blob: 3473725e4e49473cb7bc0bd8ab82b25cb305ecef [file] [log] [blame]
Minos Galanakis6aab5b72024-07-25 14:24:37 +01001# components-configuration-crypto.sh
2#
3# Copyright The Mbed TLS Contributors
4# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
5
Minos Galanakis609f7492024-07-31 16:39:28 +01006# This file contains test components that are executed by all.sh
Minos Galanakis6aab5b72024-07-25 14:24:37 +01007
8################################################################
9#### Configuration Testing - Crypto
10################################################################
11
Minos Galanakis471b34c2024-07-26 15:39:24 +010012component_test_psa_crypto_key_id_encodes_owner () {
13 msg "build: full config + PSA_CRYPTO_KEY_ID_ENCODES_OWNER, cmake, gcc, ASan"
14 scripts/config.py full
15 scripts/config.py set MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
16 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
17 make
18
19 msg "test: full config - USE_PSA_CRYPTO + PSA_CRYPTO_KEY_ID_ENCODES_OWNER, cmake, gcc, ASan"
20 make test
21}
22
23component_test_psa_assume_exclusive_buffers () {
24 msg "build: full config + MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS, cmake, gcc, ASan"
25 scripts/config.py full
26 scripts/config.py set MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
27 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
28 make
29
30 msg "test: full config + MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS, cmake, gcc, ASan"
31 make test
32}
33
Valerio Settidbb646b2024-06-20 14:40:54 +020034component_test_crypto_with_static_key_slots() {
35 msg "build: crypto full + MBEDTLS_PSA_STATIC_KEY_SLOTS"
36 scripts/config.py crypto_full
37 scripts/config.py set MBEDTLS_PSA_STATIC_KEY_SLOTS
Valerio Setti4d9a8212024-08-16 12:35:24 +020038 # Intentionally set MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE to a value that
39 # is enough to contain:
40 # - all RSA public keys up to 4096 bits (max of PSA_VENDOR_RSA_MAX_KEY_BITS).
41 # - RSA key pairs up to 1024 bits, but not 2048 or larger.
42 # - all FFDH key pairs and public keys up to 8192 bits (max of PSA_VENDOR_FFDH_MAX_KEY_BITS).
43 # - all EC key pairs and public keys up to 521 bits (max of PSA_VENDOR_ECC_MAX_CURVE_BITS).
44 scripts/config.py set MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 1212
Valerio Settidbb646b2024-06-20 14:40:54 +020045
Valerio Setti13aadd72024-08-13 13:13:23 +020046 msg "test: crypto full + MBEDTLS_PSA_STATIC_KEY_SLOTS"
Valerio Setti2a3c9b32024-08-14 06:37:02 +020047 make CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS" test
Valerio Settidbb646b2024-06-20 14:40:54 +020048}
49
Minos Galanakis471b34c2024-07-26 15:39:24 +010050# check_renamed_symbols HEADER LIB
51# Check that if HEADER contains '#define MACRO ...' then MACRO is not a symbol
Minos Galanakis609f7492024-07-31 16:39:28 +010052# name in LIB.
Minos Galanakis471b34c2024-07-26 15:39:24 +010053check_renamed_symbols () {
54 ! nm "$2" | sed 's/.* //' |
55 grep -x -F "$(sed -n 's/^ *# *define *\([A-Z_a-z][0-9A-Z_a-z]*\)..*/\1/p' "$1")"
56}
57
58component_build_psa_crypto_spm () {
59 msg "build: full config + PSA_CRYPTO_KEY_ID_ENCODES_OWNER + PSA_CRYPTO_SPM, make, gcc"
60 scripts/config.py full
61 scripts/config.py unset MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
62 scripts/config.py set MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
63 scripts/config.py set MBEDTLS_PSA_CRYPTO_SPM
64 # We can only compile, not link, since our test and sample programs
65 # aren't equipped for the modified names used when MBEDTLS_PSA_CRYPTO_SPM
66 # is active.
67 make CC=gcc CFLAGS='-Werror -Wall -Wextra -I../tests/include/spe' lib
68
69 # Check that if a symbol is renamed by crypto_spe.h, the non-renamed
70 # version is not present.
71 echo "Checking for renamed symbols in the library"
72 check_renamed_symbols tests/include/spe/crypto_spe.h library/libmbedcrypto.a
73}
74
Valerio Settia47b0452024-06-25 18:31:36 +020075# The goal of this component is to build a configuration where:
76# - test code and libtestdriver1 can make use of calloc/free and
77# - core library (including PSA core) cannot use calloc/free.
78component_test_psa_crypto_without_heap() {
Valerio Setti13aadd72024-08-13 13:13:23 +020079 msg "crypto without heap: build libtestdriver1"
Valerio Settia47b0452024-06-25 18:31:36 +020080 # Disable PSA features that cannot be accelerated and whose builtin support
81 # requires calloc/free.
82 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
Valerio Setti13aadd72024-08-13 13:13:23 +020083 scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_HKDF"
84 scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_PBKDF2_"
85 scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_TLS12_"
Valerio Settia47b0452024-06-25 18:31:36 +020086 # RSA key support requires ASN1 parse/write support for testing, but ASN1
87 # is disabled below.
Valerio Setti13aadd72024-08-13 13:13:23 +020088 scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_KEY_TYPE_RSA_"
89 scripts/config.py -f $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_RSA_"
Valerio Settia47b0452024-06-25 18:31:36 +020090 # DES requires built-in support for key generation (parity check) so it
91 # cannot be accelerated
92 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
93 # EC-JPAKE use calloc/free in PSA core
94 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
95
96 # Accelerate all PSA features (which are still enabled in CRYPTO_CONFIG_H).
97 PSA_SYM_LIST=$(./scripts/config.py -f $CRYPTO_CONFIG_H get-all-enabled PSA_WANT)
98 loc_accel_list=$(echo $PSA_SYM_LIST | sed 's/PSA_WANT_//g')
99
Valerio Settia47b0452024-06-25 18:31:36 +0200100 helper_libtestdriver1_adjust_config crypto
101 helper_libtestdriver1_make_drivers "$loc_accel_list"
102
Valerio Setti13aadd72024-08-13 13:13:23 +0200103 msg "crypto without heap: build main library"
Valerio Setti35b0b022024-08-13 13:36:50 +0200104 # Disable all legacy MBEDTLS_xxx symbols.
105 scripts/config.py unset-all "^MBEDTLS_"
106 # Build the PSA core using the proper config file.
107 scripts/config.py set MBEDTLS_PSA_CRYPTO_C
108 scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
Valerio Settia47b0452024-06-25 18:31:36 +0200109 # Enable fully-static key slots in PSA core.
110 scripts/config.py set MBEDTLS_PSA_STATIC_KEY_SLOTS
Valerio Setti35b0b022024-08-13 13:36:50 +0200111 # Prevent PSA core from creating a copy of input/output buffers.
Valerio Settia47b0452024-06-25 18:31:36 +0200112 scripts/config.py set MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
113 # Prevent PSA core from using CTR-DRBG or HMAC-DRBG for random generation.
114 scripts/config.py set MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
Valerio Setti13aadd72024-08-13 13:13:23 +0200115 # Set calloc/free as null pointer functions. Calling them would crash
Valerio Settia47b0452024-06-25 18:31:36 +0200116 # the program so we can use this as a "sentinel" for being sure no module
117 # is making use of these functions in the library.
Valerio Setti35b0b022024-08-13 13:36:50 +0200118 scripts/config.py set MBEDTLS_PLATFORM_C
Valerio Settia47b0452024-06-25 18:31:36 +0200119 scripts/config.py set MBEDTLS_PLATFORM_MEMORY
120 scripts/config.py set MBEDTLS_PLATFORM_STD_CALLOC NULL
121 scripts/config.py set MBEDTLS_PLATFORM_STD_FREE NULL
122
Valerio Settia47b0452024-06-25 18:31:36 +0200123 helper_libtestdriver1_make_main "$loc_accel_list" lib
124
Valerio Setti13aadd72024-08-13 13:13:23 +0200125 msg "crypto without heap: build test suites and helpers"
126 # Reset calloc/free functions to normal operations so that test code can
Valerio Settia47b0452024-06-25 18:31:36 +0200127 # freely use them.
128 scripts/config.py unset MBEDTLS_PLATFORM_MEMORY
129 scripts/config.py unset MBEDTLS_PLATFORM_STD_CALLOC
130 scripts/config.py unset MBEDTLS_PLATFORM_STD_FREE
131 helper_libtestdriver1_make_main "$loc_accel_list" tests
132
Valerio Setti13aadd72024-08-13 13:13:23 +0200133 msg "crypto without heap: test"
Valerio Settia47b0452024-06-25 18:31:36 +0200134 make test
135}
136
Minos Galanakisf78447f2024-07-26 20:49:51 +0100137component_test_no_rsa_key_pair_generation () {
Minos Galanakisdc0f73a2024-07-26 20:41:42 +0100138 msg "build: default config minus PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE"
139 scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
140 scripts/config.py unset MBEDTLS_GENPRIME
141 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
142 make
143
144 msg "test: default config minus PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE"
145 make test
146}
147
Minos Galanakisc06fd302024-08-01 12:16:59 +0100148component_test_no_pem_no_fs () {
149 msg "build: Default + !MBEDTLS_PEM_PARSE_C + !MBEDTLS_FS_IO (ASan build)"
150 scripts/config.py unset MBEDTLS_PEM_PARSE_C
151 scripts/config.py unset MBEDTLS_FS_IO
152 scripts/config.py unset MBEDTLS_PSA_ITS_FILE_C # requires a filesystem
153 scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA ITS
154 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
155 make
156
157 msg "test: !MBEDTLS_PEM_PARSE_C !MBEDTLS_FS_IO - main suites (inc. selftests) (ASan build)" # ~ 50s
158 make test
159
160 msg "test: !MBEDTLS_PEM_PARSE_C !MBEDTLS_FS_IO - ssl-opt.sh (ASan build)" # ~ 6 min
161 tests/ssl-opt.sh
162}
163
164component_test_rsa_no_crt () {
165 msg "build: Default + RSA_NO_CRT (ASan build)" # ~ 6 min
166 scripts/config.py set MBEDTLS_RSA_NO_CRT
167 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
168 make
169
170 msg "test: RSA_NO_CRT - main suites (inc. selftests) (ASan build)" # ~ 50s
171 make test
172
173 msg "test: RSA_NO_CRT - RSA-related part of ssl-opt.sh (ASan build)" # ~ 5s
174 tests/ssl-opt.sh -f RSA
175
176 msg "test: RSA_NO_CRT - RSA-related part of compat.sh (ASan build)" # ~ 3 min
177 tests/compat.sh -t RSA
178
179 msg "test: RSA_NO_CRT - RSA-related part of context-info.sh (ASan build)" # ~ 15 sec
180 tests/context-info.sh
181}
182
183component_test_no_ctr_drbg_classic () {
184 msg "build: Full minus CTR_DRBG, classic crypto in TLS"
185 scripts/config.py full
186 scripts/config.py unset MBEDTLS_CTR_DRBG_C
187 scripts/config.py unset MBEDTLS_USE_PSA_CRYPTO
188 scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
189
190 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
191 make
192
193 msg "test: Full minus CTR_DRBG, classic crypto - main suites"
194 make test
195
196 # In this configuration, the TLS test programs use HMAC_DRBG.
197 # The SSL tests are slow, so run a small subset, just enough to get
198 # confidence that the SSL code copes with HMAC_DRBG.
199 msg "test: Full minus CTR_DRBG, classic crypto - ssl-opt.sh (subset)"
200 tests/ssl-opt.sh -f 'Default\|SSL async private.*delay=\|tickets enabled on server'
201
202 msg "test: Full minus CTR_DRBG, classic crypto - compat.sh (subset)"
203 tests/compat.sh -m tls12 -t 'ECDSA PSK' -V NO -p OpenSSL
204}
205
206component_test_no_ctr_drbg_use_psa () {
207 msg "build: Full minus CTR_DRBG, PSA crypto in TLS"
208 scripts/config.py full
209 scripts/config.py unset MBEDTLS_CTR_DRBG_C
210 scripts/config.py set MBEDTLS_USE_PSA_CRYPTO
211
212 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
213 make
214
215 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - main suites"
216 make test
217
218 # In this configuration, the TLS test programs use HMAC_DRBG.
219 # The SSL tests are slow, so run a small subset, just enough to get
220 # confidence that the SSL code copes with HMAC_DRBG.
221 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - ssl-opt.sh (subset)"
222 tests/ssl-opt.sh -f 'Default\|SSL async private.*delay=\|tickets enabled on server'
223
224 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - compat.sh (subset)"
225 tests/compat.sh -m tls12 -t 'ECDSA PSK' -V NO -p OpenSSL
226}
227
228component_test_no_hmac_drbg_classic () {
229 msg "build: Full minus HMAC_DRBG, classic crypto in TLS"
230 scripts/config.py full
231 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
232 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
233 scripts/config.py unset MBEDTLS_USE_PSA_CRYPTO
234 scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
235
236 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
237 make
238
239 msg "test: Full minus HMAC_DRBG, classic crypto - main suites"
240 make test
241
242 # Normally our ECDSA implementation uses deterministic ECDSA. But since
243 # HMAC_DRBG is disabled in this configuration, randomized ECDSA is used
244 # instead.
245 # Test SSL with non-deterministic ECDSA. Only test features that
246 # might be affected by how ECDSA signature is performed.
247 msg "test: Full minus HMAC_DRBG, classic crypto - ssl-opt.sh (subset)"
248 tests/ssl-opt.sh -f 'Default\|SSL async private: sign'
249
250 # To save time, only test one protocol version, since this part of
251 # the protocol is identical in (D)TLS up to 1.2.
252 msg "test: Full minus HMAC_DRBG, classic crypto - compat.sh (ECDSA)"
253 tests/compat.sh -m tls12 -t 'ECDSA'
254}
255
256component_test_no_hmac_drbg_use_psa () {
257 msg "build: Full minus HMAC_DRBG, PSA crypto in TLS"
258 scripts/config.py full
259 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
260 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
261 scripts/config.py set MBEDTLS_USE_PSA_CRYPTO
262
263 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
264 make
265
266 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - main suites"
267 make test
268
269 # Normally our ECDSA implementation uses deterministic ECDSA. But since
270 # HMAC_DRBG is disabled in this configuration, randomized ECDSA is used
271 # instead.
272 # Test SSL with non-deterministic ECDSA. Only test features that
273 # might be affected by how ECDSA signature is performed.
274 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - ssl-opt.sh (subset)"
275 tests/ssl-opt.sh -f 'Default\|SSL async private: sign'
276
277 # To save time, only test one protocol version, since this part of
278 # the protocol is identical in (D)TLS up to 1.2.
279 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - compat.sh (ECDSA)"
280 tests/compat.sh -m tls12 -t 'ECDSA'
281}
282
283component_test_psa_external_rng_no_drbg_classic () {
284 msg "build: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, classic crypto in TLS"
285 scripts/config.py full
286 scripts/config.py unset MBEDTLS_USE_PSA_CRYPTO
287 scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
288 scripts/config.py set MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
289 scripts/config.py unset MBEDTLS_ENTROPY_C
290 scripts/config.py unset MBEDTLS_ENTROPY_NV_SEED
291 scripts/config.py unset MBEDTLS_PLATFORM_NV_SEED_ALT
292 scripts/config.py unset MBEDTLS_CTR_DRBG_C
293 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
294 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
295 # When MBEDTLS_USE_PSA_CRYPTO is disabled and there is no DRBG,
296 # the SSL test programs don't have an RNG and can't work. Explicitly
297 # make them use the PSA RNG with -DMBEDTLS_TEST_USE_PSA_CRYPTO_RNG.
