espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2026-05-05 20:35:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

mbedtls-3 update:

Browse Source 
1) Fix build issue in mbedtls
2) skip the public headers check in IDF
3)Update Kconfig Macros
4)Remove deprecated config options
5) Update the sha API according to new nomenclature
6) Update mbedtls_rsa_init usage
7) Include mbedtls/build_info.h instead of mbedtls/config.h
8) Dont include check_config.h
9) Add additional error message in esp_blufi_api.h
This commit is contained in:
Aditya Patwardhan
2021-05-28 18:43:32 +05:30
parent 0483bfbbfe
commit 45122533e0
40 changed files with 211 additions and 416 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/mbedtls/port/include/mbedtls/esp_config.h
+14 -87
View File
@@ -27,7 +27,7 @@
#define ESP_CONFIG_H
#include "sdkconfig.h"
#include "mbedtls/config.h"
#include "mbedtls/mbedtls_config.h"
#include "soc/soc_caps.h"
/**
@@ -959,9 +959,7 @@
*
* This only affects CBC ciphersuites, and is useless if none is defined.
*
* Requires: MBEDTLS_SSL_PROTO_TLS1 or
* MBEDTLS_SSL_PROTO_TLS1_1 or
* MBEDTLS_SSL_PROTO_TLS1_2
* Requires: MBEDTLS_SSL_PROTO_TLS1_2
*
* Comment this macro to disable support for Encrypt-then-MAC
*/
@@ -981,9 +979,7 @@
* renegotiation), since it actually fixes a more fundamental issue in the
* original SSL/TLS design, and has implications beyond Triple Handshake.
*
* Requires: MBEDTLS_SSL_PROTO_TLS1 or
* MBEDTLS_SSL_PROTO_TLS1_1 or
* MBEDTLS_SSL_PROTO_TLS1_2
* Requires: MBEDTLS_SSL_PROTO_TLS1_2
*
* Comment this macro to disable support for Extended Master Secret.
*/
@@ -1091,7 +1087,7 @@
/**
* \def MBEDTLS_SSL_RENEGOTIATION
*
* Disable support for TLS renegotiation.
* Enable support for TLS renegotiation.
*
* The two main uses of renegotiation are (1) refresh keys on long-lived
* connections and (2) client authentication after the initial handshake.
@@ -1100,6 +1096,13 @@
* misuse/misunderstand.
*
* Comment this to disable support for renegotiation.
*
* \note Even if this option is disabled, both client and server are aware
* of the Renegotiation Indication Extension (RFC 5746) used to
* prevent the SSL renegotiation attack (see RFC 5746 Sect. 1).
* (See \c mbedtls_ssl_conf_legacy_renegotiation for the
* configuration of this extension).
*
*/
#ifdef CONFIG_MBEDTLS_SSL_RENEGOTIATION
#define MBEDTLS_SSL_RENEGOTIATION
@@ -1116,21 +1119,6 @@
*/
#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
/**
* \def MBEDTLS_SSL_PROTO_TLS1_1
*
* Enable support for TLS 1.1 (and DTLS 1.0 if DTLS is enabled).
*
* Requires: MBEDTLS_MD5_C
* MBEDTLS_SHA1_C
*
* Comment this macro to disable support for TLS 1.1 / DTLS 1.0
*/
#ifdef CONFIG_MBEDTLS_SSL_PROTO_TLS1_1
#define MBEDTLS_SSL_PROTO_TLS1_1
#else
#undef MBEDTLS_SSL_PROTO_TLS1_1
#endif
/**
* \def MBEDTLS_SSL_PROTO_TLS1_2
@@ -1153,11 +1141,9 @@
*
* Enable support for DTLS (all available versions).
*
* Enable this and MBEDTLS_SSL_PROTO_TLS1_1 to enable DTLS 1.0,
* and/or this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2.
* Enable this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2.
*
* Requires: MBEDTLS_SSL_PROTO_TLS1_1
* or MBEDTLS_SSL_PROTO_TLS1_2
* Requires: MBEDTLS_SSL_PROTO_TLS1_2
*
* Comment this macro to disable support for DTLS
*/
@@ -1276,21 +1262,6 @@
#undef MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
#endif
/**
* \def MBEDTLS_SSL_DTLS_BADMAC_LIMIT
*
* Enable support for a limit of records with bad MAC.
*
* See mbedtls_ssl_conf_dtls_badmac_limit().
*
* Requires: MBEDTLS_SSL_PROTO_DTLS
*/
#ifdef CONFIG_MBEDTLS_SSL_PROTO_DTLS
#define MBEDTLS_SSL_DTLS_BADMAC_LIMIT
#else
#undef MBEDTLS_SSL_DTLS_BADMAC_LIMIT
#endif
/**
* \def MBEDTLS_SSL_SESSION_TICKETS
*
@@ -1330,14 +1301,6 @@
*/
#define MBEDTLS_SSL_SERVER_NAME_INDICATION
/**
* \def MBEDTLS_SSL_TRUNCATED_HMAC
*
* Enable support for RFC 6066 truncated HMAC in SSL.
*
* Comment this macro to disable support for truncated HMAC in SSL
*/
#define MBEDTLS_SSL_TRUNCATED_HMAC
/**
* \def MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
@@ -1367,40 +1330,6 @@
*/
#define MBEDTLS_VERSION_FEATURES
/**
* \def MBEDTLS_X509_CHECK_KEY_USAGE
*
* Enable verification of the keyUsage extension (CA and leaf certificates).
