Update mbedtls 2.18.0 rc1 #10675

0xc0170 · 2019-05-27T07:07:10Z

Description

Same as #10642, one additional revert to fix CI issue.

Pull request type

[X] Fix
[ ] Refactor
[ ] Target update
[ ] Functionality change
[ ] Docs update
[ ] Test update
[ ] Breaking change

Reviewers

Release Notes

Use Mbed Crypto implementations of crypto. For example, use aes.c from Mbed Crypto instead of the Mbed TLS copy.

When importing development releases of Mbed TLS into Mbed OS, it is useful to be able to know a the particular git commit hash that was imported. This change avoids ever creating a VERSION.txt for Mbed TLS containing only "development", which is fairly useless since one doesn't know where the development branch was at the time of import.

Do a git fetch of mbedtls instead of a pull. We don't need to checkout development, only the release specified.

When importing, after checking out the specified release, update any submodules present.

Update Mbed TLS to 2.18.0-rc1. Update Mbed Crypto to 1.1.0d0.

This reverts commit ff18a64. Use the official repository

0xc0170 · 2019-05-27T07:07:54Z

CI started

Patater

Ugh, what a confusing problem to track down. Nice find!

LGTM

mbed-ci · 2019-05-27T08:25:23Z

Test run: FAILED

Summary: 3 of 7 test jobs failed
Build number : 1
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_build-IAR
jenkins-ci/mbed-os-ci_build-ARM

0xc0170 · 2019-05-27T08:57:03Z

@k-stachowiak is looking at the failures

ciarmcom · 2019-05-27T09:00:49Z

@0xc0170, thank you for your changes.
@ARMmbed/mbed-os-tls @ARMmbed/mbed-os-crypto @ARMmbed/mbed-os-tools @ARMmbed/mbed-os-maintainers please review.

Use new TLS macro

0xc0170 · 2019-05-27T10:51:22Z

thanks to @orenc17 , found missing macro redefinition, locally the test passed. Restarting CI

0xc0170 · 2019-05-27T10:54:25Z

components/TARGET_PSA/services/crypto/COMPONENT_SPE/psa_crypto_partition.c

@@ -1479,7 +1479,7 @@ static void psa_entropy_operation(void)
            mbedtls_free(seed);
 #else
            status = PSA_ERROR_NOT_SUPPORTED;
-#endif /* MBEDTLS_ENTROPY_NV_SEED && MBEDTLS_PSA_HAS_ITS_IO*/
+#endif /* MBEDTLS_PSA_INJECT_ENTROPY */


I followed the change from this PR in another PSA file.

@Patater @k-stachowiak Is this correct?

Matches a change in features/mbedtls/mbed-crypto/platform/TARGET_PSA/COMPONENT_PSA_SRV_IMPL/psa_crypto.c

It makes sense to align the macros guarding APIs use with the macros guarding its definition. I haven't been following the development of this feature, but to me, this change looks correct.

I confirm that the compile-time guard for mbedtls_psa_inject_entropy has changed to MBEDTLS_PSA_INJECT_ENTROPY. I haven't reviewed the rest of the PR.

k-stachowiak

It may be advisable to wait for @Patater 's confirmation, but based on his approval up to this point, I approve the most recent commit, and therefore the PR.

gilles-peskine-arm · 2019-05-27T13:52:26Z

features/mbedtls/mbed-crypto/platform/TARGET_PSA/mbed_lib.json

@@ -1,4 +1,4 @@
 {
    "name": "mbed-crypto",
-    "macros": ["MBEDTLS_PSA_HAS_ITS_IO"]
+    "macros": ["MBEDTLS_PSA_INJECT_ENTROPY"]


To build Mbed Crypto with the entropy injection feature, you need:

Storage support in Mbed Crypto: MBEDTLS_PSA_CRYPTO_STORAGE_C must be enabled. This requirement already existed in Mbed OS 5.12 (Mbed Crypto 2.17).

ITS storage backend support in Mbed Crypto. In Mbed OS 5.12, this required MBEDTLS_PSA_HAS_ITS_IO. With Mbed Crypto 2.18, you don't need anything beyond MBEDTLS_PSA_CRYPTO_STORAGE_C, but you need to make sure that MBEDTLS_PSA_ITS_FILE_C is not enabled since Mbed OS comes with its own ITS storage implementation.

Entropy file support must be enabled, i.e. MBEDTLS_ENTROPY_NV_SEED must be defined. This requirement was already present before.

Default entropy sources must be disabled, i.e. MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES must be defined. This requirement was already present before.

MBEDTLS_PSA_INJECT_ENTROPY must be defined. Before, the feature was automatically enabled if both MBEDTLS_PSA_HAS_ITS_IO and MBEDTLS_ENTROPY_NV_SEED were enabled.

