Merge #126

126: Upgrading mbedtls to version 2.24.0 r=jethrogb a=raoulstrackx Upgrading mbedtls to latest version Co-authored-by: Raoul Strackx <[email protected]> Co-authored-by: Vardhan Thigle <[email protected]>
fortanix · Dec 3, 2020 · f82e140 · f82e140
2 parents c26a84e + d048b59
commit f82e140
Show file tree

Hide file tree

Showing 1,303 changed files with 78,951 additions and 195,571 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/mbedtls-sys/Cargo.toml b/mbedtls-sys/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mbedtls-sys-auto"
-version = "2.18.5"
+version = "2.24.0"
 authors = ["Jethro Beekman <[email protected]>"]
 build = "build/build.rs"
 license = "Apache-2.0/GPL-2.0+"

diff --git a/mbedtls-sys/build/build.rs b/mbedtls-sys/build/build.rs
@@ -16,7 +16,6 @@ mod mod_bindgen;
 #[path = "cmake.rs"]
 mod mod_cmake;
 
-use std::collections::HashMap;
 use std::env;
 use std::fs::File;
 use std::io::Write;
@@ -40,10 +39,7 @@ struct BuildConfig {
 impl BuildConfig {
     fn create_config_h(&self) {
         let target = env::var("TARGET").unwrap();
-        let mut defines = config::DEFAULT_DEFINES
-            .iter()
-            .cloned()
-            .collect::<HashMap<_, _>>();
+        let mut defines = config::default_defines();
         for &(feat, def) in config::FEATURE_DEFINES {
             if (feat == "std") && (target == "x86_64-fortanix-unknown-sgx") {
                 continue;
@@ -65,6 +61,9 @@ impl BuildConfig {
                 if have_feature("custom_threading") {
                     writeln!(f, "typedef void* mbedtls_threading_mutex_t;")?;
                 }
+                if have_feature("custom_time") {
+                    writeln!(f, "long long mbedtls_time(long long*);")?;
+                }
                 f.write_all(config::SUFFIX.as_bytes())
             })
             .expect("config.h I/O error");

diff --git a/mbedtls-sys/build/config.rs b/mbedtls-sys/build/config.rs
@@ -6,6 +6,8 @@
  * option. This file may not be copied, modified, or distributed except
  * according to those terms. */
 
+use std::collections::HashMap;
+
 #[derive(Copy, Clone, PartialEq, Eq)]
 pub enum Macro {
     Undefined,
@@ -63,7 +65,7 @@ for line in open('vendor/include/mbedtls/config.h').readlines():
 */
 
