From: Frank Lichtenheld <[email protected]> Since the first distros have started to pick up these versions before a fix is released, let's make our tests pass on these versions.
A fix is merged, so it might be fixed in 4.3.0. But I didn't want to add that to the version check until we have verified that. Change-Id: I694410615958afbb422d9ead71f04c1a60edc640 Signed-off-by: Frank Lichtenheld <[email protected]> Acked-by: Razvan Cojocaru <[email protected]> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1849 --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1849 This mail reflects revision 2 of this Change. Acked-by according to Gerrit (reflected above): Razvan Cojocaru <[email protected]> diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 29e8be2a..56dd3ed 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -365,7 +365,7 @@ ovpnlibdesc: mbed TLS 4. # versioning=semver-coerced ghrepo: Mbed-TLS/mbedtls - gitref: v4.0.0 + gitref: v4.2.0 libconfigure: cmake -B build -DCMAKE_INSTALL_PREFIX=$LIBPREFIX libmake: cmake --build build libinstall: sudo cmake --install build diff --git a/src/openvpn/mbedtls_compat.h b/src/openvpn/mbedtls_compat.h index 50739b6..ec45a0f 100644 --- a/src/openvpn/mbedtls_compat.h +++ b/src/openvpn/mbedtls_compat.h @@ -43,6 +43,7 @@ #include "crypto_mbedtls_legacy.h" #else #include <mbedtls/oid.h> +#include "crypto_mbedtls.h" #endif /* MBEDTLS_VERSION_NUMBER < 0x04000000 */ #ifdef HAVE_PSA_CRYPTO_H @@ -228,6 +229,18 @@ mbedtls_compat_pk_check_pair(const mbedtls_pk_context *pub, const mbedtls_pk_context *prv) { #if MBEDTLS_VERSION_NUMBER >= 0x04000000 + /* work around bug in mbedtls 4.1.0 by adding missing public key information in prv + * cf. https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/807 */ +#if MBEDTLS_VERSION_NUMBER >= 0x04010000 + if (prv->MBEDTLS_PRIVATE(pub_raw_len) == 0) + { + mbedtls_pk_context *mut_prv = (mbedtls_pk_context *)prv; /* remove const */ + ASSERT(mbed_ok(psa_export_public_key(mut_prv->MBEDTLS_PRIVATE(priv_id), + mut_prv->MBEDTLS_PRIVATE(pub_raw), + sizeof(mut_prv->MBEDTLS_PRIVATE(pub_raw)), + &mut_prv->MBEDTLS_PRIVATE(pub_raw_len)))); + } +#endif return mbedtls_pk_check_pair(pub, prv); #else return mbedtls_pk_check_pair(pub, prv, mbedtls_ctr_drbg_random, rand_ctx_get()); _______________________________________________ Openvpn-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-devel
