Skip to content

Commit a325320

Browse files
Teppo JärvelinAntti Kauppila
Teppo Järvelin
authored and
Antti Kauppila
committed
Prepare for upcoming MbedTLS changes
1 parent 468bd41 commit a325320

File tree

5 files changed

+64
-2
lines changed

5 files changed

+64
-2
lines changed

‎features/nanostack/coap-service/source/coap_security_handler.c

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,19 +68,23 @@ struct coap_security_s {
6868

6969
};
7070

71+
#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
7172
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
7273
const int ECJPAKE_SUITES[] = {
7374
MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8,
7475
0
7576
};
7677
#endif
7778

79+
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
7880
static const int PSK_SUITES[] = {
7981
MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256,
8082
MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8,
8183
MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8,
8284
0
8385
};
86+
#endif /* defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) */
87+
#endif /* !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE) */
8488

8589
#define TRACE_GROUP "CsSh"
8690

@@ -332,7 +336,9 @@ static int coap_security_handler_configure_keys(coap_security_t *sec, coap_secur
332336
if (0 != mbedtls_ssl_conf_psk(&sec->_conf, keys._priv_key, keys._priv_key_len, keys._cert, keys._cert_len)) {
333337
break;
334338
}
339+
#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
335340
mbedtls_ssl_conf_ciphersuites(&sec->_conf, PSK_SUITES);
341+
#endif /* !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE) */
336342
ret = 0;
337343
#endif
338344
break;
@@ -342,7 +348,9 @@ static int coap_security_handler_configure_keys(coap_security_t *sec, coap_secur
342348
if (mbedtls_ssl_set_hs_ecjpake_password(&sec->_ssl, keys._key, keys._key_len) != 0) {
343349
return -1;
344350
}
351+
#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
345352
mbedtls_ssl_conf_ciphersuites(&sec->_conf, ECJPAKE_SUITES);
353+
#endif /* !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE) */
346354

347355
//NOTE: If thread starts supporting PSK in other modes, then this will be needed!
348356
mbedtls_ssl_conf_export_keys_cb(&sec->_conf,
@@ -394,11 +402,23 @@ int coap_security_handler_connect_non_blocking(coap_security_t *sec, bool is_ser
394402
return -1;
395403
}
396404

405+
// Defines MBEDTLS_SSL_CONF_RECV/SEND/RECV_TIMEOUT define global functions which should be the same for all
406+
// callers of mbedtls_ssl_set_bio_ctx and there should be only one ssl context. If these rules don't apply,
407+
// these defines can't be used.
408+
#if !defined(MBEDTLS_SSL_CONF_RECV) && !defined(MBEDTLS_SSL_CONF_SEND) && !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
397409
mbedtls_ssl_set_bio(&sec->_ssl, sec,
398410
f_send, f_recv, NULL);
411+
#else
412+
mbedtls_ssl_set_bio_ctx(&sec->_ssl, sec);
413+
#endif /* !defined(MBEDTLS_SSL_CONF_RECV) && !defined(MBEDTLS_SSL_CONF_SEND) && !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT) */
399414

415+
// Defines MBEDTLS_SSL_CONF_SET_TIMER/GET_TIMER define global functions which should be the same for all
416+
// callers of mbedtls_ssl_set_timer_cb and there should be only one ssl context. If these rules don't apply,
417+
// these defines can't be used.
418+
#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && !defined(MBEDTLS_SSL_CONF_GET_TIMER)
400419
mbedtls_ssl_set_timer_cb(&sec->_ssl, sec, set_timer,
401420
get_timer);
421+
#endif /* !defined(MBEDTLS_SSL_CONF_SET_TIMER) && !defined(MBEDTLS_SSL_CONF_GET_TIMER) */
402422

403423
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
404424
//TODO: Figure out better way!!!
@@ -420,8 +440,13 @@ int coap_security_handler_connect_non_blocking(coap_security_t *sec, bool is_ser
420440
&sec->_cookie);
421441
#endif
422442

