Skip to content

Commit 02f54f5

Browse files
Apprentice-AlchemistApprentice-Alchemist
authored
[ssl] support mbedtls 4.0 (#849)
1 parent c845464 commit 02f54f5

File tree

2 files changed

+205
-31
lines changed

2 files changed

+205
-31
lines changed

‎libs/ssl/CMakeLists.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,8 @@ if (WIN32)
123123
)
124124
elseif(DOWNLOAD_DEPENDENCIES)
125125
FetchContent_Declare(mbedtls-project
126-
URL https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-3.6.4/mbedtls-3.6.4.tar.bz2
127-
URL_HASH SHA256=ec35b18a6c593cf98c3e30db8b98ff93e8940a8c4e690e66b41dfc011d678110
126+
URL https://github.com/Mbed-TLS/mbedtls/releases/download/mbedtls-4.0.0/mbedtls-4.0.0.tar.bz2
127+
URL_HASH SHA256=2f3a47f7b3a541ddef450e4867eeecb7ce2ef7776093f3a11d6d43ead6bf2827
128128
EXCLUDE_FROM_ALL
129129
)
130130
set(_OLD_BUILD_SHARED_LIBS ${BUILD_SHARED_LIBS})
@@ -133,7 +133,7 @@ elseif(DOWNLOAD_DEPENDENCIES)
133133
set(ENABLE_TESTING OFF CACHE INTERNAL "")
134134
FetchContent_MakeAvailable(mbedtls-project)
135135
set(BUILD_SHARED_LIBS ${_OLD_BUILD_SHARED_LIBS})
136-
set(MBEDTLS_LIBRARIES MbedTLS::mbedtls MbedTLS::mbedx509 MbedTLS::mbedcrypto)
136+
set(MBEDTLS_LIBRARIES MbedTLS::mbedtls MbedTLS::mbedx509 TF-PSA-Crypto::tfpsacrypto)
137137
else()
138138
find_package(MbedTLS REQUIRED)
139139
endif()

‎libs/ssl/ssl.c‎

Lines changed: 202 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,16 @@ typedef int SOCKET;
2222
#define SOCKET_ERROR (-1)
2323
#define NRETRYS 20
2424

25-
#include "mbedtls/platform.h"
2625
#include "mbedtls/error.h"
27-
#include "mbedtls/entropy.h"
28-
#include "mbedtls/ctr_drbg.h"
2926
#include "mbedtls/md.h"
3027
#include "mbedtls/pk.h"
31-
#include "mbedtls/oid.h"
32-
#include "mbedtls/x509_crt.h"
28+
#include "mbedtls/x509.h"
3329
#include "mbedtls/ssl.h"
30+
#include "mbedtls/oid.h"
31+
#if MBEDTLS_VERSION_MAJOR < 4
32+
#include "mbedtls/ctr_drbg.h"
33+
#include "mbedtls/entropy.h"
34+
#endif
3435

3536
#ifdef MBEDTLS_PSA_CRYPTO_C
3637
#include <psa/crypto.h>
@@ -68,8 +69,10 @@ struct _hl_ssl_pkey {
6869
#define TPKEY _ABSTRACT(hl_ssl_pkey)
6970

7071
static bool ssl_init_done = false;
72+
#if MBEDTLS_VERSION_MAJOR < 4
7173
static mbedtls_entropy_context entropy;
7274
static mbedtls_ctr_drbg_context ctr_drbg;
75+
#endif
7376

7477
static bool is_ssl_blocking( int r ) {
7578
return r == MBEDTLS_ERR_SSL_WANT_READ || r == MBEDTLS_ERR_SSL_WANT_WRITE;
@@ -245,7 +248,9 @@ HL_PRIM mbedtls_ssl_config *HL_NAME(conf_new)(bool server) {
245248
ssl_error(ret);
246249
return NULL;
247250
}
251+
#if MBEDTLS_VERSION_MAJOR < 4
248252
mbedtls_ssl_conf_rng(conf, mbedtls_ctr_drbg_random, &ctr_drbg);
253+
#endif
249254
return conf;
250255
}
251256

@@ -409,16 +414,158 @@ static vbyte *asn1_buf_to_string(mbedtls_asn1_buf *dat) {
409414
return (vbyte*)hl_buffer_content(buf,NULL);
410415
}
411416

