espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-12 21:57:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

[mbedtls] add support for version 3.0.0 (#7001)

Browse Source 
This commit adds forward compatibility with mbedTLS 3.0.

Changes that affected OpenThread implementation:

- Rename mbedtls_*_ret() cryptography functions whose deprecated
  variants have been removed (migration guide)

- Replace MBEDTLS_SSL_MAX_CONTENT_LEN with MBEDTLS_SSL_IN_CONTENT_LEN
  and MBEDTLS_SSL_OUT_CONTENT_LEN options (migration guide)

- Signature functions now require the hash length to match the
  expected value (migration guide)

- SSL key export interface change (migration guide) - this change
  affected us a little bit more, since Key Block for KEK generation is
  not part of mbedTLS callback anymore. I was able, however, to
  retrieve it from Master secret (did successfully commissioning
  between 2.2x vs 3.0). By the way, I clean up the code for KEK
  generation - I don't know why we also executed it for application
  CoAP secure?

- Separated MBEDTLS_SHA224_C and MBEDTLS_SHA256_C (migration guide)

- Most structure fields are now private (migration guide) - we use
  private fields just in two files in dtls.cpp and ecdsa.cpp. For now,
  I used a workaround by defining MBEDTLS_PRIVATE macro but we should
  request the mbedTLS team to provide us support for public
  getters.
This commit is contained in:
Łukasz Duda
2021-09-20 13:19:07 -07:00
committed by GitHub
parent 097aa4f65d
commit 00da94e20d
12 changed files with 194 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build.yml
+19
View File
@@ -121,6 +121,25 @@ jobs:
run: |
script/check-scan-build
mbedtls3-build:
runs-on: ubuntu-18.04
steps:
- uses: actions/checkout@v2
with:
submodules: true
- name: Bootstrap
run: |
sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev
rm -rf third_party/mbedtls/repo
- uses: actions/checkout@v2
with:
repository: ARMmbed/mbedtls
ref: v3.0.0
path: third_party/mbedtls/repo
- name: Build
run: |
./script/test build
arm-gcc:
name: arm-gcc-${{ matrix.gcc_ver }}
runs-on: ubuntu-18.04
src/core/common/random_manager.cpp
+1 -5
View File
@@ -35,10 +35,6 @@
#include <openthread/platform/entropy.h>
#if !OPENTHREAD_RADIO
#include <mbedtls/entropy_poll.h>
#endif
#include "common/code_utils.hpp"
#include "common/debug.hpp"
#include "common/logging.hpp"
@@ -155,7 +151,7 @@ void RandomManager::Entropy::Init(void)
#ifndef OT_MBEDTLS_STRONG_DEFAULT_ENTROPY_PRESENT
mbedtls_entropy_add_source(&mEntropyContext, &RandomManager::Entropy::HandleMbedtlsEntropyPoll, nullptr,
MBEDTLS_ENTROPY_MIN_HARDWARE, MBEDTLS_ENTROPY_SOURCE_STRONG);
kEntropyMinThreshold, MBEDTLS_ENTROPY_SOURCE_STRONG);
#endif // OT_MBEDTLS_STRONG_DEFAULT_ENTROPY_PRESENT
}
src/core/common/random_manager.hpp
+2
View File
@@ -133,6 +133,8 @@ private:
static int HandleMbedtlsEntropyPoll(void *aData, unsigned char *aOutput, size_t aInLen, size_t *aOutLen);
#endif // OT_MBEDTLS_STRONG_DEFAULT_ENTROPY_PRESENT
static constexpr size_t kEntropyMinThreshold = 32;
mbedtls_entropy_context mEntropyContext;
};
src/core/config/dtls.h
+1 -1
View File
@@ -47,7 +47,7 @@
*
*/
#ifndef OPENTHREAD_CONFIG_DTLS_MAX_CONTENT_LEN
#define OPENTHREAD_CONFIG_DTLS_MAX_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN
#define OPENTHREAD_CONFIG_DTLS_MAX_CONTENT_LEN MBEDTLS_SSL_IN_CONTENT_LEN
#endif
#if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE || OPENTHREAD_CONFIG_BORDER_AGENT_ENABLE || \
