diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 47ba8d3e3..ac4e986e6 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -121,6 +121,25 @@ jobs: run: | script/check-scan-build + mbedtls3-build: + runs-on: ubuntu-18.04 + steps: + - uses: actions/checkout@v2 + with: + submodules: true + - name: Bootstrap + run: | + sudo apt-get --no-install-recommends install -y ninja-build libreadline-dev libncurses-dev + rm -rf third_party/mbedtls/repo + - uses: actions/checkout@v2 + with: + repository: ARMmbed/mbedtls + ref: v3.0.0 + path: third_party/mbedtls/repo + - name: Build + run: | + ./script/test build + arm-gcc: name: arm-gcc-${{ matrix.gcc_ver }} runs-on: ubuntu-18.04 diff --git a/src/core/common/random_manager.cpp b/src/core/common/random_manager.cpp index 4c320c3b1..f48b2c155 100644 --- a/src/core/common/random_manager.cpp +++ b/src/core/common/random_manager.cpp @@ -35,10 +35,6 @@ #include -#if !OPENTHREAD_RADIO -#include -#endif - #include "common/code_utils.hpp" #include "common/debug.hpp" #include "common/logging.hpp" @@ -155,7 +151,7 @@ void RandomManager::Entropy::Init(void) #ifndef OT_MBEDTLS_STRONG_DEFAULT_ENTROPY_PRESENT mbedtls_entropy_add_source(&mEntropyContext, &RandomManager::Entropy::HandleMbedtlsEntropyPoll, nullptr, - MBEDTLS_ENTROPY_MIN_HARDWARE, MBEDTLS_ENTROPY_SOURCE_STRONG); + kEntropyMinThreshold, MBEDTLS_ENTROPY_SOURCE_STRONG); #endif // OT_MBEDTLS_STRONG_DEFAULT_ENTROPY_PRESENT } diff --git a/src/core/common/random_manager.hpp b/src/core/common/random_manager.hpp index b89857551..42e7767ee 100644 --- a/src/core/common/random_manager.hpp +++ b/src/core/common/random_manager.hpp @@ -133,6 +133,8 @@ private: static int HandleMbedtlsEntropyPoll(void *aData, unsigned char *aOutput, size_t aInLen, size_t *aOutLen); #endif // OT_MBEDTLS_STRONG_DEFAULT_ENTROPY_PRESENT + static constexpr size_t kEntropyMinThreshold = 32; + mbedtls_entropy_context mEntropyContext; }; diff --git a/src/core/config/dtls.h b/src/core/config/dtls.h index e27918c72..be6077d99 100644 --- a/src/core/config/dtls.h +++ b/src/core/config/dtls.h @@ -47,7 +47,7 @@ * */ #ifndef OPENTHREAD_CONFIG_DTLS_MAX_CONTENT_LEN -#define OPENTHREAD_CONFIG_DTLS_MAX_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN +#define OPENTHREAD_CONFIG_DTLS_MAX_CONTENT_LEN MBEDTLS_SSL_IN_CONTENT_LEN #endif #if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE || OPENTHREAD_CONFIG_BORDER_AGENT_ENABLE || \ diff --git a/src/core/crypto/crypto_platform.cpp b/src/core/crypto/crypto_platform.cpp index 92d831f71..1545d8750 100644 --- a/src/core/crypto/crypto_platform.cpp +++ b/src/core/crypto/crypto_platform.cpp @@ -298,7 +298,11 @@ OT_TOOL_WEAK otError otPlatCryptoSha256Start(void *aContext, size_t aContextSize mbedtls_sha256_context *context = static_cast(aContext); VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed); +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + VerifyOrExit((mbedtls_sha256_starts(context, 0) == 0), error = kErrorFailed); +#else VerifyOrExit((mbedtls_sha256_starts_ret(context, 0) == 0), error = kErrorFailed); +#endif exit: return error; @@ -313,8 +317,13 @@ OT_TOOL_WEAK otError otPlatCryptoSha256Update(void * aContext, mbedtls_sha256_context *context = static_cast(aContext); VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed); +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + VerifyOrExit((mbedtls_sha256_update(context, reinterpret_cast(aBuf), aBufLength) == 0), + error = kErrorFailed); +#else VerifyOrExit((mbedtls_sha256_update_ret(context, reinterpret_cast(aBuf), aBufLength) == 0), error = kErrorFailed); +#endif exit: return error; @@ -328,7 +337,11 @@ OT_TOOL_WEAK otError otPlatCryptoSha256Finish(void *aContext, size_t aContextSiz mbedtls_sha256_context *context = static_cast(aContext); VerifyOrExit(aContextSize >= sizeof(mbedtls_sha256_context), error = kErrorFailed); +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + VerifyOrExit((mbedtls_sha256_finish(context, aHash) == 0), error = kErrorFailed); +#else VerifyOrExit((mbedtls_sha256_finish_ret(context, aHash) == 0), error = kErrorFailed); +#endif exit: return error; diff --git a/src/core/crypto/ecdsa.cpp b/src/core/crypto/ecdsa.cpp index b66371d17..373169bc0 100644 --- a/src/core/crypto/ecdsa.cpp +++ b/src/core/crypto/ecdsa.cpp @@ -86,7 +86,13 @@ Error P256::KeyPair::Parse(void *aContext) const mbedtls_pk_init(pk); VerifyOrExit(mbedtls_pk_setup(pk, mbedtls_pk_info_from_type(MBEDTLS_PK_ECKEY)) == 0, error = kErrorFailed); +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + VerifyOrExit(mbedtls_pk_parse_key(pk, mDerBytes, mDerLength, nullptr, 0, mbedtls_ctr_drbg_random, + Random::Crypto::MbedTlsContextGet()) == 0, + error = kErrorParse); +#else VerifyOrExit(mbedtls_pk_parse_key(pk, mDerBytes, mDerLength, nullptr, 0) == 0, error = kErrorParse); +#endif exit: return error; @@ -103,10 +109,11 @@ Error P256::KeyPair::GetPublicKey(PublicKey &aPublicKey) const keyPair = mbedtls_pk_ec(pk); - ret = mbedtls_mpi_write_binary(&keyPair->Q.X, aPublicKey.mData, kMpiSize); + ret = mbedtls_mpi_write_binary(&keyPair->MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(X), aPublicKey.mData, kMpiSize); VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); - ret = mbedtls_mpi_write_binary(&keyPair->Q.Y, aPublicKey.mData + kMpiSize, kMpiSize); + ret = mbedtls_mpi_write_binary(&keyPair->MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(Y), aPublicKey.mData + kMpiSize, + kMpiSize); VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); exit: @@ -136,11 +143,12 @@ Error P256::KeyPair::Sign(const Sha256::Hash &aHash, Signature &aSignature) cons VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); #if (MBEDTLS_VERSION_NUMBER >= 0x02130000) - ret = mbedtls_ecdsa_sign_det_ext(&ecdsa.grp, &r, &s, &ecdsa.d, aHash.GetBytes(), Sha256::Hash::kSize, - MBEDTLS_MD_SHA256, mbedtls_ctr_drbg_random, Random::Crypto::MbedTlsContextGet()); + ret = mbedtls_ecdsa_sign_det_ext(&ecdsa.MBEDTLS_PRIVATE(grp), &r, &s, &ecdsa.MBEDTLS_PRIVATE(d), aHash.GetBytes(), + Sha256::Hash::kSize, MBEDTLS_MD_SHA256, mbedtls_ctr_drbg_random, + Random::Crypto::MbedTlsContextGet()); #else - ret = - mbedtls_ecdsa_sign_det(&ecdsa.grp, &r, &s, &ecdsa.d, aHash.GetBytes(), Sha256::Hash::kSize, MBEDTLS_MD_SHA256); + ret = mbedtls_ecdsa_sign_det(&ecdsa.MBEDTLS_PRIVATE(grp), &r, &s, &ecdsa.MBEDTLS_PRIVATE(d), aHash.GetBytes(), + Sha256::Hash::kSize, MBEDTLS_MD_SHA256); #endif VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); @@ -173,14 +181,14 @@ Error P256::PublicKey::Verify(const