him411/lede-Heleguo
1
0
Fork 0
mirror of https://github.com/Heleguo/lede.git synced 2025-12-16 10:51:12 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

mbedtls: update to version 3.6.5

Browse Source 
- Use official release archive instead of git mirror
- Update website url, fixes #13783

Tested-by: Edoardo Pinci <epinci@outlook.com>
Signed-off-by: Magnus Kroken <mkroken@gmail.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
Magnus Kroken 2025-10-16 16:11:11 +02:00
parent 89e46be186
commit 5656c258fd
5 changed files with 99 additions and 223 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
package/libs/mbedtls/Config.in
View File

@ -8,6 +8,10 @@ config MBEDTLS_AES_C
bool "MBEDTLS_AES_C"
default y
config MBEDTLS_ARIA_C
bool "MBEDTLS_ARIA_C"
default n
config MBEDTLS_CAMELLIA_C
bool "MBEDTLS_CAMELLIA_C"
default n
@ -36,10 +40,6 @@ config MBEDTLS_RIPEMD160_C
bool "MBEDTLS_RIPEMD160_C"
default n
config MBEDTLS_XTEA_C
bool "MBEDTLS_XTEA_C"
default n
config MBEDTLS_RSA_NO_CRT
bool "MBEDTLS_RSA_NO_CRT"
default y
@ -84,6 +84,10 @@ config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
bool "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED"
default n
config MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
bool "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED"
default n
comment "Curves - unselect old or less-used curves to reduce binary size"
config MBEDTLS_ECP_DP_SECP192R1_ENABLED
@ -104,7 +108,7 @@ config MBEDTLS_ECP_DP_SECP384R1_ENABLED
config MBEDTLS_ECP_DP_SECP521R1_ENABLED
bool "MBEDTLS_ECP_DP_SECP521R1_ENABLED"
default n
default y
config MBEDTLS_ECP_DP_SECP192K1_ENABLED
bool "MBEDTLS_ECP_DP_SECP192K1_ENABLED"
@ -140,10 +144,6 @@ config MBEDTLS_ECP_DP_CURVE448_ENABLED
comment "Build Options - unselect features to reduce binary size"
config MBEDTLS_CERTS_C
bool "MBEDTLS_CERTS_C"
default n
config MBEDTLS_CIPHER_MODE_OFB
bool "MBEDTLS_CIPHER_MODE_OFB"
default n
@ -168,9 +168,12 @@ config MBEDTLS_SELF_TEST
bool "MBEDTLS_SELF_TEST"
default n
config MBEDTLS_SSL_TRUNCATED_HMAC
bool "MBEDTLS_SSL_TRUNCATED_HMAC"
default n
config MBEDTLS_THREADING_C
bool "MBEDTLS_THREADING_C"
default y
config MBEDTLS_THREADING_PTHREAD
def_bool MBEDTLS_THREADING_C
config MBEDTLS_VERSION_C
bool "MBEDTLS_VERSION_C"
@ -180,6 +183,43 @@ config MBEDTLS_VERSION_FEATURES
bool "MBEDTLS_VERSION_FEATURES"
default n
config MBEDTLS_PSA_CRYPTO_CLIENT
bool "MBEDTLS_PSA_CRYPTO_CLIENT"
config MBEDTLS_DEPRECATED_WARNING
bool "MBEDTLS_DEPRECATED_WARNING"
default n
config MBEDTLS_SSL_PROTO_TLS1_2
bool "MBEDTLS_SSL_PROTO_TLS1_2"
default y
config MBEDTLS_SSL_PROTO_TLS1_3
bool "MBEDTLS_SSL_PROTO_TLS1_3"
select MBEDTLS_PSA_CRYPTO_CLIENT
select MBEDTLS_HKDF_C
default y
config MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
bool "MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE"
depends on MBEDTLS_SSL_PROTO_TLS1_3
default y
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
bool "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED"
depends on MBEDTLS_SSL_PROTO_TLS1_3
default y
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
bool "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED"
depends on MBEDTLS_SSL_PROTO_TLS1_3
default y
config MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
bool "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED"
depends on MBEDTLS_SSL_PROTO_TLS1_3
default y
comment "Build Options"
config MBEDTLS_ENTROPY_FORCE_SHA256
@ -188,6 +228,7 @@ config MBEDTLS_ENTROPY_FORCE_SHA256
config MBEDTLS_SSL_RENEGOTIATION
bool "MBEDTLS_SSL_RENEGOTIATION"
depends on MBEDTLS_SSL_PROTO_TLS1_2
default n
endif

