b99bd39b4e
Merge `unremove-non-crypto` into `mbedtls/development`. The branch
`unremove-non-crypto` was obtained by starting from `mbed-crypto/development`,
then reverting many commits that removed X.509 and TLS functionality when Mbed
Crypto forked from Mbed TLS (the “unremoval”), then make a few tweaks to
facilitate the merge.
The unremoval step restored old versions of some tls files. If a file doesn't
exist in mbed-crypto, check out the mbedtls version, regardless of what
happened during the unremoval of tls files in the crypto tree. Also
unconditionally take the mbedtls version of a few files where the
modifications are completely project-specific and are not relevant in
mbed-crypto:
* `.github/issue_template.md`: completely different. We may want to reconcile
them independently as a follow-up.
* `.travis.yml`: would only be reverted to an earlier tls version.
* `README.md`: completely different. We may want to reconcile them
independently as a follow-up.
* `doxygen/input/doc_mainpage.h`: the changes in crypto were minimal and not
relevant except as a stopgap as mbed-crypto did not have its own product
versioning in the Doxygen documentation.
* `tests/.jenkins/Jenkinsfile`: completely different.
* `tests/data_files/Makefile`: there were no changes in mbed-crypto,
but the unremoval step restored an old version.
Shell script for everything to do after the merge apart from the conflict
resolution:
```
tls_files=($(comm -23 <(git ls-tree -r --name-only HEAD) <(git ls-tree -r --name-only $(git merge-base upstream-crypto/development MERGE_HEAD))))
tls_files+=($tls_files .github/issue_template.md .travis.yml README.md doxygen/input/doc_mainpage.h tests/.jenkins/Jenkinsfile tests/data_files/Makefile)
git checkout --theirs HEAD -- $tls_files
git add -- $tls_files
```
Resolve the remaining conflicts:
* `library/CMakeLists.txt`:
* Keep the TLS definition of `src_crypto`
* `USE_SHARED_MBEDTLS_LIBRARY`: keep all three libraries, with both
`include` and `crypto/include` in `target_include_directories`, all with
version `2.21.0`.
* `programs/Makefile`:
* Reconcile the APPS lists (add/add from a differently-formatted common
ancestor): insert the `psa/*` from crypto into the tls list.
* Keep the `fuzz` target defined only in tls version.
* Keep the recipe (only in tls version) cleaning `ssl_pthread_server`
stuff for the `clean` target.
* `scripts/config.py`:
* `include_in_full`: add/add conflict. Keep both.
* `tests/scripts/all.sh`:
* `component_test_no_use_psa_crypto_full_cmake_asan`: partially old
version in crypto. Take the tls version.
* `component_test_malloc_0_null` and more: take
`component_test_malloc_0_null` from crypto (with `config.py` rather than
`config.pl`, and with `$ASAN_FLAGS` rather than an explicit list), but
add the call to `ssl-opt.sh` from tls. Take the other components from
crypto.
With this commit, building and running the unit tests with both `make ` and
`cmake` work in the default configuration on Linux. Other platforms, build
systems and configurations are likely not to work, and there is some
regression in test coverage.
There is some loss of functionality because the unremoval step restored older
versions of tls content. This commit contains the latest tls version of
tls-only files, but some changes from the tls side in files that existed on
both sides have regressed. Most problematic changes are hunks that remove some
tls-specific feature and contain either a C preprocessor symbol identifying a
tls-specific module or option, or the name of a tls-specific file. Hunks
that remove a tls-specific preprocessor symbol can be identified with the
regular expression `^-.*MBEDTLS_(ERR_)?(PKCS11|X509|NET|SSL)_`.
Subsequent commits will revert a few parts of the patch from this merge commit
in order to restore the tls functionality that it removes, ensure that the
test coverage includes what was covered in either branch, and fix test
failures.
