Merge branch 'development-restricted' into iotssl-1306-rsa-is-vulnerable-to-bellcore-glitch-attack
This commit is contained in:
Hanno Becker
commit
a3389ebb09
474 changed files with 22132 additions and 5529 deletions
|
|
@ -46,7 +46,7 @@ my $config_file = "include/mbedtls/config.h";
|
|||
my $usage = <<EOU;
|
||||
$0 [-f <file> | --file <file>] [-o | --force]
|
||||
[set <symbol> <value> | unset <symbol> | get <symbol> |
|
||||
full | realfull]
|
||||
full | realfull | baremetal]
|
||||
|
||||
Commands
|
||||
set <symbol> [<value>] - Uncomments or adds a #define for the <symbol> to
|
||||
|
|
@ -57,13 +57,14 @@ Commands
|
|||
unset <symbol> - Comments out the #define for the given symbol if
|
||||
present in the configuration file.
|
||||
get <symbol> - Finds the #define for the given symbol, returning
|
||||
an exitcode of 0 if the symbol is found, and -1 if
|
||||
an exitcode of 0 if the symbol is found, and 1 if
|
||||
not. The value of the symbol is output if one is
|
||||
specified in the configuration file.
|
||||
full - Uncomments all #define's in the configuration file
|
||||
excluding some reserved symbols, until the
|
||||
'Module configuration options' section
|
||||
realfull - Uncomments all #define's with no exclusions
|
||||
baremetal - Sets full configuration suitable for baremetal build.
|
||||
|
||||
Options
|
||||
-f | --file <filename> - The file or file path for the configuration file
|
||||
|
|
@ -93,14 +94,38 @@ MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
|
|||
MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
|
||||
MBEDTLS_ZLIB_SUPPORT
|
||||
MBEDTLS_PKCS11_C
|
||||
MBEDTLS_NO_UDBL_DIVISION
|
||||
_ALT\s*$
|
||||
);
|
||||
|
||||
# Things that should be disabled in "baremetal"
|
||||
my @excluded_baremetal = qw(
|
||||
MBEDTLS_NET_C
|
||||
MBEDTLS_TIMING_C
|
||||
MBEDTLS_FS_IO
|
||||
MBEDTLS_ENTROPY_NV_SEED
|
||||
MBEDTLS_HAVE_TIME
|
||||
MBEDTLS_HAVE_TIME_DATE
|
||||
MBEDTLS_DEPRECATED_WARNING
|
||||
MBEDTLS_HAVEGE_C
|
||||
MBEDTLS_THREADING_C
|
||||
MBEDTLS_THREADING_PTHREAD
|
||||
MBEDTLS_MEMORY_BACKTRACE
|
||||
MBEDTLS_MEMORY_BUFFER_ALLOC_C
|
||||
MBEDTLS_PLATFORM_TIME_ALT
|
||||
MBEDTLS_PLATFORM_FPRINTF_ALT
|
||||
);
|
||||
|
||||
# Things that should be enabled in "full" even if they match @excluded
|
||||
my @non_excluded = qw(
|
||||
PLATFORM_[A-Z0-9]+_ALT
|
||||
);
|
||||
|
||||
# Things that should be enabled in "baremetal"
|
||||
my @non_excluded_baremetal = qw(
|
||||
MBEDTLS_NO_PLATFORM_ENTROPY
|
||||
);
|
||||
|
||||
# Process the command line arguments
|
||||
|
||||
my $force_option = 0;
|
||||
|
|
@ -125,7 +150,7 @@ while ($arg = shift) {
|
|||
# ...else assume it's a command
|
||||
$action = $arg;
|
||||
|
||||
if ($action eq "full" || $action eq "realfull") {
|
||||
if ($action eq "full" || $action eq "realfull" || $action eq "baremetal" ) {
|
||||
# No additional parameters
|
||||
die $usage if @ARGV;
|
||||
|
||||
|
|
@ -168,7 +193,12 @@ open my $config_read, '<', $config_file or die "read $config_file: $!\n";
|
|||
my @config_lines = <$config_read>;
|
||||
close $config_read;
|
||||
|
||||
my ($exclude_re, $no_exclude_re);
|
||||
# Add required baremetal symbols to the list that is included.
|
||||
if ( $action eq "baremetal" ) {
|
||||
@non_excluded = ( @non_excluded, @non_excluded_baremetal );
|
||||
}
|
||||
|
||||
my ($exclude_re, $no_exclude_re, $exclude_baremetal_re);
|
||||
if ($action eq "realfull") {
|
||||
$exclude_re = qr/^$/;
|
||||
$no_exclude_re = qr/./;
|
||||
|
|
@ -176,22 +206,30 @@ if ($action eq "realfull") {
|
|||
$exclude_re = join '|', @excluded;
|
||||
$no_exclude_re = join '|', @non_excluded;
|
||||
}
|
||||
if ( $action eq "baremetal" ) {
|
||||
$exclude_baremetal_re = join '|', @excluded_baremetal;
|
||||
}
|
||||
|
||||
open my $config_write, '>', $config_file or die "write $config_file: $!\n";
|
||||
my $config_write = undef;
|
||||
if ($action ne "get") {
|
||||
open $config_write, '>', $config_file or die "write $config_file: $!\n";
|
||||
}
|
||||
|
||||
my $done;
|
||||
for my $line (@config_lines) {
|
||||
if ($action eq "full" || $action eq "realfull") {
|
||||
if ($action eq "full" || $action eq "realfull" || $action eq "baremetal" ) {
|
||||
if ($line =~ /name SECTION: Module configuration options/) {
|
||||
$done = 1;
|
||||
}
|
||||
|
||||
if (!$done && $line =~ m!^//\s?#define! &&
|
||||
( $line !~ /$exclude_re/ || $line =~ /$no_exclude_re/ ) ) {
|
||||
( $line !~ /$exclude_re/ || $line =~ /$no_exclude_re/ ) &&
|
||||
( $action ne "baremetal" || ( $line !~ /$exclude_baremetal_re/ ) ) ) {
|
||||
$line =~ s!^//\s?!!;
|
||||
}
|
||||
if (!$done && $line =~ m!^\s?#define! &&
|
||||
! ( $line !~ /$exclude_re/ || $line =~ /$no_exclude_re/ ) ) {
|
||||
! ( ( $line !~ /$exclude_re/ || $line =~ /$no_exclude_re/ ) &&
|
||||
( $action ne "baremetal" || ( $line !~ /$exclude_baremetal_re/ ) ) ) ) {
|
||||
$line =~ s!^!//!;
|
||||
}
|
||||
} elsif ($action eq "unset") {
|
||||
|
|
@ -207,17 +245,19 @@ for my $line (@config_lines) {
|
|||
$done = 1;
|
||||
}
|
||||
} elsif (!$done && $action eq "get") {
|
||||
if ($line =~ /^\s*#define\s*$name\s*(.*)\s*\b/) {
|
||||
if ($line =~ /^\s*#define\s*$name(?:\s+(.*?))\s*(?:$|\/\*|\/\/)/) {
|
||||
$value = $1;
|
||||
$done = 1;
|
||||
}
|
||||
}
|
||||
|
||||
print $config_write $line;
|
||||
if (defined $config_write) {
|
||||
print $config_write $line or die "write $config_file: $!\n";