src/core/crypto/crypto_platform.cpp
+13
View File
@@ -298,7 +298,11 @@ OT_TOOL_WEAK otError otPlatCryptoSha256Start(void *aContext, size_t aContextSize
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_starts(context, 0) == 0), error = kErrorFailed);
#else
VerifyOrExit((mbedtls_sha256_starts_ret(context, 0) == 0), error = kErrorFailed);
#endif
exit:
return error;
@@ -313,8 +317,13 @@ OT_TOOL_WEAK otError otPlatCryptoSha256Update(void * aContext,
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_update(context, reinterpret_cast<const uint8_t *>(aBuf), aBufLength) == 0),
error = kErrorFailed);
#else
VerifyOrExit((mbedtls_sha256_update_ret(context, reinterpret_cast<const uint8_t *>(aBuf), aBufLength) == 0),
error = kErrorFailed);
#endif
exit:
return error;
@@ -328,7 +337,11 @@ OT_TOOL_WEAK otError otPlatCryptoSha256Finish(void *aContext, size_t aContextSiz
mbedtls_sha256_context *context = static_cast<mbedtls_sha256_context *>(aContext);
VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit((mbedtls_sha256_finish(context, aHash) == 0), error = kErrorFailed);
#else
VerifyOrExit((mbedtls_sha256_finish_ret(context, aHash) == 0), error = kErrorFailed);
#endif
exit:
return error;
src/core/crypto/ecdsa.cpp
+29 -13
View File
@@ -86,7 +86,13 @@ Error P256::KeyPair::Parse(void *aContext) const
mbedtls_pk_init(pk);
VerifyOrExit(mbedtls_pk_setup(pk, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY)) == 0, error = kErrorFailed);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit(mbedtls_pk_parse_key(pk, mDerBytes, mDerLength, nullptr, 0, mbedtls_ctr_drbg_random,
Random::Crypto::MbedTlsContextGet()) == 0,
error = kErrorParse);
#else
VerifyOrExit(mbedtls_pk_parse_key(pk, mDerBytes, mDerLength, nullptr, 0) == 0, error = kErrorParse);
#endif
exit:
return error;
@@ -103,10 +109,11 @@ Error P256::KeyPair::GetPublicKey(PublicKey &aPublicKey) const
keyPair = mbedtls_pk_ec(pk);
ret = mbedtls_mpi_write_binary(&keyPair->Q.X, aPublicKey.mData, kMpiSize);
ret = mbedtls_mpi_write_binary(&keyPair->MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(X), aPublicKey.mData, kMpiSize);
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
ret = mbedtls_mpi_write_binary(&keyPair->Q.Y, aPublicKey.mData + kMpiSize, kMpiSize);
ret = mbedtls_mpi_write_binary(&keyPair->MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(Y), aPublicKey.mData + kMpiSize,
kMpiSize);
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
exit:
@@ -136,11 +143,12 @@ Error P256::KeyPair::Sign(const Sha256::Hash &aHash, Signature &aSignature) cons
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
#if (MBEDTLS_VERSION_NUMBER >= 0x02130000)
ret = mbedtls_ecdsa_sign_det_ext(&ecdsa.grp, &r, &s, &ecdsa.d, aHash.GetBytes(), Sha256::Hash::kSize,
MBEDTLS_MD_SHA256, mbedtls_ctr_drbg_random, Random::Crypto::MbedTlsContextGet());
ret = mbedtls_ecdsa_sign_det_ext(&ecdsa.MBEDTLS_PRIVATE(grp), &r, &s, &ecdsa.MBEDTLS_PRIVATE(d), aHash.GetBytes(),
Sha256::Hash::kSize, MBEDTLS_MD_SHA256, mbedtls_ctr_drbg_random,
Random::Crypto::MbedTlsContextGet());
#else
ret =
mbedtls_ecdsa_sign_det(&ecdsa.grp, &r, &s, &ecdsa.d, aHash.GetBytes(), Sha256::Hash::kSize, MBEDTLS_MD_SHA256);
ret = mbedtls_ecdsa_sign_det(&ecdsa.MBEDTLS_PRIVATE(grp), &r, &s, &ecdsa.MBEDTLS_PRIVATE(d), aHash.GetBytes(),
Sha256::Hash::kSize, MBEDTLS_MD_SHA256);
#endif
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
@@ -173,14 +181,14 @@ Error P256::PublicKey::Verify(const Sha256::Hash &aHash, const Signature &aSigna