247 lines
7.4 KiB
CMake
247 lines
7.4 KiB
CMake
option(USE_STATIC_MBEDTLS_LIBRARY "Build mbed TLS static library." ON)
|
|
option(USE_SHARED_MBEDTLS_LIBRARY "Build mbed TLS shared library." OFF)
|
|
option(LINK_WITH_PTHREAD "Explicitly link mbed TLS library to pthread." OFF)
|
|
option(LINK_WITH_TRUSTED_STORAGE "Explicitly link mbed TLS library to trusted_storage." OFF)
|
|
|
|
# Set the project root directory if it's not already defined, as may happen if
|
|
# the library folder is included directly by a parent project, without
|
|
# including the top level CMakeLists.txt.
|
|
if(NOT DEFINED MBEDTLS_DIR)
|
|
set(MBEDTLS_DIR ${CMAKE_SOURCE_DIR})
|
|
endif()
|
|
|
|
set(src_crypto
|
|
aes.c
|
|
aesni.c
|
|
arc4.c
|
|
aria.c
|
|
asn1parse.c
|
|
asn1write.c
|
|
base64.c
|
|
bignum.c
|
|
blowfish.c
|
|
camellia.c
|
|
ccm.c
|
|
chacha20.c
|
|
chachapoly.c
|
|
cipher.c
|
|
cipher_wrap.c
|
|
cmac.c
|
|
ctr_drbg.c
|
|
des.c
|
|
dhm.c
|
|
ecdh.c
|
|
ecdsa.c
|
|
ecjpake.c
|
|
ecp.c
|
|
ecp_curves.c
|
|
entropy.c
|
|
entropy_poll.c
|
|
error.c
|
|
gcm.c
|
|
havege.c
|
|
hkdf.c
|
|
hmac_drbg.c
|
|
md.c
|
|
md2.c
|
|
md4.c
|
|
md5.c
|
|
memory_buffer_alloc.c
|
|
nist_kw.c
|
|
oid.c
|
|
padlock.c
|
|
pem.c
|
|
pk.c
|
|
pk_wrap.c
|
|
pkcs12.c
|
|
pkcs5.c
|
|
pkparse.c
|
|
pkwrite.c
|
|
platform.c
|
|
platform_util.c
|
|
poly1305.c
|
|
psa_crypto.c
|
|
psa_crypto_se.c
|
|
psa_crypto_slot_management.c
|
|
psa_crypto_storage.c
|
|
psa_its_file.c
|
|
ripemd160.c
|
|
rsa.c
|
|
rsa_internal.c
|
|
sha1.c
|
|
sha256.c
|
|
sha512.c
|
|
threading.c
|
|
timing.c
|
|
version.c
|
|
version_features.c
|
|
xtea.c
|
|
)
|
|
|
|
list(APPEND src_crypto ${thirdparty_src})
|
|
|
|
set(src_x509
|
|
certs.c
|
|
pkcs11.c
|
|
x509.c
|
|
x509_create.c
|
|
x509_crl.c
|
|
x509_crt.c
|
|
x509_csr.c
|
|
x509write_crt.c
|
|
x509write_csr.c
|
|
)
|
|
|
|
set(src_tls
|
|
debug.c
|
|
net_sockets.c
|
|
ssl_cache.c
|
|
ssl_ciphersuites.c
|
|
ssl_cli.c
|
|
ssl_cookie.c
|
|
ssl_msg.c
|
|
ssl_srv.c
|
|
ssl_ticket.c
|
|
ssl_tls.c
|
|
)
|
|
|
|
if(CMAKE_COMPILER_IS_GNUCC)
|
|
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wmissing-declarations -Wmissing-prototypes")
|
|
endif(CMAKE_COMPILER_IS_GNUCC)
|
|
|
|
if(CMAKE_COMPILER_IS_CLANG)
|
|
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wmissing-declarations -Wmissing-prototypes -Wdocumentation -Wno-documentation-deprecated-sync -Wunreachable-code")
|
|
endif(CMAKE_COMPILER_IS_CLANG)
|
|
|
|
if(UNSAFE_BUILD)
|
|
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wno-error")
|
|