298 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS -DMBEDTLS_TEST_USE_PSA_CRYPTO_RNG" LDFLAGS="$ASAN_CFLAGS"
299
300 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, classic crypto - main suites"
301 make test
302
303 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, classic crypto - ssl-opt.sh (subset)"
304 tests/ssl-opt.sh -f 'Default'
305}
306
307component_test_psa_external_rng_no_drbg_use_psa () {
308 msg "build: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto in TLS"
309 scripts/config.py full
310 scripts/config.py set MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
311 scripts/config.py unset MBEDTLS_ENTROPY_C
312 scripts/config.py unset MBEDTLS_ENTROPY_NV_SEED
313 scripts/config.py unset MBEDTLS_PLATFORM_NV_SEED_ALT
314 scripts/config.py unset MBEDTLS_CTR_DRBG_C
315 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
316 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
317 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
318
319 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto - main suites"
320 make test
321
322 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto - ssl-opt.sh (subset)"
323 tests/ssl-opt.sh -f 'Default\|opaque'
324}
325
Minos Galanakis471b34c2024-07-26 15:39:24 +0100326component_test_psa_external_rng_use_psa_crypto () {
327 msg "build: full + PSA_CRYPTO_EXTERNAL_RNG + USE_PSA_CRYPTO minus CTR_DRBG"
328 scripts/config.py full
329 scripts/config.py set MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
330 scripts/config.py set MBEDTLS_USE_PSA_CRYPTO
331 scripts/config.py unset MBEDTLS_CTR_DRBG_C
332 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
333
334 msg "test: full + PSA_CRYPTO_EXTERNAL_RNG + USE_PSA_CRYPTO minus CTR_DRBG"
335 make test
336
337 msg "test: full + PSA_CRYPTO_EXTERNAL_RNG + USE_PSA_CRYPTO minus CTR_DRBG"
338 tests/ssl-opt.sh -f 'Default\|opaque'
339}
340
341component_test_psa_inject_entropy () {
342 msg "build: full + MBEDTLS_PSA_INJECT_ENTROPY"
343 scripts/config.py full
344 scripts/config.py set MBEDTLS_PSA_INJECT_ENTROPY
345 scripts/config.py set MBEDTLS_ENTROPY_NV_SEED
346 scripts/config.py set MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
347 scripts/config.py unset MBEDTLS_PLATFORM_NV_SEED_ALT
348 scripts/config.py unset MBEDTLS_PLATFORM_STD_NV_SEED_READ
349 scripts/config.py unset MBEDTLS_PLATFORM_STD_NV_SEED_WRITE
350 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS '-DMBEDTLS_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'" LDFLAGS="$ASAN_CFLAGS"
351
352 msg "test: full + MBEDTLS_PSA_INJECT_ENTROPY"
353 make test
354}
355
Minos Galanakisf78447f2024-07-26 20:49:51 +0100356component_full_no_pkparse_pkwrite () {
Minos Galanakis471b34c2024-07-26 15:39:24 +0100357 msg "build: full without pkparse and pkwrite"
358
359 scripts/config.py crypto_full
360 scripts/config.py unset MBEDTLS_PK_PARSE_C
361 scripts/config.py unset MBEDTLS_PK_WRITE_C
362
363 make CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
364
365 # Ensure that PK_[PARSE|WRITE]_C were not re-enabled accidentally (additive config).
366 not grep mbedtls_pk_parse_key ${BUILTIN_SRC_PATH}/pkparse.o
367 not grep mbedtls_pk_write_key_der ${BUILTIN_SRC_PATH}/pkwrite.o
368
369 msg "test: full without pkparse and pkwrite"
370 make test
371}
372
373component_test_crypto_full_md_light_only () {
374 msg "build: crypto_full with only the light subset of MD"
375 scripts/config.py crypto_full
376
377 # Disable MD
378 scripts/config.py unset MBEDTLS_MD_C
379 # Disable direct dependencies of MD_C
380 scripts/config.py unset MBEDTLS_HKDF_C
381 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
382 scripts/config.py unset MBEDTLS_PKCS7_C
383 # Disable indirect dependencies of MD_C
384 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # needs HMAC_DRBG
385 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
386 # Disable things that would auto-enable MD_C
387 scripts/config.py unset MBEDTLS_PKCS5_C
388
389 # Note: MD-light is auto-enabled in build_info.h by modules that need it,
390 # which we haven't disabled, so no need to explicitly enable it.
391 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
392
393 # Make sure we don't have the HMAC functions, but the hashing functions
394 not grep mbedtls_md_hmac ${BUILTIN_SRC_PATH}/md.o
395 grep mbedtls_md ${BUILTIN_SRC_PATH}/md.o
396
397 msg "test: crypto_full with only the light subset of MD"
398 make test
399}
400
Minos Galanakiscd5668f2024-07-26 20:36:23 +0100401component_test_full_no_cipher () {
402 msg "build: full no CIPHER"
403
404 scripts/config.py full
405 scripts/config.py unset MBEDTLS_CIPHER_C
406
407 # The built-in implementation of the following algs/key-types depends
408 # on CIPHER_C so we disable them.
409 # This does not hold for KEY_TYPE_CHACHA20 and ALG_CHACHA20_POLY1305
410 # so we keep them enabled.
411 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
412 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CMAC
413 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
414 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
415 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CFB
416 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CTR
417 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
418 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_OFB
419 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
420 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_STREAM_CIPHER
421 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
422
423 # The following modules directly depends on CIPHER_C
424 scripts/config.py unset MBEDTLS_CMAC_C
425 scripts/config.py unset MBEDTLS_NIST_KW_C
426
427 make
428
429 # Ensure that CIPHER_C was not re-enabled
430 not grep mbedtls_cipher_init ${BUILTIN_SRC_PATH}/cipher.o
431
432 msg "test: full no CIPHER"
433 make test
434}
435
Minos Galanakisf78447f2024-07-26 20:49:51 +0100436component_test_full_no_ccm () {
Minos Galanakis471b34c2024-07-26 15:39:24 +0100437 msg "build: full no PSA_WANT_ALG_CCM"
438
439 # Full config enables:
440 # - USE_PSA_CRYPTO so that TLS code dispatches cipher/AEAD to PSA
441 # - CRYPTO_CONFIG so that PSA_WANT config symbols are evaluated
442 scripts/config.py full
443
444 # Disable PSA_WANT_ALG_CCM so that CCM is not supported in PSA. CCM_C is still
445 # enabled, but not used from TLS since USE_PSA is set.
446 # This is helpful to ensure that TLS tests below have proper dependencies.
447 #
448 # Note: also PSA_WANT_ALG_CCM_STAR_NO_TAG is enabled, but it does not cause
449 # PSA_WANT_ALG_CCM to be re-enabled.
450 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM
451
452 make
453
454 msg "test: full no PSA_WANT_ALG_CCM"
455 make test
456}
457
Minos Galanakisf78447f2024-07-26 20:49:51 +0100458component_test_full_no_ccm_star_no_tag () {
Minos Galanakis471b34c2024-07-26 15:39:24 +0100459 msg "build: full no PSA_WANT_ALG_CCM_STAR_NO_TAG"
460
461 # Full config enables CRYPTO_CONFIG so that PSA_WANT config symbols are evaluated
462 scripts/config.py full
463
464 # Disable CCM_STAR_NO_TAG, which is the target of this test, as well as all
465 # other components that enable MBEDTLS_PSA_BUILTIN_CIPHER internal symbol.
466 # This basically disables all unauthenticated ciphers on the PSA side, while
467 # keeping AEADs enabled.
468 #
469 # Note: PSA_WANT_ALG_CCM is enabled, but it does not cause
470 # PSA_WANT_ALG_CCM_STAR_NO_TAG to be re-enabled.
471 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM_STAR_NO_TAG
472 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_STREAM_CIPHER
473 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CTR
474 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CFB
475 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_OFB
476 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_ECB_NO_PADDING
477 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING
478 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7
479
480 make
481
482 # Ensure MBEDTLS_PSA_BUILTIN_CIPHER was not enabled
483 not grep mbedtls_psa_cipher ${PSA_CORE_PATH}/psa_crypto_cipher.o
484
485 msg "test: full no PSA_WANT_ALG_CCM_STAR_NO_TAG"
486 make test
487}
488
Gilles Peskineea5de2b2024-09-19 18:41:55 +0200489component_test_config_symmetric_only () {
490 msg "build: configs/config-symmetric-only.h"
Gilles Peskineaf5a8992024-09-14 11:27:44 +0200491 cp configs/config-symmetric-only.h "$CONFIG_H"
Gilles Peskineaf5a8992024-09-14 11:27:44 +0200492 # test-ref-configs works by overwriting mbedtls_config.h; this makes cmake
493 # want to re-generate generated files that depend on it, quite correctly.
494 # However this doesn't work as the generation script expects a specific
495 # format for mbedtls_config.h, which the other files don't follow. Also,
496 # cmake can't know this, but re-generation is actually not necessary as
497 # the generated files only depend on the list of available options, not
498 # whether they're on or off. So, disable cmake's (over-sensitive here)
499 # dependency resolution for generated files and just rely on them being
500 # present (thanks to pre_generate_files) by turning GEN_FILES off.
501 CC=$ASAN_CC cmake -D GEN_FILES=Off -D CMAKE_BUILD_TYPE:String=Asan .
502 make
503
Gilles Peskineea5de2b2024-09-19 18:41:55 +0200504 msg "test: configs/config-symmetric-only.h - unit tests"
Gilles Peskineaf5a8992024-09-14 11:27:44 +0200505 make test
506}
507
Minos Galanakisc06fd302024-08-01 12:16:59 +0100508component_test_everest () {
509 msg "build: Everest ECDH context (ASan build)" # ~ 6 min
510 scripts/config.py set MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
511 CC=clang cmake -D CMAKE_BUILD_TYPE:String=Asan .
512 make
513
514 msg "test: Everest ECDH context - main suites (inc. selftests) (ASan build)" # ~ 50s
515 make test
516
517 msg "test: metatests (clang, ASan)"
518 tests/scripts/run-metatests.sh any asan poison
519
520 msg "test: Everest ECDH context - ECDH-related part of ssl-opt.sh (ASan build)" # ~ 5s
521 tests/ssl-opt.sh -f ECDH
522
523 msg "test: Everest ECDH context - compat.sh with some ECDH ciphersuites (ASan build)" # ~ 3 min
524 # Exclude some symmetric ciphers that are redundant here to gain time.
525 tests/compat.sh -f ECDH -V NO -e 'ARIA\|CAMELLIA\|CHACHA'
526}
527
528component_test_everest_curve25519_only () {
529 msg "build: Everest ECDH context, only Curve25519" # ~ 6 min
530 scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
531 scripts/config.py set MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
532 scripts/config.py unset MBEDTLS_ECDSA_C
533 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
534 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
535 scripts/config.py -f $CRYPTO_CONFIG_H set PSA_WANT_ALG_ECDH
536 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
537 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
538 scripts/config.py unset MBEDTLS_ECJPAKE_C
539 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
540
541 # Disable all curves
542 scripts/config.py unset-all "MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED"
543 scripts/config.py -f $CRYPTO_CONFIG_H unset-all "PSA_WANT_ECC_[0-9A-Z_a-z]*$"
544 scripts/config.py -f $CRYPTO_CONFIG_H set PSA_WANT_ECC_MONTGOMERY_255
545
546 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
547
548 msg "test: Everest ECDH context, only Curve25519" # ~ 50s
549 make test
550}
551
Minos Galanakis471b34c2024-07-26 15:39:24 +0100552component_test_psa_collect_statuses () {
553 msg "build+test: psa_collect_statuses" # ~30s
554 scripts/config.py full
555 tests/scripts/psa_collect_statuses.py
556 # Check that psa_crypto_init() succeeded at least once
557 grep -q '^0:psa_crypto_init:' tests/statuses.log
558 rm -f tests/statuses.log
559}
560
561# Check that the specified libraries exist and are empty.
562are_empty_libraries () {
563 nm "$@" >/dev/null 2>/dev/null
564 ! nm "$@" 2>/dev/null | grep -v ':$' | grep .
565}
566
567component_build_crypto_default () {
568 msg "build: make, crypto only"
569 scripts/config.py crypto
570 make CFLAGS='-O1 -Werror'
571 are_empty_libraries library/libmbedx509.* library/libmbedtls.*
572}
573
574component_build_crypto_full () {
575 msg "build: make, crypto only, full config"
576 scripts/config.py crypto_full
577 make CFLAGS='-O1 -Werror'
578 are_empty_libraries library/libmbedx509.* library/libmbedtls.*
579}
580
581component_test_crypto_for_psa_service () {
582 msg "build: make, config for PSA crypto service"
583 scripts/config.py crypto
584 scripts/config.py set MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
585 # Disable things that are not needed for just cryptography, to
586 # reach a configuration that would be typical for a PSA cryptography
587 # service providing all implemented PSA algorithms.
588 # System stuff
589 scripts/config.py unset MBEDTLS_ERROR_C
590 scripts/config.py unset MBEDTLS_TIMING_C
591 scripts/config.py unset MBEDTLS_VERSION_FEATURES
592 # Crypto stuff with no PSA interface
593 scripts/config.py unset MBEDTLS_BASE64_C
594 # Keep MBEDTLS_CIPHER_C because psa_crypto_cipher, CCM and GCM need it.
595 scripts/config.py unset MBEDTLS_HKDF_C # PSA's HKDF is independent
596 # Keep MBEDTLS_MD_C because deterministic ECDSA needs it for HMAC_DRBG.
597 scripts/config.py unset MBEDTLS_NIST_KW_C
598 scripts/config.py unset MBEDTLS_PEM_PARSE_C
599 scripts/config.py unset MBEDTLS_PEM_WRITE_C
600 scripts/config.py unset MBEDTLS_PKCS12_C
601 scripts/config.py unset MBEDTLS_PKCS5_C
602 # MBEDTLS_PK_PARSE_C and MBEDTLS_PK_WRITE_C are actually currently needed
603 # in PSA code to work with RSA keys. We don't require users to set those:
604 # they will be reenabled in build_info.h.
605 scripts/config.py unset MBEDTLS_PK_C
606 scripts/config.py unset MBEDTLS_PK_PARSE_C
607 scripts/config.py unset MBEDTLS_PK_WRITE_C
608 make CFLAGS='-O1 -Werror' all test
609 are_empty_libraries library/libmbedx509.* library/libmbedtls.*
610}
611
612component_build_crypto_baremetal () {
613 msg "build: make, crypto only, baremetal config"
614 scripts/config.py crypto_baremetal
615 make CFLAGS="-O1 -Werror -I$PWD/tests/include/baremetal-override/"
616 are_empty_libraries library/libmbedx509.* library/libmbedtls.*
617}
618
619support_build_crypto_baremetal () {
620 support_build_baremetal "$@"
621}
622
623# depends.py family of tests
624component_test_depends_py_cipher_id () {
625 msg "test/build: depends.py cipher_id (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200626 tests/scripts/depends.py cipher_id
Minos Galanakis471b34c2024-07-26 15:39:24 +0100627}
628
629component_test_depends_py_cipher_chaining () {
630 msg "test/build: depends.py cipher_chaining (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200631 tests/scripts/depends.py cipher_chaining
Minos Galanakis471b34c2024-07-26 15:39:24 +0100632}
633
634component_test_depends_py_cipher_padding () {
635 msg "test/build: depends.py cipher_padding (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200636 tests/scripts/depends.py cipher_padding
Minos Galanakis471b34c2024-07-26 15:39:24 +0100637}
638
639component_test_depends_py_curves () {
640 msg "test/build: depends.py curves (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200641 tests/scripts/depends.py curves
Minos Galanakis471b34c2024-07-26 15:39:24 +0100642}
643
644component_test_depends_py_hashes () {
645 msg "test/build: depends.py hashes (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200646 tests/scripts/depends.py hashes
Minos Galanakis471b34c2024-07-26 15:39:24 +0100647}
648
Minos Galanakis471b34c2024-07-26 15:39:24 +0100649component_test_depends_py_pkalgs () {
650 msg "test/build: depends.py pkalgs (gcc)"
Minos Galanakis471b34c2024-07-26 15:39:24 +0100651 tests/scripts/depends.py pkalgs
652}
653
654component_test_psa_crypto_config_ffdh_2048_only () {
655 msg "build: full config - only DH 2048"
656
657 scripts/config.py full
658
659 # Disable all DH groups other than 2048.
