blob: b7cef0d31d4ad8b2bcd2afd97424dc5faa004114 [file] [log] [blame]
Minos Galanakis6aab5b72024-07-25 14:24:37 +01001# components-configuration-crypto.sh
2#
3# Copyright The Mbed TLS Contributors
4# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
5
Minos Galanakis609f7492024-07-31 16:39:28 +01006# This file contains test components that are executed by all.sh
Minos Galanakis6aab5b72024-07-25 14:24:37 +01007
8################################################################
9#### Configuration Testing - Crypto
10################################################################
11
Minos Galanakis471b34c2024-07-26 15:39:24 +010012component_test_psa_crypto_key_id_encodes_owner () {
13 msg "build: full config + PSA_CRYPTO_KEY_ID_ENCODES_OWNER, cmake, gcc, ASan"
14 scripts/config.py full
15 scripts/config.py set MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
16 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
17 make
18
19 msg "test: full config - USE_PSA_CRYPTO + PSA_CRYPTO_KEY_ID_ENCODES_OWNER, cmake, gcc, ASan"
20 make test
21}
22
23component_test_psa_assume_exclusive_buffers () {
24 msg "build: full config + MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS, cmake, gcc, ASan"
25 scripts/config.py full
26 scripts/config.py set MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
27 CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan .
28 make
29
30 msg "test: full config + MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS, cmake, gcc, ASan"
31 make test
32}
33
Valerio Settidbb646b2024-06-20 14:40:54 +020034component_test_crypto_with_static_key_slots() {
35 msg "build: crypto full + MBEDTLS_PSA_STATIC_KEY_SLOTS"
36 scripts/config.py crypto_full
37 scripts/config.py set MBEDTLS_PSA_STATIC_KEY_SLOTS
Valerio Setti4d9a8212024-08-16 12:35:24 +020038 # Intentionally set MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE to a value that
39 # is enough to contain:
40 # - all RSA public keys up to 4096 bits (max of PSA_VENDOR_RSA_MAX_KEY_BITS).
41 # - RSA key pairs up to 1024 bits, but not 2048 or larger.
42 # - all FFDH key pairs and public keys up to 8192 bits (max of PSA_VENDOR_FFDH_MAX_KEY_BITS).
43 # - all EC key pairs and public keys up to 521 bits (max of PSA_VENDOR_ECC_MAX_CURVE_BITS).
44 scripts/config.py set MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 1212
Valerio Setti8bc81722024-08-28 05:50:45 +020045 # Disable the fully dynamic key store (default on) since it conflicts
46 # with the static behavior that we're testing here.
47 scripts/config.py unset MBEDTLS_PSA_KEY_STORE_DYNAMIC
Valerio Settidbb646b2024-06-20 14:40:54 +020048
Valerio Setti13aadd72024-08-13 13:13:23 +020049 msg "test: crypto full + MBEDTLS_PSA_STATIC_KEY_SLOTS"
Valerio Setti2a3c9b32024-08-14 06:37:02 +020050 make CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS" test
Valerio Settidbb646b2024-06-20 14:40:54 +020051}
52
Minos Galanakis471b34c2024-07-26 15:39:24 +010053# check_renamed_symbols HEADER LIB
54# Check that if HEADER contains '#define MACRO ...' then MACRO is not a symbol
Minos Galanakis609f7492024-07-31 16:39:28 +010055# name in LIB.
Minos Galanakis471b34c2024-07-26 15:39:24 +010056check_renamed_symbols () {
57 ! nm "$2" | sed 's/.* //' |
58 grep -x -F "$(sed -n 's/^ *# *define *\([A-Z_a-z][0-9A-Z_a-z]*\)..*/\1/p' "$1")"
59}
60
61component_build_psa_crypto_spm () {
62 msg "build: full config + PSA_CRYPTO_KEY_ID_ENCODES_OWNER + PSA_CRYPTO_SPM, make, gcc"
63 scripts/config.py full
64 scripts/config.py unset MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
65 scripts/config.py set MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
66 scripts/config.py set MBEDTLS_PSA_CRYPTO_SPM
67 # We can only compile, not link, since our test and sample programs
68 # aren't equipped for the modified names used when MBEDTLS_PSA_CRYPTO_SPM
69 # is active.
David Horstmann5b93d972024-10-31 15:36:05 +000070 make CC=gcc CFLAGS='-Werror -Wall -Wextra -I../framework/tests/include/spe' lib
Minos Galanakis471b34c2024-07-26 15:39:24 +010071
72 # Check that if a symbol is renamed by crypto_spe.h, the non-renamed
73 # version is not present.
74 echo "Checking for renamed symbols in the library"
David Horstmann5b93d972024-10-31 15:36:05 +000075 check_renamed_symbols framework/tests/include/spe/crypto_spe.h library/libmbedcrypto.a
Minos Galanakis471b34c2024-07-26 15:39:24 +010076}
77
Valerio Settia47b0452024-06-25 18:31:36 +020078# The goal of this component is to build a configuration where:
79# - test code and libtestdriver1 can make use of calloc/free and
80# - core library (including PSA core) cannot use calloc/free.
81component_test_psa_crypto_without_heap() {
Valerio Setti13aadd72024-08-13 13:13:23 +020082 msg "crypto without heap: build libtestdriver1"
Valerio Settia47b0452024-06-25 18:31:36 +020083 # Disable PSA features that cannot be accelerated and whose builtin support
84 # requires calloc/free.
Minos Galanakis00b641c2024-11-28 23:05:10 +000085 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
86 scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_HKDF"
87 scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_PBKDF2_"
88 scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_TLS12_"
Valerio Settia47b0452024-06-25 18:31:36 +020089 # RSA key support requires ASN1 parse/write support for testing, but ASN1
90 # is disabled below.
Minos Galanakis00b641c2024-11-28 23:05:10 +000091 scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_KEY_TYPE_RSA_"
92 scripts/config.py -c $CRYPTO_CONFIG_H unset-all "^PSA_WANT_ALG_RSA_"
Valerio Settia47b0452024-06-25 18:31:36 +020093 # DES requires built-in support for key generation (parity check) so it
94 # cannot be accelerated
Minos Galanakis00b641c2024-11-28 23:05:10 +000095 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
Valerio Settia47b0452024-06-25 18:31:36 +020096 # EC-JPAKE use calloc/free in PSA core
Minos Galanakis00b641c2024-11-28 23:05:10 +000097 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
Valerio Settia47b0452024-06-25 18:31:36 +020098
99 # Accelerate all PSA features (which are still enabled in CRYPTO_CONFIG_H).
Minos Galanakis00b641c2024-11-28 23:05:10 +0000100 PSA_SYM_LIST=$(./scripts/config.py -c $CRYPTO_CONFIG_H get-all-enabled PSA_WANT)
Valerio Settia47b0452024-06-25 18:31:36 +0200101 loc_accel_list=$(echo $PSA_SYM_LIST | sed 's/PSA_WANT_//g')
102
Valerio Settia47b0452024-06-25 18:31:36 +0200103 helper_libtestdriver1_adjust_config crypto
104 helper_libtestdriver1_make_drivers "$loc_accel_list"
105
Valerio Setti13aadd72024-08-13 13:13:23 +0200106 msg "crypto without heap: build main library"
Valerio Setti35b0b022024-08-13 13:36:50 +0200107 # Disable all legacy MBEDTLS_xxx symbols.
108 scripts/config.py unset-all "^MBEDTLS_"
109 # Build the PSA core using the proper config file.
110 scripts/config.py set MBEDTLS_PSA_CRYPTO_C
Valerio Settia47b0452024-06-25 18:31:36 +0200111 # Enable fully-static key slots in PSA core.
112 scripts/config.py set MBEDTLS_PSA_STATIC_KEY_SLOTS
Valerio Setti35b0b022024-08-13 13:36:50 +0200113 # Prevent PSA core from creating a copy of input/output buffers.
Valerio Settia47b0452024-06-25 18:31:36 +0200114 scripts/config.py set MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS
115 # Prevent PSA core from using CTR-DRBG or HMAC-DRBG for random generation.
116 scripts/config.py set MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
Valerio Setti13aadd72024-08-13 13:13:23 +0200117 # Set calloc/free as null pointer functions. Calling them would crash
Valerio Settia47b0452024-06-25 18:31:36 +0200118 # the program so we can use this as a "sentinel" for being sure no module
119 # is making use of these functions in the library.
Valerio Setti35b0b022024-08-13 13:36:50 +0200120 scripts/config.py set MBEDTLS_PLATFORM_C
Valerio Settia47b0452024-06-25 18:31:36 +0200121 scripts/config.py set MBEDTLS_PLATFORM_MEMORY
122 scripts/config.py set MBEDTLS_PLATFORM_STD_CALLOC NULL
123 scripts/config.py set MBEDTLS_PLATFORM_STD_FREE NULL
124
Valerio Settia47b0452024-06-25 18:31:36 +0200125 helper_libtestdriver1_make_main "$loc_accel_list" lib
126
Valerio Setti13aadd72024-08-13 13:13:23 +0200127 msg "crypto without heap: build test suites and helpers"
128 # Reset calloc/free functions to normal operations so that test code can
Valerio Settia47b0452024-06-25 18:31:36 +0200129 # freely use them.
130 scripts/config.py unset MBEDTLS_PLATFORM_MEMORY
131 scripts/config.py unset MBEDTLS_PLATFORM_STD_CALLOC
132 scripts/config.py unset MBEDTLS_PLATFORM_STD_FREE
133 helper_libtestdriver1_make_main "$loc_accel_list" tests
134
Valerio Setti13aadd72024-08-13 13:13:23 +0200135 msg "crypto without heap: test"
Valerio Settia47b0452024-06-25 18:31:36 +0200136 make test
137}
138
Minos Galanakisf78447f2024-07-26 20:49:51 +0100139component_test_no_rsa_key_pair_generation () {
Minos Galanakisdc0f73a2024-07-26 20:41:42 +0100140 msg "build: default config minus PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE"
Minos Galanakisdc0f73a2024-07-26 20:41:42 +0100141 scripts/config.py unset MBEDTLS_GENPRIME
Minos Galanakis00b641c2024-11-28 23:05:10 +0000142 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
Minos Galanakisdc0f73a2024-07-26 20:41:42 +0100143 make
144
145 msg "test: default config minus PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE"
146 make test
147}
148
Minos Galanakisc06fd302024-08-01 12:16:59 +0100149component_test_no_pem_no_fs () {
150 msg "build: Default + !MBEDTLS_PEM_PARSE_C + !MBEDTLS_FS_IO (ASan build)"
151 scripts/config.py unset MBEDTLS_PEM_PARSE_C
152 scripts/config.py unset MBEDTLS_FS_IO
153 scripts/config.py unset MBEDTLS_PSA_ITS_FILE_C # requires a filesystem
154 scripts/config.py unset MBEDTLS_PSA_CRYPTO_STORAGE_C # requires PSA ITS
155 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
156 make
157
158 msg "test: !MBEDTLS_PEM_PARSE_C !MBEDTLS_FS_IO - main suites (inc. selftests) (ASan build)" # ~ 50s
159 make test
160
161 msg "test: !MBEDTLS_PEM_PARSE_C !MBEDTLS_FS_IO - ssl-opt.sh (ASan build)" # ~ 6 min
162 tests/ssl-opt.sh
163}
164
165component_test_rsa_no_crt () {
166 msg "build: Default + RSA_NO_CRT (ASan build)" # ~ 6 min
167 scripts/config.py set MBEDTLS_RSA_NO_CRT
168 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
169 make
170
171 msg "test: RSA_NO_CRT - main suites (inc. selftests) (ASan build)" # ~ 50s
172 make test
173
174 msg "test: RSA_NO_CRT - RSA-related part of ssl-opt.sh (ASan build)" # ~ 5s
175 tests/ssl-opt.sh -f RSA
176
177 msg "test: RSA_NO_CRT - RSA-related part of compat.sh (ASan build)" # ~ 3 min
178 tests/compat.sh -t RSA
179
180 msg "test: RSA_NO_CRT - RSA-related part of context-info.sh (ASan build)" # ~ 15 sec
181 tests/context-info.sh
182}
183
Minos Galanakisc06fd302024-08-01 12:16:59 +0100184component_test_no_ctr_drbg_use_psa () {
185 msg "build: Full minus CTR_DRBG, PSA crypto in TLS"
186 scripts/config.py full
187 scripts/config.py unset MBEDTLS_CTR_DRBG_C
Minos Galanakisc06fd302024-08-01 12:16:59 +0100188
189 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
190 make
191
192 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - main suites"
193 make test
194
195 # In this configuration, the TLS test programs use HMAC_DRBG.
196 # The SSL tests are slow, so run a small subset, just enough to get
197 # confidence that the SSL code copes with HMAC_DRBG.
198 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - ssl-opt.sh (subset)"
199 tests/ssl-opt.sh -f 'Default\|SSL async private.*delay=\|tickets enabled on server'
200
201 msg "test: Full minus CTR_DRBG, USE_PSA_CRYPTO - compat.sh (subset)"
202 tests/compat.sh -m tls12 -t 'ECDSA PSK' -V NO -p OpenSSL
203}
204
Minos Galanakisc06fd302024-08-01 12:16:59 +0100205component_test_no_hmac_drbg_use_psa () {
206 msg "build: Full minus HMAC_DRBG, PSA crypto in TLS"
207 scripts/config.py full
208 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
209 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
Minos Galanakisc06fd302024-08-01 12:16:59 +0100210
211 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
212 make
213
214 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - main suites"
215 make test
216
217 # Normally our ECDSA implementation uses deterministic ECDSA. But since
218 # HMAC_DRBG is disabled in this configuration, randomized ECDSA is used
219 # instead.
220 # Test SSL with non-deterministic ECDSA. Only test features that
221 # might be affected by how ECDSA signature is performed.
222 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - ssl-opt.sh (subset)"
223 tests/ssl-opt.sh -f 'Default\|SSL async private: sign'
224
225 # To save time, only test one protocol version, since this part of
226 # the protocol is identical in (D)TLS up to 1.2.
227 msg "test: Full minus HMAC_DRBG, USE_PSA_CRYPTO - compat.sh (ECDSA)"
228 tests/compat.sh -m tls12 -t 'ECDSA'
229}
230
Minos Galanakisc06fd302024-08-01 12:16:59 +0100231component_test_psa_external_rng_no_drbg_use_psa () {
232 msg "build: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto in TLS"
233 scripts/config.py full
234 scripts/config.py set MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
235 scripts/config.py unset MBEDTLS_ENTROPY_C
236 scripts/config.py unset MBEDTLS_ENTROPY_NV_SEED
237 scripts/config.py unset MBEDTLS_PLATFORM_NV_SEED_ALT
238 scripts/config.py unset MBEDTLS_CTR_DRBG_C
239 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
240 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # requires HMAC_DRBG
241 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
242
243 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto - main suites"
244 make test
245
246 msg "test: PSA_CRYPTO_EXTERNAL_RNG minus *_DRBG, PSA crypto - ssl-opt.sh (subset)"
247 tests/ssl-opt.sh -f 'Default\|opaque'
248}
249
Minos Galanakis471b34c2024-07-26 15:39:24 +0100250component_test_psa_external_rng_use_psa_crypto () {
251 msg "build: full + PSA_CRYPTO_EXTERNAL_RNG + USE_PSA_CRYPTO minus CTR_DRBG"
252 scripts/config.py full
253 scripts/config.py set MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
Minos Galanakis471b34c2024-07-26 15:39:24 +0100254 scripts/config.py unset MBEDTLS_CTR_DRBG_C
255 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
256
257 msg "test: full + PSA_CRYPTO_EXTERNAL_RNG + USE_PSA_CRYPTO minus CTR_DRBG"
258 make test
259
260 msg "test: full + PSA_CRYPTO_EXTERNAL_RNG + USE_PSA_CRYPTO minus CTR_DRBG"
261 tests/ssl-opt.sh -f 'Default\|opaque'
262}
263
264component_test_psa_inject_entropy () {
265 msg "build: full + MBEDTLS_PSA_INJECT_ENTROPY"
266 scripts/config.py full
267 scripts/config.py set MBEDTLS_PSA_INJECT_ENTROPY
268 scripts/config.py set MBEDTLS_ENTROPY_NV_SEED
269 scripts/config.py set MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
270 scripts/config.py unset MBEDTLS_PLATFORM_NV_SEED_ALT
271 scripts/config.py unset MBEDTLS_PLATFORM_STD_NV_SEED_READ
272 scripts/config.py unset MBEDTLS_PLATFORM_STD_NV_SEED_WRITE
Minos Galanakis4f619e12024-11-14 14:56:47 +0000273 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS '-DTF_PSA_CRYPTO_USER_CONFIG_FILE=\"../tests/configs/user-config-for-test.h\"'" LDFLAGS="$ASAN_CFLAGS"
Minos Galanakis471b34c2024-07-26 15:39:24 +0100274
275 msg "test: full + MBEDTLS_PSA_INJECT_ENTROPY"
276 make test
277}
278
Minos Galanakisf78447f2024-07-26 20:49:51 +0100279component_full_no_pkparse_pkwrite () {
Minos Galanakis471b34c2024-07-26 15:39:24 +0100280 msg "build: full without pkparse and pkwrite"
281
282 scripts/config.py crypto_full
283 scripts/config.py unset MBEDTLS_PK_PARSE_C
284 scripts/config.py unset MBEDTLS_PK_WRITE_C
285
286 make CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
287
288 # Ensure that PK_[PARSE|WRITE]_C were not re-enabled accidentally (additive config).