set(CMAKE_C_FLAGS_ASAN "${CMAKE_C_FLAGS_ASAN} -Wno-error")
|
|
set(CMAKE_C_FLAGS_ASANDBG "${CMAKE_C_FLAGS_ASANDBG} -Wno-error")
|
|
endif(UNSAFE_BUILD)
|
|
|
|
if(WIN32)
|
|
set(libs ${libs} ws2_32)
|
|
endif(WIN32)
|
|
|
|
if(${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
|
|
SET(CMAKE_C_ARCHIVE_CREATE "<CMAKE_AR> Scr <TARGET> <LINK_FLAGS> <OBJECTS>")
|
|
SET(CMAKE_CXX_ARCHIVE_CREATE "<CMAKE_AR> Scr <TARGET> <LINK_FLAGS> <OBJECTS>")
|
|
SET(CMAKE_C_ARCHIVE_FINISH "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
|
|
SET(CMAKE_CXX_ARCHIVE_FINISH "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
|
|
endif()
|
|
|
|
if(HAIKU)
|
|
set(libs ${libs} network)
|
|
endif(HAIKU)
|
|
|
|
if(USE_PKCS11_HELPER_LIBRARY)
|
|
set(libs ${libs} pkcs11-helper)
|
|
endif(USE_PKCS11_HELPER_LIBRARY)
|
|
|
|
if(ENABLE_ZLIB_SUPPORT)
|
|
set(libs ${libs} ${ZLIB_LIBRARIES})
|
|
endif(ENABLE_ZLIB_SUPPORT)
|
|
|
|
if(LINK_WITH_PTHREAD)
|
|
set(libs ${libs} pthread)
|
|
endif()
|
|
|
|
if(LINK_WITH_TRUSTED_STORAGE)
|
|
set(libs ${libs} trusted_storage)
|
|
endif()
|
|
|
|
if (NOT USE_STATIC_MBEDTLS_LIBRARY AND NOT USE_SHARED_MBEDTLS_LIBRARY)
|
|
message(FATAL_ERROR "Need to choose static or shared mbedtls build!")
|
|
endif(NOT USE_STATIC_MBEDTLS_LIBRARY AND NOT USE_SHARED_MBEDTLS_LIBRARY)
|
|
|
|
if(USE_STATIC_MBEDTLS_LIBRARY AND USE_SHARED_MBEDTLS_LIBRARY)
|
|
set(mbedtls_static_target "mbedtls_static")
|
|
set(mbedx509_static_target "mbedx509_static")
|
|
set(mbedcrypto_static_target "mbedcrypto_static")
|
|
elseif(USE_STATIC_MBEDTLS_LIBRARY)
|
|
set(mbedtls_static_target "mbedtls")
|
|
set(mbedx509_static_target "mbedx509")
|
|
set(mbedcrypto_static_target "mbedcrypto")
|
|
endif()
|
|
|
|
if(USE_STATIC_MBEDTLS_LIBRARY)
|
|
add_library(${mbedcrypto_static_target} STATIC ${src_crypto})
|
|
set_target_properties(${mbedcrypto_static_target} PROPERTIES OUTPUT_NAME mbedcrypto)
|
|
target_link_libraries(${mbedcrypto_static_target} ${libs})
|
|
target_include_directories(${mbedcrypto_static_target}
|
|
PUBLIC ${MBEDTLS_DIR}/include/
|
|
PUBLIC ${MBEDTLS_DIR}/crypto/include/)
|
|
|
|
if(USE_CRYPTO_SUBMODULE)
|
|
install(TARGETS ${mbedcrypto_static_target}
|
|
DESTINATION ${LIB_INSTALL_DIR}
|
|
PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
|
|
else()
|
|
add_library(${mbedx509_static_target} STATIC ${src_x509})
|
|
set_target_properties(${mbedx509_static_target} PROPERTIES OUTPUT_NAME mbedx509)
|
|
target_link_libraries(${mbedx509_static_target} ${libs} ${mbedcrypto_static_target})
|
|
|
|
