TeamHepta/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-03-20 11:11:08 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
7f4fe3943d754120fa1e639ffe89402d1c436d10
mbedtls/library/mbedtls_check_config.h

368 lines
15 KiB
C
Raw Normal View History

Split config checks to separate file
2014-04-30 12:35:08 +02:00
/**
Split check_config.h Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-11-12 15:57:42 +01:00
* \file mbedtls/check_config.h
Split config checks to separate file
2014-04-30 12:35:08 +02:00
*
* \brief Consistency checks for configuration options
Document check-config.h and *adjust*.h as internal headers Including *adjust*.h directly is likely to cause them to be applied at the wrong time, resulting in an invalid or unintended configuration. Including check_config.h at the wrong time is likely to cause spurious errors. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-04-26 14:18:10 +02:00
*
* This is an internal header. Do not include it directly.
*
* This header is included automatically by all public Mbed TLS headers
* (via mbedtls/build_info.h). Do not include it directly in a configuration
* file such as mbedtls/mbedtls_config.h or #MBEDTLS_USER_CONFIG_FILE!
* It would run at the wrong time due to missing derived symbols.
Update Doxygen file blocks to remove copyright and license information
2018-01-05 15:33:17 +00:00
*/
/*
Update copyright notices to use Linux Foundation guidance As a result, the copyright of contributors other than Arm is now acknowledged, and the years of publishing are no longer tracked in the source files. Also remove the now-redundant lines declaring that the files are part of MbedTLS. This commit was generated using the following script: # ======================== #!/bin/sh # Find files find '(' -path './.git' -o -path './3rdparty' ')' -prune -o -type f -print | xargs sed -bi ' # Replace copyright attribution line s/Copyright.*Arm.*/Copyright The Mbed TLS Contributors/I # Remove redundant declaration and the preceding line $!N /This file is part of Mbed TLS/Id P D ' # ======================== Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-08-07 13:07:28 +02:00
* Copyright The Mbed TLS Contributors
update headers Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2023-11-02 19:47:20 +00:00
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Split config checks to separate file
2014-04-30 12:35:08 +02:00
*/
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#ifndef MBEDTLS_CHECK_CONFIG_H
#define MBEDTLS_CHECK_CONFIG_H
Split config checks to separate file
2014-04-30 12:35:08 +02:00
Disable code style correction in check_config.h Code style correction currently messes up check_names.py Signed-off-by: David Horstmann <david.horstmann@arm.com>
2022-11-14 15:40:46 +00:00
/* *INDENT-OFF* */
Warn if mbedtls_config.h is included manually Some projects using Mbed TLS have migrated their configuration file (config.h -> mbedtls_config.h, or MBEDTLS_CONFIG_FILE) from Mbed TLS 2.x, and kept including check_config.h. This is unnecessary since Mbed TLS 3.0, and increasingly in 3.x it may report spurious errors because the configuration adjustments have not been done yet. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2024-05-16 14:54:04 +02:00
#if !defined(MBEDTLS_CONFIG_IS_FINALIZED)
#warning "Do not include mbedtls/check_config.h manually! " \
"This may cause spurious errors. " \
"It is included automatically at the right point since Mbed TLS 3.0."
#endif /* !MBEDTLS_CONFIG_IS_FINALIZED */
config: Allow Mbed to implement TIMING_C Mbed OS now provides POSIX-like time functions, although not alarm() nor signal(). It is possible to implement MBEDTLS_TIMING_ALT on Mbed OS, so we should not artificially prevent this in check-config. Remove the the check that prevents implementing MBEDTLS_TIMING_ALT on Mbed OS. Note that this limitation originally was added in the following commit, although there isn't much context around why the restriction was imposed: 63e7ebaaa184 ("Add material for generating yotta module"). In 2015, Mbed OS was quite a different thing: no RTOS, no threads, just an asynchronous event loop model. I'd suppose the asynchronous event loop model made it difficult before to implement MBEDTLS_TIMING_C on Mbed OS, but that is no longer the case. Fixes #4633 Signed-off-by: Jaeden Amero <jaeden.amero@arm.com>
2021-06-08 18:31:27 +01:00
#if defined(TARGET_LIKE_MBED) && defined(MBEDTLS_NET_C)
#error "The NET module is not available for mbed OS - please use the network functions provided by Mbed OS"
Add material for generating yotta module
2015-07-28 14:17:48 +02:00
#endif
Split HAVE_TIME into HAVE_TIME + HAVE_TIME_DATE First one means we have time() but it may not return the actual wall clock time, second means it does.
2015-06-18 20:52:58 +02:00
#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_HAVE_TIME)
#error "MBEDTLS_HAVE_TIME_DATE without MBEDTLS_HAVE_TIME does not make sense"
#endif
Add check for unsupported partial curves acceleration Manual test: run test_psa_crypto_config_accel_ecc_non_weierstrass_curves or test_psa_crypto_config_accel_ecc_weierstrass_curves as they are now, observe it failing with the expected #error. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-09-28 09:46:22 +02:00
/* Limitations on ECC curves acceleration: partial curve acceleration is only
* supported with crypto excluding PK, X.509 or TLS.