 #[cfg_attr(rustfmt, rustfmt_skip)]
-pub const DEFAULT_DEFINES: &'static [CDefine] = &[
+const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_HAVE_ASM",                                  Defined),
     ("MBEDTLS_NO_UDBL_DIVISION",                          Undefined),
     ("MBEDTLS_NO_64BIT_MULTIPLICATION",                   Undefined),
@@ -83,6 +85,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_DEPRECATED_WARNING",                        Undefined),
     ("MBEDTLS_DEPRECATED_REMOVED",                        Undefined),
     ("MBEDTLS_CHECK_PARAMS",                              Undefined),
+    ("MBEDTLS_CHECK_PARAMS_ASSERT",                       Undefined),
     ("MBEDTLS_TIMING_ALT",                                Undefined),
     ("MBEDTLS_AES_ALT",                                   Undefined),
     ("MBEDTLS_ARC4_ALT",                                  Undefined),
@@ -132,7 +135,6 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_ECP_RANDOMIZE_JAC_ALT",                     Undefined),
     ("MBEDTLS_ECP_ADD_MIXED_ALT",                         Undefined),
     ("MBEDTLS_ECP_DOUBLE_JAC_ALT",                        Undefined),
-    ("MBEDTLS_ECDH_LEGACY_CONTEXT",                       Defined),
     ("MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT",                Undefined),
     ("MBEDTLS_ECP_NORMALIZE_JAC_ALT",                     Undefined),
     ("MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT",                    Undefined),
@@ -153,6 +155,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS",              Defined),
     ("MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN",              Defined),
     ("MBEDTLS_CIPHER_PADDING_ZEROS",                      Defined),
+    ("MBEDTLS_CTR_DRBG_USE_128_BIT_KEY",                  Undefined),
     ("MBEDTLS_ENABLE_WEAK_CIPHERSUITES",                  Undefined),
     ("MBEDTLS_REMOVE_ARC4_CIPHERSUITES",                  Defined),
     ("MBEDTLS_REMOVE_3DES_CIPHERSUITES",                  Defined),
@@ -170,6 +173,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_ECP_DP_CURVE25519_ENABLED",                 Defined),
     ("MBEDTLS_ECP_DP_CURVE448_ENABLED",                   Defined),
     ("MBEDTLS_ECP_NIST_OPTIM",                            Defined),
+    ("MBEDTLS_ECP_NO_INTERNAL_RNG",                       Undefined),
     ("MBEDTLS_ECP_RESTARTABLE",                           Undefined),
     ("MBEDTLS_ECDH_LEGACY_CONTEXT",                       Defined),
     ("MBEDTLS_ECDSA_DETERMINISTIC",                       Undefined),
@@ -192,6 +196,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_NO_PLATFORM_ENTROPY",                       Defined),
     ("MBEDTLS_ENTROPY_FORCE_SHA256",                      Undefined),
     ("MBEDTLS_ENTROPY_NV_SEED",                           Undefined),
+    ("MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER",      Undefined),
     ("MBEDTLS_MEMORY_DEBUG",                              Undefined),
     ("MBEDTLS_MEMORY_BACKTRACE",                          Undefined),
     ("MBEDTLS_PK_RSA_ALT_SUPPORT",                        Defined),
@@ -202,9 +207,13 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_RSA_NO_CRT",                                Undefined),
     ("MBEDTLS_SELF_TEST",                                 Defined),
     ("MBEDTLS_SHA256_SMALLER",                            Undefined),
+    ("MBEDTLS_SHA512_SMALLER",                            Undefined),
+    ("MBEDTLS_SHA512_NO_SHA384",                          Undefined),
     ("MBEDTLS_SSL_ALL_ALERT_MESSAGES",                    Defined),
+    ("MBEDTLS_SSL_RECORD_CHECKING",                       Defined),
     ("MBEDTLS_SSL_DTLS_CONNECTION_ID",                    Undefined),
     ("MBEDTLS_SSL_ASYNC_PRIVATE",                         Undefined),
+    ("MBEDTLS_SSL_CONTEXT_SERIALIZATION",                 Defined),
     ("MBEDTLS_SSL_DEBUG_ALL",                             Undefined),
     ("MBEDTLS_SSL_ENCRYPT_THEN_MAC",                      Defined),
     ("MBEDTLS_SSL_EXTENDED_MASTER_SECRET",                Defined),
@@ -220,6 +229,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_SSL_PROTO_TLS1",                            Undefined),
     ("MBEDTLS_SSL_PROTO_TLS1_1",                          Undefined),
     ("MBEDTLS_SSL_PROTO_TLS1_2",                          Defined),
+    ("MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL",             Undefined),
     ("MBEDTLS_SSL_PROTO_DTLS",                            Defined),
     ("MBEDTLS_SSL_ALPN",                                  Defined),
     ("MBEDTLS_SSL_DTLS_ANTI_REPLAY",                      Defined),
@@ -231,6 +241,8 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_SSL_SERVER_NAME_INDICATION",                Defined),
     ("MBEDTLS_SSL_TRUNCATED_HMAC",                        Defined),
     ("MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT",                 Undefined),
+    ("MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH",                Undefined),
+    ("MBEDTLS_TEST_HOOKS",                                Undefined),
     ("MBEDTLS_THREADING_ALT",                             Undefined),
     ("MBEDTLS_THREADING_PTHREAD",                         Undefined),
     ("MBEDTLS_USE_PSA_CRYPTO",                            Undefined),
@@ -292,6 +304,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_PLATFORM_C",                                Undefined),
     ("MBEDTLS_POLY1305_C",                                Defined),
     ("MBEDTLS_PSA_CRYPTO_C",                              Undefined),
+    ("MBEDTLS_PSA_CRYPTO_SE_C",                           Undefined),
     ("MBEDTLS_PSA_CRYPTO_STORAGE_C",                      Undefined),
     ("MBEDTLS_PSA_ITS_FILE_C",                            Undefined),
     ("MBEDTLS_RIPEMD160_C",                               Defined),
@@ -363,6 +376,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_SSL_CID_IN_LEN_MAX",                        Undefined), // default: 32
     ("MBEDTLS_SSL_CID_OUT_LEN_MAX",                       Undefined), // default: 32
     ("MBEDTLS_SSL_CID_PADDING_GRANULARITY",               Undefined), // default: 16
+    ("MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY",            Undefined), // default: 1
     ("MBEDTLS_SSL_OUT_CONTENT_LEN",                       Undefined), // default: 16384
     ("MBEDTLS_SSL_DTLS_MAX_BUFFERING",                    Undefined), // default: 32768
     ("MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME",               Undefined), // default: 86400
@@ -375,14 +389,28 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
     ("MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE",    Defined),
     ("MBEDTLS_PLATFORM_ZEROIZE_ALT",                      Undefined),
     ("MBEDTLS_PLATFORM_GMTIME_R_ALT",                     Undefined),
+    ("MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED",              Undefined),
 ];
 