mbedtls_mpi_init(&r);
mbedtls_mpi_init(&s);
ret = mbedtls_ecp_group_load(&ecdsa.grp, MBEDTLS_ECP_DP_SECP256R1);
ret = mbedtls_ecp_group_load(&ecdsa.MBEDTLS_PRIVATE(grp), MBEDTLS_ECP_DP_SECP256R1);
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
ret = mbedtls_mpi_read_binary(&ecdsa.Q.X, GetBytes(), kMpiSize);
ret = mbedtls_mpi_read_binary(&ecdsa.MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(X), GetBytes(), kMpiSize);
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
ret = mbedtls_mpi_read_binary(&ecdsa.Q.Y, GetBytes() + kMpiSize, kMpiSize);
ret = mbedtls_mpi_read_binary(&ecdsa.MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(Y), GetBytes() + kMpiSize, kMpiSize);
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
ret = mbedtls_mpi_lset(&ecdsa.Q.Z, 1);
ret = mbedtls_mpi_lset(&ecdsa.MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(Z), 1);
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
ret = mbedtls_mpi_read_binary(&r, aSignature.mShared.mMpis.mR, kMpiSize);
@@ -189,7 +197,8 @@ Error P256::PublicKey::Verify(const Sha256::Hash &aHash, const Signature &aSigna
ret = mbedtls_mpi_read_binary(&s, aSignature.mShared.mMpis.mS, kMpiSize);
VerifyOrExit(ret == 0, error = MbedTls::MapError(ret));
ret = mbedtls_ecdsa_verify(&ecdsa.grp, aHash.GetBytes(), Sha256::Hash::kSize, &ecdsa.Q, &r, &s);
ret = mbedtls_ecdsa_verify(&ecdsa.MBEDTLS_PRIVATE(grp), aHash.GetBytes(), Sha256::Hash::kSize,
&ecdsa.MBEDTLS_PRIVATE(Q), &r, &s);
VerifyOrExit(ret == 0, error = kErrorSecurity);
exit:
@@ -220,8 +229,14 @@ Error Sign(uint8_t * aOutput,
mbedtls_mpi_init(&sMpi);
// Parse a private key in PEM format.
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
VerifyOrExit(mbedtls_pk_parse_key(&pkCtx, aPrivateKey, aPrivateKeyLength, nullptr, 0, mbedtls_ctr_drbg_random,
Random::Crypto::MbedTlsContextGet()) == 0,
error = kErrorInvalidArgs);
#else
VerifyOrExit(mbedtls_pk_parse_key(&pkCtx, aPrivateKey, aPrivateKeyLength, nullptr, 0) == 0,
error = kErrorInvalidArgs);
#endif
VerifyOrExit(mbedtls_pk_get_type(&pkCtx) == MBEDTLS_PK_ECKEY, error = kErrorInvalidArgs);
keypair = mbedtls_pk_ec(pkCtx);
@@ -230,8 +245,9 @@ Error Sign(uint8_t * aOutput,
VerifyOrExit(mbedtls_ecdsa_from_keypair(&ctx, keypair) == 0, error = kErrorFailed);
// Sign using ECDSA.
VerifyOrExit(mbedtls_ecdsa_sign(&ctx.grp, &rMpi, &sMpi, &ctx.d, aInputHash, aInputHashLength,
mbedtls_ctr_drbg_random, Random::Crypto::MbedTlsContextGet()) == 0,
VerifyOrExit(mbedtls_ecdsa_sign(&ctx.MBEDTLS_PRIVATE(grp), &rMpi, &sMpi, &ctx.MBEDTLS_PRIVATE(d), aInputHash,
aInputHashLength, mbedtls_ctr_drbg_random,
Random::Crypto::MbedTlsContextGet()) == 0,
error = kErrorFailed);
VerifyOrExit(mbedtls_mpi_size(&rMpi) + mbedtls_mpi_size(&sMpi) <= aOutputLength, error = kErrorNoBufs);
src/core/crypto/mbedtls.cpp
+2
View File
@@ -132,7 +132,9 @@ Error MbedTls::MapError(int aMbedTlsError)
case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
#if (MBEDTLS_VERSION_NUMBER < 0x03000000)
case MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED:
#endif
case MBEDTLS_ERR_THREADING_BAD_INPUT_DATA:
case MBEDTLS_ERR_THREADING_MUTEX_ERROR:
error = kErrorSecurity;
src/core/crypto/mbedtls.hpp
+16
View File
@@ -36,11 +36,27 @@
#include "openthread-core-config.h"
#include <mbedtls/version.h>
#include <openthread/instance.h>
#include "common/error.hpp"
#include "common/non_copyable.hpp"
/**
* Keep forward-compatibility with Mbed TLS 3.0.
