lief-project/LIEF
1
0
Fork 0
mirror of https://github.com/lief-project/LIEF.git synced 2026-10-11 22:09:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Upgrade MbedTLS to 4.2.0

Browse Source 
Resolve #1381
This commit is contained in:
lief-integration-bot
2026-10-03 06:41:49 +02:00
parent 41132a12aa
commit a1952d4ca4
11 changed files with 68 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CMakeLists.txt
+1 -1
View File
@@ -144,7 +144,7 @@ if(NOT LIEF_OPT_MBEDTLS_EXTERNAL)
-DTF_PSA_CRYPTO_USER_CONFIG_FILE="${CMAKE_CURRENT_SOURCE_DIR}/config/mbedtls/psa_config.h"
)
else()
find_package(MbedTLS 4.0.0 EXACT REQUIRED)
find_package(MbedTLS 4.2.0 EXACT REQUIRED)
target_link_libraries(LIB_LIEF PRIVATE
MbedTLS::tfpsacrypto MbedTLS::mbedx509)
if (LIEF_PYTHON_FREE_THREADED)
cmake/LIEFConfig.cmake.in
+1 -1
View File
@@ -82,7 +82,7 @@ macro(LIEF_load_targets lib_type)
include(CMakeFindDependencyMacro)
if(@LIEF_EXTERNAL_MBEDTLS@)
find_dependency(MbedTLS 4.0.0 EXACT)
find_dependency(MbedTLS 4.2.0 EXACT)
endif()
if(@LIEF_EXTERNAL_UTF8CPP@)
cmake/LIEFDependencies.cmake
+40 -32
View File
@@ -28,8 +28,8 @@ endif()
# mbed TLS
# --------
if(NOT LIEF_OPT_MBEDTLS_EXTERNAL)
set(MBEDTLS_VERSION 4.0.0.r0.gec4044008d)
set(MBEDTLS_SHA256 SHA256=01aec4471547dec5308853ff0d797611a68a521a10496898b626035dfdc07183)
set(MBEDTLS_VERSION 4.2.0.r0.gece41aa84d)
set(MBEDTLS_SHA256 SHA256=d5583a10fb18ee3d5e71be68ccfedd00517ba3c96cbed61ca199d42c86eb5611)
set(MBEDTLS_URL "${THIRD_PARTY_DIRECTORY}/mbedtls-${MBEDTLS_VERSION}.zip" CACHE STRING "URL to MbedTLS")
FetchContent_Declare(lief_mbedtls
URL ${MBEDTLS_URL}
@@ -47,9 +47,18 @@ if(NOT LIEF_OPT_MBEDTLS_EXTERNAL)
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/include"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/include"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/dispatch"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/platform"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/utilities"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/include"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/include/tf-psa-crypto/private/everest"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/include/tf-psa-crypto/private/everest/kremlib"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/p256-m"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/pqcp/include"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/pqcp/src"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/pqcp/mldsa-native/mldsa"
)
set(mbedtls_src_files
@@ -86,9 +95,11 @@ if(NOT LIEF_OPT_MBEDTLS_EXTERNAL)
"${MBEDTLS_SOURCE_DIR}/library/x509write_csr.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/psa_crypto.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/psa_crypto_client.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/psa_crypto_random.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/psa_crypto_slot_management.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/psa_crypto_storage.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/psa_its_file.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/psa_util.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/tf_psa_crypto_config.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/tf_psa_crypto_version.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/core/psa_crypto_driver_wrappers_no_static.c"
@@ -96,9 +107,6 @@ if(NOT LIEF_OPT_MBEDTLS_EXTERNAL)
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/aesce.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/aesni.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/aria.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/asn1parse.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/asn1write.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/base64.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/bignum.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/bignum_core.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/bignum_mod.c"
@@ -107,39 +115,21 @@ if(NOT LIEF_OPT_MBEDTLS_EXTERNAL)
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/camellia.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ccm.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/chacha20.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/chacha20_neon.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/chachapoly.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/cipher.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/cipher_wrap.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/cmac.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/constant_time.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ctr_drbg.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ecdh.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ecdsa.