45
package/libs/mbedtls/Makefile
View File

@ -8,16 +8,16 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=mbedtls
PKG_VERSION:=2.28.5
PKG_VERSION:=3.6.5
PKG_RELEASE:=1
PKG_USE_MIPS16:=0
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
PKG_HASH:=849e86b626e42ded6bf67197b64aa771daa54e2a7e2868dc67e1e4711959e5e3
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL=https://github.com/Mbed-TLS/$(PKG_NAME)/releases/download/$(PKG_NAME)-$(PKG_VERSION)
PKG_HASH:=4a11f1777bb95bf4ad96721cac945a26e04bf19f57d905f241fe77ebeddf46d8
PKG_LICENSE:=GPL-2.0-or-later
PKG_LICENSE_FILES:=gpl-2.0.txt
PKG_LICENSE_FILES:=LICENSE
PKG_CPE_ID:=cpe:/a:arm:mbed_tls
MBEDTLS_BUILD_OPTS_CURVES= \
@ -37,6 +37,7 @@ MBEDTLS_BUILD_OPTS_CURVES= \
MBEDTLS_BUILD_OPTS_CIPHERS= \
CONFIG_MBEDTLS_AES_C \
CONFIG_MBEDTLS_ARIA_C \
CONFIG_MBEDTLS_CAMELLIA_C \
CONFIG_MBEDTLS_CCM_C \
CONFIG_MBEDTLS_CMAC_C \
@ -52,15 +53,17 @@ MBEDTLS_BUILD_OPTS_CIPHERS= \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED \
CONFIG_MBEDTLS_NIST_KW_C \
CONFIG_MBEDTLS_RIPEMD160_C \
CONFIG_MBEDTLS_RSA_NO_CRT \
CONFIG_MBEDTLS_XTEA_C
CONFIG_MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED \
CONFIG_MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \
CONFIG_MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
MBEDTLS_BUILD_OPTS= \
$(MBEDTLS_BUILD_OPTS_CURVES) \
$(MBEDTLS_BUILD_OPTS_CIPHERS) \
CONFIG_MBEDTLS_CERTS_C \
CONFIG_MBEDTLS_CIPHER_MODE_OFB \
CONFIG_MBEDTLS_CIPHER_MODE_XTS \
CONFIG_MBEDTLS_DEBUG_C \
@ -69,9 +72,15 @@ MBEDTLS_BUILD_OPTS= \
CONFIG_MBEDTLS_PLATFORM_C \
CONFIG_MBEDTLS_SELF_TEST \
CONFIG_MBEDTLS_SSL_RENEGOTIATION \
CONFIG_MBEDTLS_SSL_TRUNCATED_HMAC \
CONFIG_MBEDTLS_THREADING_C \
CONFIG_MBEDTLS_THREADING_PTHREAD \
CONFIG_MBEDTLS_VERSION_C \
CONFIG_MBEDTLS_VERSION_FEATURES
CONFIG_MBEDTLS_VERSION_FEATURES \
CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT \
CONFIG_MBEDTLS_DEPRECATED_WARNING \
CONFIG_MBEDTLS_SSL_PROTO_TLS1_2 \
CONFIG_MBEDTLS_SSL_PROTO_TLS1_3 \
CONFIG_MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
PKG_CONFIG_DEPENDS := $(MBEDTLS_BUILD_OPTS)
@ -80,7 +89,7 @@ include $(INCLUDE_DIR)/cmake.mk
define Package/mbedtls/Default
TITLE:=Embedded SSL
URL:=https://tls.mbed.org
URL:=https://www.trustedfirmware.org/projects/mbed-tls/
endef
define Package/mbedtls/Default/description
@ -94,7 +103,7 @@ $(call Package/mbedtls/Default)
CATEGORY:=Libraries
SUBMENU:=SSL
TITLE+= (library)
ABI_VERSION:=12
ABI_VERSION:=21
MENU:=1
endef
@ -136,16 +145,26 @@ define Build/Prepare
$(if $(strip $(foreach opt,$(MBEDTLS_BUILD_OPTS),$($(opt)))),
$(foreach opt,$(MBEDTLS_BUILD_OPTS),
$(PKG_BUILD_DIR)/scripts/config.py \
-f $(PKG_BUILD_DIR)/include/mbedtls/config.h \
-f $(PKG_BUILD_DIR)/include/mbedtls/mbedtls_config.h \
$(if $($(opt)),set,unset) $(patsubst CONFIG_%,%,$(opt))),)
endef
define Build/InstallDev
$(INSTALL_DIR) $(1)/usr/include
$(CP) $(PKG_INSTALL_DIR)/usr/include/mbedtls $(1)/usr/include/
$(CP) \
$(PKG_INSTALL_DIR)/usr/include/mbedtls \
$(PKG_INSTALL_DIR)/usr/include/psa \
$(1)/usr/include/
$(INSTALL_DIR) $(1)/usr/lib
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so* $(1)/usr/lib/
$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.a $(1)/usr/lib/
$(CP) $(PKG_INSTALL_DIR)/usr/lib/cmake $(1)/usr/lib/
$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
$(CP) \
$(PKG_INSTALL_DIR)/usr/lib/pkgconfig/mbedcrypto.pc \
$(PKG_INSTALL_DIR)/usr/lib/pkgconfig/mbedtls.pc \
$(PKG_INSTALL_DIR)/usr/lib/pkgconfig/mbedx509.pc \
$(1)/usr/lib/pkgconfig/
endef
define Package/libmbedtls/install

