Merge remote-tracking branch 'upstream-public/development' into no-generated-files-3.0
Conflicts: generated files that are removed in this branch and have
changed in development. Resolved by keeping the files removed.
diff --git a/CMakeLists.txt b/CMakeLists.txt
index fb1ffaf..f648f22 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -56,17 +56,6 @@
endif()
# Warning string - created as a list for compatibility with CMake 2.8
-set(WARNING_BORDER "*******************************************************\n")
-set(NULL_ENTROPY_WARN_L1 "**** WARNING! MBEDTLS_TEST_NULL_ENTROPY defined!\n")
-set(NULL_ENTROPY_WARN_L2 "**** THIS BUILD HAS NO DEFINED ENTROPY SOURCES\n")
-set(NULL_ENTROPY_WARN_L3 "**** AND IS *NOT* SUITABLE FOR PRODUCTION USE\n")
-
-set(NULL_ENTROPY_WARNING "${WARNING_BORDER}"
- "${NULL_ENTROPY_WARN_L1}"
- "${NULL_ENTROPY_WARN_L2}"
- "${NULL_ENTROPY_WARN_L3}"
- "${WARNING_BORDER}")
-
set(CTR_DRBG_128_BIT_KEY_WARN_L1 "**** WARNING! MBEDTLS_CTR_DRBG_USE_128_BIT_KEY defined!\n")
set(CTR_DRBG_128_BIT_KEY_WARN_L2 "**** Using 128-bit keys for CTR_DRBG limits the security of generated\n")
set(CTR_DRBG_128_BIT_KEY_WARN_L3 "**** keys and operations that use random values generated to 128-bit security\n")
@@ -99,26 +88,6 @@
message(WARNING ${CTR_DRBG_128_BIT_KEY_WARNING})
endif()
- # If NULL Entropy is configured, display an appropriate warning
- execute_process(COMMAND ${MBEDTLS_PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.py -f ${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/config.h get MBEDTLS_TEST_NULL_ENTROPY
- RESULT_VARIABLE result)
- if(${result} EQUAL 0)
- message(WARNING ${NULL_ENTROPY_WARNING})
-
- if(NOT UNSAFE_BUILD)
- message(FATAL_ERROR "\
-\n\
-Warning! You have enabled MBEDTLS_TEST_NULL_ENTROPY. \
-This option is not safe for production use and negates all security \
-It is intended for development use only. \
-\n\
-To confirm you want to build with this option, re-run cmake with the \
-option: \n\
- cmake -DUNSAFE_BUILD=ON ")
-
- return()
- endif()
- endif()
endif()
# If this is the root project add longer list of available CMAKE_BUILD_TYPE values
diff --git a/ChangeLog.d/issue4361.txt b/ChangeLog.d/issue4361.txt
new file mode 100644
index 0000000..f1dbb3f
--- /dev/null
+++ b/ChangeLog.d/issue4361.txt
@@ -0,0 +1,3 @@
+Removals
+ * Remove the MBEDTLS_SSL_RECORD_CHECKING option and enable by default its
+ previous action. Fixes #4361.
diff --git a/ChangeLog.d/make-generate-tests-python.txt b/ChangeLog.d/make-generate-tests-python.txt
new file mode 100644
index 0000000..4b9009d
--- /dev/null
+++ b/ChangeLog.d/make-generate-tests-python.txt
@@ -0,0 +1,3 @@
+Changes
+ * When building the test suites with GNU make, invoke python3 or python, not
+ python2, which is no longer supported upstream.
diff --git a/ChangeLog.d/psa_sign_message.txt b/ChangeLog.d/psa_sign_message.txt
new file mode 100644
index 0000000..2d77ec0
--- /dev/null
+++ b/ChangeLog.d/psa_sign_message.txt
@@ -0,0 +1,2 @@
+Features
+ * Implement psa_sign_message() and psa_verify_message().
diff --git a/ChangeLog.d/remove_null_entropy.txt b/ChangeLog.d/remove_null_entropy.txt
new file mode 100644
index 0000000..3d9674b
--- /dev/null
+++ b/ChangeLog.d/remove_null_entropy.txt
@@ -0,0 +1,2 @@
+API changes
+ * Remove the MBEDTLS_TEST_NULL_ENTROPY config option. Fixes #4388.