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ecjpake.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ecp.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ecp_curves.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ecp_curves_new.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/entropy.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/entropy_poll.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/gcm.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/hmac_drbg.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/lmots.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/lms.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/md.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/md5.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/memory_buffer_alloc.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/nist_kw.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/oid.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/pem.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/pk.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/pk_ecc.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/pk_rsa.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/pk_wrap.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/pkcs5.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/pkparse.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/pkwrite.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/platform.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/platform_util.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/poly1305.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/psa_crypto_aead.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/psa_crypto_cipher.c"
@@ -149,7 +139,8 @@ if(NOT LIEF_OPT_MBEDTLS_EXTERNAL)
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/psa_crypto_mac.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/psa_crypto_pake.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/psa_crypto_rsa.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/psa_util.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/psa_crypto_xof.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/psa_util_internal.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/ripemd160.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/rsa.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/rsa_alt_helpers.c"
@@ -157,16 +148,33 @@ if(NOT LIEF_OPT_MBEDTLS_EXTERNAL)
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/sha256.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/sha3.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/sha512.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src/threading.c"
#"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/library/Hacl_Curve25519.c"
#"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/library/Hacl_Curve25519_joined.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/library/everest.c"
#"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/library/legacy/Hacl_Curve25519.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/library/Hacl_Curve25519_joined.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/everest/library/x25519.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/p256-m/p256-m/p256-m.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/p256-m/p256-m_driver_entrypoints.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/pqcp/src/psa_crypto_mldsa.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/drivers/pqcp/src/wrap_mldsa_native.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/lmots.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/lms.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/md.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/nist_kw.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/pk.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/pk_ecc.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/pk_rsa.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/pk_wrap.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/pkparse.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/extras/pkwrite.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/platform/memory_buffer_alloc.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/platform/platform.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/platform/platform_util.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/platform/threading.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/utilities/asn1parse.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/utilities/asn1write.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/utilities/base64.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/utilities/constant_time.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/utilities/oid.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/utilities/pem.c"
