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, arg1, arg2)); TEST_BUFFERS_EQUAL(result, n + 1, output, n + 1); mbedtls_free(output); diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index d2b3c718c2..16efd4356b 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -533,7 +533,7 @@ void import_rsa_made_up(int bits_arg, int keypair, int expected_status_arg) psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; PSA_ASSERT(psa_crypto_init()); - TEST_CALLOC_OR_FAIL(buffer, buffer_size); + TEST_CALLOC(buffer, buffer_size); TEST_ASSERT((ret = construct_fake_rsa_key(buffer, buffer_size, &p, bits, keypair)) >= 0); @@ -578,9 +578,9 @@ void import_export(data_t *data, psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT; export_size = (ptrdiff_t) data->len + export_size_delta; - TEST_CALLOC_OR_FAIL(exported, export_size); + TEST_CALLOC(exported, export_size); if (!canonical_input) { - TEST_CALLOC_OR_FAIL(reexported, export_size); + TEST_CALLOC(reexported, export_size); } PSA_ASSERT(psa_crypto_init()); @@ -687,7 +687,7 @@ void import_export_public_key(data_t *data, PSA_ASSERT(psa_import_key(&attributes, data->x, data->len, &key)); /* Export the public key */ - TEST_CALLOC_OR_FAIL(exported, export_size); + TEST_CALLOC(exported, export_size); status = psa_export_public_key(key, exported, export_size, &exported_length); @@ -1081,7 +1081,7 @@ void asymmetric_encryption_key_policy(int policy_usage_arg, key_bits = psa_get_key_bits(&attributes); buffer_length = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, exercise_alg); - TEST_CALLOC_OR_FAIL(buffer, buffer_length); + TEST_CALLOC(buffer, buffer_length); status = psa_asymmetric_encrypt(key, exercise_alg, NULL, 0, @@ -1446,7 +1446,7 @@ void copy_success(int source_usage_arg, psa_get_key_enrollment_algorithm(&target_attributes)); if (expected_usage & PSA_KEY_USAGE_EXPORT) { size_t length; - TEST_CALLOC_OR_FAIL(export_buffer, material->len); + TEST_CALLOC(export_buffer, material->len); PSA_ASSERT(psa_export_key(target_key, export_buffer, material->len, &length)); TEST_BUFFERS_EQUAL(material->x, material->len, @@ -1599,7 +1599,7 @@ void hash_compute_fail(int alg_arg, data_t *input, psa_status_t expected_status = expected_status_arg; psa_status_t status; - TEST_CALLOC_OR_FAIL(output, output_size); + TEST_CALLOC(output, output_size); PSA_ASSERT(psa_crypto_init()); @@ -2187,7 +2187,7 @@ void mac_sign(int key_type_arg, PSA_ERROR_BUFFER_TOO_SMALL); mbedtls_test_set_step(output_size); - TEST_CALLOC_OR_FAIL(actual_mac, output_size); + TEST_CALLOC(actual_mac, output_size); /* Calculate the MAC, one-shot case. */ TEST_EQUAL(psa_mac_compute(key, alg, @@ -2283,7 +2283,7 @@ void mac_verify(int key_type_arg, PSA_ERROR_INVALID_SIGNATURE); /* Test a MAC that's too long, one-shot case. */ - TEST_CALLOC_OR_FAIL(perturbed_mac, expected_mac->len + 1); + TEST_CALLOC(perturbed_mac, expected_mac->len + 1); memcpy(perturbed_mac, expected_mac->x, expected_mac->len); TEST_EQUAL(psa_mac_verify(key, alg, input->x, input->len, @@ -2608,7 +2608,7 @@ void cipher_encrypt_fail(int alg_arg, output_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -2662,7 +2662,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, &key)); output_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, plaintext->len); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); /* set_iv() is not allowed */ PSA_ASSERT(psa_cipher_encrypt_setup(&operation, key, alg)); @@ -2811,8 +2811,8 @@ void cipher_encrypt_validation(int alg_arg, output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); output2_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) + PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg); - TEST_CALLOC_OR_FAIL(output1, output1_buffer_size); - TEST_CALLOC_OR_FAIL(output2, output2_buffer_size); + TEST_CALLOC(output1, output1_buffer_size); + TEST_CALLOC(output2, output2_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -2903,7 +2903,7 @@ void cipher_encrypt_multipart(int alg_arg, int key_type_arg, output_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) + PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); TEST_LE_U(first_part_size, input->len); PSA_ASSERT(psa_cipher_update(&operation, input->x, first_part_size, @@ -3002,7 +3002,7 @@ void cipher_decrypt_multipart(int alg_arg, int key_type_arg, output_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) + PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); TEST_LE_U(first_part_size, input->len); PSA_ASSERT(psa_cipher_update(&operation, @@ -3095,13 +3095,13 @@ void cipher_decrypt_fail(int alg_arg, /* Allocate input buffer and copy the iv and the plaintext */ input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len); if (input_buffer_size > 0) { - TEST_CALLOC_OR_FAIL(input, input_buffer_size); + TEST_CALLOC(input, input_buffer_size); memcpy(input, iv->x, iv->len); memcpy(input + iv->len, input_arg->x, input_arg->len); } output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); status = psa_cipher_decrypt(key, alg, input, input_buffer_size, output, output_buffer_size, &output_length); @@ -3142,13 +3142,13 @@ void cipher_decrypt(int alg_arg, /* Allocate input buffer and copy the iv and the plaintext */ input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len); if (input_buffer_size > 0) { - TEST_CALLOC_OR_FAIL(input, input_buffer_size); + TEST_CALLOC(input, input_buffer_size); memcpy(input, iv->x, iv->len); memcpy(input + iv->len, input_arg->x, input_arg->len); } output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -3196,7 +3196,7 @@ void cipher_verify_output(int alg_arg, PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); output1_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); - TEST_CALLOC_OR_FAIL(output1, output1_size); + TEST_CALLOC(output1, output1_size); PSA_ASSERT(psa_cipher_encrypt(key, alg, input->x, input->len, output1, output1_size, @@ -3207,7 +3207,7 @@ void cipher_verify_output(int alg_arg, PSA_CIPHER_ENCRYPT_OUTPUT_MAX_SIZE(input->len)); output2_size = output1_length; - TEST_CALLOC_OR_FAIL(output2, output2_size); + TEST_CALLOC(output2, output2_size); PSA_ASSERT(psa_cipher_decrypt(key, alg, output1, output1_length, output2, output2_size, @@ -3273,7 +3273,7 @@ void cipher_verify_output_multipart(int alg_arg, output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); TEST_LE_U(output1_buffer_size, PSA_CIPHER_ENCRYPT_OUTPUT_MAX_SIZE(input->len)); - TEST_CALLOC_OR_FAIL(output1, output1_buffer_size); + TEST_CALLOC(output1, output1_buffer_size); TEST_LE_U(first_part_size, input->len); @@ -3316,7 +3316,7 @@ void cipher_verify_output_multipart(int alg_arg, PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, output1_length)); TEST_LE_U(output2_buffer_size, PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(output1_length)); - TEST_CALLOC_OR_FAIL(output2, output2_buffer_size); + TEST_CALLOC(output2, output2_buffer_size); if (iv_length > 0) { PSA_ASSERT(psa_cipher_set_iv(&operation2, @@ -3412,7 +3412,7 @@ void aead_encrypt_decrypt(int key_type_arg, data_t *key_data, TEST_ASSERT(output_size <= PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len)); } - TEST_CALLOC_OR_FAIL(output_data, output_size); + TEST_CALLOC(output_data, output_size); status = psa_aead_encrypt(key, alg, nonce->x, nonce->len, @@ -3433,7 +3433,7 @@ void aead_encrypt_decrypt(int key_type_arg, data_t *key_data, TEST_EQUAL(status, expected_result); if (PSA_SUCCESS == expected_result) { - TEST_CALLOC_OR_FAIL(output_data2, output_length); + TEST_CALLOC(output_data2, output_length); /* For all currently defined algorithms, PSA_AEAD_DECRYPT_OUTPUT_SIZE * should be exact. */ @@ -3501,7 +3501,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, PSA_AEAD_ENCRYPT_OUTPUT_SIZE(key_type, alg, input_data->len)); TEST_ASSERT(output_size <= PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len)); - TEST_CALLOC_OR_FAIL(output_data, output_size); + TEST_CALLOC(output_data, output_size); status = psa_aead_encrypt(key, alg, nonce->x, nonce->len, @@ -3571,7 +3571,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, TEST_ASSERT(output_size <= PSA_AEAD_DECRYPT_OUTPUT_MAX_SIZE(input_data->len)); } - TEST_CALLOC_OR_FAIL(output_data, output_size); + TEST_CALLOC(output_data, output_size); status = psa_aead_decrypt(key, alg, nonce->x, nonce->len, @@ -3655,7 +3655,7 @@ void sign_hash_deterministic(int key_type_arg, data_t *key_data, key_bits, alg); TEST_ASSERT(signature_size != 0); TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE); - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(signature, signature_size); /* Perform the signature. */ PSA_ASSERT(psa_sign_hash(key, alg, @@ -3705,7 +3705,7 @@ void sign_hash_fail(int key_type_arg, data_t *key_data, size_t signature_length = 0xdeadbeef; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(signature, signature_size); PSA_ASSERT(psa_crypto_init()); @@ -3775,7 +3775,7 @@ void sign_verify_hash(int key_type_arg, data_t *key_data, key_bits, alg); TEST_ASSERT(signature_size != 0); TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE); - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(signature, signature_size); /* Perform the signature. */ PSA_ASSERT(psa_sign_hash(key, alg, @@ -3926,7 +3926,7 @@ void sign_message_deterministic(int key_type_arg, signature_size = PSA_SIGN_OUTPUT_SIZE(key_type, key_bits, alg); TEST_ASSERT(signature_size != 0); TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE); - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(signature, signature_size); PSA_ASSERT(psa_sign_message(key, alg, input_data->x, input_data->len, @@ -3964,7 +3964,7 @@ void sign_message_fail(int key_type_arg, size_t signature_length = 0xdeadbeef; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(signature, signature_size); PSA_ASSERT(psa_crypto_init()); @@ -4024,7 +4024,7 @@ void sign_verify_message(int key_type_arg, signature_size = PSA_SIGN_OUTPUT_SIZE(key_type, key_bits, alg); TEST_ASSERT(signature_size != 0); TEST_LE_U(signature_size, PSA_SIGNATURE_MAX_SIZE); - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(signature, signature_size); PSA_ASSERT(psa_sign_message(key, alg, input_data->x, input_data->len, @@ -4164,7 +4164,7 @@ void asymmetric_encrypt(int key_type_arg, output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg); TEST_LE_U(output_size, PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE); - TEST_CALLOC_OR_FAIL(output, output_size); + TEST_CALLOC(output, output_size); /* Encrypt the input */ actual_status = psa_asymmetric_encrypt(key, alg, @@ -4246,13 +4246,13 @@ void asymmetric_encrypt_decrypt(int key_type_arg, output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg); TEST_LE_U(output_size, PSA_ASYMMETRIC_ENCRYPT_OUTPUT_MAX_SIZE); - TEST_CALLOC_OR_FAIL(output, output_size); + TEST_CALLOC(output, output_size); output2_size = input_data->len; TEST_LE_U(output2_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg)); TEST_LE_U(output2_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE); - TEST_CALLOC_OR_FAIL(output2, output2_size); + TEST_CALLOC(output2, output2_size); /* We test encryption by checking that encrypt-then-decrypt gives back * the original plaintext because of the non-optional random @@ -4320,7 +4320,7 @@ void asymmetric_decrypt(int key_type_arg, /* Determine the maximum ciphertext length */ output_size = PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg); TEST_LE_U(output_size, PSA_ASYMMETRIC_DECRYPT_OUTPUT_MAX_SIZE); - TEST_CALLOC_OR_FAIL(output, output_size); + TEST_CALLOC(output, output_size); PSA_ASSERT(psa_asymmetric_decrypt(key, alg, input_data->x, input_data->len, @@ -4375,7 +4375,7 @@ void asymmetric_decrypt_fail(int key_type_arg, psa_status_t expected_status = expected_status_arg; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - TEST_CALLOC_OR_FAIL(output, output_size); + TEST_CALLOC(output, output_size); PSA_ASSERT(psa_crypto_init()); @@ -4694,7 +4694,7 @@ void derive_output(int alg_arg, expected_outputs[i] = NULL; } } - TEST_CALLOC_OR_FAIL(output_buffer, output_buffer_size); + TEST_CALLOC(output_buffer, output_buffer_size); PSA_ASSERT(psa_crypto_init()); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE); @@ -4931,8 +4931,8 @@ void derive_key_export(int alg_arg, psa_key_attributes_t derived_attributes = PSA_KEY_ATTRIBUTES_INIT; size_t length; - TEST_CALLOC_OR_FAIL(output_buffer, capacity); - TEST_CALLOC_OR_FAIL(export_buffer, capacity); + TEST_CALLOC(output_buffer, capacity); + TEST_CALLOC(export_buffer, capacity); PSA_ASSERT(psa_crypto_init()); psa_set_key_usage_flags(&base_attributes, PSA_KEY_USAGE_DERIVE); @@ -5128,7 +5128,7 @@ void raw_key_agreement(int alg_arg, PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE); /* Good case with exact output size */ - TEST_CALLOC_OR_FAIL(output, expected_output->len); + TEST_CALLOC(output, expected_output->len); PSA_ASSERT(psa_raw_key_agreement(alg, our_key, peer_key_data->x, peer_key_data->len, output, expected_output->len, @@ -5140,7 +5140,7 @@ void raw_key_agreement(int alg_arg, output_length = ~0; /* Larger buffer */ - TEST_CALLOC_OR_FAIL(output, expected_output->len + 1); + TEST_CALLOC(output, expected_output->len + 1); PSA_ASSERT(psa_raw_key_agreement(alg, our_key, peer_key_data->x, peer_key_data->len, output, expected_output->len + 1, @@ -5152,7 +5152,7 @@ void raw_key_agreement(int alg_arg, output_length = ~0; /* Buffer too small */ - TEST_CALLOC_OR_FAIL(output, expected_output->len - 1); + TEST_CALLOC(output, expected_output->len - 1); TEST_EQUAL(psa_raw_key_agreement(alg, our_key, peer_key_data->x, peer_key_data->len, output, expected_output->len - 1, @@ -5241,7 +5241,7 @@ void key_agreement_output(int alg_arg, psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; uint8_t *actual_output = NULL; - TEST_CALLOC_OR_FAIL(actual_output, MAX(expected_output1->len, + TEST_CALLOC(actual_output, MAX(expected_output1->len, expected_output2->len)); PSA_ASSERT(psa_crypto_init()); @@ -5297,8 +5297,8 @@ void generate_random(int bytes_arg) TEST_ASSERT(bytes_arg >= 0); - TEST_CALLOC_OR_FAIL(output, bytes); - TEST_CALLOC_OR_FAIL(changed, bytes); + TEST_CALLOC(output, bytes); + TEST_CALLOC(changed, bytes); PSA_ASSERT(psa_crypto_init()); @@ -5416,8 +5416,8 @@ void generate_key_rsa(int bits_arg, is_default_public_exponent = 1; e_read_size = 0; } - TEST_CALLOC_OR_FAIL(e_read_buffer, e_read_size); - TEST_CALLOC_OR_FAIL(exported, exported_size); + TEST_CALLOC(e_read_buffer, e_read_size); + TEST_CALLOC(exported, exported_size); PSA_ASSERT(psa_crypto_init()); @@ -5519,8 +5519,8 @@ void persistent_key_load_key_from_storage(data_t *data, size_t second_exported_length; if (usage_flags & PSA_KEY_USAGE_EXPORT) { - TEST_CALLOC_OR_FAIL(first_export, export_size); - TEST_CALLOC_OR_FAIL(second_export, export_size); + TEST_CALLOC(first_export, export_size); + TEST_CALLOC(second_export, export_size); } PSA_ASSERT(psa_crypto_init()); diff --git a/tests/suites/test_suite_psa_crypto_driver_wrappers.function b/tests/suites/test_suite_psa_crypto_driver_wrappers.function index f7c5c3354b..5ae04615a4 100644 --- a/tests/suites/test_suite_psa_crypto_driver_wrappers.function +++ b/tests/suites/test_suite_psa_crypto_driver_wrappers.function @@ -56,7 +56,7 @@ void sign_hash(int key_type_arg, TEST_ASSERT(signature_size != 0); TEST_ASSERT(signature_size <= PSA_SIGNATURE_MAX_SIZE); - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(signature, signature_size); actual_status = psa_sign_hash(key, alg, data_input->x, data_input->len, @@ -183,7 +183,7 @@ void sign_message(int key_type_arg, TEST_ASSERT(signature_size != 0); TEST_ASSERT(signature_size <= PSA_SIGNATURE_MAX_SIZE); - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(signature, signature_size); actual_status = psa_sign_message(key, alg, data_input->x, data_input->len, @@ -487,8 +487,8 @@ void cipher_encrypt_validation(int alg_arg, output1_buffer_size = PSA_CIPHER_ENCRYPT_OUTPUT_SIZE(key_type, alg, input->len); output2_buffer_size = PSA_CIPHER_UPDATE_OUTPUT_SIZE(key_type, alg, input->len) + PSA_CIPHER_FINISH_OUTPUT_SIZE(key_type, alg); - TEST_CALLOC_OR_FAIL(output1, output1_buffer_size); - TEST_CALLOC_OR_FAIL(output2, output2_buffer_size); + TEST_CALLOC(output1, output1_buffer_size); + TEST_CALLOC(output2, output2_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -605,7 +605,7 @@ void cipher_encrypt_multipart(int alg_arg, output_buffer_size = ((size_t) input->len + PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type)); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); if (mock_output_arg) { mbedtls_test_driver_cipher_hooks.forced_output = expected_output->x; @@ -733,7 +733,7 @@ void cipher_decrypt_multipart(int alg_arg, output_buffer_size = ((size_t) input->len + PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type)); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); if (mock_output_arg) { mbedtls_test_driver_cipher_hooks.forced_output = expected_output->x; @@ -832,13 +832,13 @@ void cipher_decrypt(int alg_arg, /* Allocate input buffer and copy the iv and the plaintext */ input_buffer_size = ((size_t) input_arg->len + (size_t) iv->len); if (input_buffer_size > 0) { - TEST_CALLOC_OR_FAIL(input, input_buffer_size); + TEST_CALLOC(input, input_buffer_size); memcpy(input, iv->x, iv->len); memcpy(input + iv->len, input_arg->x, input_arg->len); } output_buffer_size = PSA_CIPHER_DECRYPT_OUTPUT_SIZE(key_type, alg, input_buffer_size); - TEST_CALLOC_OR_FAIL(output, output_buffer_size); + TEST_CALLOC(output, output_buffer_size); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); @@ -885,7 +885,7 @@ void cipher_entry_points(int alg_arg, int key_type_arg, psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; mbedtls_test_driver_cipher_hooks = mbedtls_test_driver_cipher_hooks_init(); - TEST_CALLOC_OR_FAIL(output, input->len + 16); + TEST_CALLOC(output, input->len + 16); output_buffer_size = input->len + 16; PSA_ASSERT(psa_crypto_init()); @@ -1125,7 +1125,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, PSA_AEAD_ENCRYPT_OUTPUT_SIZE(key_type, alg, input_data->len)); TEST_ASSERT(output_size <= PSA_AEAD_ENCRYPT_OUTPUT_MAX_SIZE(input_data->len)); - TEST_CALLOC_OR_FAIL(output_data, output_size); + TEST_CALLOC(output_data, output_size); mbedtls_test_driver_aead_hooks.forced_status = forced_status; status = psa_aead_encrypt(key, alg, @@ -1187,7 +1187,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, output_size = input_data->len - PSA_AEAD_TAG_LENGTH(key_type, key_bits, alg); - TEST_CALLOC_OR_FAIL(output_data, output_size); + TEST_CALLOC(output_data, output_size); mbedtls_test_driver_aead_hooks.forced_status = forced_status; status = psa_aead_decrypt(key, alg, @@ -1250,7 +1250,7 @@ void mac_sign(int key_type_arg, PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, &key)); - TEST_CALLOC_OR_FAIL(actual_mac, mac_buffer_size); + TEST_CALLOC(actual_mac, mac_buffer_size); mbedtls_test_driver_mac_hooks.forced_status = forced_status; /* @@ -1470,7 +1470,7 @@ void builtin_key_export(int builtin_key_id_arg, psa_status_t actual_status; PSA_ASSERT(psa_crypto_init()); - TEST_CALLOC_OR_FAIL(output_buffer, expected_output->len); + TEST_CALLOC(output_buffer, expected_output->len); actual_status = psa_export_key(key, output_buffer, expected_output->len, &output_size); @@ -1521,7 +1521,7 @@ void builtin_pubkey_export(int builtin_key_id_arg, psa_status_t actual_status; PSA_ASSERT(psa_crypto_init()); - TEST_CALLOC_OR_FAIL(output_buffer, expected_output->len); + TEST_CALLOC(output_buffer, expected_output->len); actual_status = psa_export_public_key(key, output_buffer, expected_output->len, &output_size); @@ -1564,7 +1564,7 @@ void hash_compute(int alg_arg, mbedtls_test_driver_hash_hooks.forced_status = forced_status; PSA_ASSERT(psa_crypto_init()); - TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC(output, PSA_HASH_LENGTH(alg)); TEST_EQUAL(psa_hash_compute(alg, input->x, input->len, output, PSA_HASH_LENGTH(alg), @@ -1597,7 +1597,7 @@ void hash_multipart_setup(int alg_arg, size_t output_length; mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init(); - TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC(output, PSA_HASH_LENGTH(alg)); PSA_ASSERT(psa_crypto_init()); @@ -1642,7 +1642,7 @@ void hash_multipart_update(int alg_arg, size_t output_length; mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init(); - TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC(output, PSA_HASH_LENGTH(alg)); PSA_ASSERT(psa_crypto_init()); @@ -1697,7 +1697,7 @@ void hash_multipart_finish(int alg_arg, size_t output_length; mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init(); - TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC(output, PSA_HASH_LENGTH(alg)); PSA_ASSERT(psa_crypto_init()); @@ -1751,7 +1751,7 @@ void hash_clone(int alg_arg, size_t output_length; mbedtls_test_driver_hash_hooks = mbedtls_test_driver_hash_hooks_init(); - TEST_CALLOC_OR_FAIL(output, PSA_HASH_LENGTH(alg)); + TEST_CALLOC(output, PSA_HASH_LENGTH(alg)); PSA_ASSERT(psa_crypto_init()); diff --git a/tests/suites/test_suite_psa_crypto_entropy.function b/tests/suites/test_suite_psa_crypto_entropy.function index 6f65f8fd92..362b3da42a 100644 --- a/tests/suites/test_suite_psa_crypto_entropy.function +++ b/tests/suites/test_suite_psa_crypto_entropy.function @@ -114,8 +114,8 @@ void external_rng_failure_sign(int key_type, data_t *key_data, int alg, size_t signature_size = PSA_SIGNATURE_MAX_SIZE; size_t signature_length; - TEST_CALLOC_OR_FAIL(input, input_size); - TEST_CALLOC_OR_FAIL(signature, signature_size); + TEST_CALLOC(input, input_size); + TEST_CALLOC(signature, signature_size); PSA_ASSERT(psa_crypto_init()); PSA_ASSERT(psa_import_key(&attributes, key_data->x, key_data->len, @@ -163,7 +163,7 @@ void validate_entropy_seed_injection(int seed_length_a, } else { seed_size = seed_length_b; } - TEST_CALLOC_OR_FAIL(seed, seed_size); + TEST_CALLOC(seed, seed_size); /* fill seed with some data */ for (i = 0; i < seed_size; ++i) { seed[i] = i; diff --git a/tests/suites/test_suite_psa_crypto_init.function b/tests/suites/test_suite_psa_crypto_init.function index 78f80a13ae..63767f0202 100644 --- a/tests/suites/test_suite_psa_crypto_init.function +++ b/tests/suites/test_suite_psa_crypto_init.function @@ -289,7 +289,7 @@ void entropy_from_nv_seed(int seed_size_arg, uint8_t *seed = NULL; size_t seed_size = seed_size_arg; - TEST_CALLOC_OR_FAIL(seed, seed_size); + TEST_CALLOC(seed, seed_size); TEST_ASSERT(mbedtls_nv_seed_write(seed, seed_size) >= 0); custom_entropy_sources_mask = ENTROPY_SOURCE_NV_SEED; diff --git a/tests/suites/test_suite_psa_crypto_persistent_key.function b/tests/suites/test_suite_psa_crypto_persistent_key.function index 4b4b00d1df..f21875ff9a 100644 --- a/tests/suites/test_suite_psa_crypto_persistent_key.function +++ b/tests/suites/test_suite_psa_crypto_persistent_key.function @@ -61,7 +61,7 @@ void format_storage_data_check(data_t *key_data, psa_set_key_algorithm(&attributes, key_alg); psa_set_key_enrollment_algorithm(&attributes, key_alg2); - TEST_CALLOC_OR_FAIL(file_data, file_data_length); + TEST_CALLOC(file_data, file_data_length); psa_format_key_data_for_storage(key_data->x, key_data->len, &attributes.core, file_data); @@ -127,7 +127,7 @@ void save_large_persistent_key(int data_length_arg, int expected_status) size_t data_length = data_length_arg; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - TEST_CALLOC_OR_FAIL(data, data_length); + TEST_CALLOC(data, data_length); PSA_ASSERT(psa_crypto_init()); @@ -267,7 +267,7 @@ void import_export_persistent_key(data_t *data, int type_arg, size_t exported_length; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - TEST_CALLOC_OR_FAIL(exported, export_size); + TEST_CALLOC(exported, export_size); PSA_ASSERT(psa_crypto_init()); diff --git a/tests/suites/test_suite_psa_crypto_se_driver_hal.function b/tests/suites/test_suite_psa_crypto_se_driver_hal.function index a8977369db..bb00c06770 100644 --- a/tests/suites/test_suite_psa_crypto_se_driver_hal.function +++ b/tests/suites/test_suite_psa_crypto_se_driver_hal.function @@ -601,7 +601,7 @@ static int check_persistent_data(psa_key_location_t location, int ok = 0; PSA_ASSERT(psa_its_get_info(uid, &info)); - TEST_CALLOC_OR_FAIL(loaded, info.size); + TEST_CALLOC(loaded, info.size); PSA_ASSERT(psa_its_get(uid, 0, info.size, loaded, NULL)); TEST_BUFFERS_EQUAL(expected_data, size, loaded, info.size); ok = 1; diff --git a/tests/suites/test_suite_psa_crypto_slot_management.function b/tests/suites/test_suite_psa_crypto_slot_management.function index 6868c8854e..5f65fb92cd 100644 --- a/tests/suites/test_suite_psa_crypto_slot_management.function +++ b/tests/suites/test_suite_psa_crypto_slot_management.function @@ -303,7 +303,7 @@ void persistent_slot_lifecycle(int lifetime_arg, int owner_id_arg, int id_arg, psa_get_key_type(&read_attributes)); TEST_EQUAL(psa_get_key_bits(&attributes), psa_get_key_bits(&read_attributes)); - TEST_CALLOC_OR_FAIL(reexported, key_data->len); + TEST_CALLOC(reexported, key_data->len); if (usage_flags & PSA_KEY_USAGE_EXPORT) { PSA_ASSERT(psa_export_key(id, reexported, key_data->len, &reexported_length)); @@ -575,7 +575,7 @@ void copy_across_lifetimes(int source_lifetime_arg, int source_owner_id_arg, psa_get_key_enrollment_algorithm(&target_attributes)); if (expected_usage & PSA_KEY_USAGE_EXPORT) { size_t length; - TEST_CALLOC_OR_FAIL(export_buffer, material->len); + TEST_CALLOC(export_buffer, material->len); PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, material->len, &length)); TEST_BUFFERS_EQUAL(material->x, material->len, @@ -689,7 +689,7 @@ void copy_to_occupied(int source_lifetime_arg, int source_id_arg, psa_get_key_algorithm(&attributes2)); if (target_usage & PSA_KEY_USAGE_EXPORT) { size_t length; - TEST_CALLOC_OR_FAIL(export_buffer, target_material->len); + TEST_CALLOC(export_buffer, target_material->len); PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, target_material->len, &length)); TEST_BUFFERS_EQUAL(target_material->x, target_material->len, @@ -813,7 +813,7 @@ void many_transient_keys(int max_keys_arg) uint8_t exported[sizeof(size_t)]; size_t exported_length; - TEST_CALLOC_OR_FAIL(keys, max_keys); + TEST_CALLOC(keys, max_keys); PSA_ASSERT(psa_crypto_init()); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT); @@ -942,7 +942,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() TEST_ASSERT(MBEDTLS_PSA_KEY_SLOT_COUNT >= 1); - TEST_CALLOC_OR_FAIL(keys, MBEDTLS_PSA_KEY_SLOT_COUNT); + TEST_CALLOC(keys, MBEDTLS_PSA_KEY_SLOT_COUNT); PSA_ASSERT(psa_crypto_init()); psa_set_key_usage_flags(&attributes, diff --git a/tests/suites/test_suite_psa_crypto_storage_format.function b/tests/suites/test_suite_psa_crypto_storage_format.function index b68107cd73..9a03dd8f8c 100644 --- a/tests/suites/test_suite_psa_crypto_storage_format.function +++ b/tests/suites/test_suite_psa_crypto_storage_format.function @@ -36,7 +36,7 @@ static int test_written_key(const psa_key_attributes_t *attributes, /* Check that the key is represented as expected. */ PSA_ASSERT(psa_its_get_info(uid, &storage_info)); TEST_EQUAL(storage_info.size, expected_representation->len); - TEST_CALLOC_OR_FAIL(actual_representation, storage_info.size); + TEST_CALLOC(actual_representation, storage_info.size); PSA_ASSERT(psa_its_get(uid, 0, storage_info.size, actual_representation, &length)); TEST_BUFFERS_EQUAL(expected_representation->x, expected_representation->len, @@ -268,7 +268,7 @@ static int test_read_key(const psa_key_attributes_t *expected_attributes, TEST_EQUAL(psa_get_key_enrollment_algorithm(expected_attributes), psa_get_key_enrollment_algorithm(&actual_attributes)); if (can_export(expected_attributes)) { - TEST_CALLOC_OR_FAIL(exported_material, expected_material->len); + TEST_CALLOC(exported_material, expected_material->len); PSA_ASSERT(psa_export_key(key_id, exported_material, expected_material->len, &length)); diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index 5e86a0cc6c..267b2e52e0 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -92,7 +92,7 @@ void set_get_remove(int uid_arg, int flags_arg, data_t *data) unsigned char *buffer = NULL; size_t ret_len = 0; - TEST_CALLOC_OR_FAIL(buffer, data->len); + TEST_CALLOC(buffer, data->len); PSA_ASSERT(psa_its_set_wrap(uid, data->len, data->x, flags)); @@ -122,7 +122,7 @@ void set_overwrite(int uid_arg, unsigned char *buffer = NULL; size_t ret_len = 0; - TEST_CALLOC_OR_FAIL(buffer, MAX(data1->len, data2->len)); + TEST_CALLOC(buffer, MAX(data1->len, data2->len)); PSA_ASSERT(psa_its_set_wrap(uid, data1->len, data1->x, flags1)); PSA_ASSERT(psa_its_get_info(uid, &info)); @@ -214,7 +214,7 @@ void get_at(int uid_arg, data_t *data, size_t i; size_t ret_len = 0; - TEST_CALLOC_OR_FAIL(buffer, length + 16); + TEST_CALLOC(buffer, length + 16); trailer = buffer + length; memset(trailer, '-', 16); diff --git a/tests/suites/test_suite_random.function b/tests/suites/test_suite_random.function index f2da0ced22..dfc4e853b6 100644 --- a/tests/suites/test_suite_random.function +++ b/tests/suites/test_suite_random.function @@ -163,7 +163,7 @@ void mbedtls_psa_get_random_length(int n) unsigned char *output = NULL; PSA_ASSERT(psa_crypto_init()); - TEST_CALLOC_OR_FAIL(output, n); + TEST_CALLOC(output, n); TEST_EQUAL(0, mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, output, n)); diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 1dc2313da1..302939fc53 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -147,7 +147,7 @@ void test_callback_buffer(int size, int put1, int put1_ret, if (input_len == 0) { input_len = 1; } - TEST_CALLOC_OR_FAIL(input, input_len); + TEST_CALLOC(input, input_len); output_len = 0; for (j = 0; j < ROUNDS; j++) { @@ -161,7 +161,7 @@ void test_callback_buffer(int size, int put1, int put1_ret, if (output_len == 0) { output_len = 1; } - TEST_CALLOC_OR_FAIL(output, output_len); + TEST_CALLOC(output, output_len); /* Fill up the buffer with structured data so that unwanted changes * can be detected */ @@ -1516,8 +1516,8 @@ void ssl_decrypt_non_etm_cbc(int cipher_type, int hash_id, int trunc_hmac, + plaintext_len + t0.maclen + padlen + 1; - TEST_CALLOC_OR_FAIL(buf, buflen); - TEST_CALLOC_OR_FAIL(buf_save, buflen); + TEST_CALLOC(buf, buflen); + TEST_CALLOC(buf_save, buflen); /* Prepare a dummy record header */ memset(rec.ctr, 0, sizeof(rec.ctr)); From cd5a7c76f2885a1ddad839fdca007690596c9d17 Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Fri, 21 Jul 2023 11:34:44 +0100 Subject: [PATCH 126/135] Rename the length argument to TEST_CALLOC() to be the more accurate item_count Signed-off-by: Tom Cosgrove --- tests/include/test/macros.h | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h index 83b2a076a8..7c5ebf95ab 100644 --- a/tests/include/test/macros.h +++ b/tests/include/test/macros.h @@ -127,52 +127,52 @@ * The allocated memory will be filled with zeros. * * You must set \p pointer to \c NULL before calling this macro and - * put `mbedtls_free( pointer )` in the test's cleanup code. + * put `mbedtls_free(pointer)` in the test's cleanup code. * - * If \p length is zero, the resulting \p pointer will be \c NULL. + * If \p item_count is zero, the resulting \p pointer will be \c NULL. * This is usually what we want in tests since API functions are * supposed to accept null pointers when a buffer size is zero. * * This macro expands to an instruction, not an expression. * It may jump to the \c exit label. * - * \param pointer An lvalue where the address of the allocated buffer - * will be stored. - * This expression may be evaluated multiple times. - * \param length Number of elements to allocate. - * This expression may be evaluated multiple times. + * \param pointer An lvalue where the address of the allocated buffer + * will be stored. + * This expression may be evaluated multiple times. + * \param item_count Number of elements to allocate. + * This expression may be evaluated multiple times. * */ -#define TEST_CALLOC(pointer, length) \ +#define TEST_CALLOC(pointer, item_count) \ do { \ TEST_ASSERT((pointer) == NULL); \ - if ((length) != 0) { \ + if ((item_count) != 0) { \ (pointer) = mbedtls_calloc(sizeof(*(pointer)), \ - (length)); \ + (item_count)); \ TEST_ASSERT((pointer) != NULL); \ } \ } while (0) /* For backwards compatibility */ -#define ASSERT_ALLOC(pointer, length) TEST_CALLOC(pointer, length) +#define ASSERT_ALLOC(pointer, item_count) TEST_CALLOC(pointer, item_count) /** Allocate memory dynamically. If the allocation fails, skip the test case. * * This macro behaves like #TEST_CALLOC, except that if the allocation * fails, it marks the test as skipped rather than failed. */ -#define TEST_CALLOC_OR_SKIP(pointer, length) \ +#define TEST_CALLOC_OR_SKIP(pointer, item_count) \ do { \ TEST_ASSERT((pointer) == NULL); \ - if ((length) != 0) { \ + if ((item_count) != 0) { \ (pointer) = mbedtls_calloc(sizeof(*(pointer)), \ - (length)); \ + (item_count)); \ TEST_ASSUME((pointer) != NULL); \ } \ } while (0) /* For backwards compatibility */ -#define ASSERT_ALLOC_WEAK(pointer, length) TEST_CALLOC_OR_SKIP(pointer, length) +#define ASSERT_ALLOC_WEAK(pointer, item_count) TEST_CALLOC_OR_SKIP(pointer, item_count) /** Compare two buffers and fail the test case if they differ. * From ba3b14dad99dc4d174443d9d2c468d86b0c3df7a Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Mon, 4 Sep 2023 11:23:02 +0100 Subject: [PATCH 127/135] For tests, rename TEST_BUFFERS_EQUAL() to TEST_MEMORY_COMPARE() Signed-off-by: Tom Cosgrove --- tests/include/test/macros.h | 4 +- tests/suites/test_suite_aes.function | 2 +- tests/suites/test_suite_aria.function | 16 +- tests/suites/test_suite_asn1write.function | 12 +- tests/suites/test_suite_chacha20.function | 6 +- tests/suites/test_suite_cipher.function | 4 +- .../suites/test_suite_constant_time.function | 2 +- .../test_suite_constant_time_hmac.function | 2 +- tests/suites/test_suite_ecp.function | 8 +- tests/suites/test_suite_hkdf.function | 6 +- tests/suites/test_suite_md.function | 20 +-- tests/suites/test_suite_mps.function | 164 +++++++++--------- tests/suites/test_suite_pkcs12.function | 2 +- tests/suites/test_suite_pkcs1_v21.function | 8 +- tests/suites/test_suite_pkwrite.function | 6 +- .../test_suite_platform_printf.function | 6 +- tests/suites/test_suite_poly1305.function | 8 +- tests/suites/test_suite_psa_crypto.function | 74 ++++---- ..._suite_psa_crypto_driver_wrappers.function | 36 ++-- .../test_suite_psa_crypto_hash.function | 6 +- ...t_suite_psa_crypto_persistent_key.function | 6 +- ...st_suite_psa_crypto_se_driver_hal.function | 4 +- ..._suite_psa_crypto_slot_management.function | 18 +- ...t_suite_psa_crypto_storage_format.function | 4 +- tests/suites/test_suite_psa_its.function | 10 +- tests/suites/test_suite_ssl.function | 14 +- 26 files changed, 224 insertions(+), 224 deletions(-) diff --git a/tests/include/test/macros.h b/tests/include/test/macros.h index 7c5ebf95ab..f94288999d 100644 --- a/tests/include/test/macros.h +++ b/tests/include/test/macros.h @@ -186,7 +186,7 @@ * \param size2 Size of the second buffer in bytes. * This expression may be evaluated multiple times. */ -#define TEST_BUFFERS_EQUAL(p1, size1, p2, size2) \ +#define TEST_MEMORY_COMPARE(p1, size1, p2, size2) \ do { \ TEST_EQUAL((size1), (size2)); \ if ((size1) != 0) { \ @@ -195,7 +195,7 @@ } while (0) /* For backwards compatibility */ -#define ASSERT_COMPARE(p1, size1, p2, size2) TEST_BUFFERS_EQUAL(p1, size1, p2, size2) +#define ASSERT_COMPARE(p1, size1, p2, size2) TEST_MEMORY_COMPARE(p1, size1, p2, size2) /** * \brief This macro tests the expression passed to it and skips the diff --git a/tests/suites/test_suite_aes.function b/tests/suites/test_suite_aes.function index ead883e370..b159e1a15c 100644 --- a/tests/suites/test_suite_aes.function +++ b/tests/suites/test_suite_aes.function @@ -34,7 +34,7 @@ static int test_ctx_alignment(const data_t *key, // Decrypt TEST_ASSERT(mbedtls_aes_crypt_ecb(dec, MBEDTLS_AES_DECRYPT, ciphertext, output) == 0); - TEST_BUFFERS_EQUAL(plaintext, 16, output, 16); + TEST_MEMORY_COMPARE(plaintext, 16, output, 16); mbedtls_aes_free(dec); diff --git a/tests/suites/test_suite_aria.function b/tests/suites/test_suite_aria.function index 8b5eac1c97..7baabfa063 100644 --- a/tests/suites/test_suite_aria.function +++ b/tests/suites/test_suite_aria.function @@ -224,7 +224,7 @@ void aria_encrypt_ecb(data_t *key_str, data_t *src_str, output + i) == 0); } - TEST_BUFFERS_EQUAL(output, expected_output->len, + TEST_MEMORY_COMPARE(output, expected_output->len, expected_output->x, expected_output->len); } @@ -252,7 +252,7 @@ void aria_decrypt_ecb(data_t *key_str, data_t *src_str, output + i) == 0); } - TEST_BUFFERS_EQUAL(output, expected_output->len, + TEST_MEMORY_COMPARE(output, expected_output->len, expected_output->x, expected_output->len); } @@ -277,7 +277,7 @@ void aria_encrypt_cbc(data_t *key_str, data_t *iv_str, src_str->len, iv_str->x, src_str->x, output) == cbc_result); if (cbc_result == 0) { - TEST_BUFFERS_EQUAL(output, expected_output->len, + TEST_MEMORY_COMPARE(output, expected_output->len, expected_output->x, expected_output->len); } @@ -302,7 +302,7 @@ void aria_decrypt_cbc(data_t *key_str, data_t *iv_str, src_str->len, iv_str->x, src_str->x, output) == cbc_result); if (cbc_result == 0) { - TEST_BUFFERS_EQUAL(output, expected_output->len, + TEST_MEMORY_COMPARE(output, expected_output->len, expected_output->x, expected_output->len); } @@ -329,7 +329,7 @@ void aria_encrypt_cfb128(data_t *key_str, data_t *iv_str, iv_str->x, src_str->x, output) == result); - TEST_BUFFERS_EQUAL(output, expected_output->len, + TEST_MEMORY_COMPARE(output, expected_output->len, expected_output->x, expected_output->len); exit: @@ -355,7 +355,7 @@ void aria_decrypt_cfb128(data_t *key_str, data_t *iv_str, iv_str->x, src_str->x, output) == result); - TEST_BUFFERS_EQUAL(output, expected_output->len, + TEST_MEMORY_COMPARE(output, expected_output->len, expected_output->x, expected_output->len); exit: @@ -381,7 +381,7 @@ void aria_encrypt_ctr(data_t *key_str, data_t *iv_str, iv_str->x, blk, src_str->x, output) == result); - TEST_BUFFERS_EQUAL(output, expected_output->len, + TEST_MEMORY_COMPARE(output, expected_output->len, expected_output->x, expected_output->len); exit: @@ -407,7 +407,7 @@ void aria_decrypt_ctr(data_t *key_str, data_t *iv_str, iv_str->x, blk, src_str->x, output) == result); - TEST_BUFFERS_EQUAL(output, expected_output->len, + TEST_MEMORY_COMPARE(output, expected_output->len, expected_output->x, expected_output->len); exit: diff --git a/tests/suites/test_suite_asn1write.function b/tests/suites/test_suite_asn1write.function index 583ddc9fe5..4b0345f1e1 100644 --- a/tests/suites/test_suite_asn1write.function +++ b/tests/suites/test_suite_asn1write.function @@ -37,7 +37,7 @@ int generic_write_finish_step(generic_write_data_t *data, TEST_EQUAL(ret, data->end - data->p); TEST_ASSERT(data->p >= data->start); TEST_ASSERT(data->p <= data->end); - TEST_BUFFERS_EQUAL(data->p, (size_t) (data->end - data->p), + TEST_MEMORY_COMPARE(data->p, (size_t) (data->end - data->p), expected->x, expected->len); } ok = 1; @@ -322,7 +322,7 @@ void mbedtls_asn1_write_algorithm_identifier(data_t *oid, TEST_EQUAL(mbedtls_asn1_get_alg(&p, end_complete, &alg, ¶ms), 0); TEST_EQUAL(alg.tag, MBEDTLS_ASN1_OID); - TEST_BUFFERS_EQUAL(alg.p, alg.len, oid->x, oid->len); + TEST_MEMORY_COMPARE(alg.p, alg.len, oid->x, oid->len); TEST_EQUAL(params.tag, expected_params_tag); TEST_EQUAL(params.len, expected_params_len); mbedtls_free(buf_complete); @@ -440,7 +440,7 @@ void test_asn1_write_bitstrings(data_t *bitstring, int bits, mbedtls_asn1_bitstring read = { 0, 0, NULL }; TEST_EQUAL(mbedtls_asn1_get_bitstring(&data.p, data.end, &read), 0); - TEST_BUFFERS_EQUAL(read.p, read.len, + TEST_MEMORY_COMPARE(read.p, read.len, masked_bitstring, byte_length); TEST_EQUAL(read.unused_bits, 8 * byte_length - value_bits); } @@ -545,7 +545,7 @@ void store_named_data_val_found(int old_len, int new_len) TEST_ASSERT(found == head); if (new_val != NULL) { - TEST_BUFFERS_EQUAL(found->val.p, found->val.len, + TEST_MEMORY_COMPARE(found->val.p, found->val.len, new_val, (size_t) new_len); } if (new_len == 0) { @@ -580,14 +580,14 @@ void store_named_data_val_new(int new_len, int set_new_val) TEST_ASSERT(found != NULL); TEST_ASSERT(found == head); TEST_ASSERT(found->oid.p != oid); - TEST_BUFFERS_EQUAL(found->oid.p, found->oid.len, oid, oid_len); + TEST_MEMORY_COMPARE(found->oid.p, found->oid.len, oid, oid_len); if (new_len == 0) { TEST_ASSERT(found->val.p == NULL); } else if (new_val == NULL) { TEST_ASSERT(found->val.p != NULL); } else { TEST_ASSERT(found->val.p != new_val); - TEST_BUFFERS_EQUAL(found->val.p, found->val.len, + TEST_MEMORY_COMPARE(found->val.p, found->val.len, new_val, (size_t) new_len); } diff --git a/tests/suites/test_suite_chacha20.function b/tests/suites/test_suite_chacha20.function index 5d7d0891c1..66f01f4b0d 100644 --- a/tests/suites/test_suite_chacha20.function +++ b/tests/suites/test_suite_chacha20.function @@ -29,7 +29,7 @@ void chacha20_crypt(data_t *key_str, TEST_ASSERT(mbedtls_chacha20_crypt(key_str->x, nonce_str->x, counter, src_str->len, src_str->x, output) == 0); - TEST_BUFFERS_EQUAL(output, expected_output_str->len, + TEST_MEMORY_COMPARE(output, expected_output_str->len, expected_output_str->x, expected_output_str->len); /* @@ -44,7 +44,7 @@ void chacha20_crypt(data_t *key_str, memset(output, 0x00, sizeof(output)); TEST_ASSERT(mbedtls_chacha20_update(&ctx, src_str->len, src_str->x, output) == 0); - TEST_BUFFERS_EQUAL(output, expected_output_str->len, + TEST_MEMORY_COMPARE(output, expected_output_str->len, expected_output_str->x, expected_output_str->len); /* @@ -60,7 +60,7 @@ void chacha20_crypt(data_t *key_str, TEST_ASSERT(mbedtls_chacha20_update(&ctx, src_str->len - 1, src_str->x + 1, output + 1) == 0); - TEST_BUFFERS_EQUAL(output, expected_output_str->len, + TEST_MEMORY_COMPARE(output, expected_output_str->len, expected_output_str->x, expected_output_str->len); mbedtls_chacha20_free(&ctx); diff --git a/tests/suites/test_suite_cipher.function b/tests/suites/test_suite_cipher.function index fffc5139a6..9235e3db6a 100644 --- a/tests/suites/test_suite_cipher.function +++ b/tests/suites/test_suite_cipher.function @@ -1274,7 +1274,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, TEST_ASSERT(buffer_is_all_zero(decrypt_buf, decrypt_buf_len)); } else { TEST_ASSERT(ret == 0); - TEST_BUFFERS_EQUAL(decrypt_buf, outlen, clear->x, clear->len); + TEST_MEMORY_COMPARE(decrypt_buf, outlen, clear->x, clear->len); } /* Free this, but keep cipher_plus_tag for deprecated function with PSA */ @@ -1390,7 +1390,7 @@ void auth_crypt_tv(int cipher_id, data_t *key, data_t *iv, } else { /* authentic message: is the plaintext correct? */ TEST_ASSERT(ret == 0); - TEST_BUFFERS_EQUAL(decrypt_buf, outlen, clear->x, clear->len); + TEST_MEMORY_COMPARE(decrypt_buf, outlen, clear->x, clear->len); } mbedtls_free(decrypt_buf); diff --git a/tests/suites/test_suite_constant_time.function b/tests/suites/test_suite_constant_time.function index bbd8382756..3f91a7d1ff 100644 --- a/tests/suites/test_suite_constant_time.function +++ b/tests/suites/test_suite_constant_time.function @@ -38,7 +38,7 @@ void ssl_cf_memcpy_offset(int offset_min, int offset_max, int len) TEST_CF_PUBLIC(&secret, sizeof(secret)); TEST_CF_PUBLIC(dst, len); - TEST_BUFFERS_EQUAL(dst, len, src + secret, len); + TEST_MEMORY_COMPARE(dst, len, src + secret, len); } exit: diff --git a/tests/suites/test_suite_constant_time_hmac.function b/tests/suites/test_suite_constant_time_hmac.function index 2cc5005407..45f0c01c61 100644 --- a/tests/suites/test_suite_constant_time_hmac.function +++ b/tests/suites/test_suite_constant_time_hmac.function @@ -84,7 +84,7 @@ void ssl_cf_hmac(int hash) TEST_EQUAL(0, mbedtls_md_hmac_reset(&ref_ctx)); /* Compare */ - TEST_BUFFERS_EQUAL(out, out_len, ref_out, out_len); + TEST_MEMORY_COMPARE(out, out_len, ref_out, out_len); } mbedtls_free(data); diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function index 39c9ddee01..225572ad11 100644 --- a/tests/suites/test_suite_ecp.function +++ b/tests/suites/test_suite_ecp.function @@ -852,7 +852,7 @@ void ecp_muladd(int id, &len, actual_result, sizeof(actual_result))); TEST_ASSERT(len <= MBEDTLS_ECP_MAX_PT_LEN); - TEST_BUFFERS_EQUAL(expected_result->x, expected_result->len, + TEST_MEMORY_COMPARE(expected_result->x, expected_result->len, actual_result, len); exit: @@ -1356,7 +1356,7 @@ void mbedtls_ecp_read_key(int grp_id, data_t *in_key, int expected, int canonica ret = mbedtls_ecp_write_key(&key, buf, in_key->len); TEST_ASSERT(ret == 0); - TEST_BUFFERS_EQUAL(in_key->x, in_key->len, + TEST_MEMORY_COMPARE(in_key->x, in_key->len, buf, in_key->len); } else { unsigned char export1[MBEDTLS_ECP_MAX_BYTES]; @@ -1371,7 +1371,7 @@ void mbedtls_ecp_read_key(int grp_id, data_t *in_key, int expected, int canonica ret = mbedtls_ecp_write_key(&key2, export2, in_key->len); TEST_ASSERT(ret == 0); - TEST_BUFFERS_EQUAL(export1, in_key->len, + TEST_MEMORY_COMPARE(export1, in_key->len, export2, in_key->len); } } @@ -1448,7 +1448,7 @@ void genkey_mx_known_answer(int bits, data_t *seed, data_t *expected) * (can be enforced by checking these bits). * - Other bits must be random (by testing with different RNG outputs, * we validate that those bits are indeed influenced by the RNG). */ - TEST_BUFFERS_EQUAL(expected->x, expected->len, + TEST_MEMORY_COMPARE(expected->x, expected->len, actual, expected->len); } diff --git a/tests/suites/test_suite_hkdf.function b/tests/suites/test_suite_hkdf.function index f52108ecdb..a729847e7a 100644 --- a/tests/suites/test_suite_hkdf.function +++ b/tests/suites/test_suite_hkdf.function @@ -24,7 +24,7 @@ void test_hkdf(int md_alg, data_t *ikm, data_t *salt, data_t *info, info->x, info->len, okm, expected_okm->len); TEST_ASSERT(ret == 0); - TEST_BUFFERS_EQUAL(okm, expected_okm->len, + TEST_MEMORY_COMPARE(okm, expected_okm->len, expected_okm->x, expected_okm->len); } /* END_CASE */ @@ -53,7 +53,7 @@ void test_hkdf_extract(int md_alg, char *hex_ikm_string, ret = mbedtls_hkdf_extract(md, salt, salt_len, ikm, ikm_len, output_prk); TEST_ASSERT(ret == 0); - TEST_BUFFERS_EQUAL(output_prk, output_prk_len, prk, prk_len); + TEST_MEMORY_COMPARE(output_prk, output_prk_len, prk, prk_len); exit: mbedtls_free(ikm); @@ -89,7 +89,7 @@ void test_hkdf_expand(int md_alg, char *hex_info_string, ret = mbedtls_hkdf_expand(md, prk, prk_len, info, info_len, output_okm, OKM_LEN); TEST_ASSERT(ret == 0); - TEST_BUFFERS_EQUAL(output_okm, okm_len, okm, okm_len); + TEST_MEMORY_COMPARE(output_okm, okm_len, okm, okm_len); exit: mbedtls_free(info); diff --git a/tests/suites/test_suite_md.function b/tests/suites/test_suite_md.function index 0ad6e96a19..308eaa18aa 100644 --- a/tests/suites/test_suite_md.function +++ b/tests/suites/test_suite_md.function @@ -139,7 +139,7 @@ void md_text(int md_type, char *text_src_string, data_t *hash) TEST_EQUAL(0, mbedtls_md(md_info, src, src_len, output)); - TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); } /* END_CASE */ @@ -155,7 +155,7 @@ void md_hex(int md_type, data_t *src_str, data_t *hash) TEST_EQUAL(0, mbedtls_md(md_info, src_str->x, src_str->len, output)); - TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); } /* END_CASE */ @@ -188,14 +188,14 @@ void md_text_multi(int md_type, char *text_src_string, TEST_EQUAL(0, mbedtls_md_update(&ctx, src + halfway, src_len - halfway)); TEST_EQUAL(0, mbedtls_md_finish(&ctx, output)); - TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); /* Test clone */ memset(output, 0x00, sizeof(output)); TEST_EQUAL(0, mbedtls_md_update(&ctx_copy, src + halfway, src_len - halfway)); TEST_EQUAL(0, mbedtls_md_finish(&ctx_copy, output)); - TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); exit: mbedtls_md_free(&ctx); @@ -228,14 +228,14 @@ void md_hex_multi(int md_type, data_t *src_str, data_t *hash) TEST_EQUAL(0, mbedtls_md_update(&ctx, src_str->x + halfway, src_str->len - halfway)); TEST_EQUAL(0, mbedtls_md_finish(&ctx, output)); - TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); /* Test clone */ memset(output, 0x00, sizeof(output)); TEST_EQUAL(0, mbedtls_md_update(&ctx_copy, src_str->x + halfway, src_str->len - halfway)); TEST_EQUAL(0, mbedtls_md_finish(&ctx_copy, output)); - TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); exit: mbedtls_md_free(&ctx); @@ -258,7 +258,7 @@ void mbedtls_md_hmac(int md_type, int trunc_size, TEST_EQUAL(0, mbedtls_md_hmac(md_info, key_str->x, key_str->len, src_str->x, src_str->len, output)); - TEST_BUFFERS_EQUAL(output, trunc_size, hash->x, hash->len); + TEST_MEMORY_COMPARE(output, trunc_size, hash->x, hash->len); } /* END_CASE */ @@ -285,7 +285,7 @@ void md_hmac_multi(int md_type, int trunc_size, data_t *key_str, TEST_EQUAL(0, mbedtls_md_hmac_update(&ctx, src_str->x + halfway, src_str->len - halfway)); TEST_EQUAL(0, mbedtls_md_hmac_finish(&ctx, output)); - TEST_BUFFERS_EQUAL(output, trunc_size, hash->x, hash->len); + TEST_MEMORY_COMPARE(output, trunc_size, hash->x, hash->len); /* Test again, for reset() */ memset(output, 0x00, sizeof(output)); @@ -295,7 +295,7 @@ void md_hmac_multi(int md_type, int trunc_size, data_t *key_str, TEST_EQUAL(0, mbedtls_md_hmac_update(&ctx, src_str->x + halfway, src_str->len - halfway)); TEST_EQUAL(0, mbedtls_md_hmac_finish(&ctx, output)); - TEST_BUFFERS_EQUAL(output, trunc_size, hash->x, hash->len); + TEST_MEMORY_COMPARE(output, trunc_size, hash->x, hash->len); exit: mbedtls_md_free(&ctx); @@ -314,6 +314,6 @@ void mbedtls_md_file(int md_type, char *filename, TEST_EQUAL(0, mbedtls_md_file(md_info, filename, output)); - TEST_BUFFERS_EQUAL(output, mbedtls_md_get_size(md_info), hash->x, hash->len); + TEST_MEMORY_COMPARE(output, mbedtls_md_get_size(md_info), hash->x, hash->len); } /* END_CASE */ diff --git a/tests/suites/test_suite_mps.function b/tests/suites/test_suite_mps.function index ecb7e31aa6..1bc1b3ece1 100644 --- a/tests/suites/test_suite_mps.function +++ b/tests/suites/test_suite_mps.function @@ -60,7 +60,7 @@ void mbedtls_mps_reader_no_pausing_single_step_single_round(int with_acc) /* Consumption (upper layer) */ /* Consume exactly what's available */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 100, bufA, 100); + TEST_MEMORY_COMPARE(tmp, 100, bufA, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup (lower layer) */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, &paused) == 0); @@ -108,14 +108,14 @@ void mbedtls_mps_reader_no_pausing_single_step_multiple_rounds(int with_acc) /* Consumption (upper layer) */ /* Consume exactly what's available */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 100, bufA, 100); + TEST_MEMORY_COMPARE(tmp, 100, bufA, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Preparation */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufB, sizeof(bufB)) == 0); /* Consumption */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 100, bufB, 100); + TEST_MEMORY_COMPARE(tmp, 100, bufB, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup (lower layer) */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); @@ -162,11 +162,11 @@ void mbedtls_mps_reader_no_pausing_multiple_steps_single_round(int with_acc) TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, buf, 10); + TEST_MEMORY_COMPARE(tmp, 10, buf, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 70, buf + 10, 70); + TEST_MEMORY_COMPARE(tmp, 70, buf + 10, 70); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, &tmp_len) == 0); - TEST_BUFFERS_EQUAL(tmp, tmp_len, buf + 80, 20); + TEST_MEMORY_COMPARE(tmp, tmp_len, buf + 80, 20); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup (lower layer) */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); @@ -202,18 +202,18 @@ void mbedtls_mps_reader_no_pausing_multiple_steps_multiple_rounds(int with_acc) TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufA, sizeof(bufA)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 70, bufA + 10, 70); + TEST_MEMORY_COMPARE(tmp, 70, bufA + 10, 70); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, &tmp_len) == 0); - TEST_BUFFERS_EQUAL(tmp, tmp_len, bufA + 80, 20); + TEST_MEMORY_COMPARE(tmp, tmp_len, bufA + 80, 20); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Preparation */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); TEST_ASSERT(mbedtls_mps_reader_feed(&rd, bufB, sizeof(bufB)) == 0); /* Consumption */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 100, bufB, 100); + TEST_MEMORY_COMPARE(tmp, 100, bufB, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); @@ -243,7 +243,7 @@ void mbedtls_mps_reader_pausing_needed_disabled() TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 50, buf, 50); + TEST_MEMORY_COMPARE(tmp, 50, buf, 50); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -284,10 +284,10 @@ void mbedtls_mps_reader_pausing_needed_buffer_too_small() TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 50, buf, 50); + TEST_MEMORY_COMPARE(tmp, 50, buf, 50); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, buf + 50, 10); + TEST_MEMORY_COMPARE(tmp, 10, buf + 50, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); /* Wrapup (lower layer) */ @@ -295,7 +295,7 @@ void mbedtls_mps_reader_pausing_needed_buffer_too_small() MBEDTLS_ERR_MPS_READER_ACCUMULATOR_TOO_SMALL); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, &tmp_len) == 0); - TEST_BUFFERS_EQUAL(tmp, tmp_len, buf + 50, 50); + TEST_MEMORY_COMPARE(tmp, tmp_len, buf + 50, 50); mbedtls_mps_reader_free(&rd); } @@ -325,7 +325,7 @@ void mbedtls_mps_reader_reclaim_overflow() TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 50, buf, 50); + TEST_MEMORY_COMPARE(tmp, 50, buf, 50); /* Excess request */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, (mbedtls_mps_size_t) -1, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -376,10 +376,10 @@ void mbedtls_mps_reader_pausing(int option) /* Consumption (upper layer) */ /* Ask for more than what's available. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 80, bufA, 80); + TEST_MEMORY_COMPARE(tmp, 80, bufA, 80); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); switch (option) { case 0: /* Single uncommitted fetch at pausing */ case 1: @@ -400,50 +400,50 @@ void mbedtls_mps_reader_pausing(int option) switch (option) { case 0: /* Single fetch at pausing, re-fetch with commit. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); break; case 1: /* Single fetch at pausing, re-fetch without commit. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); break; case 2: /* Multiple fetches at pausing, repeat without commit. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); break; case 3: /* Multiple fetches at pausing, repeat with commit 1. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); break; case 4: /* Multiple fetches at pausing, repeat with commit 2. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); break; case 5: /* Multiple fetches at pausing, repeat with commit 3. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); break; @@ -453,7 +453,7 @@ void mbedtls_mps_reader_pausing(int option) /* In all cases, fetch the rest of the second buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 90, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 90, bufB + 10, 90); + TEST_MEMORY_COMPARE(tmp, 90, bufB + 10, 90); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ @@ -498,7 +498,7 @@ void mbedtls_mps_reader_pausing_multiple_feeds(int option) /* Consumption (upper layer) */ /* Ask for more than what's available. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 80, bufA, 80); + TEST_MEMORY_COMPARE(tmp, 80, bufA, 80); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* 20 left, ask for 70 -> 50 overhead */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == @@ -538,8 +538,8 @@ void mbedtls_mps_reader_pausing_multiple_feeds(int option) /* Consumption */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 70, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 20, bufA + 80, 20); - TEST_BUFFERS_EQUAL(tmp + 20, 50, bufB, 50); + TEST_MEMORY_COMPARE(tmp, 20, bufA + 80, 20); + TEST_MEMORY_COMPARE(tmp + 20, 50, bufB, 50); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 1000, &tmp, &fetch_len) == 0); switch (option) { case 0: @@ -591,14 +591,14 @@ void mbedtls_mps_reader_reclaim_data_left(int option) /* Fetch (but not commit) the entire buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf), &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 100, buf, 100); + TEST_MEMORY_COMPARE(tmp, 100, buf, 100); break; case 1: /* Fetch (but not commit) parts of the buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2); + TEST_MEMORY_COMPARE(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2); break; case 2: @@ -606,11 +606,11 @@ void mbedtls_mps_reader_reclaim_data_left(int option) * fetch but not commit the rest of the buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2); + TEST_MEMORY_COMPARE(tmp, sizeof(buf) / 2, buf, sizeof(buf) / 2); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, sizeof(buf) / 2, + TEST_MEMORY_COMPARE(tmp, sizeof(buf) / 2, buf + sizeof(buf) / 2, sizeof(buf) / 2); break; @@ -646,16 +646,16 @@ void mbedtls_mps_reader_reclaim_data_left_retry() TEST_ASSERT(mbedtls_mps_reader_feed(&rd, buf, sizeof(buf)) == 0); /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 50, buf, 50); + TEST_MEMORY_COMPARE(tmp, 50, buf, 50); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 50, buf + 50, 50); + TEST_MEMORY_COMPARE(tmp, 50, buf + 50, 50); /* Preparation */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == MBEDTLS_ERR_MPS_READER_DATA_LEFT); /* Consumption */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 50, buf + 50, 50); + TEST_MEMORY_COMPARE(tmp, 50, buf + 50, 50); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ TEST_ASSERT(mbedtls_mps_reader_reclaim(&rd, NULL) == 0); @@ -699,10 +699,10 @@ void mbedtls_mps_reader_multiple_pausing(int option) /* Consumption (upper layer) */ /* Ask for more than what's available. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 80, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 80, bufA, 80); + TEST_MEMORY_COMPARE(tmp, 80, bufA, 80); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -717,10 +717,10 @@ void mbedtls_mps_reader_multiple_pausing(int option) /* Consume */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, &tmp_len) == 0); - TEST_BUFFERS_EQUAL(tmp, tmp_len, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, tmp_len, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -731,18 +731,18 @@ void mbedtls_mps_reader_multiple_pausing(int option) /* Consume */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufB + 10, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufC, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufB + 10, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufC, 10); break; case 1: /* Fetch same chunks, commit afterwards, and * then exceed bounds of new buffer; accumulator * not large enough. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 51, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -756,10 +756,10 @@ void mbedtls_mps_reader_multiple_pausing(int option) * then exceed bounds of new buffer; accumulator * large enough. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -769,19 +769,19 @@ void mbedtls_mps_reader_multiple_pausing(int option) /* Consume */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 50, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 20, bufA + 80, 20); - TEST_BUFFERS_EQUAL(tmp + 20, 20, bufB, 20); - TEST_BUFFERS_EQUAL(tmp + 40, 10, bufC, 10); + TEST_MEMORY_COMPARE(tmp, 20, bufA + 80, 20); + TEST_MEMORY_COMPARE(tmp + 20, 20, bufB, 20); + TEST_MEMORY_COMPARE(tmp + 40, 10, bufC, 10); break; case 3: /* Fetch same chunks, don't commit afterwards, and * then exceed bounds of new buffer; accumulator * not large enough. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 80, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 80, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 20, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 10, bufA + 90, 10); - TEST_BUFFERS_EQUAL(tmp + 10, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 10, bufA + 90, 10); + TEST_MEMORY_COMPARE(tmp + 10, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 21, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_OUT_OF_DATA); @@ -1005,16 +1005,16 @@ void mbedtls_reader_inconsistent_usage(int option) case 0: /* Ask for buffered data in a single chunk, no commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 20, bufA + 80, 20); - TEST_BUFFERS_EQUAL(tmp + 20, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 20, bufA + 80, 20); + TEST_MEMORY_COMPARE(tmp + 20, 10, bufB, 10); success = 1; break; case 1: /* Ask for buffered data in a single chunk, with commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 30, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 20, bufA + 80, 20); - TEST_BUFFERS_EQUAL(tmp + 20, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 20, bufA + 80, 20); + TEST_MEMORY_COMPARE(tmp + 20, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); success = 1; break; @@ -1035,7 +1035,7 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data in different * chunks than before CAN fail. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); + TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 10, &tmp, NULL) == MBEDTLS_ERR_MPS_READER_INCONSISTENT_REQUESTS); break; @@ -1044,10 +1044,10 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data different chunks * than before NEED NOT fail - no commits */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); + TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 5, bufA + 95, 5); - TEST_BUFFERS_EQUAL(tmp + 5, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 5, bufA + 95, 5); + TEST_MEMORY_COMPARE(tmp + 5, 10, bufB, 10); success = 1; break; @@ -1055,11 +1055,11 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data different chunks * than before NEED NOT fail - intermediate commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); + TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 5, bufA + 95, 5); - TEST_BUFFERS_EQUAL(tmp + 5, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 5, bufA + 95, 5); + TEST_MEMORY_COMPARE(tmp + 5, 10, bufB, 10); success = 1; break; @@ -1067,10 +1067,10 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data different chunks * than before NEED NOT fail - end commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); + TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 5, bufA + 95, 5); - TEST_BUFFERS_EQUAL(tmp + 5, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 5, bufA + 95, 5); + TEST_MEMORY_COMPARE(tmp + 5, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); success = 1; break; @@ -1079,11 +1079,11 @@ void mbedtls_reader_inconsistent_usage(int option) /* Asking for buffered data different chunks * than before NEED NOT fail - intermediate & end commit */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 15, bufA + 80, 15); + TEST_MEMORY_COMPARE(tmp, 15, bufA + 80, 15); TEST_ASSERT(mbedtls_mps_reader_get(&rd, 15, &tmp, NULL) == 0); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); - TEST_BUFFERS_EQUAL(tmp, 5, bufA + 95, 5); - TEST_BUFFERS_EQUAL(tmp + 5, 10, bufB, 10); + TEST_MEMORY_COMPARE(tmp, 5, bufA + 95, 5); + TEST_MEMORY_COMPARE(tmp + 5, 10, bufB, 10); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); success = 1; break; @@ -1096,7 +1096,7 @@ void mbedtls_reader_inconsistent_usage(int option) if (success == 1) { /* In all succeeding cases, fetch the rest of the second buffer. */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 90, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 90, bufB + 10, 90); + TEST_MEMORY_COMPARE(tmp, 90, bufB + 10, 90); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ @@ -1131,7 +1131,7 @@ void mbedtls_mps_reader_feed_empty() /* Consumption (upper layer) */ TEST_ASSERT(mbedtls_mps_reader_get(&rd, 100, &tmp, NULL) == 0); - TEST_BUFFERS_EQUAL(tmp, 100, buf, 100); + TEST_MEMORY_COMPARE(tmp, 100, buf, 100); TEST_ASSERT(mbedtls_mps_reader_commit(&rd) == 0); /* Wrapup */ diff --git a/tests/suites/test_suite_pkcs12.function b/tests/suites/test_suite_pkcs12.function index 7bd6fc0d79..4334f556c9 100644 --- a/tests/suites/test_suite_pkcs12.function +++ b/tests/suites/test_suite_pkcs12.function @@ -57,7 +57,7 @@ void pkcs12_derive_key(int md_type, int key_size_arg, TEST_EQUAL(ret, expected_status); if (expected_status == 0) { - TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, + TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, output_data, key_size); } diff --git a/tests/suites/test_suite_pkcs1_v21.function b/tests/suites/test_suite_pkcs1_v21.function index 5dfe5bbb21..0ecd4a7bf7 100644 --- a/tests/suites/test_suite_pkcs1_v21.function +++ b/tests/suites/test_suite_pkcs1_v21.function @@ -42,7 +42,7 @@ void pkcs1_rsaes_oaep_encrypt(int mod, data_t *input_N, data_t *input_E, message_str->len, message_str->x, output) == result); if (result == 0) { - TEST_BUFFERS_EQUAL(output, ctx.len, result_str->x, result_str->len); + TEST_MEMORY_COMPARE(output, ctx.len, result_str->x, result_str->len); } exit: @@ -98,7 +98,7 @@ void pkcs1_rsaes_oaep_decrypt(int mod, data_t *input_P, data_t *input_Q, output, sizeof(output)) == result); if (result == 0) { - TEST_BUFFERS_EQUAL(output, output_len, result_str->x, result_str->len); + TEST_MEMORY_COMPARE(output, output_len, result_str->x, result_str->len); } } @@ -154,7 +154,7 @@ void pkcs1_rsassa_pss_sign(int mod, data_t *input_P, data_t *input_Q, &info, MBEDTLS_RSA_PRIVATE, digest, 0, hash_result, output) == result); if (result == 0) { - TEST_BUFFERS_EQUAL(output, ctx.len, result_str->x, result_str->len); + TEST_MEMORY_COMPARE(output, ctx.len, result_str->x, result_str->len); } info.buf = rnd_buf->x; @@ -165,7 +165,7 @@ void pkcs1_rsassa_pss_sign(int mod, data_t *input_P, data_t *input_Q, &info, digest, 0, hash_result, fixed_salt_length, output) == result); if (result == 0) { - TEST_BUFFERS_EQUAL(output, ctx.len, result_str->x, result_str->len); + TEST_MEMORY_COMPARE(output, ctx.len, result_str->x, result_str->len); } exit: diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function index 88d0dd28d7..e6bcb26c93 100644 --- a/tests/suites/test_suite_pkwrite.function +++ b/tests/suites/test_suite_pkwrite.function @@ -94,7 +94,7 @@ static void pk_write_check_common(char *key_file, int is_public_key, int is_der) start_buf = buf; } - TEST_BUFFERS_EQUAL(start_buf, buf_len, check_buf, check_buf_len); + TEST_MEMORY_COMPARE(start_buf, buf_len, check_buf, check_buf_len); exit: mbedtls_free(buf); @@ -150,7 +150,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) TEST_EQUAL(mbedtls_pk_write_pubkey_der(&priv_key, derived_key_raw, derived_key_len), pub_key_len); - TEST_BUFFERS_EQUAL(derived_key_raw, derived_key_len, + TEST_MEMORY_COMPARE(derived_key_raw, derived_key_len, pub_key_raw, pub_key_len); #if defined(MBEDTLS_USE_PSA_CRYPTO) @@ -162,7 +162,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) TEST_EQUAL(mbedtls_pk_write_pubkey_der(&priv_key, derived_key_raw, derived_key_len), pub_key_len); - TEST_BUFFERS_EQUAL(derived_key_raw, derived_key_len, + TEST_MEMORY_COMPARE(derived_key_raw, derived_key_len, pub_key_raw, pub_key_len); #endif /* MBEDTLS_USE_PSA_CRYPTO */ diff --git a/tests/suites/test_suite_platform_printf.function b/tests/suites/test_suite_platform_printf.function index 8739dc0a5e..643accf1f7 100644 --- a/tests/suites/test_suite_platform_printf.function +++ b/tests/suites/test_suite_platform_printf.function @@ -34,7 +34,7 @@ void printf_int(char *format, /* any format expecting one int argument, e.g. "%d /* Nominal case: buffer just large enough */ TEST_CALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, x)); - TEST_BUFFERS_EQUAL(result, n + 1, output, n + 1); + TEST_MEMORY_COMPARE(result, n + 1, output, n + 1); mbedtls_free(output); output = NULL; @@ -59,7 +59,7 @@ void printf_long_max(const char *format, /* "%lx" or longer type */ TEST_CALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, value)); - TEST_BUFFERS_EQUAL(expected, n + 1, output, n + 1); + TEST_MEMORY_COMPARE(expected, n + 1, output, n + 1); mbedtls_free(output); output = NULL; @@ -79,7 +79,7 @@ void printf_char2(char *format, /* "%c%c" */ /* Nominal case: buffer just large enough */ TEST_CALLOC(output, n + 1); TEST_EQUAL(n, mbedtls_snprintf(output, n + 1, format, arg1, arg2)); - TEST_BUFFERS_EQUAL(result, n + 1, output, n + 1); + TEST_MEMORY_COMPARE(result, n + 1, output, n + 1); mbedtls_free(output); output = NULL; diff --git a/tests/suites/test_suite_poly1305.function b/tests/suites/test_suite_poly1305.function index adee1d88ac..ff0942869f 100644 --- a/tests/suites/test_suite_poly1305.function +++ b/tests/suites/test_suite_poly1305.function @@ -22,7 +22,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_mac(key->x, src_str->x, src_str->len, mac) == 0); - TEST_BUFFERS_EQUAL(mac, expected_mac->len, + TEST_MEMORY_COMPARE(mac, expected_mac->len, expected_mac->x, expected_mac->len); /* @@ -36,7 +36,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); - TEST_BUFFERS_EQUAL(mac, expected_mac->len, + TEST_MEMORY_COMPARE(mac, expected_mac->len, expected_mac->x, expected_mac->len); /* @@ -53,7 +53,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); - TEST_BUFFERS_EQUAL(mac, expected_mac->len, + TEST_MEMORY_COMPARE(mac, expected_mac->len, expected_mac->x, expected_mac->len); } @@ -69,7 +69,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); - TEST_BUFFERS_EQUAL(mac, expected_mac->len, + TEST_MEMORY_COMPARE(mac, expected_mac->len, expected_mac->x, expected_mac->len); } diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 16efd4356b..8a20bc4eac 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -623,7 +623,7 @@ void import_export(data_t *data, } if (canonical_input) { - TEST_BUFFERS_EQUAL(data->x, data->len, exported, exported_length); + TEST_MEMORY_COMPARE(data->x, data->len, exported, exported_length); } else { mbedtls_svc_key_id_t key2 = MBEDTLS_SVC_KEY_ID_INIT; PSA_ASSERT(psa_import_key(&attributes, exported, exported_length, @@ -632,7 +632,7 @@ void import_export(data_t *data, reexported, export_size, &reexported_length)); - TEST_BUFFERS_EQUAL(exported, exported_length, + TEST_MEMORY_COMPARE(exported, exported_length, reexported, reexported_length); PSA_ASSERT(psa_destroy_key(key2)); } @@ -703,7 +703,7 @@ void import_export_public_key(data_t *data, PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(public_type, bits)); TEST_LE_U(expected_public_key->len, PSA_EXPORT_PUBLIC_KEY_MAX_SIZE); - TEST_BUFFERS_EQUAL(expected_public_key->x, expected_public_key->len, + TEST_MEMORY_COMPARE(expected_public_key->x, expected_public_key->len, exported, exported_length); } @@ -1449,7 +1449,7 @@ void copy_success(int source_usage_arg, TEST_CALLOC(export_buffer, material->len); PSA_ASSERT(psa_export_key(target_key, export_buffer, material->len, &length)); - TEST_BUFFERS_EQUAL(material->x, material->len, + TEST_MEMORY_COMPARE(material->x, material->len, export_buffer, length); } @@ -1650,7 +1650,7 @@ void hash_compute_compare(int alg_arg, data_t *input, output, PSA_HASH_LENGTH(alg), &output_length)); TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg)); - TEST_BUFFERS_EQUAL(output, output_length, + TEST_MEMORY_COMPARE(output, output_length, expected_output->x, expected_output->len); /* Compute with larger buffer */ @@ -1658,7 +1658,7 @@ void hash_compute_compare(int alg_arg, data_t *input, output, sizeof(output), &output_length)); TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg)); - TEST_BUFFERS_EQUAL(output, output_length, + TEST_MEMORY_COMPARE(output, output_length, expected_output->x, expected_output->len); /* Compare with correct hash */ @@ -2195,7 +2195,7 @@ void mac_sign(int key_type_arg, actual_mac, output_size, &mac_length), expected_status); if (expected_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(expected_mac->x, expected_mac->len, + TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len, actual_mac, mac_length); } @@ -2214,7 +2214,7 @@ void mac_sign(int key_type_arg, PSA_ASSERT(psa_mac_abort(&operation)); if (expected_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(expected_mac->x, expected_mac->len, + TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len, actual_mac, mac_length); } mbedtls_free(actual_mac); @@ -2697,7 +2697,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, output_buffer_size - output_length, &length)); output_length += length; - TEST_BUFFERS_EQUAL(ciphertext->x, ciphertext->len, + TEST_MEMORY_COMPARE(ciphertext->x, ciphertext->len, output, output_length); /* Multipart encryption */ @@ -2715,7 +2715,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, output_buffer_size - output_length, &length)); output_length += length; - TEST_BUFFERS_EQUAL(plaintext->x, plaintext->len, + TEST_MEMORY_COMPARE(plaintext->x, plaintext->len, output, output_length); /* One-shot encryption */ @@ -2723,7 +2723,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, PSA_ASSERT(psa_cipher_encrypt(key, alg, plaintext->x, plaintext->len, output, output_buffer_size, &output_length)); - TEST_BUFFERS_EQUAL(ciphertext->x, ciphertext->len, + TEST_MEMORY_COMPARE(ciphertext->x, ciphertext->len, output, output_length); /* One-shot decryption */ @@ -2731,7 +2731,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, PSA_ASSERT(psa_cipher_decrypt(key, alg, ciphertext->x, ciphertext->len, output, output_buffer_size, &output_length)); - TEST_BUFFERS_EQUAL(plaintext->x, plaintext->len, + TEST_MEMORY_COMPARE(plaintext->x, plaintext->len, output, output_length); exit: @@ -2850,7 +2850,7 @@ void cipher_encrypt_validation(int alg_arg, output2_length += function_output_length; PSA_ASSERT(psa_cipher_abort(&operation)); - TEST_BUFFERS_EQUAL(output1 + iv_size, output1_length - iv_size, + TEST_MEMORY_COMPARE(output1 + iv_size, output1_length - iv_size, output2, output2_length); exit: @@ -2949,7 +2949,7 @@ void cipher_encrypt_multipart(int alg_arg, int key_type_arg, if (expected_status == PSA_SUCCESS) { PSA_ASSERT(psa_cipher_abort(&operation)); - TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, + TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, output, total_output_length); } @@ -3049,7 +3049,7 @@ void cipher_decrypt_multipart(int alg_arg, int key_type_arg, if (expected_status == PSA_SUCCESS) { PSA_ASSERT(psa_cipher_abort(&operation)); - TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, + TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, output, total_output_length); } @@ -3160,7 +3160,7 @@ void cipher_decrypt(int alg_arg, TEST_LE_U(output_length, PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(input_buffer_size)); - TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, + TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, output, output_length); exit: mbedtls_free(input); @@ -3217,7 +3217,7 @@ void cipher_verify_output(int alg_arg, TEST_LE_U(output2_length, PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(output1_length)); - TEST_BUFFERS_EQUAL(input->x, input->len, output2, output2_length); + TEST_MEMORY_COMPARE(input->x, input->len, output2, output2_length); exit: mbedtls_free(output1); @@ -3357,7 +3357,7 @@ void cipher_verify_output_multipart(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation2)); - TEST_BUFFERS_EQUAL(input->x, input->len, output2, output2_length); + TEST_MEMORY_COMPARE(input->x, input->len, output2, output2_length); exit: psa_cipher_abort(&operation1); @@ -3452,7 +3452,7 @@ void aead_encrypt_decrypt(int key_type_arg, data_t *key_data, &output_length2), expected_result); - TEST_BUFFERS_EQUAL(input_data->x, input_data->len, + TEST_MEMORY_COMPARE(input_data->x, input_data->len, output_data2, output_length2); } @@ -3519,7 +3519,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, } PSA_ASSERT(status); - TEST_BUFFERS_EQUAL(expected_result->x, expected_result->len, + TEST_MEMORY_COMPARE(expected_result->x, expected_result->len, output_data, output_length); exit: @@ -3592,7 +3592,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, TEST_EQUAL(status, expected_result); if (expected_result == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(expected_data->x, expected_data->len, + TEST_MEMORY_COMPARE(expected_data->x, expected_data->len, output_data, output_length); } @@ -3663,7 +3663,7 @@ void sign_hash_deterministic(int key_type_arg, data_t *key_data, signature, signature_size, &signature_length)); /* Verify that the signature is what is expected. */ - TEST_BUFFERS_EQUAL(output_data->x, output_data->len, + TEST_MEMORY_COMPARE(output_data->x, output_data->len, signature, signature_length); #if defined(MBEDTLS_TEST_DEPRECATED) @@ -3673,7 +3673,7 @@ void sign_hash_deterministic(int key_type_arg, data_t *key_data, input_data->x, input_data->len, signature, signature_size, &signature_length)); - TEST_BUFFERS_EQUAL(output_data->x, output_data->len, + TEST_MEMORY_COMPARE(output_data->x, output_data->len, signature, signature_length); #endif /* MBEDTLS_TEST_DEPRECATED */ @@ -3933,7 +3933,7 @@ void sign_message_deterministic(int key_type_arg, signature, signature_size, &signature_length)); - TEST_BUFFERS_EQUAL(output_data->x, output_data->len, + TEST_MEMORY_COMPARE(output_data->x, output_data->len, signature, signature_length); exit: @@ -4271,7 +4271,7 @@ void asymmetric_encrypt_decrypt(int key_type_arg, label->x, label->len, output2, output2_size, &output2_length)); - TEST_BUFFERS_EQUAL(input_data->x, input_data->len, + TEST_MEMORY_COMPARE(input_data->x, input_data->len, output2, output2_length); exit: @@ -4328,7 +4328,7 @@ void asymmetric_decrypt(int key_type_arg, output, output_size, &output_length)); - TEST_BUFFERS_EQUAL(expected_data->x, expected_data->len, + TEST_MEMORY_COMPARE(expected_data->x, expected_data->len, output, output_length); /* If the label is empty, the test framework puts a non-null pointer @@ -4344,7 +4344,7 @@ void asymmetric_decrypt(int key_type_arg, output, output_size, &output_length)); - TEST_BUFFERS_EQUAL(expected_data->x, expected_data->len, + TEST_MEMORY_COMPARE(expected_data->x, expected_data->len, output, output_length); } @@ -4756,7 +4756,7 @@ void derive_output(int alg_arg, /* Success. Check the read data. */ PSA_ASSERT(status); if (output_sizes[i] != 0) { - TEST_BUFFERS_EQUAL(output_buffer, output_sizes[i], + TEST_MEMORY_COMPARE(output_buffer, output_sizes[i], expected_outputs[i], output_sizes[i]); } /* Check the operation status. */ @@ -4982,7 +4982,7 @@ void derive_key_export(int alg_arg, TEST_EQUAL(length, bytes2); /* Compare the outputs from the two runs. */ - TEST_BUFFERS_EQUAL(output_buffer, bytes1 + bytes2, + TEST_MEMORY_COMPARE(output_buffer, bytes1 + bytes2, export_buffer, capacity); exit: @@ -5133,7 +5133,7 @@ void raw_key_agreement(int alg_arg, peer_key_data->x, peer_key_data->len, output, expected_output->len, &output_length)); - TEST_BUFFERS_EQUAL(output, output_length, + TEST_MEMORY_COMPARE(output, output_length, expected_output->x, expected_output->len); mbedtls_free(output); output = NULL; @@ -5145,7 +5145,7 @@ void raw_key_agreement(int alg_arg, peer_key_data->x, peer_key_data->len, output, expected_output->len + 1, &output_length)); - TEST_BUFFERS_EQUAL(output, output_length, + TEST_MEMORY_COMPARE(output, output_length, expected_output->x, expected_output->len); mbedtls_free(output); output = NULL; @@ -5268,13 +5268,13 @@ void key_agreement_output(int alg_arg, PSA_ASSERT(psa_key_derivation_output_bytes(&operation, actual_output, expected_output1->len)); - TEST_BUFFERS_EQUAL(actual_output, expected_output1->len, + TEST_MEMORY_COMPARE(actual_output, expected_output1->len, expected_output1->x, expected_output1->len); if (expected_output2->len != 0) { PSA_ASSERT(psa_key_derivation_output_bytes(&operation, actual_output, expected_output2->len)); - TEST_BUFFERS_EQUAL(actual_output, expected_output2->len, + TEST_MEMORY_COMPARE(actual_output, expected_output2->len, expected_output2->x, expected_output2->len); } @@ -5443,7 +5443,7 @@ void generate_key_rsa(int bits_arg, if (is_default_public_exponent) { TEST_EQUAL(e_read_length, 0); } else { - TEST_BUFFERS_EQUAL(e_read_buffer, e_read_length, e_arg->x, e_arg->len); + TEST_MEMORY_COMPARE(e_read_buffer, e_read_length, e_arg->x, e_arg->len); } /* Do something with the key according to its type and permitted usage. */ @@ -5479,7 +5479,7 @@ void generate_key_rsa(int bits_arg, TEST_EQUAL(p[1], 0); TEST_EQUAL(p[2], 1); } else { - TEST_BUFFERS_EQUAL(p, len, e_arg->x, e_arg->len); + TEST_MEMORY_COMPARE(p, len, e_arg->x, e_arg->len); } } @@ -5588,7 +5588,7 @@ void persistent_key_load_key_from_storage(data_t *data, first_export, export_size, &first_exported_length)); if (generation_method == IMPORT_KEY) { - TEST_BUFFERS_EQUAL(data->x, data->len, + TEST_MEMORY_COMPARE(data->x, data->len, first_export, first_exported_length); } } @@ -5615,7 +5615,7 @@ void persistent_key_load_key_from_storage(data_t *data, PSA_ASSERT(psa_export_key(key, second_export, export_size, &second_exported_length)); - TEST_BUFFERS_EQUAL(first_export, first_exported_length, + TEST_MEMORY_COMPARE(first_export, first_exported_length, second_export, second_exported_length); } diff --git a/tests/suites/test_suite_psa_crypto_driver_wrappers.function b/tests/suites/test_suite_psa_crypto_driver_wrappers.function index 5ae04615a4..33aefe7386 100644 --- a/tests/suites/test_suite_psa_crypto_driver_wrappers.function +++ b/tests/suites/test_suite_psa_crypto_driver_wrappers.function @@ -64,7 +64,7 @@ void sign_hash(int key_type_arg, &signature_length); TEST_EQUAL(actual_status, expected_status); if (expected_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(signature, signature_length, + TEST_MEMORY_COMPARE(signature, signature_length, expected_output->x, expected_output->len); } TEST_EQUAL(mbedtls_test_driver_signature_sign_hooks.hits, 1); @@ -191,7 +191,7 @@ void sign_message(int key_type_arg, &signature_length); TEST_EQUAL(actual_status, expected_status); if (expected_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(signature, signature_length, + TEST_MEMORY_COMPARE(signature, signature_length, expected_output->x, expected_output->len); } /* In the builtin algorithm the driver is called twice. */ @@ -313,7 +313,7 @@ void generate_key(int force_status_arg, psa_export_key(key, actual_output, sizeof(actual_output), &actual_output_length); if (fake_output->len > 0) { - TEST_BUFFERS_EQUAL(actual_output, actual_output_length, + TEST_MEMORY_COMPARE(actual_output, actual_output_length, expected_output, expected_output_length); } else { size_t zeroes = 0; @@ -445,7 +445,7 @@ void export_key(int force_status_arg, } if (actual_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(actual_output, actual_output_length, + TEST_MEMORY_COMPARE(actual_output, actual_output_length, expected_output_ptr, expected_output_length); } exit: @@ -527,7 +527,7 @@ void cipher_encrypt_validation(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation)); // driver function should've been called as part of the finish() core routine TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); - TEST_BUFFERS_EQUAL(output1 + iv_size, output1_length - iv_size, + TEST_MEMORY_COMPARE(output1 + iv_size, output1_length - iv_size, output2, output2_length); exit: @@ -655,7 +655,7 @@ void cipher_encrypt_multipart(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation)); TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); - TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, + TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, output, total_output_length); } @@ -784,7 +784,7 @@ void cipher_decrypt_multipart(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation)); TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); - TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, + TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, output, total_output_length); } @@ -856,7 +856,7 @@ void cipher_decrypt(int alg_arg, TEST_EQUAL(status, expected_status); if (expected_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(expected_output->x, expected_output->len, + TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, output, output_length); } @@ -1141,7 +1141,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, PSA_SUCCESS : forced_status); if (status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(expected_result->x, expected_result->len, + TEST_MEMORY_COMPARE(expected_result->x, expected_result->len, output_data, output_length); } @@ -1204,7 +1204,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, PSA_SUCCESS : forced_status); if (status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(expected_data->x, expected_data->len, + TEST_MEMORY_COMPARE(expected_data->x, expected_data->len, output_data, output_length); } @@ -1326,7 +1326,7 @@ void mac_sign(int key_type_arg, } if (forced_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(expected_mac->x, expected_mac->len, + TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len, actual_mac, mac_length); } @@ -1477,7 +1477,7 @@ void builtin_key_export(int builtin_key_id_arg, if (expected_status == PSA_SUCCESS) { PSA_ASSERT(actual_status); TEST_EQUAL(output_size, expected_output->len); - TEST_BUFFERS_EQUAL(output_buffer, output_size, + TEST_MEMORY_COMPARE(output_buffer, output_size, expected_output->x, expected_output->len); PSA_ASSERT(psa_get_key_attributes(key, &attributes)); @@ -1528,7 +1528,7 @@ void builtin_pubkey_export(int builtin_key_id_arg, if (expected_status == PSA_SUCCESS) { PSA_ASSERT(actual_status); TEST_EQUAL(output_size, expected_output->len); - TEST_BUFFERS_EQUAL(output_buffer, output_size, + TEST_MEMORY_COMPARE(output_buffer, output_size, expected_output->x, expected_output->len); PSA_ASSERT(psa_get_key_attributes(key, &attributes)); @@ -1573,7 +1573,7 @@ void hash_compute(int alg_arg, TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status); if (expected_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); + TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len); } exit: @@ -1619,7 +1619,7 @@ void hash_multipart_setup(int alg_arg, forced_status == PSA_ERROR_NOT_SUPPORTED ? 1 : 4); TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status); - TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); + TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len); } exit: @@ -1674,7 +1674,7 @@ void hash_multipart_update(int alg_arg, TEST_EQUAL(mbedtls_test_driver_hash_hooks.hits, 2); TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, PSA_SUCCESS); - TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); + TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len); } exit: @@ -1727,7 +1727,7 @@ void hash_multipart_finish(int alg_arg, TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, forced_status); if (forced_status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); + TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len); } exit: @@ -1786,7 +1786,7 @@ void hash_clone(int alg_arg, TEST_EQUAL(mbedtls_test_driver_hash_hooks.hits, 3); TEST_EQUAL(mbedtls_test_driver_hash_hooks.driver_status, PSA_SUCCESS); - TEST_BUFFERS_EQUAL(output, output_length, hash->x, hash->len); + TEST_MEMORY_COMPARE(output, output_length, hash->x, hash->len); } exit: diff --git a/tests/suites/test_suite_psa_crypto_hash.function b/tests/suites/test_suite_psa_crypto_hash.function index fce293a9b3..28b556c4ff 100644 --- a/tests/suites/test_suite_psa_crypto_hash.function +++ b/tests/suites/test_suite_psa_crypto_hash.function @@ -25,7 +25,7 @@ void hash_finish(int alg_arg, data_t *input, data_t *expected_hash) PSA_ASSERT(psa_hash_finish(&operation, actual_hash, sizeof(actual_hash), &actual_hash_length)); - TEST_BUFFERS_EQUAL(expected_hash->x, expected_hash->len, + TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len, actual_hash, actual_hash_length); exit: @@ -83,13 +83,13 @@ void hash_multi_part(int alg_arg, data_t *input, data_t *expected_hash) PSA_ASSERT(psa_hash_finish(&operation, actual_hash, sizeof(actual_hash), &actual_hash_length)); - TEST_BUFFERS_EQUAL(expected_hash->x, expected_hash->len, + TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len, actual_hash, actual_hash_length); PSA_ASSERT(psa_hash_finish(&operation2, actual_hash, sizeof(actual_hash), &actual_hash_length)); - TEST_BUFFERS_EQUAL(expected_hash->x, expected_hash->len, + TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len, actual_hash, actual_hash_length); } while (len++ != input->len); diff --git a/tests/suites/test_suite_psa_crypto_persistent_key.function b/tests/suites/test_suite_psa_crypto_persistent_key.function index f21875ff9a..281fc8d747 100644 --- a/tests/suites/test_suite_psa_crypto_persistent_key.function +++ b/tests/suites/test_suite_psa_crypto_persistent_key.function @@ -66,7 +66,7 @@ void format_storage_data_check(data_t *key_data, &attributes.core, file_data); - TEST_BUFFERS_EQUAL(expected_file_data->x, expected_file_data->len, + TEST_MEMORY_COMPARE(expected_file_data->x, expected_file_data->len, file_data, file_data_length); exit: @@ -111,7 +111,7 @@ void parse_storage_data_check(data_t *file_data, (uint32_t) expected_key_alg); TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), (uint32_t) expected_key_alg2); - TEST_BUFFERS_EQUAL(expected_key_data->x, expected_key_data->len, + TEST_MEMORY_COMPARE(expected_key_data->x, expected_key_data->len, key_data, key_data_length); exit: @@ -307,7 +307,7 @@ void import_export_persistent_key(data_t *data, int type_arg, PSA_ASSERT(psa_export_key(key_id, exported, export_size, &exported_length)); - TEST_BUFFERS_EQUAL(data->x, data->len, exported, exported_length); + TEST_MEMORY_COMPARE(data->x, data->len, exported, exported_length); /* Destroy the key */ PSA_ASSERT(psa_destroy_key(key_id)); diff --git a/tests/suites/test_suite_psa_crypto_se_driver_hal.function b/tests/suites/test_suite_psa_crypto_se_driver_hal.function index bb00c06770..fd8fd63103 100644 --- a/tests/suites/test_suite_psa_crypto_se_driver_hal.function +++ b/tests/suites/test_suite_psa_crypto_se_driver_hal.function @@ -603,7 +603,7 @@ static int check_persistent_data(psa_key_location_t location, PSA_ASSERT(psa_its_get_info(uid, &info)); TEST_CALLOC(loaded, info.size); PSA_ASSERT(psa_its_get(uid, 0, info.size, loaded, NULL)); - TEST_BUFFERS_EQUAL(expected_data, size, loaded, info.size); + TEST_MEMORY_COMPARE(expected_data, size, loaded, info.size); ok = 1; exit: @@ -958,7 +958,7 @@ void key_creation_import_export(int lifetime_arg, int min_slot, int restart) PSA_ASSERT(psa_export_key(returned_id, exported, sizeof(exported), &exported_length)); - TEST_BUFFERS_EQUAL(key_material, sizeof(key_material), + TEST_MEMORY_COMPARE(key_material, sizeof(key_material), exported, exported_length); PSA_ASSERT(psa_destroy_key(returned_id)); diff --git a/tests/suites/test_suite_psa_crypto_slot_management.function b/tests/suites/test_suite_psa_crypto_slot_management.function index 5f65fb92cd..68f3f4b26b 100644 --- a/tests/suites/test_suite_psa_crypto_slot_management.function +++ b/tests/suites/test_suite_psa_crypto_slot_management.function @@ -307,7 +307,7 @@ void persistent_slot_lifecycle(int lifetime_arg, int owner_id_arg, int id_arg, if (usage_flags & PSA_KEY_USAGE_EXPORT) { PSA_ASSERT(psa_export_key(id, reexported, key_data->len, &reexported_length)); - TEST_BUFFERS_EQUAL(key_data->x, key_data->len, + TEST_MEMORY_COMPARE(key_data->x, key_data->len, reexported, reexported_length); } else { TEST_EQUAL(psa_export_key(id, reexported, @@ -402,7 +402,7 @@ void create_existent(int lifetime_arg, int owner_id_arg, int id_arg, PSA_ASSERT(psa_export_key(id, reexported, sizeof(reexported), &reexported_length)); - TEST_BUFFERS_EQUAL(material1, sizeof(material1), + TEST_MEMORY_COMPARE(material1, sizeof(material1), reexported, reexported_length); PSA_ASSERT(psa_close_key(id)); @@ -578,7 +578,7 @@ void copy_across_lifetimes(int source_lifetime_arg, int source_owner_id_arg, TEST_CALLOC(export_buffer, material->len); PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, material->len, &length)); - TEST_BUFFERS_EQUAL(material->x, material->len, + TEST_MEMORY_COMPARE(material->x, material->len, export_buffer, length); } else { size_t length; @@ -692,7 +692,7 @@ void copy_to_occupied(int source_lifetime_arg, int source_id_arg, TEST_CALLOC(export_buffer, target_material->len); PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, target_material->len, &length)); - TEST_BUFFERS_EQUAL(target_material->x, target_material->len, + TEST_MEMORY_COMPARE(target_material->x, target_material->len, export_buffer, length); } @@ -840,7 +840,7 @@ void many_transient_keys(int max_keys_arg) PSA_ASSERT(psa_export_key(keys[i], exported, sizeof(exported), &exported_length)); - TEST_BUFFERS_EQUAL(exported, exported_length, + TEST_MEMORY_COMPARE(exported, exported_length, (uint8_t *) &i, sizeof(i)); } PSA_ASSERT(psa_close_key(keys[i - 1])); @@ -917,7 +917,7 @@ void key_slot_eviction_to_import_new_key(int lifetime_arg) PSA_ASSERT(psa_export_key(key, exported, sizeof(exported), &exported_length)); - TEST_BUFFERS_EQUAL(exported, exported_length, + TEST_MEMORY_COMPARE(exported, exported_length, (uint8_t *) &i, sizeof(i)); PSA_ASSERT(psa_destroy_key(key)); } @@ -988,7 +988,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() exported, sizeof(exported), &exported_length)); i = MBEDTLS_PSA_KEY_SLOT_COUNT - 1; - TEST_BUFFERS_EQUAL(exported, exported_length, (uint8_t *) &i, sizeof(i)); + TEST_MEMORY_COMPARE(exported, exported_length, (uint8_t *) &i, sizeof(i)); PSA_ASSERT(psa_destroy_key(keys[MBEDTLS_PSA_KEY_SLOT_COUNT - 1])); /* @@ -1016,7 +1016,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() PSA_ASSERT(psa_export_key(keys[i], exported, sizeof(exported), &exported_length)); - TEST_BUFFERS_EQUAL(exported, exported_length, + TEST_MEMORY_COMPARE(exported, exported_length, (uint8_t *) &i, sizeof(i)); PSA_ASSERT(psa_destroy_key(keys[i])); } @@ -1028,7 +1028,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() PSA_ASSERT(psa_export_key(persistent_key, exported, sizeof(exported), &exported_length)); - TEST_BUFFERS_EQUAL(exported, exported_length, + TEST_MEMORY_COMPARE(exported, exported_length, (uint8_t *) &persistent_key, sizeof(persistent_key)); exit: /* diff --git a/tests/suites/test_suite_psa_crypto_storage_format.function b/tests/suites/test_suite_psa_crypto_storage_format.function index 9a03dd8f8c..6637a370a7 100644 --- a/tests/suites/test_suite_psa_crypto_storage_format.function +++ b/tests/suites/test_suite_psa_crypto_storage_format.function @@ -39,7 +39,7 @@ static int test_written_key(const psa_key_attributes_t *attributes, TEST_CALLOC(actual_representation, storage_info.size); PSA_ASSERT(psa_its_get(uid, 0, storage_info.size, actual_representation, &length)); - TEST_BUFFERS_EQUAL(expected_representation->x, expected_representation->len, + TEST_MEMORY_COMPARE(expected_representation->x, expected_representation->len, actual_representation, length); ok = 1; @@ -272,7 +272,7 @@ static int test_read_key(const psa_key_attributes_t *expected_attributes, PSA_ASSERT(psa_export_key(key_id, exported_material, expected_material->len, &length)); - TEST_BUFFERS_EQUAL(expected_material->x, expected_material->len, + TEST_MEMORY_COMPARE(expected_material->x, expected_material->len, exported_material, length); } diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index 267b2e52e0..d3c19d181d 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -100,7 +100,7 @@ void set_get_remove(int uid_arg, int flags_arg, data_t *data) TEST_ASSERT(info.size == data->len); TEST_ASSERT(info.flags == flags); PSA_ASSERT(psa_its_get(uid, 0, data->len, buffer, &ret_len)); - TEST_BUFFERS_EQUAL(data->x, data->len, buffer, ret_len); + TEST_MEMORY_COMPARE(data->x, data->len, buffer, ret_len); PSA_ASSERT(psa_its_remove(uid)); @@ -129,7 +129,7 @@ void set_overwrite(int uid_arg, TEST_ASSERT(info.size == data1->len); TEST_ASSERT(info.flags == flags1); PSA_ASSERT(psa_its_get(uid, 0, data1->len, buffer, &ret_len)); - TEST_BUFFERS_EQUAL(data1->x, data1->len, buffer, ret_len); + TEST_MEMORY_COMPARE(data1->x, data1->len, buffer, ret_len); PSA_ASSERT(psa_its_set_wrap(uid, data2->len, data2->x, flags2)); PSA_ASSERT(psa_its_get_info(uid, &info)); @@ -137,7 +137,7 @@ void set_overwrite(int uid_arg, TEST_ASSERT(info.flags == flags2); ret_len = 0; PSA_ASSERT(psa_its_get(uid, 0, data2->len, buffer, &ret_len)); - TEST_BUFFERS_EQUAL(data2->x, data2->len, buffer, ret_len); + TEST_MEMORY_COMPARE(data2->x, data2->len, buffer, ret_len); PSA_ASSERT(psa_its_remove(uid)); @@ -167,7 +167,7 @@ void set_multiple(int first_id, int count) mbedtls_snprintf(stored, sizeof(stored), "Content of file 0x%08lx", (unsigned long) uid); PSA_ASSERT(psa_its_get(uid, 0, sizeof(stored), retrieved, &ret_len)); - TEST_BUFFERS_EQUAL(retrieved, ret_len, + TEST_MEMORY_COMPARE(retrieved, ret_len, stored, sizeof(stored)); PSA_ASSERT(psa_its_remove(uid)); TEST_ASSERT(psa_its_get(uid, 0, 0, NULL, NULL) == @@ -223,7 +223,7 @@ void get_at(int uid_arg, data_t *data, status = psa_its_get(uid, offset, length_arg, buffer, &ret_len); TEST_ASSERT(status == (psa_status_t) expected_status); if (status == PSA_SUCCESS) { - TEST_BUFFERS_EQUAL(data->x + offset, (size_t) length_arg, + TEST_MEMORY_COMPARE(data->x + offset, (size_t) length_arg, buffer, ret_len); } for (i = 0; i < 16; i++) { diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index 302939fc53..de9f13c11e 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -1689,7 +1689,7 @@ void ssl_tls1_3_hkdf_expand_label(int hash_alg, ctx->x, ctx->len, dst, desired_length) == 0); - TEST_BUFFERS_EQUAL(dst, (size_t) desired_length, + TEST_MEMORY_COMPARE(dst, (size_t) desired_length, expected->x, (size_t) expected->len); } /* END_CASE */ @@ -1724,19 +1724,19 @@ void ssl_tls1_3_traffic_key_generation(int hash_alg, desired_key_len, desired_iv_len, &keys) == 0); - TEST_BUFFERS_EQUAL(keys.client_write_key, + TEST_MEMORY_COMPARE(keys.client_write_key, keys.key_len, expected_client_write_key->x, (size_t) desired_key_len); - TEST_BUFFERS_EQUAL(keys.server_write_key, + TEST_MEMORY_COMPARE(keys.server_write_key, keys.key_len, expected_server_write_key->x, (size_t) desired_key_len); - TEST_BUFFERS_EQUAL(keys.client_write_iv, + TEST_MEMORY_COMPARE(keys.client_write_iv, keys.iv_len, expected_client_write_iv->x, (size_t) desired_iv_len); - TEST_BUFFERS_EQUAL(keys.server_write_iv, + TEST_MEMORY_COMPARE(keys.server_write_iv, keys.iv_len, expected_server_write_iv->x, (size_t) desired_iv_len); @@ -1778,7 +1778,7 @@ void ssl_tls1_3_derive_secret(int hash_alg, already_hashed, dst, desired_length) == 0); - TEST_BUFFERS_EQUAL(dst, desired_length, + TEST_MEMORY_COMPARE(dst, desired_length, expected->x, desired_length); } /* END_CASE */ @@ -1797,7 +1797,7 @@ void ssl_tls1_3_key_evolution(int hash_alg, input->len ? input->x : NULL, input->len, secret_new) == 0); - TEST_BUFFERS_EQUAL(secret_new, (size_t) expected->len, + TEST_MEMORY_COMPARE(secret_new, (size_t) expected->len, expected->x, (size_t) expected->len); } /* END_CASE */ From a240fe3c193b65ac57099857a11e55fe982b32ee Mon Sep 17 00:00:00 2001 From: Tom Cosgrove Date: Mon, 4 Sep 2023 11:29:39 +0100 Subject: [PATCH 128/135] Fix code style Signed-off-by: Tom Cosgrove --- tests/suites/test_suite_aria.function | 16 ++--- tests/suites/test_suite_asn1write.function | 8 +-- tests/suites/test_suite_chacha20.function | 6 +- tests/suites/test_suite_ecp.function | 8 +-- tests/suites/test_suite_hkdf.function | 2 +- tests/suites/test_suite_mps.function | 4 +- tests/suites/test_suite_pkcs12.function | 2 +- tests/suites/test_suite_pkwrite.function | 4 +- tests/suites/test_suite_poly1305.function | 8 +-- tests/suites/test_suite_psa_crypto.function | 66 +++++++++---------- ..._suite_psa_crypto_driver_wrappers.function | 26 ++++---- .../test_suite_psa_crypto_hash.function | 6 +- ...t_suite_psa_crypto_persistent_key.function | 4 +- ...st_suite_psa_crypto_se_driver_hal.function | 2 +- ..._suite_psa_crypto_slot_management.function | 16 ++--- ...t_suite_psa_crypto_storage_format.function | 4 +- tests/suites/test_suite_psa_its.function | 4 +- tests/suites/test_suite_ssl.function | 30 ++++----- 18 files changed, 108 insertions(+), 108 deletions(-) diff --git a/tests/suites/test_suite_aria.function b/tests/suites/test_suite_aria.function index 7baabfa063..10c51a3462 100644 --- a/tests/suites/test_suite_aria.function +++ b/tests/suites/test_suite_aria.function @@ -225,7 +225,7 @@ void aria_encrypt_ecb(data_t *key_str, data_t *src_str, } TEST_MEMORY_COMPARE(output, expected_output->len, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); } exit: @@ -253,7 +253,7 @@ void aria_decrypt_ecb(data_t *key_str, data_t *src_str, } TEST_MEMORY_COMPARE(output, expected_output->len, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); } exit: @@ -278,7 +278,7 @@ void aria_encrypt_cbc(data_t *key_str, data_t *iv_str, output) == cbc_result); if (cbc_result == 0) { TEST_MEMORY_COMPARE(output, expected_output->len, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); } exit: @@ -303,7 +303,7 @@ void aria_decrypt_cbc(data_t *key_str, data_t *iv_str, output) == cbc_result); if (cbc_result == 0) { TEST_MEMORY_COMPARE(output, expected_output->len, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); } exit: @@ -330,7 +330,7 @@ void aria_encrypt_cfb128(data_t *key_str, data_t *iv_str, == result); TEST_MEMORY_COMPARE(output, expected_output->len, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); exit: mbedtls_aria_free(&ctx); @@ -356,7 +356,7 @@ void aria_decrypt_cfb128(data_t *key_str, data_t *iv_str, == result); TEST_MEMORY_COMPARE(output, expected_output->len, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); exit: mbedtls_aria_free(&ctx); @@ -382,7 +382,7 @@ void aria_encrypt_ctr(data_t *key_str, data_t *iv_str, == result); TEST_MEMORY_COMPARE(output, expected_output->len, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); exit: mbedtls_aria_free(&ctx); @@ -408,7 +408,7 @@ void aria_decrypt_ctr(data_t *key_str, data_t *iv_str, == result); TEST_MEMORY_COMPARE(output, expected_output->len, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); exit: mbedtls_aria_free(&ctx); diff --git a/tests/suites/test_suite_asn1write.function b/tests/suites/test_suite_asn1write.function index 4b0345f1e1..77bf4ef3c2 100644 --- a/tests/suites/test_suite_asn1write.function +++ b/tests/suites/test_suite_asn1write.function @@ -38,7 +38,7 @@ int generic_write_finish_step(generic_write_data_t *data, TEST_ASSERT(data->p >= data->start); TEST_ASSERT(data->p <= data->end); TEST_MEMORY_COMPARE(data->p, (size_t) (data->end - data->p), - expected->x, expected->len); + expected->x, expected->len); } ok = 1; @@ -441,7 +441,7 @@ void test_asn1_write_bitstrings(data_t *bitstring, int bits, TEST_EQUAL(mbedtls_asn1_get_bitstring(&data.p, data.end, &read), 0); TEST_MEMORY_COMPARE(read.p, read.len, - masked_bitstring, byte_length); + masked_bitstring, byte_length); TEST_EQUAL(read.unused_bits, 8 * byte_length - value_bits); } #endif /* MBEDTLS_ASN1_PARSE_C */ @@ -546,7 +546,7 @@ void store_named_data_val_found(int old_len, int new_len) if (new_val != NULL) { TEST_MEMORY_COMPARE(found->val.p, found->val.len, - new_val, (size_t) new_len); + new_val, (size_t) new_len); } if (new_len == 0) { TEST_ASSERT(found->val.p == NULL); @@ -588,7 +588,7 @@ void store_named_data_val_new(int new_len, int set_new_val) } else { TEST_ASSERT(found->val.p != new_val); TEST_MEMORY_COMPARE(found->val.p, found->val.len, - new_val, (size_t) new_len); + new_val, (size_t) new_len); } exit: diff --git a/tests/suites/test_suite_chacha20.function b/tests/suites/test_suite_chacha20.function index 66f01f4b0d..3c6f06ce7a 100644 --- a/tests/suites/test_suite_chacha20.function +++ b/tests/suites/test_suite_chacha20.function @@ -30,7 +30,7 @@ void chacha20_crypt(data_t *key_str, output) == 0); TEST_MEMORY_COMPARE(output, expected_output_str->len, - expected_output_str->x, expected_output_str->len); + expected_output_str->x, expected_output_str->len); /* * Test the streaming API @@ -45,7 +45,7 @@ void chacha20_crypt(data_t *key_str, TEST_ASSERT(mbedtls_chacha20_update(&ctx, src_str->len, src_str->x, output) == 0); TEST_MEMORY_COMPARE(output, expected_output_str->len, - expected_output_str->x, expected_output_str->len); + expected_output_str->x, expected_output_str->len); /* * Test the streaming API again, piecewise @@ -61,7 +61,7 @@ void chacha20_crypt(data_t *key_str, src_str->x + 1, output + 1) == 0); TEST_MEMORY_COMPARE(output, expected_output_str->len, - expected_output_str->x, expected_output_str->len); + expected_output_str->x, expected_output_str->len); mbedtls_chacha20_free(&ctx); } diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function