Gilles Peskine | fdb7223 | 2023-06-19 20:46:47 +0200 | [diff] [blame^] | 1 | """Collect information about PSA cryptographic mechanisms. |
| 2 | """ |
| 3 | |
| 4 | # Copyright The Mbed TLS Contributors |
| 5 | # SPDX-License-Identifier: Apache-2.0 |
| 6 | # |
| 7 | # Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 8 | # not use this file except in compliance with the License. |
| 9 | # You may obtain a copy of the License at |
| 10 | # |
| 11 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 12 | # |
| 13 | # Unless required by applicable law or agreed to in writing, software |
| 14 | # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 15 | # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 16 | # See the License for the specific language governing permissions and |
| 17 | # limitations under the License. |
| 18 | |
| 19 | import re |
| 20 | from typing import Dict, FrozenSet, List, Optional |
| 21 | |
| 22 | from . import macro_collector |
| 23 | |
| 24 | |
| 25 | class Information: |
| 26 | """Gather information about PSA constructors.""" |
| 27 | |
| 28 | def __init__(self) -> None: |
| 29 | self.constructors = self.read_psa_interface() |
| 30 | |
| 31 | @staticmethod |
| 32 | def remove_unwanted_macros( |
| 33 | constructors: macro_collector.PSAMacroEnumerator |
| 34 | ) -> None: |
| 35 | # Mbed TLS does not support finite-field DSA. |
| 36 | # Don't attempt to generate any related test case. |
| 37 | constructors.key_types.discard('PSA_KEY_TYPE_DSA_KEY_PAIR') |
| 38 | constructors.key_types.discard('PSA_KEY_TYPE_DSA_PUBLIC_KEY') |
| 39 | |
| 40 | def read_psa_interface(self) -> macro_collector.PSAMacroEnumerator: |
| 41 | """Return the list of known key types, algorithms, etc.""" |
| 42 | constructors = macro_collector.InputsForTest() |
| 43 | header_file_names = ['include/psa/crypto_values.h', |
| 44 | 'include/psa/crypto_extra.h'] |
| 45 | test_suites = ['tests/suites/test_suite_psa_crypto_metadata.data'] |
| 46 | for header_file_name in header_file_names: |
| 47 | constructors.parse_header(header_file_name) |
| 48 | for test_cases in test_suites: |
| 49 | constructors.parse_test_cases(test_cases) |
| 50 | self.remove_unwanted_macros(constructors) |
| 51 | constructors.gather_arguments() |
| 52 | return constructors |
| 53 | |
| 54 | |
| 55 | def psa_want_symbol(name: str) -> str: |
| 56 | """Return the PSA_WANT_xxx symbol associated with a PSA crypto feature.""" |
| 57 | if name.startswith('PSA_'): |
| 58 | return name[:4] + 'WANT_' + name[4:] |
| 59 | else: |
| 60 | raise ValueError('Unable to determine the PSA_WANT_ symbol for ' + name) |
| 61 | |
| 62 | def finish_family_dependency(dep: str, bits: int) -> str: |
| 63 | """Finish dep if it's a family dependency symbol prefix. |
| 64 | |
| 65 | A family dependency symbol prefix is a PSA_WANT_ symbol that needs to be |
| 66 | qualified by the key size. If dep is such a symbol, finish it by adjusting |
| 67 | the prefix and appending the key size. Other symbols are left unchanged. |
| 68 | """ |
| 69 | return re.sub(r'_FAMILY_(.*)', r'_\1_' + str(bits), dep) |
| 70 | |
| 71 | def finish_family_dependencies(dependencies: List[str], bits: int) -> List[str]: |
| 72 | """Finish any family dependency symbol prefixes. |
| 73 | |
| 74 | Apply `finish_family_dependency` to each element of `dependencies`. |
| 75 | """ |
| 76 | return [finish_family_dependency(dep, bits) for dep in dependencies] |
| 77 | |
| 78 | SYMBOLS_WITHOUT_DEPENDENCY = frozenset([ |
| 79 | 'PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG', # modifier, only in policies |
| 80 | 'PSA_ALG_AEAD_WITH_SHORTENED_TAG', # modifier |
| 81 | 'PSA_ALG_ANY_HASH', # only in policies |
| 82 | 'PSA_ALG_AT_LEAST_THIS_LENGTH_MAC', # modifier, only in policies |
| 83 | 'PSA_ALG_KEY_AGREEMENT', # chaining |