diff --git a/ChangeLog.d/sha512-output-type.txt b/ChangeLog.d/sha512-output-type.txt
new file mode 100644
index 0000000..eabc67d
--- /dev/null
+++ b/ChangeLog.d/sha512-output-type.txt
@@ -0,0 +1,6 @@
+API changes
+ * The output parameter of mbedtls_sha512_finish_ret, mbedtls_sha512_ret,
+ mbedtls_sha256_finish_ret and mbedtls_sha256_ret now has a pointer type
+ rather than array type. This removes spurious warnings in some compilers
+ when outputting a SHA-384 or SHA-224 hash into a buffer of exactly
+ the hash size.
diff --git a/Makefile b/Makefile
index ad82c0f..5b2ad16 100644
--- a/Makefile
+++ b/Makefile
@@ -91,12 +91,6 @@
done
endif
-WARNING_BORDER =*******************************************************\n
-NULL_ENTROPY_WARN_L1=**** WARNING! MBEDTLS_TEST_NULL_ENTROPY defined! ****\n
-NULL_ENTROPY_WARN_L2=**** THIS BUILD HAS NO DEFINED ENTROPY SOURCES ****\n
-NULL_ENTROPY_WARN_L3=**** AND IS *NOT* SUITABLE FOR PRODUCTION USE ****\n
-
-NULL_ENTROPY_WARNING=\n$(WARNING_BORDER)$(NULL_ENTROPY_WARN_L1)$(NULL_ENTROPY_WARN_L2)$(NULL_ENTROPY_WARN_L3)$(WARNING_BORDER)
WARNING_BORDER_LONG =**********************************************************************************\n
CTR_DRBG_128_BIT_KEY_WARN_L1=**** WARNING! MBEDTLS_CTR_DRBG_USE_128_BIT_KEY defined! ****\n
@@ -113,9 +107,6 @@
-scripts/config.py get MBEDTLS_CTR_DRBG_USE_128_BIT_KEY && ([ $$? -eq 0 ]) && \
echo '$(CTR_DRBG_128_BIT_KEY_WARNING)'
- # If NULL Entropy is configured, display an appropriate warning
- -scripts/config.py get MBEDTLS_TEST_NULL_ENTROPY && ([ $$? -eq 0 ]) && \
- echo '$(NULL_ENTROPY_WARNING)'
endif
clean: clean_more_on_top
diff --git a/docs/3.0-migration-guide.d/remove-null-entropy.md b/docs/3.0-migration-guide.d/remove-null-entropy.md
new file mode 100644
index 0000000..50e024a
--- /dev/null
+++ b/docs/3.0-migration-guide.d/remove-null-entropy.md
@@ -0,0 +1,11 @@
+Remove the option to build the library without any entropy sources
+------------------------------------------------------------------
+
+This does not affect users who use the default `config.h`, as this option was
+already off by default.
+
+If you were using the `MBEDTLS_TEST_NULL_ENTROPY` option and your platform
+doesn't have any entropy source, you should use `MBEDTLS_ENTROPY_NV_SEED`
+and make sure your device is provisioned with a strong random seed.
+Alternatively, for testing purposes only, you can create and register a fake
+entropy function.
diff --git a/docs/3.0-migration-guide.d/remove_ssl_record_checking.md b/docs/3.0-migration-guide.d/remove_ssl_record_checking.md
new file mode 100644
index 0000000..7550f7b
--- /dev/null
+++ b/docs/3.0-migration-guide.d/remove_ssl_record_checking.md
@@ -0,0 +1,13 @@
+Remove MBEDTLS_SSL_RECORD_CHECKING option and enable its action by default
+--------------------------------------------------------------------------
+
+This change does not affect users who use the default config.h, as the
+option MBEDTLS_SSL_RECORD_CHECKING was already on by default.
+
+This option was added only to control compilation of one function,
+mbedtls_ssl_check_record(), which is only useful in some specific cases, so it
+was made optional to allow users who don't need it to save some code space.
+However, the same effect can be achieve by using link-time garbage collection.
+
+Users who changed the default setting of the option need to change the config/
+build system to remove that change.
diff --git a/docs/3.0-migration-guide.d/sha512-output-type.md b/docs/3.0-migration-guide.d/sha512-output-type.md
new file mode 100644
index 0000000..c62a881
--- /dev/null
+++ b/docs/3.0-migration-guide.d/sha512-output-type.md
@@ -0,0 +1,8 @@
+SHA-512 and SHA-256 output type change
+--------------------------
+
+The output parameter of `mbedtls_sha256_finish_ret()`, `mbedtls_sha256_ret()`, `mbedtls_sha512_finish_ret()`, `mbedtls_sha512_ret()` now has a pointer type rather than array type. This makes no difference in terms of C semantics, but removes spurious warnings in some compilers when outputting a SHA-384 hash into a 48-byte buffer or a SHA-224 hash into a 28-byte buffer.
