Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add CI job build with mbedtls3 #7544

Closed
wants to merge 4 commits into from
Closed

Add CI job build with mbedtls3 #7544

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
27625af
Initial mbedTLS 3.0.0 support
Benau Jul 30, 2021
9dedf57
zuul: add an mbedtls3 CI job
bagder Aug 8, 2021
c3c49bf
fixup the git clone
bagder Aug 9, 2021
3ab2024
fixup the make install
bagder Aug 9, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
8 changes: 0 additions & 8 deletions docs/TODO
View file
Open in desktop
Expand Up @@ -118,7 +118,6 @@
13.11 Support intermediate & root pinning for PINNEDPUBLICKEY
13.13 Make sure we forbid TLS 1.3 post-handshake authentication
13.14 Support the clienthello extension
13.15 Support mbedTLS 3.0

14. GnuTLS
14.2 check connection
Expand Down Expand Up @@ -832,13 +831,6 @@
https://tools.ietf.org/html/rfc7685
https://github.com/curl/curl/issues/2299

13.15 Support mbedTLS 3.0

Version 3.0 is not backwards compatible with pre-3.0 versions, and curl no
longer builds due to breaking changes in the API.

See https://github.com/curl/curl/issues/7385

14. GnuTLS

14.2 check connection
Expand Down
6 changes: 5 additions & 1 deletion lib/md4.c
View file
Open in desktop
Expand Up @@ -36,8 +36,12 @@
#endif /* USE_OPENSSL */

#ifdef USE_MBEDTLS
#include <mbedtls/config.h>
#include <mbedtls/version.h>
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
#include <mbedtls/mbedtls_config.h>
#else
#include <mbedtls/config.h>
#endif

#if(MBEDTLS_VERSION_NUMBER >= 0x02070000)
#define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
Expand Down
9 changes: 5 additions & 4 deletions lib/md5.c
View file
Open in desktop
Expand Up @@ -33,7 +33,8 @@
#ifdef USE_MBEDTLS
#include <mbedtls/version.h>

#if(MBEDTLS_VERSION_NUMBER >= 0x02070000)
#if(MBEDTLS_VERSION_NUMBER >= 0x02070000) && \
(MBEDTLS_VERSION_NUMBER < 0x03000000)
#define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
#endif
#endif /* USE_MBEDTLS */
Expand Down Expand Up @@ -85,7 +86,7 @@ typedef mbedtls_md5_context MD5_CTX;
static void MD5_Init(MD5_CTX *ctx)
{
#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
mbedtls_md5_starts(ctx);
(void) mbedtls_md5_starts(ctx);
#else
(void) mbedtls_md5_starts_ret(ctx);
#endif
Expand All @@ -96,7 +97,7 @@ static void MD5_Update(MD5_CTX *ctx,
unsigned int length)
{
#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
mbedtls_md5_update(ctx, data, length);
(void) mbedtls_md5_update(ctx, data, length);
#else
(void) mbedtls_md5_update_ret(ctx, data, length);
#endif
Expand All @@ -105,7 +106,7 @@ static void MD5_Update(MD5_CTX *ctx,
static void MD5_Final(unsigned char *digest, MD5_CTX *ctx)
{
#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
mbedtls_md5_finish(ctx, digest);
(void) mbedtls_md5_finish(ctx, digest);
#else
(void) mbedtls_md5_finish_ret(ctx, digest);
#endif
Expand Down
17 changes: 9 additions & 8 deletions lib/sha256.c
View file
Open in desktop
Expand Up @@ -42,8 +42,9 @@
#ifdef USE_MBEDTLS
#include <mbedtls/version.h>

#if(MBEDTLS_VERSION_NUMBER >= 0x02070000)
#define HAS_RESULT_CODE_BASED_FUNCTIONS
#if(MBEDTLS_VERSION_NUMBER >= 0x02070000) && \
(MBEDTLS_VERSION_NUMBER < 0x03000000)
#define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
#endif
#endif /* USE_MBEDTLS */

