Skip to content

Commit f82e140

Browse files
bors[bot]raoulstrackxVardhan Thigle
authored
Merge #126
126: Upgrading mbedtls to version 2.24.0 r=jethrogb a=raoulstrackx Upgrading mbedtls to latest version Co-authored-by: Raoul Strackx <[email protected]> Co-authored-by: Vardhan Thigle <[email protected]>
2 parents c26a84e + d048b59 commit f82e140

File tree

1,303 files changed

+78951
-195571
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,303 files changed

+78951
-195571
lines changed

‎Cargo.lock

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎mbedtls-sys/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "mbedtls-sys-auto"
3-
version = "2.18.5"
3+
version = "2.24.0"
44
authors = ["Jethro Beekman <[email protected]>"]
55
build = "build/build.rs"
66
license = "Apache-2.0/GPL-2.0+"

‎mbedtls-sys/build/build.rs

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@ mod mod_bindgen;
1616
#[path = "cmake.rs"]
1717
mod mod_cmake;
1818

19-
use std::collections::HashMap;
2019
use std::env;
2120
use std::fs::File;
2221
use std::io::Write;
@@ -40,10 +39,7 @@ struct BuildConfig {
4039
impl BuildConfig {
4140
fn create_config_h(&self) {
4241
let target = env::var("TARGET").unwrap();
43-
let mut defines = config::DEFAULT_DEFINES
44-
.iter()
45-
.cloned()
46-
.collect::<HashMap<_, _>>();
42+
let mut defines = config::default_defines();
4743
for &(feat, def) in config::FEATURE_DEFINES {
4844
if (feat == "std") && (target == "x86_64-fortanix-unknown-sgx") {
4945
continue;
@@ -65,6 +61,9 @@ impl BuildConfig {
6561
if have_feature("custom_threading") {
6662
writeln!(f, "typedef void* mbedtls_threading_mutex_t;")?;
6763
}
64+
if have_feature("custom_time") {
65+
writeln!(f, "long long mbedtls_time(long long*);")?;
66+
}
6867
f.write_all(config::SUFFIX.as_bytes())
6968
})
7069
.expect("config.h I/O error");

‎mbedtls-sys/build/config.rs

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
* option. This file may not be copied, modified, or distributed except
77
* according to those terms. */
88

9+
use std::collections::HashMap;
10+
911
#[derive(Copy, Clone, PartialEq, Eq)]
1012
pub enum Macro {
1113
Undefined,
@@ -63,7 +65,7 @@ for line in open('vendor/include/mbedtls/config.h').readlines():
6365
*/
6466

