Migrate to the new redirect format introduced by ReadTheDocs in
readthedocs/readthedocs.org#10881
Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
Fix // comments stopping on 'n' instead of newlines. Also allow
backslash-newline in // comments.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
`psa_collect_statuses.py` runs `make RECORD_PSA_STATUS_COVERAGE_LOG=1`,
which builds with `RECORD_PSA_STATUS_COVERAGE_LOG`. In this mode, the build
includes wrappers for PSA functions, which conflict with the newly
introduced wrappers that are enabled whenever `MBEDTLS_TEST_HOOKS` is
enabled. In the future, the collect-statuses mechanism should use the new
generic wrapper mechanism. For the time being, keep the old wrappers and
avoid the new wrappers when doing the collect-statuses build.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
For now, only instrument the one function for which buffer copying has been
implemented, namely `psa_cipher_encrypt`.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Code in unit tests (`tests/suites/*.function`) and in test support
code (`tests/src/**.c`) will now go through the wrapper functions when they
call a PSA API function and `MBEDTLS_TEST_HOOKS` is enabled.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
Commit files generated by `tests/scripts/generate_psa_wrappers.py`. As of
this commit, the new code is neither useful (the wrappers just call the
underlying functions) nor used (the wrapper functions are not called from
anywhere). This will change in subsequent commits.
This is a deviation from our normal practice of generating
configuration-independent platform-independent files as part of the build in
the development branch. The PSA test wrappers will be committed to the
repository for some time for two reasons:
* In the short term, we will review the generated code but not fully review
the generator script.
* The build scripts cannot yet accommodate a generated header file.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The new script `tests/scripts/generate_psa_wrappers.py` generates the
implementation of wrapper functions for PSA API functions, as well as a
header that defines macros that redirect calls to the wrapper functions. By
default, the wrapper functions just call the underlying library function.
With `--log`, the wrapper functions log the arguments and return values.
This commit only introduces the new script. Subsequent commits will
integrate the wrappers in the build.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
The Base class generates trivial wrappers that just call the underlying
function. It is meant as a base class to construct useful wrapper generators.
The Logging class generates wrappers that can log the inputs and outputs to
a function.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
These error codes are only returned if the program has been tampered with,
so they should be CORRUPTION_DETECTED.
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
psa_wipe_key_slot can now be called on a slot in any state, if the slot's state
is PSA_SLOT_FULL or PSA_SLOT_PENDING_DELETION then there must be exactly 1 registered
reader.
Remove the state changing calls that are no longer necessary.
Signed-off-by: Ryan Everett <ryan.everett@arm.com>
Move the save/load of session endpoint and
ciphersuite that are common to TLS 1.2 and
TLS 1.3 serialized data from the
specialized ssl_{tls12,tls13}_session_{save,load}
functions to ssl__session_{save,load}.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
The purpose of this change is to eventually base
the calculation in ssl_ticket.c of the ticket age
when parsing a ticket on the ticket creation time
both in TLS 1.2 and TLS 1.3 case.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
The endpoint field is needed to serialize/deserialize
a session in TLS 1.2 the same way it is needed in the
TLS 1.3 case: client specific fields that should not
be in the serialized version on server side if both
TLS client and server are enabled in the TLS library.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Take into account that the lifetime of
tickets can be changed through the
mbedtls_ssl_ticket_rotate() API.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
When calculating the ticket age, remove the check
that the endpoint is a server. The module is
supposed to be used only server side. Furthermore,
if such check was necessary, it should be at the
beginning of all ssl_ticket.c APIs. As there is no
such protection in any API, just remove the check.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
The ticket module is removed from the build
if the TLS server is not in the build now
thus no need for the guard.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
Disable ticket module if either the TLS
server or the support for session tickets
is not enabled at build time as in that
case the ticket module is not used by the
TLS library.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
When we cannot memory poison due to platform constraints, do not attempt
to run memory poisoning metatests (but still run other ASan metatests).
Signed-off-by: David Horstmann <david.horstmann@arm.com>
Allow memory poisoning to be enabled and disabled at runtime using a
thread-local flag. This allows poisoning to be disabled whenever a PSA
function is called but not through the test wrappers, removing false
positive use-after-poisons.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