* Note: no need to check X.509 as it depends on PK. */
#if defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256) || \
defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384) || \
defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512) || \
defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255) || \
defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448) || \
defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) || \
defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256) || \
defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384) || \
defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521)
#if defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES)
Split check_config.h Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2024-11-12 15:57:42 +01:00
#if defined(MBEDTLS_SSL_TLS_C)
Add check for unsupported partial curves acceleration Manual test: run test_psa_crypto_config_accel_ecc_non_weierstrass_curves or test_psa_crypto_config_accel_ecc_weierstrass_curves as they are now, observe it failing with the expected #error. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-09-28 09:46:22 +02:00
#error "Unsupported partial support for ECC curves acceleration, see docs/driver-only-builds.md"
#endif /* modules beyond what's supported */
#endif /* not all curves accelerated */
#endif /* some curve accelerated */
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) && \
build_info: replace PK_CAN_ECDH with CAN_ECDH and fix comments Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-07 17:22:17 +02:00
!defined(MBEDTLS_CAN_ECDH)
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#error "MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \
Replace legacy RSA crypto options in check_config.h For the test_psa_crypto_config_accel_rsa_crypto component, ignore test cases that depend on MBEDTLS_GENPRIME being enabled. When all RSA cryptographic operations are provided by drivers, MBEDTLS_GENPRIME will not be enabled, as it will no longer be a configuration option. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2025-06-30 10:36:25 +02:00
( !defined(MBEDTLS_CAN_ECDH) || !defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) || \
!defined(MBEDTLS_X509_CRT_PARSE_C) || !defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) || !defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) )
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#error "MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
Fix dependencies of 1.2 ECDSA key exchanges Having ECDSA in PSA doesn't help if we're not using PSA from TLS 1.2... Also, move the definition of PSA_HAVE_FULL_ECDSA outside the MBEDTLS_PSA_CRYPTO_CONFIG guards so that it is available in all cases. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-03-10 11:40:48 +01:00
#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \
build_info: replace PK_CAN_ECDH with CAN_ECDH and fix comments Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-07 17:22:17 +02:00
( !defined(MBEDTLS_CAN_ECDH) || \
Remove definitions of MBEDTLS_PK_CAN/HAVE_ECDSA* Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-06 10:49:05 +01:00
!defined(PSA_HAVE_ALG_ECDSA_SIGN) || \
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
!defined(MBEDTLS_X509_CRT_PARSE_C) )
#error "MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
Remove temporary macros that are not needed Those were only used for KEY_EXCHANGE_ECJPAKE, but had a much larger scope than needed. We actually don't need those macros if we distinguish between cases when expressing dependencies for this key exchange. The remaining helper macros are all short lived. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:17:20 +01:00
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
( !defined(PSA_WANT_ALG_JPAKE) || \
!defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \
!defined(PSA_WANT_ECC_SECP_R1_256) )
#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites"
#endif
Add ECJPAKE key exchange
2015-09-15 17:53:32 +02:00
ECJPAKE: always use MD light This enables access to all available hashes, instead of the previous situation where you had to choose by including MD_C or not. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-03-14 23:59:24 +01:00
/* Use of EC J-PAKE in TLS requires SHA-256. */
Fix dependencies of KEY_EXCHANGE_ECJPAKE The EC J-PAKE module the ability to "fall back" to PSA when MD is not present a few PRs ago, but the dependency of this key exchange on SHA-256 wasn't updated at the time. (Note: the crypto primitive doesn't depend on SHA-256, only its use in the TLS key exchange does.) Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2022-09-19 10:44:42 +02:00
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) && \
Replace legacy symbols in config files Replace symbols that were left over in config_adjust_*.h and check_config.h Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-08-20 14:53:19 +01:00
!defined(PSA_WANT_ALG_SHA_256)
Fix dependencies of KEY_EXCHANGE_ECJPAKE The EC J-PAKE module the ability to "fall back" to PSA when MD is not present a few PRs ago, but the dependency of this key exchange on SHA-256 wasn't updated at the time. (Note: the crypto primitive doesn't depend on SHA-256, only its use in the TLS key exchange does.) Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2022-09-19 10:44:42 +02:00
#error "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED defined, but not all prerequisites"
#endif
Rename identifiers containing double-underscore Rename identifiers containing double-underscore (`__`) to avoid `__`. The reason to avoid double-underscore is that all identifiers containing double-underscore are reserved in C++. Rename all such identifiers that appear in any public header, including ssl_internal.h which is in principle private but in practice is installed with the public headers. This commit makes check-names.sh pass. ``` perl -i -pe 's/\bMBEDTLS_SSL__ECP_RESTARTABLE\b/MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED/g; s/\bMBEDTLS_KEY_EXCHANGE_(_\w+)_(_\w+)\b/MBEDTLS_KEY_EXCHANGE${1}${2}/g' include/mbedtls/*.h library/*.c programs/*/*.c scripts/data_files/rename-1.3-2.0.txt tests/suites/*.function ```
2020-03-10 12:19:08 +01:00
#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) && \
Fix dependency on low-level hash modules None of the TLS code is calling low-level hash functions directly. So the correct dependencies here are MD_CAN. (I checked and this was the only occurrence.) Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:00:28 +01:00
!defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) && \
Replace legacy symbols in config files Replace symbols that were left over in config_adjust_*.h and check_config.h Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-08-20 14:53:19 +01:00
!defined(PSA_WANT_ALG_SHA_256) && \
Remove MBEDTLS_MD_CAN_SHA512 from header files Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-03 16:52:28 +01:00
!defined(PSA_WANT_ALG_SHA_512) && \
Replace MBEDTLS_MD_CAN_SHA1 with PSA_WANT_ALG_SHA_1 Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-04 18:12:59 +01:00
!defined(PSA_WANT_ALG_SHA_1)
Fix dependency on low-level hash modules None of the TLS code is calling low-level hash functions directly. So the correct dependencies here are MD_CAN. (I checked and this was the only occurrence.) Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2024-02-08 12:00:28 +01:00
#error "!MBEDTLS_SSL_KEEP_PEER_CERTIFICATE requires SHA-512, SHA-256 or SHA-1".