289 not grep mbedtls_pk_parse_key ${BUILTIN_SRC_PATH}/pkparse.o
290 not grep mbedtls_pk_write_key_der ${BUILTIN_SRC_PATH}/pkwrite.o
291
292 msg "test: full without pkparse and pkwrite"
293 make test
294}
295
296component_test_crypto_full_md_light_only () {
297 msg "build: crypto_full with only the light subset of MD"
298 scripts/config.py crypto_full
299
300 # Disable MD
301 scripts/config.py unset MBEDTLS_MD_C
302 # Disable direct dependencies of MD_C
303 scripts/config.py unset MBEDTLS_HKDF_C
304 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
305 scripts/config.py unset MBEDTLS_PKCS7_C
306 # Disable indirect dependencies of MD_C
307 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC # needs HMAC_DRBG
Minos Galanakis00b641c2024-11-28 23:05:10 +0000308 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
Minos Galanakis471b34c2024-07-26 15:39:24 +0100309 # Disable things that would auto-enable MD_C
310 scripts/config.py unset MBEDTLS_PKCS5_C
311
312 # Note: MD-light is auto-enabled in build_info.h by modules that need it,
313 # which we haven't disabled, so no need to explicitly enable it.
314 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
315
316 # Make sure we don't have the HMAC functions, but the hashing functions
317 not grep mbedtls_md_hmac ${BUILTIN_SRC_PATH}/md.o
318 grep mbedtls_md ${BUILTIN_SRC_PATH}/md.o
319
320 msg "test: crypto_full with only the light subset of MD"
321 make test
322}
323
Minos Galanakiscd5668f2024-07-26 20:36:23 +0100324component_test_full_no_cipher () {
325 msg "build: full no CIPHER"
326
327 scripts/config.py full
328 scripts/config.py unset MBEDTLS_CIPHER_C
329
330 # The built-in implementation of the following algs/key-types depends
331 # on CIPHER_C so we disable them.
332 # This does not hold for KEY_TYPE_CHACHA20 and ALG_CHACHA20_POLY1305
333 # so we keep them enabled.
Minos Galanakis00b641c2024-11-28 23:05:10 +0000334 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CCM_STAR_NO_TAG
335 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CMAC
336 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
337 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
338 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CFB
339 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CTR
340 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
341 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_OFB
342 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
343 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_STREAM_CIPHER
344 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
Minos Galanakiscd5668f2024-07-26 20:36:23 +0100345
346 # The following modules directly depends on CIPHER_C
347 scripts/config.py unset MBEDTLS_CMAC_C
348 scripts/config.py unset MBEDTLS_NIST_KW_C
349
350 make
351
352 # Ensure that CIPHER_C was not re-enabled
353 not grep mbedtls_cipher_init ${BUILTIN_SRC_PATH}/cipher.o
354
355 msg "test: full no CIPHER"
356 make test
357}
358
Minos Galanakisf78447f2024-07-26 20:49:51 +0100359component_test_full_no_ccm () {
Minos Galanakis471b34c2024-07-26 15:39:24 +0100360 msg "build: full no PSA_WANT_ALG_CCM"
361
362 # Full config enables:
363 # - USE_PSA_CRYPTO so that TLS code dispatches cipher/AEAD to PSA
364 # - CRYPTO_CONFIG so that PSA_WANT config symbols are evaluated
365 scripts/config.py full
366
367 # Disable PSA_WANT_ALG_CCM so that CCM is not supported in PSA. CCM_C is still
368 # enabled, but not used from TLS since USE_PSA is set.
369 # This is helpful to ensure that TLS tests below have proper dependencies.
370 #
371 # Note: also PSA_WANT_ALG_CCM_STAR_NO_TAG is enabled, but it does not cause
372 # PSA_WANT_ALG_CCM to be re-enabled.
373 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM
374
375 make
376
377 msg "test: full no PSA_WANT_ALG_CCM"
378 make test
379}
380
Minos Galanakisf78447f2024-07-26 20:49:51 +0100381component_test_full_no_ccm_star_no_tag () {
Minos Galanakis471b34c2024-07-26 15:39:24 +0100382 msg "build: full no PSA_WANT_ALG_CCM_STAR_NO_TAG"
383
384 # Full config enables CRYPTO_CONFIG so that PSA_WANT config symbols are evaluated
385 scripts/config.py full
386
387 # Disable CCM_STAR_NO_TAG, which is the target of this test, as well as all
388 # other components that enable MBEDTLS_PSA_BUILTIN_CIPHER internal symbol.
389 # This basically disables all unauthenticated ciphers on the PSA side, while
390 # keeping AEADs enabled.
391 #
392 # Note: PSA_WANT_ALG_CCM is enabled, but it does not cause
393 # PSA_WANT_ALG_CCM_STAR_NO_TAG to be re-enabled.
394 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM_STAR_NO_TAG
395 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_STREAM_CIPHER
396 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CTR
397 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CFB
398 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_OFB
399 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_ECB_NO_PADDING
400 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING
401 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7
402
403 make
404
405 # Ensure MBEDTLS_PSA_BUILTIN_CIPHER was not enabled
406 not grep mbedtls_psa_cipher ${PSA_CORE_PATH}/psa_crypto_cipher.o
407
408 msg "test: full no PSA_WANT_ALG_CCM_STAR_NO_TAG"
409 make test
410}
411
Gilles Peskineea5de2b2024-09-19 18:41:55 +0200412component_test_config_symmetric_only () {
413 msg "build: configs/config-symmetric-only.h"
Minos Galanakis5da58e52024-11-07 15:35:33 +0000414 MBEDTLS_CONFIG="configs/config-symmetric-only.h"
415 CRYPTO_CONFIG="configs/crypto-config-symmetric-only.h"
Ronald Cronfaadfc22024-12-07 17:24:28 +0100416 CC=$ASAN_CC cmake -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
Gilles Peskineaf5a8992024-09-14 11:27:44 +0200417 make
418
Gilles Peskineea5de2b2024-09-19 18:41:55 +0200419 msg "test: configs/config-symmetric-only.h - unit tests"
Gilles Peskineaf5a8992024-09-14 11:27:44 +0200420 make test
421}
422
Minos Galanakisc06fd302024-08-01 12:16:59 +0100423component_test_everest () {
424 msg "build: Everest ECDH context (ASan build)" # ~ 6 min
425 scripts/config.py set MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
426 CC=clang cmake -D CMAKE_BUILD_TYPE:String=Asan .
427 make
428
429 msg "test: Everest ECDH context - main suites (inc. selftests) (ASan build)" # ~ 50s
430 make test
431
432 msg "test: metatests (clang, ASan)"
433 tests/scripts/run-metatests.sh any asan poison
434
435 msg "test: Everest ECDH context - ECDH-related part of ssl-opt.sh (ASan build)" # ~ 5s
436 tests/ssl-opt.sh -f ECDH
437
438 msg "test: Everest ECDH context - compat.sh with some ECDH ciphersuites (ASan build)" # ~ 3 min
439 # Exclude some symmetric ciphers that are redundant here to gain time.
440 tests/compat.sh -f ECDH -V NO -e 'ARIA\|CAMELLIA\|CHACHA'
441}
442
443component_test_everest_curve25519_only () {
444 msg "build: Everest ECDH context, only Curve25519" # ~ 6 min
Minos Galanakisc06fd302024-08-01 12:16:59 +0100445 scripts/config.py set MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
446 scripts/config.py unset MBEDTLS_ECDSA_C
Minos Galanakis00b641c2024-11-28 23:05:10 +0000447 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
448 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECDSA
449 scripts/config.py -c $CRYPTO_CONFIG_H set PSA_WANT_ALG_ECDH
Minos Galanakisc06fd302024-08-01 12:16:59 +0100450 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
451 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
452 scripts/config.py unset MBEDTLS_ECJPAKE_C
Minos Galanakis00b641c2024-11-28 23:05:10 +0000453 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_JPAKE
Minos Galanakisc06fd302024-08-01 12:16:59 +0100454
455 # Disable all curves
456 scripts/config.py unset-all "MBEDTLS_ECP_DP_[0-9A-Z_a-z]*_ENABLED"
Minos Galanakis00b641c2024-11-28 23:05:10 +0000457 scripts/config.py -c $CRYPTO_CONFIG_H unset-all "PSA_WANT_ECC_[0-9A-Z_a-z]*$"
458 scripts/config.py -c $CRYPTO_CONFIG_H set PSA_WANT_ECC_MONTGOMERY_255
Minos Galanakisc06fd302024-08-01 12:16:59 +0100459
460 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
461
462 msg "test: Everest ECDH context, only Curve25519" # ~ 50s
463 make test
464}
465
Minos Galanakis471b34c2024-07-26 15:39:24 +0100466component_test_psa_collect_statuses () {
467 msg "build+test: psa_collect_statuses" # ~30s
468 scripts/config.py full
469 tests/scripts/psa_collect_statuses.py
470 # Check that psa_crypto_init() succeeded at least once
471 grep -q '^0:psa_crypto_init:' tests/statuses.log
472 rm -f tests/statuses.log
473}
474
475# Check that the specified libraries exist and are empty.
476are_empty_libraries () {
477 nm "$@" >/dev/null 2>/dev/null
478 ! nm "$@" 2>/dev/null | grep -v ':$' | grep .
479}
480
481component_build_crypto_default () {
482 msg "build: make, crypto only"
483 scripts/config.py crypto
484 make CFLAGS='-O1 -Werror'
485 are_empty_libraries library/libmbedx509.* library/libmbedtls.*
486}
487
488component_build_crypto_full () {
489 msg "build: make, crypto only, full config"
490 scripts/config.py crypto_full
491 make CFLAGS='-O1 -Werror'
492 are_empty_libraries library/libmbedx509.* library/libmbedtls.*
493}
494
495component_test_crypto_for_psa_service () {
496 msg "build: make, config for PSA crypto service"
497 scripts/config.py crypto
498 scripts/config.py set MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
499 # Disable things that are not needed for just cryptography, to
500 # reach a configuration that would be typical for a PSA cryptography
501 # service providing all implemented PSA algorithms.
502 # System stuff
503 scripts/config.py unset MBEDTLS_ERROR_C
504 scripts/config.py unset MBEDTLS_TIMING_C
505 scripts/config.py unset MBEDTLS_VERSION_FEATURES
506 # Crypto stuff with no PSA interface
507 scripts/config.py unset MBEDTLS_BASE64_C
508 # Keep MBEDTLS_CIPHER_C because psa_crypto_cipher, CCM and GCM need it.
509 scripts/config.py unset MBEDTLS_HKDF_C # PSA's HKDF is independent
510 # Keep MBEDTLS_MD_C because deterministic ECDSA needs it for HMAC_DRBG.
511 scripts/config.py unset MBEDTLS_NIST_KW_C
512 scripts/config.py unset MBEDTLS_PEM_PARSE_C
513 scripts/config.py unset MBEDTLS_PEM_WRITE_C
514 scripts/config.py unset MBEDTLS_PKCS12_C
515 scripts/config.py unset MBEDTLS_PKCS5_C
516 # MBEDTLS_PK_PARSE_C and MBEDTLS_PK_WRITE_C are actually currently needed
517 # in PSA code to work with RSA keys. We don't require users to set those:
518 # they will be reenabled in build_info.h.
519 scripts/config.py unset MBEDTLS_PK_C
520 scripts/config.py unset MBEDTLS_PK_PARSE_C
521 scripts/config.py unset MBEDTLS_PK_WRITE_C
522 make CFLAGS='-O1 -Werror' all test
523 are_empty_libraries library/libmbedx509.* library/libmbedtls.*
524}
525
526component_build_crypto_baremetal () {
527 msg "build: make, crypto only, baremetal config"
528 scripts/config.py crypto_baremetal
David Horstmann5b93d972024-10-31 15:36:05 +0000529 make CFLAGS="-O1 -Werror -I$PWD/framework/tests/include/baremetal-override/"
Minos Galanakis471b34c2024-07-26 15:39:24 +0100530 are_empty_libraries library/libmbedx509.* library/libmbedtls.*
531}
532
533support_build_crypto_baremetal () {
534 support_build_baremetal "$@"
535}
536
537# depends.py family of tests
538component_test_depends_py_cipher_id () {
539 msg "test/build: depends.py cipher_id (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200540 tests/scripts/depends.py cipher_id
Minos Galanakis471b34c2024-07-26 15:39:24 +0100541}
542
543component_test_depends_py_cipher_chaining () {
544 msg "test/build: depends.py cipher_chaining (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200545 tests/scripts/depends.py cipher_chaining
Minos Galanakis471b34c2024-07-26 15:39:24 +0100546}
547
548component_test_depends_py_cipher_padding () {
549 msg "test/build: depends.py cipher_padding (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200550 tests/scripts/depends.py cipher_padding
Minos Galanakis471b34c2024-07-26 15:39:24 +0100551}
552
553component_test_depends_py_curves () {
554 msg "test/build: depends.py curves (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200555 tests/scripts/depends.py curves
Minos Galanakis471b34c2024-07-26 15:39:24 +0100556}
557
558component_test_depends_py_hashes () {
559 msg "test/build: depends.py hashes (gcc)"
Gabor Mezei9ce6d242024-06-19 17:47:05 +0200560 tests/scripts/depends.py hashes
Minos Galanakis471b34c2024-07-26 15:39:24 +0100561}
562
Minos Galanakis471b34c2024-07-26 15:39:24 +0100563component_test_depends_py_pkalgs () {
564 msg "test/build: depends.py pkalgs (gcc)"
Minos Galanakis471b34c2024-07-26 15:39:24 +0100565 tests/scripts/depends.py pkalgs
566}
567
568component_test_psa_crypto_config_ffdh_2048_only () {
569 msg "build: full config - only DH 2048"
570
571 scripts/config.py full
572
573 # Disable all DH groups other than 2048.
574 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_DH_RFC7919_3072
575 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_DH_RFC7919_4096
576 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_DH_RFC7919_6144
577 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_DH_RFC7919_8192
578
579 make CFLAGS="$ASAN_CFLAGS -Werror" LDFLAGS="$ASAN_CFLAGS"
580
581 msg "test: full config - only DH 2048"
582 make test
583
584 msg "ssl-opt: full config - only DH 2048"
585 tests/ssl-opt.sh -f "ffdh"
586}
587
588component_build_no_pk_rsa_alt_support () {
589 msg "build: !MBEDTLS_PK_RSA_ALT_SUPPORT" # ~30s
590
591 scripts/config.py full
592 scripts/config.py unset MBEDTLS_PK_RSA_ALT_SUPPORT
593 scripts/config.py set MBEDTLS_RSA_C
594 scripts/config.py set MBEDTLS_X509_CRT_WRITE_C
595
596 # Only compile - this is primarily to test for compile issues
597 make CFLAGS='-Werror -Wall -Wextra -I../tests/include/alt-dummy'
598}
599
600component_build_module_alt () {
601 msg "build: MBEDTLS_XXX_ALT" # ~30s
602 scripts/config.py full
603
604 # Disable options that are incompatible with some ALT implementations:
605 # aesni.c references mbedtls_aes_context fields directly.
606 scripts/config.py unset MBEDTLS_AESNI_C
607 scripts/config.py unset MBEDTLS_AESCE_C
608 # MBEDTLS_ECP_RESTARTABLE is documented as incompatible.
