Skip to content

Commit c8753aa

Browse files
PataterPatater
committed
WIP mbedtls: Update Mbed TLS and Mbed Crypto
TODO Use official release tags
1 parent 5451a3d commit c8753aa

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

119 files changed

+9705
-2900
lines changed

‎features/mbedtls/VERSION.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
mbedtls-2.18.1
1+
mbedtls-2.17.0-745-g9ed851d27ff0

‎features/mbedtls/importer/Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@
2727
#
2828

2929
# Set the mbed TLS release to import (this can/should be edited before import)
30-
MBED_TLS_RELEASE ?= mbedtls-2.18.1
31-
MBED_TLS_REPO_URL ?= [email protected]:ARMmbed/mbedtls-restricted.git
30+
MBED_TLS_RELEASE ?= development
31+
MBED_TLS_REPO_URL ?= [email protected]:ARMmbed/mbedtls.git
3232

3333
# Translate between mbed TLS namespace and mbed namespace
3434
TARGET_PREFIX:=../

‎features/mbedtls/inc/mbedtls/certs.h

Lines changed: 191 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
#define MBEDTLS_CERTS_H
2626

2727
#if !defined(MBEDTLS_CONFIG_FILE)
28-
#include "config.h"
28+
#include "mbedtls/config.h"
2929
#else
3030
#include MBEDTLS_CONFIG_FILE
3131
#endif
@@ -36,68 +36,214 @@
3636
extern "C" {
3737
#endif
3838

39+
/* List of all PEM-encoded CA certificates, terminated by NULL;
40+
* PEM encoded if MBEDTLS_PEM_PARSE_C is enabled, DER encoded
41+
* otherwise. */
42+
extern const char * mbedtls_test_cas[];
43+
extern const size_t mbedtls_test_cas_len[];
44+
45+
/* List of all DER-encoded CA certificates, terminated by NULL */
46+
extern const unsigned char * mbedtls_test_cas_der[];
47+
extern const size_t mbedtls_test_cas_der_len[];
48+
3949
#if defined(MBEDTLS_PEM_PARSE_C)
4050
/* Concatenation of all CA certificates in PEM format if available */
4151
extern const char mbedtls_test_cas_pem[];
4252
extern const size_t mbedtls_test_cas_pem_len;
43-
#endif
44-
45-
/* List of all CA certificates, terminated by NULL */
46-
extern const char * mbedtls_test_cas[];
47-
extern const size_t mbedtls_test_cas_len[];
53+
#endif /* MBEDTLS_PEM_PARSE_C */
4854

4955
/*
50-
* Convenience for users who just want a certificate:
51-
* RSA by default, or ECDSA if RSA is not available
56+
* CA test certificates
5257
*/
58+
59+
extern const char mbedtls_test_ca_crt_ec_pem[];
60+
extern const char mbedtls_test_ca_key_ec_pem[];
61+
extern const char mbedtls_test_ca_pwd_ec_pem[];
62+
extern const char mbedtls_test_ca_key_rsa_pem[];
63+
extern const char mbedtls_test_ca_pwd_rsa_pem[];
64+
extern const char mbedtls_test_ca_crt_rsa_sha1_pem[];
65+
extern const char mbedtls_test_ca_crt_rsa_sha256_pem[];
66+
67+
extern const unsigned char mbedtls_test_ca_crt_ec_der[];
68+
extern const unsigned char mbedtls_test_ca_key_ec_der[];
69+
extern const unsigned char mbedtls_test_ca_key_rsa_der[];
70+
extern const unsigned char mbedtls_test_ca_crt_rsa_sha1_der[];
71+
extern const unsigned char mbedtls_test_ca_crt_rsa_sha256_der[];
72+
73+
extern const size_t mbedtls_test_ca_crt_ec_pem_len;
74+
extern const size_t mbedtls_test_ca_key_ec_pem_len;
75+
extern const size_t mbedtls_test_ca_pwd_ec_pem_len;
76+
extern const size_t mbedtls_test_ca_key_rsa_pem_len;
77+
extern const size_t mbedtls_test_ca_pwd_rsa_pem_len;
78+
extern const size_t mbedtls_test_ca_crt_rsa_sha1_pem_len;
79+
extern const size_t mbedtls_test_ca_crt_rsa_sha256_pem_len;
80+
81+
extern const size_t mbedtls_test_ca_crt_ec_der_len;
82+
extern const size_t mbedtls_test_ca_key_ec_der_len;
83+
extern const size_t mbedtls_test_ca_pwd_ec_der_len;
84+
extern const size_t mbedtls_test_ca_key_rsa_der_len;
85+
extern const size_t mbedtls_test_ca_pwd_rsa_der_len;
86+
extern const size_t mbedtls_test_ca_crt_rsa_sha1_der_len;
87+
extern const size_t mbedtls_test_ca_crt_rsa_sha256_der_len;
88+
89+
/* Config-dependent dispatch between PEM and DER encoding
90+
* (PEM if enabled, otherwise DER) */
91+
92+
extern const char mbedtls_test_ca_crt_ec[];
93+
extern const char mbedtls_test_ca_key_ec[];
94+
extern const char mbedtls_test_ca_pwd_ec[];
95+
extern const char mbedtls_test_ca_key_rsa[];
96+
extern const char mbedtls_test_ca_pwd_rsa[];
97+
extern const char mbedtls_test_ca_crt_rsa_sha1[];
98+
extern const char mbedtls_test_ca_crt_rsa_sha256[];
99+
100+
extern const size_t mbedtls_test_ca_crt_ec_len;
101+
extern const size_t mbedtls_test_ca_key_ec_len;
102+
extern const size_t mbedtls_test_ca_pwd_ec_len;
103+
extern const size_t mbedtls_test_ca_key_rsa_len;
104+
extern const size_t mbedtls_test_ca_pwd_rsa_len;
105+
extern const size_t mbedtls_test_ca_crt_rsa_sha1_len;
106+
extern const size_t mbedtls_test_ca_crt_rsa_sha256_len;
107+
108+
/* Config-dependent dispatch between SHA-1 and SHA-256
109+
* (SHA-256 if enabled, otherwise SHA-1) */
110+
111+
extern const char mbedtls_test_ca_crt_rsa[];
112+
extern const size_t mbedtls_test_ca_crt_rsa_len;
113+
114+
/* Config-dependent dispatch between EC and RSA
115+
* (RSA if enabled, otherwise EC) */
116+
53117
extern const char * mbedtls_test_ca_crt;
54-
extern const size_t mbedtls_test_ca_crt_len;
55118
extern const char * mbedtls_test_ca_key;
56-
extern const size_t mbedtls_test_ca_key_len;
57119
extern const char * mbedtls_test_ca_pwd;
120+
extern const size_t mbedtls_test_ca_crt_len;
121+
extern const size_t mbedtls_test_ca_key_len;
58122
extern const size_t mbedtls_test_ca_pwd_len;
123+
124+
/*
125+
* Server test certificates
126+
*/
127+
128+
extern const char mbedtls_test_srv_crt_ec_pem[];
129+
extern const char mbedtls_test_srv_key_ec_pem[];
130+
extern const char mbedtls_test_srv_pwd_ec_pem[];
131+
extern const char mbedtls_test_srv_key_rsa_pem[];
132+
extern const char mbedtls_test_srv_pwd_rsa_pem[];
133+
extern const char mbedtls_test_srv_crt_rsa_sha1_pem[];
134+
extern const char mbedtls_test_srv_crt_rsa_sha256_pem[];
135+
136+
extern const unsigned char mbedtls_test_srv_crt_ec_der[];
137+
extern const unsigned char mbedtls_test_srv_key_ec_der[];
138+
extern const unsigned char mbedtls_test_srv_key_rsa_der[];
139+
extern const unsigned char mbedtls_test_srv_crt_rsa_sha1_der[];
140+
extern const unsigned char mbedtls_test_srv_crt_rsa_sha256_der[];
141+
142+
extern const size_t mbedtls_test_srv_crt_ec_pem_len;
143+
extern const size_t mbedtls_test_srv_key_ec_pem_len;