Add config sanity check for !MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
2019-02-26 11:43:09 +00:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
Replace legacy RSA crypto options in check_config.h For the test_psa_crypto_config_accel_rsa_crypto component, ignore test cases that depend on MBEDTLS_GENPRIME being enabled. When all RSA cryptographic operations are provided by drivers, MBEDTLS_GENPRIME will not be enabled, as it will no longer be a configuration option. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2025-06-30 10:36:25 +02:00
( !defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) || !defined(PSA_WANT_ALG_RSA_OAEP) )
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#error "MBEDTLS_X509_RSASSA_PSS_SUPPORT defined, but not all prerequisites"
Fix dependencies
2014-01-24 14:37:29 +01:00
#endif
Fix and simplify TLS hash dependency declarations Fixes #6441 Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-03-22 00:13:50 +01:00
/* TLS 1.3 requires separate HKDF parts from PSA,
* and at least one ciphersuite, so at least SHA-256 or SHA-384
* from PSA to use with HKDF.
*
* Note: for dependencies common with TLS 1.2 (running handshake hash),
* see MBEDTLS_SSL_TLS_C. */
Rename MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL to MBEDTLS_SSL_PROTO_TLS1_3 As we have now a minimal viable implementation of TLS 1.3, let's remove EXPERIMENTAL from the config option enabling it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-12-08 16:57:54 +01:00
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
Make check_config aware of MBEDTLS_PSA_CRYPTO_CLIENT When check_config needs to evaluate the availability of a feature through a PSA API, it should look for MBEDTLS_PSA_CRYPTO_CLIENT instead of MBEDTLS_PSA_CRYPTO_C, to be able to cover the case where the API is provided through a client/service interface. Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com>
2024-02-07 13:01:33 +00:00
!(defined(MBEDTLS_PSA_CRYPTO_CLIENT) && \
Fix and simplify TLS hash dependency declarations Fixes #6441 Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-03-22 00:13:50 +01:00
defined(PSA_WANT_ALG_HKDF_EXTRACT) && \
defined(PSA_WANT_ALG_HKDF_EXPAND) && \
(defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA_384)))
Rename MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL to MBEDTLS_SSL_PROTO_TLS1_3 As we have now a minimal viable implementation of TLS 1.3, let's remove EXPERIMENTAL from the config option enabling it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-12-08 16:57:54 +01:00
#error "MBEDTLS_SSL_PROTO_TLS1_3 defined, but not all prerequisites"
Add dependencies for experimental TLS 1.3 features in check_config.h Signed-off-by: Hanno Becker <hanno.becker@arm.com>
2020-06-02 06:20:23 +01:00
#endif
Add TLS 1.3 key exchange mode config options Add TLS 1.3 specific configuration options to enable/disable the support for TLS 1.3 key exchange modes. These configurations are introduced to move away from the aforementioned enablement/disablement based on MBEDTLS_KEY_EXCHANGE_xxx_ENABLED options that relate to group of TLS 1.2 ciphersuites. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2022-10-04 15:48:06 +02:00
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED)
pk: do not duplicate internal symbols for ECDH/ECDSA capabilities Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-06 14:52:45 +02:00
#if !( (defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH)) && \
defined(MBEDTLS_X509_CRT_PARSE_C) && \
Replace legacy RSA crypto options in check_config.h For the test_psa_crypto_config_accel_rsa_crypto component, ignore test cases that depend on MBEDTLS_GENPRIME being enabled. When all RSA cryptographic operations are provided by drivers, MBEDTLS_GENPRIME will not be enabled, as it will no longer be a configuration option. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2025-06-30 10:36:25 +02:00
( defined(PSA_HAVE_ALG_ECDSA_SIGN) || defined(PSA_WANT_ALG_RSA_OAEP) ) )
Add TLS 1.3 key exchange mode config options Add TLS 1.3 specific configuration options to enable/disable the support for TLS 1.3 key exchange modes. These configurations are introduced to move away from the aforementioned enablement/disablement based on MBEDTLS_KEY_EXCHANGE_xxx_ENABLED options that relate to group of TLS 1.2 ciphersuites. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2022-10-04 15:48:06 +02:00
#error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED defined, but not all prerequisites"
#endif
#endif
#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED)
Properly disable ECDH in only (psk) ephemeral ffdh key exchange components Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2023-06-15 16:44:08 +02:00
#if !( defined(PSA_WANT_ALG_ECDH) || defined(PSA_WANT_ALG_FFDH) )
Add TLS 1.3 key exchange mode config options Add TLS 1.3 specific configuration options to enable/disable the support for TLS 1.3 key exchange modes. These configurations are introduced to move away from the aforementioned enablement/disablement based on MBEDTLS_KEY_EXCHANGE_xxx_ENABLED options that relate to group of TLS 1.2 ciphersuites. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2022-10-04 15:48:06 +02:00
#error "MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED defined, but not all prerequisites"
#endif
#endif
Document that MBEDTLS_SSL_KEEP_PEER_CERTIFICATE is required by MBEDTLS_SSL_PROTO_TLS1_3 Also have check_config.h enforce this. And MBEDTLS_SSL_EXPORT_KEYS has been removed, so no longer mention it. Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-06-29 16:36:12 +01:00
/*
* The current implementation of TLS 1.3 requires MBEDTLS_SSL_KEEP_PEER_CERTIFICATE.
