Update to mbedtls 2.18.0rc3 #10802

Patater · 2019-06-10T16:31:29Z

Description

Update Mbed TLS to 2.18.0 rc3 and make Mbed OS specific modifications to allow all Mbed TLS DRBGs to use Mbed Crypto's PSA Entropy Injection feature.

Fixes #10787
Fixes #10788

Pull request type

[X] Fix
[ ] Refactor
[ ] Target update
[ ] Functionality change
[ ] Docs update
[ ] Test update
[ ] Breaking change

Reviewers

@teetak01

CC @JanneKiiskila

Patater · 2019-06-10T16:32:21Z

@ARMmbed/mbed-os-maintainers Should we close #10801 in favor of this? or is testing far enough along that we should merge #10801 first?

If we merge #10801 first, I'll rebase this PR on top.

ciarmcom · 2019-06-10T17:00:37Z

@Patater, thank you for your changes.
@JanneKiiskila @teetak01 @ARMmbed/mbed-os-crypto @ARMmbed/mbed-os-tls @ARMmbed/mbed-os-maintainers please review.

0xc0170 · 2019-06-11T06:27:45Z

Let's focus on this one. I've initially thought these 2 PRs are separate (was wondering why). I'll review and CI this one rather

0xc0170 · 2019-06-11T06:30:18Z

what rc3 and rc4 are fixing, to get these details I need to go to mbedtls ?

0xc0170 · 2019-06-11T06:31:23Z

Ci started

teetak01

Thanks @Patater

I verified that this fixes both the #10787 and #10788

bulislaw

Approved for rc3

mbed-ci · 2019-06-11T09:42:34Z

Test run: SUCCESS

Summary: 11 of 11 test jobs passed
Build number : 1
Build artifacts

Patater · 2019-06-11T09:57:48Z

Please wait for crypto team review before merge.

adbridge · 2019-06-11T11:03:17Z

Please wait for crypto team review before merge.

@Patater I would like to generate RC3 this afternoon so any chance we can prioritise this review (if not already happening) ?

When using Mbed Crypto's PSA Entropy Injection feature on Mbed OS, it is not required to opt out of having entropy sources added to your entropy contexts by default (via MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES). As integrated in Mbed OS, MBEDTLS_PSA_INJECT_ENTROPY is compatible with actual entropy sources. PSA entropy injection is implemented using the standard Mbed TLS NV Seed feature, and is as compatible with other entropy sources as the standard Mbed TLS NV Seed feature which does support entropy mixing.

Patater · 2019-06-11T11:45:21Z

Force pushed to remove rc4 version tag, as this version does not exist. The changes made to allow PSA entropy to be compatible with other entropy sources are Mbed OS only changes.

yanesca

LGTM

adbridge · 2019-06-11T13:19:11Z

CI started

TeroJaasko · 2019-06-11T15:09:49Z

This brings in dozens of warnings for PSA related macro redefinitions. Testing with mbed-os-example-blinky, GCC and K64F.

Compile [ 14.5%]: pal_client_api_empty_intf.c
[Warning] pal_client_api_intf.h@35,0: "PSA_SUCCESS" redefined
Compile [ 14.6%]: pal_client_api_intf.c
Compile [ 14.7%]: DeviceKey.cpp
Compile [ 14.9%]: pal_internal_trusted_storage_intf.c
[Warning] pal_internal_trusted_storage_intf.c@45,9: 'psa_its_set' is deprecated: PS specific types should not be used [-Wdeprecated-declarations]
Compile [ 15.3%]: val_attestation.c
[Warning] client.h@40,0: "PSA_VERSION_NONE" redefined
<..>
Compile [ 33.3%]: asn1parse.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 33.5%]: aes.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 33.6%]: asn1write.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 33.7%]: psa_crypto.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 33.8%]: blowfish.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 33.9%]: camellia.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 34.0%]: base64.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 34.2%]: ccm.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 34.3%]: chacha20.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 34.4%]: chachapoly.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 34.5%]: cipher_wrap.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 34.6%]: cmac.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 34.7%]: cipher.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 34.9%]: bignum.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 35.0%]: des.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 35.1%]: dhm.c
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 35.2%]: ctr_drbg.c
<..>
Compile [ 70.9%]: EthernetInterface.cpp
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 71.0%]: InternetSocket.cpp
Compile [ 71.1%]: L3IPInterface.cpp
[Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined
Compile [ 71.2%]: NetworkInterface.cpp

Patater · 2019-06-11T15:20:01Z

@TeroJaasko

I believe that's a pre-existing issue, tracked by internal reference https://jira.arm.com/browse/IOTCRYPT-783

Patater · 2019-06-11T15:27:16Z

@TeroJaasko I've added a commit to eliminate the warnings.

Would be nice to have Mbed OS build with -Werror...

cmonr · 2019-06-11T15:30:58Z

CI started

mbed-ci · 2019-06-11T16:50:44Z

Test run: FAILED

Summary: 1 of 11 test jobs failed
Build number : 2
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_greentea-test

adbridge · 2019-06-11T17:06:41Z

Test failure could be from the previous run

Patater · 2019-06-11T17:14:11Z

@adbridge

Yes, failures are from run 2. Run 3 is currently ongoing.