144+
extern const size_t mbedtls_test_srv_pwd_ec_pem_len;
145+
extern const size_t mbedtls_test_srv_key_rsa_pem_len;
146+
extern const size_t mbedtls_test_srv_pwd_rsa_pem_len;
147+
extern const size_t mbedtls_test_srv_crt_rsa_sha1_pem_len;
148+
extern const size_t mbedtls_test_srv_crt_rsa_sha256_pem_len;
149+
150+
extern const size_t mbedtls_test_srv_crt_ec_der_len;
151+
extern const size_t mbedtls_test_srv_key_ec_der_len;
152+
extern const size_t mbedtls_test_srv_pwd_ec_der_len;
153+
extern const size_t mbedtls_test_srv_key_rsa_der_len;
154+
extern const size_t mbedtls_test_srv_pwd_rsa_der_len;
155+
extern const size_t mbedtls_test_srv_crt_rsa_sha1_der_len;
156+
extern const size_t mbedtls_test_srv_crt_rsa_sha256_der_len;
157+
158+
/* Config-dependent dispatch between PEM and DER encoding
159+
* (PEM if enabled, otherwise DER) */
160+
161+
extern const char mbedtls_test_srv_crt_ec[];
162+
extern const char mbedtls_test_srv_key_ec[];
163+
extern const char mbedtls_test_srv_pwd_ec[];
164+
extern const char mbedtls_test_srv_key_rsa[];
165+
extern const char mbedtls_test_srv_pwd_rsa[];
166+
extern const char mbedtls_test_srv_crt_rsa_sha1[];
167+
extern const char mbedtls_test_srv_crt_rsa_sha256[];
168+
169+
extern const size_t mbedtls_test_srv_crt_ec_len;
170+
extern const size_t mbedtls_test_srv_key_ec_len;
171+
extern const size_t mbedtls_test_srv_pwd_ec_len;
172+
extern const size_t mbedtls_test_srv_key_rsa_len;
173+
extern const size_t mbedtls_test_srv_pwd_rsa_len;
174+
extern const size_t mbedtls_test_srv_crt_rsa_sha1_len;
175+
extern const size_t mbedtls_test_srv_crt_rsa_sha256_len;
176+
177+
/* Config-dependent dispatch between SHA-1 and SHA-256
178+
* (SHA-256 if enabled, otherwise SHA-1) */
179+
180+
extern const char mbedtls_test_srv_crt_rsa[];
181+
extern const size_t mbedtls_test_srv_crt_rsa_len;
182+
183+
/* Config-dependent dispatch between EC and RSA
184+
* (RSA if enabled, otherwise EC) */
185+
59186
extern const char * mbedtls_test_srv_crt;
60-
extern const size_t mbedtls_test_srv_crt_len;
61187
extern const char * mbedtls_test_srv_key;
188+
extern const char * mbedtls_test_srv_pwd;
189+
extern const size_t mbedtls_test_srv_crt_len;
62190
extern const size_t mbedtls_test_srv_key_len;
63-
extern const char * mbedtls_test_cli_crt;
64-
extern const size_t mbedtls_test_cli_crt_len;
65-
extern const char * mbedtls_test_cli_key;
66-
extern const size_t mbedtls_test_cli_key_len;
191+
extern const size_t mbedtls_test_srv_pwd_len;
192+
193+
/*
194+
* Client test certificates
195+
*/
196+
197+
extern const char mbedtls_test_cli_crt_ec_pem[];
198+
extern const char mbedtls_test_cli_key_ec_pem[];
199+
extern const char mbedtls_test_cli_pwd_ec_pem[];
200+
extern const char mbedtls_test_cli_key_rsa_pem[];
201+
extern const char mbedtls_test_cli_pwd_rsa_pem[];
202+
extern const char mbedtls_test_cli_crt_rsa_pem[];
203+
204+
extern const unsigned char mbedtls_test_cli_crt_ec_der[];
205+
extern const unsigned char mbedtls_test_cli_key_ec_der[];
206+
extern const unsigned char mbedtls_test_cli_key_rsa_der[];
207+
extern const unsigned char mbedtls_test_cli_crt_rsa_der[];
208+
209+
extern const size_t mbedtls_test_cli_crt_ec_pem_len;
210+
extern const size_t mbedtls_test_cli_key_ec_pem_len;
211+
extern const size_t mbedtls_test_cli_pwd_ec_pem_len;
212+
extern const size_t mbedtls_test_cli_key_rsa_pem_len;
213+
extern const size_t mbedtls_test_cli_pwd_rsa_pem_len;
214+
extern const size_t mbedtls_test_cli_crt_rsa_pem_len;
215+
216+
extern const size_t mbedtls_test_cli_crt_ec_der_len;
217+
extern const size_t mbedtls_test_cli_key_ec_der_len;
218+
extern const size_t mbedtls_test_cli_key_rsa_der_len;
219+
extern const size_t mbedtls_test_cli_crt_rsa_der_len;
220+
221+
/* Config-dependent dispatch between PEM and DER encoding
222+
* (PEM if enabled, otherwise DER) */
223+
224+
extern const char mbedtls_test_cli_crt_ec[];
225+
extern const char mbedtls_test_cli_key_ec[];
226+
extern const char mbedtls_test_cli_pwd_ec[];
227+
extern const char mbedtls_test_cli_key_rsa[];
228+
extern const char mbedtls_test_cli_pwd_rsa[];
229+
extern const char mbedtls_test_cli_crt_rsa[];
67230