*/
#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && !defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
#error "MBEDTLS_SSL_PROTO_TLS1_3 defined without MBEDTLS_SSL_KEEP_PEER_CERTIFICATE"
#endif
Remove the TLS 1.0 and 1.1 support Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-05-12 17:49:18 +02:00
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
Remove `MBEDTLS_KEY_EXCHANGE_RSA_ENABLED` config option Signed-off-by: Gabor Mezei <gabor.mezei@arm.com>
2025-02-26 18:06:05 +01:00
!(defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) || \
Add additional sanity checks to check_config.h Additional sanity checks in check_config.h to ensure: * if test certificates are included (MBEDTLS_CERTS_C) there must be also be support for the core X509 feature (MBEDTLS_X509_USE_C). This has a secondary dependency on the public key abstraction layer (MBEDTLS_PK_C), necessary as the certificates will either be signed by RSA or ECDSA, and therefore need to be part of the library. * if any of the TLS protocols are defined (MBEDTLS_SSL_PROTO_xxx) then a key exchange method must also be defined (MBEDTLS_KEY_EXCHANGE_xxx). Anyone who knows the library will probably not make these mistakes or will quickly diagnose and fix them, but it is possible to compile and link both configurations if you build only the library and not the example programs, and therefore users may not realise immediately that there's a mistake, only discovering it at runtime. These checks may therefore save someone some time. Signed-off-by: Simon Butcher <simon.butcher@arm.com>
2019-04-11 18:56:18 +01:00
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) || \
defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) || \
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) || \
defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) )
#error "One or more versions of the TLS protocol are enabled " \
"but no key exchange methods defined with MBEDTLS_KEY_EXCHANGE_xxxx"
#endif
Change prerequisites of MBEDTLS_SSL_EARLY_DATA and add related check Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
2022-10-25 02:56:00 +00:00
#if defined(MBEDTLS_SSL_EARLY_DATA) && \
Update documents and check Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
2022-11-10 10:38:17 +00:00
( !defined(MBEDTLS_SSL_SESSION_TICKETS) || \
( !defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) && \
!defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) ) )
Change prerequisites of MBEDTLS_SSL_EARLY_DATA and add related check Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>
2022-10-25 02:56:00 +00:00
#error "MBEDTLS_SSL_EARLY_DATA defined, but not all prerequisites"
#endif
Add max_early_data_size config option Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2022-11-05 10:50:06 +08:00
#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_SRV_C) && \
MBEDTLS_SSL_MAX_EARLY_DATA_SIZE: default value should be commented out in config Numeric options should be commented out with their default values in the config file, and a separate header file should set the default value if necessary. This was done for most other options in #8161; do it here for MBEDTLS_SSL_MAX_EARLY_DATA_SIZE. Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2023-09-14 12:59:50 +01:00
defined(MBEDTLS_SSL_MAX_EARLY_DATA_SIZE) && \
((MBEDTLS_SSL_MAX_EARLY_DATA_SIZE < 0) || \
(MBEDTLS_SSL_MAX_EARLY_DATA_SIZE > UINT32_MAX))
#error "MBEDTLS_SSL_MAX_EARLY_DATA_SIZE must be in the range(0..UINT32_MAX)"
Add max_early_data_size config option Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2022-11-05 10:50:06 +08:00
#endif
Rm hard dependency of DTLS on TIMING_C
2015-05-13 10:10:00 +02:00
#if defined(MBEDTLS_SSL_PROTO_DTLS) && \
!defined(MBEDTLS_SSL_PROTO_TLS1_2)
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#error "MBEDTLS_SSL_PROTO_DTLS defined, but not all prerequisites"
Add basic flags for DTLS
2014-02-06 13:04:16 +01:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_SSL_CLI_C) && !defined(MBEDTLS_SSL_TLS_C)
#error "MBEDTLS_SSL_CLI_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
check_config: add missing dependencies for the build without BIGNUM Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-03 15:36:25 +01:00
#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) && !defined(MBEDTLS_X509_CRT_PARSE_C)
#error "MBEDTLS_SSL_ASYNC_PRIVATE defined, but not all prerequisites"
#endif
Fix and simplify TLS hash dependency declarations Fixes #6441 Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-03-22 00:13:50 +01:00
/* TLS 1.2 and 1.3 require SHA-256 or SHA-384 (running handshake hash) */
Address review comment Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-09-05 13:08:59 +01:00
#if defined(MBEDTLS_SSL_TLS_C) && \
Replace legacy symbols in config files Replace symbols that were left over in config_adjust_*.h and check_config.h Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-08-20 14:53:19 +01:00
!(defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA_384))
Fix typos Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-03-24 10:30:40 +01:00
#error "MBEDTLS_SSL_TLS_C defined, but not all prerequisites"
Fix and simplify TLS hash dependency declarations Fixes #6441 Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2023-03-22 00:13:50 +01:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_SSL_SRV_C) && !defined(MBEDTLS_SSL_TLS_C)
#error "MBEDTLS_SSL_SRV_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
tls13_only: check_config pass Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2021-12-23 11:06:26 +08:00
#if defined(MBEDTLS_SSL_TLS_C) && \
!( defined(MBEDTLS_SSL_PROTO_TLS1_2) || defined(MBEDTLS_SSL_PROTO_TLS1_3) )
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#error "MBEDTLS_SSL_TLS_C defined, but no protocols are active"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
Relax some dependencies - DTLS_HELLO_VERIFY no longer depends on SRV_C - SSL_COOKIE_C no longer depends on DTLS_HELLO_VERIFY Not that much work for us, and easier on users (esp. since it allows just disabling SRV_C alone).