Sha256::Hash &aHash, const Signature &aSigna mbedtls_mpi_init(&r); mbedtls_mpi_init(&s); - ret = mbedtls_ecp_group_load(&ecdsa.grp, MBEDTLS_ECP_DP_SECP256R1); + ret = mbedtls_ecp_group_load(&ecdsa.MBEDTLS_PRIVATE(grp), MBEDTLS_ECP_DP_SECP256R1); VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); - ret = mbedtls_mpi_read_binary(&ecdsa.Q.X, GetBytes(), kMpiSize); + ret = mbedtls_mpi_read_binary(&ecdsa.MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(X), GetBytes(), kMpiSize); VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); - ret = mbedtls_mpi_read_binary(&ecdsa.Q.Y, GetBytes() + kMpiSize, kMpiSize); + ret = mbedtls_mpi_read_binary(&ecdsa.MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(Y), GetBytes() + kMpiSize, kMpiSize); VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); - ret = mbedtls_mpi_lset(&ecdsa.Q.Z, 1); + ret = mbedtls_mpi_lset(&ecdsa.MBEDTLS_PRIVATE(Q).MBEDTLS_PRIVATE(Z), 1); VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); ret = mbedtls_mpi_read_binary(&r, aSignature.mShared.mMpis.mR, kMpiSize); @@ -189,7 +197,8 @@ Error P256::PublicKey::Verify(const Sha256::Hash &aHash, const Signature &aSigna ret = mbedtls_mpi_read_binary(&s, aSignature.mShared.mMpis.mS, kMpiSize); VerifyOrExit(ret == 0, error = MbedTls::MapError(ret)); - ret = mbedtls_ecdsa_verify(&ecdsa.grp, aHash.GetBytes(), Sha256::Hash::kSize, &ecdsa.Q, &r, &s); + ret = mbedtls_ecdsa_verify(&ecdsa.MBEDTLS_PRIVATE(grp), aHash.GetBytes(), Sha256::Hash::kSize, + &ecdsa.MBEDTLS_PRIVATE(Q), &r, &s); VerifyOrExit(ret == 0, error = kErrorSecurity); exit: @@ -220,8 +229,14 @@ Error Sign(uint8_t * aOutput, mbedtls_mpi_init(&sMpi); // Parse a private key in PEM format. +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + VerifyOrExit(mbedtls_pk_parse_key(&pkCtx, aPrivateKey, aPrivateKeyLength, nullptr, 0, mbedtls_ctr_drbg_random, + Random::Crypto::MbedTlsContextGet()) == 0, + error = kErrorInvalidArgs); +#else VerifyOrExit(mbedtls_pk_parse_key(&pkCtx, aPrivateKey, aPrivateKeyLength, nullptr, 0) == 0, error = kErrorInvalidArgs); +#endif VerifyOrExit(mbedtls_pk_get_type(&pkCtx) == MBEDTLS_PK_ECKEY, error = kErrorInvalidArgs); keypair = mbedtls_pk_ec(pkCtx); @@ -230,8 +245,9 @@ Error Sign(uint8_t * aOutput, VerifyOrExit(mbedtls_ecdsa_from_keypair(&ctx, keypair) == 0, error = kErrorFailed); // Sign using ECDSA. - VerifyOrExit(mbedtls_ecdsa_sign(&ctx.grp, &rMpi, &sMpi, &ctx.d, aInputHash, aInputHashLength, - mbedtls_ctr_drbg_random, Random::Crypto::MbedTlsContextGet()) == 0, + VerifyOrExit(mbedtls_ecdsa_sign(&ctx.MBEDTLS_PRIVATE(grp), &rMpi, &sMpi, &ctx.MBEDTLS_PRIVATE(d), aInputHash, + aInputHashLength, mbedtls_ctr_drbg_random, + Random::Crypto::MbedTlsContextGet()) == 0, error = kErrorFailed); VerifyOrExit(mbedtls_mpi_size(&rMpi) + mbedtls_mpi_size(&sMpi) <= aOutputLength, error = kErrorNoBufs); diff --git a/src/core/crypto/mbedtls.cpp b/src/core/crypto/mbedtls.cpp index 4b27b4afd..7be4d0dc5 100644 --- a/src/core/crypto/mbedtls.cpp +++ b/src/core/crypto/mbedtls.cpp @@ -132,7 +132,9 @@ Error MbedTls::MapError(int aMbedTlsError) case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: +#if (MBEDTLS_VERSION_NUMBER < 0x03000000) case MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED: +#endif case MBEDTLS_ERR_THREADING_BAD_INPUT_DATA: case MBEDTLS_ERR_THREADING_MUTEX_ERROR: error = kErrorSecurity; diff --git a/src/core/crypto/mbedtls.hpp b/src/core/crypto/mbedtls.hpp index 569815f7e..2be5cfca8 100644 --- a/src/core/crypto/mbedtls.hpp +++ b/src/core/crypto/mbedtls.hpp @@ -36,11 +36,27 @@ #include "openthread-core-config.h" +#include + #include #include "common/error.hpp" #include "common/non_copyable.hpp" +/** + * Keep forward-compatibility with Mbed TLS 3.0. + * + * Direct access to fields of structures declared in public headers is no longer + * supported. In Mbed TLS 3, the layout of structures is not considered part of + * the stable API, and minor versions (3.1, 3.2, etc.) may add, remove, rename, + * reorder or change the type of structure fields. + */ +#if (MBEDTLS_VERSION_NUMBER < 0x03000000) +#ifndef MBEDTLS_PRIVATE +#define MBEDTLS_PRIVATE(member) member +#endif +#endif + namespace ot { namespace Crypto { diff --git a/src/core/meshcop/dtls.cpp b/src/core/meshcop/dtls.cpp index c661b410e..a19d4018d 100644 --- a/src/core/meshcop/dtls.cpp +++ b/src/core/meshcop/dtls.cpp @@ -37,6 +37,7 @@ #ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED #include #endif + #include #include "common/code_utils.hpp" @@ -293,7 +294,13 @@ Error Dtls::Setup(bool aClient) mbedtls_ssl_conf_sig_hashes(&mConf, sHashes); #endif } + +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + mbedtls_ssl_set_export_keys_cb(&mSsl, HandleMbedtlsExportKeys, this); +#else mbedtls_ssl_conf_export_keys_cb(&mConf, HandleMbedtlsExportKeys, this); +#endif + mbedtls_ssl_conf_handshake_timeout(&mConf, 8000, 60000); mbedtls_ssl_conf_dbg(&mConf, HandleMbedtlsDebug, this); @@ -376,8 +383,15 @@ int Dtls::SetApplicationCoapSecureKeys(void) rval = mbedtls_x509_crt_parse(&mOwnCert, static_cast(mOwnCertSrc), static_cast(mOwnCertLength)); VerifyOrExit(rval == 0); + +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + rval = mbedtls_pk_parse_key(&mPrivateKey, static_cast(mPrivateKeySrc), + static_cast(mPrivateKeyLength), nullptr, 0, mbedtls_ctr_drbg_random, + Random::Crypto::MbedTlsContextGet()); +#else rval = mbedtls_pk_parse_key(&mPrivateKey, static_cast(mPrivateKeySrc), static_cast(mPrivateKeyLength), nullptr, 0); +#endif VerifyOrExit(rval == 0); rval = mbedtls_ssl_conf_own_cert(&mConf, &mOwnCert, &mPrivateKey); VerifyOrExit(rval == 0); @@ -712,12 +726,61 @@ void Dtls::HandleMbedtlsSetTimer(uint32_t aIntermediate, uint32_t aFinish) } } -int Dtls::HandleMbedtlsExportKeys(void * aContext, +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + +void Dtls::HandleMbedtlsExportKeys(void * aContext, + mbedtls_ssl_key_export_type aType, + const unsigned char * aMasterSecret, + size_t aMasterSecretLen, + const unsigned char aClientRandom[32], + const unsigned char aServerRandom[32], + mbedtls_tls_prf_types aTlsPrfType) +{ + static_cast(aContext)->HandleMbedtlsExportKeys(aType, aMasterSecret, aMasterSecretLen, aClientRandom, + aServerRandom, aTlsPrfType); +} + +void Dtls::HandleMbedtlsExportKeys(mbedtls_ssl_key_export_type aType, + const unsigned char * aMasterSecret, + size_t aMasterSecretLen, + const unsigned char aClientRandom[32], + const unsigned char aServerRandom[32], + mbedtls_tls_prf_types aTlsPrfType) +{ + Crypto::Sha256::Hash