660 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_DH_RFC7919_3072
661 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_DH_RFC7919_4096
662 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_DH_RFC7919_6144
663 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_DH_RFC7919_8192
664
665 make CFLAGS="$ASAN_CFLAGS -Werror" LDFLAGS="$ASAN_CFLAGS"
666
667 msg "test: full config - only DH 2048"
668 make test
669
670 msg "ssl-opt: full config - only DH 2048"
671 tests/ssl-opt.sh -f "ffdh"
672}
673
674component_build_no_pk_rsa_alt_support () {
675 msg "build: !MBEDTLS_PK_RSA_ALT_SUPPORT" # ~30s
676
677 scripts/config.py full
678 scripts/config.py unset MBEDTLS_PK_RSA_ALT_SUPPORT
679 scripts/config.py set MBEDTLS_RSA_C
680 scripts/config.py set MBEDTLS_X509_CRT_WRITE_C
681
682 # Only compile - this is primarily to test for compile issues
683 make CFLAGS='-Werror -Wall -Wextra -I../tests/include/alt-dummy'
684}
685
686component_build_module_alt () {
687 msg "build: MBEDTLS_XXX_ALT" # ~30s
688 scripts/config.py full
689
690 # Disable options that are incompatible with some ALT implementations:
691 # aesni.c references mbedtls_aes_context fields directly.
692 scripts/config.py unset MBEDTLS_AESNI_C
693 scripts/config.py unset MBEDTLS_AESCE_C
694 # MBEDTLS_ECP_RESTARTABLE is documented as incompatible.
695 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
696 # You can only have one threading implementation: alt or pthread, not both.
697 scripts/config.py unset MBEDTLS_THREADING_PTHREAD
698 # The SpecifiedECDomain parsing code accesses mbedtls_ecp_group fields
699 # directly and assumes the implementation works with partial groups.
700 scripts/config.py unset MBEDTLS_PK_PARSE_EC_EXTENDED
701 # MBEDTLS_SHA256_*ALT can't be used with MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_*
702 scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
703 scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY
704 # MBEDTLS_SHA512_*ALT can't be used with MBEDTLS_SHA512_USE_A64_CRYPTO_*
705 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
706 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY
707
708 # Enable all MBEDTLS_XXX_ALT for whole modules. Do not enable
709 # MBEDTLS_XXX_YYY_ALT which are for single functions.
710 scripts/config.py set-all 'MBEDTLS_([A-Z0-9]*|NIST_KW)_ALT'
711
712 # We can only compile, not link, since we don't have any implementations
713 # suitable for testing with the dummy alt headers.
714 make CFLAGS='-Werror -Wall -Wextra -I../tests/include/alt-dummy' lib
715}
716
717component_test_psa_crypto_config_accel_ecdsa () {
718 msg "build: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDSA"
719
720 # Algorithms and key types to accelerate
721 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
722 $(helper_get_psa_key_type_list "ECC") \
723 $(helper_get_psa_curve_list)"
724
725 # Configure
726 # ---------
727
Elena Uziunaite91d83862024-09-04 14:51:31 +0100728 # Start from default config + TLS 1.3
Minos Galanakis471b34c2024-07-26 15:39:24 +0100729 helper_libtestdriver1_adjust_config "default"
730
Elena Uziunaite91d83862024-09-04 14:51:31 +0100731 scripts/config.py set MBEDTLS_USE_PSA_CRYPTO
732
Minos Galanakis471b34c2024-07-26 15:39:24 +0100733 # Disable the module that's accelerated
734 scripts/config.py unset MBEDTLS_ECDSA_C
735
736 # Disable things that depend on it
737 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
738 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
739
740 # Build
741 # -----
742
743 # These hashes are needed for some ECDSA signature tests.
Elena Uziunaiteffce45c2024-09-12 14:58:52 +0100744 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
Minos Galanakis471b34c2024-07-26 15:39:24 +0100745 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
746
747 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
748
749 helper_libtestdriver1_make_main "$loc_accel_list"
750
751 # Make sure this was not re-enabled by accident (additive config)
752 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
753
754 # Run the tests
755 # -------------
756
757 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDSA"
758 make test
759}
760
761component_test_psa_crypto_config_accel_ecdh () {
762 msg "build: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDH"
763
764 # Algorithms and key types to accelerate
765 loc_accel_list="ALG_ECDH \
766 $(helper_get_psa_key_type_list "ECC") \
767 $(helper_get_psa_curve_list)"
768
769 # Configure
770 # ---------
771
772 # Start from default config (no USE_PSA)
773 helper_libtestdriver1_adjust_config "default"
774
775 # Disable the module that's accelerated
776 scripts/config.py unset MBEDTLS_ECDH_C
777
778 # Disable things that depend on it
779 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
780 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
781 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
782 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
783 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
784
785 # Build
786 # -----
787
788 helper_libtestdriver1_make_drivers "$loc_accel_list"
789
790 helper_libtestdriver1_make_main "$loc_accel_list"
791
792 # Make sure this was not re-enabled by accident (additive config)
793 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
794
795 # Run the tests
796 # -------------
797
798 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated ECDH"
799 make test
800}
801
802component_test_psa_crypto_config_accel_ffdh () {
803 msg "build: full with accelerated FFDH"
804
805 # Algorithms and key types to accelerate
806 loc_accel_list="ALG_FFDH \
807 $(helper_get_psa_key_type_list "DH") \
808 $(helper_get_psa_dh_group_list)"
809
810 # Configure
811 # ---------
812
813 # start with full (USE_PSA and TLS 1.3)
814 helper_libtestdriver1_adjust_config "full"
815
816 # Disable the module that's accelerated
817 scripts/config.py unset MBEDTLS_DHM_C
818
819 # Disable things that depend on it
820 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
821 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
822
823 # Build
824 # -----
825
826 helper_libtestdriver1_make_drivers "$loc_accel_list"
827
828 helper_libtestdriver1_make_main "$loc_accel_list"
829
830 # Make sure this was not re-enabled by accident (additive config)
831 not grep mbedtls_dhm_ ${BUILTIN_SRC_PATH}/dhm.o
832
833 # Run the tests
834 # -------------
835
836 msg "test: full with accelerated FFDH"
837 make test
838
839 msg "ssl-opt: full with accelerated FFDH alg"
840 tests/ssl-opt.sh -f "ffdh"
841}
842
843component_test_psa_crypto_config_reference_ffdh () {
844 msg "build: full with non-accelerated FFDH"
845
846 # Start with full (USE_PSA and TLS 1.3)
847 helper_libtestdriver1_adjust_config "full"
848
849 # Disable things that are not supported
850 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
851 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
852 make
853
854 msg "test suites: full with non-accelerated FFDH alg"
855 make test
856
857 msg "ssl-opt: full with non-accelerated FFDH alg"
858 tests/ssl-opt.sh -f "ffdh"
859}
860
Minos Galanakisf78447f2024-07-26 20:49:51 +0100861component_test_psa_crypto_config_accel_pake () {
Minos Galanakis471b34c2024-07-26 15:39:24 +0100862 msg "build: full with accelerated PAKE"
863
864 loc_accel_list="ALG_JPAKE \
865 $(helper_get_psa_key_type_list "ECC") \
866 $(helper_get_psa_curve_list)"
867
868 # Configure
869 # ---------
870
871 helper_libtestdriver1_adjust_config "full"
872
873 # Make built-in fallback not available
874 scripts/config.py unset MBEDTLS_ECJPAKE_C
875 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
876
877 # Build
878 # -----
879
880 helper_libtestdriver1_make_drivers "$loc_accel_list"
881
882 helper_libtestdriver1_make_main "$loc_accel_list"
883
884 # Make sure this was not re-enabled by accident (additive config)
885 not grep mbedtls_ecjpake_init ${BUILTIN_SRC_PATH}/ecjpake.o
886
887 # Run the tests
888 # -------------
889
890 msg "test: full with accelerated PAKE"
891 make test
892}
893
894component_test_psa_crypto_config_accel_ecc_some_key_types () {
895 msg "build: full with accelerated EC algs and some key types"
896
897 # Algorithms and key types to accelerate
898 # For key types, use an explicitly list to omit GENERATE (and DERIVE)
899 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
900 ALG_ECDH \
901 ALG_JPAKE \
902 KEY_TYPE_ECC_PUBLIC_KEY \
903 KEY_TYPE_ECC_KEY_PAIR_BASIC \
904 KEY_TYPE_ECC_KEY_PAIR_IMPORT \
905 KEY_TYPE_ECC_KEY_PAIR_EXPORT \
906 $(helper_get_psa_curve_list)"
907
908 # Configure
909 # ---------
910
911 # start with config full for maximum coverage (also enables USE_PSA)
912 helper_libtestdriver1_adjust_config "full"
913
914 # Disable modules that are accelerated - some will be re-enabled
915 scripts/config.py unset MBEDTLS_ECDSA_C
916 scripts/config.py unset MBEDTLS_ECDH_C
917 scripts/config.py unset MBEDTLS_ECJPAKE_C
918 scripts/config.py unset MBEDTLS_ECP_C
919
920 # Disable all curves - those that aren't accelerated should be re-enabled
921 helper_disable_builtin_curves
922
923 # Restartable feature is not yet supported by PSA. Once it will in
924 # the future, the following line could be removed (see issues
925 # 6061, 6332 and following ones)
926 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
927
928 # this is not supported by the driver API yet
929 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
930
931 # Build
932 # -----
933
934 # These hashes are needed for some ECDSA signature tests.
935 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
936 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
937 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
938
939 helper_libtestdriver1_make_main "$loc_accel_list"
940
941 # ECP should be re-enabled but not the others
942 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
943 not grep mbedtls_ecdsa ${BUILTIN_SRC_PATH}/ecdsa.o
944 not grep mbedtls_ecjpake ${BUILTIN_SRC_PATH}/ecjpake.o
945 grep mbedtls_ecp ${BUILTIN_SRC_PATH}/ecp.o
946
947 # Run the tests
948 # -------------
949
950 msg "test suites: full with accelerated EC algs and some key types"
951 make test
952}
953
954# Run tests with only (non-)Weierstrass accelerated
955# Common code used in:
956# - component_test_psa_crypto_config_accel_ecc_weierstrass_curves
957# - component_test_psa_crypto_config_accel_ecc_non_weierstrass_curves
Minos Galanakis471b34c2024-07-26 15:39:24 +0100958common_test_psa_crypto_config_accel_ecc_some_curves () {
959 weierstrass=$1
960 if [ $weierstrass -eq 1 ]; then
961 desc="Weierstrass"
962 else
963 desc="non-Weierstrass"
964 fi
965
966 msg "build: crypto_full minus PK with accelerated EC algs and $desc curves"
967
968 # Note: Curves are handled in a special way by the libtestdriver machinery,
969 # so we only want to include them in the accel list when building the main
970 # libraries, hence the use of a separate variable.
971 # Note: the following loop is a modified version of
972 # helper_get_psa_curve_list that only keeps Weierstrass families.
973 loc_weierstrass_list=""
974 loc_non_weierstrass_list=""
975 for item in $(sed -n 's/^#define PSA_WANT_\(ECC_[0-9A-Z_a-z]*\).*/\1/p' <"$CRYPTO_CONFIG_H"); do
976 case $item in
977 ECC_BRAINPOOL*|ECC_SECP*)
978 loc_weierstrass_list="$loc_weierstrass_list $item"
979 ;;
980 *)
981 loc_non_weierstrass_list="$loc_non_weierstrass_list $item"
982 ;;
983 esac
984 done
985 if [ $weierstrass -eq 1 ]; then
986 loc_curve_list=$loc_weierstrass_list
987 else
988 loc_curve_list=$loc_non_weierstrass_list
989 fi
990
991 # Algorithms and key types to accelerate
992 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
993 ALG_ECDH \
994 ALG_JPAKE \
995 $(helper_get_psa_key_type_list "ECC") \
996 $loc_curve_list"
997
998 # Configure
999 # ---------
1000
1001 # Start with config crypto_full and remove PK_C:
1002 # that's what's supported now, see docs/driver-only-builds.md.
1003 helper_libtestdriver1_adjust_config "crypto_full"
1004 scripts/config.py unset MBEDTLS_PK_C
1005 scripts/config.py unset MBEDTLS_PK_PARSE_C
1006 scripts/config.py unset MBEDTLS_PK_WRITE_C
1007
1008 # Disable modules that are accelerated - some will be re-enabled
1009 scripts/config.py unset MBEDTLS_ECDSA_C
1010 scripts/config.py unset MBEDTLS_ECDH_C
1011 scripts/config.py unset MBEDTLS_ECJPAKE_C
1012 scripts/config.py unset MBEDTLS_ECP_C
1013
1014 # Disable all curves - those that aren't accelerated should be re-enabled
1015 helper_disable_builtin_curves
1016
1017 # Restartable feature is not yet supported by PSA. Once it will in
1018 # the future, the following line could be removed (see issues
1019 # 6061, 6332 and following ones)
1020 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
1021
1022 # this is not supported by the driver API yet
1023 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
1024
1025 # Build
1026 # -----
1027
1028 # These hashes are needed for some ECDSA signature tests.
1029 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1030 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1031 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1032
1033 helper_libtestdriver1_make_main "$loc_accel_list"
1034
1035 # We expect ECDH to be re-enabled for the missing curves
1036 grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1037 # We expect ECP to be re-enabled, however the parts specific to the
1038 # families of curves that are accelerated should be ommited.
1039 # - functions with mxz in the name are specific to Montgomery curves
1040 # - ecp_muladd is specific to Weierstrass curves
1041 ##nm ${BUILTIN_SRC_PATH}/ecp.o | tee ecp.syms
1042 if [ $weierstrass -eq 1 ]; then
1043 not grep mbedtls_ecp_muladd ${BUILTIN_SRC_PATH}/ecp.o
1044 grep mxz ${BUILTIN_SRC_PATH}/ecp.o
1045 else
1046 grep mbedtls_ecp_muladd ${BUILTIN_SRC_PATH}/ecp.o
1047 not grep mxz ${BUILTIN_SRC_PATH}/ecp.o
1048 fi
1049 # We expect ECDSA and ECJPAKE to be re-enabled only when
1050 # Weierstrass curves are not accelerated
1051 if [ $weierstrass -eq 1 ]; then
1052 not grep mbedtls_ecdsa ${BUILTIN_SRC_PATH}/ecdsa.o
1053 not grep mbedtls_ecjpake ${BUILTIN_SRC_PATH}/ecjpake.o
1054 else
1055 grep mbedtls_ecdsa ${BUILTIN_SRC_PATH}/ecdsa.o
1056 grep mbedtls_ecjpake ${BUILTIN_SRC_PATH}/ecjpake.o
1057 fi
1058
1059 # Run the tests
1060 # -------------
1061
1062 msg "test suites: crypto_full minus PK with accelerated EC algs and $desc curves"
1063 make test
1064}
1065
1066component_test_psa_crypto_config_accel_ecc_weierstrass_curves () {
1067 common_test_psa_crypto_config_accel_ecc_some_curves 1
1068}
1069
1070component_test_psa_crypto_config_accel_ecc_non_weierstrass_curves () {
1071 common_test_psa_crypto_config_accel_ecc_some_curves 0
1072}
1073
1074# Auxiliary function to build config for all EC based algorithms (EC-JPAKE,
1075# ECDH, ECDSA) with and without drivers.