2015-05-20 10:59:43 +02:00
#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) && !defined(MBEDTLS_SSL_PROTO_DTLS)
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#error "MBEDTLS_SSL_DTLS_HELLO_VERIFY defined, but not all prerequisites"
Make DTLS_HELLO_VERIFY a compile option
2014-07-23 00:28:58 +02:00
#endif
Stop wasting resources Use a custom function that minimally parses the message an creates a reply without the overhead of a full SSL context. Also fix dependencies: needs DTLS_HELLO_VERIFY for the cookie types, and let's also depend on SRV_C as is doesn't make sense on client.
2015-09-08 17:50:29 +02:00
#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) && \
Tune dependencies Don't depend on srv.c in config.h, but add explicit checks. This is more in line with other options that only make sense server-side, and also it allows to test full config minus srv.c more easily.
2015-09-09 12:46:16 +02:00
!defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY)
Stop wasting resources Use a custom function that minimally parses the message an creates a reply without the overhead of a full SSL context. Also fix dependencies: needs DTLS_HELLO_VERIFY for the cookie types, and let's also depend on SRV_C as is doesn't make sense on client.
2015-09-08 17:50:29 +02:00
#error "MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE defined, but not all prerequisites"
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) && \
( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) )
#error "MBEDTLS_SSL_DTLS_ANTI_REPLAY defined, but not all prerequisites"
Make DTLS_ANTI_REPLAY depends on PROTO_DTLS
2014-09-24 14:05:32 +02:00
#endif
Restore X509 and SSL functionality Look for changes that remove X509/SSL functionality. ``` git diff 'HEAD^{/^Merge}~1' HEAD --diff-filter=M -- . ':!library/error.c' ':!library/version_features.c' ':!programs/test/query_config.c' ':!visualc' ':!*.pdf' ':!*.der' | grep -E "^-.*MBEDTLS_(ERR_)?(PKCS11|X509|NET|SSL)_" ``` All of these removals are in `config.h` or `check_config.h`. Selectively revert the differences in these two files. ``` git diff 'HEAD^{/^Merge}~1' 'HEAD^{/^Merge}' include/mbedtls/config.h include/mbedtls/check_config.h | git apply -p1 -R ``` * `include/mbedtls/check_config.h`: * ARIA for GCM: don't remove it. * `MBEDTLS_PSA_CRYPTO_SE_C`: don't remove it. * `MBEDTLS_SHA512_NO_SHA384`: don't remove it. * `MBEDTLS_SSL_DTLS_CONNECTION_ID`: restore it. * `include/mbedtls/config.h`: * warning about `MBEDTLS_ECDSA_SIGN_ALT`: don't remove it. * `MBEDTLS_CTR_DRBG_USE_128_BIT_KEY` full paragraph: don't remove it. * `MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER`: don't remove it. * `MBEDTLS_SHA512_SMALLER`…: don't remove it. * `MBEDTLS_SSL_RECORD_CHECKING`: restore it. * `MBEDTLS_SSL_CONTEXT_SERIALIZATION`: restore it. * `MBEDTLS_USE_PSA_CRYPTO` note: don't restore the tls version. * `MBEDTLS_USE_PSA_CRYPTO` warning: restore the tls version. * `MBEDTLS_CMAC_C`: restore it to being disabled by default. It's a minor API change in Mbed TLS because it changes the layout of `mbedtls_cipher_context_t`. * `MBEDTLS_CTR_DRBG_C`: don't restore the older version of the description from tls. * `MBEDTLS_GCM_C`: don't restore the older description from tls. * `MBEDTLS_PSA_CRYPTO_C`: don't restore `crypto/`. * `MBEDTLS_PSA_CRYPTO_SE_C`: don't remove it. * `MBEDTLS_PSA_CRYPTO_STORAGE_C`: don't restore `crypto/`. Don't disable it by default. * `MBEDTLS_PSA_ITS_FILE_C`: don't restore, like for ``MBEDTLS_PSA_CRYPTO_STORAGE_C``. * `MBEDTLS_CTR_DRBG_USE_128_BIT_KEY` single line: don't restore it since there is now a full paragraph in the proper section above. * `MBEDTLS_SSL_CID_IN_LEN_MAX`…: restore it. * `MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES`: restore the version without a space to format the line like the others.
