wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-11-13 17:00:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3373 from cesanta/mbedtls4

Browse Source 
Add support for MbedTLS 4
This commit is contained in:
Sergio R. Caprile authored and GitHub committed 2025-12-12 20:23:43 -03:00
2 parents 9aae863956 e15056a9e4
commit a49eb47a91
3 files changed
+55 -23
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/nightly.yml
+1 -1
View File
@@ -163,7 +163,7 @@ jobs:
name: macos SSL=${{ matrix.ssl }} TFLAGS=${{ matrix.select }} name: macos SSL=${{ matrix.ssl }} TFLAGS=${{ matrix.select }}
env: env:
SSL: ${{ matrix.ssl }} SSL: ${{ matrix.ssl }}
TFLAGS: ${{ matrix.select }} -DMQTT_LOCALHOST ${{ matrix.env.tflags }} -DNO_ABORT -Wno-sign-conversion # Workaround for MbedTLS 3.5.0 TFLAGS: ${{ matrix.select }} -DMQTT_LOCALHOST ${{ matrix.env.tflags }} -DNO_ABORT -Wno-sign-conversion -Wno-undef # Workarounds for MbedTLS
HOMEBREW_NO_AUTO_UPDATE: 1 HOMEBREW_NO_AUTO_UPDATE: 1
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@v4
mongoose.c
+27 -11
View File
@@ -15265,7 +15265,8 @@ void mg_tls_ctx_free(struct mg_mgr *mgr) {
#if MG_TLS == MG_TLS_MBED #if MG_TLS == MG_TLS_MBED
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000 #if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000 && \
MBEDTLS_VERSION_NUMBER < 0x04000000
#define MG_MBEDTLS_RNG_GET , mg_mbed_rng, NULL #define MG_MBEDTLS_RNG_GET , mg_mbed_rng, NULL
#else #else
#define MG_MBEDTLS_RNG_GET #define MG_MBEDTLS_RNG_GET
@@ -15278,11 +15279,14 @@ static int mg_tls_err(struct mg_connection *c, int rc) {
return rc; return rc;
} }
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x04000000
#else
static int mg_mbed_rng(void *ctx, unsigned char *buf, size_t len) { static int mg_mbed_rng(void *ctx, unsigned char *buf, size_t len) {
mg_random(buf, len); mg_random(buf, len);
(void) ctx; (void) ctx;
return 0; return 0;
} }
#endif
static bool mg_load_cert(struct mg_str str, mbedtls_x509_crt *p) { static bool mg_load_cert(struct mg_str str, mbedtls_x509_crt *p) {
int rc; int rc;
@@ -15320,7 +15324,7 @@ void mg_tls_free(struct mg_connection *c) {
#endif #endif
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000 && \ #if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000 && \
defined(MBEDTLS_PSA_CRYPTO_C) defined(MBEDTLS_PSA_CRYPTO_C)
mbedtls_psa_crypto_free(); // https://github.com/Mbed-TLS/mbedtls/issues/9223#issuecomment-2144898336 mbedtls_psa_crypto_free(); // https://github.com/Mbed-TLS/mbedtls/issues/9223#issuecomment-2144898336
#endif #endif
mg_free(tls); mg_free(tls);
c->tls = NULL; c->tls = NULL;
@@ -15398,7 +15402,11 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
mg_error(c, "tls defaults %#x", -mg_tls_err(c, rc)); mg_error(c, "tls defaults %#x", -mg_tls_err(c, rc));
goto fail; goto fail;
} }
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x04000000
MG_INFO(("PSA is in control of random number generation"));
#else
mbedtls_ssl_conf_rng(&tls->conf, mg_mbed_rng, c); mbedtls_ssl_conf_rng(&tls->conf, mg_mbed_rng, c);
#endif
if (opts->ca.len == 0 || mg_strcmp(opts->ca, mg_str("*")) == 0) { if (opts->ca.len == 0 || mg_strcmp(opts->ca, mg_str("*")) == 0) {
// NOTE: MBEDTLS_SSL_VERIFY_NONE is not supported for TLS1.3 on client side // NOTE: MBEDTLS_SSL_VERIFY_NONE is not supported for TLS1.3 on client side
@@ -15450,7 +15458,7 @@ size_t mg_tls_pending(struct mg_connection *c) {
long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) { long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) {
struct mg_tls *tls = (struct mg_tls *) c->tls; struct mg_tls *tls = (struct mg_tls *) c->tls;
long n = mbedtls_ssl_read(&tls->ssl, (unsigned char *) buf, len); long n = mbedtls_ssl_read(&tls->ssl, (unsigned char *) buf, len);
if (!c->is_tls_hs && buf == NULL && n == 0) return 0; // TODO(): MIP if (!c->is_tls_hs && buf == NULL && n == 0) return 0; // TODO(): MIP
if (n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE) if (n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE)