The run 2 failures appear to be assertion failures during filesystem tests on K66F. Have we seen that before?

mbedgt: test suite report:
| target       | platform_name | test suite                                                                   | result | elapsed_time (sec) | copy_method |
|--------------|---------------|------------------------------------------------------------------------------|--------|--------------------|-------------|
| K66F-GCC_ARM | K66F          | components-storage-blockdevice-component_sd-tests-filesystem-dirs            | OK     | 86.94              | default     |
| K66F-GCC_ARM | K66F          | components-storage-blockdevice-component_sd-tests-filesystem-files           | FAIL   | 76.97              | default     |
| K66F-GCC_ARM | K66F          | components-storage-blockdevice-component_sd-tests-filesystem-fopen           | OK     | 93.23              | default     |
| K66F-GCC_ARM | K66F          | components-storage-blockdevice-component_sd-tests-filesystem-parallel        | FAIL   | 77.57              | default     |

adbridge · 2019-06-11T17:35:12Z

@adbridge

Yes, failures are from run 2. Run 3 is currently ongoing.

The run 2 failures appear to be assertion failures during filesystem tests on K66F. Have we seen that before?

We get a few 'random' ci failures due to boards in a bad state etc, so it may have been seen previously. Probably not something to worry about if run 3 passes ok.

mbed-ci · 2019-06-11T17:51:46Z

Test run: FAILED

Summary: 3 of 7 test jobs failed
Build number : 3
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_build-IAR

0xc0170 · 2019-06-12T05:46:49Z

Test failed above but then CI posted build failures (nothing in the logs, not on VPN to verify the hooks). Restart?

mbed-ci · 2019-06-12T09:15:35Z

Test run: FAILED

Summary: 3 of 7 test jobs failed
Build number : 4
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-ARM
jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_build-IAR

Patater · 2019-06-12T10:16:50Z

Updated to to fix its test failures hopefully. Re-added the definition of MBEDTLS_PSA_CRYPTO_C for PSA SPE targets as it appears that some files (not sure which yet) used by PSA SPE targets are not including the mbedtls/config.h as they should.

adbridge · 2019-06-12T10:33:27Z

CI restarted

adbridge · 2019-06-12T11:33:24Z

@Patater looks like a couple more valid failures

gilles-peskine-arm

LGTM but I didn't review the configuration changes on each platform individually.

Mbed TLS now enables PSA APIs by default on all targets. It's not necessary to explicitly enable MBEDTLS_PSA_CRYPTO_C, as that can be gotten from the Mbed TLS config.h. However, many PSA targets depend on `-DMBEDTLS_PSA_CRYPTO_C` being defined by the Mbed OS json configuration system and are not yet properly including the Mbed TLS configuration; for these PSA targets, warnings may remain until this issue is fixed. Avoiding re-definition will eliminate warnings like the following, when building mbed-os-example-blinky: Compile [ 14.5%]: pal_client_api_empty_intf.c [Warning] pal_client_api_intf.h@35,0: "PSA_SUCCESS" redefined Compile [ 14.6%]: pal_client_api_intf.c Compile [ 14.7%]: DeviceKey.cpp Compile [ 14.9%]: pal_internal_trusted_storage_intf.c [Warning] pal_internal_trusted_storage_intf.c@45,9: 'psa_its_set' is deprecated: PS specific types should not be used [-Wdeprecated-declarations] Compile [ 15.3%]: val_attestation.c [Warning] client.h@40,0: "PSA_VERSION_NONE" redefined <..> Compile [ 33.3%]: asn1parse.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 33.5%]: aes.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 33.6%]: asn1write.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 33.7%]: psa_crypto.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 33.8%]: blowfish.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 33.9%]: camellia.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 34.0%]: base64.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 34.2%]: ccm.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 34.3%]: chacha20.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 34.4%]: chachapoly.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 34.5%]: cipher_wrap.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 34.6%]: cmac.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 34.7%]: cipher.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 34.9%]: bignum.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 35.0%]: des.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 35.1%]: dhm.c [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 35.2%]: ctr_drbg.c <..> Compile [ 70.9%]: EthernetInterface.cpp [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 71.0%]: InternetSocket.cpp Compile [ 71.1%]: L3IPInterface.cpp [Warning] config.h@2838,0: "MBEDTLS_PSA_CRYPTO_C" redefined Compile [ 71.2%]: NetworkInterface.cpp

Patater · 2019-06-12T11:50:33Z

Updated to re-add MBEDTLS_PSA_CRYPTO_C via targets.json, as many PSA targets, both SPE and NSPE, are depending on -DMBEDTLS_PSA_CRYPTO_C being defined by the Mbed OS configuration system instead of using the Mbed TLS config.h.