2020-03-04 21:35:27 +01:00
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
( !defined(MBEDTLS_SSL_TLS_C) || !defined(MBEDTLS_SSL_PROTO_DTLS) )
#error "MBEDTLS_SSL_DTLS_CONNECTION_ID defined, but not all prerequisites"
#endif
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
defined(MBEDTLS_SSL_CID_IN_LEN_MAX) && \
MBEDTLS_SSL_CID_IN_LEN_MAX > 255
#error "MBEDTLS_SSL_CID_IN_LEN_MAX too large (max 255)"
#endif
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) && \
defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) && \
MBEDTLS_SSL_CID_OUT_LEN_MAX > 255
#error "MBEDTLS_SSL_CID_OUT_LEN_MAX too large (max 255)"
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) && \
!defined(MBEDTLS_SSL_PROTO_TLS1_2)
Redo of PR#5345. Fixed spelling and typographical errors found by CodeSpell. Signed-off-by: Shaun Case <warmsocks@gmail.com> Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-12-20 21:14:10 -08:00
#error "MBEDTLS_SSL_ENCRYPT_THEN_MAC defined, but not all prerequisites"
Implement initial negotiation of EtM Not implemented yet: - actually using EtM - conditions on renegotiation
2014-10-27 13:57:03 +01:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) && \
!defined(MBEDTLS_SSL_PROTO_TLS1_2)
Redo of PR#5345. Fixed spelling and typographical errors found by CodeSpell. Signed-off-by: Shaun Case <warmsocks@gmail.com> Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-12-20 21:14:10 -08:00
#error "MBEDTLS_SSL_EXTENDED_MASTER_SECRET defined, but not all prerequisites"
Make session-hash depend on TLS versions
2014-10-28 14:13:55 +01:00
#endif
Disable MBEDTLS_SSL_RENEGOTIATION in tls13-only configuration There's no renegotiation in TLS 1.3, so this option should have no effect. Insist on having it disabled, to avoid the risk of accidentally having different behavior in TLS 1.3 if the option is enabled (as happened in https://github.com/Mbed-TLS/mbedtls/issues/6200). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-08-12 22:43:18 +02:00
#if defined(MBEDTLS_SSL_RENEGOTIATION) && \
!defined(MBEDTLS_SSL_PROTO_TLS1_2)
#error "MBEDTLS_SSL_RENEGOTIATION defined, but not all prerequisites"
#endif
Fix MBEDTLS_SSL_TICKET_C, MBEDTLS_SSL_SESSION_TICKETS dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-10-10 08:47:13 +02:00
#if defined(MBEDTLS_SSL_TICKET_C) && \
Replace legacy symbols in config files Replace symbols that were left over in config_adjust_*.h and check_config.h Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-08-20 14:53:19 +01:00
!( defined(PSA_WANT_ALG_CCM) || defined(PSA_WANT_ALG_GCM) || \
defined(PSA_WANT_ALG_CHACHA20_POLY1305) )
Fix missing guard and double-space Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-10-11 09:40:40 +02:00
#error "MBEDTLS_SSL_TICKET_C defined, but not all prerequisites"
Fix MBEDTLS_SSL_TICKET_C, MBEDTLS_SSL_SESSION_TICKETS dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-10-10 08:47:13 +02:00
#endif
Rename MBEDTLS_SSL_TICKET_NONCE_LENGTH Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2022-07-20 11:04:50 +08:00
#if defined(MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH) && \
MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH >= 256
#error "MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH must be less than 256"
fix comments and time_t type issues Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
2022-07-20 10:36:12 +08:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) && \
!defined(MBEDTLS_X509_CRT_PARSE_C)
#error "MBEDTLS_SSL_SERVER_NAME_INDICATION defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_VERSION_FEATURES) && !defined(MBEDTLS_VERSION_C)
#error "MBEDTLS_VERSION_FEATURES defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
check_config: remove unnecessary BIGNUM_C requirements Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-27 10:10:28 +02:00
#if defined(MBEDTLS_X509_USE_C) && \
Replace MBEDTLS_OID_C by function-specific dependencies For each function in `x509_oid.c`, determine where it is used and only include it in the build if it is needed by the X.509 code. Define the corresponding internal tables only when they are consumed by a function. This makes Mbed TLS completely independent of the compilation option `MBEDTLS_OID_C`. This option remains present only in sample configs for crypto, where it must stay until TF-PSA-Crypto no longer relies on this option. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2025-05-12 20:52:07 +02:00
(!defined(MBEDTLS_ASN1_PARSE_C) || !defined(MBEDTLS_PK_PARSE_C))
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#error "MBEDTLS_X509_USE_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
check_config: remove unnecessary BIGNUM_C requirements Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-27 10:10:28 +02:00
#if defined(MBEDTLS_X509_CREATE_C) && \
Replace MBEDTLS_OID_C by function-specific dependencies For each function in `x509_oid.c`, determine where it is used and only include it in the build if it is needed by the X.509 code. Define the corresponding internal tables only when they are consumed by a function. This makes Mbed TLS completely independent of the compilation option `MBEDTLS_OID_C`. This option remains present only in sample configs for crypto, where it must stay until TF-PSA-Crypto no longer relies on this option. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2025-05-12 20:52:07 +02:00
(!defined(MBEDTLS_ASN1_WRITE_C) || !defined(MBEDTLS_PK_PARSE_C))
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#error "MBEDTLS_X509_CREATE_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_X509_CRT_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) )
#error "MBEDTLS_X509_CRT_PARSE_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_X509_CRL_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) )
#error "MBEDTLS_X509_CRL_PARSE_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_X509_CSR_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) )
#error "MBEDTLS_X509_CSR_PARSE_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_X509_CRT_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) )