609 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
610 # You can only have one threading implementation: alt or pthread, not both.
611 scripts/config.py unset MBEDTLS_THREADING_PTHREAD
612 # The SpecifiedECDomain parsing code accesses mbedtls_ecp_group fields
613 # directly and assumes the implementation works with partial groups.
614 scripts/config.py unset MBEDTLS_PK_PARSE_EC_EXTENDED
615 # MBEDTLS_SHA256_*ALT can't be used with MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_*
616 scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
617 scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY
618 # MBEDTLS_SHA512_*ALT can't be used with MBEDTLS_SHA512_USE_A64_CRYPTO_*
619 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
620 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY
621
622 # Enable all MBEDTLS_XXX_ALT for whole modules. Do not enable
623 # MBEDTLS_XXX_YYY_ALT which are for single functions.
624 scripts/config.py set-all 'MBEDTLS_([A-Z0-9]*|NIST_KW)_ALT'
625
626 # We can only compile, not link, since we don't have any implementations
627 # suitable for testing with the dummy alt headers.
628 make CFLAGS='-Werror -Wall -Wextra -I../tests/include/alt-dummy' lib
629}
630
631component_test_psa_crypto_config_accel_ecdsa () {
Ronald Cron93ba6252024-09-05 10:37:14 +0200632 msg "build: accelerated ECDSA"
Minos Galanakis471b34c2024-07-26 15:39:24 +0100633
634 # Algorithms and key types to accelerate
635 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
636 $(helper_get_psa_key_type_list "ECC") \
637 $(helper_get_psa_curve_list)"
638
639 # Configure
640 # ---------
641
Elena Uziunaite91d83862024-09-04 14:51:31 +0100642 # Start from default config + TLS 1.3
Minos Galanakis471b34c2024-07-26 15:39:24 +0100643 helper_libtestdriver1_adjust_config "default"
644
645 # Disable the module that's accelerated
646 scripts/config.py unset MBEDTLS_ECDSA_C
647
648 # Disable things that depend on it
649 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
650 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
651
652 # Build
653 # -----
654
655 # These hashes are needed for some ECDSA signature tests.
Elena Uziunaiteffce45c2024-09-12 14:58:52 +0100656 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
Minos Galanakis471b34c2024-07-26 15:39:24 +0100657 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
658
659 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
660
661 helper_libtestdriver1_make_main "$loc_accel_list"
662
663 # Make sure this was not re-enabled by accident (additive config)
664 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
665
666 # Run the tests
667 # -------------
668
Ronald Cron93ba6252024-09-05 10:37:14 +0200669 msg "test: accelerated ECDSA"
Minos Galanakis471b34c2024-07-26 15:39:24 +0100670 make test
671}
672
673component_test_psa_crypto_config_accel_ecdh () {
Ronald Cron93ba6252024-09-05 10:37:14 +0200674 msg "build: accelerated ECDH"
Minos Galanakis471b34c2024-07-26 15:39:24 +0100675
676 # Algorithms and key types to accelerate
677 loc_accel_list="ALG_ECDH \
678 $(helper_get_psa_key_type_list "ECC") \
679 $(helper_get_psa_curve_list)"
680
681 # Configure
682 # ---------
683
684 # Start from default config (no USE_PSA)
685 helper_libtestdriver1_adjust_config "default"
686
687 # Disable the module that's accelerated
688 scripts/config.py unset MBEDTLS_ECDH_C
689
690 # Disable things that depend on it
691 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
692 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
693 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
694 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
695 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
696
697 # Build
698 # -----
699
700 helper_libtestdriver1_make_drivers "$loc_accel_list"
701
702 helper_libtestdriver1_make_main "$loc_accel_list"
703
704 # Make sure this was not re-enabled by accident (additive config)
705 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
706
707 # Run the tests
708 # -------------
709
Ronald Cron93ba6252024-09-05 10:37:14 +0200710 msg "test: accelerated ECDH"
Minos Galanakis471b34c2024-07-26 15:39:24 +0100711 make test
712}
713
714component_test_psa_crypto_config_accel_ffdh () {
715 msg "build: full with accelerated FFDH"
716
717 # Algorithms and key types to accelerate
718 loc_accel_list="ALG_FFDH \
719 $(helper_get_psa_key_type_list "DH") \
720 $(helper_get_psa_dh_group_list)"
721
722 # Configure
723 # ---------
724
725 # start with full (USE_PSA and TLS 1.3)
726 helper_libtestdriver1_adjust_config "full"
727
728 # Disable the module that's accelerated
729 scripts/config.py unset MBEDTLS_DHM_C
730
731 # Disable things that depend on it
732 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
733 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
734
735 # Build
736 # -----
737
738 helper_libtestdriver1_make_drivers "$loc_accel_list"
739
740 helper_libtestdriver1_make_main "$loc_accel_list"
741
742 # Make sure this was not re-enabled by accident (additive config)
743 not grep mbedtls_dhm_ ${BUILTIN_SRC_PATH}/dhm.o
744
745 # Run the tests
746 # -------------
747
748 msg "test: full with accelerated FFDH"
749 make test
750
751 msg "ssl-opt: full with accelerated FFDH alg"
752 tests/ssl-opt.sh -f "ffdh"
753}
754
755component_test_psa_crypto_config_reference_ffdh () {
756 msg "build: full with non-accelerated FFDH"
757
758 # Start with full (USE_PSA and TLS 1.3)
759 helper_libtestdriver1_adjust_config "full"
760
761 # Disable things that are not supported
762 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
763 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
764 make
765
766 msg "test suites: full with non-accelerated FFDH alg"
767 make test
768
769 msg "ssl-opt: full with non-accelerated FFDH alg"
770 tests/ssl-opt.sh -f "ffdh"
771}
772
Minos Galanakisf78447f2024-07-26 20:49:51 +0100773component_test_psa_crypto_config_accel_pake () {
Minos Galanakis471b34c2024-07-26 15:39:24 +0100774 msg "build: full with accelerated PAKE"
775
776 loc_accel_list="ALG_JPAKE \
777 $(helper_get_psa_key_type_list "ECC") \
778 $(helper_get_psa_curve_list)"
779
780 # Configure
781 # ---------
782
783 helper_libtestdriver1_adjust_config "full"
784
785 # Make built-in fallback not available
786 scripts/config.py unset MBEDTLS_ECJPAKE_C
787 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
788
789 # Build
790 # -----
791
792 helper_libtestdriver1_make_drivers "$loc_accel_list"
793
794 helper_libtestdriver1_make_main "$loc_accel_list"
795
796 # Make sure this was not re-enabled by accident (additive config)
797 not grep mbedtls_ecjpake_init ${BUILTIN_SRC_PATH}/ecjpake.o
798
799 # Run the tests
800 # -------------
801
802 msg "test: full with accelerated PAKE"
803 make test
804}
805
806component_test_psa_crypto_config_accel_ecc_some_key_types () {
807 msg "build: full with accelerated EC algs and some key types"
808
809 # Algorithms and key types to accelerate
810 # For key types, use an explicitly list to omit GENERATE (and DERIVE)
811 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
812 ALG_ECDH \
813 ALG_JPAKE \
814 KEY_TYPE_ECC_PUBLIC_KEY \
815 KEY_TYPE_ECC_KEY_PAIR_BASIC \
816 KEY_TYPE_ECC_KEY_PAIR_IMPORT \
817 KEY_TYPE_ECC_KEY_PAIR_EXPORT \
818 $(helper_get_psa_curve_list)"
819
820 # Configure
821 # ---------
822
823 # start with config full for maximum coverage (also enables USE_PSA)
824 helper_libtestdriver1_adjust_config "full"
825
826 # Disable modules that are accelerated - some will be re-enabled
827 scripts/config.py unset MBEDTLS_ECDSA_C
828 scripts/config.py unset MBEDTLS_ECDH_C
829 scripts/config.py unset MBEDTLS_ECJPAKE_C
830 scripts/config.py unset MBEDTLS_ECP_C
831
832 # Disable all curves - those that aren't accelerated should be re-enabled
833 helper_disable_builtin_curves
834
835 # Restartable feature is not yet supported by PSA. Once it will in
836 # the future, the following line could be removed (see issues
837 # 6061, 6332 and following ones)
838 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
839
840 # this is not supported by the driver API yet
841 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
842
843 # Build
844 # -----
845
846 # These hashes are needed for some ECDSA signature tests.
847 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
848 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
849 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
850
851 helper_libtestdriver1_make_main "$loc_accel_list"
852
853 # ECP should be re-enabled but not the others
854 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
855 not grep mbedtls_ecdsa ${BUILTIN_SRC_PATH}/ecdsa.o
856 not grep mbedtls_ecjpake ${BUILTIN_SRC_PATH}/ecjpake.o
857 grep mbedtls_ecp ${BUILTIN_SRC_PATH}/ecp.o
858
859 # Run the tests
860 # -------------
861
862 msg "test suites: full with accelerated EC algs and some key types"
863 make test
864}
865
866# Run tests with only (non-)Weierstrass accelerated
867# Common code used in:
868# - component_test_psa_crypto_config_accel_ecc_weierstrass_curves
869# - component_test_psa_crypto_config_accel_ecc_non_weierstrass_curves
Minos Galanakis471b34c2024-07-26 15:39:24 +0100870common_test_psa_crypto_config_accel_ecc_some_curves () {
871 weierstrass=$1
872 if [ $weierstrass -eq 1 ]; then
873 desc="Weierstrass"
874 else
875 desc="non-Weierstrass"
876 fi
877
878 msg "build: crypto_full minus PK with accelerated EC algs and $desc curves"
879
880 # Note: Curves are handled in a special way by the libtestdriver machinery,
881 # so we only want to include them in the accel list when building the main
882 # libraries, hence the use of a separate variable.
883 # Note: the following loop is a modified version of
884 # helper_get_psa_curve_list that only keeps Weierstrass families.
885 loc_weierstrass_list=""
886 loc_non_weierstrass_list=""
887 for item in $(sed -n 's/^#define PSA_WANT_\(ECC_[0-9A-Z_a-z]*\).*/\1/p' <"$CRYPTO_CONFIG_H"); do
888 case $item in
889 ECC_BRAINPOOL*|ECC_SECP*)
890 loc_weierstrass_list="$loc_weierstrass_list $item"
891 ;;
892 *)
893 loc_non_weierstrass_list="$loc_non_weierstrass_list $item"
894 ;;
895 esac
896 done
897 if [ $weierstrass -eq 1 ]; then
898 loc_curve_list=$loc_weierstrass_list
899 else
900 loc_curve_list=$loc_non_weierstrass_list
901 fi
902
903 # Algorithms and key types to accelerate
904 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
905 ALG_ECDH \
906 ALG_JPAKE \
907 $(helper_get_psa_key_type_list "ECC") \
908 $loc_curve_list"
909
910 # Configure
911 # ---------
912
913 # Start with config crypto_full and remove PK_C:
914 # that's what's supported now, see docs/driver-only-builds.md.
915 helper_libtestdriver1_adjust_config "crypto_full"
916 scripts/config.py unset MBEDTLS_PK_C
917 scripts/config.py unset MBEDTLS_PK_PARSE_C
918 scripts/config.py unset MBEDTLS_PK_WRITE_C
919
920 # Disable modules that are accelerated - some will be re-enabled
921 scripts/config.py unset MBEDTLS_ECDSA_C
922 scripts/config.py unset MBEDTLS_ECDH_C
923 scripts/config.py unset MBEDTLS_ECJPAKE_C
924 scripts/config.py unset MBEDTLS_ECP_C
925
926 # Disable all curves - those that aren't accelerated should be re-enabled
927 helper_disable_builtin_curves
928
929 # Restartable feature is not yet supported by PSA. Once it will in
930 # the future, the following line could be removed (see issues
931 # 6061, 6332 and following ones)
932 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
933
934 # this is not supported by the driver API yet
935 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
936
937 # Build
938 # -----
939
940 # These hashes are needed for some ECDSA signature tests.
941 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
942 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
943 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
944
945 helper_libtestdriver1_make_main "$loc_accel_list"
946
947 # We expect ECDH to be re-enabled for the missing curves
948 grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
949 # We expect ECP to be re-enabled, however the parts specific to the
950 # families of curves that are accelerated should be ommited.
951 # - functions with mxz in the name are specific to Montgomery curves
952 # - ecp_muladd is specific to Weierstrass curves
953 ##nm ${BUILTIN_SRC_PATH}/ecp.o | tee ecp.syms
954 if [ $weierstrass -eq 1 ]; then
955 not grep mbedtls_ecp_muladd ${BUILTIN_SRC_PATH}/ecp.o
956 grep mxz ${BUILTIN_SRC_PATH}/ecp.o
957 else
958 grep mbedtls_ecp_muladd ${BUILTIN_SRC_PATH}/ecp.o
959 not grep mxz ${BUILTIN_SRC_PATH}/ecp.o
960 fi
961 # We expect ECDSA and ECJPAKE to be re-enabled only when
962 # Weierstrass curves are not accelerated
963 if [ $weierstrass -eq 1 ]; then
964 not grep mbedtls_ecdsa ${BUILTIN_SRC_PATH}/ecdsa.o
965 not grep mbedtls_ecjpake ${BUILTIN_SRC_PATH}/ecjpake.o
966 else
967 grep mbedtls_ecdsa ${BUILTIN_SRC_PATH}/ecdsa.o
968 grep mbedtls_ecjpake ${BUILTIN_SRC_PATH}/ecjpake.o
969 fi
970
971 # Run the tests
972 # -------------
973
974 msg "test suites: crypto_full minus PK with accelerated EC algs and $desc curves"
975 make test
976}
977
978component_test_psa_crypto_config_accel_ecc_weierstrass_curves () {
979 common_test_psa_crypto_config_accel_ecc_some_curves 1
980}
981
982component_test_psa_crypto_config_accel_ecc_non_weierstrass_curves () {
983 common_test_psa_crypto_config_accel_ecc_some_curves 0
984}
985
986# Auxiliary function to build config for all EC based algorithms (EC-JPAKE,
987# ECDH, ECDSA) with and without drivers.
988# The input parameter is a boolean value which indicates:
989# - 0 keep built-in EC algs,
990# - 1 exclude built-in EC algs (driver only).
991#
992# This is used by the two following components to ensure they always use the
993# same config, except for the use of driver or built-in EC algorithms:
994# - component_test_psa_crypto_config_accel_ecc_ecp_light_only;
995# - component_test_psa_crypto_config_reference_ecc_ecp_light_only.
996# This supports comparing their test coverage with analyze_outcomes.py.
Minos Galanakis471b34c2024-07-26 15:39:24 +0100997config_psa_crypto_config_ecp_light_only () {
998 driver_only="$1"
999 # start with config full for maximum coverage (also enables USE_PSA)
1000 helper_libtestdriver1_adjust_config "full"
1001 if [ "$driver_only" -eq 1 ]; then
1002 # Disable modules that are accelerated
1003 scripts/config.py unset MBEDTLS_ECDSA_C
1004 scripts/config.py unset MBEDTLS_ECDH_C
1005 scripts/config.py unset MBEDTLS_ECJPAKE_C
1006 scripts/config.py unset MBEDTLS_ECP_C
1007 fi
1008
1009 # Restartable feature is not yet supported by PSA. Once it will in
1010 # the future, the following line could be removed (see issues
1011 # 6061, 6332 and following ones)
1012 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
1013}
1014
1015# Keep in sync with component_test_psa_crypto_config_reference_ecc_ecp_light_only
Minos Galanakis471b34c2024-07-26 15:39:24 +01001016component_test_psa_crypto_config_accel_ecc_ecp_light_only () {
1017 msg "build: full with accelerated EC algs"
1018
1019 # Algorithms and key types to accelerate
1020 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
1021 ALG_ECDH \
1022 ALG_JPAKE \
1023 $(helper_get_psa_key_type_list "ECC") \
1024 $(helper_get_psa_curve_list)"
1025
1026 # Configure
1027 # ---------
1028
1029 # Use the same config as reference, only without built-in EC algs
1030 config_psa_crypto_config_ecp_light_only 1
1031
1032 # Do not disable builtin curves because that support is required for:
1033 # - MBEDTLS_PK_PARSE_EC_EXTENDED
1034 # - MBEDTLS_PK_PARSE_EC_COMPRESSED
1035
1036 # Build
1037 # -----
1038
1039 # These hashes are needed for some ECDSA signature tests.
