Skip to content

Commit 8fc2a3c

Browse files
0xc01700xc0170
authored
Merge pull request #10675 from 0xc0170/update-mbedtls-2.18.0-rc1
Update mbedtls 2.18.0 rc1
2 parents 19e7622 + 948d437 commit 8fc2a3c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

104 files changed

+4901
-2394
lines changed

‎components/TARGET_PSA/services/crypto/COMPONENT_SPE/psa_crypto_partition.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1453,7 +1453,7 @@ static void psa_entropy_operation(void)
14531453
}
14541454

14551455
case PSA_IPC_CALL: {
1456-
#if (defined(MBEDTLS_ENTROPY_NV_SEED) && defined(MBEDTLS_PSA_HAS_ITS_IO))
1456+
#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
14571457
unsigned char *seed = NULL;
14581458
uint32_t bytes_read;
14591459
size_t seed_size = msg.in_size[0];
@@ -1479,7 +1479,7 @@ static void psa_entropy_operation(void)
14791479
mbedtls_free(seed);
14801480
#else
14811481
status = PSA_ERROR_NOT_SUPPORTED;
1482-
#endif /* MBEDTLS_ENTROPY_NV_SEED && MBEDTLS_PSA_HAS_ITS_IO*/
1482+
#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
14831483
break;
14841484
}
14851485

‎features/mbedtls/VERSION.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
mbedtls-2.17.0
1+
mbedtls-2.18.0-rc2

‎features/mbedtls/importer/Makefile

Lines changed: 71 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@
2727
#
2828

2929
# Set the mbed TLS release to import (this can/should be edited before import)
30-
MBED_TLS_RELEASE ?= mbedtls-2.17.0
31-
MBED_TLS_REPO_URL ?= [email protected]:ARMmbed/mbedtls.git
30+
MBED_TLS_RELEASE ?= mbedtls-2.18.0-rc2
31+
MBED_TLS_REPO_URL ?= [email protected]:ARMmbed/mbedtls-restricted.git
3232

3333
# Translate between mbed TLS namespace and mbed namespace
3434
TARGET_PREFIX:=../
@@ -41,6 +41,67 @@ MBED_TLS_DIR:=TARGET_IGNORE/mbedtls
4141
MBED_TLS_API:=$(MBED_TLS_DIR)/include/mbedtls
4242
MBED_TLS_GIT_CFG=$(MBED_TLS_DIR)/.git/config
4343