index 225572ad11..a3103d930a 100644 --- a/tests/suites/test_suite_ecp.function +++ b/tests/suites/test_suite_ecp.function @@ -853,7 +853,7 @@ void ecp_muladd(int id, TEST_ASSERT(len <= MBEDTLS_ECP_MAX_PT_LEN); TEST_MEMORY_COMPARE(expected_result->x, expected_result->len, - actual_result, len); + actual_result, len); exit: mbedtls_ecp_group_free(&grp); @@ -1357,7 +1357,7 @@ void mbedtls_ecp_read_key(int grp_id, data_t *in_key, int expected, int canonica TEST_ASSERT(ret == 0); TEST_MEMORY_COMPARE(in_key->x, in_key->len, - buf, in_key->len); + buf, in_key->len); } else { unsigned char export1[MBEDTLS_ECP_MAX_BYTES]; unsigned char export2[MBEDTLS_ECP_MAX_BYTES]; @@ -1372,7 +1372,7 @@ void mbedtls_ecp_read_key(int grp_id, data_t *in_key, int expected, int canonica TEST_ASSERT(ret == 0); TEST_MEMORY_COMPARE(export1, in_key->len, - export2, in_key->len); + export2, in_key->len); } } @@ -1449,7 +1449,7 @@ void genkey_mx_known_answer(int bits, data_t *seed, data_t *expected) * - Other bits must be random (by testing with different RNG outputs, * we validate that those bits are indeed influenced by the RNG). */ TEST_MEMORY_COMPARE(expected->x, expected->len, - actual, expected->len); + actual, expected->len); } exit: diff --git a/tests/suites/test_suite_hkdf.function b/tests/suites/test_suite_hkdf.function index a729847e7a..f307a7d304 100644 --- a/tests/suites/test_suite_hkdf.function +++ b/tests/suites/test_suite_hkdf.function @@ -25,7 +25,7 @@ void test_hkdf(int md_alg, data_t *ikm, data_t *salt, data_t *info, TEST_ASSERT(ret == 0); TEST_MEMORY_COMPARE(okm, expected_okm->len, - expected_okm->x, expected_okm->len); + expected_okm->x, expected_okm->len); } /* END_CASE */ diff --git a/tests/suites/test_suite_mps.function b/tests/suites/test_suite_mps.function index 1bc1b3ece1..03818ec3c1 100644 --- a/tests/suites/test_suite_mps.function +++ b/tests/suites/test_suite_mps.function @@ -611,8 +611,8 @@ void mbedtls_mps_reader_reclaim_data_left(int option) TEST_ASSERT(mbedtls_mps_reader_get(&rd, sizeof(buf) / 2, &tmp, NULL) == 0); TEST_MEMORY_COMPARE(tmp, sizeof(buf) / 2, - buf + sizeof(buf) / 2, - sizeof(buf) / 2); + buf + sizeof(buf) / 2, + sizeof(buf) / 2); break; default: diff --git a/tests/suites/test_suite_pkcs12.function b/tests/suites/test_suite_pkcs12.function index 4334f556c9..0d399124ac 100644 --- a/tests/suites/test_suite_pkcs12.function +++ b/tests/suites/test_suite_pkcs12.function @@ -58,7 +58,7 @@ void pkcs12_derive_key(int md_type, int key_size_arg, if (expected_status == 0) { TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, - output_data, key_size); + output_data, key_size); } exit: diff --git a/tests/suites/test_suite_pkwrite.function b/tests/suites/test_suite_pkwrite.function index e6bcb26c93..d1f7813b73 100644 --- a/tests/suites/test_suite_pkwrite.function +++ b/tests/suites/test_suite_pkwrite.function @@ -151,7 +151,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) derived_key_len), pub_key_len); TEST_MEMORY_COMPARE(derived_key_raw, derived_key_len, - pub_key_raw, pub_key_len); + pub_key_raw, pub_key_len); #if defined(MBEDTLS_USE_PSA_CRYPTO) mbedtls_platform_zeroize(derived_key_raw, derived_key_len); @@ -163,7 +163,7 @@ void pk_write_public_from_private(char *priv_key_file, char *pub_key_file) derived_key_len), pub_key_len); TEST_MEMORY_COMPARE(derived_key_raw, derived_key_len, - pub_key_raw, pub_key_len); + pub_key_raw, pub_key_len); #endif /* MBEDTLS_USE_PSA_CRYPTO */ exit: diff --git a/tests/suites/test_suite_poly1305.function b/tests/suites/test_suite_poly1305.function index ff0942869f..c391c8627c 100644 --- a/tests/suites/test_suite_poly1305.function +++ b/tests/suites/test_suite_poly1305.function @@ -23,7 +23,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) src_str->len, mac) == 0); TEST_MEMORY_COMPARE(mac, expected_mac->len, - expected_mac->x, expected_mac->len); + expected_mac->x, expected_mac->len); /* * Test the streaming API @@ -37,7 +37,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); TEST_MEMORY_COMPARE(mac, expected_mac->len, - expected_mac->x, expected_mac->len); + expected_mac->x, expected_mac->len); /* * Test the streaming API again, piecewise @@ -54,7 +54,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); TEST_MEMORY_COMPARE(mac, expected_mac->len, - expected_mac->x, expected_mac->len); + expected_mac->x, expected_mac->len); } /* @@ -70,7 +70,7 @@ void mbedtls_poly1305(data_t *key, data_t *expected_mac, data_t *src_str) TEST_ASSERT(mbedtls_poly1305_finish(&ctx, mac) == 0); TEST_MEMORY_COMPARE(mac, expected_mac->len, - expected_mac->x, expected_mac->len); + expected_mac->x, expected_mac->len); } mbedtls_poly1305_free(&ctx); diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 8a20bc4eac..0db5bff79a 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -633,7 +633,7 @@ void import_export(data_t *data, export_size, &reexported_length)); TEST_MEMORY_COMPARE(exported, exported_length, - reexported, reexported_length); + reexported, reexported_length); PSA_ASSERT(psa_destroy_key(key2)); } TEST_ASSERT(exported_length <= @@ -704,7 +704,7 @@ void import_export_public_key(data_t *data, TEST_LE_U(expected_public_key->len, PSA_EXPORT_PUBLIC_KEY_MAX_SIZE); TEST_MEMORY_COMPARE(expected_public_key->x, expected_public_key->len, - exported, exported_length); + exported, exported_length); } exit: @@ -1450,7 +1450,7 @@ void copy_success(int source_usage_arg, PSA_ASSERT(psa_export_key(target_key, export_buffer, material->len, &length)); TEST_MEMORY_COMPARE(material->x, material->len, - export_buffer, length); + export_buffer, length); } if (!mbedtls_test_psa_exercise_key(target_key, expected_usage, expected_alg)) { @@ -1651,7 +1651,7 @@ void hash_compute_compare(int alg_arg, data_t *input, &output_length)); TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg)); TEST_MEMORY_COMPARE(output, output_length, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); /* Compute with larger buffer */ PSA_ASSERT(psa_hash_compute(alg, input->x, input->len, @@ -1659,7 +1659,7 @@ void hash_compute_compare(int alg_arg, data_t *input, &output_length)); TEST_EQUAL(output_length, PSA_HASH_LENGTH(alg)); TEST_MEMORY_COMPARE(output, output_length, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); /* Compare with correct hash */ PSA_ASSERT(psa_hash_compare(alg, input->x, input->len, @@ -2196,7 +2196,7 @@ void mac_sign(int key_type_arg, expected_status); if (expected_status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len, - actual_mac, mac_length); + actual_mac, mac_length); } if (output_size > 0) { @@ -2215,7 +2215,7 @@ void mac_sign(int key_type_arg, if (expected_status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len, - actual_mac, mac_length); + actual_mac, mac_length); } mbedtls_free(actual_mac); actual_mac = NULL; @@ -2698,7 +2698,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, &length)); output_length += length; TEST_MEMORY_COMPARE(ciphertext->x, ciphertext->len, - output, output_length); + output, output_length); /* Multipart encryption */ PSA_ASSERT(psa_cipher_decrypt_setup(&operation, key, alg)); @@ -2716,7 +2716,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, &length)); output_length += length; TEST_MEMORY_COMPARE(plaintext->x, plaintext->len, - output, output_length); + output, output_length); /* One-shot encryption */ output_length = ~0; @@ -2724,7 +2724,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, output, output_buffer_size, &output_length)); TEST_MEMORY_COMPARE(ciphertext->x, ciphertext->len, - output, output_length); + output, output_length); /* One-shot decryption */ output_length = ~0; @@ -2732,7 +2732,7 @@ void cipher_alg_without_iv(int alg_arg, int key_type_arg, data_t *key_data, output, output_buffer_size, &output_length)); TEST_MEMORY_COMPARE(plaintext->x, plaintext->len, - output, output_length); + output, output_length); exit: mbedtls_free(output); @@ -2851,7 +2851,7 @@ void cipher_encrypt_validation(int alg_arg, PSA_ASSERT(psa_cipher_abort(&operation)); TEST_MEMORY_COMPARE(output1 + iv_size, output1_length - iv_size, - output2, output2_length); + output2, output2_length); exit: psa_cipher_abort(&operation); @@ -2950,7 +2950,7 @@ void cipher_encrypt_multipart(int alg_arg, int key_type_arg, PSA_ASSERT(psa_cipher_abort(&operation)); TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, - output, total_output_length); + output, total_output_length); } exit: @@ -3050,7 +3050,7 @@ void cipher_decrypt_multipart(int alg_arg, int key_type_arg, PSA_ASSERT(psa_cipher_abort(&operation)); TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, - output, total_output_length); + output, total_output_length); } exit: @@ -3161,7 +3161,7 @@ void cipher_decrypt(int alg_arg, PSA_CIPHER_DECRYPT_OUTPUT_MAX_SIZE(input_buffer_size)); TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, - output, output_length); + output, output_length); exit: mbedtls_free(input); mbedtls_free(output); @@ -3453,7 +3453,7 @@ void aead_encrypt_decrypt(int key_type_arg, data_t *key_data, expected_result); TEST_MEMORY_COMPARE(input_data->x, input_data->len, - output_data2, output_length2); + output_data2, output_length2); } exit: @@ -3520,7 +3520,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, PSA_ASSERT(status); TEST_MEMORY_COMPARE(expected_result->x, expected_result->len, - output_data, output_length); + output_data, output_length); exit: psa_destroy_key(key); @@ -3593,7 +3593,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, if (expected_result == PSA_SUCCESS) { TEST_MEMORY_COMPARE(expected_data->x, expected_data->len, - output_data, output_length); + output_data, output_length); } exit: @@ -3664,7 +3664,7 @@ void sign_hash_deterministic(int key_type_arg, data_t *key_data, &signature_length)); /* Verify that the signature is what is expected. */ TEST_MEMORY_COMPARE(output_data->x, output_data->len, - signature, signature_length); + signature, signature_length); #if defined(MBEDTLS_TEST_DEPRECATED) memset(signature, 0, signature_size); @@ -3674,7 +3674,7 @@ void sign_hash_deterministic(int key_type_arg, data_t *key_data, signature, signature_size, &signature_length)); TEST_MEMORY_COMPARE(output_data->x, output_data->len, - signature, signature_length); + signature, signature_length); #endif /* MBEDTLS_TEST_DEPRECATED */ exit: @@ -3934,7 +3934,7 @@ void sign_message_deterministic(int key_type_arg, &signature_length)); TEST_MEMORY_COMPARE(output_data->x, output_data->len, - signature, signature_length); + signature, signature_length); exit: psa_reset_key_attributes(&attributes); @@ -4272,7 +4272,7 @@ void asymmetric_encrypt_decrypt(int key_type_arg, output2, output2_size, &output2_length)); TEST_MEMORY_COMPARE(input_data->x, input_data->len, - output2, output2_length); + output2, output2_length); exit: /* @@ -4329,7 +4329,7 @@ void asymmetric_decrypt(int key_type_arg, output_size, &output_length)); TEST_MEMORY_COMPARE(expected_data->x, expected_data->len, - output, output_length); + output, output_length); /* If the label is empty, the test framework puts a non-null pointer * in label->x. Test that a null pointer works as well. */ @@ -4345,7 +4345,7 @@ void asymmetric_decrypt(int key_type_arg, output_size, &output_length)); TEST_MEMORY_COMPARE(expected_data->x, expected_data->len, - output, output_length); + output, output_length); } exit: @@ -4757,7 +4757,7 @@ void derive_output(int alg_arg, PSA_ASSERT(status); if (output_sizes[i] != 0) { TEST_MEMORY_COMPARE(output_buffer, output_sizes[i], - expected_outputs[i], output_sizes[i]); + expected_outputs[i], output_sizes[i]); } /* Check the operation status. */ expected_capacity -= output_sizes[i]; @@ -4983,7 +4983,7 @@ void derive_key_export(int alg_arg, /* Compare the outputs from the two runs. */ TEST_MEMORY_COMPARE(output_buffer, bytes1 + bytes2, - export_buffer, capacity); + export_buffer, capacity); exit: mbedtls_free(output_buffer); @@ -5134,7 +5134,7 @@ void raw_key_agreement(int alg_arg, output, expected_output->len, &output_length)); TEST_MEMORY_COMPARE(output, output_length, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); mbedtls_free(output); output = NULL; output_length = ~0; @@ -5146,7 +5146,7 @@ void raw_key_agreement(int alg_arg, output, expected_output->len + 1, &output_length)); TEST_MEMORY_COMPARE(output, output_length, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); mbedtls_free(output); output = NULL; output_length = ~0; @@ -5242,7 +5242,7 @@ void key_agreement_output(int alg_arg, uint8_t *actual_output = NULL; TEST_CALLOC(actual_output, MAX(expected_output1->len, - expected_output2->len)); + expected_output2->len)); PSA_ASSERT(psa_crypto_init()); @@ -5269,13 +5269,13 @@ void key_agreement_output(int alg_arg, actual_output, expected_output1->len)); TEST_MEMORY_COMPARE(actual_output, expected_output1->len, - expected_output1->x, expected_output1->len); + expected_output1->x, expected_output1->len); if (expected_output2->len != 0) { PSA_ASSERT(psa_key_derivation_output_bytes(&operation, actual_output, expected_output2->len)); TEST_MEMORY_COMPARE(actual_output, expected_output2->len, - expected_output2->x, expected_output2->len); + expected_output2->x, expected_output2->len); } exit: @@ -5589,7 +5589,7 @@ void persistent_key_load_key_from_storage(data_t *data, &first_exported_length)); if (generation_method == IMPORT_KEY) { TEST_MEMORY_COMPARE(data->x, data->len, - first_export, first_exported_length); + first_export, first_exported_length); } } @@ -5616,7 +5616,7 @@ void persistent_key_load_key_from_storage(data_t *data, second_export, export_size, &second_exported_length)); TEST_MEMORY_COMPARE(first_export, first_exported_length, - second_export, second_exported_length); + second_export, second_exported_length); } /* Do something with the key according to its type and permitted usage. */ diff --git a/tests/suites/test_suite_psa_crypto_driver_wrappers.function b/tests/suites/test_suite_psa_crypto_driver_wrappers.function index 33aefe7386..b789908d0f 100644 --- a/tests/suites/test_suite_psa_crypto_driver_wrappers.function +++ b/tests/suites/test_suite_psa_crypto_driver_wrappers.function @@ -65,7 +65,7 @@ void sign_hash(int key_type_arg, TEST_EQUAL(actual_status, expected_status); if (expected_status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(signature, signature_length, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); } TEST_EQUAL(mbedtls_test_driver_signature_sign_hooks.hits, 1); @@ -192,7 +192,7 @@ void sign_message(int key_type_arg, TEST_EQUAL(actual_status, expected_status); if (expected_status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(signature, signature_length, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); } /* In the builtin algorithm the driver is called twice. */ TEST_EQUAL(mbedtls_test_driver_signature_sign_hooks.hits, @@ -314,7 +314,7 @@ void generate_key(int force_status_arg, if (fake_output->len > 0) { TEST_MEMORY_COMPARE(actual_output, actual_output_length, - expected_output, expected_output_length); + expected_output, expected_output_length); } else { size_t zeroes = 0; for (size_t i = 0; i < sizeof(actual_output); i++) { @@ -446,7 +446,7 @@ void export_key(int force_status_arg, if (actual_status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(actual_output, actual_output_length, - expected_output_ptr, expected_output_length); + expected_output_ptr, expected_output_length); } exit: psa_reset_key_attributes(&attributes); @@ -528,7 +528,7 @@ void cipher_encrypt_validation(int alg_arg, // driver function should've been called as part of the finish() core routine TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); TEST_MEMORY_COMPARE(output1 + iv_size, output1_length - iv_size, - output2, output2_length); + output2, output2_length); exit: psa_cipher_abort(&operation); @@ -656,7 +656,7 @@ void cipher_encrypt_multipart(int alg_arg, TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, - output, total_output_length); + output, total_output_length); } exit: @@ -785,7 +785,7 @@ void cipher_decrypt_multipart(int alg_arg, TEST_EQUAL(mbedtls_test_driver_cipher_hooks.hits, 0); TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, - output, total_output_length); + output, total_output_length); } exit: @@ -857,7 +857,7 @@ void cipher_decrypt(int alg_arg, if (expected_status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(expected_output->x, expected_output->len, - output, output_length); + output, output_length); } exit: @@ -1142,7 +1142,7 @@ void aead_encrypt(int key_type_arg, data_t *key_data, if (status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(expected_result->x, expected_result->len, - output_data, output_length); + output_data, output_length); } exit: @@ -1205,7 +1205,7 @@ void aead_decrypt(int key_type_arg, data_t *key_data, if (status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(expected_data->x, expected_data->len, - output_data, output_length); + output_data, output_length); } exit: @@ -1327,7 +1327,7 @@ void mac_sign(int key_type_arg, if (forced_status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(expected_mac->x, expected_mac->len, - actual_mac, mac_length); + actual_mac, mac_length); } mbedtls_free(actual_mac); @@ -1478,7 +1478,7 @@ void builtin_key_export(int builtin_key_id_arg, PSA_ASSERT(actual_status); TEST_EQUAL(output_size, expected_output->len); TEST_MEMORY_COMPARE(output_buffer, output_size, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); PSA_ASSERT(psa_get_key_attributes(key, &attributes)); TEST_EQUAL(psa_get_key_bits(&attributes), builtin_key_bits); @@ -1529,7 +1529,7 @@ void builtin_pubkey_export(int builtin_key_id_arg, PSA_ASSERT(actual_status); TEST_EQUAL(output_size, expected_output->len); TEST_MEMORY_COMPARE(output_buffer, output_size, - expected_output->x, expected_output->len); + expected_output->x, expected_output->len); PSA_ASSERT(psa_get_key_attributes(key, &attributes)); TEST_EQUAL(psa_get_key_bits(&attributes), builtin_key_bits); diff --git a/tests/suites/test_suite_psa_crypto_hash.function b/tests/suites/test_suite_psa_crypto_hash.function index 28b556c4ff..0405c1de9e 100644 --- a/tests/suites/test_suite_psa_crypto_hash.function +++ b/tests/suites/test_suite_psa_crypto_hash.function @@ -26,7 +26,7 @@ void hash_finish(int alg_arg, data_t *input, data_t *expected_hash) actual_hash, sizeof(actual_hash), &actual_hash_length)); TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len, - actual_hash, actual_hash_length); + actual_hash, actual_hash_length); exit: psa_hash_abort(&operation); @@ -84,13 +84,13 @@ void hash_multi_part(int alg_arg, data_t *input, data_t *expected_hash) actual_hash, sizeof(actual_hash), &actual_hash_length)); TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len, - actual_hash, actual_hash_length); + actual_hash, actual_hash_length); PSA_ASSERT(psa_hash_finish(&operation2, actual_hash, sizeof(actual_hash), &actual_hash_length)); TEST_MEMORY_COMPARE(expected_hash->x, expected_hash->len, - actual_hash, actual_hash_length); + actual_hash, actual_hash_length); } while (len++ != input->len); exit: diff --git a/tests/suites/test_suite_psa_crypto_persistent_key.function b/tests/suites/test_suite_psa_crypto_persistent_key.function index 281fc8d747..8f6a57f55f 100644 --- a/tests/suites/test_suite_psa_crypto_persistent_key.function +++ b/tests/suites/test_suite_psa_crypto_persistent_key.function @@ -67,7 +67,7 @@ void format_storage_data_check(data_t *key_data, file_data); TEST_MEMORY_COMPARE(expected_file_data->x, expected_file_data->len, - file_data, file_data_length); + file_data, file_data_length); exit: mbedtls_free(file_data); @@ -112,7 +112,7 @@ void parse_storage_data_check(data_t *file_data, TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), (uint32_t) expected_key_alg2); TEST_MEMORY_COMPARE(expected_key_data->x, expected_key_data->len, - key_data, key_data_length); + key_data, key_data_length); exit: mbedtls_free(key_data); diff --git a/tests/suites/test_suite_psa_crypto_se_driver_hal.function b/tests/suites/test_suite_psa_crypto_se_driver_hal.function index fd8fd63103..15232a44f7 100644 --- a/tests/suites/test_suite_psa_crypto_se_driver_hal.function +++ b/tests/suites/test_suite_psa_crypto_se_driver_hal.function @@ -959,7 +959,7 @@ void key_creation_import_export(int lifetime_arg, int min_slot, int restart) exported, sizeof(exported), &exported_length)); TEST_MEMORY_COMPARE(key_material, sizeof(key_material), - exported, exported_length); + exported, exported_length); PSA_ASSERT(psa_destroy_key(returned_id)); if (!check_persistent_data(location, diff --git a/tests/suites/test_suite_psa_crypto_slot_management.function b/tests/suites/test_suite_psa_crypto_slot_management.function index 68f3f4b26b..5bd12eb09e 100644 --- a/tests/suites/test_suite_psa_crypto_slot_management.function +++ b/tests/suites/test_suite_psa_crypto_slot_management.function @@ -308,7 +308,7 @@ void persistent_slot_lifecycle(int lifetime_arg, int owner_id_arg, int id_arg, PSA_ASSERT(psa_export_key(id, reexported, key_data->len, &reexported_length)); TEST_MEMORY_COMPARE(key_data->x, key_data->len, - reexported, reexported_length); + reexported, reexported_length); } else { TEST_EQUAL(psa_export_key(id, reexported, key_data->len, &reexported_length), @@ -403,7 +403,7 @@ void create_existent(int lifetime_arg, int owner_id_arg, int id_arg, reexported, sizeof(reexported), &reexported_length)); TEST_MEMORY_COMPARE(material1, sizeof(material1), - reexported, reexported_length); + reexported, reexported_length); PSA_ASSERT(psa_close_key(id)); @@ -579,7 +579,7 @@ void copy_across_lifetimes(int source_lifetime_arg, int source_owner_id_arg, PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, material->len, &length)); TEST_MEMORY_COMPARE(material->x, material->len, - export_buffer, length); + export_buffer, length); } else { size_t length; /* Check that the key is actually non-exportable. */ @@ -693,7 +693,7 @@ void copy_to_occupied(int source_lifetime_arg, int source_id_arg, PSA_ASSERT(psa_export_key(returned_target_id, export_buffer, target_material->len, &length)); TEST_MEMORY_COMPARE(target_material->x, target_material->len, - export_buffer, length); + export_buffer, length); } PSA_ASSERT(psa_destroy_key(returned_source_id)); @@ -841,7 +841,7 @@ void many_transient_keys(int max_keys_arg) exported, sizeof(exported), &exported_length)); TEST_MEMORY_COMPARE(exported, exported_length, - (uint8_t *) &i, sizeof(i)); + (uint8_t *) &i, sizeof(i)); } PSA_ASSERT(psa_close_key(keys[i - 1])); @@ -918,7 +918,7 @@ void key_slot_eviction_to_import_new_key(int lifetime_arg) exported, sizeof(exported), &exported_length)); TEST_MEMORY_COMPARE(exported, exported_length, - (uint8_t *) &i, sizeof(i)); + (uint8_t *) &i, sizeof(i)); PSA_ASSERT(psa_destroy_key(key)); } @@ -1017,7 +1017,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() exported, sizeof(exported), &exported_length)); TEST_MEMORY_COMPARE(exported, exported_length, - (uint8_t *) &i, sizeof(i)); + (uint8_t *) &i, sizeof(i)); PSA_ASSERT(psa_destroy_key(keys[i])); } @@ -1029,7 +1029,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() PSA_ASSERT(psa_export_key(persistent_key, exported, sizeof(exported), &exported_length)); TEST_MEMORY_COMPARE(exported, exported_length, - (uint8_t *) &persistent_key, sizeof(persistent_key)); + (uint8_t *) &persistent_key, sizeof(persistent_key)); exit: /* * Key attributes may have been returned by psa_get_key_attributes() diff --git a/tests/suites/test_suite_psa_crypto_storage_format.function b/tests/suites/test_suite_psa_crypto_storage_format.function index 6637a370a7..2f68409e9d 100644 --- a/tests/suites/test_suite_psa_crypto_storage_format.function +++ b/tests/suites/test_suite_psa_crypto_storage_format.function @@ -40,7 +40,7 @@ static int test_written_key(const psa_key_attributes_t *attributes, PSA_ASSERT(psa_its_get(uid, 0, storage_info.size, actual_representation, &length)); TEST_MEMORY_COMPARE(expected_representation->x, expected_representation->len, - actual_representation, length); + actual_representation, length); ok = 1; @@ -273,7 +273,7 @@ static int test_read_key(const psa_key_attributes_t *expected_attributes, exported_material, expected_material->len, &length)); TEST_MEMORY_COMPARE(expected_material->x, expected_material->len, - exported_material, length); + exported_material, length); } if ((flags & TEST_FLAG_EXERCISE) && can_exercise(&actual_attributes)) { diff --git a/tests/suites/test_suite_psa_its.function b/tests/suites/test_suite_psa_its.function index d3c19d181d..0f66c79517 100644 --- a/tests/suites/test_suite_psa_its.function +++ b/tests/suites/test_suite_psa_its.function @@ -168,7 +168,7 @@ void set_multiple(int first_id, int count) "Content of file 0x%08lx", (unsigned long) uid); PSA_ASSERT(psa_its_get(uid, 0, sizeof(stored), retrieved, &ret_len)); TEST_MEMORY_COMPARE(retrieved, ret_len, - stored, sizeof(stored)); + stored, sizeof(stored)); PSA_ASSERT(psa_its_remove(uid)); TEST_ASSERT(psa_its_get(uid, 0, 0, NULL, NULL) == PSA_ERROR_DOES_NOT_EXIST); @@ -224,7 +224,7 @@ void get_at(int uid_arg, data_t *data, TEST_ASSERT(status == (psa_status_t) expected_status); if (status == PSA_SUCCESS) { TEST_MEMORY_COMPARE(data->x + offset, (size_t) length_arg, - buffer, ret_len); + buffer, ret_len); } for (i = 0; i < 16; i++) { TEST_ASSERT(trailer[i] == '-'); diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index de9f13c11e..02c3799099 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -1690,7 +1690,7 @@ void ssl_tls1_3_hkdf_expand_label(int hash_alg, dst, desired_length) == 0); TEST_MEMORY_COMPARE(dst, (size_t) desired_length, - expected->x, (size_t) expected->len); + expected->x, (size_t) expected->len); } /* END_CASE */ @@ -1725,21 +1725,21 @@ void ssl_tls1_3_traffic_key_generation(int hash_alg, &keys) == 