417+
// The following code is adapted from `library/x509_oid.c` in MbedTLS 4.0.0
418+
// Originally Copyright The Mbed TLS Contributors
419+
// SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
420+
421+
#define ADD_LEN(s) s, MBEDTLS_OID_SIZE(s)
422+
#define OID_DESCRIPTOR(s, name, description) {ADD_LEN(s)}
423+
#define NULL_OID_DESCRIPTOR {NULL, 0}
424+
425+
typedef struct {
426+
const char *asn1; /*!< OID ASN.1 representation */
427+
size_t asn1_len; /*!< length of asn1 */
428+
} mbedtls_x509_oid_descriptor_t;
429+
430+
typedef struct {
431+
mbedtls_x509_oid_descriptor_t descriptor;
432+
const char *short_name;
433+
} oid_x520_attr_t;
434+
435+
static const oid_x520_attr_t oid_x520_attr_type[] = {
436+
{
437+
OID_DESCRIPTOR(MBEDTLS_OID_AT_CN, "id-at-commonName", "Common Name"),
438+
"CN",
439+
},
440+
{
441+
OID_DESCRIPTOR(MBEDTLS_OID_AT_COUNTRY, "id-at-countryName", "Country"),
442+
"C",
443+
},
444+
{
445+
OID_DESCRIPTOR(MBEDTLS_OID_AT_LOCALITY, "id-at-locality", "Locality"),
446+
"L",
447+
},
448+
{
449+
OID_DESCRIPTOR(MBEDTLS_OID_AT_STATE, "id-at-state", "State"),
450+
"ST",
451+
},
452+
{
453+
OID_DESCRIPTOR(MBEDTLS_OID_AT_ORGANIZATION, "id-at-organizationName",
454+
"Organization"),
455+
"O",
456+
},
457+
{
458+
OID_DESCRIPTOR(MBEDTLS_OID_AT_ORG_UNIT, "id-at-organizationalUnitName",
459+
"Org Unit"),
460+
"OU",
461+
},
462+
{
463+
OID_DESCRIPTOR(MBEDTLS_OID_PKCS9_EMAIL, "emailAddress",
464+
"E-mail address"),
465+
"emailAddress",
466+
},
467+
{
468+
OID_DESCRIPTOR(MBEDTLS_OID_AT_SERIAL_NUMBER, "id-at-serialNumber",
469+
"Serial number"),
470+
"serialNumber",
471+
},
472+
{
473+
OID_DESCRIPTOR(MBEDTLS_OID_AT_POSTAL_ADDRESS, "id-at-postalAddress",
474+
"Postal address"),
475+
"postalAddress",
476+
},
477+
{
478+
OID_DESCRIPTOR(MBEDTLS_OID_AT_POSTAL_CODE, "id-at-postalCode",
479+
"Postal code"),
480+
"postalCode",
481+
},
482+
{
483+
OID_DESCRIPTOR(MBEDTLS_OID_AT_SUR_NAME, "id-at-surName", "Surname"),
484+
"SN",
485+
},
486+
{
487+
OID_DESCRIPTOR(MBEDTLS_OID_AT_GIVEN_NAME, "id-at-givenName",
488+
"Given name"),
489+
"GN",
490+
},
491+
{
492+
OID_DESCRIPTOR(MBEDTLS_OID_AT_INITIALS, "id-at-initials", "Initials"),
493+
"initials",
494+
},
495+
{
496+
OID_DESCRIPTOR(MBEDTLS_OID_AT_GENERATION_QUALIFIER,
497+
"id-at-generationQualifier", "Generation qualifier"),
498+
"generationQualifier",
499+
},
500+
{
501+
OID_DESCRIPTOR(MBEDTLS_OID_AT_TITLE, "id-at-title", "Title"),
502+
"title",
503+
},
504+
{
505+
OID_DESCRIPTOR(MBEDTLS_OID_AT_DN_QUALIFIER, "id-at-dnQualifier",
506+
"Distinguished Name qualifier"),
507+
"dnQualifier",
508+
},
509+
{
510+
OID_DESCRIPTOR(MBEDTLS_OID_AT_PSEUDONYM, "id-at-pseudonym",
511+
"Pseudonym"),
512+
"pseudonym",
513+
},
514+
#ifdef MBEDTLS_OID_UID
515+
{
516+
OID_DESCRIPTOR(MBEDTLS_OID_UID, "id-uid", "User Id"),
517+
"uid",
518+
},
519+
#endif
520+
{
521+
OID_DESCRIPTOR(MBEDTLS_OID_DOMAIN_COMPONENT, "id-domainComponent",
522+
"Domain component"),
523+
"DC",
524+
},
525+
{
526+
OID_DESCRIPTOR(MBEDTLS_OID_AT_UNIQUE_IDENTIFIER,
527+
"id-at-uniqueIdentifier", "Unique Identifier"),
528+
"uniqueIdentifier",
529+
},
530+
{
531+
NULL_OID_DESCRIPTOR,
532+
NULL,
533+
}};
534+
535+
static const oid_x520_attr_t *
536+
oid_x520_attr_from_asn1(const mbedtls_asn1_buf *oid) {
537+
const oid_x520_attr_t *p = (oid_x520_attr_type);
538+
const mbedtls_x509_oid_descriptor_t *cur =
539+
(const mbedtls_x509_oid_descriptor_t *)p;
540+
if (p == NULL || oid == NULL)
541+
return NULL;
542+
while (cur->asn1 != NULL) {
543+
if (cur->asn1_len == oid->len && memcmp(cur->asn1, oid->p, oid->len) == 0) {
544+
return p;
545+
}
546+
p++;
547+
cur = (const mbedtls_x509_oid_descriptor_t *)p;
548+
}
549+
return NULL;
550+
}
551+
552+
static int oid_get_attr_short_name(const mbedtls_asn1_buf *oid,
553+
const char **short_name) {
554+
const oid_x520_attr_t *data = oid_x520_attr_from_asn1(oid);
555+
if (data == NULL)
556+
return -0x2100;
557+
*short_name = data->short_name;
558+
return 0;
559+
}
560+
561+
// end code adapted from MbedTLS
562+
412563
HL_PRIM vbyte *HL_NAME(cert_get_subject)(hl_ssl_cert *cert, vbyte *objname) {
413-
mbedtls_x509_name *obj;
414-
int r;
415-
const char *oname, *rname;
416-
obj = &cert->c->subject;
417-
if (obj == NULL)
418-
hl_error("Invalid subject");
419-
rname = (char*)objname;
564+
mbedtls_x509_name *obj = &cert->c->subject;
565+
const char *rname = (char*)objname;
420566
while (obj != NULL) {
421-
r = mbedtls_oid_get_attr_short_name(&obj->oid, &oname);
567+
const char *oname;
568+
int r = oid_get_attr_short_name(&obj->oid, &oname);
422569
if (r == 0 && strcmp(oname, rname) == 0)
423570
return asn1_buf_to_string(&obj->val);
424571
obj = obj->next;
@@ -427,15 +574,11 @@ HL_PRIM vbyte *HL_NAME(cert_get_subject)(hl_ssl_cert *cert, vbyte *objname) {
427574
}
428575