1040 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1041 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1042 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1043
1044 helper_libtestdriver1_make_main "$loc_accel_list"
1045
1046 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
1047 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
1048 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1049 not grep mbedtls_ecjpake_ ${BUILTIN_SRC_PATH}/ecjpake.o
1050 not grep mbedtls_ecp_mul ${BUILTIN_SRC_PATH}/ecp.o
1051
1052 # Run the tests
1053 # -------------
1054
1055 msg "test suites: full with accelerated EC algs"
1056 make test
1057
1058 msg "ssl-opt: full with accelerated EC algs"
1059 tests/ssl-opt.sh
1060}
1061
1062# Keep in sync with component_test_psa_crypto_config_accel_ecc_ecp_light_only
Minos Galanakis471b34c2024-07-26 15:39:24 +01001063component_test_psa_crypto_config_reference_ecc_ecp_light_only () {
Ronald Cron93ba6252024-09-05 10:37:14 +02001064 msg "build: non-accelerated EC algs"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001065
1066 config_psa_crypto_config_ecp_light_only 0
1067
1068 make
1069
1070 msg "test suites: full with non-accelerated EC algs"
1071 make test
1072
1073 msg "ssl-opt: full with non-accelerated EC algs"
1074 tests/ssl-opt.sh
1075}
1076
1077# This helper function is used by:
1078# - component_test_psa_crypto_config_accel_ecc_no_ecp_at_all()
1079# - component_test_psa_crypto_config_reference_ecc_no_ecp_at_all()
1080# to ensure that both tests use the same underlying configuration when testing
1081# driver's coverage with analyze_outcomes.py.
1082#
1083# This functions accepts 1 boolean parameter as follows:
1084# - 1: building with accelerated EC algorithms (ECDSA, ECDH, ECJPAKE), therefore
1085# excluding their built-in implementation as well as ECP_C & ECP_LIGHT
1086# - 0: include built-in implementation of EC algorithms.
1087#
1088# PK_C and RSA_C are always disabled to ensure there is no remaining dependency
1089# on the ECP module.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001090config_psa_crypto_no_ecp_at_all () {
1091 driver_only="$1"
1092 # start with full config for maximum coverage (also enables USE_PSA)
1093 helper_libtestdriver1_adjust_config "full"
1094
1095 if [ "$driver_only" -eq 1 ]; then
1096 # Disable modules that are accelerated
1097 scripts/config.py unset MBEDTLS_ECDSA_C
1098 scripts/config.py unset MBEDTLS_ECDH_C
1099 scripts/config.py unset MBEDTLS_ECJPAKE_C
1100 # Disable ECP module (entirely)
1101 scripts/config.py unset MBEDTLS_ECP_C
1102 fi
1103
1104 # Disable all the features that auto-enable ECP_LIGHT (see build_info.h)
1105 scripts/config.py unset MBEDTLS_PK_PARSE_EC_EXTENDED
1106 scripts/config.py unset MBEDTLS_PK_PARSE_EC_COMPRESSED
1107 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
1108
1109 # Restartable feature is not yet supported by PSA. Once it will in
1110 # the future, the following line could be removed (see issues
1111 # 6061, 6332 and following ones)
1112 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
1113}
1114
1115# Build and test a configuration where driver accelerates all EC algs while
1116# all support and dependencies from ECP and ECP_LIGHT are removed on the library
1117# side.
1118#
1119# Keep in sync with component_test_psa_crypto_config_reference_ecc_no_ecp_at_all()
Minos Galanakis471b34c2024-07-26 15:39:24 +01001120component_test_psa_crypto_config_accel_ecc_no_ecp_at_all () {
1121 msg "build: full + accelerated EC algs - ECP"
1122
1123 # Algorithms and key types to accelerate
1124 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
1125 ALG_ECDH \
1126 ALG_JPAKE \
1127 $(helper_get_psa_key_type_list "ECC") \
1128 $(helper_get_psa_curve_list)"
1129
1130 # Configure
1131 # ---------
1132
1133 # Set common configurations between library's and driver's builds
1134 config_psa_crypto_no_ecp_at_all 1
1135 # Disable all the builtin curves. All the required algs are accelerated.
1136 helper_disable_builtin_curves
1137
1138 # Build
1139 # -----
1140
1141 # Things we wanted supported in libtestdriver1, but not accelerated in the main library:
1142 # SHA-1 and all SHA-2/3 variants, as they are used by ECDSA deterministic.
1143 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1144 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1145
1146 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1147
1148 helper_libtestdriver1_make_main "$loc_accel_list"
1149
1150 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
1151 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
1152 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1153 not grep mbedtls_ecjpake_ ${BUILTIN_SRC_PATH}/ecjpake.o
1154 # Also ensure that ECP module was not re-enabled
1155 not grep mbedtls_ecp_ ${BUILTIN_SRC_PATH}/ecp.o
1156
1157 # Run the tests
1158 # -------------
1159
1160 msg "test: full + accelerated EC algs - ECP"
1161 make test
1162
1163 msg "ssl-opt: full + accelerated EC algs - ECP"
1164 tests/ssl-opt.sh
1165}
1166
1167# Reference function used for driver's coverage analysis in analyze_outcomes.py
1168# in conjunction with component_test_psa_crypto_config_accel_ecc_no_ecp_at_all().
1169# Keep in sync with its accelerated counterpart.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001170component_test_psa_crypto_config_reference_ecc_no_ecp_at_all () {
1171 msg "build: full + non accelerated EC algs"
1172
1173 config_psa_crypto_no_ecp_at_all 0
1174
1175 make
1176
1177 msg "test: full + non accelerated EC algs"
1178 make test
1179
1180 msg "ssl-opt: full + non accelerated EC algs"
1181 tests/ssl-opt.sh
1182}
1183
1184# This is a common configuration helper used directly from:
1185# - common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
1186# - common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
1187# and indirectly from:
1188# - component_test_psa_crypto_config_accel_ecc_no_bignum
1189# - accelerate all EC algs, disable RSA and FFDH
1190# - component_test_psa_crypto_config_reference_ecc_no_bignum
1191# - this is the reference component of the above
1192# - it still disables RSA and FFDH, but it uses builtin EC algs
1193# - component_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
1194# - accelerate all EC and FFDH algs, disable only RSA
1195# - component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
1196# - this is the reference component of the above
1197# - it still disables RSA, but it uses builtin EC and FFDH algs
1198#
1199# This function accepts 2 parameters:
1200# $1: a boolean value which states if we are testing an accelerated scenario
1201# or not.
1202# $2: a string value which states which components are tested. Allowed values
1203# are "ECC" or "ECC_DH".
Minos Galanakisf78447f2024-07-26 20:49:51 +01001204config_psa_crypto_config_accel_ecc_ffdh_no_bignum () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001205 driver_only="$1"
1206 test_target="$2"
1207 # start with full config for maximum coverage (also enables USE_PSA)
1208 helper_libtestdriver1_adjust_config "full"
1209
1210 if [ "$driver_only" -eq 1 ]; then
1211 # Disable modules that are accelerated
1212 scripts/config.py unset MBEDTLS_ECDSA_C
1213 scripts/config.py unset MBEDTLS_ECDH_C
1214 scripts/config.py unset MBEDTLS_ECJPAKE_C
1215 # Disable ECP module (entirely)
1216 scripts/config.py unset MBEDTLS_ECP_C
1217 # Also disable bignum
1218 scripts/config.py unset MBEDTLS_BIGNUM_C
1219 fi
1220
1221 # Disable all the features that auto-enable ECP_LIGHT (see build_info.h)
1222 scripts/config.py unset MBEDTLS_PK_PARSE_EC_EXTENDED
1223 scripts/config.py unset MBEDTLS_PK_PARSE_EC_COMPRESSED
1224 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE
1225
1226 # RSA support is intentionally disabled on this test because RSA_C depends
1227 # on BIGNUM_C.
1228 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_RSA_[0-9A-Z_a-z]*"
1229 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_ALG_RSA_[0-9A-Z_a-z]*"
1230 scripts/config.py unset MBEDTLS_RSA_C
1231 scripts/config.py unset MBEDTLS_PKCS1_V15
1232 scripts/config.py unset MBEDTLS_PKCS1_V21
1233 scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
1234 # Also disable key exchanges that depend on RSA
Minos Galanakis471b34c2024-07-26 15:39:24 +01001235 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
1236 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
1237 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
1238 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
1239
1240 if [ "$test_target" = "ECC" ]; then
1241 # When testing ECC only, we disable FFDH support, both from builtin and
1242 # PSA sides, and also disable the key exchanges that depend on DHM.
1243 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_FFDH
1244 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_KEY_TYPE_DH_[0-9A-Z_a-z]*"
1245 scripts/config.py -f "$CRYPTO_CONFIG_H" unset-all "PSA_WANT_DH_RFC7919_[0-9]*"
1246 scripts/config.py unset MBEDTLS_DHM_C
1247 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
1248 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
1249 else
1250 # When testing ECC and DH instead, we disable DHM and depending key
1251 # exchanges only in the accelerated build
1252 if [ "$driver_only" -eq 1 ]; then
1253 scripts/config.py unset MBEDTLS_DHM_C
1254 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
1255 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
1256 fi
1257 fi
1258
1259 # Restartable feature is not yet supported by PSA. Once it will in
1260 # the future, the following line could be removed (see issues
1261 # 6061, 6332 and following ones)
1262 scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
1263}
1264
1265# Common helper used by:
1266# - component_test_psa_crypto_config_accel_ecc_no_bignum
1267# - component_test_psa_crypto_config_accel_ecc_ffdh_no_bignum
1268#
1269# The goal is to build and test accelerating either:
1270# - ECC only or
1271# - both ECC and FFDH
1272#
1273# It is meant to be used in conjunction with
1274# common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum() for drivers
1275# coverage analysis in the "analyze_outcomes.py" script.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001276common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum () {
1277 test_target="$1"
1278
1279 # This is an internal helper to simplify text message handling
1280 if [ "$test_target" = "ECC_DH" ]; then
1281 accel_text="ECC/FFDH"
1282 removed_text="ECP - DH"
1283 else
1284 accel_text="ECC"
1285 removed_text="ECP"
1286 fi
1287
1288 msg "build: full + accelerated $accel_text algs + USE_PSA - $removed_text - BIGNUM"
1289
1290 # By default we accelerate all EC keys/algs
1291 loc_accel_list="ALG_ECDSA ALG_DETERMINISTIC_ECDSA \
1292 ALG_ECDH \
1293 ALG_JPAKE \
1294 $(helper_get_psa_key_type_list "ECC") \
1295 $(helper_get_psa_curve_list)"
1296 # Optionally we can also add DH to the list of accelerated items
1297 if [ "$test_target" = "ECC_DH" ]; then
1298 loc_accel_list="$loc_accel_list \
1299 ALG_FFDH \
1300 $(helper_get_psa_key_type_list "DH") \
1301 $(helper_get_psa_dh_group_list)"
1302 fi
1303
1304 # Configure
1305 # ---------
1306
1307 # Set common configurations between library's and driver's builds
1308 config_psa_crypto_config_accel_ecc_ffdh_no_bignum 1 "$test_target"
1309 # Disable all the builtin curves. All the required algs are accelerated.
1310 helper_disable_builtin_curves
1311
1312 # Build
1313 # -----
1314
1315 # Things we wanted supported in libtestdriver1, but not accelerated in the main library:
1316 # SHA-1 and all SHA-2/3 variants, as they are used by ECDSA deterministic.
1317 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1318 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1319
1320 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1321
1322 helper_libtestdriver1_make_main "$loc_accel_list"
1323
1324 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
1325 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
1326 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1327 not grep mbedtls_ecjpake_ ${BUILTIN_SRC_PATH}/ecjpake.o
1328 # Also ensure that ECP, RSA, [DHM] or BIGNUM modules were not re-enabled
1329 not grep mbedtls_ecp_ ${BUILTIN_SRC_PATH}/ecp.o
1330 not grep mbedtls_rsa_ ${BUILTIN_SRC_PATH}/rsa.o
1331 not grep mbedtls_mpi_ ${BUILTIN_SRC_PATH}/bignum.o
1332 not grep mbedtls_dhm_ ${BUILTIN_SRC_PATH}/dhm.o
1333
1334 # Run the tests
1335 # -------------
1336
1337 msg "test suites: full + accelerated $accel_text algs + USE_PSA - $removed_text - DHM - BIGNUM"
1338
1339 make test
1340
1341 msg "ssl-opt: full + accelerated $accel_text algs + USE_PSA - $removed_text - BIGNUM"
1342 tests/ssl-opt.sh
1343}
1344
1345# Common helper used by:
1346# - component_test_psa_crypto_config_reference_ecc_no_bignum
1347# - component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum
1348#
1349# The goal is to build and test a reference scenario (i.e. with builtin
1350# components) compared to the ones used in
1351# common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum() above.
1352#
1353# It is meant to be used in conjunction with
1354# common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum() for drivers'
1355# coverage analysis in "analyze_outcomes.py" script.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001356common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum () {
1357 test_target="$1"
1358
1359 # This is an internal helper to simplify text message handling
1360 if [ "$test_target" = "ECC_DH" ]; then
1361 accel_text="ECC/FFDH"
1362 else
1363 accel_text="ECC"
1364 fi
1365
1366 msg "build: full + non accelerated $accel_text algs + USE_PSA"
1367
1368 config_psa_crypto_config_accel_ecc_ffdh_no_bignum 0 "$test_target"
1369
1370 make
1371
1372 msg "test suites: full + non accelerated EC algs + USE_PSA"
1373 make test
1374
1375 msg "ssl-opt: full + non accelerated $accel_text algs + USE_PSA"
1376 tests/ssl-opt.sh
1377}
1378
1379component_test_psa_crypto_config_accel_ecc_no_bignum () {
1380 common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum "ECC"
1381}
1382
1383component_test_psa_crypto_config_reference_ecc_no_bignum () {
1384 common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum "ECC"
1385}
1386
1387component_test_psa_crypto_config_accel_ecc_ffdh_no_bignum () {
1388 common_test_psa_crypto_config_accel_ecc_ffdh_no_bignum "ECC_DH"
1389}
1390
1391component_test_psa_crypto_config_reference_ecc_ffdh_no_bignum () {
1392 common_test_psa_crypto_config_reference_ecc_ffdh_no_bignum "ECC_DH"
1393}
1394
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001395component_test_tfm_config_as_is () {
1396 msg "build: configs/config-tfm.h"
Minos Galanakis5da58e52024-11-07 15:35:33 +00001397 MBEDTLS_CONFIG="configs/config-tfm.h"
1398 CRYPTO_CONFIG="configs/ext/crypto_config_profile_medium.h"
Minos Galanakis4f619e12024-11-14 14:56:47 +00001399 CC=$ASAN_CC cmake -DMBEDTLS_CONFIG_FILE="$MBEDTLS_CONFIG" -DTF_PSA_CRYPTO_CONFIG_FILE="$CRYPTO_CONFIG" -D CMAKE_BUILD_TYPE:String=Asan .
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001400 make
1401
1402 msg "test: configs/config-tfm.h - unit tests"
1403 make test
1404}
1405
Minos Galanakis471b34c2024-07-26 15:39:24 +01001406# Helper for setting common configurations between:
1407# - component_test_tfm_config_p256m_driver_accel_ec()
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001408# - component_test_tfm_config_no_p256m()
Minos Galanakis471b34c2024-07-26 15:39:24 +01001409common_tfm_config () {
1410 # Enable TF-M config
1411 cp configs/config-tfm.h "$CONFIG_H"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001412 cp configs/ext/crypto_config_profile_medium.h "$CRYPTO_CONFIG_H"
1413
Minos Galanakis471b34c2024-07-26 15:39:24 +01001414 # Config adjustment for better test coverage in our environment.
1415 # This is not needed just to build and pass tests.
1416 #
1417 # Enable filesystem I/O for the benefit of PK parse/write tests.