+
+This makes no difference to a vast majority of applications. If your code takes a pointer to one of these functions, you may need to change the type of the pointer.
+
+Alternative implementations of the SHA256 and SHA512 modules must adjust their functions' prototype accordingly.
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index 47b5de0..4a2d70f 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -201,15 +201,6 @@
#endif
#undef MBEDTLS_HAS_MEMSAN
-#if defined(MBEDTLS_TEST_NULL_ENTROPY) && \
- ( !defined(MBEDTLS_ENTROPY_C) || !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) )
-#error "MBEDTLS_TEST_NULL_ENTROPY defined, but not all prerequisites"
-#endif
-#if defined(MBEDTLS_TEST_NULL_ENTROPY) && \
- ( defined(MBEDTLS_ENTROPY_NV_SEED) || defined(MBEDTLS_ENTROPY_HARDWARE_ALT) )
-#error "MBEDTLS_TEST_NULL_ENTROPY defined, but entropy sources too"
-#endif
-
#if defined(MBEDTLS_GCM_C) && ( \
!defined(MBEDTLS_AES_C) && !defined(MBEDTLS_CAMELLIA_C) && !defined(MBEDTLS_ARIA_C) )
#error "MBEDTLS_GCM_C defined, but not all prerequisites"
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 907a041..bc39a12 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -528,23 +528,6 @@
//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT
/**
- * \def MBEDTLS_TEST_NULL_ENTROPY
- *
- * Enables testing and use of mbed TLS without any configured entropy sources.
- * This permits use of the library on platforms before an entropy source has
- * been integrated (see for example the MBEDTLS_ENTROPY_HARDWARE_ALT or the
- * MBEDTLS_ENTROPY_NV_SEED switches).
- *
- * WARNING! This switch MUST be disabled in production builds, and is suitable
- * only for development.
- * Enabling the switch negates any security provided by the library.
- *
- * Requires MBEDTLS_ENTROPY_C, MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
- *
- */
-//#define MBEDTLS_TEST_NULL_ENTROPY
-
-/**
* \def MBEDTLS_ENTROPY_HARDWARE_ALT
*
* Uncomment this macro to let mbed TLS use your own implementation of a
@@ -1468,20 +1451,6 @@
#define MBEDTLS_SSL_ALL_ALERT_MESSAGES
/**
- * \def MBEDTLS_SSL_RECORD_CHECKING
- *
- * Enable the function mbedtls_ssl_check_record() which can be used to check
- * the validity and authenticity of an incoming record, to verify that it has
- * not been seen before. These checks are performed without modifying the
- * externally visible state of the SSL context.
- *
- * See mbedtls_ssl_check_record() for more information.
- *
- * Uncomment to enable support for record checking.
- */
-#define MBEDTLS_SSL_RECORD_CHECKING
-
-/**
* \def MBEDTLS_SSL_DTLS_CONNECTION_ID
*
* Enable support for the DTLS Connection ID extension
diff --git a/include/mbedtls/sha256.h b/include/mbedtls/sha256.h
index 9b8d91d..22c2c7d 100644
--- a/include/mbedtls/sha256.h
+++ b/include/mbedtls/sha256.h
@@ -127,13 +127,14 @@
* \param ctx The SHA-256 context. This must be initialized
* and have a hash operation started.
* \param output The SHA-224 or SHA-256 checksum result.
- * This must be a writable buffer of length \c 32 Bytes.
+ * This must be a writable buffer of length \c 32 bytes
+ * for SHA-256, \c 28 bytes for SHA-224.
*
* \return \c 0 on success.
* \return A negative error code on failure.
*/
int mbedtls_sha256_finish_ret( mbedtls_sha256_context *ctx,
- unsigned char output[32] );
+ unsigned char *output );
/**
* \brief This function processes a single data block within
@@ -163,14 +164,15 @@
* \param input The buffer holding the data. This must be a readable
* buffer of length \p ilen Bytes.
* \param ilen The length of the input data in Bytes.