*
* Disabling this avoids problems with mis-issued and/or misused
* (intermediate) CA and leaf certificates.
*
* \warning Depending on your PKI use, disabling this can be a security risk!
*
* Comment to skip keyUsage checking for both CA and leaf certificates.
*/
#ifdef CONFIG_MBEDTLS_X509_CHECK_KEY_USAGE
#define MBEDTLS_X509_CHECK_KEY_USAGE
#else
#undef MBEDTLS_X509_CHECK_KEY_USAGE
#endif
/**
* \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
*
* Enable verification of the extendedKeyUsage extension (leaf certificates).
*
* Disabling this avoids problems with mis-issued and/or misused certificates.
*
* \warning Depending on your PKI use, disabling this can be a security risk!
*
* Comment to skip extendedKeyUsage checking for certificates.
*/
#ifdef CONFIG_MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
#else
#undef MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
#endif
/**
* \def MBEDTLS_X509_RSASSA_PSS_SUPPORT
@@ -2770,6 +2699,4 @@
/* To Do - while updating to v3.0 remove all the code where this flag is used */
#define MBEDTLS_DEPRECATED_REMOVED
#include "mbedtls/check_config.h"
#endif /* MBEDTLS_CONFIG_H */
#endif /* ESP_CONFIG_H */
components/mbedtls/port/include/md/esp_md.h
+17 -48
View File
@@ -35,7 +35,7 @@ typedef struct MD5Context mbedtls_md5_context;
* stronger message digests instead.
*
*/
int esp_md5_init_ret( mbedtls_md5_context *ctx );
void esp_md5_init( mbedtls_md5_context *ctx );
/**
* \brief Clear MD5 context
@@ -62,6 +62,20 @@ void esp_md5_free( mbedtls_md5_context *ctx );
*/
void esp_md5_clone( mbedtls_md5_context *dst, const mbedtls_md5_context *src );
/**
* \brief MD5 context setup
*
* \param ctx context to be initialized
*
* \return 0 if successful
*
* \warning MD5 is considered a weak message digest and its use
* constitutes a security risk. We recommend considering
* stronger message digests instead.
*
*/
int mbedtls_md5_starts( mbedtls_md5_context *ctx );
/**
* \brief MD5 process buffer
*
@@ -76,7 +90,7 @@ void esp_md5_clone( mbedtls_md5_context *dst, const mbedtls_md5_context *src );
* stronger message digests instead.
*
*/
int esp_md5_update_ret( mbedtls_md5_context *ctx, const unsigned char *input, size_t ilen );
int esp_md5_update( mbedtls_md5_context *ctx, const unsigned char *input, size_t ilen );
/**
* \brief MD5 final digest
@@ -91,7 +105,7 @@ int esp_md5_update_ret( mbedtls_md5_context *ctx, const unsigned char *input, si
* stronger message digests instead.
*
*/
int esp_md5_finish_ret( mbedtls_md5_context *ctx, unsigned char output[16] );
int esp_md5_finish( mbedtls_md5_context *ctx, unsigned char output[16] );
/**
* \brief MD5 process data block (internal use only)
@@ -108,51 +122,6 @@ int esp_md5_finish_ret( mbedtls_md5_context *ctx, unsigned char output[16] );
*/
int esp_md5_process( mbedtls_md5_context *ctx, const unsigned char data[64] );
/**
* \brief MD5 context setup
*
* \deprecated Superseded by mbedtls_md5_starts_ret() in 2.7.0
*
* \param ctx context to be initialized
*
* \warning MD5 is considered a weak message digest and its use
* constitutes a security risk. We recommend considering
* stronger message digests instead.
*
*/
void esp_md5_init( mbedtls_md5_context *ctx );
/**
* \brief MD5 process buffer
*
* \deprecated Superseded by mbedtls_md5_update_ret() in 2.7.0
*
* \param ctx MD5 context
* \param input buffer holding the data
* \param ilen length of the input data
*
* \warning MD5 is considered a weak message digest and its use
* constitutes a security risk. We recommend considering
* stronger message digests instead.
*
*/
void esp_md5_update( mbedtls_md5_context *ctx, const unsigned char *input, size_t ilen );
/**
* \brief MD5 final digest
*
* \deprecated Superseded by mbedtls_md5_finish_ret() in 2.7.0
*
* \param ctx MD5 context
* \param output MD5 checksum result
*
* \warning MD5 is considered a weak message digest and its use
* constitutes a security risk. We recommend considering
* stronger message digests instead.
*
*/
void esp_md5_finish( mbedtls_md5_context *ctx, unsigned char output[16] );
#ifdef __cplusplus
}
#endif
components/mbedtls/port/include/md5_alt.h
+1 -3
View File
@@ -33,9 +33,7 @@ extern "C" {
#define mbedtls_md5_init esp_md5_init
#define mbedtls_md5_update esp_md5_update
#define mbedtls_md5_finish esp_md5_finish
#define mbedtls_md5_starts_ret esp_md5_init_ret
#define mbedtls_md5_update_ret esp_md5_update_ret
#define mbedtls_md5_finish_ret esp_md5_finish_ret
#define mbedtls_md5_starts esp_md5_starts
#define mbedtls_md5_free esp_md5_free
#define mbedtls_md5_clone esp_md5_clone