Move some scripts from mbedtls by gilles-peskine-arm · Pull Request #283 · Mbed-TLS/mbedtls-framework

gilles-peskine-arm · 2026-02-26T19:11:36Z

Move some branch-independent scripts from mbedtls. In particular audit-validity-dates.py which I need to change for #282.

Moved using Mbed-TLS/mbedtls-docs#145, so most of the content is some history picked up from mbedtls. The review consists of checking that the history starts from a PR merge on main and a PR merge on development, that the subsequent merges do what is expected to effectively move files around, and that the subsequent non-merge commits are acceptable and end up with a sane result.

PR checklist

TF-PSA-Crypto PR not required because: none of the scripts are referenced from TF-PSA-Crypto
development PR Move some scripts to the framework mbedtls#10624
3.6 PR Backport 3.6: Move some scripts to the framework mbedtls#10629

Even though the TLS RFCs do not mandate libraries to expose *Error Alerts* (as defined in RFC8446 6.2 for TLS 1.3 and in RFC5246 7.2.2 for TLS 1.2) to the user, there are use cases when it is handy to get the actual last received fatal error instead of a generic one. For instance this enables the user to differ between received fatal errors in case `mbedtls_ssl_handshake()`, `mbedtls_ssl_handshake_step()` or `mbedtls_ssl_read()` returned `MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE`. This changesets stores the last incoming fatal alert in `mbedtls_ssl_context` and provides `mbedtls_ssl_get_alert()` as a getter for retrieving it. Another option would be to provide a callback mechanisms for all kinds of alerts (not only fatals) but for simplicity I discarded this option. Signed-off-by: Nico Geyso <ng@gsmk.de>

Signed-off-by: Nico Geyso <ng@gsmk.de>

reset indicator (in_alert_recv) and type (in_alert_type) in mbedtls_ssl_session_reset_msg_layer Signed-off-by: Nico Geyso <ng@gsmk.de>

Signed-off-by: Nico Geyso <ng@gsmk.de>

This function is no more used anywhere and can be safely removed. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Remove usage of mbedtls_pk_debug stuff and related functions (mbedtls_debug_print_psa_rsa(), mbedtls_debug_print_psa_ec(), mbedtls_debug_print_integer() and debug_count_valid_bits()) and use mbedtls_pk_write_pubkey_psa() to get the public key from the PK context. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Move single line printing to a separate function named mbedtls_debug_print_buf_one_line(). This accepts one extra parameter 'add_text' to tell if the final text chars are to be printed at the end of the line or not. Add also mbedtls_debug_print_buf_ext() as a generalized version of mbedtls_debug_print_buf() by adding the extra 'add_text' param. debug_print_pk() will now use mbedtls_debug_print_buf_ext() in order not to print chars while dumping the buffer. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Adjust dumping format of public keys following recent updates to mbedtls_debug_print_crt() and debug_print_pk() Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

In tf-psa-crypto "mbedtls_pk_write_pubkey_psa()" is only available when MBEDTLS_PK_WRITE_C is defined. Therefore we need to add this guard also in mbedtls to "debug_print_pk" (and indirectly to "mbedtls_debug_print_crt") and the corresponding tests using it. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Guards for "mbedtls_debug_print_crt()" were updated in previous commit, but those changes were not applied to MBEDTLS_SSL_DEBUG_CRT therefore causing build failures in the CI. This commit fixes the problem. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

%zu creates problem in MinGW testing. Use MBEDTLS_PRINTF_SIZET intead. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Keep MBEDTLS_PK_WRITE_C as guard only for "debug_print_pk" but let "mbedtls_debug_print_crt" to work also when MBEDTLS_PK_WRITE_C is disabled. In this case the only public key won't be printed, but the rest of the certificate will be. This commit also updates test coverage by duplicating test cases: now there will be one case for when MBEDTLS_PK_WRITE_C is enabled and another one for !MBEDTLS_PK_WRITE_C. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