#error "MBEDTLS_X509_CRT_WRITE_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#if defined(MBEDTLS_X509_CSR_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) )
#error "MBEDTLS_X509_CSR_WRITE_C defined, but not all prerequisites"
Split config checks to separate file
2014-04-30 12:35:08 +02:00
#endif
check_config: add missing dependencies for the build without BIGNUM Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-03 15:36:25 +01:00
#if defined(MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK) && \
fix wrong dependency for X509_TRUSTED_CERTIFICATE_CALLBACK Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-05 09:32:29 +01:00
( !defined(MBEDTLS_X509_CRT_PARSE_C) )
check_config: add missing dependencies for the build without BIGNUM Signed-off-by: Valerio Setti <vsetti@baylibre.com>
2023-01-03 15:36:25 +01:00
#error "MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK defined, but not all prerequisites"
#endif
Add mki value and some review comments 1. Add check for prerequisites in check_config.h 2. Add mki value to use_srtp extension 3. address some review comments Signed-off-by: Johan Pascal <johan.pascal@belledonne-communications.com>
2017-12-21 10:15:08 +02:00
#if defined(MBEDTLS_SSL_DTLS_SRTP) && ( !defined(MBEDTLS_SSL_PROTO_DTLS) )
#error "MBEDTLS_SSL_DTLS_SRTP defined, but not all prerequisites"
#endif
Add a missing dependency to config.h Variable buffer lengths depend on the maximum fragment length extension. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2020-10-21 15:12:39 +02:00
#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) && ( !defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) )
#error "MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH defined, but not all prerequisites"
#endif
Add parsing for Record Size Limit extension in TLS 1.3 Fixes #7007 Signed-off-by: Jan Bruckner <jan@janbruckner.de>
2023-02-10 12:45:19 +01:00
#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) && ( !defined(MBEDTLS_SSL_PROTO_TLS1_3) )
#error "MBEDTLS_SSL_RECORD_SIZE_LIMIT defined, but not all prerequisites"
#endif
test: keep SSL_TICKET_C and SSL_CONTEXT_SERIALIZATION enabled Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-10-02 16:03:42 +02:00
#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) && \
Replace legacy symbols in config files Replace symbols that were left over in config_adjust_*.h and check_config.h Signed-off-by: Elena Uziunaite <elena.uziunaite@arm.com>
2024-08-20 14:53:19 +01:00
!( defined(PSA_WANT_ALG_CCM) || defined(PSA_WANT_ALG_GCM) || \
defined(PSA_WANT_ALG_CHACHA20_POLY1305) )
Make MBEDTLS_SSL_CONTEXT_SERIALIZATION dependent on AEAD Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-09-28 07:59:01 +02:00
#error "MBEDTLS_SSL_CONTEXT_SERIALIZATION defined, but not all prerequisites"
#endif
Error out if attempting to use a removed feature If the compile-time configuration enables an option that was removed in Mbed TLS 3.0, and the effect of removing the option would likely not be detected at build time, #error out in check_config.h. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 18:45:41 +02:00
/* Reject attempts to enable options that have been removed and that could
* cause a build to succeed but with features removed. */
#if defined(MBEDTLS_HAVEGE_C) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_HAVEGE_C was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/2599"
Error out if attempting to use a removed feature If the compile-time configuration enables an option that was removed in Mbed TLS 3.0, and the effect of removing the option would likely not be detected at build time, #error out in check_config.h. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 18:45:41 +02:00
#endif
#if defined(MBEDTLS_SSL_HW_RECORD_ACCEL) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_SSL_HW_RECORD_ACCEL was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031"
Error out if attempting to use a removed feature If the compile-time configuration enables an option that was removed in Mbed TLS 3.0, and the effect of removing the option would likely not be detected at build time, #error out in check_config.h. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 18:45:41 +02:00
#endif
#if defined(MBEDTLS_SSL_PROTO_SSL3) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_SSL_PROTO_SSL3 (SSL v3.0 support) was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031"
Error out if attempting to use a removed feature If the compile-time configuration enables an option that was removed in Mbed TLS 3.0, and the effect of removing the option would likely not be detected at build time, #error out in check_config.h. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 18:45:41 +02:00
#endif
#if defined(MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO (SSL v2 ClientHello support) was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031"
Error out if attempting to use a removed feature If the compile-time configuration enables an option that was removed in Mbed TLS 3.0, and the effect of removing the option would likely not be detected at build time, #error out in check_config.h. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 18:45:41 +02:00
#endif
#if defined(MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT (compatibility with the buggy implementation of truncated HMAC in Mbed TLS up to 2.7) was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031"
Error out if attempting to use a removed feature If the compile-time configuration enables an option that was removed in Mbed TLS 3.0, and the effect of removing the option would likely not be detected at build time, #error out in check_config.h. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 18:45:41 +02:00
#endif
#if defined(MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES) //no-check-names
Remove extraneous word Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 19:01:59 +02:00
#error "MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_CERTIFICATES was removed in Mbed TLS 3.0. See the ChangeLog entry if you really need SHA-1-signed certificates."