return MG_IO_WAIT; return MG_IO_WAIT;
#if defined(MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET) #if defined(MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
@@ -15474,10 +15482,11 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
(n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE); (n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE);
if (was_throttled) return MG_IO_WAIT; // flushed throttled data instead if (was_throttled) return MG_IO_WAIT; // flushed throttled data instead
if (c->is_tls_throttled) { if (c->is_tls_throttled) {
tls->throttled_buf = (unsigned char *)buf; // MbedTLS code actually ignores tls->throttled_buf =
tls->throttled_len = len; // these, but let's play API rules (unsigned char *) buf; // MbedTLS code actually ignores
return (long) len; // already encripted that when throttled tls->throttled_len = len; // these, but let's play API rules
} // if last chunk fails to be sent, it needs to be flushed return (long) len; // already encripted that when throttled
} // if last chunk fails to be sent, it needs to be flushed
if (n <= 0) return MG_IO_ERR; if (n <= 0) return MG_IO_ERR;
return n; return n;
} }
@@ -15485,8 +15494,10 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
void mg_tls_flush(struct mg_connection *c) { void mg_tls_flush(struct mg_connection *c) {
struct mg_tls *tls = (struct mg_tls *) c->tls; struct mg_tls *tls = (struct mg_tls *) c->tls;
if (c->is_tls_throttled) { if (c->is_tls_throttled) {
long n = mbedtls_ssl_write(&tls->ssl, tls->throttled_buf, tls->throttled_len); long n =
c->is_tls_throttled = (n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE); mbedtls_ssl_write(&tls->ssl, tls->throttled_buf, tls->throttled_len);
c->is_tls_throttled =
(n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE);
} }
} }
@@ -15498,9 +15509,14 @@ void mg_tls_ctx_init(struct mg_mgr *mgr) {
#ifdef MBEDTLS_SSL_SESSION_TICKETS #ifdef MBEDTLS_SSL_SESSION_TICKETS
int rc; int rc;
mbedtls_ssl_ticket_init(&ctx->tickets); mbedtls_ssl_ticket_init(&ctx->tickets);
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x04000000
if ((rc = mbedtls_ssl_ticket_setup(&ctx->tickets, PSA_ALG_GCM,
PSA_KEY_TYPE_AES, 128, 86400))
#else
if ((rc = mbedtls_ssl_ticket_setup(&ctx->tickets, mg_mbed_rng, NULL, if ((rc = mbedtls_ssl_ticket_setup(&ctx->tickets, mg_mbed_rng, NULL,
MBEDTLS_CIPHER_AES_128_GCM, 86400)) != MBEDTLS_CIPHER_AES_128_GCM, 86400))
0) { #endif
!= 0) {
MG_ERROR((" mbedtls_ssl_ticket_setup %#x", -rc)); MG_ERROR((" mbedtls_ssl_ticket_setup %#x", -rc));
} }
#endif #endif
src/tls_mbed.c
+27 -11
View File
@@ -6,7 +6,8 @@
#if MG_TLS == MG_TLS_MBED #if MG_TLS == MG_TLS_MBED
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000 #if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000 && \
MBEDTLS_VERSION_NUMBER < 0x04000000
#define MG_MBEDTLS_RNG_GET , mg_mbed_rng, NULL #define MG_MBEDTLS_RNG_GET , mg_mbed_rng, NULL
#else #else
#define MG_MBEDTLS_RNG_GET #define MG_MBEDTLS_RNG_GET
@@ -19,11 +20,14 @@ static int mg_tls_err(struct mg_connection *c, int rc) {
return rc; return rc;
} }
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x04000000
#else
static int mg_mbed_rng(void *ctx, unsigned char *buf, size_t len) { static int mg_mbed_rng(void *ctx, unsigned char *buf, size_t len) {
mg_random(buf, len); mg_random(buf, len);
(void) ctx; (void) ctx;
return 0; return 0;
} }
#endif
static bool mg_load_cert(struct mg_str str, mbedtls_x509_crt *p) { static bool mg_load_cert(struct mg_str str, mbedtls_x509_crt *p) {
int rc; int rc;
@@ -61,7 +65,7 @@ void mg_tls_free(struct mg_connection *c) {
#endif #endif
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000 && \ #if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000 && \
defined(MBEDTLS_PSA_CRYPTO_C) defined(MBEDTLS_PSA_CRYPTO_C)
mbedtls_psa_crypto_free(); // https://github.com/Mbed-TLS/mbedtls/issues/9223#issuecomment-2144898336 mbedtls_psa_crypto_free(); // https://github.com/Mbed-TLS/mbedtls/issues/9223#issuecomment-2144898336
#endif #endif
mg_free(tls); mg_free(tls);