Expand Down Expand Up @@ -105,8 +106,8 @@ typedef mbedtls_sha256_context SHA256_CTX;

static void SHA256_Init(SHA256_CTX *ctx)
{
#if !defined(HAS_RESULT_CODE_BASED_FUNCTIONS)
mbedtls_sha256_starts(ctx, 0);
#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
(void) mbedtls_sha256_starts(ctx, 0);
#else
(void) mbedtls_sha256_starts_ret(ctx, 0);
#endif
Expand All @@ -116,17 +117,17 @@ static void SHA256_Update(SHA256_CTX *ctx,
const unsigned char *data,
unsigned int length)
{
#if !defined(HAS_RESULT_CODE_BASED_FUNCTIONS)
mbedtls_sha256_update(ctx, data, length);
#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
(void) mbedtls_sha256_update(ctx, data, length);
#else
(void) mbedtls_sha256_update_ret(ctx, data, length);
#endif
}

static void SHA256_Final(unsigned char *digest, SHA256_CTX *ctx)
{
#if !defined(HAS_RESULT_CODE_BASED_FUNCTIONS)
mbedtls_sha256_finish(ctx, digest);
#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
(void) mbedtls_sha256_finish(ctx, digest);
#else
(void) mbedtls_sha256_finish_ret(ctx, digest);
#endif
Expand Down
58 changes: 58 additions & 0 deletions lib/vtls/mbedtls.c
View file
Open in desktop
Expand Up @@ -41,7 +41,9 @@
#include <mbedtls/net.h>
#endif
#include <mbedtls/ssl.h>
#if MBEDTLS_VERSION_NUMBER < 0x03000000
#include <mbedtls/certs.h>
#endif
#include <mbedtls/x509.h>

#include <mbedtls/error.h>
Expand Down Expand Up @@ -183,6 +185,17 @@ static Curl_send mbed_send;

static CURLcode mbedtls_version_from_curl(int *mbedver, long version)
{
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
switch(version) {
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:
case CURL_SSLVERSION_TLSv1_2:
*mbedver = MBEDTLS_SSL_MINOR_VERSION_3;
return CURLE_OK;
case CURL_SSLVERSION_TLSv1_3:
break;
}
#else
switch(version) {
case CURL_SSLVERSION_TLSv1_0:
*mbedver = MBEDTLS_SSL_MINOR_VERSION_1;
Expand All @@ -196,6 +209,8 @@ static CURLcode mbedtls_version_from_curl(int *mbedver, long version)
case CURL_SSLVERSION_TLSv1_3:
break;
}
#endif

return CURLE_SSL_CONNECT_ERROR;
}

Expand All @@ -205,8 +220,13 @@ set_ssl_version_min_max(struct Curl_easy *data, struct connectdata *conn,
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
struct ssl_backend_data *backend = connssl->backend;
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
int mbedtls_ver_min = MBEDTLS_SSL_MINOR_VERSION_3;
int mbedtls_ver_max = MBEDTLS_SSL_MINOR_VERSION_3;
#else
int mbedtls_ver_min = MBEDTLS_SSL_MINOR_VERSION_1;
int mbedtls_ver_max = MBEDTLS_SSL_MINOR_VERSION_1;
#endif
long ssl_version = SSL_CONN_CONFIG(version);
long ssl_version_max = SSL_CONN_CONFIG(version_max);
CURLcode result = CURLE_OK;
Expand Down Expand Up @@ -354,8 +374,15 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn,

if(SSL_SET_OPTION(key) || SSL_SET_OPTION(key_blob)) {
if(SSL_SET_OPTION(key)) {
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
ret = mbedtls_pk_parse_keyfile(&backend->pk, SSL_SET_OPTION(key),
SSL_SET_OPTION(key_passwd),
mbedtls_ctr_drbg_random,
&backend->ctr_drbg);
#else
ret = mbedtls_pk_parse_keyfile(&backend->pk, SSL_SET_OPTION(key),
SSL_SET_OPTION(key_passwd));
#endif

if(ret) {
mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
Expand All @@ -369,9 +396,17 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn,
const unsigned char *key_data =
(const unsigned char *)ssl_key_blob->data;
const char *passwd = SSL_SET_OPTION(key_passwd);
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
(const unsigned char *)passwd,
passwd ? strlen(passwd) : 0,
mbedtls_ctr_drbg_random,
&backend->ctr_drbg);
#else
ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
(const unsigned char *)passwd,
passwd ? strlen(passwd) : 0);
#endif

if(ret) {
mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
Expand Down Expand Up @@ -426,10 +461,12 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn,
switch(SSL_CONN_CONFIG(version)) {
case CURL_SSLVERSION_DEFAULT:
case CURL_SSLVERSION_TLSv1:
#if MBEDTLS_VERSION_NUMBER < 0x03000000
mbedtls_ssl_conf_min_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
MBEDTLS_SSL_MINOR_VERSION_1);
infof(data, "mbedTLS: Set min SSL version to TLS 1.0");
break;
#endif
case CURL_SSLVERSION_TLSv1_0:
case CURL_SSLVERSION_TLSv1_1:
case CURL_SSLVERSION_TLSv1_2:
Expand Down Expand Up @@ -632,7 +669,12 @@ mbed_connect_step2(struct Curl_easy *data, struct connectdata *conn,
mbedtls_x509_crt *p;
unsigned char pubkey[PUB_DER_MAX_BYTES];