0); TEST_MEMORY_COMPARE(keys.client_write_key, - keys.key_len, - expected_client_write_key->x, - (size_t) desired_key_len); + keys.key_len, + expected_client_write_key->x, + (size_t) desired_key_len); TEST_MEMORY_COMPARE(keys.server_write_key, - keys.key_len, - expected_server_write_key->x, - (size_t) desired_key_len); + keys.key_len, + expected_server_write_key->x, + (size_t) desired_key_len); TEST_MEMORY_COMPARE(keys.client_write_iv, - keys.iv_len, - expected_client_write_iv->x, - (size_t) desired_iv_len); + keys.iv_len, + expected_client_write_iv->x, + (size_t) desired_iv_len); TEST_MEMORY_COMPARE(keys.server_write_iv, - keys.iv_len, - expected_server_write_iv->x, - (size_t) desired_iv_len); + keys.iv_len, + expected_server_write_iv->x, + (size_t) desired_iv_len); } /* END_CASE */ @@ -1779,7 +1779,7 @@ void ssl_tls1_3_derive_secret(int hash_alg, dst, desired_length) == 0); TEST_MEMORY_COMPARE(dst, desired_length, - expected->x, desired_length); + expected->x, desired_length); } /* END_CASE */ @@ -1798,7 +1798,7 @@ void ssl_tls1_3_key_evolution(int hash_alg, secret_new) == 0); TEST_MEMORY_COMPARE(secret_new, (size_t) expected->len, - expected->x, (size_t) expected->len); + expected->x, (size_t) expected->len); } /* END_CASE */ From 937b91eb6f5050c40133b2b89bdc224591062f96 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 7 Sep 2023 17:40:16 +0200 Subject: [PATCH 129/135] Fix boolean options in the wrong section Boolean options that modify the behavior of a module are supposed to be in the "feature support" section, not in the "configuration options" support: that section is documented to contain commented-out definitions with a value, for which the comment contains the default version. In particular, merely uncommenting a definition in the "configuration options" section is not supposed to change anything. Move the offending boolean options to the proper section. This causes those options to be enabled by `config.py full` unless explicitly excluded. For the moved options: * Everest is already explicitly excluded. * The ALT options need to link against a custom function, so exclude them. * `MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE` is ok for testing, and is currently never tested in `all.sh`. With this commit, we will now test the library with it enabled in configurations based on `full`. Signed-off-by: Gilles Peskine --- include/mbedtls/config.h | 130 +++++++++++++++++++-------------------- scripts/config.py | 6 +- 2 files changed, 70 insertions(+), 66 deletions(-) diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index fa5ebd787d..8d8139fef8 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -265,6 +265,45 @@ //#define MBEDTLS_PLATFORM_NV_SEED_ALT //#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT +/** + * Uncomment the macro to let Mbed TLS use your alternate implementation of + * mbedtls_platform_gmtime_r(). This replaces the default implementation in + * platform_util.c. + * + * gmtime() is not a thread-safe function as defined in the C standard. The + * library will try to use safer implementations of this function, such as + * gmtime_r() when available. However, if Mbed TLS cannot identify the target + * system, the implementation of mbedtls_platform_gmtime_r() will default to + * using the standard gmtime(). In this case, calls from the library to + * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex + * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the + * library are also guarded with this mutex to avoid race conditions. However, + * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will + * unconditionally use the implementation for mbedtls_platform_gmtime_r() + * supplied at compile time. + */ +//#define MBEDTLS_PLATFORM_GMTIME_R_ALT + +/** + * Uncomment the macro to let mbed TLS use your alternate implementation of + * mbedtls_platform_zeroize(). This replaces the default implementation in + * platform_util.c. + * + * mbedtls_platform_zeroize() is a widely used function across the library to + * zero a block of memory. The implementation is expected to be secure in the + * sense that it has been written to prevent the compiler from removing calls + * to mbedtls_platform_zeroize() as part of redundant code elimination + * optimizations. However, it is difficult to guarantee that calls to + * mbedtls_platform_zeroize() will not be optimized by the compiler as older + * versions of the C language standards do not provide a secure implementation + * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to + * configure their own implementation of mbedtls_platform_zeroize(), for + * example by using directives specific to their compiler, features from newer + * C standards (e.g using memset_s() in C11) or calling a secure memset() from + * their system (e.g explicit_bzero() in BSD). + */ +//#define MBEDTLS_PLATFORM_ZEROIZE_ALT + /** * \def MBEDTLS_DEPRECATED_WARNING * @@ -818,6 +857,15 @@ */ #define MBEDTLS_REMOVE_3DES_CIPHERSUITES +/** + * Enable the verified implementations of ECDH primitives from Project Everest + * (currently only Curve25519). This feature changes the layout of ECDH + * contexts and therefore is a compatibility break for applications that access + * fields of a mbedtls_ecdh_context structure directly. See also + * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. + */ +//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED + /** * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED * @@ -2117,6 +2165,23 @@ */ //#define MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH +/** + * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake + * signature and ciphersuite selection. Without this build-time option, SHA-1 + * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes. + * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by + * default. At the time of writing, there is no practical attack on the use + * of SHA-1 in handshake signatures, hence this option is turned on by default + * to preserve compatibility with existing peers, but the general + * warning applies nonetheless: + * + * \warning SHA-1 is considered a weak message digest and its use constitutes + * a security risk. If possible, we recommend avoiding dependencies + * on it, and considering stronger message digests instead. + * + */ +//#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE + /** * \def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN * @@ -4141,71 +4206,6 @@ //#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */ //#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */ -/** - * Allow SHA-1 in the default TLS configuration for TLS 1.2 handshake - * signature and ciphersuite selection. Without this build-time option, SHA-1 - * support must be activated explicitly through mbedtls_ssl_conf_sig_hashes. - * The use of SHA-1 in TLS <= 1.1 and in HMAC-SHA-1 is always allowed by - * default. At the time of writing, there is no practical attack on the use - * of SHA-1 in handshake signatures, hence this option is turned on by default - * to preserve compatibility with existing peers, but the general - * warning applies nonetheless: - * - * \warning SHA-1 is considered a weak message digest and its use constitutes - * a security risk. If possible, we recommend avoiding dependencies - * on it, and considering stronger message digests instead. - * - */ -//#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE - -/** - * Uncomment the macro to let mbed TLS use your alternate implementation of - * mbedtls_platform_zeroize(). This replaces the default implementation in - * platform_util.c. - * - * mbedtls_platform_zeroize() is a widely used function across the library to - * zero a block of memory. The implementation is expected to be secure in the - * sense that it has been written to prevent the compiler from removing calls - * to mbedtls_platform_zeroize() as part of redundant code elimination - * optimizations. However, it is difficult to guarantee that calls to - * mbedtls_platform_zeroize() will not be optimized by the compiler as older - * versions of the C language standards do not provide a secure implementation - * of memset(). Therefore, MBEDTLS_PLATFORM_ZEROIZE_ALT enables users to - * configure their own implementation of mbedtls_platform_zeroize(), for - * example by using directives specific to their compiler, features from newer - * C standards (e.g using memset_s() in C11) or calling a secure memset() from - * their system (e.g explicit_bzero() in BSD). - */ -//#define MBEDTLS_PLATFORM_ZEROIZE_ALT - -/** - * Uncomment the macro to let Mbed TLS use your alternate implementation of - * mbedtls_platform_gmtime_r(). This replaces the default implementation in - * platform_util.c. - * - * gmtime() is not a thread-safe function as defined in the C standard. The - * library will try to use safer implementations of this function, such as - * gmtime_r() when available. However, if Mbed TLS cannot identify the target - * system, the implementation of mbedtls_platform_gmtime_r() will default to - * using the standard gmtime(). In this case, calls from the library to - * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex - * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the - * library are also guarded with this mutex to avoid race conditions. However, - * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will - * unconditionally use the implementation for mbedtls_platform_gmtime_r() - * supplied at compile time. - */ -//#define MBEDTLS_PLATFORM_GMTIME_R_ALT - -/** - * Enable the verified implementations of ECDH primitives from Project Everest - * (currently only Curve25519). This feature changes the layout of ECDH - * contexts and therefore is a compatibility break for applications that access - * fields of a mbedtls_ecdh_context structure directly. See also - * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. - */ -//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED - /** \} name SECTION: Module configuration options */ /* Target and application specific configurations diff --git a/scripts/config.py b/scripts/config.py index 2db67efaa9..7a68d0b547 100755 --- a/scripts/config.py +++ b/scripts/config.py @@ -225,7 +225,11 @@ def is_seamless_alt(name): Exclude alternative implementations of library functions since they require an implementation of the relevant functions and an xxx_alt.h header. """ - if name == 'MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT': + if name in ( + 'MBEDTLS_PLATFORM_GMTIME_R_ALT', + 'MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT', + 'MBEDTLS_PLATFORM_ZEROIZE_ALT', + ): # Similar to non-platform xxx_ALT, requires platform_alt.h return False return name.startswith('MBEDTLS_PLATFORM_') From e008890afaf19a9a05fa7054cf3bc4a357f5e200 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 7 Sep 2023 19:20:34 +0200 Subject: [PATCH 130/135] Update generated files Signed-off-by: Gilles Peskine --- library/version_features.c | 12 +++++ programs/test/query_config.c | 96 ++++++++++++++++++------------------ 2 files changed, 60 insertions(+), 48 deletions(-) diff --git a/library/version_features.c b/library/version_features.c index 049a58aa21..ad8a357149 100644 --- a/library/version_features.c +++ b/library/version_features.c @@ -75,6 +75,12 @@ static const char * const features[] = { #if defined(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT) "MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT", #endif /* MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT */ +#if defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) + "MBEDTLS_PLATFORM_GMTIME_R_ALT", +#endif /* MBEDTLS_PLATFORM_GMTIME_R_ALT */ +#if defined(MBEDTLS_PLATFORM_ZEROIZE_ALT) + "MBEDTLS_PLATFORM_ZEROIZE_ALT", +#endif /* MBEDTLS_PLATFORM_ZEROIZE_ALT */ #if defined(MBEDTLS_DEPRECATED_WARNING) "MBEDTLS_DEPRECATED_WARNING", #endif /* MBEDTLS_DEPRECATED_WARNING */ @@ -312,6 +318,9 @@ static const char * const features[] = { #if defined(MBEDTLS_REMOVE_3DES_CIPHERSUITES) "MBEDTLS_REMOVE_3DES_CIPHERSUITES", #endif /* MBEDTLS_REMOVE_3DES_CIPHERSUITES */ +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + "MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED", +#endif /* MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED */ #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) "MBEDTLS_ECP_DP_SECP192R1_ENABLED", #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */ @@ -576,6 +585,9 @@ static const char * const features[] = { #if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) "MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH", #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */ +#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE) + "MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE", +#endif /* MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE */ #if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) "MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN", #endif /* MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN */ diff --git a/programs/test/query_config.c b/programs/test/query_config.c index b3a6a592d6..9bf717c4db 100644 --- a/programs/test/query_config.c +++ b/programs/test/query_config.c @@ -260,6 +260,22 @@ int query_config(const char *config) } #endif /* MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT */ +#if defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) + if( strcmp( "MBEDTLS_PLATFORM_GMTIME_R_ALT", config ) == 0 ) + { + MACRO_EXPANSION_TO_STR( MBEDTLS_PLATFORM_GMTIME_R_ALT ); + return( 0 ); + } +#endif /* MBEDTLS_PLATFORM_GMTIME_R_ALT */ + +#if defined(MBEDTLS_PLATFORM_ZEROIZE_ALT) + if( strcmp( "MBEDTLS_PLATFORM_ZEROIZE_ALT", config ) == 0 ) + { + MACRO_EXPANSION_TO_STR( MBEDTLS_PLATFORM_ZEROIZE_ALT ); + return( 0 ); + } +#endif /* MBEDTLS_PLATFORM_ZEROIZE_ALT */ + #if defined(MBEDTLS_DEPRECATED_WARNING) if( strcmp( "MBEDTLS_DEPRECATED_WARNING", config ) == 0 ) { @@ -892,6 +908,14 @@ int query_config(const char *config) } #endif /* MBEDTLS_REMOVE_3DES_CIPHERSUITES */ +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + if( strcmp( "MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED", config ) == 0 ) + { + MACRO_EXPANSION_TO_STR( MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED ); + return( 0 ); + } +#endif /* MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED */ + #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) if( strcmp( "MBEDTLS_ECP_DP_SECP192R1_ENABLED", config ) == 0 ) { @@ -1596,6 +1620,14 @@ int query_config(const char *config) } #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */ +#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE) + if( strcmp( "MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE", config ) == 0 ) + { + MACRO_EXPANSION_TO_STR( MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE ); + return( 0 ); + } +#endif /* MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE */ + #if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) if( strcmp( "MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN", config ) == 0 ) { @@ -2844,38 +2876,6 @@ int query_config(const char *config) } #endif /* MBEDTLS_X509_MAX_FILE_PATH_LEN */ -#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE) - if( strcmp( "MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE", config ) == 0 ) - { - MACRO_EXPANSION_TO_STR( MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE ); - return( 0 ); - } -#endif /* MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE */ - -#if defined(MBEDTLS_PLATFORM_ZEROIZE_ALT) - if( strcmp( "MBEDTLS_PLATFORM_ZEROIZE_ALT", config ) == 0 ) - { - MACRO_EXPANSION_TO_STR( MBEDTLS_PLATFORM_ZEROIZE_ALT ); - return( 0 ); - } -#endif /* MBEDTLS_PLATFORM_ZEROIZE_ALT */ - -#if defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) - if( strcmp( "MBEDTLS_PLATFORM_GMTIME_R_ALT", config ) == 0 ) - { - MACRO_EXPANSION_TO_STR( MBEDTLS_PLATFORM_GMTIME_R_ALT ); - return( 0 ); - } -#endif /* MBEDTLS_PLATFORM_GMTIME_R_ALT */ - -#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) - if( strcmp( "MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED", config ) == 0 ) - { - MACRO_EXPANSION_TO_STR( MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED ); - return( 0 ); - } -#endif /* MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED */ - /* If the symbol is not found, return an error */ return 1; } @@ -2946,6 +2946,14 @@ void list_config(void) OUTPUT_MACRO_NAME_VALUE(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT); #endif /* MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT */ +#if defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) + OUTPUT_MACRO_NAME_VALUE(MBEDTLS_PLATFORM_GMTIME_R_ALT); +#endif /* MBEDTLS_PLATFORM_GMTIME_R_ALT */ + +#if defined(MBEDTLS_PLATFORM_ZEROIZE_ALT) + OUTPUT_MACRO_NAME_VALUE(MBEDTLS_PLATFORM_ZEROIZE_ALT); +#endif /* MBEDTLS_PLATFORM_ZEROIZE_ALT */ + #if defined(MBEDTLS_DEPRECATED_WARNING) OUTPUT_MACRO_NAME_VALUE(MBEDTLS_DEPRECATED_WARNING); #endif /* MBEDTLS_DEPRECATED_WARNING */ @@ -3262,6 +3270,10 @@ void list_config(void) OUTPUT_MACRO_NAME_VALUE(MBEDTLS_REMOVE_3DES_CIPHERSUITES); #endif /* MBEDTLS_REMOVE_3DES_CIPHERSUITES */ +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) + OUTPUT_MACRO_NAME_VALUE(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED); +#endif /* MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED */ + #if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) OUTPUT_MACRO_NAME_VALUE(MBEDTLS_ECP_DP_SECP192R1_ENABLED); #endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */ @@ -3614,6 +3626,10 @@ void list_config(void) OUTPUT_MACRO_NAME_VALUE(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH); #endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */ +#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE) + OUTPUT_MACRO_NAME_VALUE(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE); +#endif /* MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE */ + #if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) OUTPUT_MACRO_NAME_VALUE(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN); #endif /* MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN */ @@ -4238,22 +4254,6 @@ void list_config(void) OUTPUT_MACRO_NAME_VALUE(MBEDTLS_X509_MAX_FILE_PATH_LEN); #endif /* MBEDTLS_X509_MAX_FILE_PATH_LEN */ -#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE) - OUTPUT_MACRO_NAME_VALUE(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE); -#endif /* MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE */ - -#if defined(MBEDTLS_PLATFORM_ZEROIZE_ALT) - OUTPUT_MACRO_NAME_VALUE(MBEDTLS_PLATFORM_ZEROIZE_ALT); -#endif /* MBEDTLS_PLATFORM_ZEROIZE_ALT */ - -#if defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) - OUTPUT_MACRO_NAME_VALUE(MBEDTLS_PLATFORM_GMTIME_R_ALT); -#endif /* MBEDTLS_PLATFORM_GMTIME_R_ALT */ - -#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) - OUTPUT_MACRO_NAME_VALUE(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED); -#endif /* MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED */ - } #if defined(_MSC_VER) From 3a11771baef328f0e6782341631ed15091dcd514 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Fri, 8 Sep 2023 11:17:09 +0200 Subject: [PATCH 131/135] Pacify pylint Signed-off-by: Gilles Peskine --- scripts/config.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/config.py b/scripts/config.py index 7a68d0b547..2f79978b74 100755 --- a/scripts/config.py +++ b/scripts/config.py @@ -226,9 +226,9 @@ def is_seamless_alt(name): an implementation of the relevant functions and an xxx_alt.h header. """ if name in ( - 'MBEDTLS_PLATFORM_GMTIME_R_ALT', - 'MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT', - 'MBEDTLS_PLATFORM_ZEROIZE_ALT', + 'MBEDTLS_PLATFORM_GMTIME_R_ALT', + 'MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT', + 'MBEDTLS_PLATFORM_ZEROIZE_ALT', ): # Similar to non-platform xxx_ALT, requires platform_alt.h return False From fa9392abcd303db77e6b31b35adf396e85e16d37 Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Thu, 7 Sep 2023 16:54:44 +0200 Subject: [PATCH 132/135] PSA config: Add comment about HKDF. Signed-off-by: Ronald Cron --- include/mbedtls/config_psa.h | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/include/mbedtls/config_psa.h b/include/mbedtls/config_psa.h index 1e74a1b5b9..67d5df11b3 100644 --- a/include/mbedtls/config_psa.h +++ b/include/mbedtls/config_psa.h @@ -110,6 +110,10 @@ extern "C" { #if defined(PSA_WANT_ALG_HKDF) #if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF) +/* + * The PSA implementation has its own implementation of HKDF, separate from + * hkdf.c. No need to enable MBEDTLS_HKDF_C here. + */ #define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 #define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1 #endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF */ From bd44d93ee9b4246bcbb92cfafe4dbb70d14052bc Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 3 Aug 2023 17:22:44 +0200 Subject: [PATCH 133/135] Allow "Mbed TLS" as the project name in Doxygen Previously the code only recognized the old spelling "mbed TLS", so it missed doxygen/input/doc_mainpage.h. Signed-off-by: Gilles Peskine --- scripts/bump_version.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/bump_version.sh b/scripts/bump_version.sh index df629e9243..57ade94a7e 100755 --- a/scripts/bump_version.sh +++ b/scripts/bump_version.sh @@ -136,7 +136,7 @@ mv tmp tests/suites/test_suite_version.data [ $VERBOSE ] && echo "Bumping PROJECT_NAME in doxygen/mbedtls.doxyfile and doxygen/input/doc_mainpage.h" for i in doxygen/mbedtls.doxyfile doxygen/input/doc_mainpage.h; do - sed -e "s/mbed TLS v[0-9\.]\{1,\}/mbed TLS v$VERSION/g" < $i > tmp + sed -e "s/\\([Mm]bed TLS v\\)[0-9][0-9.]*/\\1$VERSION/g" < $i > tmp mv tmp $i done From f08ca83b4fe40411e5bd89aeebd8cbf3bf02b1d9 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 12 Sep 2023 19:21:54 +0200 Subject: [PATCH 134/135] Update spelling "mbed TLS" to "Mbed TLS" The official spelling of the trade mark changed from all-lowercase "mbed" to normal proper noun capitalization "Mbed" a few years ago. We've been using the new spelling in new text but still have the old spelling in a lot of text. This commit updates most occurrences of "mbed TLS": ``` sed -i -e 's/mbed TLS/Mbed TLS/g' $(git ls-files ':!ChangeLog' ':!tests/data_files/**' ':!tests/suites/*.data' ':!programs/x509/*' ':!configs/tfm*') ``` Justification for the omissions: * `ChangeLog`: historical text. * `test/data_files/**`, `tests/suites/*.data`, `programs/x509/*`: many occurrences are significant names in certificates and such. Changing the spelling would invalidate many signatures and tests. * `configs/tfm*`: this is an imported file. We'll follow the upstream updates. Signed-off-by: Gilles Peskine --- .github/issue_template.md | 2 +- .../everest/include/everest/vs2010/inttypes.h | 2 +- .../everest/include/everest/vs2010/stdbool.h | 2 +- 3rdparty/everest/include/everest/x25519.h | 2 +- .../everest/library/Hacl_Curve25519_joined.c | 2 +- 3rdparty/everest/library/x25519.c | 2 +- CMakeLists.txt | 14 +++--- DartConfiguration.tcl | 2 +- configs/README.txt | 2 +- configs/config-mini-tls1_1.h | 4 +- configs/config-no-entropy.h | 4 +- configs/config-suite-b.h | 4 +- configs/config-thread.h | 4 +- doxygen/mbedtls.doxyfile | 2 +- include/CMakeLists.txt | 2 +- include/mbedtls/check_config.h | 2 +- include/mbedtls/compat-1.3.h | 2 +- include/mbedtls/config.h | 48 +++++++++---------- include/mbedtls/ecp.h | 2 +- include/mbedtls/entropy_poll.h | 2 +- include/mbedtls/error.h | 2 +- include/mbedtls/pkcs11.h | 2 +- include/mbedtls/platform_time.h | 2 +- include/mbedtls/ssl_ciphersuites.h | 2 +- include/mbedtls/threading.h | 4 +- include/mbedtls/version.h | 12 ++--- include/mbedtls/x509_crt.h | 4 +- include/mbedtls/x509_csr.h | 2 +- library/CMakeLists.txt | 8 ++-- library/cipher.c | 2 +- library/cipher_wrap.c | 2 +- library/ecjpake.c | 2 +- library/md.c | 2 +- library/mps_common.h | 2 +- library/mps_error.h | 2 +- library/mps_reader.h | 2 +- library/mps_trace.h | 2 +- library/psa_crypto_core.h | 4 +- library/ssl_ciphersuites.c | 2 +- programs/ssl/ssl_fork_server.c | 2 +- programs/ssl/ssl_mail_client.c | 4 +- programs/ssl/ssl_pthread_server.c | 2 +- programs/ssl/ssl_server.c | 2 +- programs/ssl/ssl_server2.c | 2 +- scripts/bump_version.sh | 2 +- scripts/footprint.sh | 4 +- scripts/generate_features.pl | 4 +- scripts/lcov.sh | 2 +- scripts/rename.pl | 6 +-- tests/compat.sh | 4 +- tests/scripts/all.sh | 2 +- tests/scripts/basic-build-test.sh | 2 +- tests/scripts/check-doxy-blocks.pl | 2 +- tests/scripts/check-generated-files.sh | 2 +- tests/scripts/doxygen.sh | 2 +- tests/scripts/generate-afl-tests.sh | 2 +- tests/suites/test_suite_ecp.function | 2 +- tests/suites/test_suite_version.function | 4 +- tests/suites/test_suite_x509parse.function | 2 +- 59 files changed, 110 insertions(+), 110 deletions(-) diff --git a/.github/issue_template.md b/.github/issue_template.md index 370066f486..d4573a4356 100644 --- a/.github/issue_template.md +++ b/.github/issue_template.md @@ -20,7 +20,7 @@ github issues for questions. **OS** Mbed OS|linux|windows| -**mbed TLS build:** +**Mbed TLS build:** Version: x.x.x or git commit id OS version: x.x.x Configuration: please attach config.h file where possible diff --git a/3rdparty/everest/include/everest/vs2010/inttypes.h b/3rdparty/everest/include/everest/vs2010/inttypes.h index d53f87f21d..77003be0b0 100644 --- a/3rdparty/everest/include/everest/vs2010/inttypes.h +++ b/3rdparty/everest/include/everest/vs2010/inttypes.h @@ -17,7 +17,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ #ifndef _INTTYPES_H_VS2010 diff --git a/3rdparty/everest/include/everest/vs2010/stdbool.h b/3rdparty/everest/include/everest/vs2010/stdbool.h index 5b7039c4f4..dcae6d80ad 100644 --- a/3rdparty/everest/include/everest/vs2010/stdbool.h +++ b/3rdparty/everest/include/everest/vs2010/stdbool.h @@ -17,7 +17,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ #ifndef _STDBOOL_H_VS2010 diff --git a/3rdparty/everest/include/everest/x25519.h b/3rdparty/everest/include/everest/x25519.h index 7a973dcf01..ef314d2f3b 100644 --- a/3rdparty/everest/include/everest/x25519.h +++ b/3rdparty/everest/include/everest/x25519.h @@ -16,7 +16,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ #ifndef MBEDTLS_X25519_H diff --git a/3rdparty/everest/library/Hacl_Curve25519_joined.c b/3rdparty/everest/library/Hacl_Curve25519_joined.c