6567
#[cfg_attr(rustfmt, rustfmt_skip)]
66-
pub const DEFAULT_DEFINES: &'static [CDefine] = &[
68+
const DEFAULT_DEFINES: &'static [CDefine] = &[
6769
("MBEDTLS_HAVE_ASM", Defined),
6870
("MBEDTLS_NO_UDBL_DIVISION", Undefined),
6971
("MBEDTLS_NO_64BIT_MULTIPLICATION", Undefined),
@@ -83,6 +85,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
8385
("MBEDTLS_DEPRECATED_WARNING", Undefined),
8486
("MBEDTLS_DEPRECATED_REMOVED", Undefined),
8587
("MBEDTLS_CHECK_PARAMS", Undefined),
88+
("MBEDTLS_CHECK_PARAMS_ASSERT", Undefined),
8689
("MBEDTLS_TIMING_ALT", Undefined),
8790
("MBEDTLS_AES_ALT", Undefined),
8891
("MBEDTLS_ARC4_ALT", Undefined),
@@ -132,7 +135,6 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
132135
("MBEDTLS_ECP_RANDOMIZE_JAC_ALT", Undefined),
133136
("MBEDTLS_ECP_ADD_MIXED_ALT", Undefined),
134137
("MBEDTLS_ECP_DOUBLE_JAC_ALT", Undefined),
135-
("MBEDTLS_ECDH_LEGACY_CONTEXT", Defined),
136138
("MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT", Undefined),
137139
("MBEDTLS_ECP_NORMALIZE_JAC_ALT", Undefined),
138140
("MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT", Undefined),
@@ -153,6 +155,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
153155
("MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS", Defined),
154156
("MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN", Defined),
155157
("MBEDTLS_CIPHER_PADDING_ZEROS", Defined),
158+
("MBEDTLS_CTR_DRBG_USE_128_BIT_KEY", Undefined),
156159
("MBEDTLS_ENABLE_WEAK_CIPHERSUITES", Undefined),
157160
("MBEDTLS_REMOVE_ARC4_CIPHERSUITES", Defined),
158161
("MBEDTLS_REMOVE_3DES_CIPHERSUITES", Defined),
@@ -170,6 +173,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
170173
("MBEDTLS_ECP_DP_CURVE25519_ENABLED", Defined),
171174
("MBEDTLS_ECP_DP_CURVE448_ENABLED", Defined),
172175
("MBEDTLS_ECP_NIST_OPTIM", Defined),
176+
("MBEDTLS_ECP_NO_INTERNAL_RNG", Undefined),
173177
("MBEDTLS_ECP_RESTARTABLE", Undefined),
174178
("MBEDTLS_ECDH_LEGACY_CONTEXT", Defined),
175179
("MBEDTLS_ECDSA_DETERMINISTIC", Undefined),
@@ -192,6 +196,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
192196
("MBEDTLS_NO_PLATFORM_ENTROPY", Defined),
193197
("MBEDTLS_ENTROPY_FORCE_SHA256", Undefined),
194198
("MBEDTLS_ENTROPY_NV_SEED", Undefined),
199+
("MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER", Undefined),
195200
("MBEDTLS_MEMORY_DEBUG", Undefined),
196201
("MBEDTLS_MEMORY_BACKTRACE", Undefined),
197202
("MBEDTLS_PK_RSA_ALT_SUPPORT", Defined),
@@ -202,9 +207,13 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
202207
("MBEDTLS_RSA_NO_CRT", Undefined),
203208
("MBEDTLS_SELF_TEST", Defined),
204209
("MBEDTLS_SHA256_SMALLER", Undefined),
210+
("MBEDTLS_SHA512_SMALLER", Undefined),
211+
("MBEDTLS_SHA512_NO_SHA384", Undefined),
205212
("MBEDTLS_SSL_ALL_ALERT_MESSAGES", Defined),
213+
("MBEDTLS_SSL_RECORD_CHECKING", Defined),
206214
("MBEDTLS_SSL_DTLS_CONNECTION_ID", Undefined),
207215
("MBEDTLS_SSL_ASYNC_PRIVATE", Undefined),
216+
("MBEDTLS_SSL_CONTEXT_SERIALIZATION", Defined),
208217
("MBEDTLS_SSL_DEBUG_ALL", Undefined),
209218
("MBEDTLS_SSL_ENCRYPT_THEN_MAC", Defined),
210219
("MBEDTLS_SSL_EXTENDED_MASTER_SECRET", Defined),
@@ -220,6 +229,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
220229
("MBEDTLS_SSL_PROTO_TLS1", Undefined),
221230
("MBEDTLS_SSL_PROTO_TLS1_1", Undefined),
222231
("MBEDTLS_SSL_PROTO_TLS1_2", Defined),
232+
("MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL", Undefined),
223233
("MBEDTLS_SSL_PROTO_DTLS", Defined),
224234
("MBEDTLS_SSL_ALPN", Defined),
225235
("MBEDTLS_SSL_DTLS_ANTI_REPLAY", Defined),
@@ -231,6 +241,8 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
231241
("MBEDTLS_SSL_SERVER_NAME_INDICATION", Defined),
232242
("MBEDTLS_SSL_TRUNCATED_HMAC", Defined),
233243
("MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT", Undefined),
244+
("MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH", Undefined),
245+
("MBEDTLS_TEST_HOOKS", Undefined),
234246
("MBEDTLS_THREADING_ALT", Undefined),
235247
("MBEDTLS_THREADING_PTHREAD", Undefined),
236248
("MBEDTLS_USE_PSA_CRYPTO", Undefined),
@@ -292,6 +304,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
292304
("MBEDTLS_PLATFORM_C", Undefined),
293305
("MBEDTLS_POLY1305_C", Defined),
294306
("MBEDTLS_PSA_CRYPTO_C", Undefined),
307+
("MBEDTLS_PSA_CRYPTO_SE_C", Undefined),
295308
("MBEDTLS_PSA_CRYPTO_STORAGE_C", Undefined),
296309
("MBEDTLS_PSA_ITS_FILE_C", Undefined),
297310
("MBEDTLS_RIPEMD160_C", Defined),
@@ -363,6 +376,7 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
363376
("MBEDTLS_SSL_CID_IN_LEN_MAX", Undefined), // default: 32
364377
("MBEDTLS_SSL_CID_OUT_LEN_MAX", Undefined), // default: 32
365378
("MBEDTLS_SSL_CID_PADDING_GRANULARITY", Undefined), // default: 16
379+
("MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY", Undefined), // default: 1
366380
("MBEDTLS_SSL_OUT_CONTENT_LEN", Undefined), // default: 16384
367381
("MBEDTLS_SSL_DTLS_MAX_BUFFERING", Undefined), // default: 32768
368382
("MBEDTLS_SSL_DEFAULT_TICKET_LIFETIME", Undefined), // default: 86400
@@ -375,14 +389,28 @@ pub const DEFAULT_DEFINES: &'static [CDefine] = &[
375389
("MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE", Defined),
376390
("MBEDTLS_PLATFORM_ZEROIZE_ALT", Undefined),
377391
("MBEDTLS_PLATFORM_GMTIME_R_ALT", Undefined),
392+
("MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED", Undefined),
378393
];
379394