11
package/libs/mbedtls/patches/100-fix-gcc14-build.patch Normal file
View File

@ -0,0 +1,11 @@
--- a/library/common.h
+++ b/library/common.h
@@ -199,7 +199,7 @@ static inline void mbedtls_xor(unsigned
uint8x16_t x = veorq_u8(v1, v2);
vst1q_u8(r + i, x);
}
-#if defined(__IAR_SYSTEMS_ICC__)
+#if defined(__IAR_SYSTEMS_ICC__) || (defined(MBEDTLS_COMPILER_IS_GCC) && MBEDTLS_GCC_VERSION >= 140100)
/* This if statement helps some compilers (e.g., IAR) optimise out the byte-by-byte tail case
* where n is a constant multiple of 16.
* For other compilers (e.g. recent gcc and clang) it makes no difference if n is a compile-time

197
package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch
View File

@ -1,197 +0,0 @@
From eb9d4fdf1846e688d51d86a9a50f0312aca2af25 Mon Sep 17 00:00:00 2001
From: Glenn Strauss <gstrauss@gluelogic.com>
Date: Sun, 23 Oct 2022 19:48:18 -0400
Subject: [PATCH] x509 crt verify SAN iPAddress
Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
---
include/mbedtls/x509_crt.h | 2 +-
library/x509_crt.c | 126 ++++++++++++++++++++++++++++++-------
2 files changed, 103 insertions(+), 25 deletions(-)
--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -608,7 +608,7 @@ int mbedtls_x509_crt_verify_info(char *b
* \param cn The expected Common Name. This will be checked to be
* present in the certificate's subjectAltNames extension or,
* if this extension is absent, as a CN component in its
- * Subject name. Currently only DNS names are supported. This
+ * Subject name. DNS names and IP addresses are supported. This
* may be \c NULL if the CN need not be verified.
* \param flags The address at which to store the result of the verification.
* If the verification couldn't be completed, the flag value is
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -57,6 +57,10 @@
#if defined(MBEDTLS_HAVE_TIME)
#if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
+#define WIN32_LEAN_AND_MEAN
+#ifndef _WIN32_WINNT
+#define _WIN32_WINNT 0x0600
+#endif
#include <windows.h>
#else
#include <time.h>
@@ -3002,6 +3006,61 @@ find_parent:
}
}
+#ifdef _WIN32
+#ifdef _MSC_VER
+#pragma comment(lib, "ws2_32.lib")
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#elif (defined(__MINGW32__) || defined(__MINGW64__)) && _WIN32_WINNT >= 0x0600
+#include <winsock2.h>
+#include <ws2tcpip.h>
+#endif
+#elif defined(__sun)
+/* Solaris requires -lsocket -lnsl for inet_pton() */
+#elif defined(__has_include)
+#if __has_include(<sys/socket.h>)
+#include <sys/socket.h>
+#endif
+#if __has_include(<arpa/inet.h>)
+#include <arpa/inet.h>
+#endif
+#endif
+
+/* Use whether or not AF_INET6 is defined to indicate whether or not to use
+ * the platform inet_pton() or a local implementation (below). The local
+ * implementation may be used even in cases where the platform provides
+ * inet_pton(), e.g. when there are different includes required and/or the
+ * platform implementation requires dependencies on additional libraries.
+ * Specifically, Windows requires custom includes and additional link
+ * dependencies, and Solaris requires additional link dependencies.
+ * Also, as a coarse heuristic, use the local implementation if the compiler
+ * does not support __has_include(), or if the definition of AF_INET6 is not
+ * provided by headers included (or not) via __has_include() above. */
+#ifndef AF_INET6
+
+#define x509_cn_inet_pton(cn, dst) (0)