- * \param output The SHA-224 or SHA-256 checksum result. This must
- * be a writable buffer of length \c 32 Bytes.
+ * \param output The SHA-224 or SHA-256 checksum result.
+ * This must be a writable buffer of length \c 32 bytes
+ * for SHA-256, \c 28 bytes for SHA-224.
* \param is224 Determines which function to use. This must be
* either \c 0 for SHA-256, or \c 1 for SHA-224.
*/
int mbedtls_sha256_ret( const unsigned char *input,
size_t ilen,
- unsigned char output[32],
+ unsigned char *output,
int is224 );
#if defined(MBEDTLS_SELF_TEST)
diff --git a/include/mbedtls/sha512.h b/include/mbedtls/sha512.h
index 56cefe1..ef1fa22 100644
--- a/include/mbedtls/sha512.h
+++ b/include/mbedtls/sha512.h
@@ -134,13 +134,14 @@
* \param ctx The SHA-512 context. This must be initialized
* and have a hash operation started.
* \param output The SHA-384 or SHA-512 checksum result.
- * This must be a writable buffer of length \c 64 Bytes.
+ * This must be a writable buffer of length \c 64 bytes
+ * for SHA-512, \c 48 bytes for SHA-384.
*
* \return \c 0 on success.
* \return A negative error code on failure.
*/
int mbedtls_sha512_finish_ret( mbedtls_sha512_context *ctx,
- unsigned char output[64] );
+ unsigned char *output );
/**
* \brief This function processes a single data block within
@@ -171,7 +172,8 @@
* a readable buffer of length \p ilen Bytes.
* \param ilen The length of the input data in Bytes.
* \param output The SHA-384 or SHA-512 checksum result.
- * This must be a writable buffer of length \c 64 Bytes.
+ * This must be a writable buffer of length \c 64 bytes
+ * for SHA-512, \c 48 bytes for SHA-384.
* \param is384 Determines which function to use. This must be either
* \c 0 for SHA-512, or \c 1 for SHA-384.
*
@@ -184,7 +186,7 @@
*/
int mbedtls_sha512_ret( const unsigned char *input,
size_t ilen,
- unsigned char output[64],
+ unsigned char *output,
int is384 );
#if defined(MBEDTLS_SELF_TEST)
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index f90c76a..ffbbd79 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -1791,7 +1791,6 @@
*/
void mbedtls_ssl_conf_read_timeout( mbedtls_ssl_config *conf, uint32_t timeout );
-#if defined(MBEDTLS_SSL_RECORD_CHECKING)
/**
* \brief Check whether a buffer contains a valid and authentic record
* that has not been seen before. (DTLS only).
@@ -1839,7 +1838,6 @@
int mbedtls_ssl_check_record( mbedtls_ssl_context const *ssl,
unsigned char *buf,
size_t buflen );
-#endif /* MBEDTLS_SSL_RECORD_CHECKING */
/**
* \brief Set the timer callbacks (Mandatory for DTLS.)
diff --git a/library/entropy.c b/library/entropy.c
index c7ae97a..cc68628 100644
--- a/library/entropy.c
+++ b/library/entropy.c
@@ -21,12 +21,6 @@
#if defined(MBEDTLS_ENTROPY_C)
-#if defined(MBEDTLS_TEST_NULL_ENTROPY)
-#warning "**** WARNING! MBEDTLS_TEST_NULL_ENTROPY defined! "
-#warning "**** THIS BUILD HAS NO DEFINED ENTROPY SOURCES "
-#warning "**** THIS BUILD IS *NOT* SUITABLE FOR PRODUCTION USE "
-#endif
-
#include "mbedtls/entropy.h"
#include "entropy_poll.h"
#include "mbedtls/platform_util.h"
@@ -73,11 +67,6 @@
/* Reminder: Update ENTROPY_HAVE_STRONG in the test files
* when adding more strong entropy sources here. */
-#if defined(MBEDTLS_TEST_NULL_ENTROPY)
- mbedtls_entropy_add_source( ctx, mbedtls_null_entropy_poll, NULL,
- 1, MBEDTLS_ENTROPY_SOURCE_STRONG );
-#endif
-
#if !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
mbedtls_entropy_add_source( ctx, mbedtls_platform_entropy_poll, NULL,
@@ -524,7 +513,6 @@
#endif /* MBEDTLS_FS_IO */
#if defined(MBEDTLS_SELF_TEST)
-#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
/*
* Dummy source function
*/
@@ -538,7 +526,6 @@
return( 0 );
}
-#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT)
@@ -646,17 +633,14 @@
int mbedtls_entropy_self_test( int verbose )
{
int ret = 1;
-#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
mbedtls_entropy_context ctx;
unsigned char buf[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
unsigned char acc[MBEDTLS_ENTROPY_BLOCK_SIZE] = { 0 };
size_t i, j;
-#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