add_library(${mbedtls_static_target} STATIC ${src_tls})
|
|
set_target_properties(${mbedtls_static_target} PROPERTIES OUTPUT_NAME mbedtls)
|
|
target_link_libraries(${mbedtls_static_target} ${libs} ${mbedx509_static_target})
|
|
|
|
install(TARGETS ${mbedtls_static_target} ${mbedx509_static_target} ${mbedcrypto_static_target}
|
|
DESTINATION ${LIB_INSTALL_DIR}
|
|
PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
|
|
endif()
|
|
endif(USE_STATIC_MBEDTLS_LIBRARY)
|
|
|
|
if(USE_SHARED_MBEDTLS_LIBRARY)
|
|
|
|
add_library(mbedcrypto SHARED ${src_crypto})
|
|
set_target_properties(mbedcrypto PROPERTIES VERSION 2.21.0 SOVERSION 4)
|
|
target_link_libraries(mbedcrypto ${libs})
|
|
target_include_directories(mbedcrypto
|
|
PUBLIC ${MBEDTLS_DIR}/include/
|
|
PUBLIC ${MBEDTLS_DIR}/crypto/include/)
|
|
|
|
add_library(mbedx509 SHARED ${src_x509})
|
|
set_target_properties(mbedx509 PROPERTIES VERSION 2.21.0 SOVERSION 1)
|
|
target_link_libraries(mbedx509 ${libs} mbedcrypto)
|
|
target_include_directories(mbedx509
|
|
PUBLIC ${MBEDTLS_DIR}/include/
|
|
PUBLIC ${MBEDTLS_DIR}/crypto/include/)
|
|
|
|
add_library(mbedtls SHARED ${src_tls})
|
|
set_target_properties(mbedtls PROPERTIES VERSION 2.21.0 SOVERSION 13)
|
|
target_link_libraries(mbedtls ${libs} mbedx509)
|
|
target_include_directories(mbedtls
|
|
PUBLIC ${MBEDTLS_DIR}/include/
|
|
PUBLIC ${MBEDTLS_DIR}/crypto/include/)
|
|
|
|
if(USE_CRYPTO_SUBMODULE)
|
|
install(TARGETS mbedcrypto
|
|
DESTINATION ${LIB_INSTALL_DIR}
|
|
PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
|
|
else()
|
|
add_library(mbedx509 SHARED ${src_x509})
|
|
set_target_properties(mbedx509 PROPERTIES VERSION 2.16.0 SOVERSION 0)
|
|
target_link_libraries(mbedx509 ${libs} mbedcrypto)
|
|
|
|
add_library(mbedtls SHARED ${src_tls})
|
|
set_target_properties(mbedtls PROPERTIES VERSION 2.16.0 SOVERSION 12)
|
|
target_link_libraries(mbedtls ${libs} mbedx509)
|
|
|
|
install(TARGETS mbedtls mbedx509 mbedcrypto
|
|
DESTINATION ${LIB_INSTALL_DIR}
|
|
PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
|
|
endif()
|
|
endif(USE_SHARED_MBEDTLS_LIBRARY)
|
|
|
|
if(USE_CRYPTO_SUBMODULE)
|
|
add_custom_target(crypto_lib DEPENDS mbedcrypto)
|
|
if(USE_STATIC_MBEDTLS_LIBRARY AND USE_SHARED_MBEDTLS_LIBRARY)
|
|
add_dependencies(crypto_lib mbedcrypto_static)
|
|
endif()
|
|
else()
|
|
add_custom_target(lib DEPENDS mbedcrypto mbedx509 mbedtls)
|
|
if(USE_STATIC_MBEDTLS_LIBRARY AND USE_SHARED_MBEDTLS_LIBRARY)
|
|
add_dependencies(lib mbedcrypto_static mbedx509_static mbedtls_static)
|
|
endif()
|
|
endif()
|