+
+#else
+
+static int x509_inet_pton_ipv6(const char *src, void *dst)
+{
+ return inet_pton(AF_INET6, src, dst) == 1 ? 0 : -1;
+}
+
+static int x509_inet_pton_ipv4(const char *src, void *dst)
+{
+ return inet_pton(AF_INET, src, dst) == 1 ? 0 : -1;
+}
+
+#endif /* AF_INET6 */
+
+static size_t x509_cn_inet_pton(const char *cn, void *dst)
+{
+ return strchr(cn, ':') == NULL
+ ? x509_inet_pton_ipv4(cn, dst) == 0 ? 4 : 0
+ : x509_inet_pton_ipv6(cn, dst) == 0 ? 16 : 0;
+}
+
/*
* Check for CN match
*/
@@ -3022,24 +3081,51 @@ static int x509_crt_check_cn(const mbedt
return -1;
}
+static int x509_crt_check_san_ip(const mbedtls_x509_sequence *san,
+ const char *cn, size_t cn_len)
+{
+ uint32_t ip[4];
+ cn_len = x509_cn_inet_pton(cn, ip);
+ if (cn_len == 0) {
+ return -1;
+ }
+
+ for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
+ const unsigned char san_type = (unsigned char) cur->buf.tag &
+ MBEDTLS_ASN1_TAG_VALUE_MASK;
+ if (san_type == MBEDTLS_X509_SAN_IP_ADDRESS &&
+ cur->buf.len == cn_len && memcmp(cur->buf.p, ip, cn_len) == 0) {
+ return 0;
+ }
+ }
+
+ return -1;
+}
+
/*
* Check for SAN match, see RFC 5280 Section 4.2.1.6
*/
-static int x509_crt_check_san(const mbedtls_x509_buf *name,
+static int x509_crt_check_san(const mbedtls_x509_sequence *san,
const char *cn, size_t cn_len)
{
- const unsigned char san_type = (unsigned char) name->tag &
- MBEDTLS_ASN1_TAG_VALUE_MASK;
-
- /* dNSName */
- if (san_type == MBEDTLS_X509_SAN_DNS_NAME) {
- return x509_crt_check_cn(name, cn, cn_len);
+ int san_ip = 0;
+ for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
+ switch ((unsigned char) cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK) {
+ case MBEDTLS_X509_SAN_DNS_NAME: /* dNSName */
+ if (x509_crt_check_cn(&cur->buf, cn, cn_len) == 0) {
+ return 0;
+ }
+ break;
+ case MBEDTLS_X509_SAN_IP_ADDRESS: /* iPAddress */
+ san_ip = 1;
+ break;
+ /* (We may handle other types here later.) */
+ default: /* Unrecognized type */
+ break;
+ }
}
- /* (We may handle other types here later.) */
-
- /* Unrecognized type */
- return -1;
+ return san_ip ? x509_crt_check_san_ip(san, cn, cn_len) : -1;
}
/*
@@ -3050,31 +3136,23 @@ static void x509_crt_verify_name(const m
uint32_t *flags)
{
const mbedtls_x509_name *name;
- const mbedtls_x509_sequence *cur;
size_t cn_len = strlen(cn);
if (crt->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME) {
- for (cur = &crt->subject_alt_names; cur != NULL; cur = cur->next) {
- if (x509_crt_check_san(&cur->buf, cn, cn_len) == 0) {
- break;
- }
- }
-
- if (cur == NULL) {
- *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ if (x509_crt_check_san(&crt->subject_alt_names, cn, cn_len) == 0) {
+ return;
}
} else {
for (name = &crt->subject; name != NULL; name = name->next) {
if (MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &name->oid) == 0 &&
x509_crt_check_cn(&name->val, cn, cn_len) == 0) {
- break;
+ return;
}
}
- if (name == NULL) {
- *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
- }
}
+
+ *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
}
/*

4
package/libs/mbedtls/patches/101-remove-test.patch
View File

@ -1,7 +1,9 @@
--- a/programs/CMakeLists.txt
+++ b/programs/CMakeLists.txt
@@ -1,12 +1,8 @@
@@ -3,14 +3,10 @@ add_custom_target(${programs_target})
add_subdirectory(aes)
add_subdirectory(cipher)
-if (NOT WIN32)
- add_subdirectory(fuzz)
-endif()