Attention is currently required from: plaisthos.
Hello plaisthos,
I'd like you to do a code review.
Please visit
http://gerrit.openvpn.net/c/openvpn/+/1849?usp=email
to review the following change.
Change subject: mbedtls: Work-around bug in mbedtls 4.1.0 and 4.2.0
......................................................................
mbedtls: Work-around bug in mbedtls 4.1.0 and 4.2.0
Since the first distros have started to pick up these
versions before a fix is released, let's make our tests
pass on these versions.
A fix is merged, so it might be fixed in 4.3.0. But I
didn't want to add that to the version check until we
have verified that.
Change-Id: I694410615958afbb422d9ead71f04c1a60edc640
Signed-off-by: Frank Lichtenheld <[email protected]>
---
M .github/workflows/build.yaml
M src/openvpn/mbedtls_compat.h
2 files changed, 13 insertions(+), 1 deletion(-)
git pull ssh://gerrit.openvpn.net:29418/openvpn refs/changes/49/1849/1
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 29e8be2a..56dd3ed 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -365,7 +365,7 @@
ovpnlibdesc: mbed TLS 4.
# versioning=semver-coerced
ghrepo: Mbed-TLS/mbedtls
- gitref: v4.0.0
+ gitref: v4.2.0
libconfigure: cmake -B build -DCMAKE_INSTALL_PREFIX=$LIBPREFIX
libmake: cmake --build build
libinstall: sudo cmake --install build
diff --git a/src/openvpn/mbedtls_compat.h b/src/openvpn/mbedtls_compat.h
index 50739b6..7149487 100644
--- a/src/openvpn/mbedtls_compat.h
+++ b/src/openvpn/mbedtls_compat.h
@@ -43,6 +43,7 @@
#include "crypto_mbedtls_legacy.h"
#else
#include <mbedtls/oid.h>
+#include "crypto_mbedtls.h"
#endif /* MBEDTLS_VERSION_NUMBER < 0x04000000 */
#ifdef HAVE_PSA_CRYPTO_H
@@ -228,6 +229,17 @@
mbedtls_compat_pk_check_pair(const mbedtls_pk_context *pub, const
mbedtls_pk_context *prv)
{
#if MBEDTLS_VERSION_NUMBER >= 0x04000000
+ /* work around bug in mbedtls 4.1.0 by adding missing public key
information in prv
+ * cf. https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/807 */
+#if MBEDTLS_VERSION_NUMBER >= 0x04010000
+ if (prv->MBEDTLS_PRIVATE(pub_raw_len) == 0)
+ {
+ ASSERT(mbed_ok(psa_export_public_key(prv->MBEDTLS_PRIVATE(priv_id),
+ (uint8_t
*)prv->MBEDTLS_PRIVATE(pub_raw),
+
sizeof(prv->MBEDTLS_PRIVATE(pub_raw)),
+ (size_t
*)&prv->MBEDTLS_PRIVATE(pub_raw_len))));
+ }
+#endif
return mbedtls_pk_check_pair(pub, prv);
#else
return mbedtls_pk_check_pair(pub, prv, mbedtls_ctr_drbg_random,
rand_ctx_get());
--
To view, visit http://gerrit.openvpn.net/c/openvpn/+/1849?usp=email
To unsubscribe, or for help writing mail filters, visit
http://gerrit.openvpn.net/settings?usp=email
Gerrit-MessageType: newchange
Gerrit-Project: openvpn
Gerrit-Branch: master
Gerrit-Change-Id: I694410615958afbb422d9ead71f04c1a60edc640
Gerrit-Change-Number: 1849
Gerrit-PatchSet: 1
Gerrit-Owner: flichtenheld <[email protected]>
Gerrit-Reviewer: plaisthos <[email protected]>
Gerrit-CC: openvpn-devel <[email protected]>
Gerrit-Attention: plaisthos <[email protected]>
_______________________________________________
Openvpn-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-devel