if( verbose != 0 )
mbedtls_printf( " ENTROPY test: " );
-#if !defined(MBEDTLS_TEST_NULL_ENTROPY)
mbedtls_entropy_init( &ctx );
/* First do a gather to make sure we have default sources */
@@ -704,7 +688,6 @@
cleanup:
mbedtls_entropy_free( &ctx );
-#endif /* !MBEDTLS_TEST_NULL_ENTROPY */
if( verbose != 0 )
{
diff --git a/library/entropy_poll.c b/library/entropy_poll.c
index e4ffe2b..e5d75c5 100644
--- a/library/entropy_poll.c
+++ b/library/entropy_poll.c
@@ -211,23 +211,6 @@
#endif /* _WIN32 && !EFIX64 && !EFI32 */
#endif /* !MBEDTLS_NO_PLATFORM_ENTROPY */
-#if defined(MBEDTLS_TEST_NULL_ENTROPY)
-int mbedtls_null_entropy_poll( void *data,
- unsigned char *output, size_t len, size_t *olen )
-{
- ((void) data);
- ((void) output);
-
- *olen = 0;
- if( len < sizeof(unsigned char) )
- return( 0 );
-
- output[0] = 0;
- *olen = sizeof(unsigned char);
- return( 0 );
-}
-#endif
-
#if defined(MBEDTLS_TIMING_C)
int mbedtls_hardclock_poll( void *data,
unsigned char *output, size_t len, size_t *olen )
diff --git a/library/entropy_poll.h b/library/entropy_poll.h
index e12a134..9120fe5 100644
--- a/library/entropy_poll.h
+++ b/library/entropy_poll.h
@@ -43,14 +43,6 @@
#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Minimum for the hardware source */
#endif
-/**
- * \brief Entropy poll callback that provides 0 entropy.
- */
-#if defined(MBEDTLS_TEST_NULL_ENTROPY)
- int mbedtls_null_entropy_poll( void *data,
- unsigned char *output, size_t len, size_t *olen );
-#endif
-
#if !defined(MBEDTLS_NO_PLATFORM_ENTROPY)
/**
* \brief Platform-specific entropy poll callback
diff --git a/library/padlock.h b/library/padlock.h
index 78dbeb6..4f4e400 100644
--- a/library/padlock.h
+++ b/library/padlock.h
@@ -71,7 +71,7 @@
*
* \param feature The feature to detect
*
- * \return 1 if CPU has support for the feature, 0 otherwise
+ * \return non-zero if CPU has support for the feature, 0 otherwise
*/
int mbedtls_padlock_has_support( int feature );
diff --git a/library/sha256.c b/library/sha256.c
index a94f325..36ab0c1 100644
--- a/library/sha256.c
+++ b/library/sha256.c
@@ -332,7 +332,7 @@
* SHA-256 final digest
*/
int mbedtls_sha256_finish_ret( mbedtls_sha256_context *ctx,
- unsigned char output[32] )
+ unsigned char *output )
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
uint32_t used;
@@ -401,7 +401,7 @@
*/
int mbedtls_sha256_ret( const unsigned char *input,
size_t ilen,
- unsigned char output[32],
+ unsigned char *output,
int is224 )
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
diff --git a/library/sha512.c b/library/sha512.c
index 7530629..7d53731 100644
--- a/library/sha512.c
+++ b/library/sha512.c
@@ -380,7 +380,7 @@
* SHA-512 final digest
*/
int mbedtls_sha512_finish_ret( mbedtls_sha512_context *ctx,
- unsigned char output[64] )
+ unsigned char *output )
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
unsigned used;
@@ -453,7 +453,7 @@
*/
int mbedtls_sha512_ret( const unsigned char *input,
size_t ilen,
- unsigned char output[64],
+ unsigned char *output,
int is384 )
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index faafaba..609aa98 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -86,7 +86,6 @@
return( 0 );
}
-#if defined(MBEDTLS_SSL_RECORD_CHECKING)
static int ssl_parse_record_header( mbedtls_ssl_context const *ssl,
unsigned char *buf,
size_t len,
@@ -150,7 +149,6 @@
MBEDTLS_SSL_DEBUG_MSG( 1, ( "<= mbedtls_ssl_check_record" ) );
return( ret );
}
-#endif /* MBEDTLS_SSL_RECORD_CHECKING */
#define SSL_DONT_FORCE_FLUSH 0
#define SSL_FORCE_FLUSH 1
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 7900383..7172c74 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -2898,8 +2898,6 @@
#if defined(MBEDTLS_SHA512_C)
-typedef int (*finish_sha384_t)(mbedtls_sha512_context*, unsigned char*);
-
static void ssl_calc_finished_tls_sha384(
mbedtls_ssl_context *ssl, unsigned char *buf, int from )
{
@@ -2958,13 +2956,7 @@
MBEDTLS_SSL_DEBUG_BUF( 4, "finished sha512 state", (unsigned char *)
sha512.state, sizeof( sha512.state ) );
#endif
- /*
- * For SHA-384, we can save 16 bytes by keeping padbuf 48 bytes long.