*
* Direct access to fields of structures declared in public headers is no longer
* supported. In Mbed TLS 3, the layout of structures is not considered part of
* the stable API, and minor versions (3.1, 3.2, etc.) may add, remove, rename,
* reorder or change the type of structure fields.
*/
#if (MBEDTLS_VERSION_NUMBER < 0x03000000)
#ifndef MBEDTLS_PRIVATE
#define MBEDTLS_PRIVATE(member) member
#endif
#endif
namespace ot {
namespace Crypto {
src/core/meshcop/dtls.cpp
+80 -21
View File
@@ -37,6 +37,7 @@
#ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
#include <mbedtls/pem.h>
#endif
#include <openthread/platform/radio.h>
#include "common/code_utils.hpp"
@@ -293,7 +294,13 @@ Error Dtls::Setup(bool aClient)
mbedtls_ssl_conf_sig_hashes(&mConf, sHashes);
#endif
}
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
mbedtls_ssl_set_export_keys_cb(&mSsl, HandleMbedtlsExportKeys, this);
#else
mbedtls_ssl_conf_export_keys_cb(&mConf, HandleMbedtlsExportKeys, this);
#endif
mbedtls_ssl_conf_handshake_timeout(&mConf, 8000, 60000);
mbedtls_ssl_conf_dbg(&mConf, HandleMbedtlsDebug, this);
@@ -376,8 +383,15 @@ int Dtls::SetApplicationCoapSecureKeys(void)
rval = mbedtls_x509_crt_parse(&mOwnCert, static_cast<const unsigned char *>(mOwnCertSrc),
static_cast<size_t>(mOwnCertLength));
VerifyOrExit(rval == 0);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
rval = mbedtls_pk_parse_key(&mPrivateKey, static_cast<const unsigned char *>(mPrivateKeySrc),
static_cast<size_t>(mPrivateKeyLength), nullptr, 0, mbedtls_ctr_drbg_random,
Random::Crypto::MbedTlsContextGet());
#else
rval = mbedtls_pk_parse_key(&mPrivateKey, static_cast<const unsigned char *>(mPrivateKeySrc),
static_cast<size_t>(mPrivateKeyLength), nullptr, 0);
#endif
VerifyOrExit(rval == 0);
rval = mbedtls_ssl_conf_own_cert(&mConf, &mOwnCert, &mPrivateKey);
VerifyOrExit(rval == 0);
@@ -712,12 +726,61 @@ void Dtls::HandleMbedtlsSetTimer(uint32_t aIntermediate, uint32_t aFinish)
}
}
int Dtls::HandleMbedtlsExportKeys(void * aContext,
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
void Dtls::HandleMbedtlsExportKeys(void * aContext,
mbedtls_ssl_key_export_type aType,
const unsigned char * aMasterSecret,
size_t aMasterSecretLen,
const unsigned char aClientRandom[32],
const unsigned char aServerRandom[32],
mbedtls_tls_prf_types aTlsPrfType)
{
static_cast<Dtls *>(aContext)->HandleMbedtlsExportKeys(aType, aMasterSecret, aMasterSecretLen, aClientRandom,
aServerRandom, aTlsPrfType);
}
void Dtls::HandleMbedtlsExportKeys(mbedtls_ssl_key_export_type aType,
const unsigned char * aMasterSecret,
size_t aMasterSecretLen,
const unsigned char aClientRandom[32],
const unsigned char aServerRandom[32],
mbedtls_tls_prf_types aTlsPrfType)
{
Crypto::Sha256::Hash kek;
Crypto::Sha256 sha256;
unsigned char keyBlock[kDtlsKeyBlockSize];
unsigned char randBytes[2 * kDtlsRandomBufferSize];
VerifyOrExit(mCipherSuites[0] == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8);
VerifyOrExit(aType == MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET);