1076# The input parameter is a boolean value which indicates:
1077# - 0 keep built-in EC algs,
1078# - 1 exclude built-in EC algs (driver only).
1079#
1080# This is used by the two following components to ensure they always use the
1081# same config, except for the use of driver or built-in EC algorithms:
1082# - component_test_psa_crypto_config_accel_ecc_ecp_light_only;
1083# - component_test_psa_crypto_config_reference_ecc_ecp_light_only.
1084# This supports comparing their test coverage with analyze_outcomes.py.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001085config_psa_crypto_config_ecp_light_only () {
1086 driver_only="$1"
1087 # start with config full for maximum coverage (also enables USE_PSA)
1088 helper_libtestdriver1_adjust_config "full"
1089 if [ "$driver_only" -eq 1 ]; then
1090 # Disable modules that are accelerated
1091 scripts/config.py unset MBEDTLS_ECDSA_C
1092 scripts/config.py unset MBEDTLS_ECDH_C
1093 scripts/config.py unset MBEDTLS_ECJPAKE_C
1094 scripts/config.py unset MBEDTLS_ECP_C
1095 fi
1096
1097 # Restartable feature is not yet supported by PSA. Once it will in
1098 # the future, the following line could be removed (see issues
1099 # 6061, 6332 and following ones)
1100 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
1101}
1102
1103# Keep in sync with component_test_psa_crypto_config_reference_ecc_ecp_light_only
Minos Galanakis471b34c2024-07-26 15:39:24 +01001104component_test_psa_crypto_config_accel_ecc_ecp_light_only () {
1105 msg "build: full with accelerated EC algs"
1106
1107 # Algorithms and key types to accelerate
1108 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
1109 ALG_ECDH \
1110 ALG_JPAKE \
1111 $(helper_get_psa_key_type_list "ECC") \
1112 $(helper_get_psa_curve_list)"
1113
1114 # Configure
1115 # ---------
1116
1117 # Use the same config as reference, only without built-in EC algs
1118 config_psa_crypto_config_ecp_light_only 1
1119
1120 # Do not disable builtin curves because that support is required for:
1121 # - MBEDTLS_PK_PARSE_EC_EXTENDED
1122 # - MBEDTLS_PK_PARSE_EC_COMPRESSED
1123
1124 # Build
1125 # -----
1126
1127 # These hashes are needed for some ECDSA signature tests.
1128 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1129 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1130 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1131
1132 helper_libtestdriver1_make_main "$loc_accel_list"
1133
1134 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
1135 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
1136 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1137 not grep mbedtls_ecjpake_ ${BUILTIN_SRC_PATH}/ecjpake.o
1138 not grep mbedtls_ecp_mul ${BUILTIN_SRC_PATH}/ecp.o
1139
1140 # Run the tests
1141 # -------------
1142
1143 msg "test suites: full with accelerated EC algs"
1144 make test
1145
1146 msg "ssl-opt: full with accelerated EC algs"
1147 tests/ssl-opt.sh
1148}
1149
1150# Keep in sync with component_test_psa_crypto_config_accel_ecc_ecp_light_only
Minos Galanakis471b34c2024-07-26 15:39:24 +01001151component_test_psa_crypto_config_reference_ecc_ecp_light_only () {
1152 msg "build: MBEDTLS_PSA_CRYPTO_CONFIG with non-accelerated EC algs"
1153
1154 config_psa_crypto_config_ecp_light_only 0
1155
1156 make
1157
1158 msg "test suites: full with non-accelerated EC algs"
1159 make test
1160
1161 msg "ssl-opt: full with non-accelerated EC algs"
1162 tests/ssl-opt.sh
1163}
1164
1165# This helper function is used by:
1166# - component_test_psa_crypto_config_accel_ecc_no_ecp_at_all()
1167# - component_test_psa_crypto_config_reference_ecc_no_ecp_at_all()
1168# to ensure that both tests use the same underlying configuration when testing
1169# driver's coverage with analyze_outcomes.py.
1170#
1171# This functions accepts 1 boolean parameter as follows:
1172# - 1: building with accelerated EC algorithms (ECDSA, ECDH, ECJPAKE), therefore
1173# excluding their built-in implementation as well as ECP_C & ECP_LIGHT
1174# - 0: include built-in implementation of EC algorithms.
1175#
1176# PK_C and RSA_C are always disabled to ensure there is no remaining dependency
1177# on the ECP module.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001178config_psa_crypto_no_ecp_at_all () {
1179 driver_only="$1"
1180 # start with full config for maximum coverage (also enables USE_PSA)
1181 helper_libtestdriver1_adjust_config "full"
1182
1183 if [ "$driver_only" -eq 1 ]; then
1184 # Disable modules that are accelerated
1185 scripts/config.py unset MBEDTLS_ECDSA_C
1186 scripts/config.py unset MBEDTLS_ECDH_C
1187 scripts/config.py unset MBEDTLS_ECJPAKE_C
1188 # Disable ECP module (entirely)
1189 scripts/config.py unset MBEDTLS_ECP_C
1190 fi
1191
1192 # Disable all the features that auto-enable ECP_LIGHT (see build_info.h)
1193 scripts/config.py unset MBEDTLS_PK_PARSE_EC_EXTENDED
1194 scripts/config.py unset MBEDTLS_PK_PARSE_EC_COMPRESSED
1195 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
1196
1197 # Restartable feature is not yet supported by PSA. Once it will in
1198 # the future, the following line could be removed (see issues
1199 # 6061, 6332 and following ones)
1200 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
1201}
1202
1203# Build and test a configuration where driver accelerates all EC algs while
1204# all support and dependencies from ECP and ECP_LIGHT are removed on the library
1205# side.
1206#
1207# Keep in sync with component_test_psa_crypto_config_reference_ecc_no_ecp_at_all()
Minos Galanakis471b34c2024-07-26 15:39:24 +01001208component_test_psa_crypto_config_accel_ecc_no_ecp_at_all () {
1209 msg "build: full + accelerated EC algs - ECP"
1210
1211 # Algorithms and key types to accelerate
1212 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
1213 ALG_ECDH \
1214 ALG_JPAKE \
1215 $(helper_get_psa_key_type_list "ECC") \
1216 $(helper_get_psa_curve_list)"
1217
1218 # Configure
1219 # ---------
1220
1221 # Set common configurations between library's and driver's builds
1222 config_psa_crypto_no_ecp_at_all 1
1223 # Disable all the builtin curves. All the required algs are accelerated.
1224 helper_disable_builtin_curves
1225
1226 # Build
1227 # -----
1228
1229 # Things we wanted supported in libtestdriver1, but not accelerated in the main library:
1230 # SHA-1 and all SHA-2/3 variants, as they are used by ECDSA deterministic.
1231 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1232 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1233
1234 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1235
1236 helper_libtestdriver1_make_main "$loc_accel_list"
1237
1238 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
1239 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
1240 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1241 not grep mbedtls_ecjpake_ ${BUILTIN_SRC_PATH}/ecjpake.o
1242 # Also ensure that ECP module was not re-enabled
1243 not grep mbedtls_ecp_ ${BUILTIN_SRC_PATH}/ecp.o
1244
1245 # Run the tests
1246 # -------------
1247
1248 msg "test: full + accelerated EC algs - ECP"
1249 make test
1250
1251 msg "ssl-opt: full + accelerated EC algs - ECP"
1252 tests/ssl-opt.sh
1253}
1254
1255# Reference function used for driver's coverage analysis in analyze_outcomes.py
1256# in conjunction with component_test_psa_crypto_config_accel_ecc_no_ecp_at_all().
1257# Keep in sync with its accelerated counterpart.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001258component_test_psa_crypto_config_reference_ecc_no_ecp_at_all () {
1259 msg "build: full + non accelerated EC algs"
1260
1261 config_psa_crypto_no_ecp_at_all 0
1262
1263 make
1264
1265 msg "test: full + non accelerated EC algs"
1266 make test
1267
1268 msg "ssl-opt: full + non accelerated EC algs"
1269 tests/ssl-opt.sh
1270}
1271
1272# This is a common configuration helper used directly from:
1273# - common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
1274# - common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
1275# and indirectly from:
1276# - component_test_psa_crypto_config_accel_ecc_no_bignum
1277# - accelerate all EC algs, disable RSA and FFDH
1278# - component_test_psa_crypto_config_reference_ecc_no_bignum
1279# - this is the reference component of the above
1280# - it still disables RSA and FFDH, but it uses builtin EC algs
1281# - component_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
1282# - accelerate all EC and FFDH algs, disable only RSA
1283# - component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
1284# - this is the reference component of the above
1285# - it still disables RSA, but it uses builtin EC and FFDH algs
1286#
1287# This function accepts 2 parameters:
1288# $1: a boolean value which states if we are testing an accelerated scenario
1289# or not.
1290# $2: a string value which states which components are tested. Allowed values
1291# are "ECC" or "ECC_DH".
Minos Galanakisf78447f2024-07-26 20:49:51 +01001292config_psa_crypto_config_accel_ecc_ffdh_no_bignum () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001293 driver_only="$1"
1294 test_target="$2"
1295 # start with full config for maximum coverage (also enables USE_PSA)
1296 helper_libtestdriver1_adjust_config "full"
1297
1298 if [ "$driver_only" -eq 1 ]; then
1299 # Disable modules that are accelerated
1300 scripts/config.py unset MBEDTLS_ECDSA_C
1301 scripts/config.py unset MBEDTLS_ECDH_C
1302 scripts/config.py unset MBEDTLS_ECJPAKE_C
1303 # Disable ECP module (entirely)
1304 scripts/config.py unset MBEDTLS_ECP_C
1305 # Also disable bignum
1306 scripts/config.py unset MBEDTLS_BIGNUM_C
1307 fi
1308
1309 # Disable all the features that auto-enable ECP_LIGHT (see build_info.h)
1310 scripts/config.py unset MBEDTLS_PK_PARSE_EC_EXTENDED
1311 scripts/config.py unset MBEDTLS_PK_PARSE_EC_COMPRESSED
1312 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
1313
1314 # RSA support is intentionally disabled on this test because RSA_C depends
1315 # on BIGNUM_C.
1316 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_RSA_[0-9A-Z_a-z]*"
1317 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_ALG_RSA_[0-9A-Z_a-z]*"
1318 scripts/config.py unset MBEDTLS_RSA_C
1319 scripts/config.py unset MBEDTLS_PKCS1_V15
1320 scripts/config.py unset MBEDTLS_PKCS1_V21
1321 scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
1322 # Also disable key exchanges that depend on RSA
1323 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
1324 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
1325 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
1326 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
1327 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
1328
1329 if [ "$test_target" = "ECC" ]; then
1330 # When testing ECC only, we disable FFDH support, both from builtin and
1331 # PSA sides, and also disable the key exchanges that depend on DHM.
1332 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_FFDH
1333 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_DH_[0-9A-Z_a-z]*"
1334 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_DH_RFC7919_[0-9]*"
1335 scripts/config.py unset MBEDTLS_DHM_C
1336 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
1337 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
1338 else
1339 # When testing ECC and DH instead, we disable DHM and depending key
1340 # exchanges only in the accelerated build
1341 if [ "$driver_only" -eq 1 ]; then
1342 scripts/config.py unset MBEDTLS_DHM_C
1343 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
1344 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
1345 fi
1346 fi
1347
1348 # Restartable feature is not yet supported by PSA. Once it will in
1349 # the future, the following line could be removed (see issues
1350 # 6061, 6332 and following ones)
1351 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
1352}
1353
1354# Common helper used by:
1355# - component_test_psa_crypto_config_accel_ecc_no_bignum
1356# - component_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
1357#
1358# The goal is to build and test accelerating either:
1359# - ECC only or
1360# - both ECC and FFDH
1361#
1362# It is meant to be used in conjunction with
1363# common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum() for drivers
1364# coverage analysis in the "analyze_outcomes.py" script.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001365common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum () {
1366 test_target="$1"
1367
1368 # This is an internal helper to simplify text message handling
1369 if [ "$test_target" = "ECC_DH" ]; then
1370 accel_text="ECC/FFDH"
1371 removed_text="ECP - DH"
1372 else
1373 accel_text="ECC"
1374 removed_text="ECP"
1375 fi
1376
1377 msg "build: full + accelerated $accel_text algs + USE_PSA - $removed_text - BIGNUM"
1378
1379 # By default we accelerate all EC keys/algs
1380 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
1381 ALG_ECDH \
1382 ALG_JPAKE \
1383 $(helper_get_psa_key_type_list "ECC") \
1384 $(helper_get_psa_curve_list)"
1385 # Optionally we can also add DH to the list of accelerated items
1386 if [ "$test_target" = "ECC_DH" ]; then
1387 loc_accel_list="$loc_accel_list \
1388 ALG_FFDH \
1389 $(helper_get_psa_key_type_list "DH") \
1390 $(helper_get_psa_dh_group_list)"
1391 fi
1392
1393 # Configure
1394 # ---------
1395
1396 # Set common configurations between library's and driver's builds
1397 config_psa_crypto_config_accel_ecc_ffdh_no_bignum 1 "$test_target"
1398 # Disable all the builtin curves. All the required algs are accelerated.
1399 helper_disable_builtin_curves
1400
1401 # Build
1402 # -----
1403
1404 # Things we wanted supported in libtestdriver1, but not accelerated in the main library:
1405 # SHA-1 and all SHA-2/3 variants, as they are used by ECDSA deterministic.
1406 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1407 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1408
1409 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1410
1411 helper_libtestdriver1_make_main "$loc_accel_list"
1412
1413 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
1414 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
1415 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1416 not grep mbedtls_ecjpake_ ${BUILTIN_SRC_PATH}/ecjpake.o
1417 # Also ensure that ECP, RSA, [DHM] or BIGNUM modules were not re-enabled
1418 not grep mbedtls_ecp_ ${BUILTIN_SRC_PATH}/ecp.o
1419 not grep mbedtls_rsa_ ${BUILTIN_SRC_PATH}/rsa.o
1420 not grep mbedtls_mpi_ ${BUILTIN_SRC_PATH}/bignum.o
1421 not grep mbedtls_dhm_ ${BUILTIN_SRC_PATH}/dhm.o
1422
1423 # Run the tests
1424 # -------------
1425
1426 msg "test suites: full + accelerated $accel_text algs + USE_PSA - $removed_text - DHM - BIGNUM"
1427
1428 make test
1429
1430 msg "ssl-opt: full + accelerated $accel_text algs + USE_PSA - $removed_text - BIGNUM"
1431 tests/ssl-opt.sh
1432}
1433
1434# Common helper used by:
1435# - component_test_psa_crypto_config_reference_ecc_no_bignum
1436# - component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
1437#
1438# The goal is to build and test a reference scenario (i.e. with builtin
1439# components) compared to the ones used in
1440# common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum() above.
