compile issue if MBEDTLS_CERTS_C is not set in 2.28.1

[hauke]

Summary

I am getting the following compile problem when compiling mbedtls 2.28.1 in OpenWrt master:

-- Build files have been written to: /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1
awk 'BEGIN { rc = 1 } /#define MBEDTLS_DEBUG_C/ { $0 = "// #define MBEDTLS_DEBUG_C"; rc = 0 } { print } END { exit(rc) }' /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include/mbedtls/config.h >/home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include/mbedtls/config.h.new && mv /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include/mbedtls/config.h.new /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include/mbedtls/config.h
awk 'BEGIN { rc = 1 } /#define MBEDTLS_HKDF_C/ { $0 = "// #define MBEDTLS_HKDF_C"; rc = 0 } { print } END { exit(rc) }' /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include/mbedtls/config.h >/home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include/mbedtls/config.h.new && mv /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include/mbedtls/config.h.new /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include/mbedtls/config.h
sed -i '/fuzz/d' /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/programs/CMakeLists.txt
sed -i '/test/d' /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/programs/CMakeLists.txt
touch /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/.configured_5e1d5ee8fa334bc8ae9c07800ce6707c
rm -f /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/.built
touch /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/.built_check
MAKEFLAGS="" /home/hauke/openwrt/openwrt/staging_dir/host/bin/ninja  -j1 -C /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1 
ninja: Entering directory `/home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1'
[0/1] Re-running CMake...
-- Configuring done
-- Generating done
-- Build files have been written to: /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1
[295/316] Building C object programs/ssl/CMakeFiles/ssl_server2.dir/ssl_server2.c.o
FAILED: programs/ssl/CMakeFiles/ssl_server2.dir/ssl_server2.c.o 
/home/hauke/openwrt/openwrt/staging_dir/toolchain-aarch64_cortex-a53_gcc-11.3.0_musl/bin/aarch64-openwrt-linux-musl-gcc  -I/home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/programs/ssl/../../tests/include -I/home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/include -pipe -mcpu=cortex-a53 -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -fmacro-prefix-map=/home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1=mbedtls-2.28.1 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -ffunction-sections -fdata-sections -Wall -Wextra -Wwrite-strings -Wformat=2 -Wno-format-nonliteral -Wvla -Wlogical-op -Wshadow -Wformat-signedness -Wformat-overflow=2 -Wformat-truncation -Werror -O2 -fPIE -MD -MT programs/ssl/CMakeFiles/ssl_server2.dir/ssl_server2.c.o -MF programs/ssl/CMakeFiles/ssl_server2.dir/ssl_server2.c.o.d -o programs/ssl/CMakeFiles/ssl_server2.dir/ssl_server2.c.o -c /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/programs/ssl/ssl_server2.c
/home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/programs/ssl/ssl_server2.c: In function 'main':
/home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/programs/ssl/ssl_server2.c:4142:1: error: expected declaration or statement at end of input
 4142 | }
      | ^
ninja: build stopped: subcommand failed.
make[2]: *** [Makefile:142: /home/hauke/openwrt/openwrt/build_dir/target-aarch64_cortex-a53_musl/mbedtls-2.28.1/.built] Error 1
make[2]: Leaving directory '/home/hauke/openwrt/openwrt/package/libs/mbedtls'
time: package/libs/mbedtls/compile#30.75#2.63#32.45

OpenWrt builds for Linux and uses the following patch to adjust the default configuration:
https://github.com/openwrt/openwrt/blob/master/package/libs/mbedtls/patches/200-config.patch

I bisected it to this commit: 331c342

System information

Mbed TLS version: 2.28.1
Operating system and version: OpenWrt master (GCC 11.3, Linux 5.10, musl libc)
Configuration (if not default, please attach mbedtls_config.h): Default config + these changes: https://github.com/openwrt/openwrt/blob/master/package/libs/mbedtls/patches/200-config.patch
Compiler and options (if you used a pre-built binary, please indicate how you obtained it): (GCC 11.3, Linux 5.10, musl libc)
Additional environment information:

Expected behavior

It should compile.

Actual behavior

It does not compile.

Steps to reproduce

Compile mbedtls 2.28.1 with this patch: https://github.com/openwrt/openwrt/blob/master/package/libs/mbedtls/patches/200-config.patch

Additional information

mbedtls 2.28.0 compiles fine.

The following patch fixed it for me:

Fix a compile problem introduced in commit 331c3421d1f0 ("Address review comments")

--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -2511,7 +2511,6 @@ int main( int argc, char *argv[] )
         }
         key_cert_init2 = 2;
 #endif /* MBEDTLS_ECDSA_C */
-    }
 
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     if( opt.key_opaque != 0 )
@@ -2540,6 +2539,7 @@ int main( int argc, char *argv[] )
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 #endif /* MBEDTLS_CERTS_C */
+    }
 
     mbedtls_printf( " ok (key types: %s - %s)\n", mbedtls_pk_get_name( &pkey ), mbedtls_pk_get_name( &pkey2 ) );
 #endif /* MBEDTLS_X509_CRT_PARSE_C */

I haven't signed the CLA.

[gilles-peskine-arm]

Apologies for not fixing this in 2.28.2. We hadn't classified this as a regression, but looking closer we should have. The fix should be in 2.28.3.

Note that your patch is only correct when MBEDTLS_USE_PSA_CRYPTO is disabled (it is by default).

[gilles-peskine-arm]

The fix in #7013 has been merged.