Minos Galanakis5da58e52024-11-07 15:35:33 +00001418 sed -i '/PROFILE_M_PSA_CRYPTO_CONFIG_H/i #define MBEDTLS_FS_IO' "$CRYPTO_CONFIG_H"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001419}
1420
1421# Keep this in sync with component_test_tfm_config() as they are both meant
1422# to be used in analyze_outcomes.py for driver's coverage analysis.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001423component_test_tfm_config_p256m_driver_accel_ec () {
1424 msg "build: TF-M config + p256m driver + accel ECDH(E)/ECDSA"
1425
1426 common_tfm_config
1427
1428 # Build crypto library
David Horstmann5b93d972024-10-31 15:36:05 +00001429 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS -I../framework/tests/include/spe" LDFLAGS="$ASAN_CFLAGS"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001430
1431 # Make sure any built-in EC alg was not re-enabled by accident (additive config)
1432 not grep mbedtls_ecdsa_ ${BUILTIN_SRC_PATH}/ecdsa.o
1433 not grep mbedtls_ecdh_ ${BUILTIN_SRC_PATH}/ecdh.o
1434 not grep mbedtls_ecjpake_ ${BUILTIN_SRC_PATH}/ecjpake.o
1435 # Also ensure that ECP, RSA, DHM or BIGNUM modules were not re-enabled
1436 not grep mbedtls_ecp_ ${BUILTIN_SRC_PATH}/ecp.o
1437 not grep mbedtls_rsa_ ${BUILTIN_SRC_PATH}/rsa.o
1438 not grep mbedtls_dhm_ ${BUILTIN_SRC_PATH}/dhm.o
1439 not grep mbedtls_mpi_ ${BUILTIN_SRC_PATH}/bignum.o
1440 # Check that p256m was built
1441 grep -q p256_ecdsa_ library/libmbedcrypto.a
1442
1443 # In "config-tfm.h" we disabled CIPHER_C tweaking TF-M's configuration
1444 # files, so we want to ensure that it has not be re-enabled accidentally.
1445 not grep mbedtls_cipher ${BUILTIN_SRC_PATH}/cipher.o
1446
1447 # Run the tests
1448 msg "test: TF-M config + p256m driver + accel ECDH(E)/ECDSA"
1449 make test
1450}
1451
1452# Keep this in sync with component_test_tfm_config_p256m_driver_accel_ec() as
1453# they are both meant to be used in analyze_outcomes.py for driver's coverage
1454# analysis.
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001455component_test_tfm_config_no_p256m () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001456 common_tfm_config
1457
1458 # Disable P256M driver, which is on by default, so that analyze_outcomes
1459 # can compare this test with test_tfm_config_p256m_driver_accel_ec
Minos Galanakis5da58e52024-11-07 15:35:33 +00001460 sed -i '/PROFILE_M_PSA_CRYPTO_CONFIG_H/i #undef MBEDTLS_PSA_P256M_DRIVER_ENABLED' "$CRYPTO_CONFIG_H"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001461
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001462 msg "build: TF-M config without p256m"
David Horstmann5b93d972024-10-31 15:36:05 +00001463 make CFLAGS='-Werror -Wall -Wextra -I../framework/tests/include/spe' tests
Minos Galanakis471b34c2024-07-26 15:39:24 +01001464
1465 # Check that p256m was not built
1466 not grep p256_ecdsa_ library/libmbedcrypto.a
1467
1468 # In "config-tfm.h" we disabled CIPHER_C tweaking TF-M's configuration
1469 # files, so we want to ensure that it has not be re-enabled accidentally.
1470 not grep mbedtls_cipher ${BUILTIN_SRC_PATH}/cipher.o
1471
Gilles Peskineeffa6a02024-09-14 11:35:36 +02001472 msg "test: TF-M config without p256m"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001473 make test
1474}
1475
Minos Galanakis471b34c2024-07-26 15:39:24 +01001476# This is an helper used by:
1477# - component_test_psa_ecc_key_pair_no_derive
1478# - component_test_psa_ecc_key_pair_no_generate
1479# The goal is to test with all PSA_WANT_KEY_TYPE_xxx_KEY_PAIR_yyy symbols
1480# enabled, but one. Input arguments are as follows:
Gilles Peskinefef912c2024-09-20 16:07:09 +02001481# - $1 is the configuration to start from
1482# - $2 is the key type under test, i.e. ECC/RSA/DH
1483# - $3 is the key option to be unset (i.e. generate, derive, etc)
Minos Galanakisf78447f2024-07-26 20:49:51 +01001484build_and_test_psa_want_key_pair_partial () {
Gilles Peskinefef912c2024-09-20 16:07:09 +02001485 base_config=$1
1486 key_type=$2
1487 unset_option=$3
Minos Galanakis471b34c2024-07-26 15:39:24 +01001488 disabled_psa_want="PSA_WANT_KEY_TYPE_${key_type}_KEY_PAIR_${unset_option}"
1489
Gilles Peskinefef912c2024-09-20 16:07:09 +02001490 msg "build: $base_config - ${disabled_psa_want}"
1491 scripts/config.py "$base_config"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001492
1493 # All the PSA_WANT_KEY_TYPE_xxx_KEY_PAIR_yyy are enabled by default in
1494 # crypto_config.h so we just disable the one we don't want.
1495 scripts/config.py -f "$CRYPTO_CONFIG_H" unset "$disabled_psa_want"
1496
1497 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
1498
Gilles Peskinefef912c2024-09-20 16:07:09 +02001499 msg "test: $base_config - ${disabled_psa_want}"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001500 make test
1501}
1502
Minos Galanakisf78447f2024-07-26 20:49:51 +01001503component_test_psa_ecc_key_pair_no_derive () {
Gilles Peskinefef912c2024-09-20 16:07:09 +02001504 build_and_test_psa_want_key_pair_partial full "ECC" "DERIVE"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001505}
1506
Minos Galanakisf78447f2024-07-26 20:49:51 +01001507component_test_psa_ecc_key_pair_no_generate () {
Gilles Peskinefef912c2024-09-20 16:07:09 +02001508 # TLS needs ECC key generation whenever ephemeral ECDH is enabled.
1509 # We don't have proper guards for configurations with ECC key generation
1510 # disabled (https://github.com/Mbed-TLS/mbedtls/issues/9481). Until
1511 # then (if ever), just test the crypto part of the library.
1512 build_and_test_psa_want_key_pair_partial crypto_full "ECC" "GENERATE"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001513}
1514
1515config_psa_crypto_accel_rsa () {
1516 driver_only=$1
1517
1518 # Start from crypto_full config (no X.509, no TLS)
1519 helper_libtestdriver1_adjust_config "crypto_full"
1520
1521 if [ "$driver_only" -eq 1 ]; then
1522 # Remove RSA support and its dependencies
1523 scripts/config.py unset MBEDTLS_RSA_C
1524 scripts/config.py unset MBEDTLS_PKCS1_V15
1525 scripts/config.py unset MBEDTLS_PKCS1_V21
1526
1527 # We need PEM parsing in the test library as well to support the import
1528 # of PEM encoded RSA keys.
Minos Galanakis23452f52024-11-28 17:48:14 +00001529 scripts/config.py -c "$CONFIG_TEST_DRIVER_H" set MBEDTLS_PEM_PARSE_C
1530 scripts/config.py -c "$CONFIG_TEST_DRIVER_H" set MBEDTLS_BASE64_C
Minos Galanakis471b34c2024-07-26 15:39:24 +01001531 fi
1532}
1533
1534component_test_psa_crypto_config_accel_rsa_crypto () {
1535 msg "build: crypto_full with accelerated RSA"
1536
1537 loc_accel_list="ALG_RSA_OAEP ALG_RSA_PSS \
1538 ALG_RSA_PKCS1V15_CRYPT ALG_RSA_PKCS1V15_SIGN \
1539 KEY_TYPE_RSA_PUBLIC_KEY \
1540 KEY_TYPE_RSA_KEY_PAIR_BASIC \
1541 KEY_TYPE_RSA_KEY_PAIR_GENERATE \
1542 KEY_TYPE_RSA_KEY_PAIR_IMPORT \
1543 KEY_TYPE_RSA_KEY_PAIR_EXPORT"
1544
1545 # Configure
1546 # ---------
1547
1548 config_psa_crypto_accel_rsa 1
1549
1550 # Build
1551 # -----
1552
1553 # These hashes are needed for unit tests.
1554 loc_extra_list="ALG_SHA_1 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1555 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512 ALG_MD5"
1556 helper_libtestdriver1_make_drivers "$loc_accel_list" "$loc_extra_list"
1557
1558 helper_libtestdriver1_make_main "$loc_accel_list"
1559
1560 # Make sure this was not re-enabled by accident (additive config)
1561 not grep mbedtls_rsa ${BUILTIN_SRC_PATH}/rsa.o
1562
1563 # Run the tests
1564 # -------------
1565
1566 msg "test: crypto_full with accelerated RSA"
1567 make test
1568}
1569
1570component_test_psa_crypto_config_reference_rsa_crypto () {
1571 msg "build: crypto_full with non-accelerated RSA"
1572
1573 # Configure
1574 # ---------
1575 config_psa_crypto_accel_rsa 0
1576
1577 # Build
1578 # -----
1579 make
1580
1581 # Run the tests
1582 # -------------
1583 msg "test: crypto_full with non-accelerated RSA"
1584 make test
1585}
1586
1587# This is a temporary test to verify that full RSA support is present even when
1588# only one single new symbols (PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) is defined.
Minos Galanakisf78447f2024-07-26 20:49:51 +01001589component_test_new_psa_want_key_pair_symbol () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001590 msg "Build: crypto config - MBEDTLS_RSA_C + PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC"
1591
1592 # Create a temporary output file unless there is already one set
1593 if [ "$MBEDTLS_TEST_OUTCOME_FILE" ]; then
1594 REMOVE_OUTCOME_ON_EXIT="no"
1595 else
1596 REMOVE_OUTCOME_ON_EXIT="yes"
1597 MBEDTLS_TEST_OUTCOME_FILE="$PWD/out.csv"
1598 export MBEDTLS_TEST_OUTCOME_FILE
1599 fi
1600
1601 # Start from crypto configuration
1602 scripts/config.py crypto
1603
1604 # Remove RSA support and its dependencies
1605 scripts/config.py unset MBEDTLS_PKCS1_V15
1606 scripts/config.py unset MBEDTLS_PKCS1_V21
1607 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
1608 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
1609 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
Minos Galanakis471b34c2024-07-26 15:39:24 +01001610 scripts/config.py unset MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
1611 scripts/config.py unset MBEDTLS_RSA_C
1612 scripts/config.py unset MBEDTLS_X509_RSASSA_PSS_SUPPORT
1613
Minos Galanakis471b34c2024-07-26 15:39:24 +01001614 # Keep only PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC enabled in order to ensure
1615 # that proper translations is done in crypto_legacy.h.
1616 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
1617 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT
1618 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
1619
1620 make
1621
1622 msg "Test: crypto config - MBEDTLS_RSA_C + PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC"
1623 make test
1624
1625 # Parse only 1 relevant line from the outcome file, i.e. a test which is
1626 # performing RSA signature.
1627 msg "Verify that 'RSA PKCS1 Sign #1 (SHA512, 1536 bits RSA)' is PASS"
1628 cat $MBEDTLS_TEST_OUTCOME_FILE | grep 'RSA PKCS1 Sign #1 (SHA512, 1536 bits RSA)' | grep -q "PASS"
1629
1630 if [ "$REMOVE_OUTCOME_ON_EXIT" == "yes" ]; then
1631 rm $MBEDTLS_TEST_OUTCOME_FILE
1632 fi
1633}
1634
1635component_test_psa_crypto_config_accel_hash () {
Ronald Cron93ba6252024-09-05 10:37:14 +02001636 msg "test: accelerated hash"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001637
1638 loc_accel_list="ALG_MD5 ALG_RIPEMD160 ALG_SHA_1 \
1639 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1640 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1641
1642 # Configure
1643 # ---------
1644
1645 # Start from default config (no USE_PSA)
1646 helper_libtestdriver1_adjust_config "default"
1647
1648 # Disable the things that are being accelerated
1649 scripts/config.py unset MBEDTLS_MD5_C
1650 scripts/config.py unset MBEDTLS_RIPEMD160_C
1651 scripts/config.py unset MBEDTLS_SHA1_C
1652 scripts/config.py unset MBEDTLS_SHA224_C
1653 scripts/config.py unset MBEDTLS_SHA256_C
1654 scripts/config.py unset MBEDTLS_SHA384_C
1655 scripts/config.py unset MBEDTLS_SHA512_C
1656 scripts/config.py unset MBEDTLS_SHA3_C
1657
1658 # Build
1659 # -----
1660
1661 helper_libtestdriver1_make_drivers "$loc_accel_list"
1662
1663 helper_libtestdriver1_make_main "$loc_accel_list"
1664
1665 # There's a risk of something getting re-enabled via config_psa.h;
1666 # make sure it did not happen. Note: it's OK for MD_C to be enabled.
1667 not grep mbedtls_md5 ${BUILTIN_SRC_PATH}/md5.o
1668 not grep mbedtls_sha1 ${BUILTIN_SRC_PATH}/sha1.o
1669 not grep mbedtls_sha256 ${BUILTIN_SRC_PATH}/sha256.o
1670 not grep mbedtls_sha512 ${BUILTIN_SRC_PATH}/sha512.o
1671 not grep mbedtls_ripemd160 ${BUILTIN_SRC_PATH}/ripemd160.o
1672
1673 # Run the tests
1674 # -------------
1675
Ronald Cron93ba6252024-09-05 10:37:14 +02001676 msg "test: accelerated hash"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001677 make test
1678}
1679
1680# Auxiliary function to build config for hashes with and without drivers
Minos Galanakis471b34c2024-07-26 15:39:24 +01001681config_psa_crypto_hash_use_psa () {
1682 driver_only="$1"
1683 # start with config full for maximum coverage (also enables USE_PSA)
1684 helper_libtestdriver1_adjust_config "full"
1685 if [ "$driver_only" -eq 1 ]; then
1686 # disable the built-in implementation of hashes
1687 scripts/config.py unset MBEDTLS_MD5_C
1688 scripts/config.py unset MBEDTLS_RIPEMD160_C
1689 scripts/config.py unset MBEDTLS_SHA1_C
1690 scripts/config.py unset MBEDTLS_SHA224_C
1691 scripts/config.py unset MBEDTLS_SHA256_C # see external RNG below
1692 scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
1693 scripts/config.py unset MBEDTLS_SHA384_C
1694 scripts/config.py unset MBEDTLS_SHA512_C
1695 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
1696 scripts/config.py unset MBEDTLS_SHA3_C
1697 fi
1698}
1699
1700# Note that component_test_psa_crypto_config_reference_hash_use_psa
1701# is related to this component and both components need to be kept in sync.
1702# For details please see comments for component_test_psa_crypto_config_reference_hash_use_psa.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001703component_test_psa_crypto_config_accel_hash_use_psa () {
1704 msg "test: full with accelerated hashes"
1705
1706 loc_accel_list="ALG_MD5 ALG_RIPEMD160 ALG_SHA_1 \
1707 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1708 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1709
1710 # Configure
1711 # ---------
1712
1713 config_psa_crypto_hash_use_psa 1
1714
1715 # Build
1716 # -----
1717
1718 helper_libtestdriver1_make_drivers "$loc_accel_list"
1719
1720 helper_libtestdriver1_make_main "$loc_accel_list"
1721
1722 # There's a risk of something getting re-enabled via config_psa.h;
1723 # make sure it did not happen. Note: it's OK for MD_C to be enabled.
1724 not grep mbedtls_md5 ${BUILTIN_SRC_PATH}/md5.o
1725 not grep mbedtls_sha1 ${BUILTIN_SRC_PATH}/sha1.o
1726 not grep mbedtls_sha256 ${BUILTIN_SRC_PATH}/sha256.o
1727 not grep mbedtls_sha512 ${BUILTIN_SRC_PATH}/sha512.o
1728 not grep mbedtls_ripemd160 ${BUILTIN_SRC_PATH}/ripemd160.o
1729
1730 # Run the tests
1731 # -------------
1732
1733 msg "test: full with accelerated hashes"
1734 make test
1735
1736 # This is mostly useful so that we can later compare outcome files with
1737 # the reference config in analyze_outcomes.py, to check that the
1738 # dependency declarations in ssl-opt.sh and in TLS code are correct.
1739 msg "test: ssl-opt.sh, full with accelerated hashes"
1740 tests/ssl-opt.sh
1741
1742 # This is to make sure all ciphersuites are exercised, but we don't need
1743 # interop testing (besides, we already got some from ssl-opt.sh).
1744 msg "test: compat.sh, full with accelerated hashes"
1745 tests/compat.sh -p mbedTLS -V YES
1746}
1747
1748# This component provides reference configuration for test_psa_crypto_config_accel_hash_use_psa
1749# without accelerated hash. The outcome from both components are used by the analyze_outcomes.py
1750# script to find regression in test coverage when accelerated hash is used (tests and ssl-opt).