+pub fn default_defines() -> HashMap<&'static str, Macro> {
+    let mut defines = HashMap::new();
+
+    for (key, value) in DEFAULT_DEFINES.iter() {
+        if defines.insert(*key, *value).is_some() {
+            panic!("Duplicate default define in {}: {}", file!(), key);
+        }
+    }
+
+    defines
+}
+
 #[cfg_attr(rustfmt, rustfmt_skip)]
 pub const FEATURE_DEFINES: &'static [(&'static str, CDefine)] = &[
     ("time",                  ("MBEDTLS_HAVE_TIME",                         Defined)),
     ("time",                  ("MBEDTLS_HAVE_TIME_DATE",                    Defined)),
     ("time",                  ("MBEDTLS_TIMING_C",                          Defined)),
     ("custom_time",           ("MBEDTLS_PLATFORM_TIME_MACRO",               DefinedAs("mbedtls_time"))),
+    ("custom_time",           ("MBEDTLS_PLATFORM_TIME_TYPE_MACRO",          DefinedAs("long long"))),
     ("custom_gmtime_r",       ("MBEDTLS_PLATFORM_GMTIME_R_ALT",             Defined)),
     ("havege",                ("MBEDTLS_HAVEGE_C",                          Defined)),
     ("threading",             ("MBEDTLS_THREADING_C",                       Defined)),

diff --git a/mbedtls-sys/build/headers.rs b/mbedtls-sys/build/headers.rs
@@ -18,8 +18,8 @@ use crate::have_feature;
  *
  * ls -f1 $( \
  *  ( \
- *      grep '^#include' *|grep -v '<'|grep -v MBEDTLS_|sed 's/:#include//;s/"//g'|grep -v _alt.h; \
- *      ls *.h|awk '{print $1 " " $1}' \
+ *      grep '^#include' *|grep -v '<'|grep -v MBEDTLS_|sed 's/:#include//;s/"//g'|sed 's#mbedtls/##g'| egrep -v ' (psa/crypto.h|everest/everest.h|zlib.h|.*_alt.h)$'; \
+ *       ls *.h|awk '{print $1 " " $1}' \
  *  )|tsort|tac| \
  *  egrep -v '^(compat-1.3.h|certs.h|config.h|check_config.h)$' \
  * )

diff --git a/mbedtls-sys/src/types.rs b/mbedtls-sys/src/types.rs
@@ -90,18 +90,27 @@ extern crate libc;
 mod libc_types {
     pub use super::libc::FILE;
 