443+
#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
423444
mbedtls_ssl_conf_min_version(&sec->_conf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MAJOR_VERSION_3);
445+
#endif /* !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER) */
446+
447+
#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
424448
mbedtls_ssl_conf_max_version(&sec->_conf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MAJOR_VERSION_3);
449+
#endif /* !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER) */
425450

426451
sec->_is_started = true;
427452

‎features/nanostack/sal-stack-nanostack/source/Security/protocols/tls_sec_prot/tls_sec_prot_lib.c

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -340,16 +340,30 @@ int8_t tls_sec_prot_lib_connect(tls_security_t *sec, bool is_server, const sec_p
340340
return -1;
341341
}
342342

343+
// Defines MBEDTLS_SSL_CONF_RECV/SEND/RECV_TIMEOUT define global functions which should be the same for all
344+
// callers of mbedtls_ssl_set_bio_ctx and there should be only one ssl context. If these rules don't apply,
345+
// these defines can't be used.
346+
#if !defined(MBEDTLS_SSL_CONF_RECV) && !defined(MBEDTLS_SSL_CONF_SEND) && !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
343347
// Set calbacks
344348
mbedtls_ssl_set_bio(&sec->ssl, sec, tls_sec_prot_lib_ssl_send, tls_sec_prot_lib_ssl_recv, NULL);
349+
#else
350+
mbedtls_ssl_set_bio_ctx(&sec->ssl, sec);
351+
#endif /* !defined(MBEDTLS_SSL_CONF_RECV) && !defined(MBEDTLS_SSL_CONF_SEND) && !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT) */
352+
353+
// Defines MBEDTLS_SSL_CONF_SET_TIMER/GET_TIMER define global functions which should be the same for all
354+
// callers of mbedtls_ssl_set_timer_cb and there should be only one ssl context. If these rules don't apply,
355+
// these defines can't be used.
356+
#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && !defined(MBEDTLS_SSL_CONF_GET_TIMER)
345357
mbedtls_ssl_set_timer_cb(&sec->ssl, sec, tls_sec_prot_lib_ssl_set_timer, tls_sec_prot_lib_ssl_get_timer);
358+
#endif /* !defined(MBEDTLS_SSL_CONF_SET_TIMER) && !defined(MBEDTLS_SSL_CONF_GET_TIMER) */
346359

347360
// Configure certificates, keys and certificate revocation list
348361
if (tls_sec_prot_lib_configure_certificates(sec, certs) != 0) {
349362
tr_error("cert conf fail");
350363
return -1;
351364
}
352365

366+
#if !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE)
353367
// Configure ciphersuites
354368
static const int sec_suites[] = {
355369
MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,
@@ -358,6 +372,7 @@ int8_t tls_sec_prot_lib_connect(tls_security_t *sec, bool is_server, const sec_p
358372
0
359373
};
360374
mbedtls_ssl_conf_ciphersuites(&sec->conf, sec_suites);
375+
#endif /* !defined(MBEDTLS_SSL_CONF_SINGLE_CIPHERSUITE) */
361376

362377
#ifdef TLS_SEC_PROT_LIB_TLS_DEBUG
363378
mbedtls_ssl_conf_dbg(&sec->conf, tls_sec_prot_lib_debug, sec);
@@ -367,8 +382,13 @@ int8_t tls_sec_prot_lib_connect(tls_security_t *sec, bool is_server, const sec_p
367382
// Export keys callback
368383
mbedtls_ssl_conf_export_keys_ext_cb(&sec->conf, tls_sec_prot_lib_ssl_export_keys, sec);
369384

385+
#if !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER)
370386
mbedtls_ssl_conf_min_version(&sec->conf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MAJOR_VERSION_3);
387+
#endif /* !defined(MBEDTLS_SSL_CONF_MIN_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MIN_MAJOR_VER) */
388+
389+
#if !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER)
371390
mbedtls_ssl_conf_max_version(&sec->conf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MAJOR_VERSION_3);
391+
#endif /* !defined(MBEDTLS_SSL_CONF_MAX_MINOR_VER) || !defined(MBEDTLS_SSL_CONF_MAX_MAJOR_VER) */
372392