1751# Both components need to be kept in sync.
Minos Galanakisf78447f2024-07-26 20:49:51 +01001752component_test_psa_crypto_config_reference_hash_use_psa () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001753 msg "test: full without accelerated hashes"
1754
1755 config_psa_crypto_hash_use_psa 0
1756
1757 make
1758
1759 msg "test: full without accelerated hashes"
1760 make test
1761
1762 msg "test: ssl-opt.sh, full without accelerated hashes"
1763 tests/ssl-opt.sh
1764}
1765
1766# Auxiliary function to build config for hashes with and without drivers
Minos Galanakis471b34c2024-07-26 15:39:24 +01001767config_psa_crypto_hmac_use_psa () {
1768 driver_only="$1"
1769 # start with config full for maximum coverage (also enables USE_PSA)
1770 helper_libtestdriver1_adjust_config "full"
1771
1772 if [ "$driver_only" -eq 1 ]; then
1773 # Disable MD_C in order to disable the builtin support for HMAC. MD_LIGHT
1774 # is still enabled though (for ENTROPY_C among others).
1775 scripts/config.py unset MBEDTLS_MD_C
1776 # Disable also the builtin hashes since they are supported by the driver
1777 # and MD module is able to perform PSA dispathing.
1778 scripts/config.py unset-all MBEDTLS_SHA
1779 scripts/config.py unset MBEDTLS_MD5_C
1780 scripts/config.py unset MBEDTLS_RIPEMD160_C
1781 fi
1782
1783 # Direct dependencies of MD_C. We disable them also in the reference
1784 # component to work with the same set of features.
1785 scripts/config.py unset MBEDTLS_PKCS7_C
1786 scripts/config.py unset MBEDTLS_PKCS5_C
1787 scripts/config.py unset MBEDTLS_HMAC_DRBG_C
1788 scripts/config.py unset MBEDTLS_HKDF_C
1789 # Dependencies of HMAC_DRBG
1790 scripts/config.py unset MBEDTLS_ECDSA_DETERMINISTIC
1791 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_DETERMINISTIC_ECDSA
1792}
1793
Minos Galanakisf78447f2024-07-26 20:49:51 +01001794component_test_psa_crypto_config_accel_hmac () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001795 msg "test: full with accelerated hmac"
1796
1797 loc_accel_list="ALG_HMAC KEY_TYPE_HMAC \
1798 ALG_MD5 ALG_RIPEMD160 ALG_SHA_1 \
1799 ALG_SHA_224 ALG_SHA_256 ALG_SHA_384 ALG_SHA_512 \
1800 ALG_SHA3_224 ALG_SHA3_256 ALG_SHA3_384 ALG_SHA3_512"
1801
1802 # Configure
1803 # ---------
1804
1805 config_psa_crypto_hmac_use_psa 1
1806
1807 # Build
1808 # -----
1809
1810 helper_libtestdriver1_make_drivers "$loc_accel_list"
1811
1812 helper_libtestdriver1_make_main "$loc_accel_list"
1813
1814 # Ensure that built-in support for HMAC is disabled.
1815 not grep mbedtls_md_hmac ${BUILTIN_SRC_PATH}/md.o
1816
1817 # Run the tests
1818 # -------------
1819
1820 msg "test: full with accelerated hmac"
1821 make test
1822}
1823
Minos Galanakisf78447f2024-07-26 20:49:51 +01001824component_test_psa_crypto_config_reference_hmac () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001825 msg "test: full without accelerated hmac"
1826
1827 config_psa_crypto_hmac_use_psa 0
1828
1829 make
1830
1831 msg "test: full without accelerated hmac"
1832 make test
1833}
1834
1835component_test_psa_crypto_config_accel_des () {
Ronald Cron93ba6252024-09-05 10:37:14 +02001836 msg "test: accelerated DES"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001837
1838 # Albeit this components aims at accelerating DES which should only support
1839 # CBC and ECB modes, we need to accelerate more than that otherwise DES_C
1840 # would automatically be re-enabled by "config_adjust_legacy_from_psa.c"
1841 loc_accel_list="ALG_ECB_NO_PADDING ALG_CBC_NO_PADDING ALG_CBC_PKCS7 \
1842 ALG_CTR ALG_CFB ALG_OFB ALG_XTS ALG_CMAC \
1843 KEY_TYPE_DES"
1844
1845 # Note: we cannot accelerate all ciphers' key types otherwise we would also
1846 # have to either disable CCM/GCM or accelerate them, but that's out of scope
1847 # of this component. This limitation will be addressed by #8598.
1848
1849 # Configure
1850 # ---------
1851
1852 # Start from the full config
1853 helper_libtestdriver1_adjust_config "full"
1854
1855 # Disable the things that are being accelerated
1856 scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
1857 scripts/config.py unset MBEDTLS_CIPHER_PADDING_PKCS7
1858 scripts/config.py unset MBEDTLS_CIPHER_MODE_CTR
1859 scripts/config.py unset MBEDTLS_CIPHER_MODE_CFB
1860 scripts/config.py unset MBEDTLS_CIPHER_MODE_OFB
1861 scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
1862 scripts/config.py unset MBEDTLS_DES_C
1863 scripts/config.py unset MBEDTLS_CMAC_C
1864
1865 # Build
1866 # -----
1867
1868 helper_libtestdriver1_make_drivers "$loc_accel_list"
1869
1870 helper_libtestdriver1_make_main "$loc_accel_list"
1871
1872 # Make sure this was not re-enabled by accident (additive config)
Gilles Peskine29e86ca2024-06-19 15:09:27 +02001873 not grep mbedtls_des ${BUILTIN_SRC_PATH}/des.o
Minos Galanakis471b34c2024-07-26 15:39:24 +01001874
1875 # Run the tests
1876 # -------------
1877
Ronald Cron93ba6252024-09-05 10:37:14 +02001878 msg "test: accelerated DES"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001879 make test
1880}
1881
1882component_test_psa_crypto_config_accel_aead () {
Ronald Cron93ba6252024-09-05 10:37:14 +02001883 msg "test: accelerated AEAD"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001884
1885 loc_accel_list="ALG_GCM ALG_CCM ALG_CHACHA20_POLY1305 \
1886 KEY_TYPE_AES KEY_TYPE_CHACHA20 KEY_TYPE_ARIA KEY_TYPE_CAMELLIA"
1887
1888 # Configure
1889 # ---------
1890
1891 # Start from full config
1892 helper_libtestdriver1_adjust_config "full"
1893
1894 # Disable things that are being accelerated
1895 scripts/config.py unset MBEDTLS_GCM_C
1896 scripts/config.py unset MBEDTLS_CCM_C
1897 scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1898
1899 # Disable CCM_STAR_NO_TAG because this re-enables CCM_C.
1900 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM_STAR_NO_TAG
1901
1902 # Build
1903 # -----
1904
1905 helper_libtestdriver1_make_drivers "$loc_accel_list"
1906
1907 helper_libtestdriver1_make_main "$loc_accel_list"
1908
1909 # Make sure this was not re-enabled by accident (additive config)
1910 not grep mbedtls_ccm ${BUILTIN_SRC_PATH}/ccm.o
1911 not grep mbedtls_gcm ${BUILTIN_SRC_PATH}/gcm.o
1912 not grep mbedtls_chachapoly ${BUILTIN_SRC_PATH}/chachapoly.o
1913
1914 # Run the tests
1915 # -------------
1916
Ronald Cron93ba6252024-09-05 10:37:14 +02001917 msg "test: accelerated AEAD"
Minos Galanakis471b34c2024-07-26 15:39:24 +01001918 make test
1919}
1920
1921# This is a common configuration function used in:
1922# - component_test_psa_crypto_config_accel_cipher_aead_cmac
1923# - component_test_psa_crypto_config_reference_cipher_aead_cmac
Minos Galanakisf78447f2024-07-26 20:49:51 +01001924common_psa_crypto_config_accel_cipher_aead_cmac () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01001925 # Start from the full config
1926 helper_libtestdriver1_adjust_config "full"
1927
1928 scripts/config.py unset MBEDTLS_NIST_KW_C
1929}
1930
1931# The 2 following test components, i.e.
1932# - component_test_psa_crypto_config_accel_cipher_aead_cmac
1933# - component_test_psa_crypto_config_reference_cipher_aead_cmac
1934# are meant to be used together in analyze_outcomes.py script in order to test
1935# driver's coverage for ciphers and AEADs.
Minos Galanakis471b34c2024-07-26 15:39:24 +01001936component_test_psa_crypto_config_accel_cipher_aead_cmac () {
1937 msg "build: full config with accelerated cipher inc. AEAD and CMAC"
1938
1939 loc_accel_list="ALG_ECB_NO_PADDING ALG_CBC_NO_PADDING ALG_CBC_PKCS7 ALG_CTR ALG_CFB \
1940 ALG_OFB ALG_XTS ALG_STREAM_CIPHER ALG_CCM_STAR_NO_TAG \
1941 ALG_GCM ALG_CCM ALG_CHACHA20_POLY1305 ALG_CMAC \
1942 KEY_TYPE_DES KEY_TYPE_AES KEY_TYPE_ARIA KEY_TYPE_CHACHA20 KEY_TYPE_CAMELLIA"
1943
1944 # Configure
1945 # ---------
1946
1947 common_psa_crypto_config_accel_cipher_aead_cmac
1948
1949 # Disable the things that are being accelerated
1950 scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
1951 scripts/config.py unset MBEDTLS_CIPHER_PADDING_PKCS7
1952 scripts/config.py unset MBEDTLS_CIPHER_MODE_CTR
1953 scripts/config.py unset MBEDTLS_CIPHER_MODE_CFB
1954 scripts/config.py unset MBEDTLS_CIPHER_MODE_OFB
1955 scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
1956 scripts/config.py unset MBEDTLS_GCM_C
1957 scripts/config.py unset MBEDTLS_CCM_C
1958 scripts/config.py unset MBEDTLS_CHACHAPOLY_C
1959 scripts/config.py unset MBEDTLS_CMAC_C
1960 scripts/config.py unset MBEDTLS_DES_C
1961 scripts/config.py unset MBEDTLS_AES_C
1962 scripts/config.py unset MBEDTLS_ARIA_C
1963 scripts/config.py unset MBEDTLS_CHACHA20_C
1964 scripts/config.py unset MBEDTLS_CAMELLIA_C
1965
1966 # Disable CIPHER_C entirely as all ciphers/AEADs are accelerated and PSA
1967 # does not depend on it.
1968 scripts/config.py unset MBEDTLS_CIPHER_C
1969
1970 # Build
1971 # -----
1972
1973 helper_libtestdriver1_make_drivers "$loc_accel_list"
1974
1975 helper_libtestdriver1_make_main "$loc_accel_list"
1976
1977 # Make sure this was not re-enabled by accident (additive config)
1978 not grep mbedtls_cipher ${BUILTIN_SRC_PATH}/cipher.o
1979 not grep mbedtls_des ${BUILTIN_SRC_PATH}/des.o
1980 not grep mbedtls_aes ${BUILTIN_SRC_PATH}/aes.o
1981 not grep mbedtls_aria ${BUILTIN_SRC_PATH}/aria.o
1982 not grep mbedtls_camellia ${BUILTIN_SRC_PATH}/camellia.o
1983 not grep mbedtls_ccm ${BUILTIN_SRC_PATH}/ccm.o
1984 not grep mbedtls_gcm ${BUILTIN_SRC_PATH}/gcm.o
1985 not grep mbedtls_chachapoly ${BUILTIN_SRC_PATH}/chachapoly.o
1986 not grep mbedtls_cmac ${BUILTIN_SRC_PATH}/cmac.o
1987
1988 # Run the tests
1989 # -------------
1990
1991 msg "test: full config with accelerated cipher inc. AEAD and CMAC"
1992 make test
1993
1994 msg "ssl-opt: full config with accelerated cipher inc. AEAD and CMAC"
1995 tests/ssl-opt.sh
1996
1997 msg "compat.sh: full config with accelerated cipher inc. AEAD and CMAC"
1998 tests/compat.sh -V NO -p mbedTLS
1999}
2000
2001component_test_psa_crypto_config_reference_cipher_aead_cmac () {
2002 msg "build: full config with non-accelerated cipher inc. AEAD and CMAC"
2003 common_psa_crypto_config_accel_cipher_aead_cmac
2004
2005 make
2006
2007 msg "test: full config with non-accelerated cipher inc. AEAD and CMAC"
2008 make test
2009
2010 msg "ssl-opt: full config with non-accelerated cipher inc. AEAD and CMAC"
2011 tests/ssl-opt.sh
2012
2013 msg "compat.sh: full config with non-accelerated cipher inc. AEAD and CMAC"
2014 tests/compat.sh -V NO -p mbedTLS
2015}
2016
Minos Galanakisf78447f2024-07-26 20:49:51 +01002017common_block_cipher_dispatch () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002018 TEST_WITH_DRIVER="$1"
2019
2020 # Start from the full config
2021 helper_libtestdriver1_adjust_config "full"
2022
2023 if [ "$TEST_WITH_DRIVER" -eq 1 ]; then
2024 # Disable key types that are accelerated (there is no legacy equivalent
2025 # symbol for ECB)
2026 scripts/config.py unset MBEDTLS_AES_C
2027 scripts/config.py unset MBEDTLS_ARIA_C
2028 scripts/config.py unset MBEDTLS_CAMELLIA_C
2029 fi
2030
2031 # Disable cipher's modes that, when not accelerated, cause
2032 # legacy key types to be re-enabled in "config_adjust_legacy_from_psa.h".
2033 # Keep this also in the reference component in order to skip the same tests
2034 # that were skipped in the accelerated one.
2035 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CTR
2036 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CFB
2037 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_OFB
2038 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING
2039 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7
2040 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CMAC
2041 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CCM_STAR_NO_TAG
2042 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
2043
2044 # Disable direct dependency on AES_C
2045 scripts/config.py unset MBEDTLS_NIST_KW_C
2046
2047 # Prevent the cipher module from using deprecated PSA path. The reason is
2048 # that otherwise there will be tests relying on "aes_info" (defined in
2049 # "cipher_wrap.c") whose functions are not available when AES_C is
2050 # not defined. ARIA and Camellia are not a problem in this case because
2051 # the PSA path is not tested for these key types.
2052 scripts/config.py set MBEDTLS_DEPRECATED_REMOVED
2053}
2054
Gilles Peskinea9dda7e2024-06-21 11:25:01 +02002055component_test_full_block_cipher_psa_dispatch_static_keystore () {
2056 msg "build: full + PSA dispatch in block_cipher with static keystore"
2057 # Check that the static key store works well when CTR_DRBG uses a
2058 # PSA key for AES.