44+
CRYPTO_SRC := \
45+
$(TARGET_SRC)/aes.c \
46+
$(TARGET_SRC)/aesni.c \
47+
$(TARGET_SRC)/arc4.c \
48+
$(TARGET_SRC)/aria.c \
49+
$(TARGET_SRC)/asn1parse.c \
50+
$(TARGET_SRC)/asn1write.c \
51+
$(TARGET_SRC)/base64.c \
52+
$(TARGET_SRC)/bignum.c \
53+
$(TARGET_SRC)/blowfish.c \
54+
$(TARGET_SRC)/camellia.c \
55+
$(TARGET_SRC)/ccm.c \
56+
$(TARGET_SRC)/chacha20.c \
57+
$(TARGET_SRC)/chachapoly.c \
58+
$(TARGET_SRC)/cipher.c \
59+
$(TARGET_SRC)/cipher_wrap.c \
60+
$(TARGET_SRC)/cmac.c \
61+
$(TARGET_SRC)/ctr_drbg.c \
62+
$(TARGET_SRC)/des.c \
63+
$(TARGET_SRC)/dhm.c \
64+
$(TARGET_SRC)/ecdh.c \
65+
$(TARGET_SRC)/ecdsa.c \
66+
$(TARGET_SRC)/ecjpake.c \
67+
$(TARGET_SRC)/ecp.c \
68+
$(TARGET_SRC)/ecp_curves.c \
69+
$(TARGET_SRC)/entropy.c \
70+
$(TARGET_SRC)/entropy_poll.c \
71+
$(TARGET_SRC)/gcm.c \
72+
$(TARGET_SRC)/havege.c \
73+
$(TARGET_SRC)/hkdf.c \
74+
$(TARGET_SRC)/hmac_drbg.c \
75+
$(TARGET_SRC)/md.c \
76+
$(TARGET_SRC)/md2.c \
77+
$(TARGET_SRC)/md4.c \
78+
$(TARGET_SRC)/md5.c \
79+
$(TARGET_SRC)/md_wrap.c \
80+
$(TARGET_SRC)/memory_buffer_alloc.c \
81+
$(TARGET_SRC)/nist_kw.c \
82+
$(TARGET_SRC)/oid.c \
83+
$(TARGET_SRC)/padlock.c \
84+
$(TARGET_SRC)/pem.c \
85+
$(TARGET_SRC)/pk.c \
86+
$(TARGET_SRC)/pk_wrap.c \
87+
$(TARGET_SRC)/pkcs12.c \
88+
$(TARGET_SRC)/pkcs5.c \
89+
$(TARGET_SRC)/pkparse.c \
90+
$(TARGET_SRC)/pkwrite.c \
91+
$(TARGET_SRC)/platform.c \
92+
$(TARGET_SRC)/platform_util.c \
93+
$(TARGET_SRC)/poly1305.c \
94+
$(TARGET_SRC)/ripemd160.c \
95+
$(TARGET_SRC)/rsa_internal.c \
96+
$(TARGET_SRC)/rsa.c \
97+
$(TARGET_SRC)/sha1.c \
98+
$(TARGET_SRC)/sha256.c \
99+
$(TARGET_SRC)/sha512.c \
100+
$(TARGET_SRC)/threading.c \
101+
$(TARGET_SRC)/timing.c \
102+
$(TARGET_SRC)/xtea.c \
103+
# end
104+
44105
.PHONY: all deploy deploy-tests rsync mbedtls clean update
45106

46107
all: mbedtls
@@ -53,6 +114,9 @@ rsync:
53114
rm -rf $(TARGET_SRC)
54115
rsync -a --exclude='*.txt' $(MBED_TLS_DIR)/library/ $(TARGET_SRC)
55116
#
117+
# Remove files that duplicate Mbed Crypto
118+
rm -rf $(CRYPTO_SRC)
119+
#
56120
# Copying mbed TLS headers to mbed includes...
57121
rm -rf $(TARGET_INC)
58122
mkdir -p $(TARGET_INC)
@@ -86,14 +150,16 @@ update: $(MBED_TLS_GIT_CFG) $(MBED_TLS_HA_GIT_CFG)
86150
# Updating to the specified mbed TLS library version
87151
# (If it is not an initial checkout we will start with the repository
88152
# being in a detached head state)
89-
git -C $(MBED_TLS_DIR) checkout development
90-
git -C $(MBED_TLS_DIR) pull --rebase origin development
153+
git -C $(MBED_TLS_DIR) fetch
91154
#
92155
# Checking out the required release
93156
git -C $(MBED_TLS_DIR) checkout $(MBED_TLS_RELEASE)
94157
#
158+
# Update and checkout git submodules
159+
git -C $(MBED_TLS_DIR) submodule update --init --recursive
160+
#
95161
# Updating checked out version tag
96-
echo $(MBED_TLS_RELEASE) > $(TARGET_PREFIX)VERSION.txt
162+
git -C $(MBED_TLS_DIR) describe --tags --abbrev=12 --dirty --always > $(TARGET_PREFIX)VERSION.txt
97163

98164
$(MBED_TLS_GIT_CFG):
99165
rm -rf $(MBED_TLS_DIR)

‎features/mbedtls/inc/mbedtls/asn1write.h

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,12 @@
3333
#include "asn1.h"
3434