|
||||
}
|
||||
}
|
||||
|
||||
# Did the set command work?
|
||||
if ($action eq "set"&& $force_option && !$done) {
|
||||
if ($action eq "set" && $force_option && !$done) {
|
||||
|
||||
# If the force option was set, append the symbol to the end of the file
|
||||
my $line = "#define $name";
|
||||
|
|
@ -225,20 +265,22 @@ if ($action eq "set"&& $force_option && !$done) {
|
|||
$line .= "\n";
|
||||
$done = 1;
|
||||
|
||||
print $config_write $line;
|
||||
print $config_write $line or die "write $config_file: $!\n";
|
||||
}
|
||||
|
||||
close $config_write;
|
||||
if (defined $config_write) {
|
||||
close $config_write or die "close $config_file: $!\n";
|
||||
}
|
||||
|
||||
if ($action eq "get") {
|
||||
if($done) {
|
||||
if ($done) {
|
||||
if ($value ne '') {
|
||||
print $value;
|
||||
print "$value\n";
|
||||
}
|
||||
exit 0;
|
||||
} else {
|
||||
# If the symbol was not found, return an error
|
||||
exit -1;
|
||||
exit 1;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -24,6 +24,7 @@
|
|||
<ItemGroup>
|
||||
<ProjectReference Include="mbedTLS.vcxproj">
|
||||
<Project>{46cf2d25-6a36-4189-b59c-e4815388e554}</Project>
|
||||
<LinkLibraryDependencies>true</LinkLibraryDependencies>
|
||||
</ProjectReference>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
|
|
@ -100,7 +101,7 @@
|
|||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<ShowProgress>NotSet</ShowProgress>
|
||||
<AdditionalDependencies>kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);mbedTLS.lib</AdditionalDependencies>
|
||||
<AdditionalDependencies>kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>Debug</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
<ProjectReference>
|
||||
|
|
@ -120,7 +121,7 @@
|
|||
<SubSystem>Console</SubSystem>
|
||||
<GenerateDebugInformation>true</GenerateDebugInformation>
|
||||
<ShowProgress>NotSet</ShowProgress>
|
||||
<AdditionalDependencies>kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);mbedTLS.lib</AdditionalDependencies>
|
||||
<AdditionalDependencies>kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
<AdditionalLibraryDirectories>Debug</AdditionalLibraryDirectories>
|
||||
</Link>
|
||||
<ProjectReference>
|
||||
|
|
@ -144,7 +145,7 @@
|
|||
<EnableCOMDATFolding>true</EnableCOMDATFolding>
|
||||
<OptimizeReferences>true</OptimizeReferences>
|
||||
<AdditionalLibraryDirectories>Release</AdditionalLibraryDirectories>
|
||||
<AdditionalDependencies>kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies);mbedTLS.lib</AdditionalDependencies>
|
||||
<AdditionalDependencies>kernel32.lib;user32.lib;gdi32.lib;winspool.lib;comdlg32.lib;advapi32.lib;shell32.lib;ole32.lib;oleaut32.lib;uuid.lib;odbc32.lib;odbccp32.lib;%(AdditionalDependencies)</AdditionalDependencies>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
|
|
|
|||
|
|
@ -2,8 +2,8 @@
|
|||
expression x, y;
|
||||
statement S;
|
||||
@@
|
||||
x = mbedtls_malloc(...);
|
||||
y = mbedtls_malloc(...);
|
||||
x = mbedtls_calloc(...);
|
||||
y = mbedtls_calloc(...);
|
||||
...
|
||||
* if (x == NULL || y == NULL)
|
||||
S
|
||||
|
|
@ -13,8 +13,8 @@ expression x, y;
|
|||
statement S;
|
||||
@@
|
||||
if (
|
||||
* (x = mbedtls_malloc(...)) == NULL
|
||||
* (x = mbedtls_calloc(...)) == NULL
|
||||
||
|
||||
* (y = mbedtls_malloc(...)) == NULL
|
||||
* (y = mbedtls_calloc(...)) == NULL
|
||||
)
|
||||
S
|
||||
|
|
|
|||
|
|
@ -29,13 +29,14 @@ if( @ARGV ) {
|
|||
|
||||
my $error_format_file = $data_dir.'/error.fmt';
|
||||
|
||||
my @low_level_modules = ( "AES", "ASN1", "BLOWFISH", "CAMELLIA", "BIGNUM",
|
||||
"BASE64", "XTEA", "PBKDF2", "OID",
|
||||
"PADLOCK", "DES", "NET", "CTR_DRBG", "ENTROPY",
|
||||
"HMAC_DRBG", "MD2", "MD4", "MD5", "RIPEMD160",
|
||||
"SHA1", "SHA256", "SHA512", "GCM", "THREADING", "CCM" );
|
||||
my @high_level_modules = ( "PEM", "X509", "DHM", "RSA", "ECP", "MD", "CIPHER", "SSL",
|
||||
"PK", "PKCS12", "PKCS5" );
|
||||
my @low_level_modules = qw( AES ARC4 ASN1 BASE64 BIGNUM BLOWFISH
|
||||
CAMELLIA CCM CMAC CTR_DRBG DES
|
||||
ENTROPY GCM HMAC_DRBG MD2 MD4 MD5
|
||||
NET OID PADLOCK PBKDF2 RIPEMD160
|
||||
SHA1 SHA256 SHA512 THREADING XTEA );
|
||||
my @high_level_modules = qw( CIPHER DHM ECP MD
|
||||
PEM PK PKCS12 PKCS5
|
||||
RSA SSL X509 );
|
||||
|
||||
my $line_separator = $/;
|
||||
undef $/;