memcpy(randBytes, aServerRandom, kDtlsRandomBufferSize);
memcpy(randBytes + kDtlsRandomBufferSize, aClientRandom, kDtlsRandomBufferSize);
// Retrieve the Key block from Master secret
mbedtls_ssl_tls_prf(aTlsPrfType, aMasterSecret, aMasterSecretLen, "key expansion", randBytes, sizeof(randBytes),
keyBlock, sizeof(keyBlock));
sha256.Start();
sha256.Update(keyBlock, kDtlsKeyBlockSize);
sha256.Finish(kek);
otLogDebgMeshCoP("Generated KEK");
Get<KeyManager>().SetKek(kek.GetBytes());
exit:
return;
}
#else
int Dtls::HandleMbedtlsExportKeys(void *aContext,
const unsigned char *aMasterSecret,
const unsigned char *aKeyBlock,
size_t aMacLength,
size_t aKeyLength,
size_t aIvLength)
size_t aMacLength,
size_t aKeyLength,
size_t aIvLength)
{
return static_cast<Dtls *>(aContext)->HandleMbedtlsExportKeys(aMasterSecret, aKeyBlock, aMacLength, aKeyLength,
aIvLength);
@@ -725,34 +788,30 @@ int Dtls::HandleMbedtlsExportKeys(void * aContext,
int Dtls::HandleMbedtlsExportKeys(const unsigned char *aMasterSecret,
const unsigned char *aKeyBlock,
size_t aMacLength,
size_t aKeyLength,
size_t aIvLength)
size_t aMacLength,
size_t aKeyLength,
size_t aIvLength)
{
OT_UNUSED_VARIABLE(aMasterSecret);
Crypto::Sha256::Hash kek;
Crypto::Sha256 sha256;
Crypto::Sha256 sha256;
VerifyOrExit(mCipherSuites[0] == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8);
sha256.Start();
sha256.Update(aKeyBlock, 2 * static_cast<uint16_t>(aMacLength + aKeyLength + aIvLength));
sha256.Finish(kek);
otLogDebgMeshCoP("Generated KEK");
Get<KeyManager>().SetKek(kek.GetBytes());
if (mCipherSuites[0] == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8)
{
otLogDebgMeshCoP("Generated KEK");
}
#if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE
else
{
otLogDebgCoap("ApplicationCoapSecure Generated KEK");
}
#endif
exit:
return 0;
}
#endif // (MBEDTLS_VERSION_NUMBER >= 0x03000000)
void Dtls::HandleTimer(Timer &aTimer)
{
static_cast<Dtls *>(static_cast<TimerMilliContext &>(aTimer).GetContext())->HandleTimer();
@@ -795,7 +854,7 @@ void Dtls::Process(void)
{
rval = mbedtls_ssl_handshake(&mSsl);
if (mSsl.state == MBEDTLS_SSL_HANDSHAKE_OVER)
if (mSsl.MBEDTLS_PRIVATE(state) == MBEDTLS_SSL_HANDSHAKE_OVER)
{
mState = kStateConnected;
@@ -839,7 +898,7 @@ void Dtls::Process(void)
OT_UNREACHABLE_CODE(break);
case MBEDTLS_ERR_SSL_INVALID_MAC:
if (mSsl.state != MBEDTLS_SSL_HANDSHAKE_OVER)
if (mSsl.MBEDTLS_PRIVATE(state) != MBEDTLS_SSL_HANDSHAKE_OVER)
{
mbedtls_ssl_send_alert_message(&mSsl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC);
@@ -849,7 +908,7 @@ void Dtls::Process(void)
break;
default:
if (mSsl.state != MBEDTLS_SSL_HANDSHAKE_OVER)
if (mSsl.MBEDTLS_PRIVATE(state) != MBEDTLS_SSL_HANDSHAKE_OVER)
{
mbedtls_ssl_send_alert_message(&mSsl, MBEDTLS_SSL_ALERT_LEVEL_FATAL,
MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE);
src/core/meshcop/dtls.hpp
+25 -1
View File
@@ -36,10 +36,10 @@
#include "openthread-core-config.h"
#include <mbedtls/certs.h>
#include <mbedtls/net_sockets.h>
#include <mbedtls/ssl.h>
#include <mbedtls/ssl_cookie.h>
#include <mbedtls/version.h>