429576
HL_PRIM vbyte *HL_NAME(cert_get_issuer)(hl_ssl_cert *cert, vbyte *objname) {
430-
mbedtls_x509_name *obj;
431-
int r;
432-
const char *oname, *rname;
433-
obj = &cert->c->issuer;
434-
if (obj == NULL)
435-
hl_error("Invalid issuer");
436-
rname = (char*)objname;
577+
mbedtls_x509_name *obj = &cert->c->issuer;
578+
const char *rname = (char*)objname;
437579
while (obj != NULL) {
438-
r = mbedtls_oid_get_attr_short_name(&obj->oid, &oname);
580+
const char *oname;
581+
int r = oid_get_attr_short_name(&obj->oid, &oname);
439582
if (r == 0 && strcmp(oname, rname) == 0)
440583
return asn1_buf_to_string(&obj->val);
441584
obj = obj->next;
@@ -587,7 +730,9 @@ HL_PRIM hl_ssl_pkey *HL_NAME(key_from_der)(vbyte *data, int len, bool pub) {
587730
if (pub)
588731
r = mbedtls_pk_parse_public_key(pk, (const unsigned char*)data, len);
589732
else
590-
#if MBEDTLS_VERSION_MAJOR >= 3
733+
#if MBEDTLS_VERSION_MAJOR >= 4
734+
r = mbedtls_pk_parse_key(pk, (const unsigned char*)data, len, NULL, 0);
735+
#elif MBEDTLS_VERSION_MAJOR >= 3
591736
r = mbedtls_pk_parse_key(pk, (const unsigned char*)data, len, NULL, 0, mbedtls_ctr_drbg_random, &ctr_drbg);
592737
#else
593738
r = mbedtls_pk_parse_key(pk, (const unsigned char*)data, len, NULL, 0);
@@ -616,7 +761,12 @@ HL_PRIM hl_ssl_pkey *HL_NAME(key_from_pem)(vbyte *data, bool pub, vbyte *pass) {
616761
buf[len - 1] = '\0';
617762
if (pub)
618763
r = mbedtls_pk_parse_public_key(pk, buf, len);
619-
#if MBEDTLS_VERSION_MAJOR >= 3
764+
#if MBEDTLS_VERSION_MAJOR >= 4
765+
else if (pass == NULL)
766+
r = mbedtls_pk_parse_key(pk, buf, len, NULL, 0);
767+
else
768+
r = mbedtls_pk_parse_key(pk, buf, len, (const unsigned char*)pass, strlen((char*)pass));
769+
#elif MBEDTLS_VERSION_MAJOR >= 3
620770
else if (pass == NULL)
621771
r = mbedtls_pk_parse_key(pk, buf, len, NULL, 0, mbedtls_ctr_drbg_random, &ctr_drbg);
622772
else
@@ -643,12 +793,32 @@ HL_PRIM hl_ssl_pkey *HL_NAME(key_from_pem)(vbyte *data, bool pub, vbyte *pass) {
643793
DEFINE_PRIM(TPKEY, key_from_der, _BYTES _I32 _BOOL);
644794
DEFINE_PRIM(TPKEY, key_from_pem, _BYTES _BOOL _BYTES);
645795