|
||||
|
|
|
|||
|
|
@ -1,70 +0,0 @@
|
|||
#!/usr/bin/perl
|
||||
|
||||
# Check for malloc calls not shortly followed by initialisation.
|
||||
#
|
||||
# Known limitations:
|
||||
# - false negative: can't see allocations spanning more than one line
|
||||
# - possible false negatives, see patterns
|
||||
# - false positive: malloc-malloc-init-init is not accepted
|
||||
# - false positives: "non-standard" init functions (eg, the things being
|
||||
# initialised is not the first arg, or initialise struct members)
|
||||
#
|
||||
# Since false positives are expected, the results must be manually reviewed.
|
||||
#
|
||||
# Typical usage: scripts/malloc-init.pl library/*.c
|
||||
|
||||
use warnings;
|
||||
use strict;
|
||||
|
||||
use utf8;
|
||||
use open qw(:std utf8);
|
||||
|
||||
my $limit = 7;
|
||||
my $inits = qr/memset|memcpy|_init|fread|base64_..code/;
|
||||
|
||||
# cases to bear in mind:
|
||||
#
|
||||
# 0. foo = malloc(...); memset( foo, ... );
|
||||
# 1. *foo = malloc(...); memset( *foo, ... );
|
||||
# 2. type *foo = malloc(...); memset( foo, ...);
|
||||
# 3. foo = malloc(...); foo_init( (type *) foo );
|
||||
# 4. foo = malloc(...); for(i=0..n) { init( &foo[i] ); }
|
||||
#
|
||||
# The chosen patterns are a bit relaxed, but unlikely to cause false positives
|
||||
# in real code (initialising *foo or &foo instead of foo will likely be caught
|
||||
# by functional tests).
|
||||
#
|
||||
my $id = qr/([a-zA-Z-0-9_\->\.]*)/;
|
||||
my $prefix = qr/\s(?:\*?|\&?|\([a-z_]* \*\))\s*/;
|
||||
|
||||
my $name;
|
||||
my $line;
|
||||
my @bad;
|
||||
|
||||
die "Usage: $0 file.c [...]\n" unless @ARGV;
|
||||
|
||||
while (my $file = shift @ARGV)
|
||||
{
|
||||
open my $fh, "<", $file or die "read $file failed: $!\n";
|
||||
while (<$fh>)
|
||||
{
|
||||
if( /mbedtls_malloc\(/ ) {
|
||||
if( /$id\s*=.*mbedtls_malloc\(/ ) {
|
||||
push @bad, "$file:$line:$name" if $name;
|
||||
$name = $1;
|
||||
$line = $.;
|
||||
} else {
|
||||
push @bad, "$file:$.:???" unless /return mbedtls_malloc/;
|
||||
}
|
||||
} elsif( $name && /(?:$inits)\($prefix\Q$name\E\b/ ) {
|
||||
undef $name;
|
||||
} elsif( $name && $. - $line > $limit ) {
|
||||
push @bad, "$file:$line:$name";
|
||||
undef $name;
|
||||
undef $line;
|
||||
}
|
||||
}
|
||||
close $fh or die;
|
||||
}
|
||||
|
||||
print "$_\n" for @bad;
|
||||
7
scripts/rm-calloc-cast.cocci
Normal file
7
scripts/rm-calloc-cast.cocci
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
@rm_calloc_cast@
|
||||
expression x, n, m;
|
||||
type T;
|
||||
@@
|
||||
x =
|
||||
- (T *)
|
||||
mbedtls_calloc(n, m)
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
@rm_malloc_cast@
|
||||
expression x, n;
|
||||
type T;
|
||||
@@
|
||||
x =
|
||||
- (T *)
|
||||
mbedtls_malloc(n)
|
||||
Loading…
Add table
Add a link
Reference in a new issue