1441#
1442# It is meant to be used in conjunction with
1443# common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum() for drivers'
1444# coverage analysis in "analyze_outcomes.py" script.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001445common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum () {
1446 test_target="$1"
1447
1448 # This is an internal helper to simplify text message handling
1449 if [ "$test_target" = "ECC_DH" ]; then
1450 accel_text="ECC/FFDH"
1451 else
1452 accel_text="ECC"
1453 fi
1454
1455 msg "build: full + non accelerated $accel_text algs + USE_PSA"
1456
1457 config_psa_crypto_config_accel_ecc_ffdh_no_bignum 0 "$test_target"
1458
1459 make
1460
1461 msg "test suites: full + non accelerated EC algs + USE_PSA"
1462 make test
1463
1464 msg "ssl-opt: full + non accelerated $accel_text algs + USE_PSA"
1465 tests/ssl-opt.sh
1466}
1467
1468component_test_psa_crypto_config_accel_ecc_no_bignum () {
1469 common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum "ECC"
1470}
1471
1472component_test_psa_crypto_config_reference_ecc_no_bignum () {
1473 common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum "ECC"
1474}
1475
1476component_test_psa_crypto_config_accel_ecc_ffdh_no_bignum () {
1477 common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum "ECC_DH"
1478}
1479
1480component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum () {
1481 common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum "ECC_DH"
1482}
1483
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001484component_test_tfm_config_as_is () {
1485 msg "build: configs/config-tfm.h"
1486 cp configs/config-tfm.h "$CONFIG_H"
1487 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
1488 make
1489
1490 msg "test: configs/config-tfm.h - unit tests"
1491 make test
1492}
1493
Minos Galanakis471b34c2024-07-26 15:39:24 +01001494# Helper for setting common configurations between:
1495# - component_test_tfm_config_p256m_driver_accel_ec()
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001496# - component_test_tfm_config_no_p256m()
Minos Galanakis471b34c2024-07-26 15:39:24 +01001497common_tfm_config () {
1498 # Enable TF-M config
1499 cp configs/config-tfm.h "$CONFIG_H"
1500 echo "#undef MBEDTLS_PSA_CRYPTO_CONFIG_FILE" >> "$CONFIG_H"
1501 cp configs/ext/crypto_config_profile_medium.h "$CRYPTO_CONFIG_H"
1502
1503 # Other config adjustment to make the tests pass.
1504 # This should probably be adopted upstream.
1505 #
1506 # - USE_PSA_CRYPTO for PK_HAVE_ECC_KEYS
1507 echo "#define MBEDTLS_USE_PSA_CRYPTO" >> "$CONFIG_H"
1508
1509 # Config adjustment for better test coverage in our environment.
1510 # This is not needed just to build and pass tests.
1511 #
1512 # Enable filesystem I/O for the benefit of PK parse/write tests.
1513 echo "#define MBEDTLS_FS_IO" >> "$CONFIG_H"
1514}
1515
1516# Keep this in sync with component_test_tfm_config() as they are both meant
1517# to be used in analyze_outcomes.py for driver's coverage analysis.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001518component_test_tfm_config_p256m_driver_accel_ec () {
1519 msg "build: TF-M config + p256m driver + accel ECDH(E)/ECDSA"
1520
1521 common_tfm_config
1522
1523 # Build crypto library
1524 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS -I../tests/include/spe" LDFLAGS="$ASAN_CFLAGS"
1525
1526 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
1527 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
1528 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1529 not grep mbedtls_ecjpake_ ${BUILTIN_SRC_PATH}/ecjpake.o
1530 # Also ensure that ECP, RSA, DHM or BIGNUM modules were not re-enabled
1531 not grep mbedtls_ecp_ ${BUILTIN_SRC_PATH}/ecp.o
1532 not grep mbedtls_rsa_ ${BUILTIN_SRC_PATH}/rsa.o
1533 not grep mbedtls_dhm_ ${BUILTIN_SRC_PATH}/dhm.o
1534 not grep mbedtls_mpi_ ${BUILTIN_SRC_PATH}/bignum.o
1535 # Check that p256m was built
1536 grep -q p256_ecdsa_ library/libmbedcrypto.a
1537
1538 # In "config-tfm.h" we disabled CIPHER_C tweaking TF-M's configuration
1539 # files, so we want to ensure that it has not be re-enabled accidentally.
1540 not grep mbedtls_cipher ${BUILTIN_SRC_PATH}/cipher.o
1541
1542 # Run the tests
1543 msg "test: TF-M config + p256m driver + accel ECDH(E)/ECDSA"
1544 make test
1545}
1546
1547# Keep this in sync with component_test_tfm_config_p256m_driver_accel_ec() as
1548# they are both meant to be used in analyze_outcomes.py for driver's coverage
1549# analysis.
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001550component_test_tfm_config_no_p256m () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001551 common_tfm_config
1552
1553 # Disable P256M driver, which is on by default, so that analyze_outcomes
1554 # can compare this test with test_tfm_config_p256m_driver_accel_ec
1555 echo "#undef MBEDTLS_PSA_P256M_DRIVER_ENABLED" >> "$CONFIG_H"
1556
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001557 msg "build: TF-M config without p256m"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001558 make CFLAGS='-Werror -Wall -Wextra -I../tests/include/spe' tests
1559
1560 # Check that p256m was not built
1561 not grep p256_ecdsa_ library/libmbedcrypto.a
1562
1563 # In "config-tfm.h" we disabled CIPHER_C tweaking TF-M's configuration
1564 # files, so we want to ensure that it has not be re-enabled accidentally.
1565 not grep mbedtls_cipher ${BUILTIN_SRC_PATH}/cipher.o
1566
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001567 msg "test: TF-M config without p256m"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001568 make test
1569}
1570
Minos Galanakis471b34c2024-07-26 15:39:24 +01001571# This is an helper used by:
1572# - component_test_psa_ecc_key_pair_no_derive
1573# - component_test_psa_ecc_key_pair_no_generate
1574# The goal is to test with all PSA_WANT_KEY_TYPE_xxx_KEY_PAIR_yyy symbols
1575# enabled, but one. Input arguments are as follows:
1576# - $1 is the key type under test, i.e. ECC/RSA/DH
1577# - $2 is the key option to be unset (i.e. generate, derive, etc)
Minos Galanakisf78447f2024-07-26 20:49:51 +01001578build_and_test_psa_want_key_pair_partial () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001579 key_type=$1
1580 unset_option=$2
1581 disabled_psa_want="PSA_WANT_KEY_TYPE_${key_type}_KEY_PAIR_${unset_option}"
1582
1583 msg "build: full - MBEDTLS_USE_PSA_CRYPTO - ${disabled_psa_want}"
1584 scripts/config.py full
1585 scripts/config.py unset MBEDTLS_USE_PSA_CRYPTO
1586 scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_3
1587
1588 # All the PSA_WANT_KEY_TYPE_xxx_KEY_PAIR_yyy are enabled by default in
1589 # crypto_config.h so we just disable the one we don't want.
1590 scripts/config.py -f "$CRYPTO_CONFIG_H" unset "$disabled_psa_want"
1591
1592 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
1593
1594 msg "test: full - MBEDTLS_USE_PSA_CRYPTO - ${disabled_psa_want}"
1595 make test
1596}
1597
Minos Galanakisf78447f2024-07-26 20:49:51 +01001598component_test_psa_ecc_key_pair_no_derive () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001599 build_and_test_psa_want_key_pair_partial "ECC" "DERIVE"
1600}
1601
Minos Galanakisf78447f2024-07-26 20:49:51 +01001602component_test_psa_ecc_key_pair_no_generate () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001603 build_and_test_psa_want_key_pair_partial "ECC" "GENERATE"
1604}
1605
1606config_psa_crypto_accel_rsa () {
1607 driver_only=$1
1608
1609 # Start from crypto_full config (no X.509, no TLS)
1610 helper_libtestdriver1_adjust_config "crypto_full"
1611
1612 if [ "$driver_only" -eq 1 ]; then
1613 # Remove RSA support and its dependencies
1614 scripts/config.py unset MBEDTLS_RSA_C
1615 scripts/config.py unset MBEDTLS_PKCS1_V15
1616 scripts/config.py unset MBEDTLS_PKCS1_V21
1617
1618 # We need PEM parsing in the test library as well to support the import
1619 # of PEM encoded RSA keys.
1620 scripts/config.py -f "$CONFIG_TEST_DRIVER_H" set MBEDTLS_PEM_PARSE_C
1621 scripts/config.py -f "$CONFIG_TEST_DRIVER_H" set MBEDTLS_BASE64_C
1622 fi
1623}
1624
1625component_test_psa_crypto_config_accel_rsa_crypto () {
1626 msg "build: crypto_full with accelerated RSA"
1627
1628 loc_accel_list="ALG_RSA_OAEP ALG_RSA_PSS \
1629 ALG_RSA_PKCS1V15_CRYPT ALG_RSA_PKCS1V15_SIGN \
1630 KEY_TYPE_RSA_PUBLIC_KEY \
1631 KEY_TYPE_RSA_KEY_PAIR_BASIC \
1632 KEY_TYPE_RSA_KEY_PAIR_GENERATE \
1633 KEY_TYPE_RSA_KEY_PAIR_IMPORT \
1634 KEY_TYPE_RSA_KEY_PAIR_EXPORT"
1635
1636 # Configure
1637 # ---------
1638
1639 config_psa_crypto_accel_rsa 1
1640
1641 # Build
1642 # -----
1643
1644 # These hashes are needed for unit tests.
1645 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1646 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512 ALG_MD5"
1647 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1648
1649 helper_libtestdriver1_make_main "$loc_accel_list"
1650
1651 # Make sure this was not re-enabled by accident (additive config)
1652 not grep mbedtls_rsa ${BUILTIN_SRC_PATH}/rsa.o
1653
1654 # Run the tests
1655 # -------------
1656
1657 msg "test: crypto_full with accelerated RSA"
1658 make test
1659}
1660
1661component_test_psa_crypto_config_reference_rsa_crypto () {
1662 msg "build: crypto_full with non-accelerated RSA"
1663
1664 # Configure
1665 # ---------
1666 config_psa_crypto_accel_rsa 0
1667
1668 # Build
1669 # -----
1670 make
1671
1672 # Run the tests
1673 # -------------
1674 msg "test: crypto_full with non-accelerated RSA"
1675 make test
1676}
1677
1678# This is a temporary test to verify that full RSA support is present even when
1679# only one single new symbols (PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) is defined.
Minos Galanakisf78447f2024-07-26 20:49:51 +01001680component_test_new_psa_want_key_pair_symbol () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001681 msg "Build: crypto config - MBEDTLS_RSA_C + PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC"
1682
1683 # Create a temporary output file unless there is already one set
1684 if [ "$MBEDTLS_TEST_OUTCOME_FILE" ]; then
1685 REMOVE_OUTCOME_ON_EXIT="no"
1686 else
1687 REMOVE_OUTCOME_ON_EXIT="yes"
1688 MBEDTLS_TEST_OUTCOME_FILE="$PWD/out.csv"
1689 export MBEDTLS_TEST_OUTCOME_FILE
1690 fi
1691
1692 # Start from crypto configuration
1693 scripts/config.py crypto
1694
1695 # Remove RSA support and its dependencies
1696 scripts/config.py unset MBEDTLS_PKCS1_V15
1697 scripts/config.py unset MBEDTLS_PKCS1_V21
1698 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
1699 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
1700 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
1701 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
1702 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
1703 scripts/config.py unset MBEDTLS_RSA_C
1704 scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
1705
1706 # Enable PSA support
1707 scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
1708
1709 # Keep only PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC enabled in order to ensure
1710 # that proper translations is done in crypto_legacy.h.
1711 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
1712 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT
1713 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
1714
1715 make
1716
1717 msg "Test: crypto config - MBEDTLS_RSA_C + PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC"
1718 make test
1719
1720 # Parse only 1 relevant line from the outcome file, i.e. a test which is
1721 # performing RSA signature.
1722 msg "Verify that 'RSA PKCS1 Sign #1 (SHA512, 1536 bits RSA)' is PASS"
1723 cat $MBEDTLS_TEST_OUTCOME_FILE | grep 'RSA PKCS1 Sign #1 (SHA512, 1536 bits RSA)' | grep -q "PASS"
1724
1725 if [ "$REMOVE_OUTCOME_ON_EXIT" == "yes" ]; then
1726 rm $MBEDTLS_TEST_OUTCOME_FILE
1727 fi
1728}
1729
1730component_test_psa_crypto_config_accel_hash () {
1731 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated hash"
1732
1733 loc_accel_list="ALG_MD5 ALG_RIPEMD160 ALG_SHA_1 \
1734 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1735 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1736
1737 # Configure
1738 # ---------
1739
1740 # Start from default config (no USE_PSA)
1741 helper_libtestdriver1_adjust_config "default"
1742
1743 # Disable the things that are being accelerated
1744 scripts/config.py unset MBEDTLS_MD5_C
1745 scripts/config.py unset MBEDTLS_RIPEMD160_C
1746 scripts/config.py unset MBEDTLS_SHA1_C
1747 scripts/config.py unset MBEDTLS_SHA224_C
1748 scripts/config.py unset MBEDTLS_SHA256_C
1749 scripts/config.py unset MBEDTLS_SHA384_C
1750 scripts/config.py unset MBEDTLS_SHA512_C
1751 scripts/config.py unset MBEDTLS_SHA3_C
1752
1753 # Build
1754 # -----
1755
1756 helper_libtestdriver1_make_drivers "$loc_accel_list"
1757
1758 helper_libtestdriver1_make_main "$loc_accel_list"
1759
1760 # There's a risk of something getting re-enabled via config_psa.h;
1761 # make sure it did not happen. Note: it's OK for MD_C to be enabled.
1762 not grep mbedtls_md5 ${BUILTIN_SRC_PATH}/md5.o
1763 not grep mbedtls_sha1 ${BUILTIN_SRC_PATH}/sha1.o
1764 not grep mbedtls_sha256 ${BUILTIN_SRC_PATH}/sha256.o
1765 not grep mbedtls_sha512 ${BUILTIN_SRC_PATH}/sha512.o
1766 not grep mbedtls_ripemd160 ${BUILTIN_SRC_PATH}/ripemd160.o
1767
1768 # Run the tests
1769 # -------------
1770
1771 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated hash"
1772 make test
1773}
1774
1775# Auxiliary function to build config for hashes with and without drivers
Minos Galanakis471b34c2024-07-26 15:39:24 +01001776config_psa_crypto_hash_use_psa () {
1777 driver_only="$1"
1778 # start with config full for maximum coverage (also enables USE_PSA)
1779 helper_libtestdriver1_adjust_config "full"
1780 if [ "$driver_only" -eq 1 ]; then
1781 # disable the built-in implementation of hashes
1782 scripts/config.py unset MBEDTLS_MD5_C
1783 scripts/config.py unset MBEDTLS_RIPEMD160_C
1784 scripts/config.py unset MBEDTLS_SHA1_C
1785 scripts/config.py unset MBEDTLS_SHA224_C
1786 scripts/config.py unset MBEDTLS_SHA256_C # see external RNG below
1787 scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
1788 scripts/config.py unset MBEDTLS_SHA384_C
1789 scripts/config.py unset MBEDTLS_SHA512_C
1790 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
1791 scripts/config.py unset MBEDTLS_SHA3_C
1792 fi
1793}
1794
1795# Note that component_test_psa_crypto_config_reference_hash_use_psa
1796# is related to this component and both components need to be kept in sync.
1797# For details please see comments for component_test_psa_crypto_config_reference_hash_use_psa.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001798component_test_psa_crypto_config_accel_hash_use_psa () {
1799 msg "test: full with accelerated hashes"
1800
1801 loc_accel_list="ALG_MD5 ALG_RIPEMD160 ALG_SHA_1 \
1802 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1803 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1804
1805 # Configure
1806 # ---------
1807
1808 config_psa_crypto_hash_use_psa 1
1809
1810 # Build
1811 # -----
1812
1813 helper_libtestdriver1_make_drivers "$loc_accel_list"
1814
1815 helper_libtestdriver1_make_main "$loc_accel_list"
1816
1817 # There's a risk of something getting re-enabled via config_psa.h;
1818 # make sure it did not happen. Note: it's OK for MD_C to be enabled.