adbridge · 2019-06-12T11:54:23Z

Ci started

mbed-ci · 2019-06-12T12:04:34Z

Test run: FAILED

Summary: 4 of 7 test jobs failed
Build number : 5
Build artifacts

Failed test jobs:

jenkins-ci/mbed-os-ci_build-IAR
jenkins-ci/mbed-os-ci_build-GCC_ARM
jenkins-ci/mbed-os-ci_mbed2-build-IAR
jenkins-ci/mbed-os-ci_build-ARM

mbed-ci · 2019-06-12T14:11:18Z

Test run: SUCCESS

Summary: 11 of 11 test jobs passed
Build number : 6
Build artifacts

Patater added 2 commits June 10, 2019 09:55

mbedtls: Update to Mbed Crypto 1.1.0d2

03b2c53

mbedtls: Update to Mbed TLS 2.18.0-rc3

4917b10

ciarmcom requested review from JanneKiiskila, teetak01 and a team June 10, 2019 17:00

ciarmcom added the needs: review label Jun 10, 2019

0xc0170 mentioned this pull request Jun 11, 2019

Update to mbedtls 2.18.0rc3 #10801

Closed

0xc0170 added the release-version: 5.13.0-rc3 label Jun 11, 2019

0xc0170 approved these changes Jun 11, 2019

View reviewed changes

teetak01 approved these changes Jun 11, 2019

View reviewed changes

bulislaw approved these changes Jun 11, 2019

View reviewed changes

Patater force-pushed the update-to-mbedtls-2.18.0rc4 branch from 7419c3d to 1470d06 Compare June 11, 2019 11:44

Patater changed the title ~~Update to mbedtls 2.18.0rc4~~ Update to mbedtls 2.18.0rc3 Jun 11, 2019

yanesca approved these changes Jun 11, 2019

View reviewed changes

gilles-peskine-arm approved these changes Jun 11, 2019

View reviewed changes

0xc0170 added needs: CI and removed needs: review labels Jun 11, 2019

This was referenced Jun 11, 2019

psa: PSA entropy is compatible with other entropy ARMmbed/mbed-crypto#146

Closed

psa: PSA entropy is compatible with other entropy Mbed-TLS/mbedtls#2685

Closed

Patater force-pushed the update-to-mbedtls-2.18.0rc4 branch from 02ac141 to e61e92c Compare June 12, 2019 10:14

gilles-peskine-arm approved these changes Jun 12, 2019

View reviewed changes

Patater force-pushed the update-to-mbedtls-2.18.0rc4 branch from e61e92c to 39ea40f Compare June 12, 2019 11:49

adbridge added ready for merge and removed needs: CI labels Jun 12, 2019

adbridge merged commit 4ad71c4 into ARMmbed:master Jun 12, 2019

adbridge removed the ready for merge label Jun 12, 2019

teetak01 mentioned this pull request Jun 20, 2019

DeviceKey was not declared for RZ_A1H target PelionIoT/mbed-cloud-client-example#48

Closed

dgreen-arm mentioned this pull request Jun 25, 2019

Add adjust-check-config script to mbedtls importer #10894

Merged

Update to mbedtls 2.18.0rc3 #10802

Update to mbedtls 2.18.0rc3 #10802

Uh oh!

Conversation

Patater commented Jun 10, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Pull request type

Reviewers

Uh oh!

Patater commented Jun 10, 2019

Uh oh!

ciarmcom commented Jun 10, 2019

Uh oh!

0xc0170 commented Jun 11, 2019

Uh oh!

0xc0170 commented Jun 11, 2019

Uh oh!

0xc0170 commented Jun 11, 2019

Uh oh!

teetak01 left a comment

Choose a reason for hiding this comment

Uh oh!

bulislaw left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mbed-ci commented Jun 11, 2019

Test run: SUCCESS

Uh oh!

Patater commented Jun 11, 2019

Uh oh!

adbridge commented Jun 11, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Patater commented Jun 11, 2019

Uh oh!

yanesca left a comment

Choose a reason for hiding this comment

Uh oh!

adbridge commented Jun 11, 2019

Uh oh!

TeroJaasko commented Jun 11, 2019

Uh oh!

Patater commented Jun 11, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Patater commented Jun 11, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cmonr commented Jun 11, 2019

Uh oh!

mbed-ci commented Jun 11, 2019

Test run: FAILED

Uh oh!

adbridge commented Jun 11, 2019

Uh oh!

Patater commented Jun 11, 2019

Uh oh!

adbridge commented Jun 11, 2019

Uh oh!

mbed-ci commented Jun 11, 2019

Test run: FAILED

Uh oh!

0xc0170 commented Jun 12, 2019

Uh oh!

mbed-ci commented Jun 12, 2019

Test run: FAILED

Uh oh!

Patater commented Jun 12, 2019

Uh oh!

adbridge commented Jun 12, 2019

Uh oh!

adbridge commented Jun 12, 2019

Uh oh!

gilles-peskine-arm left a comment

Choose a reason for hiding this comment

Uh oh!

Patater commented Jun 12, 2019

Uh oh!

Patater commented Jun 10, 2019 •

edited

Loading

bulislaw left a comment •

edited

Loading

adbridge commented Jun 11, 2019 •

edited

Loading

Patater commented Jun 11, 2019 •

edited

Loading

Patater commented Jun 11, 2019 •

edited

Loading