This is similar to the already existing "component_full_no_pkparse_pkwrite". The biggest difference is that this new component starts from "full" config instead of "crypto_full" because we want to test also some TLS modules, in particular "test_suite_debug" where the new function "mbedtls_pk_write_pubkey_psa" has been introduced. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Now that the crypto files have been moved to the crypto repository, consume them there. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Let crypto own its part of the makefiles

Switching to CMake build caused some failures due to the fact that: - binary objects in tf-psa-crypto are not in the same location as before; - header files from "<mbedtls-root>/include" are no more included when building tf-psa-crypto ojects. This commit fixes both problems. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Remove use of pk_debug()

A switch has recently been made from make to cmake to build these tests but paths for "not grep" were not properly updated. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

…lying type Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

…09_pk_type_as_string Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Move a bunch of files from `scripts` and `mbedtls/scripts` to the framework. The following files will be added (moved from Mbed TLS `development`): * `scripts/ecp_comb_table.py` * `scripts/massif_max.pl` * `tests/scripts/audit-validity-dates.py` (moved to `scripts/`) * `tests/scripts/gen_ctr_drbg.pl` (moved to `scripts/`) * `tests/scripts/gen_gcm_decrypt.pl` (moved to `scripts/`) * `tests/scripts/gen_gcm_encrypt.pl` (moved to `scripts/`) * `tests/scripts/gen_pkcs1_v21_sign_verify.pl` (moved to `scripts/`) * `tests/scripts/generate-afl-tests.sh` (moved to `scripts/`) * `tests/scripts/generate_server9_bad_saltlen.py` (moved to `scripts/`) * `tests/scripts/run-metatests.sh` (moved to `scripts/`) * `tests/scripts/run_demos.py` (moved to `scripts/`) * `tests/scripts/test_config_script.py` (moved to `scripts/`) Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com> Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

…_dates-move-from-mbedtls

…om-mbedtls

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

We were missing `mbedtls_framework/code_wrapper/*.py` because we were not traversing the directory recursively. Also improve the comment explaining the duplicate-code workaround for code that's being moved between files in different repositories. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

gilles-peskine-arm · 2026-03-09T09:55:50Z

I had to inject an additional merge of main so that updating the consuming branches to the head of this branch can be a forward move.

ng-gsmk and others added 30 commits December 10, 2025 19:37

test ssl_get_alert_after_fatal - remove mbedtls_ssl_conf_rng

0841cea

Signed-off-by: Nico Geyso <ng@gsmk.de>

Fix C code style issues

f9a734f

Signed-off-by: Nico Geyso <ng@gsmk.de>

Fix more C code style issues

13200ab

Signed-off-by: Nico Geyso <ng@gsmk.de>

ssl - reset alert type for session reset

33bd8f8

reset indicator (in_alert_recv) and type (in_alert_type) in mbedtls_ssl_session_reset_msg_layer Signed-off-by: Nico Geyso <ng@gsmk.de>

tests/ssl_get_alert_after_fatal - add invalid param case

6140cfb

Signed-off-by: Nico Geyso <ng@gsmk.de>

library: debug: remove mbedtls_debug_print_mpi()

10eaf68

This function is no more used anywhere and can be safely removed. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

tests: scripts: adjust CRT dump test data

3c419c1

Adjust dumping format of public keys following recent updates to mbedtls_debug_print_crt() and debug_print_pk() Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

library: debug: fix print format in mbedtls_debug_print_buf_ext()

2af638a

%zu creates problem in MinGW testing. Use MBEDTLS_PRINTF_SIZET intead. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

tests: scripts: build with cmake in all components using Asan

059aac8

Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Update tf-psa-crypto with makefile helpers

fca232c

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Use the crypto makefile helpers in tf-psa-crypto

e23b6e4

Now that the crypto files have been moved to the crypto repository, consume them there. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Remove local copies of makefile helpers

4ffb299

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Merge pull request #10544 from gilles-peskine-arm/move-crypto-makefiles