373393
// Set certificate verify callback
374394
mbedtls_ssl_set_verify(&sec->ssl, tls_sec_prot_lib_x509_crt_verify, sec);

‎features/netsocket/DTLSSocketWrapper.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,13 @@ DTLSSocketWrapper::DTLSSocketWrapper(Socket *transport, const char *hostname, co
3030
_timer_expired(false)
3131
{
3232
mbedtls_ssl_conf_transport(get_ssl_config(), MBEDTLS_SSL_TRANSPORT_DATAGRAM);
33+
34+
// Defines MBEDTLS_SSL_CONF_SET_TIMER/GET_TIMER define global functions which should be the same for all
35+
// callers of mbedtls_ssl_set_timer_cb and there should be only one ssl context. If these rules don't apply,
36+
// these defines can't be used
37+
#if !defined(MBEDTLS_SSL_CONF_SET_TIMER) && !defined(MBEDTLS_SSL_CONF_GET_TIMER)
3338
mbedtls_ssl_set_timer_cb(get_ssl_context(), this, timing_set_delay, timing_get_delay);
39+
#endif /* !defined(MBEDTLS_SSL_CONF_SET_TIMER) && !defined(MBEDTLS_SSL_CONF_GET_TIMER) */
3440
}
3541

3642
void DTLSSocketWrapper::timing_set_delay(void *ctx, uint32_t int_ms, uint32_t fin_ms)

‎features/netsocket/TLSSocketWrapper.cpp

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ TLSSocketWrapper::~TLSSocketWrapper()
8585

8686
void TLSSocketWrapper::set_hostname(const char *hostname)
8787
{
88-
#ifdef MBEDTLS_X509_CRT_PARSE_C
88+
#if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
8989
mbedtls_ssl_set_hostname(&_ssl, hostname);
9090
#endif
9191
}
@@ -207,7 +207,15 @@ nsapi_error_t TLSSocketWrapper::start_handshake(bool first_call)
207207

208208
_transport->set_blocking(false);
209209
_transport->sigio(mbed::callback(this, &TLSSocketWrapper::event));
210-
mbedtls_ssl_set_bio(&_ssl, this, ssl_send, ssl_recv, NULL);
210+
211+
// Defines MBEDTLS_SSL_CONF_RECV/SEND/RECV_TIMEOUT define global functions which should be the same for all
212+
// callers of mbedtls_ssl_set_bio_ctx and there should be only one ssl context. If these rules don't apply,
213+
// these defines can't be used.
214+
#if !defined(MBEDTLS_SSL_CONF_RECV) && !defined(MBEDTLS_SSL_CONF_SEND) && !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT)
215+
mbedtls_ssl_set_bio(&_ssl, this, ssl_send, ssl_recv, nullptr);
216+
#else
217+
mbedtls_ssl_set_bio_ctx(&_ssl, this);
218+
#endif /* !defined(MBEDTLS_SSL_CONF_RECV) && !defined(MBEDTLS_SSL_CONF_SEND) && !defined(MBEDTLS_SSL_CONF_RECV_TIMEOUT) */
211219

212220
_tls_initialized = true;
213221

‎features/netsocket/TLSSocketWrapper.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,9 @@ class TLSSocketWrapper : public Socket {
6666
virtual ~TLSSocketWrapper();
6767

6868
/** Set hostname.
69+
*
70+
* @note Implementation is inside following defines:
71+
* #if defined(MBEDTLS_X509_CRT_PARSE_C) && !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
6972
*
7073
* TLSSocket requires hostname used to verify the certificate.
7174
* If hostname is not given in constructor, this function must be used before

0 commit comments

Comments
 (0)