So I don't understand why it worked before. What caused MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES, MBEDTLS_ENTROPY_NV_SEED, and for that matter MBEDTLS_PSA_CRYPTO_STORAGE_C and ``MBEDTLS_PSA_CRYPTO_C` to be enabled? Any idea @k-stachowiak ?

I found that MBEDTLS_PSA_CRYPTO_STORAGE_C is enabled conditionally in features/mbedtls/platform/inc/platform_mbed.h. In this file, #define MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C is now obsolete, but harmless.

MBEDTLS_PSA_INJECT_ENTROPY should not be enabled by default for Mbed Crypto. It should only be enabled on targets that use this feature. In 5.12, it was automatically enabled on targets where TARGET_PSA and MBEDTLS_ENTROPY_NV_SEED were both enabled. It would have failed if such a target didn't also define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES, so I must still be missing something, because I can't see any place where this gets defined.

Now MBEDTLS_PSA_INJECT_ENTROPY needs to be enabled explicitly on the targets that want this feature. I don't know which targets want it. This has to be a subset of the targets where it works.

To make this more backward compatible with 5.12, it would be possible to enable the feature where it's supported by modifying the configuration at the end of features/mbedtls/platform/inc/platform_mbed.h:

/* Enable entropy injection if it is supported. */ #if defined(MBEDTLS_ENTROPY_NV_SEED) && \ defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) && \ defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) #define MBEDTLS_PSA_INJECT_ENTROPY #endif

But I don't think this is desirable, because this feature adds a few hundred bytes of code and increases the attack surface and the risk of misconfiguration that could lead to bricking a device.

I don't know the history of the aforementioned options beyond the fact that I have seen them being switched on and off in the past. However, based on this

MBEDTLS_PSA_INJECT_ENTROPY should not be enabled by default for Mbed Crypto

which makes sense to me, why don't we just remove the macro we are now commenting on?
Right now I'm testing that approach locally.

It builds with the feature switched off, but as far as I know, we actually need it in. Unfortunately, I don't know a simple way of enabling it without causing the trouble other than doing it for particular targets, as Gilles has mentioned earlier.

@alzix @orenc17 Any suggestions ?

I've come up with a short term fix in enabling the entropy injection API on PSA targets if the user or applications has chosen to enable NV Seed, only on PSA targets. This is compatible with Mbed OS 5.12.

Longer term, we need to implement entropy mixing in Mbed Crypto to support using both TRNG and NV Seed at the same time.

I've tested on NUCLEO_F429ZI, K64F, and CY8CKIT_062_WIFI_BT.

0xc0170 · 2019-05-28T10:05:06Z

If any new development, let me know. I can grant you access to my fork to keep this up to date (currently @k-stachowiak has it can push).

0xc0170 · 2019-05-28T10:29:42Z

CI started

Patater · 2019-05-28T10:30:14Z

Rebased to remove enabling PSA Entropy Injection unconditionally. Added commits to remove stale configuration options and to conditionally enable MBEDTLS_PSA_INJECT_ENTROPY for PSA targets if MBEDTLS_ENTROPY_NV_SEED is set.

mbed-ci · 2019-05-28T12:37:58Z

Test run: FAILED

Summary: 3 of 11 test jobs failed
Build number : 5
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_cloud-client-test
jenkins-ci/mbed-os-ci_greentea-test
jenkins-ci/mbed-os-ci_exporter

0xc0170 · 2019-05-28T12:38:42Z

CI restarted

Patater · 2019-05-28T12:39:53Z

Rebased to re-add the ITS configuration option (by dropping c044804), which PAL was depending on. Mbed Crypto no longer uses that option, and it shouldn't be necessary to depend on that option even if PAL needs to use ITS: PAL can assume if the target is PSA, that ITS is available.

0xc0170 · 2019-05-28T13:00:05Z

CI restarted

mbed-ci · 2019-05-28T13:03:16Z

Test run: FAILED

Summary: 6 of 7 test jobs failed
Build number : 6
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_mbed2-build-ARM
jenkins-ci/mbed-os-ci_mbed2-build-IAR
jenkins-ci/mbed-os-ci_build-IAR
jenkins-ci/mbed-os-ci_mbed2-build-GCC_ARM

mbed-ci · 2019-05-28T15:13:53Z

Test run: FAILED

Summary: 1 of 11 test jobs failed
Build number : 7
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_exporter

Patater · 2019-05-28T17:46:14Z

CI was unable to get a license when building one of the files (ecdh.c) during the exporter test. This made it look like an error from Mbed Crypto at first glance, but we also see the following in the log, which caused the build of that file to fail.