1819 not grep mbedtls_md5 ${BUILTIN_SRC_PATH}/md5.o
1820 not grep mbedtls_sha1 ${BUILTIN_SRC_PATH}/sha1.o
1821 not grep mbedtls_sha256 ${BUILTIN_SRC_PATH}/sha256.o
1822 not grep mbedtls_sha512 ${BUILTIN_SRC_PATH}/sha512.o
1823 not grep mbedtls_ripemd160 ${BUILTIN_SRC_PATH}/ripemd160.o
1824
1825 # Run the tests
1826 # -------------
1827
1828 msg "test: full with accelerated hashes"
1829 make test
1830
1831 # This is mostly useful so that we can later compare outcome files with
1832 # the reference config in analyze_outcomes.py, to check that the
1833 # dependency declarations in ssl-opt.sh and in TLS code are correct.
1834 msg "test: ssl-opt.sh, full with accelerated hashes"
1835 tests/ssl-opt.sh
1836
1837 # This is to make sure all ciphersuites are exercised, but we don't need
1838 # interop testing (besides, we already got some from ssl-opt.sh).
1839 msg "test: compat.sh, full with accelerated hashes"
1840 tests/compat.sh -p mbedTLS -V YES
1841}
1842
1843# This component provides reference configuration for test_psa_crypto_config_accel_hash_use_psa
1844# without accelerated hash. The outcome from both components are used by the analyze_outcomes.py
1845# script to find regression in test coverage when accelerated hash is used (tests and ssl-opt).
1846# Both components need to be kept in sync.
Minos Galanakisf78447f2024-07-26 20:49:51 +01001847component_test_psa_crypto_config_reference_hash_use_psa () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001848 msg "test: full without accelerated hashes"
1849
1850 config_psa_crypto_hash_use_psa 0
1851
1852 make
1853
1854 msg "test: full without accelerated hashes"
1855 make test
1856
1857 msg "test: ssl-opt.sh, full without accelerated hashes"
1858 tests/ssl-opt.sh
1859}
1860
1861# Auxiliary function to build config for hashes with and without drivers
Minos Galanakis471b34c2024-07-26 15:39:24 +01001862config_psa_crypto_hmac_use_psa () {
1863 driver_only="$1"
1864 # start with config full for maximum coverage (also enables USE_PSA)
1865 helper_libtestdriver1_adjust_config "full"
1866
1867 if [ "$driver_only" -eq 1 ]; then
1868 # Disable MD_C in order to disable the builtin support for HMAC. MD_LIGHT
1869 # is still enabled though (for ENTROPY_C among others).
1870 scripts/config.py unset MBEDTLS_MD_C
1871 # Disable also the builtin hashes since they are supported by the driver
1872 # and MD module is able to perform PSA dispathing.
1873 scripts/config.py unset-all MBEDTLS_SHA
1874 scripts/config.py unset MBEDTLS_MD5_C
1875 scripts/config.py unset MBEDTLS_RIPEMD160_C
1876 fi
1877
1878 # Direct dependencies of MD_C. We disable them also in the reference
1879 # component to work with the same set of features.
1880 scripts/config.py unset MBEDTLS_PKCS7_C
1881 scripts/config.py unset MBEDTLS_PKCS5_C
1882 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
1883 scripts/config.py unset MBEDTLS_HKDF_C
1884 # Dependencies of HMAC_DRBG
1885 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC
1886 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
1887}
1888
Minos Galanakisf78447f2024-07-26 20:49:51 +01001889component_test_psa_crypto_config_accel_hmac () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001890 msg "test: full with accelerated hmac"
1891
1892 loc_accel_list="ALG_HMAC KEY_TYPE_HMAC \
1893 ALG_MD5 ALG_RIPEMD160 ALG_SHA_1 \
1894 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1895 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1896
1897 # Configure
1898 # ---------
1899
1900 config_psa_crypto_hmac_use_psa 1
1901
1902 # Build
1903 # -----
1904
1905 helper_libtestdriver1_make_drivers "$loc_accel_list"
1906
1907 helper_libtestdriver1_make_main "$loc_accel_list"
1908
1909 # Ensure that built-in support for HMAC is disabled.
1910 not grep mbedtls_md_hmac ${BUILTIN_SRC_PATH}/md.o
1911
1912 # Run the tests
1913 # -------------
1914
1915 msg "test: full with accelerated hmac"
1916 make test
1917}
1918
Minos Galanakisf78447f2024-07-26 20:49:51 +01001919component_test_psa_crypto_config_reference_hmac () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001920 msg "test: full without accelerated hmac"
1921
1922 config_psa_crypto_hmac_use_psa 0
1923
1924 make
1925
1926 msg "test: full without accelerated hmac"
1927 make test
1928}
1929
1930component_test_psa_crypto_config_accel_des () {
1931 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated DES"
1932
1933 # Albeit this components aims at accelerating DES which should only support
1934 # CBC and ECB modes, we need to accelerate more than that otherwise DES_C
1935 # would automatically be re-enabled by "config_adjust_legacy_from_psa.c"
1936 loc_accel_list="ALG_ECB_NO_PADDING ALG_CBC_NO_PADDING ALG_CBC_PKCS7 \
1937 ALG_CTR ALG_CFB ALG_OFB ALG_XTS ALG_CMAC \
1938 KEY_TYPE_DES"
1939
1940 # Note: we cannot accelerate all ciphers' key types otherwise we would also
1941 # have to either disable CCM/GCM or accelerate them, but that's out of scope
1942 # of this component. This limitation will be addressed by #8598.
1943
1944 # Configure
1945 # ---------
1946
1947 # Start from the full config
1948 helper_libtestdriver1_adjust_config "full"
1949
1950 # Disable the things that are being accelerated
1951 scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
1952 scripts/config.py unset MBEDTLS_CIPHER_PADDING_PKCS7
1953 scripts/config.py unset MBEDTLS_CIPHER_MODE_CTR
1954 scripts/config.py unset MBEDTLS_CIPHER_MODE_CFB
1955 scripts/config.py unset MBEDTLS_CIPHER_MODE_OFB
1956 scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
1957 scripts/config.py unset MBEDTLS_DES_C
1958 scripts/config.py unset MBEDTLS_CMAC_C
1959
1960 # Build
1961 # -----
1962
1963 helper_libtestdriver1_make_drivers "$loc_accel_list"
1964
1965 helper_libtestdriver1_make_main "$loc_accel_list"
1966
1967 # Make sure this was not re-enabled by accident (additive config)
1968 not grep mbedtls_des* ${BUILTIN_SRC_PATH}/des.o
1969
1970 # Run the tests
1971 # -------------
1972
1973 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated DES"
1974 make test
1975}
1976
1977component_test_psa_crypto_config_accel_aead () {
1978 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated AEAD"
1979
1980 loc_accel_list="ALG_GCM ALG_CCM ALG_CHACHA20_POLY1305 \
1981 KEY_TYPE_AES KEY_TYPE_CHACHA20 KEY_TYPE_ARIA KEY_TYPE_CAMELLIA"
1982
1983 # Configure
1984 # ---------
1985
1986 # Start from full config
1987 helper_libtestdriver1_adjust_config "full"
1988
1989 # Disable things that are being accelerated
1990 scripts/config.py unset MBEDTLS_GCM_C
1991 scripts/config.py unset MBEDTLS_CCM_C
1992 scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1993
1994 # Disable CCM_STAR_NO_TAG because this re-enables CCM_C.
1995 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM_STAR_NO_TAG
1996
1997 # Build
1998 # -----
1999
2000 helper_libtestdriver1_make_drivers "$loc_accel_list"
2001
2002 helper_libtestdriver1_make_main "$loc_accel_list"
2003
2004 # Make sure this was not re-enabled by accident (additive config)
2005 not grep mbedtls_ccm ${BUILTIN_SRC_PATH}/ccm.o
2006 not grep mbedtls_gcm ${BUILTIN_SRC_PATH}/gcm.o
2007 not grep mbedtls_chachapoly ${BUILTIN_SRC_PATH}/chachapoly.o
2008
2009 # Run the tests
2010 # -------------
2011
2012 msg "test: MBEDTLS_PSA_CRYPTO_CONFIG with accelerated AEAD"
2013 make test
2014}
2015
2016# This is a common configuration function used in:
2017# - component_test_psa_crypto_config_accel_cipher_aead_cmac
2018# - component_test_psa_crypto_config_reference_cipher_aead_cmac
Minos Galanakisf78447f2024-07-26 20:49:51 +01002019common_psa_crypto_config_accel_cipher_aead_cmac () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002020 # Start from the full config
2021 helper_libtestdriver1_adjust_config "full"
2022
2023 scripts/config.py unset MBEDTLS_NIST_KW_C
2024}
2025
2026# The 2 following test components, i.e.
2027# - component_test_psa_crypto_config_accel_cipher_aead_cmac
2028# - component_test_psa_crypto_config_reference_cipher_aead_cmac
2029# are meant to be used together in analyze_outcomes.py script in order to test
2030# driver's coverage for ciphers and AEADs.
Minos Galanakis471b34c2024-07-26 15:39:24 +01002031component_test_psa_crypto_config_accel_cipher_aead_cmac () {
2032 msg "build: full config with accelerated cipher inc. AEAD and CMAC"
2033
2034 loc_accel_list="ALG_ECB_NO_PADDING ALG_CBC_NO_PADDING ALG_CBC_PKCS7 ALG_CTR ALG_CFB \
2035 ALG_OFB ALG_XTS ALG_STREAM_CIPHER ALG_CCM_STAR_NO_TAG \
2036 ALG_GCM ALG_CCM ALG_CHACHA20_POLY1305 ALG_CMAC \
2037 KEY_TYPE_DES KEY_TYPE_AES KEY_TYPE_ARIA KEY_TYPE_CHACHA20 KEY_TYPE_CAMELLIA"
2038
2039 # Configure
2040 # ---------
2041
2042 common_psa_crypto_config_accel_cipher_aead_cmac
2043
2044 # Disable the things that are being accelerated
2045 scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
2046 scripts/config.py unset MBEDTLS_CIPHER_PADDING_PKCS7
2047 scripts/config.py unset MBEDTLS_CIPHER_MODE_CTR
2048 scripts/config.py unset MBEDTLS_CIPHER_MODE_CFB
2049 scripts/config.py unset MBEDTLS_CIPHER_MODE_OFB
2050 scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
2051 scripts/config.py unset MBEDTLS_GCM_C
2052 scripts/config.py unset MBEDTLS_CCM_C
2053 scripts/config.py unset MBEDTLS_CHACHAPOLY_C
2054 scripts/config.py unset MBEDTLS_CMAC_C
2055 scripts/config.py unset MBEDTLS_DES_C
2056 scripts/config.py unset MBEDTLS_AES_C
2057 scripts/config.py unset MBEDTLS_ARIA_C
2058 scripts/config.py unset MBEDTLS_CHACHA20_C
2059 scripts/config.py unset MBEDTLS_CAMELLIA_C
2060
2061 # Disable CIPHER_C entirely as all ciphers/AEADs are accelerated and PSA
2062 # does not depend on it.
2063 scripts/config.py unset MBEDTLS_CIPHER_C
2064
2065 # Build
2066 # -----
2067
2068 helper_libtestdriver1_make_drivers "$loc_accel_list"
2069
2070 helper_libtestdriver1_make_main "$loc_accel_list"
2071
2072 # Make sure this was not re-enabled by accident (additive config)
2073 not grep mbedtls_cipher ${BUILTIN_SRC_PATH}/cipher.o
2074 not grep mbedtls_des ${BUILTIN_SRC_PATH}/des.o
2075 not grep mbedtls_aes ${BUILTIN_SRC_PATH}/aes.o
2076 not grep mbedtls_aria ${BUILTIN_SRC_PATH}/aria.o
2077 not grep mbedtls_camellia ${BUILTIN_SRC_PATH}/camellia.o
2078 not grep mbedtls_ccm ${BUILTIN_SRC_PATH}/ccm.o
2079 not grep mbedtls_gcm ${BUILTIN_SRC_PATH}/gcm.o
2080 not grep mbedtls_chachapoly ${BUILTIN_SRC_PATH}/chachapoly.o
2081 not grep mbedtls_cmac ${BUILTIN_SRC_PATH}/cmac.o
2082
2083 # Run the tests
2084 # -------------
2085
2086 msg "test: full config with accelerated cipher inc. AEAD and CMAC"
2087 make test
2088
2089 msg "ssl-opt: full config with accelerated cipher inc. AEAD and CMAC"
2090 tests/ssl-opt.sh
2091
2092 msg "compat.sh: full config with accelerated cipher inc. AEAD and CMAC"
2093 tests/compat.sh -V NO -p mbedTLS
2094}
2095
2096component_test_psa_crypto_config_reference_cipher_aead_cmac () {
2097 msg "build: full config with non-accelerated cipher inc. AEAD and CMAC"
2098 common_psa_crypto_config_accel_cipher_aead_cmac
2099
2100 make
2101
2102 msg "test: full config with non-accelerated cipher inc. AEAD and CMAC"
2103 make test
2104
2105 msg "ssl-opt: full config with non-accelerated cipher inc. AEAD and CMAC"
2106 tests/ssl-opt.sh
2107
2108 msg "compat.sh: full config with non-accelerated cipher inc. AEAD and CMAC"
2109 tests/compat.sh -V NO -p mbedTLS
2110}
2111
Minos Galanakisf78447f2024-07-26 20:49:51 +01002112common_block_cipher_dispatch () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002113 TEST_WITH_DRIVER="$1"
2114
2115 # Start from the full config
2116 helper_libtestdriver1_adjust_config "full"
2117
2118 if [ "$TEST_WITH_DRIVER" -eq 1 ]; then
2119 # Disable key types that are accelerated (there is no legacy equivalent
2120 # symbol for ECB)
2121 scripts/config.py unset MBEDTLS_AES_C
2122 scripts/config.py unset MBEDTLS_ARIA_C
2123 scripts/config.py unset MBEDTLS_CAMELLIA_C
2124 fi
2125
2126 # Disable cipher's modes that, when not accelerated, cause
2127 # legacy key types to be re-enabled in "config_adjust_legacy_from_psa.h".
2128 # Keep this also in the reference component in order to skip the same tests
2129 # that were skipped in the accelerated one.
2130 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CTR
2131 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CFB
2132 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_OFB
2133 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING
2134 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7
2135 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CMAC
2136 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM_STAR_NO_TAG
2137 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
2138
2139 # Disable direct dependency on AES_C
2140 scripts/config.py unset MBEDTLS_NIST_KW_C
2141
2142 # Prevent the cipher module from using deprecated PSA path. The reason is
2143 # that otherwise there will be tests relying on "aes_info" (defined in
2144 # "cipher_wrap.c") whose functions are not available when AES_C is
2145 # not defined. ARIA and Camellia are not a problem in this case because
2146 # the PSA path is not tested for these key types.
2147 scripts/config.py set MBEDTLS_DEPRECATED_REMOVED
2148}
2149
Gilles Peskinea9dda7e2024-06-21 11:25:01 +02002150component_test_full_block_cipher_psa_dispatch_static_keystore () {
2151 msg "build: full + PSA dispatch in block_cipher with static keystore"
2152 # Check that the static key store works well when CTR_DRBG uses a
2153 # PSA key for AES.