3535
#define MBEDTLS_ASN1_CHK_ADD(g, f) \
36-
do { \
37-
if( ( ret = f ) < 0 ) \
36+
do \
37+
{ \
38+
if( ( ret = (f) ) < 0 ) \
3839
return( ret ); \
3940
else \
40-
g += ret; \
41+
(g) += ret; \
4142
} while( 0 )
4243

4344
#ifdef __cplusplus

‎features/mbedtls/inc/mbedtls/bignum.h

Lines changed: 42 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,12 @@
4646
#define MBEDTLS_ERR_MPI_NOT_ACCEPTABLE -0x000E /**< The input arguments are not acceptable. */
4747
#define MBEDTLS_ERR_MPI_ALLOC_FAILED -0x0010 /**< Memory allocation failed. */
4848

49-
#define MBEDTLS_MPI_CHK(f) do { if( ( ret = f ) != 0 ) goto cleanup; } while( 0 )
49+
#define MBEDTLS_MPI_CHK(f) \
50+
do \
51+
{ \
52+
if( ( ret = (f) ) != 0 ) \
53+
goto cleanup; \
54+
} while( 0 )
5055

5156
/*
5257
* Maximum size MPIs are allowed to grow to in number of limbs.
@@ -490,8 +495,24 @@ int mbedtls_mpi_read_binary( mbedtls_mpi *X, const unsigned char *buf,
490495
size_t buflen );
491496

492497
/**
493-
* \brief Export an MPI into unsigned big endian binary data
494-
* of fixed size.
498+
* \brief Import X from unsigned binary data, little endian
499+
*
500+
* \param X The destination MPI. This must point to an initialized MPI.
501+
* \param buf The input buffer. This must be a readable buffer of length
502+
* \p buflen Bytes.
503+
* \param buflen The length of the input buffer \p p in Bytes.
504+
*
505+
* \return \c 0 if successful.
506+
* \return #MBEDTLS_ERR_MPI_ALLOC_FAILED if memory allocation failed.
507+
* \return Another negative error code on different kinds of failure.
508+
*/
509+
int mbedtls_mpi_read_binary_le( mbedtls_mpi *X,
510+
const unsigned char *buf, size_t buflen );
511+
512+
/**
513+
* \brief Export X into unsigned binary data, big endian.
514+
* Always fills the whole buffer, which will start with zeros
515+
* if the number is smaller.
495516
*
496517
* \param X The source MPI. This must point to an initialized MPI.
497518
* \param buf The output buffer. This must be a writable buffer of length
@@ -506,6 +527,24 @@ int mbedtls_mpi_read_binary( mbedtls_mpi *X, const unsigned char *buf,
506527
int mbedtls_mpi_write_binary( const mbedtls_mpi *X, unsigned char *buf,
507528
size_t buflen );
508529

530+
/**
531+
* \brief Export X into unsigned binary data, little endian.
532+
* Always fills the whole buffer, which will end with zeros
533+
* if the number is smaller.
534+
*
535+
* \param X The source MPI. This must point to an initialized MPI.
536+
* \param buf The output buffer. This must be a writable buffer of length
537+
* \p buflen Bytes.
538+
* \param buflen The size of the output buffer \p buf in Bytes.
539+
*
540+
* \return \c 0 if successful.
541+
* \return #MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if \p buf isn't
542+
* large enough to hold the value of \p X.
543+
* \return Another negative error code on different kinds of failure.
544+
*/
545+
int mbedtls_mpi_write_binary_le( const mbedtls_mpi *X,
546+
unsigned char *buf, size_t buflen );
547+
509548
/**
510549
* \brief Perform a left-shift on an MPI: X <<= count
511550
*

‎features/mbedtls/inc/mbedtls/check_config.h

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,11 @@
125125
#error "MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative or PSA-based ECP implementation"
126126
#endif
127127

