From 152a5f241083de8c1e6a1c3232a7a3c74dc251fc Mon Sep 17 00:00:00 2001 From: Dan Halbert Date: Wed, 29 Jul 2026 16:05:43 -0400 Subject: [PATCH 1/4] Update lib/mbedtls from 2.28.3 to 4.2.0 Fixes TLS verification against servers addressed by IP: 2.28.3's x509_crt_check_san() matches only dNSName, so iPAddress fell through to "unrecognized type" and any such connection failed with MBEDTLS_ERR_X509_CERT_VERIFY_FAILED on raspberrypi. mbedtls 4.x moves crypto into the nested tf-psa-crypto submodule and splits the configuration in two: MBEDTLS_CONFIG_FILE now covers only TLS and X.509, while algorithms are requested with PSA_WANT_* from TF_PSA_CRYPTO_CONFIG_FILE. The legacy mbedtls_sha256_*() headers also became private. - tools/ci_fetch_deps.py initializes tf-psa-crypto and framework by name rather than with --recursive, which would also pull mldsa-native. - ports/raspberrypi/Makefile generates the PSA driver wrappers with tf-psa-crypto's jinja templates, adding jsonschema to requirements-dev.txt, and globs the source directories instead of listing files. - Randomness comes from the port TRNG via MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG, since 4.x dropped MBEDTLS_ENTROPY_HARDWARE_ALT. This also keeps entropy.c and ctr_drbg.c out of the build. - hashlib uses the public mbedtls_md_*() interface. hashlib.Hash gains a finaliser because mbedtls_md_setup() allocates its digest context. - Protocol versions and crypto are kept in line with espressif, which is already on 4.0.0: TLS 1.2 only, no P-521. ChaCha20-Poly1305 is enabled here and not there, because RP2 has no AES accelerator. - Removes the MBEDTLS_VERSION_MAJOR == 3 branches, which no port ever built. Co-Authored-By: Claude Opus 5 (1M context) --- .gitmodules | 2 +- lib/mbedtls | 2 +- lib/mbedtls_config/crt_bundle.c | 21 - lib/mbedtls_config/hashlib_psa_port.c | 32 + lib/mbedtls_config/mbedtls_config.h | 212 +++--- lib/mbedtls_config/mbedtls_port.c | 64 +- lib/mbedtls_config/tf_psa_crypto_config.h | 133 ++++ .../tf_psa_crypto_config_hashlib.h | 48 ++ lib/mbedtls_errors/do-mp.sh | 13 +- lib/mbedtls_errors/error.fmt | 7 +- lib/mbedtls_errors/generate_errors.diff | 16 +- lib/mbedtls_errors/mp_mbedtls_errors.c | 603 +++--------------- locale/circuitpython.pot | 2 +- ports/raspberrypi/Makefile | 150 ++--- ports/raspberrypi/supervisor/port.c | 4 + py/circuitpy_defns.mk | 59 +- py/circuitpy_mpconfig.h | 4 +- requirements-dev.txt | 3 + shared-module/hashlib/Hash.c | 62 -- shared-module/hashlib/Hash.h | 21 - shared-module/hashlib/__init__.c | 44 +- shared-module/hashlib/__init__.h | 13 - shared-module/ssl/SSLContext.c | 8 + shared-module/ssl/SSLSocket.c | 51 +- shared-module/ssl/SSLSocket.h | 9 - tools/ci_fetch_deps.py | 16 + 26 files changed, 612 insertions(+), 987 deletions(-) create mode 100644 lib/mbedtls_config/hashlib_psa_port.c create mode 100644 lib/mbedtls_config/tf_psa_crypto_config.h create mode 100644 lib/mbedtls_config/tf_psa_crypto_config_hashlib.h diff --git a/.gitmodules b/.gitmodules index a7b67b8d860..f241a4c7eae 100644 --- a/.gitmodules +++ b/.gitmodules @@ -316,7 +316,7 @@ branch = circuitpython9 [submodule "lib/mbedtls"] path = lib/mbedtls - url = https://github.com/ARMmbed/mbedtls.git + url = https://github.com/Mbed-TLS/mbedtls.git [submodule "frozen/Adafruit_CircuitPython_UC8151D"] path = frozen/Adafruit_CircuitPython_UC8151D url = https://github.com/adafruit/Adafruit_CircuitPython_UC8151D diff --git a/lib/mbedtls b/lib/mbedtls index 981743de6fc..ece41aa84d7 160000 --- a/lib/mbedtls +++ b/lib/mbedtls @@ -1 +1 @@ -Subproject commit 981743de6fcdbe672e482b6fd724d31d0a0d2476 +Subproject commit ece41aa84d7879d7e55c59e955a5884b541f7f3b diff --git