2154 scripts/config.py unset MBEDTLS_PSA_KEY_STORE_DYNAMIC
2155
2156 loc_accel_list="ALG_ECB_NO_PADDING \
2157 KEY_TYPE_AES KEY_TYPE_ARIA KEY_TYPE_CAMELLIA"
2158
2159 # Configure
2160 # ---------
2161
2162 common_block_cipher_dispatch 1
2163
2164 # Build
2165 # -----
2166
2167 helper_libtestdriver1_make_drivers "$loc_accel_list"
2168
2169 helper_libtestdriver1_make_main "$loc_accel_list"
2170
2171 # Make sure disabled components were not re-enabled by accident (additive
2172 # config)
2173 not grep mbedtls_aes_ library/aes.o
2174 not grep mbedtls_aria_ library/aria.o
2175 not grep mbedtls_camellia_ library/camellia.o
2176
2177 # Run the tests
2178 # -------------
2179
2180 msg "test: full + PSA dispatch in block_cipher with static keystore"
2181 make test
2182}
2183
Minos Galanakis471b34c2024-07-26 15:39:24 +01002184component_test_full_block_cipher_psa_dispatch () {
2185 msg "build: full + PSA dispatch in block_cipher"
2186
2187 loc_accel_list="ALG_ECB_NO_PADDING \
2188 KEY_TYPE_AES KEY_TYPE_ARIA KEY_TYPE_CAMELLIA"
2189
2190 # Configure
2191 # ---------
2192
2193 common_block_cipher_dispatch 1
2194
2195 # Build
2196 # -----
2197
2198 helper_libtestdriver1_make_drivers "$loc_accel_list"
2199
2200 helper_libtestdriver1_make_main "$loc_accel_list"
2201
2202 # Make sure disabled components were not re-enabled by accident (additive
2203 # config)
2204 not grep mbedtls_aes_ ${BUILTIN_SRC_PATH}/aes.o
2205 not grep mbedtls_aria_ ${BUILTIN_SRC_PATH}/aria.o
2206 not grep mbedtls_camellia_ ${BUILTIN_SRC_PATH}/camellia.o
2207
2208 # Run the tests
2209 # -------------
2210
2211 msg "test: full + PSA dispatch in block_cipher"
2212 make test
2213}
2214
2215# This is the reference component of component_test_full_block_cipher_psa_dispatch
Minos Galanakis471b34c2024-07-26 15:39:24 +01002216component_test_full_block_cipher_legacy_dispatch () {
2217 msg "build: full + legacy dispatch in block_cipher"
2218
2219 common_block_cipher_dispatch 0
2220
2221 make
2222
2223 msg "test: full + legacy dispatch in block_cipher"
2224 make test
2225}
2226
Minos Galanakisf78447f2024-07-26 20:49:51 +01002227component_test_aead_chachapoly_disabled () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002228 msg "build: full minus CHACHAPOLY"
2229 scripts/config.py full
2230 scripts/config.py unset MBEDTLS_CHACHAPOLY_C
2231 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CHACHA20_POLY1305
2232 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
2233
2234 msg "test: full minus CHACHAPOLY"
2235 make test
2236}
2237
Minos Galanakisf78447f2024-07-26 20:49:51 +01002238component_test_aead_only_ccm () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002239 msg "build: full minus CHACHAPOLY and GCM"
2240 scripts/config.py full
2241 scripts/config.py unset MBEDTLS_CHACHAPOLY_C
2242 scripts/config.py unset MBEDTLS_GCM_C
2243 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CHACHA20_POLY1305
2244 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_GCM
2245 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
2246
2247 msg "test: full minus CHACHAPOLY and GCM"
2248 make test
2249}
2250
Minos Galanakisf78447f2024-07-26 20:49:51 +01002251component_test_ccm_aes_sha256 () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002252 msg "build: CCM + AES + SHA256 configuration"
2253
2254 cp "$CONFIG_TEST_DRIVER_H" "$CONFIG_H"
2255 cp configs/crypto-config-ccm-aes-sha256.h "$CRYPTO_CONFIG_H"
2256
2257 make
2258
2259 msg "test: CCM + AES + SHA256 configuration"
2260 make test
2261}
2262
2263# Test that the given .o file builds with all (valid) combinations of the given options.
2264#
2265# Syntax: build_test_config_combos FILE VALIDATOR_FUNCTION OPT1 OPT2 ...
2266#
2267# The validator function is the name of a function to validate the combination of options.
2268# It may be "" if all combinations are valid.
2269# It receives a string containing a combination of options, as passed to the compiler,
2270# e.g. "-DOPT1 -DOPT2 ...". It must return 0 iff the combination is valid, non-zero if invalid.
Minos Galanakisf78447f2024-07-26 20:49:51 +01002271build_test_config_combos () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002272 file=$1
2273 shift
2274 validate_options=$1
2275 shift
2276 options=("$@")
2277
2278 # clear all of the options so that they can be overridden on the clang commandline
2279 for opt in "${options[@]}"; do
2280 ./scripts/config.py unset ${opt}
2281 done
2282
2283 # enter the library directory
2284 cd library
2285
2286 # The most common issue is unused variables/functions, so ensure -Wunused is set.
2287 warning_flags="-Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused"
2288
2289 # Extract the command generated by the Makefile to build the target file.
2290 # This ensures that we have any include paths, macro definitions, etc
2291 # that may be applied by make.
2292 # Add -fsyntax-only as we only want a syntax check and don't need to generate a file.
2293 compile_cmd="clang \$(LOCAL_CFLAGS) ${warning_flags} -fsyntax-only -c"
2294
2295 makefile=$(TMPDIR=. mktemp)
2296 deps=""
2297
2298 len=${#options[@]}
2299 source_file=../${file%.o}.c
2300
2301 targets=0
2302 echo 'include Makefile' >${makefile}
2303
2304 for ((i = 0; i < $((2**${len})); i++)); do
2305 # generate each of 2^n combinations of options
2306 # each bit of $i is used to determine if options[i] will be set or not
2307 target="t"
2308 clang_args=""
2309 for ((j = 0; j < ${len}; j++)); do
2310 if (((i >> j) & 1)); then
2311 opt=-D${options[$j]}
2312 clang_args="${clang_args} ${opt}"
2313 target="${target}${opt}"
2314 fi
2315 done
2316
2317 # if combination is not known to be invalid, add it to the makefile
2318 if [[ -z $validate_options ]] || $validate_options "${clang_args}"; then
2319 cmd="${compile_cmd} ${clang_args}"
2320 echo "${target}: ${source_file}; $cmd ${source_file}" >> ${makefile}
2321
2322 deps="${deps} ${target}"
2323 ((++targets))
2324 fi
2325 done
2326
2327 echo "build_test_config_combos: ${deps}" >> ${makefile}
2328
2329 # execute all of the commands via Make (probably in parallel)
2330 make -s -f ${makefile} build_test_config_combos
2331 echo "$targets targets checked"
2332
2333 # clean up the temporary makefile
2334 rm ${makefile}
2335}
2336
Minos Galanakisf78447f2024-07-26 20:49:51 +01002337validate_aes_config_variations () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002338 if [[ "$1" == *"MBEDTLS_AES_USE_HARDWARE_ONLY"* ]]; then
2339 if [[ !(("$HOSTTYPE" == "aarch64" && "$1" != *"MBEDTLS_AESCE_C"*) || \
2340 ("$HOSTTYPE" == "x86_64" && "$1" != *"MBEDTLS_AESNI_C"*)) ]]; then
2341 return 1
2342 fi
2343 fi
2344 return 0
2345}
2346
Minos Galanakisf78447f2024-07-26 20:49:51 +01002347component_build_aes_variations () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002348 # 18s - around 90ms per clang invocation on M1 Pro
2349 #
2350 # aes.o has many #if defined(...) guards that intersect in complex ways.
2351 # Test that all the combinations build cleanly.
2352
2353 MBEDTLS_ROOT_DIR="$PWD"
2354 msg "build: aes.o for all combinations of relevant config options"
2355
2356 build_test_config_combos ${BUILTIN_SRC_PATH}/aes.o validate_aes_config_variations \
Thomas Daubney6cf05f92024-07-18 11:30:22 +01002357 "MBEDTLS_AES_ROM_TABLES" \
Minos Galanakis471b34c2024-07-26 15:39:24 +01002358 "MBEDTLS_AES_FEWER_TABLES" "MBEDTLS_AES_USE_HARDWARE_ONLY" \
2359 "MBEDTLS_AESNI_C" "MBEDTLS_AESCE_C" "MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH"
2360
2361 cd "$MBEDTLS_ROOT_DIR"
2362 msg "build: aes.o for all combinations of relevant config options + BLOCK_CIPHER_NO_DECRYPT"
2363
2364 # MBEDTLS_BLOCK_CIPHER_NO_DECRYPT is incompatible with ECB in PSA, CBC/XTS/NIST_KW/DES,
2365 # manually set or unset those configurations to check
2366 # MBEDTLS_BLOCK_CIPHER_NO_DECRYPT with various combinations in aes.o.
Ronald Cron54d1eec2024-09-06 09:55:38 +02002367 scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
Minos Galanakis471b34c2024-07-26 15:39:24 +01002368 scripts/config.py set MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
Minos Galanakis471b34c2024-07-26 15:39:24 +01002369 scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
Minos Galanakis471b34c2024-07-26 15:39:24 +01002370 scripts/config.py unset MBEDTLS_NIST_KW_C
Ronald Cron54d1eec2024-09-06 09:55:38 +02002371
2372 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
2373 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
2374 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
2375 scripts/config.py -f $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
Ronald Cron4153ebb2024-09-11 15:32:48 +02002376 # Note: The two unsets below are to be removed for Mbed TLS 4.0
Ronald Cron54d1eec2024-09-06 09:55:38 +02002377 scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
2378 scripts/config.py unset MBEDTLS_DES_C
2379
Minos Galanakis471b34c2024-07-26 15:39:24 +01002380 build_test_config_combos ${BUILTIN_SRC_PATH}/aes.o validate_aes_config_variations \
Thomas Daubney6cf05f92024-07-18 11:30:22 +01002381 "MBEDTLS_AES_ROM_TABLES" \
Minos Galanakis471b34c2024-07-26 15:39:24 +01002382 "MBEDTLS_AES_FEWER_TABLES" "MBEDTLS_AES_USE_HARDWARE_ONLY" \
2383 "MBEDTLS_AESNI_C" "MBEDTLS_AESCE_C" "MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH"
2384}
2385
Minos Galanakisf78447f2024-07-26 20:49:51 +01002386component_test_sha3_variations () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002387 msg "sha3 loop unroll variations"
2388
2389 # define minimal config sufficient to test SHA3
Ronald Crone7f289e2024-09-06 11:02:47 +02002390 cat > include/mbedtls/mbedtls_config.h << END
2391 #define MBEDTLS_AES_C
2392 #define MBEDTLS_CTR_DRBG_C
2393 #define MBEDTLS_ENTROPY_C
2394 #define MBEDTLS_PSA_CRYPTO_C
2395 #define MBEDTLS_PSA_CRYPTO_CONFIG
2396 #define MBEDTLS_SELF_TEST
2397END
2398
2399 cat > tf-psa-crypto/include/psa/crypto_config.h << END
2400 #define PSA_WANT_ALG_SHA_256 1
2401 #define PSA_WANT_ALG_SHA3_224 1
2402 #define PSA_WANT_ALG_SHA3_256 1
2403 #define PSA_WANT_ALG_SHA3_384 1
2404 #define PSA_WANT_ALG_SHA3_512 1
Minos Galanakis471b34c2024-07-26 15:39:24 +01002405END
2406
2407 msg "all loops unrolled"
2408 make clean
2409 make -C tests ../tf-psa-crypto/tests/test_suite_shax CFLAGS="-DMBEDTLS_SHA3_THETA_UNROLL=1 -DMBEDTLS_SHA3_PI_UNROLL=1 -DMBEDTLS_SHA3_CHI_UNROLL=1 -DMBEDTLS_SHA3_RHO_UNROLL=1"
2410 ./tf-psa-crypto/tests/test_suite_shax
2411
2412 msg "all loops rolled up"
2413 make clean
2414 make -C tests ../tf-psa-crypto/tests/test_suite_shax CFLAGS="-DMBEDTLS_SHA3_THETA_UNROLL=0 -DMBEDTLS_SHA3_PI_UNROLL=0 -DMBEDTLS_SHA3_CHI_UNROLL=0 -DMBEDTLS_SHA3_RHO_UNROLL=0"
2415 ./tf-psa-crypto/tests/test_suite_shax
2416}
2417
Minos Galanakisf699d512024-08-01 11:32:30 +01002418support_build_aes_aesce_armcc () {
2419 support_build_armcc
2420}
2421
Minos Galanakis471b34c2024-07-26 15:39:24 +01002422# For timebeing, no aarch64 gcc available in CI and no arm64 CI node.
2423component_build_aes_aesce_armcc () {
2424 msg "Build: AESCE test on arm64 platform without plain C."
2425 scripts/config.py baremetal
2426
2427 # armc[56] don't support SHA-512 intrinsics
2428 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
2429
2430 # Stop armclang warning about feature detection for A64_CRYPTO.
2431 # With this enabled, the library does build correctly under armclang,
2432 # but in baremetal builds (as tested here), feature detection is
2433 # unavailable, and the user is notified via a #warning. So enabling
2434 # this feature would prevent us from building with -Werror on
2435 # armclang. Tracked in #7198.
2436 scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
2437 scripts/config.py set MBEDTLS_HAVE_ASM
2438
2439 msg "AESCE, build with default configuration."
2440 scripts/config.py set MBEDTLS_AESCE_C
2441 scripts/config.py unset MBEDTLS_AES_USE_HARDWARE_ONLY
Manuel Pégourié-Gonnard8f08bcd2024-10-01 13:01:54 +02002442 helper_armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8-a+crypto"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002443
2444 msg "AESCE, build AESCE only"
2445 scripts/config.py set MBEDTLS_AESCE_C
2446 scripts/config.py set MBEDTLS_AES_USE_HARDWARE_ONLY
Manuel Pégourié-Gonnard8f08bcd2024-10-01 13:01:54 +02002447 helper_armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8-a+crypto"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002448}
2449
Minos Galanakis471b34c2024-07-26 15:39:24 +01002450component_test_aes_only_128_bit_keys () {
2451 msg "build: default config + AES_ONLY_128_BIT_KEY_LENGTH"
2452 scripts/config.py set MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
2453
2454 make CFLAGS='-O2 -Werror -Wall -Wextra'
2455
2456 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH"
2457 make test
2458}
2459
2460component_test_no_ctr_drbg_aes_only_128_bit_keys () {
2461 msg "build: default config + AES_ONLY_128_BIT_KEY_LENGTH - CTR_DRBG_C"
2462 scripts/config.py set MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
2463 scripts/config.py unset MBEDTLS_CTR_DRBG_C
2464
2465 make CC=clang CFLAGS='-Werror -Wall -Wextra'
2466
2467 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH - CTR_DRBG_C"
2468 make test
2469}
2470
2471component_test_aes_only_128_bit_keys_have_builtins () {
2472 msg "build: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
2473 scripts/config.py set MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
2474 scripts/config.py unset MBEDTLS_AESNI_C
2475 scripts/config.py unset MBEDTLS_AESCE_C
2476
2477 make CFLAGS='-O2 -Werror -Wall -Wextra'
2478
2479 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
2480 make test
2481
2482 msg "selftest: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
2483 programs/test/selftest
2484}
2485
2486component_test_gcm_largetable () {
2487 msg "build: default config + GCM_LARGE_TABLE - AESNI_C - AESCE_C"
2488 scripts/config.py set MBEDTLS_GCM_LARGE_TABLE
2489 scripts/config.py unset MBEDTLS_AESNI_C
2490 scripts/config.py unset MBEDTLS_AESCE_C
2491
2492 make CFLAGS='-O2 -Werror -Wall -Wextra'
2493
2494 msg "test: default config - GCM_LARGE_TABLE - AESNI_C - AESCE_C"
2495 make test
2496}
2497
2498component_test_aes_fewer_tables () {
2499 msg "build: default config with AES_FEWER_TABLES enabled"
2500 scripts/config.py set MBEDTLS_AES_FEWER_TABLES
2501 make CFLAGS='-O2 -Werror -Wall -Wextra'
2502
2503 msg "test: AES_FEWER_TABLES"
2504 make test
2505}
2506
2507component_test_aes_rom_tables () {
2508 msg "build: default config with AES_ROM_TABLES enabled"
2509 scripts/config.py set MBEDTLS_AES_ROM_TABLES
2510 make CFLAGS='-O2 -Werror -Wall -Wextra'
2511
2512 msg "test: AES_ROM_TABLES"
2513 make test
2514}
2515
2516component_test_aes_fewer_tables_and_rom_tables () {
2517 msg "build: default config with AES_ROM_TABLES and AES_FEWER_TABLES enabled"
2518 scripts/config.py set MBEDTLS_AES_FEWER_TABLES
2519 scripts/config.py set MBEDTLS_AES_ROM_TABLES
2520 make CFLAGS='-O2 -Werror -Wall -Wextra'
2521
2522 msg "test: AES_FEWER_TABLES + AES_ROM_TABLES"
2523 make test
2524}
2525
Ronald Cron66040472024-09-06 10:14:38 +02002526# helper for component_test_block_cipher_no_decrypt_aesni() which:
Minos Galanakis471b34c2024-07-26 15:39:24 +01002527# - enable/disable the list of config options passed from -s/-u respectively.