kek; + Crypto::Sha256 sha256; + unsigned char keyBlock[kDtlsKeyBlockSize]; + unsigned char randBytes[2 * kDtlsRandomBufferSize]; + + VerifyOrExit(mCipherSuites[0] == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8); + VerifyOrExit(aType == MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET); + + memcpy(randBytes, aServerRandom, kDtlsRandomBufferSize); + memcpy(randBytes + kDtlsRandomBufferSize, aClientRandom, kDtlsRandomBufferSize); + + // Retrieve the Key block from Master secret + mbedtls_ssl_tls_prf(aTlsPrfType, aMasterSecret, aMasterSecretLen, "key expansion", randBytes, sizeof(randBytes), + keyBlock, sizeof(keyBlock)); + + sha256.Start(); + sha256.Update(keyBlock, kDtlsKeyBlockSize); + sha256.Finish(kek); + + otLogDebgMeshCoP("Generated KEK"); + Get().SetKek(kek.GetBytes()); + +exit: + return; +} + +#else + +int Dtls::HandleMbedtlsExportKeys(void *aContext, const unsigned char *aMasterSecret, const unsigned char *aKeyBlock, - size_t aMacLength, - size_t aKeyLength, - size_t aIvLength) + size_t aMacLength, + size_t aKeyLength, + size_t aIvLength) { return static_cast(aContext)->HandleMbedtlsExportKeys(aMasterSecret, aKeyBlock, aMacLength, aKeyLength, aIvLength); @@ -725,34 +788,30 @@ int Dtls::HandleMbedtlsExportKeys(void * aContext, int Dtls::HandleMbedtlsExportKeys(const unsigned char *aMasterSecret, const unsigned char *aKeyBlock, - size_t aMacLength, - size_t aKeyLength, - size_t aIvLength) + size_t aMacLength, + size_t aKeyLength, + size_t aIvLength) { OT_UNUSED_VARIABLE(aMasterSecret); Crypto::Sha256::Hash kek; - Crypto::Sha256 sha256; + Crypto::Sha256 sha256; + + VerifyOrExit(mCipherSuites[0] == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8); sha256.Start(); sha256.Update(aKeyBlock, 2 * static_cast(aMacLength + aKeyLength + aIvLength)); sha256.Finish(kek); + otLogDebgMeshCoP("Generated KEK"); Get().SetKek(kek.GetBytes()); - if (mCipherSuites[0] == MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8) - { - otLogDebgMeshCoP("Generated KEK"); - } -#if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE - else - { - otLogDebgCoap("ApplicationCoapSecure Generated KEK"); - } -#endif +exit: return 0; } +#endif // (MBEDTLS_VERSION_NUMBER >= 0x03000000) + void Dtls::HandleTimer(Timer &aTimer) { static_cast(static_cast(aTimer).GetContext())->HandleTimer(); @@ -795,7 +854,7 @@ void Dtls::Process(void) { rval = mbedtls_ssl_handshake(&mSsl); - if (mSsl.state == MBEDTLS_SSL_HANDSHAKE_OVER) + if (mSsl.MBEDTLS_PRIVATE(state) == MBEDTLS_SSL_HANDSHAKE_OVER) { mState = kStateConnected; @@ -839,7 +898,7 @@ void Dtls::Process(void) OT_UNREACHABLE_CODE(break); case MBEDTLS_ERR_SSL_INVALID_MAC: - if (mSsl.state != MBEDTLS_SSL_HANDSHAKE_OVER) + if (mSsl.MBEDTLS_PRIVATE(state) != MBEDTLS_SSL_HANDSHAKE_OVER) { mbedtls_ssl_send_alert_message(&mSsl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC); @@ -849,7 +908,7 @@ void Dtls::Process(void) break; default: - if (mSsl.state != MBEDTLS_SSL_HANDSHAKE_OVER) + if (mSsl.MBEDTLS_PRIVATE(state) != MBEDTLS_SSL_HANDSHAKE_OVER) { mbedtls_ssl_send_alert_message(&mSsl, MBEDTLS_SSL_ALERT_LEVEL_FATAL, MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE); diff --git a/src/core/meshcop/dtls.hpp b/src/core/meshcop/dtls.hpp index 