395+
pub fn default_defines() -> HashMap<&'static str, Macro> {
396+
let mut defines = HashMap::new();
397+
398+
for (key, value) in DEFAULT_DEFINES.iter() {
399+
if defines.insert(*key, *value).is_some() {
400+
panic!("Duplicate default define in {}: {}", file!(), key);
401+
}
402+
}
403+
404+
defines
405+
}
406+
380407
#[cfg_attr(rustfmt, rustfmt_skip)]
381408
pub const FEATURE_DEFINES: &'static [(&'static str, CDefine)] = &[
382409
("time", ("MBEDTLS_HAVE_TIME", Defined)),
383410
("time", ("MBEDTLS_HAVE_TIME_DATE", Defined)),
384411
("time", ("MBEDTLS_TIMING_C", Defined)),
385412
("custom_time", ("MBEDTLS_PLATFORM_TIME_MACRO", DefinedAs("mbedtls_time"))),
413+
("custom_time", ("MBEDTLS_PLATFORM_TIME_TYPE_MACRO", DefinedAs("long long"))),
386414
("custom_gmtime_r", ("MBEDTLS_PLATFORM_GMTIME_R_ALT", Defined)),
387415
("havege", ("MBEDTLS_HAVEGE_C", Defined)),
388416
("threading", ("MBEDTLS_THREADING_C", Defined)),

‎mbedtls-sys/build/headers.rs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ use crate::have_feature;
1818
*
1919
* ls -f1 $( \
2020
* ( \
21-
* grep '^#include' *|grep -v '<'|grep -v MBEDTLS_|sed 's/:#include//;s/"//g'|grep -v _alt.h; \
22-
* ls *.h|awk '{print $1 " " $1}' \
21+
* grep '^#include' *|grep -v '<'|grep -v MBEDTLS_|sed 's/:#include//;s/"//g'|sed 's#mbedtls/##g'| egrep -v ' (psa/crypto.h|everest/everest.h|zlib.h|.*_alt.h)$'; \
22+
* ls *.h|awk '{print $1 " " $1}' \
2323
* )|tsort|tac| \
2424
* egrep -v '^(compat-1.3.h|certs.h|config.h|check_config.h)$' \
2525
* )