2528# - build
2529# - test for tests_suite_xxx
2530# - selftest
2531#
2532# Usage: helper_block_cipher_no_decrypt_build_test
2533# [-s set_opts] [-u unset_opts] [-c cflags] [-l ldflags] [option [...]]
2534# Options: -s set_opts the list of config options to enable
2535# -u unset_opts the list of config options to disable
2536# -c cflags the list of options passed to CFLAGS
2537# -l ldflags the list of options passed to LDFLAGS
Minos Galanakis471b34c2024-07-26 15:39:24 +01002538helper_block_cipher_no_decrypt_build_test () {
2539 while [ $# -gt 0 ]; do
2540 case "$1" in
2541 -s)
2542 shift; local set_opts="$1";;
2543 -u)
2544 shift; local unset_opts="$1";;
2545 -c)
2546 shift; local cflags="-Werror -Wall -Wextra $1";;
2547 -l)
2548 shift; local ldflags="$1";;
2549 esac
2550 shift
2551 done
2552 set_opts="${set_opts:-}"
2553 unset_opts="${unset_opts:-}"
2554 cflags="${cflags:-}"
2555 ldflags="${ldflags:-}"
2556
2557 [ -n "$set_opts" ] && echo "Enabling: $set_opts" && scripts/config.py set-all $set_opts
2558 [ -n "$unset_opts" ] && echo "Disabling: $unset_opts" && scripts/config.py unset-all $unset_opts
2559
2560 msg "build: default config + BLOCK_CIPHER_NO_DECRYPT${set_opts:+ + $set_opts}${unset_opts:+ - $unset_opts} with $cflags${ldflags:+, $ldflags}"
2561 make clean
2562 make CFLAGS="-O2 $cflags" LDFLAGS="$ldflags"
2563
2564 # Make sure we don't have mbedtls_xxx_setkey_dec in AES/ARIA/CAMELLIA
2565 not grep mbedtls_aes_setkey_dec ${BUILTIN_SRC_PATH}/aes.o
2566 not grep mbedtls_aria_setkey_dec ${BUILTIN_SRC_PATH}/aria.o
2567 not grep mbedtls_camellia_setkey_dec ${BUILTIN_SRC_PATH}/camellia.o
2568 # Make sure we don't have mbedtls_internal_aes_decrypt in AES
2569 not grep mbedtls_internal_aes_decrypt ${BUILTIN_SRC_PATH}/aes.o
2570 # Make sure we don't have mbedtls_aesni_inverse_key in AESNI
2571 not grep mbedtls_aesni_inverse_key ${BUILTIN_SRC_PATH}/aesni.o
2572
2573 msg "test: default config + BLOCK_CIPHER_NO_DECRYPT${set_opts:+ + $set_opts}${unset_opts:+ - $unset_opts} with $cflags${ldflags:+, $ldflags}"
2574 make test
2575
2576 msg "selftest: default config + BLOCK_CIPHER_NO_DECRYPT${set_opts:+ + $set_opts}${unset_opts:+ - $unset_opts} with $cflags${ldflags:+, $ldflags}"
2577 programs/test/selftest
2578}
2579
Ronald Cron66040472024-09-06 10:14:38 +02002580# This is a configuration function used in component_test_block_cipher_no_decrypt_xxx:
2581config_block_cipher_no_decrypt () {
2582 scripts/config.py set MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
2583 scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
2584 scripts/config.py unset MBEDTLS_NIST_KW_C
2585
2586 # Enable support for cryptographic mechanisms through the PSA API.
2587 # Note: XTS, KW are not yet supported via the PSA API in Mbed TLS.
2588 scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
2589 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING
2590 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7
2591 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_ECB_NO_PADDING
2592 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_DES
Ronald Cron4153ebb2024-09-11 15:32:48 +02002593 # Note: The two unsets below are to be removed for Mbed TLS 4.0
Ronald Cron66040472024-09-06 10:14:38 +02002594 scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
2595 scripts/config.py unset MBEDTLS_DES_C
2596}
2597
2598component_test_block_cipher_no_decrypt_aesni () {
2599 # Test BLOCK_CIPHER_NO_DECRYPT with AESNI intrinsics, AESNI assembly and
2600 # AES C implementation on x86_64 and with AESNI intrinsics on x86.
2601
2602 # This consistently causes an llvm crash on clang 3.8, so use gcc
2603 export CC=gcc
2604 config_block_cipher_no_decrypt
2605
Minos Galanakis471b34c2024-07-26 15:39:24 +01002606 # test AESNI intrinsics
2607 helper_block_cipher_no_decrypt_build_test \
2608 -s "MBEDTLS_AESNI_C" \
2609 -c "-mpclmul -msse2 -maes"
2610
2611 # test AESNI assembly
2612 helper_block_cipher_no_decrypt_build_test \
2613 -s "MBEDTLS_AESNI_C" \
2614 -c "-mno-pclmul -mno-sse2 -mno-aes"
2615
2616 # test AES C implementation
2617 helper_block_cipher_no_decrypt_build_test \
2618 -u "MBEDTLS_AESNI_C"
2619
2620 # test AESNI intrinsics for i386 target
2621 helper_block_cipher_no_decrypt_build_test \
2622 -s "MBEDTLS_AESNI_C" \
2623 -c "-m32 -mpclmul -msse2 -maes" \
2624 -l "-m32"
2625}
2626
Minos Galanakisf699d512024-08-01 11:32:30 +01002627support_test_block_cipher_no_decrypt_aesce_armcc () {
2628 support_build_armcc
2629}
2630
Minos Galanakis471b34c2024-07-26 15:39:24 +01002631component_test_block_cipher_no_decrypt_aesce_armcc () {
2632 scripts/config.py baremetal
2633
2634 # armc[56] don't support SHA-512 intrinsics
2635 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
2636
2637 # Stop armclang warning about feature detection for A64_CRYPTO.
2638 # With this enabled, the library does build correctly under armclang,
2639 # but in baremetal builds (as tested here), feature detection is
2640 # unavailable, and the user is notified via a #warning. So enabling
2641 # this feature would prevent us from building with -Werror on
2642 # armclang. Tracked in #7198.
2643 scripts/config.py unset MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
2644 scripts/config.py set MBEDTLS_HAVE_ASM
2645
Ronald Cron66040472024-09-06 10:14:38 +02002646 config_block_cipher_no_decrypt
Minos Galanakis471b34c2024-07-26 15:39:24 +01002647
2648 # test AESCE baremetal build
2649 scripts/config.py set MBEDTLS_AESCE_C
2650 msg "build: default config + BLOCK_CIPHER_NO_DECRYPT with AESCE"
Manuel Pégourié-Gonnard8f08bcd2024-10-01 13:01:54 +02002651 helper_armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8-a+crypto -Werror -Wall -Wextra"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002652
2653 # Make sure we don't have mbedtls_xxx_setkey_dec in AES/ARIA/CAMELLIA
2654 not grep mbedtls_aes_setkey_dec ${BUILTIN_SRC_PATH}/aes.o
2655 not grep mbedtls_aria_setkey_dec ${BUILTIN_SRC_PATH}/aria.o
2656 not grep mbedtls_camellia_setkey_dec ${BUILTIN_SRC_PATH}/camellia.o
2657 # Make sure we don't have mbedtls_internal_aes_decrypt in AES
2658 not grep mbedtls_internal_aes_decrypt ${BUILTIN_SRC_PATH}/aes.o
2659 # Make sure we don't have mbedtls_aesce_inverse_key and aesce_decrypt_block in AESCE
2660 not grep mbedtls_aesce_inverse_key ${BUILTIN_SRC_PATH}/aesce.o
2661 not grep aesce_decrypt_block ${BUILTIN_SRC_PATH}/aesce.o
2662}
2663
2664component_test_ctr_drbg_aes_256_sha_256 () {
2665 msg "build: full + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
2666 scripts/config.py full
2667 scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2668 scripts/config.py set MBEDTLS_ENTROPY_FORCE_SHA256
2669 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2670 make
2671
2672 msg "test: full + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
2673 make test
2674}
2675
2676component_test_ctr_drbg_aes_128_sha_512 () {
2677 msg "build: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY (ASan build)"
2678 scripts/config.py full
2679 scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2680 scripts/config.py set MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
2681 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2682 make
2683
2684 msg "test: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY (ASan build)"
2685 make test
2686}
2687
2688component_test_ctr_drbg_aes_128_sha_256 () {
2689 msg "build: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
2690 scripts/config.py full
2691 scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2692 scripts/config.py set MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
2693 scripts/config.py set MBEDTLS_ENTROPY_FORCE_SHA256
2694 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2695 make
2696
2697 msg "test: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
2698 make test
2699}
2700
2701component_test_se_default () {
2702 msg "build: default config + MBEDTLS_PSA_CRYPTO_SE_C"
2703 scripts/config.py set MBEDTLS_PSA_CRYPTO_SE_C
2704 make CC=clang CFLAGS="$ASAN_CFLAGS -Os" LDFLAGS="$ASAN_CFLAGS"
2705
2706 msg "test: default config + MBEDTLS_PSA_CRYPTO_SE_C"
2707 make test
2708}
2709
Gilles Peskinea9dda7e2024-06-21 11:25:01 +02002710component_test_full_static_keystore () {
2711 msg "build: full config - MBEDTLS_PSA_KEY_STORE_DYNAMIC"
2712 scripts/config.py full
2713 scripts/config.py unset MBEDTLS_PSA_KEY_STORE_DYNAMIC
2714 make CC=clang CFLAGS="$ASAN_CFLAGS -Os" LDFLAGS="$ASAN_CFLAGS"
2715
2716 msg "test: full config - MBEDTLS_PSA_KEY_STORE_DYNAMIC"
2717 make test
2718}
2719
Minos Galanakis471b34c2024-07-26 15:39:24 +01002720component_test_psa_crypto_drivers () {
Ronald Crona0afbfb2024-10-15 13:20:31 +02002721 # Test dispatch to drivers and fallbacks with
2722 # test_suite_psa_crypto_driver_wrappers test suite. The test drivers that
2723 # are wrappers around the builtin drivers are activated by
2724 # PSA_CRYPTO_DRIVER_TEST.
2725 #
2726 # For the time being, some test cases in test_suite_block_cipher and
2727 # test_suite_md.psa rely on this component to be run at least once by the
2728 # CI. This should disappear as we progress the 4.x work. See
2729 # config_adjust_test_accelerators.h for more information.
Minos Galanakis471b34c2024-07-26 15:39:24 +01002730 msg "build: full + test drivers dispatching to builtins"
2731 scripts/config.py full
Ronald Cron67cc6a72024-10-14 10:55:24 +02002732 loc_cflags="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_CONFIG_ADJUST_TEST_ACCELERATORS"
Ronald Cronede04b32024-10-16 10:47:15 +02002733 loc_cflags="${loc_cflags} -I../tests/include"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002734
2735 make CC=$ASAN_CC CFLAGS="${loc_cflags}" LDFLAGS="$ASAN_CFLAGS"
2736
2737 msg "test: full + test drivers dispatching to builtins"
2738 make test
2739}
2740
2741component_build_psa_config_file () {
2742 msg "build: make with MBEDTLS_PSA_CRYPTO_CONFIG_FILE" # ~40s
2743 scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
2744 cp "$CRYPTO_CONFIG_H" psa_test_config.h
2745 echo '#error "MBEDTLS_PSA_CRYPTO_CONFIG_FILE is not working"' >"$CRYPTO_CONFIG_H"
2746 make CFLAGS="-I '$PWD' -DMBEDTLS_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"'"
2747 # Make sure this feature is enabled. We'll disable it in the next phase.
2748 programs/test/query_compile_time_config MBEDTLS_CMAC_C
2749 make clean
2750
2751 msg "build: make with MBEDTLS_PSA_CRYPTO_CONFIG_FILE + MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE" # ~40s
2752 # In the user config, disable one feature and its dependencies, which will
2753 # reflect on the mbedtls configuration so we can query it with
2754 # query_compile_time_config.
2755 echo '#undef PSA_WANT_ALG_CMAC' >psa_user_config.h
2756 echo '#undef PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128' >> psa_user_config.h
2757 scripts/config.py unset MBEDTLS_CMAC_C
2758 make CFLAGS="-I '$PWD' -DMBEDTLS_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"' -DMBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE='\"psa_user_config.h\"'"
2759 not programs/test/query_compile_time_config MBEDTLS_CMAC_C
2760
2761 rm -f psa_test_config.h psa_user_config.h
2762}
2763
2764component_build_psa_alt_headers () {
2765 msg "build: make with PSA alt headers" # ~20s
2766
2767 # Generate alternative versions of the substitutable headers with the
2768 # same content except different include guards.
2769 make -C tests include/alt-extra/psa/crypto_platform_alt.h include/alt-extra/psa/crypto_struct_alt.h
2770
2771 # Build the library and some programs.
2772 # Don't build the fuzzers to avoid having to go through hoops to set
2773 # a correct include path for programs/fuzz/Makefile.
2774 make CFLAGS="-I ../tests/include/alt-extra -DMBEDTLS_PSA_CRYPTO_PLATFORM_FILE='\"psa/crypto_platform_alt.h\"' -DMBEDTLS_PSA_CRYPTO_STRUCT_FILE='\"psa/crypto_struct_alt.h\"'" lib
2775 make -C programs -o fuzz CFLAGS="-I ../tests/include/alt-extra -DMBEDTLS_PSA_CRYPTO_PLATFORM_FILE='\"psa/crypto_platform_alt.h\"' -DMBEDTLS_PSA_CRYPTO_STRUCT_FILE='\"psa/crypto_struct_alt.h\"'"
2776
2777 # Check that we're getting the alternative include guards and not the
2778 # original include guards.
2779 programs/test/query_included_headers | grep -x PSA_CRYPTO_PLATFORM_ALT_H
2780 programs/test/query_included_headers | grep -x PSA_CRYPTO_STRUCT_ALT_H
2781 programs/test/query_included_headers | not grep -x PSA_CRYPTO_PLATFORM_H
2782 programs/test/query_included_headers | not grep -x PSA_CRYPTO_STRUCT_H
2783}
2784
2785component_test_min_mpi_window_size () {
2786 msg "build: Default + MBEDTLS_MPI_WINDOW_SIZE=1 (ASan build)" # ~ 10s
2787 scripts/config.py set MBEDTLS_MPI_WINDOW_SIZE 1
2788 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2789 make
2790
2791 msg "test: MBEDTLS_MPI_WINDOW_SIZE=1 - main suites (inc. selftests) (ASan build)" # ~ 10s
2792 make test
2793}