796+
static mbedtls_md_type_t md_type_from_string(const char *alg) {
797+
if (strcmp(alg, "MD5") == 0) {
798+
return MBEDTLS_MD_MD5;
799+
} else if(strcmp(alg, "SHA1") == 0) {
800+
return MBEDTLS_MD_SHA1;
801+
} else if (strcmp(alg, "SHA224") == 0) {
802+
return MBEDTLS_MD_SHA224;
803+
} else if (strcmp(alg, "SHA256") == 0) {
804+
return MBEDTLS_MD_SHA256;
805+
} else if (strcmp(alg, "SHA384") == 0) {
806+
return MBEDTLS_MD_SHA384;
807+
} else if (strcmp(alg, "SHA512") == 0) {
808+
return MBEDTLS_MD_SHA512;
809+
} else if (strcmp(alg, "RIPEMD160") == 0) {
810+
return MBEDTLS_MD_RIPEMD160;
811+
} else {
812+
hl_error("Unknown hash algorithm: %s", alg);
813+
}
814+
}
815+
646816
HL_PRIM vbyte *HL_NAME(dgst_make)(vbyte *data, int len, vbyte *alg, int *size) {
647817
const mbedtls_md_info_t *md;
648818
int mdlen, r = -1;
649819
vbyte *out;
650820

651-
md = mbedtls_md_info_from_string((char*)alg);
821+
md = mbedtls_md_info_from_type(md_type_from_string((char*)alg));
652822
if (md == NULL) {
653823
hl_error("Invalid hash algorithm");
654824
return NULL;
@@ -671,7 +841,7 @@ HL_PRIM vbyte *HL_NAME(dgst_sign)(vbyte *data, int len, hl_ssl_pkey *key, vbyte
671841
unsigned char hash[MBEDTLS_MD_MAX_SIZE];
672842
size_t ssize = size ? *size : 0;
673843

674-
md = mbedtls_md_info_from_string((char*)alg);
844+
md = mbedtls_md_info_from_type(md_type_from_string((char*)alg));
675845
if (md == NULL) {
676846
hl_error("Invalid hash algorithm");
677847
return NULL;
@@ -681,7 +851,10 @@ HL_PRIM vbyte *HL_NAME(dgst_sign)(vbyte *data, int len, hl_ssl_pkey *key, vbyte
681851
ssl_error(r);
682852
return NULL;
683853
}
684-
#if MBEDTLS_VERSION_MAJOR >= 3
854+
#if MBEDTLS_VERSION_MAJOR >= 4
855+
out = hl_gc_alloc_noptr(MBEDTLS_PK_SIGNATURE_MAX_SIZE);
856+
if ((r = mbedtls_pk_sign(key->k, mbedtls_md_get_type(md), hash, mbedtls_md_get_size(md), out, MBEDTLS_PK_SIGNATURE_MAX_SIZE, (size ? &ssize : NULL))) != 0) {
857+
#elif MBEDTLS_VERSION_MAJOR >= 3
685858
out = hl_gc_alloc_noptr(MBEDTLS_PK_SIGNATURE_MAX_SIZE);
686859
if ((r = mbedtls_pk_sign(key->k, mbedtls_md_get_type(md), hash, mbedtls_md_get_size(md), out, MBEDTLS_PK_SIGNATURE_MAX_SIZE, (size ? &ssize : NULL), mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) {
687860
#else
@@ -700,7 +873,7 @@ HL_PRIM bool HL_NAME(dgst_verify)(vbyte *data, int dlen, vbyte *sign, int slen,
700873
int r = -1;
701874
unsigned char hash[MBEDTLS_MD_MAX_SIZE];
702875

703-
md = mbedtls_md_info_from_string((char*)alg);
876+
md = mbedtls_md_info_from_type(md_type_from_string((char*)alg));
704877
if (md == NULL) {
705878
hl_error("Invalid hash algorithm");
706879
return false;
@@ -764,10 +937,11 @@ HL_PRIM void HL_NAME(ssl_init)() {
764937
#endif
765938

766939
// Init RNG
940+
#if MBEDTLS_VERSION_MAJOR < 4
767941
mbedtls_entropy_init(&entropy);
768942
mbedtls_ctr_drbg_init(&ctr_drbg);
769943
mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);
770-
944+
#endif
771945
#ifdef MBEDTLS_PSA_CRYPTO_C
772946
psa_crypto_init();
773947
#endif

0 commit comments

Comments
 (0)