‎mbedtls-sys/src/types.rs

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -90,18 +90,27 @@ extern crate libc;
9090
mod libc_types {
9191
pub use super::libc::FILE;
9292

93+
#[cfg(all(feature = "time", not(feature = "custom_time")))]
94+
pub use super::libc::time_t;
95+
96+
#[cfg(feature = "custom_time")]
97+
pub type time_t = super::raw_types::c_longlong;
98+
9399
#[cfg(feature = "time")]
94-
pub use super::libc::{time_t, tm};
100+
pub use super::libc::tm;
95101

96102
}
97103

98104
#[cfg(not(feature = "libc"))]
99105
mod libc_types {
100106
pub enum FILE {}
101107

102-
#[cfg(feature = "time")]
108+
#[cfg(all(feature = "time", not(feature = "custom_time")))]
103109
pub type time_t = i64;
104110

111+
#[cfg(feature = "custom_time")]
112+
pub type time_t = super::raw_types::c_longlong;
113+
105114
#[cfg(feature = "time")]
106115
#[repr(C)]
107116
pub struct tm {

‎mbedtls-sys/vendor/3rdparty/.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/Makefile

‎mbedtls-sys/vendor/3rdparty/CMakeLists.txt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
list (APPEND thirdparty_src)
2+
list (APPEND thirdparty_lib)
3+
list (APPEND thirdparty_inc_public)
4+
list (APPEND thirdparty_inc)
5+
list (APPEND thirdparty_def)
6+
7+
execute_process(COMMAND ${MBEDTLS_PYTHON_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/config.py -f ${CMAKE_CURRENT_SOURCE_DIR}/../include/mbedtls/config.h get MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED RESULT_VARIABLE result)
8+
9+
if(${result} EQUAL 0)
10+
add_subdirectory(everest)
11+
endif()
12+
13+
set(thirdparty_src ${thirdparty_src} PARENT_SCOPE)
14+
set(thirdparty_lib ${thirdparty_lib} PARENT_SCOPE)
15+
set(thirdparty_inc_public ${thirdparty_inc_public} PARENT_SCOPE)
16+
set(thirdparty_inc ${thirdparty_inc} PARENT_SCOPE)
17+
set(thirdparty_def ${thirdparty_def} PARENT_SCOPE)

‎mbedtls-sys/vendor/3rdparty/Makefile.inc

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
THIRDPARTY_DIR = $(dir $(lastword $(MAKEFILE_LIST)))
2+
include $(THIRDPARTY_DIR)/everest/Makefile.inc

‎mbedtls-sys/vendor/3rdparty/everest/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
*.o
2+
Makefile

‎mbedtls-sys/vendor/3rdparty/everest/CMakeLists.txt

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
list (APPEND everest_src)
2+
list (APPEND everest_inc_public)
3+
list (APPEND everest_inc)
4+
list (APPEND everest_def)
5+
6+
set(everest_src
7+
${CMAKE_CURRENT_SOURCE_DIR}/library/everest.c
8+
${CMAKE_CURRENT_SOURCE_DIR}/library/x25519.c
9+
${CMAKE_CURRENT_SOURCE_DIR}/library/Hacl_Curve25519_joined.c
10+
)
11+
12+
list(APPEND everest_inc_public ${CMAKE_CURRENT_SOURCE_DIR}/include)
13+
list(APPEND everest_inc ${CMAKE_CURRENT_SOURCE_DIR}/include/everest ${CMAKE_CURRENT_SOURCE_DIR}/include/everest/kremlib)
14+
15+
if(INSTALL_MBEDTLS_HEADERS)
16+
17+
install(DIRECTORY include/everest
18+
DESTINATION include
19+
FILE_PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
20+
DIRECTORY_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
21+
FILES_MATCHING PATTERN "*.h")
22+
23+
endif(INSTALL_MBEDTLS_HEADERS)
24+
25+
set(thirdparty_src ${thirdparty_src} ${everest_src} PARENT_SCOPE)
26+
set(thirdparty_inc_public ${thirdparty_inc_public} ${everest_inc_public} PARENT_SCOPE)
27+
set(thirdparty_inc ${thirdparty_inc} ${everest_inc} PARENT_SCOPE)
28+
set(thirdparty_def ${thirdparty_def} ${everest_def} PARENT_SCOPE)