| 84 | 'PSA_ALG_TRUNCATED_MAC', # modifier |
| 85 | ]) |
| 86 | def automatic_dependencies(*expressions: str) -> List[str]: |
| 87 | """Infer dependencies of a test case by looking for PSA_xxx symbols. |
| 88 | |
| 89 | The arguments are strings which should be C expressions. Do not use |
| 90 | string literals or comments as this function is not smart enough to |
| 91 | skip them. |
| 92 | """ |
| 93 | used = set() |
| 94 | for expr in expressions: |
| 95 | used.update(re.findall(r'PSA_(?:ALG|ECC_FAMILY|KEY_TYPE)_\w+', expr)) |
| 96 | used.difference_update(SYMBOLS_WITHOUT_DEPENDENCY) |
| 97 | return sorted(psa_want_symbol(name) for name in used) |
| 98 | |
| 99 | # Define set of regular expressions and dependencies to optionally append |
| 100 | # extra dependencies for test case. |
| 101 | AES_128BIT_ONLY_DEP_REGEX = r'AES\s(192|256)' |
| 102 | AES_128BIT_ONLY_DEP = ["!MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH"] |
| 103 | |
| 104 | DEPENDENCY_FROM_KEY = { |
| 105 | AES_128BIT_ONLY_DEP_REGEX: AES_128BIT_ONLY_DEP |
| 106 | }#type: Dict[str, List[str]] |
| 107 | def generate_key_dependencies(description: str) -> List[str]: |
| 108 | """Return additional dependencies based on pairs of REGEX and dependencies. |
| 109 | """ |
| 110 | deps = [] |
| 111 | for regex, dep in DEPENDENCY_FROM_KEY.items(): |
| 112 | if re.search(regex, description): |
| 113 | deps += dep |
| 114 | |
| 115 | return deps |
| 116 | |
| 117 | # A temporary hack: at the time of writing, not all dependency symbols |
| 118 | # are implemented yet. Skip test cases for which the dependency symbols are |
| 119 | # not available. Once all dependency symbols are available, this hack must |
| 120 | # be removed so that a bug in the dependency symbols properly leads to a test |
| 121 | # failure. |
| 122 | def read_implemented_dependencies(filename: str) -> FrozenSet[str]: |
| 123 | return frozenset(symbol |
| 124 | for line in open(filename) |
| 125 | for symbol in re.findall(r'\bPSA_WANT_\w+\b', line)) |
| 126 | _implemented_dependencies = None #type: Optional[FrozenSet[str]] #pylint: disable=invalid-name |
| 127 | def hack_dependencies_not_implemented(dependencies: List[str]) -> None: |
| 128 | global _implemented_dependencies #pylint: disable=global-statement,invalid-name |
| 129 | if _implemented_dependencies is None: |
| 130 | _implemented_dependencies = \ |
| 131 | read_implemented_dependencies('include/psa/crypto_config.h') |
| 132 | if not all((dep.lstrip('!') in _implemented_dependencies or |
| 133 | not dep.lstrip('!').startswith('PSA_WANT')) |
| 134 | for dep in dependencies): |
| 135 | dependencies.append('DEPENDENCY_NOT_IMPLEMENTED_YET') |
| 136 | |
| 137 | def tweak_key_pair_dependency(dep: str, usage: str): |
| 138 | """ |
| 139 | This helper function add the proper suffix to PSA_WANT_KEY_TYPE_xxx_KEY_PAIR |
| 140 | symbols according to the required usage. |
| 141 | """ |
| 142 | ret_list = list() |
| 143 | if dep.endswith('KEY_PAIR'): |
| 144 | if usage == "BASIC": |
| 145 | # BASIC automatically includes IMPORT and EXPORT for test purposes (see |
| 146 | # config_psa.h). |
| 147 | ret_list.append(re.sub(r'KEY_PAIR', r'KEY_PAIR_BASIC', dep)) |
| 148 | ret_list.append(re.sub(r'KEY_PAIR', r'KEY_PAIR_IMPORT', dep)) |
| 149 | ret_list.append(re.sub(r'KEY_PAIR', r'KEY_PAIR_EXPORT', dep)) |
| 150 | elif usage == "GENERATE": |
| 151 | ret_list.append(re.sub(r'KEY_PAIR', r'KEY_PAIR_GENERATE', dep)) |
| 152 | else: |
| 153 | # No replacement to do in this case |
| 154 | ret_list.append(dep) |
| 155 | return ret_list |
| 156 | |
| 157 | def fix_key_pair_dependencies(dep_list: List[str], usage: str): |
| 158 | new_list = [new_deps |
| 159 | for dep in dep_list |
| 160 | for new_deps in tweak_key_pair_dependency(dep, usage)] |
| 161 | |
| 162 | return new_list |