+    #[cfg(all(feature = "time", not(feature = "custom_time")))]
+    pub use super::libc::time_t;
+
+    #[cfg(feature = "custom_time")]
+    pub type time_t = super::raw_types::c_longlong;
+
     #[cfg(feature = "time")]
-    pub use super::libc::{time_t, tm};
+    pub use super::libc::tm;
 
 }
 
 #[cfg(not(feature = "libc"))]
 mod libc_types {
     pub enum FILE {}
 
-    #[cfg(feature = "time")]
+    #[cfg(all(feature = "time", not(feature = "custom_time")))]
     pub type time_t = i64;
 
+    #[cfg(feature = "custom_time")]
+    pub type time_t = super::raw_types::c_longlong;
+
     #[cfg(feature = "time")]
     #[repr(C)]
     pub struct tm {

diff --git a/mbedtls-sys/vendor/3rdparty/.gitignore b/mbedtls-sys/vendor/3rdparty/.gitignore
@@ -0,0 +1 @@
+/Makefile
diff --git a/mbedtls-sys/vendor/3rdparty/CMakeLists.txt b/mbedtls-sys/vendor/3rdparty/CMakeLists.txt
@@ -0,0 +1,17 @@
+list (APPEND thirdparty_src)
+list (APPEND thirdparty_lib)
+list (APPEND thirdparty_inc_public)
+list (APPEND thirdparty_inc)
+list (APPEND thirdparty_def)
+
+execute_process(COMMAND ${MBEDTLS_PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/config.py -f ${CMAKE_CURRENT_SOURCE_DIR}/../include/mbedtls/config.h get MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED RESULT_VARIABLE result)
+
+if(${result} EQUAL 0)
+    add_subdirectory(everest)
+endif()
+
+set(thirdparty_src ${thirdparty_src} PARENT_SCOPE)
+set(thirdparty_lib ${thirdparty_lib} PARENT_SCOPE)
+set(thirdparty_inc_public ${thirdparty_inc_public} PARENT_SCOPE)
+set(thirdparty_inc ${thirdparty_inc} PARENT_SCOPE)
+set(thirdparty_def ${thirdparty_def} PARENT_SCOPE)
diff --git a/mbedtls-sys/vendor/3rdparty/Makefile.inc b/mbedtls-sys/vendor/3rdparty/Makefile.inc
@@ -0,0 +1,2 @@
+THIRDPARTY_DIR = $(dir $(lastword $(MAKEFILE_LIST)))
+include $(THIRDPARTY_DIR)/everest/Makefile.inc
diff --git a/mbedtls-sys/vendor/3rdparty/everest/.gitignore b/mbedtls-sys/vendor/3rdparty/everest/.gitignore
@@ -0,0 +1,2 @@
+*.o
+Makefile
diff --git a/mbedtls-sys/vendor/3rdparty/everest/CMakeLists.txt b/mbedtls-sys/vendor/3rdparty/everest/CMakeLists.txt
@@ -0,0 +1,28 @@
+list (APPEND everest_src)
+list (APPEND everest_inc_public)
+list (APPEND everest_inc)
+list (APPEND everest_def)
+
+set(everest_src
+  ${CMAKE_CURRENT_SOURCE_DIR}/library/everest.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/library/x25519.c
+  ${CMAKE_CURRENT_SOURCE_DIR}/library/Hacl_Curve25519_joined.c
+)
+
+list(APPEND everest_inc_public ${CMAKE_CURRENT_SOURCE_DIR}/include)
+list(APPEND everest_inc ${CMAKE_CURRENT_SOURCE_DIR}/include/everest ${CMAKE_CURRENT_SOURCE_DIR}/include/everest/kremlib)
+
+if(INSTALL_MBEDTLS_HEADERS)
+
+  install(DIRECTORY include/everest
+    DESTINATION include
+    FILE_PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+    DIRECTORY_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
+    FILES_MATCHING PATTERN "*.h")
+
+endif(INSTALL_MBEDTLS_HEADERS)
+
+set(thirdparty_src ${thirdparty_src} ${everest_src} PARENT_SCOPE)