‎mbedtls-sys/vendor/3rdparty/everest/Makefile.inc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
THIRDPARTY_INCLUDES+=-I../3rdparty/everest/include -I../3rdparty/everest/include/everest -I../3rdparty/everest/include/everest/kremlib
2+
3+
THIRDPARTY_CRYPTO_OBJECTS+= \
4+
../3rdparty/everest/library/everest.o \
5+
../3rdparty/everest/library/x25519.o \
6+
../3rdparty/everest/library/Hacl_Curve25519_joined.o

‎mbedtls-sys/vendor/3rdparty/everest/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
The files in this directory stem from [Project Everest](https://project-everest.github.io/) and are distributed under the Apache 2.0 license.
2+
3+
This is a formally verified implementation of Curve25519-based handshakes. The C code is automatically derived from the (verified) [original implementation](https://github.com/project-everest/hacl-star/tree/master/code/curve25519) in the [F* language](https://github.com/fstarlang/fstar) by [KreMLin](https://github.com/fstarlang/kremlin). In addition to the improved safety and security of the implementation, it is also significantly faster than the default implementation of Curve25519 in mbedTLS.
4+
5+
The caveat is that not all platforms are supported, although the version in `everest/library/legacy` should work on most systems. The main issue is that some platforms do not provide a 128-bit integer type and KreMLin therefore has to use additional (also verified) code to simulate them, resulting in less of a performance gain overall. Explictly supported platforms are currently `x86` and `x86_64` using gcc or clang, and Visual C (2010 and later).

‎mbedtls-sys/vendor/3rdparty/everest/include/everest/Hacl_Curve25519.h

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
/* Copyright (c) INRIA and Microsoft Corporation. All rights reserved.
2+
Licensed under the Apache 2.0 License. */
3+
4+
/* This file was generated by KreMLin <https://github.com/FStarLang/kremlin>
5+
* KreMLin invocation: /mnt/e/everest/verify/kremlin/krml -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -fbuiltin-uint128 -fc89 -fparentheses -fno-shadow -header /mnt/e/everest/verify/hdrcLh -minimal -I /mnt/e/everest/verify/hacl-star/code/lib/kremlin -I /mnt/e/everest/verify/kremlin/kremlib/compat -I /mnt/e/everest/verify/hacl-star/specs -I /mnt/e/everest/verify/hacl-star/specs/old -I . -ccopt -march=native -verbose -ldopt -flto -tmpdir x25519-c -I ../bignum -bundle Hacl.Curve25519=* -minimal -add-include "kremlib.h" -skip-compilation x25519-c/out.krml -o x25519-c/Hacl_Curve25519.c
6+
* F* version: 059db0c8
7+
* KreMLin version: 916c37ac
8+
*/
9+
10+
11+
12+
#ifndef __Hacl_Curve25519_H
13+
#define __Hacl_Curve25519_H
14+
15+
16+
#include "kremlib.h"
17+
18+
void Hacl_Curve25519_crypto_scalarmult(uint8_t *mypublic, uint8_t *secret, uint8_t *basepoint);
19+
20+
#define __Hacl_Curve25519_H_DEFINED
21+
#endif

0 commit comments

Comments
 (0)