Unable to connect to the license server. Check that ARMLMD_LICENSE_FILE is set correctly, and the license server is available.```

cmonr · 2019-05-28T18:05:49Z

CI job restarted: jenkins-ci/mbed-os-ci_exporter

0xc0170 · 2019-05-28T19:24:09Z

Ready for integration

Patater and others added 6 commits May 23, 2019 12:27

mbedtls: Source crypto from Mbed Crypto

e3d1e27

Use Mbed Crypto implementations of crypto. For example, use aes.c from Mbed Crypto instead of the Mbed TLS copy.

mbedtls: Fetch instead of pull

ce2de9a

Do a git fetch of mbedtls instead of a pull. We don't need to checkout development, only the release specified.

mbedtls: Update submodules after checkout

2626179

When importing, after checking out the specified release, update any submodules present.

mbedtls: Update to Mbed TLS 2.18.0-rc1

60252b9

Update Mbed TLS to 2.18.0-rc1. Update Mbed Crypto to 1.1.0d0.

Revert "Check mbed-crypto-example with fork"

eebc1b9

This reverts commit ff18a64. Use the official repository

0xc0170 added needs: CI release-version: 5.13.0-rc1 labels May 27, 2019

0xc0170 requested a review from Patater May 27, 2019 07:08

Patater approved these changes May 27, 2019

View reviewed changes

0xc0170 added needs: work and removed needs: CI labels May 27, 2019

ciarmcom requested review from a team May 27, 2019 09:00

ciarmcom added the needs: review label May 27, 2019

0xc0170 removed the needs: review label May 27, 2019

0xc0170 removed request for a team May 27, 2019 10:36

SPE: fix inject entropy macro

303d0f0

Use new TLS macro

0xc0170 commented May 27, 2019

View reviewed changes

k-stachowiak approved these changes May 27, 2019

View reviewed changes

0xc0170 requested a review from Patater May 27, 2019 11:13

0xc0170 mentioned this pull request May 27, 2019

Update Mbed TLS to 2.18.0 #10642

Closed

gilles-peskine-arm reviewed May 27, 2019

View reviewed changes

0xc0170 added needs: work and removed needs: review labels May 28, 2019

Update Mbed TLS feature to 2.18.0-rc2

948d437

Patater force-pushed the update-mbedtls-2.18.0-rc1 branch from be696bb to 473b4ce Compare May 28, 2019 10:28

0xc0170 added needs: CI needs: work and removed needs: work needs: CI labels May 28, 2019

Patater force-pushed the update-mbedtls-2.18.0-rc1 branch from 473b4ce to 84e0b12 Compare May 28, 2019 12:36

0xc0170 added needs: CI and removed needs: work labels May 28, 2019

Patater force-pushed the update-mbedtls-2.18.0-rc1 branch from 84e0b12 to 948d437 Compare May 28, 2019 12:55

0xc0170 added ready for merge and removed needs: CI labels May 28, 2019

0xc0170 merged commit 8fc2a3c into ARMmbed:master May 28, 2019

0xc0170 removed the ready for merge label May 28, 2019

Update mbedtls 2.18.0 rc1 #10675

Update mbedtls 2.18.0 rc1 #10675

Uh oh!

Conversation

0xc0170 commented May 27, 2019

Description

Pull request type

Reviewers

Release Notes

Uh oh!

0xc0170 commented May 27, 2019

Uh oh!

Patater left a comment

Choose a reason for hiding this comment

Uh oh!

mbed-ci commented May 27, 2019

Uh oh!

0xc0170 commented May 27, 2019

Uh oh!

ciarmcom commented May 27, 2019

Uh oh!

0xc0170 commented May 27, 2019

Uh oh!

0xc0170 May 27, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

0xc0170 May 27, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k-stachowiak left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k-stachowiak May 27, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

0xc0170 commented May 28, 2019

Uh oh!

0xc0170 commented May 28, 2019

Uh oh!

Patater commented May 28, 2019

Uh oh!

mbed-ci commented May 28, 2019

Uh oh!

0xc0170 commented May 28, 2019

Uh oh!

Patater commented May 28, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

0xc0170 commented May 28, 2019

Uh oh!

mbed-ci commented May 28, 2019

Uh oh!

mbed-ci commented May 28, 2019

Uh oh!

Patater commented May 28, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cmonr commented May 28, 2019

Uh oh!

0xc0170 commented May 28, 2019

Uh oh!

0xc0170 May 27, 2019 •

edited

Loading

0xc0170 May 27, 2019 •

edited

Loading

k-stachowiak May 27, 2019 •

edited

Loading

Patater commented May 28, 2019 •

edited

Loading

Patater commented May 28, 2019 •

edited

Loading