68-
#if defined(MBEDTLS_ECDSA_C)
69-
extern const char mbedtls_test_ca_crt_ec[];
70-
extern const size_t mbedtls_test_ca_crt_ec_len;
71-
extern const char mbedtls_test_ca_key_ec[];
72-
extern const size_t mbedtls_test_ca_key_ec_len;
73-
extern const char mbedtls_test_ca_pwd_ec[];
74-
extern const size_t mbedtls_test_ca_pwd_ec_len;
75-
extern const char mbedtls_test_srv_crt_ec[];
76-
extern const size_t mbedtls_test_srv_crt_ec_len;
77-
extern const char mbedtls_test_srv_key_ec[];
78-
extern const size_t mbedtls_test_srv_key_ec_len;
79-
extern const char mbedtls_test_cli_crt_ec[];
80231
extern const size_t mbedtls_test_cli_crt_ec_len;
81-
extern const char mbedtls_test_cli_key_ec[];
82232
extern const size_t mbedtls_test_cli_key_ec_len;
83-
#endif
84-
85-
#if defined(MBEDTLS_RSA_C)
86-
extern const char mbedtls_test_ca_crt_rsa[];
87-
extern const size_t mbedtls_test_ca_crt_rsa_len;
88-
extern const char mbedtls_test_ca_key_rsa[];
89-
extern const size_t mbedtls_test_ca_key_rsa_len;
90-
extern const char mbedtls_test_ca_pwd_rsa[];
91-
extern const size_t mbedtls_test_ca_pwd_rsa_len;
92-
extern const char mbedtls_test_srv_crt_rsa[];
93-
extern const size_t mbedtls_test_srv_crt_rsa_len;
94-
extern const char mbedtls_test_srv_key_rsa[];
95-
extern const size_t mbedtls_test_srv_key_rsa_len;
96-
extern const char mbedtls_test_cli_crt_rsa[];
97-
extern const size_t mbedtls_test_cli_crt_rsa_len;
98-
extern const char mbedtls_test_cli_key_rsa[];
233+
extern const size_t mbedtls_test_cli_pwd_ec_len;
99234
extern const size_t mbedtls_test_cli_key_rsa_len;
100-
#endif
235+
extern const size_t mbedtls_test_cli_pwd_rsa_len;
236+
extern const size_t mbedtls_test_cli_crt_rsa_len;
237+
238+
/* Config-dependent dispatch between EC and RSA
239+
* (RSA if enabled, otherwise EC) */
240+
241+
extern const char * mbedtls_test_cli_crt;
242+
extern const char * mbedtls_test_cli_key;
243+
extern const char * mbedtls_test_cli_pwd;
244+
extern const size_t mbedtls_test_cli_crt_len;
245+
extern const size_t mbedtls_test_cli_key_len;
246+
extern const size_t mbedtls_test_cli_pwd_len;
101247

