Skip to content

Fix mbedTLS 4.x compatibility #579

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bsergean merged 1 commit into from
May 21, 2026
+22 −12
Merged

Fix mbedTLS 4.x compatibility #579

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 16 additions & 11 deletions ixwebsocket/IXSocketMbedTLS.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,18 +42,18 @@ namespace ix

mbedtls_ssl_init(&_ssl);
mbedtls_ssl_config_init(&_conf);
#if MBEDTLS_VERSION_MAJOR < 4
mbedtls_ctr_drbg_init(&_ctr_drbg);
mbedtls_entropy_init(&_entropy);
#endif
mbedtls_x509_crt_init(&_cacert);
mbedtls_x509_crt_init(&_cert);
mbedtls_pk_init(&_pkey);
// Initialize the PSA Crypto API if required by the version of Mbed TLS (3.6.0).
// This allows the X.509/TLS libraries to use PSA for crypto operations.
// Initialize the PSA Crypto API for mbedTLS 3.6+ and all 4.x releases.
// See: https://github.com/Mbed-TLS/mbedtls/blob/development/docs/use-psa-crypto.md
if (MBEDTLS_VERSION_MAJOR >= 3 && MBEDTLS_VERSION_MINOR >= 6 && MBEDTLS_VERSION_PATCH >= 0)
{
psa_crypto_init();
}
#if MBEDTLS_VERSION_MAJOR >= 4 || (MBEDTLS_VERSION_MAJOR == 3 && MBEDTLS_VERSION_MINOR >= 6)
psa_crypto_init();
#endif
}

bool SocketMbedTLS::loadSystemCertificates(std::string& errorMsg)
Expand Down Expand Up @@ -112,6 +112,7 @@ namespace ix

const char* pers = "IXSocketMbedTLS";

#if MBEDTLS_VERSION_MAJOR < 4
if (mbedtls_ctr_drbg_seed(&_ctr_drbg,
mbedtls_entropy_func,
&_entropy,
Expand All @@ -121,6 +122,7 @@ namespace ix
errMsg = "Setting entropy seed failed";
return false;
}
#endif

if (mbedtls_ssl_config_defaults(&_conf,
(isClient) ? MBEDTLS_SSL_IS_CLIENT : MBEDTLS_SSL_IS_SERVER,
Expand All @@ -131,7 +133,9 @@ namespace ix
return false;
}

#if MBEDTLS_VERSION_MAJOR < 4
mbedtls_ssl_conf_rng(&_conf, mbedtls_ctr_drbg_random, &_ctr_drbg);
#endif

if (_tlsOptions.hasCertAndKey())
{
Expand All @@ -140,7 +144,7 @@ namespace ix
errMsg = "Cannot parse cert file '" + _tlsOptions.certFile + "'";
return false;
}
#ifdef IXWEBSOCKET_USE_MBED_TLS_MIN_VERSION_3
#if MBEDTLS_VERSION_MAJOR == 3
if (mbedtls_pk_parse_keyfile(&_pkey, _tlsOptions.keyFile.c_str(), "", mbedtls_ctr_drbg_random, &_ctr_drbg) < 0)
#else
if (mbedtls_pk_parse_keyfile(&_pkey, _tlsOptions.keyFile.c_str(), "") < 0)
Expand Down Expand Up @@ -317,15 +321,16 @@ namespace ix

mbedtls_ssl_free(&_ssl);
mbedtls_ssl_config_free(&_conf);
#if MBEDTLS_VERSION_MAJOR < 4
mbedtls_ctr_drbg_free(&_ctr_drbg);
mbedtls_entropy_free(&_entropy);
#endif
mbedtls_x509_crt_free(&_cacert);
mbedtls_x509_crt_free(&_cert);
mbedtls_pk_free(&_pkey);
if (MBEDTLS_VERSION_MAJOR >= 3 && MBEDTLS_VERSION_MINOR >= 6 && MBEDTLS_VERSION_PATCH >= 0)
{
mbedtls_psa_crypto_free();
}
#if MBEDTLS_VERSION_MAJOR >= 4 || (MBEDTLS_VERSION_MAJOR == 3 && MBEDTLS_VERSION_MINOR >= 6)
mbedtls_psa_crypto_free();
#endif

Socket::close();
}
Expand Down
7 changes: 6 additions & 1 deletion ixwebsocket/IXSocketMbedTLS.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,12 @@

#include "IXSocket.h"
#include "IXSocketTLSOptions.h"
#include <mbedtls/version.h>
#if MBEDTLS_VERSION_MAJOR < 4
#include <mbedtls/ctr_drbg.h>
#include <mbedtls/debug.h>
#include <mbedtls/entropy.h>
#endif
#include <mbedtls/debug.h>
#include <mbedtls/error.h>
#include <mbedtls/net_sockets.h>
#include <mbedtls/platform.h>
Expand Down Expand Up @@ -41,8 +44,10 @@ namespace ix
private:
mbedtls_ssl_context _ssl;
mbedtls_ssl_config _conf;
#if MBEDTLS_VERSION_MAJOR < 4
mbedtls_entropy_context _entropy;
mbedtls_ctr_drbg_context _ctr_drbg;
#endif
mbedtls_x509_crt _cacert;
mbedtls_x509_crt _cert;
mbedtls_pk_context _pkey;
Expand Down
Loading