+set(thirdparty_inc_public ${thirdparty_inc_public} ${everest_inc_public} PARENT_SCOPE)
+set(thirdparty_inc ${thirdparty_inc} ${everest_inc} PARENT_SCOPE)
+set(thirdparty_def ${thirdparty_def} ${everest_def} PARENT_SCOPE)
diff --git a/mbedtls-sys/vendor/3rdparty/everest/Makefile.inc b/mbedtls-sys/vendor/3rdparty/everest/Makefile.inc
@@ -0,0 +1,6 @@
+THIRDPARTY_INCLUDES+=-I../3rdparty/everest/include -I../3rdparty/everest/include/everest -I../3rdparty/everest/include/everest/kremlib
+
+THIRDPARTY_CRYPTO_OBJECTS+= \
+	../3rdparty/everest/library/everest.o \
+	../3rdparty/everest/library/x25519.o \
+	../3rdparty/everest/library/Hacl_Curve25519_joined.o
diff --git a/mbedtls-sys/vendor/3rdparty/everest/README.md b/mbedtls-sys/vendor/3rdparty/everest/README.md
@@ -0,0 +1,5 @@
+The files in this directory stem from [Project Everest](https://project-everest.github.io/) and are distributed under the Apache 2.0 license.
+
+This is a formally verified implementation of Curve25519-based handshakes. The C code is automatically derived from the (verified) [original implementation](https://github.com/project-everest/hacl-star/tree/master/code/curve25519) in the [F* language](https://github.com/fstarlang/fstar) by [KreMLin](https://github.com/fstarlang/kremlin). In addition to the improved safety and security of the implementation, it is also significantly faster than the default implementation of Curve25519 in mbedTLS.
+
+The caveat is that not all platforms are supported, although the version in `everest/library/legacy` should work on most systems. The main issue is that some platforms do not provide a 128-bit integer type and KreMLin therefore has to use additional (also verified) code to simulate them, resulting in less of a performance gain overall. Explictly supported platforms are currently `x86` and `x86_64` using gcc or clang, and Visual C (2010 and later).
diff --git a/mbedtls-sys/vendor/3rdparty/everest/include/everest/Hacl_Curve25519.h b/mbedtls-sys/vendor/3rdparty/everest/include/everest/Hacl_Curve25519.h
@@ -0,0 +1,21 @@
+/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved.
+   Licensed under the Apache 2.0 License. */
+
+/* This file was generated by KreMLin <https://github.com/FStarLang/kremlin>
+ * KreMLin invocation: /mnt/e/everest/verify/kremlin/krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -fbuiltin-uint128 -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -I /mnt/e/everest/verify/hacl-star/code/lib/kremlin -I /mnt/e/everest/verify/kremlin/kremlib/compat -I /mnt/e/everest/verify/hacl-star/specs -I /mnt/e/everest/verify/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c
+ * F* version: 059db0c8
+ * KreMLin version: 916c37ac
+ */
+
+
+
+#ifndef __Hacl_Curve25519_H
+#define __Hacl_Curve25519_H
+
+
+#include "kremlib.h"
+
+void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint);
+
+#define __Hacl_Curve25519_H_DEFINED
+#endif
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		THIRDPARTY_DIR = $(dir $(lastword $(MAKEFILE_LIST)))
		include $(THIRDPARTY_DIR)/everest/Makefile.inc