2059 scripts/config.py unset MBEDTLS_PSA_KEY_STORE_DYNAMIC
2060
2061 loc_accel_list="ALG_ECB_NO_PADDING \
2062 KEY_TYPE_AES KEY_TYPE_ARIA KEY_TYPE_CAMELLIA"
2063
2064 # Configure
2065 # ---------
2066
2067 common_block_cipher_dispatch 1
2068
2069 # Build
2070 # -----
2071
2072 helper_libtestdriver1_make_drivers "$loc_accel_list"
2073
2074 helper_libtestdriver1_make_main "$loc_accel_list"
2075
2076 # Make sure disabled components were not re-enabled by accident (additive
2077 # config)
2078 not grep mbedtls_aes_ library/aes.o
2079 not grep mbedtls_aria_ library/aria.o
2080 not grep mbedtls_camellia_ library/camellia.o
2081
2082 # Run the tests
2083 # -------------
2084
2085 msg "test: full + PSA dispatch in block_cipher with static keystore"
2086 make test
2087}
2088
Minos Galanakis471b34c2024-07-26 15:39:24 +01002089component_test_full_block_cipher_psa_dispatch () {
2090 msg "build: full + PSA dispatch in block_cipher"
2091
2092 loc_accel_list="ALG_ECB_NO_PADDING \
2093 KEY_TYPE_AES KEY_TYPE_ARIA KEY_TYPE_CAMELLIA"
2094
2095 # Configure
2096 # ---------
2097
2098 common_block_cipher_dispatch 1
2099
2100 # Build
2101 # -----
2102
2103 helper_libtestdriver1_make_drivers "$loc_accel_list"
2104
2105 helper_libtestdriver1_make_main "$loc_accel_list"
2106
2107 # Make sure disabled components were not re-enabled by accident (additive
2108 # config)
2109 not grep mbedtls_aes_ ${BUILTIN_SRC_PATH}/aes.o
2110 not grep mbedtls_aria_ ${BUILTIN_SRC_PATH}/aria.o
2111 not grep mbedtls_camellia_ ${BUILTIN_SRC_PATH}/camellia.o
2112
2113 # Run the tests
2114 # -------------
2115
2116 msg "test: full + PSA dispatch in block_cipher"
2117 make test
2118}
2119
2120# This is the reference component of component_test_full_block_cipher_psa_dispatch
Minos Galanakis471b34c2024-07-26 15:39:24 +01002121component_test_full_block_cipher_legacy_dispatch () {
2122 msg "build: full + legacy dispatch in block_cipher"
2123
2124 common_block_cipher_dispatch 0
2125
2126 make
2127
2128 msg "test: full + legacy dispatch in block_cipher"
2129 make test
2130}
2131
Minos Galanakisf78447f2024-07-26 20:49:51 +01002132component_test_aead_chachapoly_disabled () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002133 msg "build: full minus CHACHAPOLY"
2134 scripts/config.py full
2135 scripts/config.py unset MBEDTLS_CHACHAPOLY_C
2136 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CHACHA20_POLY1305
2137 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
2138
2139 msg "test: full minus CHACHAPOLY"
2140 make test
2141}
2142
Minos Galanakisf78447f2024-07-26 20:49:51 +01002143component_test_aead_only_ccm () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002144 msg "build: full minus CHACHAPOLY and GCM"
2145 scripts/config.py full
2146 scripts/config.py unset MBEDTLS_CHACHAPOLY_C
2147 scripts/config.py unset MBEDTLS_GCM_C
2148 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CHACHA20_POLY1305
2149 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_GCM
2150 make CC=$ASAN_CC CFLAGS="$ASAN_CFLAGS" LDFLAGS="$ASAN_CFLAGS"
2151
2152 msg "test: full minus CHACHAPOLY and GCM"
2153 make test
2154}
2155
Minos Galanakisf78447f2024-07-26 20:49:51 +01002156component_test_ccm_aes_sha256 () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002157 msg "build: CCM + AES + SHA256 configuration"
2158
Minos Galanakisa17ffc72024-12-02 23:57:30 +00002159 # Setting a blank config disables everyhing in the library side.
2160 echo '#define MBEDTLS_CONFIG_H ' >"$CONFIG_H"
Ronald Cron9d262d72024-12-06 17:41:26 +01002161 cp configs/crypto-config-ccm-aes-sha256.h "$CRYPTO_CONFIG_H"
2162
Minos Galanakis471b34c2024-07-26 15:39:24 +01002163 make
Minos Galanakis471b34c2024-07-26 15:39:24 +01002164 msg "test: CCM + AES + SHA256 configuration"
2165 make test
2166}
2167
2168# Test that the given .o file builds with all (valid) combinations of the given options.
2169#
2170# Syntax: build_test_config_combos FILE VALIDATOR_FUNCTION OPT1 OPT2 ...
2171#
2172# The validator function is the name of a function to validate the combination of options.
2173# It may be "" if all combinations are valid.
2174# It receives a string containing a combination of options, as passed to the compiler,
2175# e.g. "-DOPT1 -DOPT2 ...". It must return 0 iff the combination is valid, non-zero if invalid.
Minos Galanakisf78447f2024-07-26 20:49:51 +01002176build_test_config_combos () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002177 file=$1
2178 shift
2179 validate_options=$1
2180 shift
2181 options=("$@")
2182
2183 # clear all of the options so that they can be overridden on the clang commandline
2184 for opt in "${options[@]}"; do
2185 ./scripts/config.py unset ${opt}
2186 done
2187
2188 # enter the library directory
2189 cd library
2190
2191 # The most common issue is unused variables/functions, so ensure -Wunused is set.
2192 warning_flags="-Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused"
2193
2194 # Extract the command generated by the Makefile to build the target file.
2195 # This ensures that we have any include paths, macro definitions, etc
2196 # that may be applied by make.
2197 # Add -fsyntax-only as we only want a syntax check and don't need to generate a file.
2198 compile_cmd="clang \$(LOCAL_CFLAGS) ${warning_flags} -fsyntax-only -c"
2199
2200 makefile=$(TMPDIR=. mktemp)
2201 deps=""
2202
2203 len=${#options[@]}
2204 source_file=../${file%.o}.c
2205
2206 targets=0
2207 echo 'include Makefile' >${makefile}
2208
2209 for ((i = 0; i < $((2**${len})); i++)); do
2210 # generate each of 2^n combinations of options
2211 # each bit of $i is used to determine if options[i] will be set or not
2212 target="t"
2213 clang_args=""
2214 for ((j = 0; j < ${len}; j++)); do
2215 if (((i >> j) & 1)); then
2216 opt=-D${options[$j]}
2217 clang_args="${clang_args} ${opt}"
2218 target="${target}${opt}"
2219 fi
2220 done
2221
2222 # if combination is not known to be invalid, add it to the makefile
2223 if [[ -z $validate_options ]] || $validate_options "${clang_args}"; then
2224 cmd="${compile_cmd} ${clang_args}"
2225 echo "${target}: ${source_file}; $cmd ${source_file}" >> ${makefile}
2226
2227 deps="${deps} ${target}"
2228 ((++targets))
2229 fi
2230 done
2231
2232 echo "build_test_config_combos: ${deps}" >> ${makefile}
2233
2234 # execute all of the commands via Make (probably in parallel)
2235 make -s -f ${makefile} build_test_config_combos
2236 echo "$targets targets checked"
2237
2238 # clean up the temporary makefile
2239 rm ${makefile}
2240}
2241
Minos Galanakisf78447f2024-07-26 20:49:51 +01002242validate_aes_config_variations () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002243 if [[ "$1" == *"MBEDTLS_AES_USE_HARDWARE_ONLY"* ]]; then
2244 if [[ !(("$HOSTTYPE" == "aarch64" && "$1" != *"MBEDTLS_AESCE_C"*) || \
2245 ("$HOSTTYPE" == "x86_64" && "$1" != *"MBEDTLS_AESNI_C"*)) ]]; then
2246 return 1
2247 fi
2248 fi
2249 return 0
2250}
2251
Minos Galanakisf78447f2024-07-26 20:49:51 +01002252component_build_aes_variations () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002253 # 18s - around 90ms per clang invocation on M1 Pro
2254 #
2255 # aes.o has many #if defined(...) guards that intersect in complex ways.
2256 # Test that all the combinations build cleanly.
2257
2258 MBEDTLS_ROOT_DIR="$PWD"
2259 msg "build: aes.o for all combinations of relevant config options"
2260
2261 build_test_config_combos ${BUILTIN_SRC_PATH}/aes.o validate_aes_config_variations \
Thomas Daubney6cf05f92024-07-18 11:30:22 +01002262 "MBEDTLS_AES_ROM_TABLES" \
Minos Galanakis471b34c2024-07-26 15:39:24 +01002263 "MBEDTLS_AES_FEWER_TABLES" "MBEDTLS_AES_USE_HARDWARE_ONLY" \
2264 "MBEDTLS_AESNI_C" "MBEDTLS_AESCE_C" "MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH"
2265
2266 cd "$MBEDTLS_ROOT_DIR"
2267 msg "build: aes.o for all combinations of relevant config options + BLOCK_CIPHER_NO_DECRYPT"
2268
2269 # MBEDTLS_BLOCK_CIPHER_NO_DECRYPT is incompatible with ECB in PSA, CBC/XTS/NIST_KW/DES,
2270 # manually set or unset those configurations to check
2271 # MBEDTLS_BLOCK_CIPHER_NO_DECRYPT with various combinations in aes.o.
2272 scripts/config.py set MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
Minos Galanakis471b34c2024-07-26 15:39:24 +01002273 scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
Minos Galanakis471b34c2024-07-26 15:39:24 +01002274 scripts/config.py unset MBEDTLS_NIST_KW_C
Ronald Cron54d1eec2024-09-06 09:55:38 +02002275
Minos Galanakis00b641c2024-11-28 23:05:10 +00002276 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_NO_PADDING
2277 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_CBC_PKCS7
2278 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_ALG_ECB_NO_PADDING
2279 scripts/config.py -c $CRYPTO_CONFIG_H unset PSA_WANT_KEY_TYPE_DES
Ronald Cron4153ebb2024-09-11 15:32:48 +02002280 # Note: The two unsets below are to be removed for Mbed TLS 4.0
Ronald Cron54d1eec2024-09-06 09:55:38 +02002281 scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
2282 scripts/config.py unset MBEDTLS_DES_C
2283
Minos Galanakis471b34c2024-07-26 15:39:24 +01002284 build_test_config_combos ${BUILTIN_SRC_PATH}/aes.o validate_aes_config_variations \
Thomas Daubney6cf05f92024-07-18 11:30:22 +01002285 "MBEDTLS_AES_ROM_TABLES" \
Minos Galanakis471b34c2024-07-26 15:39:24 +01002286 "MBEDTLS_AES_FEWER_TABLES" "MBEDTLS_AES_USE_HARDWARE_ONLY" \
2287 "MBEDTLS_AESNI_C" "MBEDTLS_AESCE_C" "MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH"
2288}
2289
Minos Galanakisf78447f2024-07-26 20:49:51 +01002290component_test_sha3_variations () {
Minos Galanakis471b34c2024-07-26 15:39:24 +01002291 msg "sha3 loop unroll variations"
2292
2293 # define minimal config sufficient to test SHA3
Ronald Crone7f289e2024-09-06 11:02:47 +02002294 cat > include/mbedtls/mbedtls_config.h << END
Ronald Crone7f289e2024-09-06 11:02:47 +02002295END
2296
2297 cat > tf-psa-crypto/include/psa/crypto_config.h << END
2298 #define PSA_WANT_ALG_SHA_256 1
2299 #define PSA_WANT_ALG_SHA3_224 1
2300 #define PSA_WANT_ALG_SHA3_256 1
2301 #define PSA_WANT_ALG_SHA3_384 1
2302 #define PSA_WANT_ALG_SHA3_512 1
Ronald Cron3dd1d3d2024-12-05 15:12:06 +01002303 #define MBEDTLS_AES_C
2304 #define MBEDTLS_CTR_DRBG_C
2305 #define MBEDTLS_ENTROPY_C
2306 #define MBEDTLS_PSA_CRYPTO_C
2307 #define MBEDTLS_SELF_TEST
Minos Galanakis471b34c2024-07-26 15:39:24 +01002308END
2309
2310 msg "all loops unrolled"
2311 make clean
2312 make -C tests ../tf-psa-crypto/tests/test_suite_shax CFLAGS="-DMBEDTLS_SHA3_THETA_UNROLL=1 -DMBEDTLS_SHA3_PI_UNROLL=1 -DMBEDTLS_SHA3_CHI_UNROLL=1 -DMBEDTLS_SHA3_RHO_UNROLL=1"
2313 ./tf-psa-crypto/tests/test_suite_shax
2314
2315 msg "all loops rolled up"
2316 make clean
2317 make -C tests ../tf-psa-crypto/tests/test_suite_shax CFLAGS="-DMBEDTLS_SHA3_THETA_UNROLL=0 -DMBEDTLS_SHA3_PI_UNROLL=0 -DMBEDTLS_SHA3_CHI_UNROLL=0 -DMBEDTLS_SHA3_RHO_UNROLL=0"
2318 ./tf-psa-crypto/tests/test_suite_shax
2319}
2320
Minos Galanakisf699d512024-08-01 11:32:30 +01002321support_build_aes_aesce_armcc () {
2322 support_build_armcc
2323}
2324
Minos Galanakis471b34c2024-07-26 15:39:24 +01002325# For timebeing, no aarch64 gcc available in CI and no arm64 CI node.
2326component_build_aes_aesce_armcc () {
2327 msg "Build: AESCE test on arm64 platform without plain C."
2328 scripts/config.py baremetal
2329
2330 # armc[56] don't support SHA-512 intrinsics
2331 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
2332
2333 # Stop armclang warning about feature detection for A64_CRYPTO.
2334 # With this enabled, the library does build correctly under armclang,
2335 # but in baremetal builds (as tested here), feature detection is
2336 # unavailable, and the user is notified via a #warning. So enabling
2337 # this feature would prevent us from building with -Werror on
2338 # armclang. Tracked in #7198.
2339 scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
2340 scripts/config.py set MBEDTLS_HAVE_ASM
2341
2342 msg "AESCE, build with default configuration."
2343 scripts/config.py set MBEDTLS_AESCE_C
2344 scripts/config.py unset MBEDTLS_AES_USE_HARDWARE_ONLY
Manuel Pégourié-Gonnard8f08bcd2024-10-01 13:01:54 +02002345 helper_armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8-a+crypto"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002346
2347 msg "AESCE, build AESCE only"
2348 scripts/config.py set MBEDTLS_AESCE_C
2349 scripts/config.py set MBEDTLS_AES_USE_HARDWARE_ONLY
Manuel Pégourié-Gonnard8f08bcd2024-10-01 13:01:54 +02002350 helper_armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8-a+crypto"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002351}
2352
Minos Galanakis471b34c2024-07-26 15:39:24 +01002353component_test_aes_only_128_bit_keys () {
2354 msg "build: default config + AES_ONLY_128_BIT_KEY_LENGTH"
2355 scripts/config.py set MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
2356
2357 make CFLAGS='-O2 -Werror -Wall -Wextra'
2358
2359 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH"
2360 make test
2361}
2362
2363component_test_no_ctr_drbg_aes_only_128_bit_keys () {
2364 msg "build: default config + AES_ONLY_128_BIT_KEY_LENGTH - CTR_DRBG_C"
2365 scripts/config.py set MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
2366 scripts/config.py unset MBEDTLS_CTR_DRBG_C
2367
2368 make CC=clang CFLAGS='-Werror -Wall -Wextra'
2369
2370 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH - CTR_DRBG_C"
2371 make test
2372}
2373
2374component_test_aes_only_128_bit_keys_have_builtins () {
2375 msg "build: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
2376 scripts/config.py set MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
2377 scripts/config.py unset MBEDTLS_AESNI_C
2378 scripts/config.py unset MBEDTLS_AESCE_C
2379
2380 make CFLAGS='-O2 -Werror -Wall -Wextra'
2381
2382 msg "test: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
2383 make test
2384
2385 msg "selftest: default config + AES_ONLY_128_BIT_KEY_LENGTH - AESNI_C - AESCE_C"
2386 programs/test/selftest
2387}
2388
2389component_test_gcm_largetable () {
2390 msg "build: default config + GCM_LARGE_TABLE - AESNI_C - AESCE_C"
2391 scripts/config.py set MBEDTLS_GCM_LARGE_TABLE
2392 scripts/config.py unset MBEDTLS_AESNI_C
2393 scripts/config.py unset MBEDTLS_AESCE_C
2394
2395 make CFLAGS='-O2 -Werror -Wall -Wextra'
2396
2397 msg "test: default config - GCM_LARGE_TABLE - AESNI_C - AESCE_C"
2398 make test
2399}
2400
2401component_test_aes_fewer_tables () {
2402 msg "build: default config with AES_FEWER_TABLES enabled"
2403 scripts/config.py set MBEDTLS_AES_FEWER_TABLES
2404 make CFLAGS='-O2 -Werror -Wall -Wextra'
2405
2406 msg "test: AES_FEWER_TABLES"
2407 make test
2408}
2409
2410component_test_aes_rom_tables () {
2411 msg "build: default config with AES_ROM_TABLES enabled"
2412 scripts/config.py set MBEDTLS_AES_ROM_TABLES
2413 make CFLAGS='-O2 -Werror -Wall -Wextra'
2414
2415 msg "test: AES_ROM_TABLES"
2416 make test
2417}
2418
2419component_test_aes_fewer_tables_and_rom_tables () {
2420 msg "build: default config with AES_ROM_TABLES and AES_FEWER_TABLES enabled"
2421 scripts/config.py set MBEDTLS_AES_FEWER_TABLES
2422 scripts/config.py set MBEDTLS_AES_ROM_TABLES
2423 make CFLAGS='-O2 -Werror -Wall -Wextra'
2424
2425 msg "test: AES_FEWER_TABLES + AES_ROM_TABLES"
2426 make test
2427}
2428
Ronald Cron66040472024-09-06 10:14:38 +02002429# helper for component_test_block_cipher_no_decrypt_aesni() which:
Minos Galanakis471b34c2024-07-26 15:39:24 +01002430# - enable/disable the list of config options passed from -s/-u respectively.