index ee62be1ceb..b7d0c929c9 100644 --- a/3rdparty/everest/library/Hacl_Curve25519_joined.c +++ b/3rdparty/everest/library/Hacl_Curve25519_joined.c @@ -16,7 +16,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ #include "common.h" diff --git a/3rdparty/everest/library/x25519.c b/3rdparty/everest/library/x25519.c index 9faa9ab7d8..83064dc619 100644 --- a/3rdparty/everest/library/x25519.c +++ b/3rdparty/everest/library/x25519.c @@ -16,7 +16,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ #include "common.h" diff --git a/CMakeLists.txt b/CMakeLists.txt index 52814ba6b1..b001bb70a1 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -34,18 +34,18 @@ cmake_policy(SET CMP0011 NEW) cmake_policy(SET CMP0012 NEW) if(TEST_CPP) - project("mbed TLS" C CXX) + project("Mbed TLS" C CXX) else() - project("mbed TLS" C) + project("Mbed TLS" C) endif() # Set the project root directory. set(MBEDTLS_DIR ${CMAKE_CURRENT_SOURCE_DIR}) -option(USE_PKCS11_HELPER_LIBRARY "Build mbed TLS with the pkcs11-helper library." OFF) -option(ENABLE_ZLIB_SUPPORT "Build mbed TLS with zlib library." OFF) +option(USE_PKCS11_HELPER_LIBRARY "Build Mbed TLS with the pkcs11-helper library." OFF) +option(ENABLE_ZLIB_SUPPORT "Build Mbed TLS with zlib library." OFF) -option(ENABLE_PROGRAMS "Build mbed TLS programs." ON) +option(ENABLE_PROGRAMS "Build Mbed TLS programs." ON) option(UNSAFE_BUILD "Allow unsafe builds. These builds ARE NOT SECURE." OFF) option(MBEDTLS_FATAL_WARNINGS "Compiler warnings treated as errors" ON) @@ -57,9 +57,9 @@ string(REGEX MATCH "MSVC" CMAKE_COMPILER_IS_MSVC "${CMAKE_C_COMPILER_ID}") # the test suites currently have compile errors with MSVC if(CMAKE_COMPILER_IS_MSVC) - option(ENABLE_TESTING "Build mbed TLS tests." OFF) + option(ENABLE_TESTING "Build Mbed TLS tests." OFF) else() - option(ENABLE_TESTING "Build mbed TLS tests." ON) + option(ENABLE_TESTING "Build Mbed TLS tests." ON) endif() # Warning string - created as a list for compatibility with CMake 2.8 diff --git a/DartConfiguration.tcl b/DartConfiguration.tcl index dfa0f07181..af0578a581 100644 --- a/DartConfiguration.tcl +++ b/DartConfiguration.tcl @@ -1,4 +1,4 @@ Site: localhost -BuildName: mbed TLS-test +BuildName: Mbed TLS-test CoverageCommand: /usr/bin/gcov MemoryCheckCommand: /usr/bin/valgrind diff --git a/configs/README.txt b/configs/README.txt index 933fa7f21d..d2f9bcb008 100644 --- a/configs/README.txt +++ b/configs/README.txt @@ -23,4 +23,4 @@ them, you can pick one of the following methods: make Note that the second method also works if you want to keep your custom -configuration file outside the mbed TLS tree. +configuration file outside the Mbed TLS tree. diff --git a/configs/config-mini-tls1_1.h b/configs/config-mini-tls1_1.h index 78e31d5488..318e0fba8b 100644 --- a/configs/config-mini-tls1_1.h +++ b/configs/config-mini-tls1_1.h @@ -33,13 +33,13 @@ #define MBEDTLS_HAVE_ASM #define MBEDTLS_HAVE_TIME -/* mbed TLS feature support */ +/* Mbed TLS feature support */ #define MBEDTLS_CIPHER_MODE_CBC #define MBEDTLS_PKCS1_V15 #define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED #define MBEDTLS_SSL_PROTO_TLS1_1 -/* mbed TLS modules */ +/* Mbed TLS modules */ #define MBEDTLS_AES_C #define MBEDTLS_ASN1_PARSE_C #define MBEDTLS_ASN1_WRITE_C diff --git a/configs/config-no-entropy.h b/configs/config-no-entropy.h index 63f9411a36..72006eb6ef 100644 --- a/configs/config-no-entropy.h +++ b/configs/config-no-entropy.h @@ -36,7 +36,7 @@ #define MBEDTLS_HAVE_ASM #define MBEDTLS_HAVE_TIME -/* mbed TLS feature support */ +/* Mbed TLS feature support */ #define MBEDTLS_CIPHER_MODE_CBC #define MBEDTLS_CIPHER_PADDING_PKCS7 #define MBEDTLS_REMOVE_ARC4_CIPHERSUITES @@ -53,7 +53,7 @@ #define MBEDTLS_X509_CHECK_KEY_USAGE #define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE -/* mbed TLS modules */ +/* Mbed TLS modules */ #define MBEDTLS_AES_C #define MBEDTLS_ASN1_PARSE_C #define MBEDTLS_ASN1_WRITE_C diff --git a/configs/config-suite-b.h b/configs/config-suite-b.h index 29897fd5f5..545a7912d8 100644 --- a/configs/config-suite-b.h +++ b/configs/config-suite-b.h @@ -40,13 +40,13 @@ #define MBEDTLS_HAVE_ASM #define MBEDTLS_HAVE_TIME -/* mbed TLS feature support */ +/* Mbed TLS feature support */ #define MBEDTLS_ECP_DP_SECP256R1_ENABLED #define MBEDTLS_ECP_DP_SECP384R1_ENABLED #define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED #define MBEDTLS_SSL_PROTO_TLS1_2 -/* mbed TLS modules */ +/* Mbed TLS modules */ #define MBEDTLS_AES_C #define MBEDTLS_ASN1_PARSE_C #define MBEDTLS_ASN1_WRITE_C diff --git a/configs/config-thread.h b/configs/config-thread.h index de24158ae1..0de7e1679f 100644 --- a/configs/config-thread.h +++ b/configs/config-thread.h @@ -38,7 +38,7 @@ /* System support */ #define MBEDTLS_HAVE_ASM -/* mbed TLS feature support */ +/* Mbed TLS feature support */ #define MBEDTLS_AES_ROM_TABLES #define MBEDTLS_ECP_DP_SECP256R1_ENABLED #define MBEDTLS_ECP_NIST_OPTIM @@ -50,7 +50,7 @@ #define MBEDTLS_SSL_DTLS_HELLO_VERIFY #define MBEDTLS_SSL_EXPORT_KEYS -/* mbed TLS modules */ +/* Mbed TLS modules */ #define MBEDTLS_AES_C #define MBEDTLS_ASN1_PARSE_C #define MBEDTLS_ASN1_WRITE_C diff --git a/doxygen/mbedtls.doxyfile b/doxygen/mbedtls.doxyfile index 0fc2da09c6..adad131760 100644 --- a/doxygen/mbedtls.doxyfile +++ b/doxygen/mbedtls.doxyfile @@ -1,4 +1,4 @@ -PROJECT_NAME = "mbed TLS v2.28.4" +PROJECT_NAME = "Mbed TLS v2.28.4" OUTPUT_DIRECTORY = ../apidoc/ FULL_PATH_NAMES = NO OPTIMIZE_OUTPUT_FOR_C = YES diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index 62c0f620af..11b417bd33 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -1,4 +1,4 @@ -option(INSTALL_MBEDTLS_HEADERS "Install mbed TLS headers." ON) +option(INSTALL_MBEDTLS_HEADERS "Install Mbed TLS headers." ON) if(INSTALL_MBEDTLS_HEADERS) diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h index 2cb36e9e17..dddcb73c75 100644 --- a/include/mbedtls/check_config.h +++ b/include/mbedtls/check_config.h @@ -35,7 +35,7 @@ */ #include #if CHAR_BIT != 8 -#error "mbed TLS requires a platform with 8-bit chars" +#error "Mbed TLS requires a platform with 8-bit chars" #endif #if defined(_WIN32) diff --git a/include/mbedtls/compat-1.3.h b/include/mbedtls/compat-1.3.h index 3a34cf6d26..117c88ae73 100644 --- a/include/mbedtls/compat-1.3.h +++ b/include/mbedtls/compat-1.3.h @@ -1,7 +1,7 @@ /** * \file compat-1.3.h * - * \brief Compatibility definitions for using mbed TLS with client code written + * \brief Compatibility definitions for using Mbed TLS with client code written * for the PolarSSL naming conventions. * * \deprecated Use the new names directly instead diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h index 8d8139fef8..7b1f38aa9e 100644 --- a/include/mbedtls/config.h +++ b/include/mbedtls/config.h @@ -163,7 +163,7 @@ * * Enable the memory allocation layer. * - * By default mbed TLS uses the system-provided calloc() and free(). + * By default Mbed TLS uses the system-provided calloc() and free(). * This allows different allocators (self-implemented or provided) to be * provided to the platform abstraction layer. * @@ -236,10 +236,10 @@ /** * \def MBEDTLS_PLATFORM_EXIT_ALT * - * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let mbed TLS support the + * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let Mbed TLS support the * function in the platform abstraction layer. * - * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, mbed TLS will + * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, Mbed TLS will * provide a function "mbedtls_platform_set_printf()" that allows you to set an * alternative printf function pointer. * @@ -285,7 +285,7 @@ //#define MBEDTLS_PLATFORM_GMTIME_R_ALT /** - * Uncomment the macro to let mbed TLS use your alternate implementation of + * Uncomment the macro to let Mbed TLS use your alternate implementation of * mbedtls_platform_zeroize(). This replaces the default implementation in * platform_util.c. * @@ -400,7 +400,7 @@ /** \} name SECTION: System support */ /** - * \name SECTION: mbed TLS feature support + * \name SECTION: Mbed TLS feature support * * This section sets support for features that are or are not needed * within the modules that are enabled. @@ -423,7 +423,7 @@ /** * \def MBEDTLS_AES_ALT * - * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let mbed TLS use your + * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let Mbed TLS use your * alternate core implementation of a symmetric crypto, an arithmetic or hash * module (e.g. platform specific assembly optimized implementations). Keep * in mind that the function prototypes should remain the same. @@ -431,7 +431,7 @@ * This replaces the whole module. If you only want to replace one of the * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags. * - * Example: In case you uncomment MBEDTLS_AES_ALT, mbed TLS will no longer + * Example: In case you uncomment MBEDTLS_AES_ALT, Mbed TLS will no longer * provide the "struct mbedtls_aes_context" definition and omit the base * function declarations and implementations. "aes_alt.h" will be included from * "aes.h" to include the new function definitions. @@ -484,14 +484,14 @@ /** * \def MBEDTLS_MD2_PROCESS_ALT * - * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use you + * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let Mbed TLS use you * alternate core implementation of symmetric crypto or hash function. Keep in * mind that function prototypes should remain the same. * - * This replaces only one function. The header file from mbed TLS is still + * This replaces only one function. The header file from Mbed TLS is still * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags. * - * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, mbed TLS will + * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, Mbed TLS will * no longer provide the mbedtls_sha1_process() function, but it will still provide * the other function (using your mbedtls_sha1_process() function) and the definition * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible @@ -551,11 +551,11 @@ * * Expose a part of the internal interface of the Elliptic Curve Point module. * - * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let mbed TLS use your + * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let Mbed TLS use your * alternative core implementation of elliptic curve arithmetic. Keep in mind * that function prototypes should remain the same. * - * This partially replaces one function. The header file from mbed TLS is still + * This partially replaces one function. The header file from Mbed TLS is still * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation * is still present and it is used for group structures not supported by the * alternative. @@ -579,11 +579,11 @@ * implement optimized set up and tear down instructions. * * Example: In case you set MBEDTLS_ECP_INTERNAL_ALT and - * MBEDTLS_ECP_DOUBLE_JAC_ALT, mbed TLS will still provide the ecp_double_jac() + * MBEDTLS_ECP_DOUBLE_JAC_ALT, Mbed TLS will still provide the ecp_double_jac() * function, but will use your mbedtls_internal_ecp_double_jac() if the group * for the operation is supported by your implementation (i.e. your * mbedtls_internal_ecp_grp_capable() function returns 1 for this group). If the - * group is not supported by your implementation, then the original mbed TLS + * group is not supported by your implementation, then the original Mbed TLS * implementation of ecp_double_jac() is used instead, unless this fallback * behaviour is disabled by setting MBEDTLS_ECP_NO_FALLBACK (in which case * ecp_double_jac() will return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE). @@ -614,7 +614,7 @@ /** * \def MBEDTLS_TEST_NULL_ENTROPY * - * Enables testing and use of mbed TLS without any configured entropy sources. + * Enables testing and use of Mbed TLS without any configured entropy sources. * This permits use of the library on platforms before an entropy source has * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the * MBEDTLS_ENTROPY_NV_SEED switches). @@ -631,7 +631,7 @@ /** * \def MBEDTLS_ENTROPY_HARDWARE_ALT * - * Uncomment this macro to let mbed TLS use your own implementation of a + * Uncomment this macro to let Mbed TLS use your own implementation of a * hardware entropy collector. * * Your function must be called \c mbedtls_hardware_poll(), have the same @@ -1639,7 +1639,7 @@ * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES * * Enable sending of alert messages in case of encountered errors as per RFC. - * If you choose not to send the alert messages, mbed TLS can still communicate + * If you choose not to send the alert messages, Mbed TLS can still communicate * with other servers, only debugging of failures is harder. * * The advantage of not sending alert messages, is that no information is given @@ -2429,12 +2429,12 @@ * Uncomment to enable use of ZLIB */ //#define MBEDTLS_ZLIB_SUPPORT -/** \} name SECTION: mbed TLS feature support */ +/** \} name SECTION: Mbed TLS feature support */ /** - * \name SECTION: mbed TLS modules + * \name SECTION: Mbed TLS modules * - * This section enables or disables entire modules in mbed TLS + * This section enables or disables entire modules in Mbed TLS * \{ */ @@ -3155,7 +3155,7 @@ * Module: library/memory_buffer_alloc.c * * Requires: MBEDTLS_PLATFORM_C - * MBEDTLS_PLATFORM_MEMORY (to use it within mbed TLS) + * MBEDTLS_PLATFORM_MEMORY (to use it within Mbed TLS) * * Enable this module to enable the buffer memory allocator. */ @@ -3595,7 +3595,7 @@ * \def MBEDTLS_THREADING_C * * Enable the threading abstraction layer. - * By default mbed TLS assumes it is used in a non-threaded environment or that + * By default Mbed TLS assumes it is used in a non-threaded environment or that * contexts are not shared between threads. If you do intend to use contexts * between threads, you will need to enable this layer to prevent race * conditions. See also our Knowledge Base article about threading: @@ -3609,7 +3609,7 @@ * You will have to enable either MBEDTLS_THREADING_ALT or * MBEDTLS_THREADING_PTHREAD. * - * Enable this layer to allow use of mutexes within mbed TLS + * Enable this layer to allow use of mutexes within Mbed TLS */ //#define MBEDTLS_THREADING_C @@ -3761,7 +3761,7 @@ */ #define MBEDTLS_XTEA_C -/** \} name SECTION: mbed TLS modules */ +/** \} name SECTION: Mbed TLS modules */ /** * \name SECTION: General configuration options diff --git a/include/mbedtls/ecp.h b/include/mbedtls/ecp.h index 23ebe9bc9a..4995090f9b 100644 --- a/include/mbedtls/ecp.h +++ b/include/mbedtls/ecp.h @@ -219,7 +219,7 @@ mbedtls_ecp_point; #if !defined(MBEDTLS_ECP_ALT) /* - * default mbed TLS elliptic curve arithmetic implementation + * default Mbed TLS elliptic curve arithmetic implementation * * (in case MBEDTLS_ECP_ALT is defined then the developer has to provide an * alternative implementation for the whole module and it will replace this diff --git a/include/mbedtls/entropy_poll.h b/include/mbedtls/entropy_poll.h index eca3b5620c..fed686235f 100644 --- a/include/mbedtls/entropy_poll.h +++ b/include/mbedtls/entropy_poll.h @@ -82,7 +82,7 @@ int mbedtls_hardclock_poll(void *data, /** * \brief Entropy poll callback for a hardware source * - * \warning This is not provided by mbed TLS! + * \warning This is not provided by Mbed TLS! * See \c MBEDTLS_ENTROPY_HARDWARE_ALT in config.h. * * \note This must accept NULL as its first argument. diff --git a/include/mbedtls/error.h b/include/mbedtls/error.h index dd3c787d6c..bc3e678b10 100644 --- a/include/mbedtls/error.h +++ b/include/mbedtls/error.h @@ -171,7 +171,7 @@ static inline int mbedtls_error_add(int high, int low, } /** - * \brief Translate a mbed TLS error code into a string representation, + * \brief Translate a Mbed TLS error code into a string representation, * Result is truncated if necessary and always includes a terminating * null byte. * diff --git a/include/mbedtls/pkcs11.h b/include/mbedtls/pkcs11.h index 80a8a9c423..908a1bc35c 100644 --- a/include/mbedtls/pkcs11.h +++ b/include/mbedtls/pkcs11.h @@ -71,7 +71,7 @@ typedef struct mbedtls_pkcs11_context { MBEDTLS_DEPRECATED void mbedtls_pkcs11_init(mbedtls_pkcs11_context *ctx); /** - * Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate. + * Fill in a Mbed TLS certificate, based on the given PKCS11 helper certificate. * * \deprecated This function is deprecated and will be removed in a * future version of the library. diff --git a/include/mbedtls/platform_time.h b/include/mbedtls/platform_time.h index eee61d695a..112286bef8 100644 --- a/include/mbedtls/platform_time.h +++ b/include/mbedtls/platform_time.h @@ -1,7 +1,7 @@ /** * \file platform_time.h * - * \brief mbed TLS Platform time abstraction + * \brief Mbed TLS Platform time abstraction */ /* * Copyright The Mbed TLS Contributors diff --git a/include/mbedtls/ssl_ciphersuites.h b/include/mbedtls/ssl_ciphersuites.h index 5300125f94..cdf724c229 100644 --- a/include/mbedtls/ssl_ciphersuites.h +++ b/include/mbedtls/ssl_ciphersuites.h @@ -1,7 +1,7 @@ /** * \file ssl_ciphersuites.h * - * \brief SSL Ciphersuites for mbed TLS + * \brief SSL Ciphersuites for Mbed TLS */ /* * Copyright The Mbed TLS Contributors diff --git a/include/mbedtls/threading.h b/include/mbedtls/threading.h index 25de77e7d4..5b5efca620 100644 --- a/include/mbedtls/threading.h +++ b/include/mbedtls/threading.h @@ -63,9 +63,9 @@ typedef struct mbedtls_threading_mutex_t { * \brief Set your alternate threading implementation function * pointers and initialize global mutexes. If used, this * function must be called once in the main thread before any - * other mbed TLS function is called, and + * other Mbed TLS function is called, and * mbedtls_threading_free_alt() must be called once in the main - * thread after all other mbed TLS functions. + * thread after all other Mbed TLS functions. * * \note mutex_init() and mutex_free() don't return a status code. * If mutex_init() fails, it should leave its argument (the diff --git a/include/mbedtls/version.h b/include/mbedtls/version.h index 1ae06e6868..b602ecade8 100644 --- a/include/mbedtls/version.h +++ b/include/mbedtls/version.h @@ -21,7 +21,7 @@ */ /* * This set of compile-time defines and run-time variables can be used to - * determine the version number of the mbed TLS library used. + * determine the version number of the Mbed TLS library used. */ #ifndef MBEDTLS_VERSION_H #define MBEDTLS_VERSION_H @@ -47,7 +47,7 @@ */ #define MBEDTLS_VERSION_NUMBER 0x021C0400 #define MBEDTLS_VERSION_STRING "2.28.4" -#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.28.4" +#define MBEDTLS_VERSION_STRING_FULL "Mbed TLS 2.28.4" #if defined(MBEDTLS_VERSION_C) @@ -72,9 +72,9 @@ unsigned int mbedtls_version_get_number(void); void mbedtls_version_get_string(char *string); /** - * Get the full version string ("mbed TLS x.y.z"). + * Get the full version string ("Mbed TLS x.y.z"). * - * \param string The string that will receive the value. The mbed TLS version + * \param string The string that will receive the value. The Mbed TLS version * string will use 18 bytes AT MOST including a terminating * null byte. * (So the buffer should be at least 18 bytes to receive this @@ -84,12 +84,12 @@ void mbedtls_version_get_string_full(char *string); /** * \brief Check if support for a feature was compiled into this - * mbed TLS binary. This allows you to see at runtime if the + * Mbed TLS binary. This allows you to see at runtime if the * library was for instance compiled with or without * Multi-threading support. * * \note only checks against defines in the sections "System - * support", "mbed TLS modules" and "mbed TLS feature + * support", "Mbed TLS modules" and "Mbed TLS feature * support" in config.h * * \param feature The string for the define to check (e.g. "MBEDTLS_AES_C") diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h index d436635a5e..bf883e8e96 100644 --- a/include/mbedtls/x509_crt.h +++ b/include/mbedtls/x509_crt.h @@ -914,7 +914,7 @@ int mbedtls_x509write_crt_set_validity(mbedtls_x509write_cert *ctx, const char * * \brief Set the issuer name for a Certificate * Issuer names should contain a comma-separated list * of OID types and values: - * e.g. "C=UK,O=ARM,CN=mbed TLS CA" + * e.g. "C=UK,O=ARM,CN=Mbed TLS CA" * * \param ctx CRT context to use * \param issuer_name issuer name to set @@ -929,7 +929,7 @@ int mbedtls_x509write_crt_set_issuer_name(mbedtls_x509write_cert *ctx, * \brief Set the subject name for a Certificate * Subject names should contain a comma-separated list * of OID types and values: - * e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + * e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" * * \param ctx CRT context to use * \param subject_name subject name to set diff --git a/include/mbedtls/x509_csr.h b/include/mbedtls/x509_csr.h index 5975584da2..6daf57b662 100644 --- a/include/mbedtls/x509_csr.h +++ b/include/mbedtls/x509_csr.h @@ -171,7 +171,7 @@ void mbedtls_x509write_csr_init(mbedtls_x509write_csr *ctx); * \brief Set the subject name for a CSR * Subject names should contain a comma-separated list * of OID types and values: - * e.g. "C=UK,O=ARM,CN=mbed TLS Server 1" + * e.g. "C=UK,O=ARM,CN=Mbed TLS Server 1" * * \param ctx CSR context to use * \param subject_name subject name to set diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt index 147caafd50..1bff6bc792 100644 --- a/library/CMakeLists.txt +++ b/library/CMakeLists.txt @@ -1,7 +1,7 @@ -option(USE_STATIC_MBEDTLS_LIBRARY "Build mbed TLS static library." ON) -option(USE_SHARED_MBEDTLS_LIBRARY "Build mbed TLS shared library." OFF) -option(LINK_WITH_PTHREAD "Explicitly link mbed TLS library to pthread." OFF) -option(LINK_WITH_TRUSTED_STORAGE "Explicitly link mbed TLS library to trusted_storage." OFF) +option(USE_STATIC_MBEDTLS_LIBRARY "Build Mbed TLS static library." ON) +option(USE_SHARED_MBEDTLS_LIBRARY "Build Mbed TLS shared library." OFF) +option(LINK_WITH_PTHREAD "Explicitly link Mbed TLS library to pthread." OFF) +option(LINK_WITH_TRUSTED_STORAGE "Explicitly link Mbed TLS library to trusted_storage." OFF) # Set the project root directory if it's not already defined, as may happen if # the library folder is included directly by a parent project, without diff --git a/library/cipher.c b/library/cipher.c index 36f87c3005..4b715d4896 100644 --- a/library/cipher.c +++ b/library/cipher.c @@ -1,7 +1,7 @@ /** * \file cipher.c * - * \brief Generic cipher wrapper for mbed TLS + * \brief Generic cipher wrapper for Mbed TLS * * \author Adriaan de Jong * diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c index 737cf9776b..f92d000380 100644 --- a/library/cipher_wrap.c +++ b/library/cipher_wrap.c @@ -1,7 +1,7 @@ /** * \file cipher_wrap.c * - * \brief Generic cipher wrapper for mbed TLS + * \brief Generic cipher wrapper for Mbed TLS * * \author Adriaan de Jong * diff --git a/library/ecjpake.c b/library/ecjpake.c index 3728d1a580..17fa6983d8 100644 --- a/library/ecjpake.c +++ b/library/ecjpake.c @@ -1060,7 +1060,7 @@ int mbedtls_ecjpake_self_test(int verbose) #if !defined(MBEDTLS_ECJPAKE_ALT) /* 'reference handshake' tests can only be run against implementations * for which we have 100% control over how the random ephemeral keys - * are generated. This is only the case for the internal mbed TLS + * are generated. This is only the case for the internal Mbed TLS * implementation, so these tests are skipped in case the internal * implementation is swapped out for an alternative one. */ if (verbose != 0) { diff --git a/library/md.c b/library/md.c index 1e24ee45bc..45563781d5 100644 --- a/library/md.c +++ b/library/md.c @@ -1,7 +1,7 @@ /** * \file md.c * - * \brief Generic message digest wrapper for mbed TLS + * \brief Generic message digest wrapper for Mbed TLS * * \author Adriaan de Jong * diff --git a/library/mps_common.h b/library/mps_common.h index 4a10176bd5..80e3133a59 100644 --- a/library/mps_common.h +++ b/library/mps_common.h @@ -14,7 +14,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ /** diff --git a/library/mps_error.h b/library/mps_error.h index 15570d2384..5113959beb 100644 --- a/library/mps_error.h +++ b/library/mps_error.h @@ -14,7 +14,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ /** diff --git a/library/mps_reader.h b/library/mps_reader.h index bff6705037..bb912ec17f 100644 --- a/library/mps_reader.h +++ b/library/mps_reader.h @@ -14,7 +14,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ /** diff --git a/library/mps_trace.h b/library/mps_trace.h index 6f0455f038..f8e0a5d807 100644 --- a/library/mps_trace.h +++ b/library/mps_trace.h @@ -14,7 +14,7 @@ * See the License for the specific language governing permissions and * limitations under the License. * - * This file is part of mbed TLS (https://tls.mbed.org) + * This file is part of Mbed TLS (https://tls.mbed.org) */ /** diff --git a/library/psa_crypto_core.h b/library/psa_crypto_core.h index 688ea38853..781c9d2f43 100644 --- a/library/psa_crypto_core.h +++ b/library/psa_crypto_core.h @@ -238,12 +238,12 @@ psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot, const uint8_t *data, size_t data_length); -/** Convert an mbed TLS error code to a PSA error code +/** Convert an Mbed TLS error code to a PSA error code * * \note This function is provided solely for the convenience of * Mbed TLS and may be removed at any time without notice. * - * \param ret An mbed TLS-thrown error code + * \param ret An Mbed TLS-thrown error code * * \return The corresponding PSA error code */ diff --git a/library/ssl_ciphersuites.c b/library/ssl_ciphersuites.c index b37921a1eb..f1e995633b 100644 --- a/library/ssl_ciphersuites.c +++ b/library/ssl_ciphersuites.c @@ -1,7 +1,7 @@ /** * \file ssl_ciphersuites.c * - * \brief SSL ciphersuites for mbed TLS + * \brief SSL ciphersuites for Mbed TLS * * Copyright The Mbed TLS Contributors * SPDX-License-Identifier: Apache-2.0 diff --git a/programs/ssl/ssl_fork_server.c b/programs/ssl/ssl_fork_server.c index adba12aabe..d50a6b89ec 100644 --- a/programs/ssl/ssl_fork_server.c +++ b/programs/ssl/ssl_fork_server.c @@ -69,7 +69,7 @@ int main(void) #define HTTP_RESPONSE \ "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \ - "

mbed TLS Test Server

\r\n" \ + "

Mbed TLS Test Server

\r\n" \ "

Successful connection using: %s

\r\n" #define DEBUG_LEVEL 0 diff --git a/programs/ssl/ssl_mail_client.c b/programs/ssl/ssl_mail_client.c index 89a26fc70a..a10aa76227 100644 --- a/programs/ssl/ssl_mail_client.c +++ b/programs/ssl/ssl_mail_client.c @@ -771,9 +771,9 @@ usage: mbedtls_printf(" > Write content to server:"); fflush(stdout); - len = sprintf((char *) buf, "From: %s\r\nSubject: mbed TLS Test mail\r\n\r\n" + len = sprintf((char *) buf, "From: %s\r\nSubject: Mbed TLS Test mail\r\n\r\n" "This is a simple test mail from the " - "mbed TLS mail client example.\r\n" + "Mbed TLS mail client example.\r\n" "\r\n" "Enjoy!", opt.mail_from); ret = write_ssl_data(&ssl, buf, len); diff --git a/programs/ssl/ssl_pthread_server.c b/programs/ssl/ssl_pthread_server.c index b4a718d7a2..a2a0ca32d6 100644 --- a/programs/ssl/ssl_pthread_server.c +++ b/programs/ssl/ssl_pthread_server.c @@ -71,7 +71,7 @@ int main(void) #define HTTP_RESPONSE \ "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \ - "

mbed TLS Test Server

\r\n" \ + "

Mbed TLS Test Server

\r\n" \ "

Successful connection using: %s

\r\n" #define DEBUG_LEVEL 0 diff --git a/programs/ssl/ssl_server.c b/programs/ssl/ssl_server.c index 69fd0bb065..f8ce7c415a 100644 --- a/programs/ssl/ssl_server.c +++ b/programs/ssl/ssl_server.c @@ -64,7 +64,7 @@ int main(void) #define HTTP_RESPONSE \ "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \ - "

mbed TLS Test Server

\r\n" \ + "

Mbed TLS Test Server

\r\n" \ "

Successful connection using: %s

\r\n" #define DEBUG_LEVEL 0 diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c index 2d5a1333b4..c01bf1306f 100644 --- a/programs/ssl/ssl_server2.c +++ b/programs/ssl/ssl_server2.c @@ -160,7 +160,7 @@ int main(void) * packets (for fragmentation purposes) */ #define HTTP_RESPONSE \ "HTTP/1.0 200 OK\r\nContent-Type: text/html\r\n\r\n" \ - "

mbed TLS Test Server

\r\n" \ + "

Mbed TLS Test Server

\r\n" \ "

Successful connection using: %s

\r\n" // LONG_RESPONSE /* diff --git a/scripts/bump_version.sh b/scripts/bump_version.sh index 57ade94a7e..b84308d9cd 100755 --- a/scripts/bump_version.sh +++ b/scripts/bump_version.sh @@ -125,7 +125,7 @@ cat include/mbedtls/version.h | \ sed -e "s/_VERSION_PATCH .\{1,\}/_VERSION_PATCH $PATCH/" | \ sed -e "s/_VERSION_NUMBER .\{1,\}/_VERSION_NUMBER $VERSION_NR/" | \ sed -e "s/_VERSION_STRING .\{1,\}/_VERSION_STRING \"$VERSION\"/" | \ - sed -e "s/_VERSION_STRING_FULL .\{1,\}/_VERSION_STRING_FULL \"mbed TLS $VERSION\"/" \ + sed -e "s/_VERSION_STRING_FULL .\{1,\}/_VERSION_STRING_FULL \"Mbed TLS $VERSION\"/" \ > tmp mv tmp include/mbedtls/version.h diff --git a/scripts/footprint.sh b/scripts/footprint.sh index 4d7be7a27c..8e7f60a412 100755 --- a/scripts/footprint.sh +++ b/scripts/footprint.sh @@ -17,7 +17,7 @@ # # Purpose # -# This script determines ROM size (or code size) for the standard mbed TLS +# This script determines ROM size (or code size) for the standard Mbed TLS # configurations, when built for a Cortex M3/M4 target. # # Configurations included: @@ -108,7 +108,7 @@ else fi log "" -log "mbed TLS $MBEDTLS_VERSION$GIT_VERSION" +log "Mbed TLS $MBEDTLS_VERSION$GIT_VERSION" log "$( arm-none-eabi-gcc --version | head -n1 )" log "CFLAGS=$ARMGCC_FLAGS" diff --git a/scripts/generate_features.pl b/scripts/generate_features.pl index 74a95279be..6b1ef10176 100755 --- a/scripts/generate_features.pl +++ b/scripts/generate_features.pl @@ -39,8 +39,8 @@ if( @ARGV ) { my $feature_format_file = $data_dir.'/version_features.fmt'; -my @sections = ( "System support", "mbed TLS modules", - "mbed TLS feature support" ); +my @sections = ( "System support", "Mbed TLS modules", + "Mbed TLS feature support" ); my $line_separator = $/; undef $/; diff --git a/scripts/lcov.sh b/scripts/lcov.sh index 8d141eedf7..6bba02fd24 100755 --- a/scripts/lcov.sh +++ b/scripts/lcov.sh @@ -51,7 +51,7 @@ lcov_library_report () { lcov --rc lcov_branch_coverage=1 --add-tracefile Coverage/tmp/files.info --add-tracefile Coverage/tmp/tests.info -o Coverage/tmp/all.info lcov --rc lcov_branch_coverage=1 --remove Coverage/tmp/all.info -o Coverage/tmp/final.info '*.h' gendesc tests/Descriptions.txt -o Coverage/tmp/descriptions - genhtml --title "mbed TLS" --description-file Coverage/tmp/descriptions --keep-descriptions --legend --branch-coverage -o Coverage Coverage/tmp/final.info + genhtml --title "Mbed TLS" --description-file Coverage/tmp/descriptions --keep-descriptions --legend --branch-coverage -o Coverage Coverage/tmp/final.info rm -f Coverage/tmp/*.info Coverage/tmp/descriptions echo "Coverage report in: Coverage/index.html" } diff --git a/scripts/rename.pl b/scripts/rename.pl index 9ea5f09c9a..2214f3754f 100755 --- a/scripts/rename.pl +++ b/scripts/rename.pl @@ -17,8 +17,8 @@ # # Purpose # -# This script migrates application source code from the mbed TLS 1.3 API to the -# mbed TLS 2.0 API. +# This script migrates application source code from the Mbed TLS 1.3 API to the +# Mbed TLS 2.0 API. # # The script processes the given source code and renames identifiers - functions # types, enums etc, as @@ -88,7 +88,7 @@ while( my $filename = shift ) if( dir($filename)->parent eq $lib_include_dir || dir($filename)->parent eq $lib_source_dir ) { - die "Script cannot be executed on the mbed TLS library itself."; + die "Script cannot be executed on the Mbed TLS library itself."; } if( -d $filename ) { print STDERR "skip (directory)\n"; next } diff --git a/tests/compat.sh b/tests/compat.sh index 952997537f..ba8465b5e5 100755 --- a/tests/compat.sh +++ b/tests/compat.sh @@ -276,7 +276,7 @@ filter_ciphersuites() { if [ "X" != "X$FILTER" -o "X" != "X$EXCLUDE" ]; then - # Ciphersuite for mbed TLS + # Ciphersuite for Mbed TLS M_CIPHERS=$( filter "$M_CIPHERS" ) # Ciphersuite for OpenSSL @@ -286,7 +286,7 @@ filter_ciphersuites() G_CIPHERS=$( filter "$G_CIPHERS" ) fi - # For GnuTLS client -> mbed TLS server, + # For GnuTLS client -> Mbed TLS server, # we need to force IPv4 by connecting to 127.0.0.1 but then auth fails if is_dtls "$MODE" && [ "X$VERIFY" = "XYES" ]; then G_CIPHERS="" diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index 4ed1949a2c..19c9cc5ba2 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -125,7 +125,7 @@ shopt -s extglob pre_check_environment () { if [ -d library -a -d include -a -d tests ]; then :; else - echo "Must be run from mbed TLS root" >&2 + echo "Must be run from Mbed TLS root" >&2 exit 1 fi } diff --git a/tests/scripts/basic-build-test.sh b/tests/scripts/basic-build-test.sh index abc4a2fba9..196ce459c9 100755 --- a/tests/scripts/basic-build-test.sh +++ b/tests/scripts/basic-build-test.sh @@ -43,7 +43,7 @@ set -eu if [ -d library -a -d include -a -d tests ]; then :; else - echo "Must be run from mbed TLS root" >&2 + echo "Must be run from Mbed TLS root" >&2 exit 1 fi diff --git a/tests/scripts/check-doxy-blocks.pl b/tests/scripts/check-doxy-blocks.pl index 3ed7069c57..dd955301ff 100755 --- a/tests/scripts/check-doxy-blocks.pl +++ b/tests/scripts/check-doxy-blocks.pl @@ -68,7 +68,7 @@ sub check_dir { # Check that the script is being run from the project's root directory. for my $dir (@directories) { if (! -d $dir) { - die "This script must be run from the mbed TLS root directory"; + die "This script must be run from the Mbed TLS root directory"; } else { check_dir($dir) } diff --git a/tests/scripts/check-generated-files.sh b/tests/scripts/check-generated-files.sh index f8a244928d..ac0a08d89c 100755 --- a/tests/scripts/check-generated-files.sh +++ b/tests/scripts/check-generated-files.sh @@ -34,7 +34,7 @@ EOF fi if [ -d library -a -d include -a -d tests ]; then :; else - echo "Must be run from mbed TLS root" >&2 + echo "Must be run from Mbed TLS root" >&2 exit 1 fi diff --git a/tests/scripts/doxygen.sh b/tests/scripts/doxygen.sh index 2bc8dc992c..cb87829e26 100755 --- a/tests/scripts/doxygen.sh +++ b/tests/scripts/doxygen.sh @@ -21,7 +21,7 @@ set -eu if [ -d library -a -d include -a -d tests ]; then :; else - echo "Must be run from mbed TLS root" >&2 + echo "Must be run from Mbed TLS root" >&2 exit 1 fi diff --git a/tests/scripts/generate-afl-tests.sh b/tests/scripts/generate-afl-tests.sh index a640b566dd..a51fbc9650 100755 --- a/tests/scripts/generate-afl-tests.sh +++ b/tests/scripts/generate-afl-tests.sh @@ -41,7 +41,7 @@ THIS_DIR=$(basename $PWD) if [ -d ../library -a -d ../include -a -d ../tests -a $THIS_DIR == "tests" ]; then :; else - echo " [!] Must be run from mbed TLS tests directory" >&2 + echo " [!] Must be run from Mbed TLS tests directory" >&2 exit 1 fi diff --git a/tests/suites/test_suite_ecp.function b/tests/suites/test_suite_ecp.function index a3103d930a..b134061456 100644 --- a/tests/suites/test_suite_ecp.function +++ b/tests/suites/test_suite_ecp.function @@ -489,7 +489,7 @@ void ecp_test_vect_restart(int id, * MBEDTLS_ECP_WINDOW_SIZE, as well as implementation details that may * change in the future. A factor 2 is a minimum safety margin. * - * For reference, with mbed TLS 2.4 and default settings, for P-256: + * For reference, with Mbed TLS 2.4 and default settings, for P-256: * - Random point mult: ~3250M * - Cold base point mult: ~3300M * - Hot base point mult: ~1100M diff --git a/tests/suites/test_suite_version.function b/tests/suites/test_suite_version.function index 981f8ab85f..eeae512626 100644 --- a/tests/suites/test_suite_version.function +++ b/tests/suites/test_suite_version.function @@ -20,7 +20,7 @@ void check_compiletime_version(char *version_str) mbedtls_snprintf(build_str, 100, "%d.%d.%d", MBEDTLS_VERSION_MAJOR, MBEDTLS_VERSION_MINOR, MBEDTLS_VERSION_PATCH); - mbedtls_snprintf(build_str_full, 100, "mbed TLS %d.%d.%d", MBEDTLS_VERSION_MAJOR, + mbedtls_snprintf(build_str_full, 100, "Mbed TLS %d.%d.%d", MBEDTLS_VERSION_MAJOR, MBEDTLS_VERSION_MINOR, MBEDTLS_VERSION_PATCH); build_int = MBEDTLS_VERSION_MAJOR << 24 | @@ -56,7 +56,7 @@ void check_runtime_version(char *version_str) (get_int >> 24) & 0xFF, (get_int >> 16) & 0xFF, (get_int >> 8) & 0xFF); - mbedtls_snprintf(build_str_full, 100, "mbed TLS %s", version_str); + mbedtls_snprintf(build_str_full, 100, "Mbed TLS %s", version_str); TEST_ASSERT(strcmp(build_str, version_str) == 0); TEST_ASSERT(strcmp(build_str_full, get_str_full) == 0); diff --git a/tests/suites/test_suite_x509parse.function b/tests/suites/test_suite_x509parse.function index 09a9d12874..6e327924c5 100644 --- a/tests/suites/test_suite_x509parse.function +++ b/tests/suites/test_suite_x509parse.function @@ -564,7 +564,7 @@ void x509_verify_restart(char *crt_file, char *ca_file, /* * See comments on ecp_test_vect_restart() for op count precision. * - * For reference, with mbed TLS 2.6 and default settings: + * For reference, with Mbed TLS 2.6 and default settings: * - ecdsa_verify() for P-256: ~ 6700 * - ecdsa_verify() for P-384: ~ 18800 * - x509_verify() for server5 -> test-ca2: ~ 18800 From bd26a8de929ff62cf792d48bd4ad44110088bc13 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 12 Sep 2023 19:19:31 +0200 Subject: [PATCH 135/135] More spelling corrections Signed-off-by: Gilles Peskine --- include/mbedtls/error.h | 6 +++--- tests/data_files/Makefile | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/include/mbedtls/error.h b/include/mbedtls/error.h index bc3e678b10..0d6230f597 100644 --- a/include/mbedtls/error.h +++ b/include/mbedtls/error.h @@ -171,9 +171,9 @@ static inline int mbedtls_error_add(int high, int low, } /** - * \brief Translate a Mbed TLS error code into a string representation, - * Result is truncated if necessary and always includes a terminating - * null byte. + * \brief Translate an Mbed TLS error code into a string representation. + * The result is truncated if necessary and always includes a + * terminating null byte. * * \param errnum error code * \param buffer buffer to place representation in diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile index e2e419074e..f67db07120 100644 --- a/tests/data_files/Makefile +++ b/tests/data_files/Makefile @@ -1,7 +1,7 @@ ## This file contains a record of how some of the test data was ## generated. The final build products are committed to the repository ## as well to make sure that the test data is identical. You do not -## need to use this makefile unless you're extending mbed TLS's tests. +## need to use this makefile unless you're extending Mbed TLS's tests. ## Many data files were generated prior to the existence of this ## makefile, so the method of their generation was not recorded.