"${MBEDTLS_SOURCE_DIR}/tf-psa-crypto/utilities/pkcs5.c"
)
endif()
doc/sphinx/changelog.md
+1
View File
@@ -98,6 +98,7 @@
* Update nanobind to version ``3.0.1``
* Update frozen to commit ``1a6065f``
* Update mbedtls to version ``4.2.0``
:Python:
src/PE/signature/RsaInfo.cpp
-2
View File
@@ -38,7 +38,6 @@ RsaInfo::RsaInfo(const RsaInfo::rsa_ctx_handle ctx) {
// NOLINTNEXTLINE(clang-taidy-avoid-unfixed-enum-cast)
mbedtls_md_type_t(pctx->private_hash_id));
mbedtls_rsa_copy(local_ctx, pctx);
mbedtls_rsa_complete(local_ctx);
ctx_ = reinterpret_cast<RsaInfo::rsa_ctx_handle>(local_ctx);
}
@@ -51,7 +50,6 @@ RsaInfo::RsaInfo(const RsaInfo& other) {
// NOLINTNEXTLINE(clang-taidy-avoid-unfixed-enum-cast)
mbedtls_md_type_t(octx->private_hash_id));
mbedtls_rsa_copy(local_ctx, octx);
mbedtls_rsa_complete(local_ctx);
ctx_ = reinterpret_cast<RsaInfo::rsa_ctx_handle>(local_ctx);
}
}
src/PE/signature/Signature.cpp
+4 -1
View File
@@ -28,7 +28,10 @@
#include "LIEF/PE/signature/SpcIndirectData.hpp"
#include "LIEF/PE/signature/attributes.hpp"
#include <psa/crypto_builtin_primitives.h>
#include <mbedtls/private/md5.h>
#include <mbedtls/private/sha1.h>
#include <mbedtls/private/sha256.h>
#include <mbedtls/private/sha512.h>
#include "frozen.hpp"
#include "internal_utils.hpp"
src/PE/utils.cpp
+1 -1
View File
@@ -21,7 +21,7 @@
#endif
#include "logging.hpp"
#include "psa/crypto_builtin_primitives.h"
#include "mbedtls/private/md5.h"
#include "LIEF/BinaryStream/FileStream.hpp"
#include "LIEF/BinaryStream/SpanStream.hpp"
src/mbedtls_wraps.h
+5 -28
View File
@@ -51,22 +51,17 @@ extern "C" {
#include <mbedtls/pk.h>
#include <mbedtls/oid.h>
#if defined(MBEDTLS_THREADING_C)
#include "mbedtls/threading.h"
#endif
static_assert(MBEDTLS_VERSION_NUMBER == 0x04000000, "Expecting mbedtls 4.0.0");
static_assert(MBEDTLS_VERSION_NUMBER == 0x04020000, "Expecting mbedtls 4.2.0");
// From: tf-psa-crypto/include/mbedtls/private/pk_private.h
// <pk_private.h>
typedef enum {
MBEDTLS_PK_NONE=0,
MBEDTLS_PK_RSA,
MBEDTLS_PK_NONE = MBEDTLS_PK_SIGALG_NONE,
MBEDTLS_PK_RSA = MBEDTLS_PK_SIGALG_RSA_PKCS1V15,
MBEDTLS_PK_RSASSA_PSS = MBEDTLS_PK_SIGALG_RSA_PSS,
MBEDTLS_PK_ECDSA = MBEDTLS_PK_SIGALG_ECDSA,
MBEDTLS_PK_ECKEY,
MBEDTLS_PK_ECKEY_DH,
MBEDTLS_PK_ECDSA,
MBEDTLS_PK_RSA_ALT,
MBEDTLS_PK_RSASSA_PSS,
MBEDTLS_PK_OPAQUE,
} mbedtls_pk_type_t;
@@ -76,10 +71,6 @@ mbedtls_pk_type_t mbedtls_pk_get_type(const mbedtls_pk_context *ctx);
// From: tf-psa-crypto/drivers/builtin/include/mbedtls/private/rsa.h
// <rsa.h>
typedef struct mbedtls_rsa_context {
int MBEDTLS_PRIVATE(ver); /*!< Reserved for internal purposes.
* Do not set this field in application
* code. Its meaning might change without
* notice. */
size_t MBEDTLS_PRIVATE(len); /*!< The size of \p N in Bytes. */
mbedtls_mpi MBEDTLS_PRIVATE(N); /*!< The public modulus. */
@@ -108,22 +99,8 @@ typedef struct mbedtls_rsa_context {
as specified in md.h for use in the MGF
mask generating function used in the
EME-OAEP and EMSA-PSS encodings. */
#if defined(MBEDTLS_THREADING_C)
/* Invariant: the mutex is initialized iff ver != 0. */
mbedtls_threading_mutex_t MBEDTLS_PRIVATE(mutex); /*!< Thread-safety mutex. */
#endif
} mbedtls_rsa_context;
static inline mbedtls_rsa_context *mbedtls_pk_rsa(const mbedtls_pk_context pk)
{
switch (mbedtls_pk_get_type(&pk)) {
case MBEDTLS_PK_RSA:
return (mbedtls_rsa_context *) (pk).MBEDTLS_PRIVATE(pk_ctx);
default:
return NULL;
}
}
int mbedtls_rsa_parse_pubkey(mbedtls_rsa_context *rsa, const unsigned char *key, size_t keylen);
void mbedtls_rsa_init(mbedtls_rsa_context *ctx);
void mbedtls_rsa_free(mbedtls_rsa_context *ctx);
src/visitors/hash.cpp
+5 -2
View File
@@ -16,8 +16,11 @@
#include <functional>
#include <numeric>
#include "mbedtls_wraps.h"
#include "psa/crypto_builtin_primitives.h"
#ifndef MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
#define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
#endif
#include "mbedtls/private/sha256.h"
#include "LIEF/hash.hpp"
tests/pe/test_authenticode.py
+10
View File
@@ -427,6 +427,16 @@ def test_rsa_info():
assert Q == 0
@pytest.mark.parametrize("name", ["Amazon Root CA 3", "Amazon Root CA 4"])
def test_ec_certificate(name):
certs = lief.PE.x509.parse(get_sample("pkcs7/windows-ca-bundle.pem"))
cert = next(c for c in certs if c.subject == f"C=US, O=Amazon, CN={name}")
assert cert.key_type == lief.PE.x509.KEY_TYPES.ECKEY
assert cert.rsa_info is None
assert cert.verify(cert) == lief.PE.x509.VERIFICATION_FLAGS.OK
def test_issue_703():
sig = lief.PE.Signature.parse(get_sample("pkcs7/cert_issue_703.der"))
assert sig is not None
third-party/mbedtls-4.0.0.r0.gec4044008d.zip → third-party/mbedtls-4.2.0.r0.gece41aa84d.zip
Vendored
BIN
View File
Binary file not shown.