On Sat, Nov 11, 2023 at 1:35 PM Hauke Mehrtens <ha...@hauke-m.de> wrote:
>
> This adds support for compiling the code against Mbed TLS 3.0.0.
> It still compiles against Mbed TLS 2.28.
>
> The following changes were needed:
> * DES and 3DES was removed
> * mbedtls_pk_context->pk_info is private, use mbedtls_pk_get_type()
> to check if it was initialized
> * mbedtls_pk_parse_keyfile() now gets a random callback
> * mbedtls/certs.h contains test data and is not installed any more and
> not needed.
>
> Signed-off-by: Hauke Mehrtens <ha...@hauke-m.de>
> ---
> ustream-mbedtls.c | 12 +++++++++++-
> ustream-mbedtls.h | 1 -
> 2 files changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/ustream-mbedtls.c b/ustream-mbedtls.c
> index 7fc7874..1c70cac 100644
> --- a/ustream-mbedtls.c
> +++ b/ustream-mbedtls.c
> @@ -110,9 +110,15 @@ static const int default_ciphersuites_client[] =
> AES_CBC_CIPHERS(ECDHE_ECDSA),
> AES_CBC_CIPHERS(ECDHE_RSA),
> AES_CBC_CIPHERS(DHE_RSA),
> +/* Removed in Mbed TLS 3.0.0 */
are these for Windows XP compatibility?
> +#ifdef MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
> MBEDTLS_TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
> +#endif
> AES_CIPHERS(RSA),
> +/* Removed in Mbed TLS 3.0.0 */
> +#ifdef MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA
> MBEDTLS_TLS_RSA_WITH_3DES_EDE_CBC_SHA,
> +#endif
> 0
> };
>
> @@ -171,7 +177,7 @@ static void ustream_ssl_update_own_cert(struct
> ustream_ssl_ctx *ctx)
> if (!ctx->cert.version)
> return;
>
> - if (!ctx->key.pk_info)
> + if (mbedtls_pk_get_type(&ctx->key) == MBEDTLS_PK_NONE)
> return;
>
> mbedtls_ssl_conf_own_cert(&ctx->conf, &ctx->cert, &ctx->key);
> @@ -206,7 +212,11 @@ __hidden int __ustream_ssl_set_key_file(struct
> ustream_ssl_ctx *ctx, const char
> {
> int ret;
>
> +#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
> + ret = mbedtls_pk_parse_keyfile(&ctx->key, file, NULL, _random, NULL);
> +#else
> ret = mbedtls_pk_parse_keyfile(&ctx->key, file, NULL);
> +#endif
> if (ret)
> return -1;
>
> diff --git a/ustream-mbedtls.h b/ustream-mbedtls.h
> index e622e5e..7e7c699 100644
> --- a/ustream-mbedtls.h
> +++ b/ustream-mbedtls.h
> @@ -21,7 +21,6 @@
>
> #include <mbedtls/net_sockets.h>
> #include <mbedtls/ssl.h>
> -#include <mbedtls/certs.h>
> #include <mbedtls/x509.h>
> #include <mbedtls/rsa.h>
> #include <mbedtls/error.h>
> --
> 2.39.2
>
>
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel@lists.openwrt.org
> https://lists.openwrt.org/mailman/listinfo/openwrt-devel
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel
