espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-08-08 19:57:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[meshcop] check mbedtls version to ensure mbedtls_ssl_key_export_type is defined (#12053)

Browse Source 
The macro MBEDTLS_SSL_EXPORT_KEYS is added to OT in PR #7025, it is used to
ensure mbedtls_ssl_key_export_type is defined. However, the macro
MBEDTLS_SSL_EXPORT_KEYS has been removed from the mbedtls since mbedtls-3.1.0.
If developers use external mbedtls repo with version 3.1.0 or higher
versions, and missed to define MBEDTLS_SSL_EXPORT_KEYS, it will cause
the KEK won't be set to the KeyManager.

This commit checks whether the mbedtls version is equal to or higher than
3.1.0 to ensure mbedtls_ssl_key_export_type is defined.
This commit is contained in:
Zhanglong Xia
2025-10-27 10:54:26 -07:00
committed by GitHub
parent 76f905bfac
commit fc71e69f92
2 changed files with 18 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/meshcop/secure_transport.cpp
+4 -7
View File
@@ -247,7 +247,7 @@ Error SecureSession::Setup(void)
#endif
}
#if defined(MBEDTLS_SSL_EXPORT_KEYS) && (MBEDTLS_VERSION_NUMBER < 0x03000000)
#if (MBEDTLS_VERSION_NUMBER < 0x03000000)
mbedtls_ssl_conf_export_keys_cb(&mConf, SecureTransport::HandleMbedtlsExportKeys, &mTransport);
#endif
@@ -301,7 +301,7 @@ Error SecureSession::Setup(void)
mbedtls_ssl_set_timer_cb(&mSsl, this, HandleMbedtlsSetTimer, HandleMbedtlsGetTimer);
}
#if defined(MBEDTLS_SSL_EXPORT_KEYS) && (MBEDTLS_VERSION_NUMBER >= 0x03000000)
#if OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
mbedtls_ssl_set_export_keys_cb(&mSsl, SecureTransport::HandleMbedtlsExportKeys, &mTransport);
#endif
@@ -898,9 +898,7 @@ exit:
return rval;
}
#ifdef MBEDTLS_SSL_EXPORT_KEYS
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
#if OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
void SecureTransport::HandleMbedtlsExportKeys(void *aContext,
mbedtls_ssl_key_export_type aType,
const unsigned char *aMasterSecret,
@@ -981,8 +979,7 @@ exit:
return 0;
}
#endif // (MBEDTLS_VERSION_NUMBER >= 0x03000000)
#endif // MBEDTLS_SSL_EXPORT_KEYS
#endif // OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
void SecureTransport::HandleUpdateTask(Tasklet &aTasklet)
{
src/core/meshcop/secure_transport.hpp
+14 -4
View File
@@ -53,6 +53,18 @@
#endif
#include <mbedtls/version.h>
#ifdef OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
#error \
"OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT MUST NOT be defined directly. It is derived from other configs."
#endif
#if ((defined(MBEDTLS_SSL_EXPORT_KEYS) && (MBEDTLS_VERSION_NUMBER >= 0x03000000)) || \
(MBEDTLS_VERSION_NUMBER >= 0x03010000))
#define OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT 1
#else
#define OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT 0
#endif
#if OPENTHREAD_CONFIG_BLE_TCAT_ENABLE
#ifndef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
#error OPENTHREAD_CONFIG_BLE_TCAT_ENABLE requires MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
@@ -755,8 +767,7 @@ private:
static void HandleMbedtlsDebug(void *aContext, int aLevel, const char *aFile, int aLine, const char *aStr);
void HandleMbedtlsDebug(int aLevel, const char *aFile, int aLine, const char *aStr);
#ifdef MBEDTLS_SSL_EXPORT_KEYS
#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
#if OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
static void HandleMbedtlsExportKeys(void *aContext,
mbedtls_ssl_key_export_type aType,
@@ -787,8 +798,7 @@ private:
size_t aKeyLength,
size_t aIvLength);
#endif // (MBEDTLS_VERSION_NUMBER >= 0x03000000)
#endif // MBEDTLS_SSL_EXPORT_KEYS
#endif // OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
static void HandleUpdateTask(Tasklet &aTasklet);
void HandleUpdateTask(void);