#if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE
#ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
@@ -360,6 +360,9 @@ private:
static constexpr uint16_t kApplicationDataMaxLength = OPENTHREAD_CONFIG_DTLS_APPLICATION_DATA_MAX_LENGTH;
#endif
static constexpr size_t kDtlsKeyBlockSize = 40;
static constexpr size_t kDtlsRandomBufferSize = 32;
void FreeMbedtls(void);
Error Setup(bool aClient);
@@ -388,6 +391,25 @@ private:
static int HandleMbedtlsTransmit(void *aContext, const unsigned char *aBuf, size_t aLength);
int HandleMbedtlsTransmit(const unsigned char *aBuf, size_t aLength);
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
static void HandleMbedtlsExportKeys(void * aContext,
mbedtls_ssl_key_export_type aType,
const unsigned char * aMasterSecret,
size_t aMasterSecretLen,
const unsigned char aClientRandom[32],
const unsigned char aServerRandom[32],
mbedtls_tls_prf_types aTlsPrfType);
void HandleMbedtlsExportKeys(mbedtls_ssl_key_export_type aType,
const unsigned char * aMasterSecret,
size_t aMasterSecretLen,
const unsigned char aClientRandom[32],
const unsigned char aServerRandom[32],
mbedtls_tls_prf_types aTlsPrfType);
#else
static int HandleMbedtlsExportKeys(void * aContext,
const unsigned char *aMasterSecret,
const unsigned char *aKeyBlock,
@@ -400,6 +422,8 @@ private:
size_t aKeyLength,
size_t aIvLength);
#endif
static void HandleTimer(Timer &aTimer);
void HandleTimer(void);
third_party/mbedtls/CMakeLists.txt
Vendored
+3 -3
View File
@@ -85,7 +85,7 @@ target_compile_definitions(mbedtls
)
target_include_directories(mbedtls
PUBLIC
${CMAKE_CURRENT_SOURCE_DIR}/repo/include
$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/repo/include>
PRIVATE
${OT_PUBLIC_INCLUDES}
$<TARGET_PROPERTY:ot-config,INTERFACE_INCLUDE_DIRECTORIES>
@@ -99,7 +99,7 @@ target_compile_definitions(mbedx509
)
target_include_directories(mbedx509
PUBLIC
${CMAKE_CURRENT_SOURCE_DIR}/repo/include
$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/repo/include>
PRIVATE
${OT_PUBLIC_INCLUDES}
$<TARGET_PROPERTY:ot-config,INTERFACE_INCLUDE_DIRECTORIES>
@@ -113,7 +113,7 @@ target_compile_definitions(mbedcrypto
)
target_include_directories(mbedcrypto
PUBLIC
${CMAKE_CURRENT_SOURCE_DIR}/repo/include
$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/repo/include>
PRIVATE
${OT_PUBLIC_INCLUDES}
$<TARGET_PROPERTY:ot-config,INTERFACE_INCLUDE_DIRECTORIES>
third_party/mbedtls/mbedtls-config.h
Vendored
+3
View File
@@ -67,6 +67,7 @@
#define MBEDTLS_PLATFORM_C
#define MBEDTLS_PLATFORM_MEMORY
#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
#define MBEDTLS_SHA224_C
#define MBEDTLS_SHA256_C
#define MBEDTLS_SHA256_SMALLER
#define MBEDTLS_SSL_CLI_C
@@ -128,6 +129,8 @@
#define MBEDTLS_SSL_MAX_CONTENT_LEN 768 /**< Maxium fragment length in bytes */
#endif
#define MBEDTLS_SSL_IN_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN
#define MBEDTLS_SSL_OUT_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN
#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
// Spans multiple lines to avoid being processed by unifdef