085b000d6..505fdbe1a 100644 --- a/src/core/meshcop/dtls.hpp +++ b/src/core/meshcop/dtls.hpp @@ -36,10 +36,10 @@ #include "openthread-core-config.h" -#include #include #include #include +#include #if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE #ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED @@ -360,6 +360,9 @@ private: static constexpr uint16_t kApplicationDataMaxLength = OPENTHREAD_CONFIG_DTLS_APPLICATION_DATA_MAX_LENGTH; #endif + static constexpr size_t kDtlsKeyBlockSize = 40; + static constexpr size_t kDtlsRandomBufferSize = 32; + void FreeMbedtls(void); Error Setup(bool aClient); @@ -388,6 +391,25 @@ private: static int HandleMbedtlsTransmit(void *aContext, const unsigned char *aBuf, size_t aLength); int HandleMbedtlsTransmit(const unsigned char *aBuf, size_t aLength); +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000) + + static void HandleMbedtlsExportKeys(void * aContext, + mbedtls_ssl_key_export_type aType, + const unsigned char * aMasterSecret, + size_t aMasterSecretLen, + const unsigned char aClientRandom[32], + const unsigned char aServerRandom[32], + mbedtls_tls_prf_types aTlsPrfType); + + void HandleMbedtlsExportKeys(mbedtls_ssl_key_export_type aType, + const unsigned char * aMasterSecret, + size_t aMasterSecretLen, + const unsigned char aClientRandom[32], + const unsigned char aServerRandom[32], + mbedtls_tls_prf_types aTlsPrfType); + +#else + static int HandleMbedtlsExportKeys(void * aContext, const unsigned char *aMasterSecret, const unsigned char *aKeyBlock, @@ -400,6 +422,8 @@ private: size_t aKeyLength, size_t aIvLength); +#endif + static void HandleTimer(Timer &aTimer); void HandleTimer(void); diff --git a/third_party/mbedtls/CMakeLists.txt b/third_party/mbedtls/CMakeLists.txt index 07682ba5e..e58ef81d0 100644 --- a/third_party/mbedtls/CMakeLists.txt +++ b/third_party/mbedtls/CMakeLists.txt @@ -85,7 +85,7 @@ target_compile_definitions(mbedtls ) target_include_directories(mbedtls PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/repo/include + $ PRIVATE ${OT_PUBLIC_INCLUDES} $ @@ -99,7 +99,7 @@ target_compile_definitions(mbedx509 ) target_include_directories(mbedx509 PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/repo/include + $ PRIVATE ${OT_PUBLIC_INCLUDES} $ @@ -113,7 +113,7 @@ target_compile_definitions(mbedcrypto ) target_include_directories(mbedcrypto PUBLIC - ${CMAKE_CURRENT_SOURCE_DIR}/repo/include + $ PRIVATE ${OT_PUBLIC_INCLUDES} $ diff --git a/third_party/mbedtls/mbedtls-config.h b/third_party/mbedtls/mbedtls-config.h index 619cfd74f..997870c21 100644 --- a/third_party/mbedtls/mbedtls-config.h +++ b/third_party/mbedtls/mbedtls-config.h @@ -67,6 +67,7 @@ #define MBEDTLS_PLATFORM_C #define MBEDTLS_PLATFORM_MEMORY #define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +#define MBEDTLS_SHA224_C #define MBEDTLS_SHA256_C #define MBEDTLS_SHA256_SMALLER #define MBEDTLS_SSL_CLI_C @@ -128,6 +129,8 @@ #define MBEDTLS_SSL_MAX_CONTENT_LEN 768 /**< Maxium fragment length in bytes */ #endif +#define MBEDTLS_SSL_IN_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN +#define MBEDTLS_SSL_OUT_CONTENT_LEN MBEDTLS_SSL_MAX_CONTENT_LEN #define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 // Spans multiple lines to avoid being processed by unifdef