Error out if attempting to use a removed feature If the compile-time configuration enables an option that was removed in Mbed TLS 3.0, and the effect of removing the option would likely not be detected at build time, #error out in check_config.h. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 18:45:41 +02:00
#endif
#if defined(MBEDTLS_ZLIB_SUPPORT) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_ZLIB_SUPPORT was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4031"
Error out if attempting to use a removed feature If the compile-time configuration enables an option that was removed in Mbed TLS 3.0, and the effect of removing the option would likely not be detected at build time, #error out in check_config.h. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 18:45:41 +02:00
#endif
Remove MBEDTLS_CHECK_PARAMS option Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-05-14 15:08:04 +02:00
#if defined(MBEDTLS_CHECK_PARAMS) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_CHECK_PARAMS was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4313"
Remove MBEDTLS_CHECK_PARAMS option Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-05-14 15:08:04 +02:00
#endif
Adding removed defines to check_config.h and fixing the migration guide entry. Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-05-31 12:58:25 +02:00
#if defined(MBEDTLS_SSL_CID_PADDING_GRANULARITY) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_SSL_CID_PADDING_GRANULARITY was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4335"
Adding removed defines to check_config.h and fixing the migration guide entry. Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-05-31 12:58:25 +02:00
#endif
#if defined(MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_SSL_TLS1_3_PADDING_GRANULARITY was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4335"
Adding removed defines to check_config.h and fixing the migration guide entry. Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-05-31 12:58:25 +02:00
#endif
Removes MBEDTLS_SSL_TRUNCATED_HMAC config option Commit removes the MBEDTLS_SSL_TRUNCATED_HMAC config option from config.h and places a check that it is unset in check_config.h. Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
2021-06-15 12:54:14 +01:00
#if defined(MBEDTLS_SSL_TRUNCATED_HMAC) //no-check-names
Update references to old Github organisation Replace references to ARMmbed organisation with the new org, Mbed-TLS, following project migration. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2022-03-31 14:07:01 +01:00
#error "MBEDTLS_SSL_TRUNCATED_HMAC was removed in Mbed TLS 3.0. See https://github.com/Mbed-TLS/mbedtls/issues/4341"
Removes MBEDTLS_SSL_TRUNCATED_HMAC config option Commit removes the MBEDTLS_SSL_TRUNCATED_HMAC config option from config.h and places a check that it is unset in check_config.h. Signed-off-by: Thomas Daubney <thomas.daubney@arm.com>
2021-06-15 12:54:14 +01:00
#endif
mbedtls: add support for pkcs7 PKCS7 signing format is used by OpenPOWER Key Management, which is using mbedtls as its crypto library. This patch adds the limited support of pkcs7 parser and verification to the mbedtls. The limitations are: * Only signed data is supported. * CRLs are not currently handled. * Single signer is supported. Signed-off-by: Daniel Axtens <dja@axtens.net> Signed-off-by: Eric Richter <erichte@linux.ibm.com> Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
2020-11-16 19:03:12 +00:00
#if defined(MBEDTLS_PKCS7_C) && ( ( !defined(MBEDTLS_ASN1_PARSE_C) ) || \
Replace MBEDTLS_OID_C by function-specific dependencies For each function in `x509_oid.c`, determine where it is used and only include it in the build if it is needed by the X.509 code. Define the corresponding internal tables only when they are consumed by a function. This makes Mbed TLS completely independent of the compilation option `MBEDTLS_OID_C`. This option remains present only in sample configs for crypto, where it must stay until TF-PSA-Crypto no longer relies on this option. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2025-05-12 20:52:07 +02:00
( !defined(MBEDTLS_PK_PARSE_C) ) || \
check_config: remove unnecessary BIGNUM_C requirements Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
2023-07-27 10:10:28 +02:00
( !defined(MBEDTLS_X509_CRT_PARSE_C) ) || \
( !defined(MBEDTLS_X509_CRL_PARSE_C) ) || \
pkcs7: Add dependecy on MBEDTLS_MD_C Signed-off-by: Nick Child <nick.child@ibm.com>
2022-11-09 10:36:10 -06:00
( !defined(MBEDTLS_MD_C) ) )
mbedtls: add support for pkcs7 PKCS7 signing format is used by OpenPOWER Key Management, which is using mbedtls as its crypto library. This patch adds the limited support of pkcs7 parser and verification to the mbedtls. The limitations are: * Only signed data is supported. * CRLs are not currently handled. * Single signer is supported. Signed-off-by: Daniel Axtens <dja@axtens.net> Signed-off-by: Eric Richter <erichte@linux.ibm.com> Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
2020-11-16 19:03:12 +00:00
#error "MBEDTLS_PKCS7_C is defined, but not all prerequisites"
#endif
Have MBEDTLS_TIMING_C require MBEDTLS_HAVE_TIME Nowadays, the timing module just builds on a function that provides a timer with millisecond resolution. In terms of platform requirements, this is almost exactly equivalent to `mbedtls_ms_time()` provides (`mbedtls_ms_time()` is arguably a little stronger because it is supposed to last longer than a single timer object, but an application could start a timer when it starts, so there's no real difference.) So it's a bit silly that `timing.c` essentially reimplements this. Rely on `mbedtls_ms_time()` instead. This is an API break because in Mbed TLS 4.0, it was possible to enable `MBEDTLS_TIMING_C` without `MBEDTLS_HAVE_TIME`. However, `timing.c` only provided an implementation for Windows and Unix-like platforms, and on those platforms, it is very likely that the default implementation of `MBEDTLS_HAVE_TIME` would also work. (The main exception would be a platform that has the traditional Unix function `gettimeofday()`, but not the 1990s novelty `clock_gettime()`.) So make this an official requirement, as a belated change that really should have gone into 4.0 if we'd taken the time to dig into it. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2026-02-19 16:26:18 +01:00
#if defined(MBEDTLS_TIMING_C) && \
!(defined(MBEDTLS_HAVE_TIME) || defined(MBEDTLS_TIMING_ALT))
#error "MBEDTLS_TIMING_C requires either MBEDTLS_HAVE_TIME or MBEDTLS_TIMING_ALT"
#endif
Disable code style correction in check_config.h Code style correction currently messes up check_names.py Signed-off-by: David Horstmann <david.horstmann@arm.com>
2022-11-14 15:40:46 +00:00
/* *INDENT-ON* */
The Great Renaming A simple execution of tmp/invoke-rename.pl
2015-04-08 12:49:31 +02:00
#endif /* MBEDTLS_CHECK_CONFIG_H */
Reference in New Issue Copy Permalink