#if MBEDTLS_VERSION_NUMBER >= 0x03000000
if(!peercert || !peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p) ||
!peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len)) {
#else
if(!peercert || !peercert->raw.p || !peercert->raw.len) {
#endif
failf(data, "Failed due to missing peer certificate");
return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
}
Expand All @@ -647,14 +689,25 @@ mbed_connect_step2(struct Curl_easy *data, struct connectdata *conn,
/* Make a copy of our const peercert because mbedtls_pk_write_pubkey_der
needs a non-const key, for now.
https://github.com/ARMmbed/mbedtls/issues/396 */
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
if(mbedtls_x509_crt_parse_der(p,
peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len))) {
#else
if(mbedtls_x509_crt_parse_der(p, peercert->raw.p, peercert->raw.len)) {
#endif
failf(data, "Failed copying peer certificate");
mbedtls_x509_crt_free(p);
free(p);
return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
}

#if MBEDTLS_VERSION_NUMBER >= 0x03000000
size = mbedtls_pk_write_pubkey_der(&p->MBEDTLS_PRIVATE(pk), pubkey,
PUB_DER_MAX_BYTES);
#else
size = mbedtls_pk_write_pubkey_der(&p->pk, pubkey, PUB_DER_MAX_BYTES);
#endif

if(size <= 0) {
failf(data, "Failed copying public key from peer certificate");
Expand Down Expand Up @@ -1064,12 +1117,17 @@ static CURLcode mbedtls_sha256sum(const unsigned char *input,
unsigned char *sha256sum,
size_t sha256len UNUSED_PARAM)
{
/* TODO: explain this for different mbedtls 2.x vs 3 version */
(void)sha256len;
#if MBEDTLS_VERSION_NUMBER < 0x02070000
mbedtls_sha256(input, inputlen, sha256sum, 0);
#else
/* returns 0 on success, otherwise failure */
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
if(mbedtls_sha256(input, inputlen, sha256sum, 0) != 0)
#else
if(mbedtls_sha256_ret(input, inputlen, sha256sum, 0) != 0)
#endif
return CURLE_BAD_FUNCTION_ARGUMENT;
#endif
return CURLE_OK;
Expand Down
8 changes: 8 additions & 0 deletions scripts/zuul/before_script.sh
View file
Open in desktop
Expand Up @@ -96,6 +96,14 @@ if [ "$TRAVIS_OS_NAME" = linux -a "$OPENSSL3" ]; then
make install_sw
fi

if [ "$TRAVIS_OS_NAME" = linux -a "$MBEDTLS3" ]; then
cd $HOME
git clone --depth=1 -b v3.0.0 https://github.com/ARMmbed/mbedtls
cd mbedtls
make
make DESTDIR=$HOME/mbedtls3 install
fi

if [ "$TRAVIS_OS_NAME" = linux -a "$LIBRESSL" ]; then
cd $HOME
git clone --depth=1 -b v3.1.4 https://github.com/libressl-portable/portable.git libressl-git
Expand Down
19 changes: 19 additions & 0 deletions zuul.d/jobs.yaml
View file
Open in desktop
Expand Up @@ -245,6 +245,24 @@
LD_LIBRARY_PATH: "{{ ansible_user_dir }}/openssl3/lib64:/usr/local/lib"
TFLAGS: https ftps

- job:
name: curl-debug-mbedtls3
parent: curl-base
vars:
curl_apt_packages:
- libpsl-dev
- libbrotli-dev
- libzstd-dev
curl_env:
CC: gcc-8
CXX: g++-8
T: debug
MBEDTLS3: "yes"
C: >-
--with-mbedtls={{ ansible_user_dir }}/mbedtls3
LD_LIBRARY_PATH: "{{ ansible_user_dir }}/mbedtls3/lib:/usr/local/lib"
TFLAGS: https ftps

- job:
name: curl-debug-mesalink
parent: curl-base
Expand Down Expand Up @@ -545,6 +563,7 @@
- curl-novalgrind-ngtcp2-gnutls
- curl-debug-wolfssl
- curl-debug-openssl3
- curl-debug-mbedtls3
- curl-debug-mesalink
- curl-debug-clang-with-openssl
- curl-debug-clang-disable-alt-svc-with-openssl
Expand Down