102248
#ifdef __cplusplus
103249
}

‎features/mbedtls/inc/mbedtls/compat-1.3.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
*/
2727

2828
#if !defined(MBEDTLS_CONFIG_FILE)
29-
#include "config.h"
29+
#include "mbedtls/config.h"
3030
#else
3131
#include MBEDTLS_CONFIG_FILE
3232
#endif

‎features/mbedtls/inc/mbedtls/config.h

Lines changed: 51 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -293,28 +293,52 @@
293293
* For example, when a function accepts as input a pointer to a buffer that may
294294
* contain untrusted data, and its documentation mentions that this pointer
295295
* must not be NULL:
296-
* - the pointer is checked to be non-NULL only if this option is enabled
297-
* - the content of the buffer is always validated
296+
* - The pointer is checked to be non-NULL only if this option is enabled.
297+
* - The content of the buffer is always validated.
298298
*
299299
* When this flag is defined, if a library function receives a parameter that
300-
* is invalid, it will:
301-
* - invoke the macro MBEDTLS_PARAM_FAILED() which by default expands to a
302-
* call to the function mbedtls_param_failed()
303-
* - immediately return (with a specific error code unless the function
304-
* returns void and can't communicate an error).
305-
*
306-
* When defining this flag, you also need to:
307-
* - either provide a definition of the function mbedtls_param_failed() in
308-
* your application (see platform_util.h for its prototype) as the library
309-
* calls that function, but does not provide a default definition for it,
310-
* - or provide a different definition of the macro MBEDTLS_PARAM_FAILED()
311-
* below if the above mechanism is not flexible enough to suit your needs.
312-
* See the documentation of this macro later in this file.
300+
* is invalid:
301+
* 1. The function will invoke the macro MBEDTLS_PARAM_FAILED().
302+
* 2. If MBEDTLS_PARAM_FAILED() did not terminate the program, the function
303+
* will immediately return. If the function returns an Mbed TLS error code,
304+
* the error code in this case is MBEDTLS_ERR_xxx_BAD_INPUT_DATA.
305+
*
306+
* When defining this flag, you also need to arrange a definition for
307+
* MBEDTLS_PARAM_FAILED(). You can do this by any of the following methods:
308+
* - By default, the library defines MBEDTLS_PARAM_FAILED() to call a
309+
* function mbedtls_param_failed(), but the library does not define this
310+
* function. If you do not make any other arrangements, you must provide
311+
* the function mbedtls_param_failed() in your application.
312+
* See `platform_util.h` for its prototype.
313+
* - If you enable the macro #MBEDTLS_CHECK_PARAMS_ASSERT, then the
314+
* library defines MBEDTLS_PARAM_FAILED(\c cond) to be `assert(cond)`.
315+
* You can still supply an alternative definition of
316+
* MBEDTLS_PARAM_FAILED(), which may call `assert`.
317+
* - If you define a macro MBEDTLS_PARAM_FAILED() before including `config.h`
318+
* or you uncomment the definition of MBEDTLS_PARAM_FAILED() in `config.h`,
319+
* the library will call the macro that you defined and will not supply
320+
* its own version. Note that if MBEDTLS_PARAM_FAILED() calls `assert`,
321+
* you need to enable #MBEDTLS_CHECK_PARAMS_ASSERT so that library source
322+
* files include `<assert.h>`.
313323
*
314324
* Uncomment to enable validation of application-controlled parameters.
315325
*/
316326
//#define MBEDTLS_CHECK_PARAMS
317327

328+
/**
329+
* \def MBEDTLS_CHECK_PARAMS_ASSERT
330+
*
331+
* Allow MBEDTLS_PARAM_FAILED() to call `assert`, and make it default to
332+
* `assert`. This macro is only used if #MBEDTLS_CHECK_PARAMS is defined.
333+
*
334+
* If this macro is not defined, then MBEDTLS_PARAM_FAILED() defaults to
335+
* calling a function mbedtls_param_failed(). See the documentation of
336+
* #MBEDTLS_CHECK_PARAMS for details.
337+
*
338+
* Uncomment to allow MBEDTLS_PARAM_FAILED() to call `assert`.
339+
*/
340+
//#define MBEDTLS_CHECK_PARAMS_ASSERT
341+
318342
/* \} name SECTION: System support */
319343

320344
/**
@@ -3272,13 +3296,16 @@
32723296

32733297
/**
32743298
* \brief This macro is invoked by the library when an invalid parameter
3275-
* is detected that is only checked with MBEDTLS_CHECK_PARAMS
3299+
* is detected that is only checked with #MBEDTLS_CHECK_PARAMS
32763300
* (see the documentation of that option for context).
32773301
*
3278-
* When you leave this undefined here, a default definition is
3279-
* provided that invokes the function mbedtls_param_failed(),
3280-
* which is declared in platform_util.h for the benefit of the
3281-
* library, but that you need to define in your application.
3302+
* When you leave this undefined here, the library provides
3303+
* a default definition. If the macro #MBEDTLS_CHECK_PARAMS_ASSERT
3304+
* is defined, the default definition is `assert(cond)`,
3305+
* otherwise the default definition calls a function
3306+
* mbedtls_param_failed(). This function is declared in
3307+
* `platform_util.h` for the benefit of the library, but
3308+
* you need to define in your application.
32823309
*
32833310
* When you define this here, this replaces the default
32843311
* definition in platform_util.h (which no longer declares the
@@ -3287,6 +3314,9 @@
32873314
* particular, that all the necessary declarations are visible
32883315
* from within the library - you can ensure that by providing
32893316
* them in this file next to the macro definition).
3317+
* If you define this macro to call `assert`, also define
3318+
* #MBEDTLS_CHECK_PARAMS_ASSERT so that library source files
3319+
* include `<assert.h>`.
32903320
*
32913321
* Note that you may define this macro to expand to nothing, in
32923322
* which case you don't have to worry about declarations or
@@ -3532,7 +3562,7 @@
35323562
#include MBEDTLS_USER_CONFIG_FILE
35333563
#endif
35343564

3535-
#include "check_config.h"
3565+
#include "mbedtls/check_config.h"
35363566

35373567
#endif /* !MBEDTLS_ENTROPY_HARDWARE_ALT && !MBEDTLS_TEST_NULL_ENTROPY && !MBEDTLS_ENTROPY_NV_SEED */
35383568

0 commit comments

Comments
 (0)