128+
#if defined(MBEDTLS_ECP_RESTARTABLE) && \
129+
! defined(MBEDTLS_ECDH_LEGACY_CONTEXT)
130+
#error "MBEDTLS_ECP_RESTARTABLE defined, but not MBEDTLS_ECDH_LEGACY_CONTEXT"
131+
#endif
132+
128133
#if defined(MBEDTLS_ECDSA_DETERMINISTIC) && !defined(MBEDTLS_HMAC_DRBG_C)
129134
#error "MBEDTLS_ECDSA_DETERMINISTIC defined, but not all prerequisites"
130135
#endif
@@ -525,26 +530,25 @@
525530
#error "MBEDTLS_PSA_CRYPTO_SPM defined, but not all prerequisites"
526531
#endif
527532

528-
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) && defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C)
529-
#error "Only one of MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C can be defined"
530-
#endif
531-
532533
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \
533-
!( defined(MBEDTLS_PSA_CRYPTO_C) && \
534-
( defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) || \
535-
defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) ) )
534+
! defined(MBEDTLS_PSA_CRYPTO_C)
536535
#error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites"
537536
#endif
538537

539-
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) && \
540-
!( defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \
541-
defined(MBEDTLS_FS_IO) )
542-
#error "MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C defined, but not all prerequisites"
538+
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
539+
!( defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \
540+
defined(MBEDTLS_ENTROPY_NV_SEED) )
541+
#error "MBEDTLS_PSA_INJECT_ENTROPY defined, but not all prerequisites"
542+
#endif
543+
544+
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
545+
!defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
546+
#error "MBEDTLS_PSA_INJECT_ENTROPY is not compatible with actual entropy sources"
543547
#endif
544548

545-
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) && \
546-
! defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
547-
#error "MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C defined, but not all prerequisites"
549+
#if defined(MBEDTLS_PSA_ITS_FILE_C) && \
550+
!defined(MBEDTLS_FS_IO)
551+
#error "MBEDTLS_PSA_ITS_FILE_C defined, but not all prerequisites"
548552
#endif
549553

550554
#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \

‎features/mbedtls/inc/mbedtls/cipher.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,12 @@ typedef enum {
176176
MBEDTLS_CIPHER_AES_256_XTS, /**< AES 256-bit cipher in XTS block mode. */
177177
MBEDTLS_CIPHER_CHACHA20, /**< ChaCha20 stream cipher. */
178178
MBEDTLS_CIPHER_CHACHA20_POLY1305, /**< ChaCha20-Poly1305 AEAD cipher. */
179+
MBEDTLS_CIPHER_AES_128_KW, /**< AES cipher with 128-bit NIST KW mode. */
180+
MBEDTLS_CIPHER_AES_192_KW, /**< AES cipher with 192-bit NIST KW mode. */
181+
MBEDTLS_CIPHER_AES_256_KW, /**< AES cipher with 256-bit NIST KW mode. */
182+
MBEDTLS_CIPHER_AES_128_KWP, /**< AES cipher with 128-bit NIST KWP mode. */
183+
MBEDTLS_CIPHER_AES_192_KWP, /**< AES cipher with 192-bit NIST KWP mode. */
184+
MBEDTLS_CIPHER_AES_256_KWP, /**< AES cipher with 256-bit NIST KWP mode. */
179185
} mbedtls_cipher_type_t;
180186

181187
/** Supported cipher modes. */
@@ -191,6 +197,8 @@ typedef enum {
191197
MBEDTLS_MODE_CCM, /**< The CCM cipher mode. */
192198
MBEDTLS_MODE_XTS, /**< The XTS cipher mode. */
193199
MBEDTLS_MODE_CHACHAPOLY, /**< The ChaCha-Poly cipher mode. */
200+
MBEDTLS_MODE_KW, /**< The SP800-38F KW mode */
201+
MBEDTLS_MODE_KWP, /**< The SP800-38F KWP mode */
194202
} mbedtls_cipher_mode_t;
195203

196204
/** Supported cipher padding types. */

0 commit comments

Comments
 (0)