193401c

Let crypto own its part of the makefiles

Merge pull request #10517 from valeriosetti/issue10460

f7173e4

Remove use of pk_debug()

tests: scripts: configuration-crypto: fix paths for "not grep"

5aba22b

A switch has recently been made from make to cmake to build these tests but paths for "not grep" were not properly updated. Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>

Replace mbedtls_pk_get_name with pk_key_type_to_string

2481daa

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Fix style issues

f9b95ce

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

rename function

837a3ce

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Update ssl-opt to remove Opaque key types

81deeb8

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Update ssl-opt tests as wrapped keys now expose the underlying type

98e958c

Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Further updates to ssl-opt tests as wrapped keys now expose the under…

f77d749

…lying type Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

Change function name from mbedtls_pk_key_type_to_string to mbedtls_x5…

085aef5

…09_pk_type_as_string Signed-off-by: Ben Taylor <ben.taylor@linaro.org>

gilles-peskine-arm added needs-work and removed needs-reviewer This PR needs someone to pick it up for review labels Mar 3, 2026

gilles-peskine-arm added 2 commits March 3, 2026 13:36

Merge branch 'tmp-branch-move-files-to-framework' into audit_validity…

7dffa35

…_dates-move-from-mbedtls

gilles-peskine-arm force-pushed the audit_validity_dates-move-from-mbedtls branch from 002dc03 to e95dfd4 Compare March 3, 2026 12:55

gilles-peskine-arm mentioned this pull request Mar 3, 2026

Backport 3.6: Move some scripts to the framework Mbed-TLS/mbedtls#10629

Merged

5 tasks

gilles-peskine-arm added needs-ci Needs to pass CI tests needs-review Every commit must be reviewed by at least two team members. needs-reviewer This PR needs someone to pick it up for review and removed needs-work needs-ci Needs to pass CI tests labels Mar 3, 2026

gilles-peskine-arm requested a review from valeriosetti March 9, 2026 09:39

gilles-peskine-arm added 8 commits March 9, 2026 10:50

Merge remote-tracking branch 'main' into audit_validity_dates-move-fr…

731ff38

…om-mbedtls

Add requirements in the framework for scripts in the framework

7221529

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Update paths after moving some scripts to the framework

7bc3cdf

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Fix cosmetic issues reported by pylint

d393ebd

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Fix or silence minor issues reported by pylint

c77ecf0

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Remove temporary code from the tf-psa-crypto split

95367db

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

Add pylint duplicate-code exceptions for newly moved files

c5135a0

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>

gilles-peskine-arm force-pushed the audit_validity_dates-move-from-mbedtls branch from e95dfd4 to c5135a0 Compare March 9, 2026 09:53

valeriosetti approved these changes Mar 9, 2026

View reviewed changes

bjwtaylor approved these changes Mar 11, 2026

View reviewed changes

github-project-automation bot moved this from In Development to Has Approval in Roadmap pull requests (new board) Mar 11, 2026

gilles-peskine-arm added approved Design and code approved - may be waiting for CI or backports and removed needs-review Every commit must be reviewed by at least two team members. needs-reviewer This PR needs someone to pick it up for review labels Mar 12, 2026

gilles-peskine-arm merged commit c3d6599 into Mbed-TLS:main Mar 12, 2026
2 checks passed

github-project-automation bot moved this from Has Approval to Done in Roadmap pull requests (new board) Mar 12, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Move some scripts from mbedtls#283

Move some scripts from mbedtls#283
gilles-peskine-arm merged 157 commits intoMbed-TLS:mainfrom
gilles-peskine-arm:audit_validity_dates-move-from-mbedtls

gilles-peskine-arm commented Feb 26, 2026 •

edited

Loading

Uh oh!

gilles-peskine-arm commented Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Conversation

gilles-peskine-arm commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR checklist

Uh oh!

gilles-peskine-arm commented Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

gilles-peskine-arm commented Feb 26, 2026 •

edited

Loading