c->tls = NULL; c->tls = NULL;
@@ -139,7 +143,11 @@ void mg_tls_init(struct mg_connection *c, const struct mg_tls_opts *opts) {
mg_error(c, "tls defaults %#x", -mg_tls_err(c, rc)); mg_error(c, "tls defaults %#x", -mg_tls_err(c, rc));
goto fail; goto fail;
} }
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x04000000
MG_INFO(("PSA is in control of random number generation"));
#else
mbedtls_ssl_conf_rng(&tls->conf, mg_mbed_rng, c); mbedtls_ssl_conf_rng(&tls->conf, mg_mbed_rng, c);
#endif
if (opts->ca.len == 0 || mg_strcmp(opts->ca, mg_str("*")) == 0) { if (opts->ca.len == 0 || mg_strcmp(opts->ca, mg_str("*")) == 0) {
// NOTE: MBEDTLS_SSL_VERIFY_NONE is not supported for TLS1.3 on client side // NOTE: MBEDTLS_SSL_VERIFY_NONE is not supported for TLS1.3 on client side
@@ -191,7 +199,7 @@ size_t mg_tls_pending(struct mg_connection *c) {
long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) { long mg_tls_recv(struct mg_connection *c, void *buf, size_t len) {
struct mg_tls *tls = (struct mg_tls *) c->tls; struct mg_tls *tls = (struct mg_tls *) c->tls;
long n = mbedtls_ssl_read(&tls->ssl, (unsigned char *) buf, len); long n = mbedtls_ssl_read(&tls->ssl, (unsigned char *) buf, len);
if (!c->is_tls_hs && buf == NULL && n == 0) return 0; // TODO(): MIP if (!c->is_tls_hs && buf == NULL && n == 0) return 0; // TODO(): MIP
if (n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE) if (n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE)
return MG_IO_WAIT; return MG_IO_WAIT;
#if defined(MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET) #if defined(MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
@@ -215,10 +223,11 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
(n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE); (n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE);
if (was_throttled) return MG_IO_WAIT; // flushed throttled data instead if (was_throttled) return MG_IO_WAIT; // flushed throttled data instead
if (c->is_tls_throttled) { if (c->is_tls_throttled) {
tls->throttled_buf = (unsigned char *)buf; // MbedTLS code actually ignores tls->throttled_buf =
tls->throttled_len = len; // these, but let's play API rules (unsigned char *) buf; // MbedTLS code actually ignores
return (long) len; // already encripted that when throttled tls->throttled_len = len; // these, but let's play API rules
} // if last chunk fails to be sent, it needs to be flushed return (long) len; // already encripted that when throttled
} // if last chunk fails to be sent, it needs to be flushed
if (n <= 0) return MG_IO_ERR; if (n <= 0) return MG_IO_ERR;
return n; return n;
} }
@@ -226,8 +235,10 @@ long mg_tls_send(struct mg_connection *c, const void *buf, size_t len) {
void mg_tls_flush(struct mg_connection *c) { void mg_tls_flush(struct mg_connection *c) {
struct mg_tls *tls = (struct mg_tls *) c->tls; struct mg_tls *tls = (struct mg_tls *) c->tls;
if (c->is_tls_throttled) { if (c->is_tls_throttled) {
long n = mbedtls_ssl_write(&tls->ssl, tls->throttled_buf, tls->throttled_len); long n =
c->is_tls_throttled = (n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE); mbedtls_ssl_write(&tls->ssl, tls->throttled_buf, tls->throttled_len);
c->is_tls_throttled =
(n == MBEDTLS_ERR_SSL_WANT_READ || n == MBEDTLS_ERR_SSL_WANT_WRITE);
} }
} }
@@ -239,9 +250,14 @@ void mg_tls_ctx_init(struct mg_mgr *mgr) {
#ifdef MBEDTLS_SSL_SESSION_TICKETS #ifdef MBEDTLS_SSL_SESSION_TICKETS
int rc; int rc;
mbedtls_ssl_ticket_init(&ctx->tickets); mbedtls_ssl_ticket_init(&ctx->tickets);
#if defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x04000000
if ((rc = mbedtls_ssl_ticket_setup(&ctx->tickets, PSA_ALG_GCM,
PSA_KEY_TYPE_AES, 128, 86400))
#else
if ((rc = mbedtls_ssl_ticket_setup(&ctx->tickets, mg_mbed_rng, NULL, if ((rc = mbedtls_ssl_ticket_setup(&ctx->tickets, mg_mbed_rng, NULL,
MBEDTLS_CIPHER_AES_128_GCM, 86400)) != MBEDTLS_CIPHER_AES_128_GCM, 86400))
0) { #endif
!= 0) {
MG_ERROR((" mbedtls_ssl_ticket_setup %#x", -rc)); MG_ERROR((" mbedtls_ssl_ticket_setup %#x", -rc));
} }
#endif #endif