2431# - build
2432# - test for tests_suite_xxx
2433# - selftest
2434#
2435# Usage: helper_block_cipher_no_decrypt_build_test
2436# [-s set_opts] [-u unset_opts] [-c cflags] [-l ldflags] [option [...]]
2437# Options: -s set_opts the list of config options to enable
2438# -u unset_opts the list of config options to disable
2439# -c cflags the list of options passed to CFLAGS
2440# -l ldflags the list of options passed to LDFLAGS
Minos Galanakis471b34c2024-07-26 15:39:24 +01002441helper_block_cipher_no_decrypt_build_test () {
2442 while [ $# -gt 0 ]; do
2443 case "$1" in
2444 -s)
2445 shift; local set_opts="$1";;
2446 -u)
2447 shift; local unset_opts="$1";;
2448 -c)
2449 shift; local cflags="-Werror -Wall -Wextra $1";;
2450 -l)
2451 shift; local ldflags="$1";;
2452 esac
2453 shift
2454 done
2455 set_opts="${set_opts:-}"
2456 unset_opts="${unset_opts:-}"
2457 cflags="${cflags:-}"
2458 ldflags="${ldflags:-}"
2459
2460 [ -n "$set_opts" ] && echo "Enabling: $set_opts" && scripts/config.py set-all $set_opts
2461 [ -n "$unset_opts" ] && echo "Disabling: $unset_opts" && scripts/config.py unset-all $unset_opts
2462
2463 msg "build: default config + BLOCK_CIPHER_NO_DECRYPT${set_opts:+ + $set_opts}${unset_opts:+ - $unset_opts} with $cflags${ldflags:+, $ldflags}"
2464 make clean
2465 make CFLAGS="-O2 $cflags" LDFLAGS="$ldflags"
2466
2467 # Make sure we don't have mbedtls_xxx_setkey_dec in AES/ARIA/CAMELLIA
2468 not grep mbedtls_aes_setkey_dec ${BUILTIN_SRC_PATH}/aes.o
2469 not grep mbedtls_aria_setkey_dec ${BUILTIN_SRC_PATH}/aria.o
2470 not grep mbedtls_camellia_setkey_dec ${BUILTIN_SRC_PATH}/camellia.o
2471 # Make sure we don't have mbedtls_internal_aes_decrypt in AES
2472 not grep mbedtls_internal_aes_decrypt ${BUILTIN_SRC_PATH}/aes.o
2473 # Make sure we don't have mbedtls_aesni_inverse_key in AESNI
2474 not grep mbedtls_aesni_inverse_key ${BUILTIN_SRC_PATH}/aesni.o
2475
2476 msg "test: default config + BLOCK_CIPHER_NO_DECRYPT${set_opts:+ + $set_opts}${unset_opts:+ - $unset_opts} with $cflags${ldflags:+, $ldflags}"
2477 make test
2478
2479 msg "selftest: default config + BLOCK_CIPHER_NO_DECRYPT${set_opts:+ + $set_opts}${unset_opts:+ - $unset_opts} with $cflags${ldflags:+, $ldflags}"
2480 programs/test/selftest
2481}
2482
Ronald Cron66040472024-09-06 10:14:38 +02002483# This is a configuration function used in component_test_block_cipher_no_decrypt_xxx:
2484config_block_cipher_no_decrypt () {
2485 scripts/config.py set MBEDTLS_BLOCK_CIPHER_NO_DECRYPT
2486 scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
2487 scripts/config.py unset MBEDTLS_NIST_KW_C
2488
2489 # Enable support for cryptographic mechanisms through the PSA API.
2490 # Note: XTS, KW are not yet supported via the PSA API in Mbed TLS.
Ronald Cron66040472024-09-06 10:14:38 +02002491 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_NO_PADDING
2492 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_CBC_PKCS7
2493 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_ALG_ECB_NO_PADDING
2494 scripts/config.py -f "$CRYPTO_CONFIG_H" unset PSA_WANT_KEY_TYPE_DES
Ronald Cron4153ebb2024-09-11 15:32:48 +02002495 # Note: The two unsets below are to be removed for Mbed TLS 4.0
Ronald Cron66040472024-09-06 10:14:38 +02002496 scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
2497 scripts/config.py unset MBEDTLS_DES_C
2498}
2499
2500component_test_block_cipher_no_decrypt_aesni () {
2501 # Test BLOCK_CIPHER_NO_DECRYPT with AESNI intrinsics, AESNI assembly and
2502 # AES C implementation on x86_64 and with AESNI intrinsics on x86.
2503
2504 # This consistently causes an llvm crash on clang 3.8, so use gcc
2505 export CC=gcc
2506 config_block_cipher_no_decrypt
2507
Minos Galanakis471b34c2024-07-26 15:39:24 +01002508 # test AESNI intrinsics
2509 helper_block_cipher_no_decrypt_build_test \
2510 -s "MBEDTLS_AESNI_C" \
2511 -c "-mpclmul -msse2 -maes"
2512
2513 # test AESNI assembly
2514 helper_block_cipher_no_decrypt_build_test \
2515 -s "MBEDTLS_AESNI_C" \
2516 -c "-mno-pclmul -mno-sse2 -mno-aes"
2517
2518 # test AES C implementation
2519 helper_block_cipher_no_decrypt_build_test \
2520 -u "MBEDTLS_AESNI_C"
2521
2522 # test AESNI intrinsics for i386 target
2523 helper_block_cipher_no_decrypt_build_test \
2524 -s "MBEDTLS_AESNI_C" \
2525 -c "-m32 -mpclmul -msse2 -maes" \
2526 -l "-m32"
2527}
2528
Minos Galanakisf699d512024-08-01 11:32:30 +01002529support_test_block_cipher_no_decrypt_aesce_armcc () {
2530 support_build_armcc
2531}
2532
Minos Galanakis471b34c2024-07-26 15:39:24 +01002533component_test_block_cipher_no_decrypt_aesce_armcc () {
2534 scripts/config.py baremetal
2535
2536 # armc[56] don't support SHA-512 intrinsics
2537 scripts/config.py unset MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
2538
2539 # Stop armclang warning about feature detection for A64_CRYPTO.
2540 # With this enabled, the library does build correctly under armclang,
2541 # but in baremetal builds (as tested here), feature detection is
2542 # unavailable, and the user is notified via a #warning. So enabling
2543 # this feature would prevent us from building with -Werror on
2544 # armclang. Tracked in #7198.
2545 scripts/config.py unset MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
2546 scripts/config.py set MBEDTLS_HAVE_ASM
2547
Ronald Cron66040472024-09-06 10:14:38 +02002548 config_block_cipher_no_decrypt
Minos Galanakis471b34c2024-07-26 15:39:24 +01002549
2550 # test AESCE baremetal build
2551 scripts/config.py set MBEDTLS_AESCE_C
2552 msg "build: default config + BLOCK_CIPHER_NO_DECRYPT with AESCE"
Manuel Pégourié-Gonnard8f08bcd2024-10-01 13:01:54 +02002553 helper_armc6_build_test "-O1 --target=aarch64-arm-none-eabi -march=armv8-a+crypto -Werror -Wall -Wextra"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002554
2555 # Make sure we don't have mbedtls_xxx_setkey_dec in AES/ARIA/CAMELLIA
2556 not grep mbedtls_aes_setkey_dec ${BUILTIN_SRC_PATH}/aes.o
2557 not grep mbedtls_aria_setkey_dec ${BUILTIN_SRC_PATH}/aria.o
2558 not grep mbedtls_camellia_setkey_dec ${BUILTIN_SRC_PATH}/camellia.o
2559 # Make sure we don't have mbedtls_internal_aes_decrypt in AES
2560 not grep mbedtls_internal_aes_decrypt ${BUILTIN_SRC_PATH}/aes.o
2561 # Make sure we don't have mbedtls_aesce_inverse_key and aesce_decrypt_block in AESCE
2562 not grep mbedtls_aesce_inverse_key ${BUILTIN_SRC_PATH}/aesce.o
2563 not grep aesce_decrypt_block ${BUILTIN_SRC_PATH}/aesce.o
2564}
2565
2566component_test_ctr_drbg_aes_256_sha_256 () {
2567 msg "build: full + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
2568 scripts/config.py full
2569 scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2570 scripts/config.py set MBEDTLS_ENTROPY_FORCE_SHA256
2571 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2572 make
2573
2574 msg "test: full + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
2575 make test
2576}
2577
2578component_test_ctr_drbg_aes_128_sha_512 () {
2579 msg "build: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY (ASan build)"
2580 scripts/config.py full
2581 scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2582 scripts/config.py set MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
2583 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2584 make
2585
2586 msg "test: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY (ASan build)"
2587 make test
2588}
2589
2590component_test_ctr_drbg_aes_128_sha_256 () {
2591 msg "build: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
2592 scripts/config.py full
2593 scripts/config.py unset MBEDTLS_MEMORY_BUFFER_ALLOC_C
2594 scripts/config.py set MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
2595 scripts/config.py set MBEDTLS_ENTROPY_FORCE_SHA256
2596 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2597 make
2598
2599 msg "test: full + MBEDTLS_CTR_DRBG_USE_128_BIT_KEY + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
2600 make test
2601}
2602
2603component_test_se_default () {
2604 msg "build: default config + MBEDTLS_PSA_CRYPTO_SE_C"
2605 scripts/config.py set MBEDTLS_PSA_CRYPTO_SE_C
2606 make CC=clang CFLAGS="$ASAN_CFLAGS -Os" LDFLAGS="$ASAN_CFLAGS"
2607
2608 msg "test: default config + MBEDTLS_PSA_CRYPTO_SE_C"
2609 make test
2610}
2611
Gilles Peskinea9dda7e2024-06-21 11:25:01 +02002612component_test_full_static_keystore () {
2613 msg "build: full config - MBEDTLS_PSA_KEY_STORE_DYNAMIC"
2614 scripts/config.py full
2615 scripts/config.py unset MBEDTLS_PSA_KEY_STORE_DYNAMIC
2616 make CC=clang CFLAGS="$ASAN_CFLAGS -Os" LDFLAGS="$ASAN_CFLAGS"
2617
2618 msg "test: full config - MBEDTLS_PSA_KEY_STORE_DYNAMIC"
2619 make test
2620}
2621
Minos Galanakis471b34c2024-07-26 15:39:24 +01002622component_test_psa_crypto_drivers () {
Ronald Crona0afbfb2024-10-15 13:20:31 +02002623 # Test dispatch to drivers and fallbacks with
2624 # test_suite_psa_crypto_driver_wrappers test suite. The test drivers that
2625 # are wrappers around the builtin drivers are activated by
2626 # PSA_CRYPTO_DRIVER_TEST.
2627 #
2628 # For the time being, some test cases in test_suite_block_cipher and
2629 # test_suite_md.psa rely on this component to be run at least once by the
2630 # CI. This should disappear as we progress the 4.x work. See
2631 # config_adjust_test_accelerators.h for more information.
Minos Galanakis471b34c2024-07-26 15:39:24 +01002632 msg "build: full + test drivers dispatching to builtins"
2633 scripts/config.py full
Ronald Cron67cc6a72024-10-14 10:55:24 +02002634 loc_cflags="$ASAN_CFLAGS -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_CONFIG_ADJUST_TEST_ACCELERATORS"
David Horstmann5b93d972024-10-31 15:36:05 +00002635 loc_cflags="${loc_cflags} -I../framework/tests/include"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002636
2637 make CC=$ASAN_CC CFLAGS="${loc_cflags}" LDFLAGS="$ASAN_CFLAGS"
2638
2639 msg "test: full + test drivers dispatching to builtins"
2640 make test
2641}
2642
2643component_build_psa_config_file () {
Minos Galanakis4f619e12024-11-14 14:56:47 +00002644 msg "build: make with TF_PSA_CRYPTO_CONFIG_FILE" # ~40s
Minos Galanakis471b34c2024-07-26 15:39:24 +01002645 cp "$CRYPTO_CONFIG_H" psa_test_config.h
Minos Galanakis4f619e12024-11-14 14:56:47 +00002646 echo '#error "TF_PSA_CRYPTO_CONFIG_FILE is not working"' >"$CRYPTO_CONFIG_H"
2647 make CFLAGS="-I '$PWD' -DTF_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"'"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002648 # Make sure this feature is enabled. We'll disable it in the next phase.
2649 programs/test/query_compile_time_config MBEDTLS_CMAC_C
2650 make clean
2651
Minos Galanakis4f619e12024-11-14 14:56:47 +00002652 msg "build: make with TF_PSA_CRYPTO_CONFIG_FILE + TF_PSA_CRYPTO_USER_CONFIG_FILE" # ~40s
Minos Galanakis471b34c2024-07-26 15:39:24 +01002653 # In the user config, disable one feature and its dependencies, which will
2654 # reflect on the mbedtls configuration so we can query it with
2655 # query_compile_time_config.
2656 echo '#undef PSA_WANT_ALG_CMAC' >psa_user_config.h
2657 echo '#undef PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128' >> psa_user_config.h
Minos Galanakisaa2f12c2024-10-22 15:31:07 +01002658 echo '#undef MBEDTLS_CMAC_C' >> psa_user_config.h
Minos Galanakis4f619e12024-11-14 14:56:47 +00002659 make CFLAGS="-I '$PWD' -DTF_PSA_CRYPTO_CONFIG_FILE='\"psa_test_config.h\"' -DTF_PSA_CRYPTO_USER_CONFIG_FILE='\"psa_user_config.h\"'"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002660 not programs/test/query_compile_time_config MBEDTLS_CMAC_C
2661
2662 rm -f psa_test_config.h psa_user_config.h
2663}
2664
2665component_build_psa_alt_headers () {
2666 msg "build: make with PSA alt headers" # ~20s
2667
2668 # Generate alternative versions of the substitutable headers with the
2669 # same content except different include guards.
David Horstmanndc459512024-11-07 17:08:11 +00002670 make -C tests ../framework/tests/include/alt-extra/psa/crypto_platform_alt.h ../framework/tests/include/alt-extra/psa/crypto_struct_alt.h
Minos Galanakis471b34c2024-07-26 15:39:24 +01002671
2672 # Build the library and some programs.
2673 # Don't build the fuzzers to avoid having to go through hoops to set
2674 # a correct include path for programs/fuzz/Makefile.
David Horstmann5b93d972024-10-31 15:36:05 +00002675 make CFLAGS="-I ../framework/tests/include/alt-extra -DMBEDTLS_PSA_CRYPTO_PLATFORM_FILE='\"psa/crypto_platform_alt.h\"' -DMBEDTLS_PSA_CRYPTO_STRUCT_FILE='\"psa/crypto_struct_alt.h\"'" lib
2676 make -C programs -o fuzz CFLAGS="-I ../framework/tests/include/alt-extra -DMBEDTLS_PSA_CRYPTO_PLATFORM_FILE='\"psa/crypto_platform_alt.h\"' -DMBEDTLS_PSA_CRYPTO_STRUCT_FILE='\"psa/crypto_struct_alt.h\"'"
Minos Galanakis471b34c2024-07-26 15:39:24 +01002677
2678 # Check that we're getting the alternative include guards and not the
2679 # original include guards.
2680 programs/test/query_included_headers | grep -x PSA_CRYPTO_PLATFORM_ALT_H
2681 programs/test/query_included_headers | grep -x PSA_CRYPTO_STRUCT_ALT_H
2682 programs/test/query_included_headers | not grep -x PSA_CRYPTO_PLATFORM_H
2683 programs/test/query_included_headers | not grep -x PSA_CRYPTO_STRUCT_H
2684}
2685
2686component_test_min_mpi_window_size () {
2687 msg "build: Default + MBEDTLS_MPI_WINDOW_SIZE=1 (ASan build)" # ~ 10s
2688 scripts/config.py set MBEDTLS_MPI_WINDOW_SIZE 1
2689 CC=$ASAN_CC cmake -D CMAKE_BUILD_TYPE:String=Asan .
2690 make
2691
2692 msg "test: MBEDTLS_MPI_WINDOW_SIZE=1 - main suites (inc. selftests) (ASan build)" # ~ 10s
2693 make test
2694}