- * However, to avoid stringop-overflow warning in gcc, we have to cast
- * mbedtls_sha512_finish_ret().
- */
- finish_sha384_t finish = (finish_sha384_t)mbedtls_sha512_finish_ret;
- finish( &sha512, padbuf );
+ mbedtls_sha512_finish_ret( &sha512, padbuf );
mbedtls_sha512_free( &sha512 );
#endif
diff --git a/programs/fuzz/Makefile b/programs/fuzz/Makefile
index 588bb28..59a2bb7 100644
--- a/programs/fuzz/Makefile
+++ b/programs/fuzz/Makefile
@@ -20,8 +20,6 @@
DLEXT ?= so
EXEXT=
SHARED_SUFFIX=
-# python2 for POSIX since FreeBSD has only python2 as default.
-PYTHON ?= python2
ifdef FUZZINGENGINE
LOCAL_LDFLAGS += -lFuzzingEngine
diff --git a/programs/ssl/ssl_test_common_source.c b/programs/ssl/ssl_test_common_source.c
index 73457a1..fd7eacf 100644
--- a/programs/ssl/ssl_test_common_source.c
+++ b/programs/ssl/ssl_test_common_source.c
@@ -159,7 +159,6 @@
#endif /* MBEDTLS_SSL_EXPORT_KEYS */
-#if defined(MBEDTLS_SSL_RECORD_CHECKING)
int ssl_check_record( mbedtls_ssl_context const *ssl,
unsigned char const *buf, size_t len )
{
@@ -220,7 +219,6 @@
return( 0 );
}
-#endif /* MBEDTLS_SSL_RECORD_CHECKING */
int recv_cb( void *ctx, unsigned char *buf, size_t len )
{
@@ -241,10 +239,8 @@
/* Here's the place to do any datagram/record checking
* in between receiving the packet from the underlying
* transport and passing it on to the TLS stack. */
-#if defined(MBEDTLS_SSL_RECORD_CHECKING)
if( ssl_check_record( io_ctx->ssl, buf, recv_len ) != 0 )
return( -1 );
-#endif /* MBEDTLS_SSL_RECORD_CHECKING */
}
return( (int) recv_len );
@@ -267,10 +263,8 @@
/* Here's the place to do any datagram/record checking
* in between receiving the packet from the underlying
* transport and passing it on to the TLS stack. */
-#if defined(MBEDTLS_SSL_RECORD_CHECKING)
if( ssl_check_record( io_ctx->ssl, buf, recv_len ) != 0 )
return( -1 );
-#endif /* MBEDTLS_SSL_RECORD_CHECKING */
}
return( (int) recv_len );
diff --git a/scripts/config.py b/scripts/config.py
index a77ead0..a68b2a9 100755
--- a/scripts/config.py
+++ b/scripts/config.py
@@ -194,7 +194,6 @@
'MBEDTLS_SHA512_NO_SHA384', # removes a feature
'MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN', # build dependency (clang+memsan)
'MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND', # build dependency (valgrind headers)
- 'MBEDTLS_TEST_NULL_ENTROPY', # removes a feature
'MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION', # influences the use of X.509 in TLS
'MBEDTLS_X509_REMOVE_INFO', # removes a feature
])
diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 3cd9456..1653ad8 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -2093,21 +2093,6 @@
if_build_succeeded tests/ssl-opt.sh -f 'Default\|EtM' -e 'without EtM'
}
-component_test_null_entropy () {
- msg "build: default config with MBEDTLS_TEST_NULL_ENTROPY (ASan build)"
- scripts/config.py set MBEDTLS_TEST_NULL_ENTROPY
- scripts/config.py set MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
- scripts/config.py set MBEDTLS_ENTROPY_C
- scripts/config.py unset MBEDTLS_ENTROPY_NV_SEED
- scripts/config.py unset MBEDTLS_PLATFORM_NV_SEED_ALT
- scripts/config.py unset MBEDTLS_ENTROPY_HARDWARE_ALT
- CC=gcc cmake -D CMAKE_BUILD_TYPE:String=Asan -D UNSAFE_BUILD=ON .
- make
-
- msg "test: MBEDTLS_TEST_NULL_ENTROPY - main suites (inc. selftests) (ASan build)"
- make test
-}
-
component_test_no_date_time () {
msg "build: default config without MBEDTLS_HAVE_TIME_DATE"
scripts/config.py unset MBEDTLS_HAVE_TIME_DATE
diff --git a/tests/suites/helpers.function b/tests/suites/helpers.function
index 27d9249..2ef07fa 100644
--- a/tests/suites/helpers.function
+++ b/tests/suites/helpers.function
@@ -87,11 +87,10 @@
/* Indicates whether we expect mbedtls_entropy_init
* to initialize some strong entropy source. */
-#if defined(MBEDTLS_TEST_NULL_ENTROPY) || \
- ( !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) && \
- ( !defined(MBEDTLS_NO_PLATFORM_ENTROPY) || \
- defined(MBEDTLS_ENTROPY_HARDWARE_ALT) || \
- defined(ENTROPY_NV_SEED) ) )
+#if !defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) && \
+ ( !defined(MBEDTLS_NO_PLATFORM_ENTROPY) || \
+ defined(MBEDTLS_ENTROPY_HARDWARE_ALT) || \
+ defined(ENTROPY_NV_SEED) )
#define ENTROPY_HAVE_STRONG
#endif
diff --git a/tests/suites/test_suite_entropy.data b/tests/suites/test_suite_entropy.data
index 95bfe66..0b30bb8 100644
--- a/tests/suites/test_suite_entropy.data
+++ b/tests/suites/test_suite_entropy.data
@@ -83,9 +83,4 @@
entropy_nv_seed:"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
Entropy self test
-depends_on:!MBEDTLS_TEST_NULL_ENTROPY
entropy_selftest:0
-
-Entropy self test (MBEDTLS_TEST_NULL_ENTROPY)
-depends_on:MBEDTLS_TEST_NULL_ENTROPY
-entropy_selftest:1
diff --git a/tests/suites/test_suite_random.function b/tests/suites/test_suite_random.function
index 37fa36e..c532c8a 100644
--- a/tests/suites/test_suite_random.function
+++ b/tests/suites/test_suite_random.function
@@ -18,7 +18,7 @@
/* END_HEADER */
-/* BEGIN_CASE depends_on:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:MBEDTLS_CTR_DRBG_C */
+/* BEGIN_CASE depends_on:MBEDTLS_ENTROPY_C:MBEDTLS_CTR_DRBG_C */
void random_twice_with_ctr_drbg( )
{
mbedtls_entropy_context entropy;
@@ -57,7 +57,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_ENTROPY_C:!MBEDTLS_TEST_NULL_ENTROPY:MBEDTLS_HMAC_DRBG_C */
+/* BEGIN_CASE depends_on:MBEDTLS_ENTROPY_C:MBEDTLS_HMAC_DRBG_C */
void random_twice_with_hmac_drbg( int md_type )
{
mbedtls_entropy_context entropy;
@@ -97,7 +97,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:!MBEDTLS_TEST_NULL_ENTROPY:!MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
+/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:!MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
void random_twice_with_psa_from_classic( )
{
unsigned char output1[OUTPUT_SIZE];
@@ -123,7 +123,7 @@
}
/* END_CASE */
-/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:!MBEDTLS_TEST_NULL_ENTROPY:!MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
+/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C:!MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
void random_twice_with_psa_from_psa( )
{
unsigned char output1[OUTPUT_SIZE];