a/lib/mbedtls_config/crt_bundle.c b/lib/mbedtls_config/crt_bundle.c index 4a8836fb586..01bb497f655 100644 --- a/lib/mbedtls_config/crt_bundle.c +++ b/lib/mbedtls_config/crt_bundle.c @@ -56,10 +56,6 @@ static crt_bundle_t s_crt_bundle; static int crt_check_signature(mbedtls_x509_crt *child, const uint8_t *pub_key_buf, size_t pub_key_len); -#if MBEDTLS_VERSION_MAJOR < 3 -#define MBEDTLS_PRIVATE(x) x -#endif - static int crt_check_signature(mbedtls_x509_crt *child, const uint8_t *pub_key_buf, size_t pub_key_len) { int ret = 0; mbedtls_x509_crt parent; @@ -74,33 +70,16 @@ static int crt_check_signature(mbedtls_x509_crt *child, const uint8_t *pub_key_b } - #if MBEDTLS_VERSION_MAJOR < 4 - // Fast check to avoid expensive computations when not necessary - if (!mbedtls_pk_can_do(&parent.pk, child->MBEDTLS_PRIVATE(sig_pk))) { - LOGE(TAG, "Simple compare failed"); - ret = -1; - goto cleanup; - } - #endif - md_info = mbedtls_md_info_from_type(child->MBEDTLS_PRIVATE(sig_md)); if ((ret = mbedtls_md(md_info, child->tbs.p, child->tbs.len, hash)) != 0) { LOGE(TAG, "Internal mbedTLS error %X", ret); goto cleanup; } - #if MBEDTLS_VERSION_MAJOR >= 4 if ((ret = mbedtls_pk_verify_ext( child->MBEDTLS_PRIVATE(sig_pk), &parent.pk, child->MBEDTLS_PRIVATE(sig_md), hash, mbedtls_md_get_size(md_info), child->MBEDTLS_PRIVATE(sig).p, child->MBEDTLS_PRIVATE(sig).len)) != 0) { - #else - if ((ret = mbedtls_pk_verify_ext( - child->MBEDTLS_PRIVATE(sig_pk), child->MBEDTLS_PRIVATE(sig_opts), &parent.pk, - child->MBEDTLS_PRIVATE(sig_md), hash, mbedtls_md_get_size(md_info), - child->MBEDTLS_PRIVATE(sig).p, child->MBEDTLS_PRIVATE(sig).len)) != 0) { - #endif - LOGE(TAG, "PK verify failed with error %X", ret); goto cleanup; } diff --git a/lib/mbedtls_config/hashlib_psa_port.c b/lib/mbedtls_config/hashlib_psa_port.c new file mode 100644 index 00000000000..88a3b96adba --- /dev/null +++ b/lib/mbedtls_config/hashlib_psa_port.c @@ -0,0 +1,32 @@ +// This file is part of the CircuitPython project: https://circuitpython.org +// +// SPDX-FileCopyrightText: Copyright (c) 2026 Dan Halbert for Adafruit Industries +// +// SPDX-License-Identifier: MIT + +// Platform glue for ports that build the PSA crypto core for hashlib but not for ssl. +// The ssl equivalent is mbedtls_port.c; the two are mutually exclusive, because +// CIRCUITPY_HASHLIB_MBEDTLS_ONLY means hashlib without ssl. + +#include + +#if CIRCUITPY_HASHLIB_MBEDTLS_ONLY + +#include "psa/crypto.h" + +#include "shared-bindings/os/__init__.h" + +// Required by MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. psa_crypto_init() initializes the RNG +// subsystem even in a build that only ever hashes, so this has to exist. +psa_status_t mbedtls_psa_external_get_random( + mbedtls_psa_external_random_context_t *context, + uint8_t *output, size_t output_size, size_t *output_length) { + (void)context; + if (!common_hal_os_urandom(output, output_size)) { + return PSA_ERROR_INSUFFICIENT_ENTROPY; + } + *output_length = output_size; + return PSA_SUCCESS; +} + +#endif diff --git a/lib/mbedtls_config/mbedtls_config.h b/lib/mbedtls_config/mbedtls_config.h index 7943994e157..062ad11ff17 100644 --- a/lib/mbedtls_config/mbedtls_config.h +++ b/lib/mbedtls_config/mbedtls_config.h @@ -1,130 +1,102 @@ -/* - * This file is part of the MicroPython project, http://micropython.org/ - * - * The MIT License (MIT) - * - * Copyright (c) 2018-2019 Damien P. George - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - */ -#ifndef MICROPY_INCLUDED_MBEDTLS_CONFIG_H -#define MICROPY_INCLUDED_MBEDTLS_CONFIG_H - -// If you want to debug MBEDTLS uncomment the following and -// Pass 3 to mbedtls_debug_set_threshold in socket_new +// This file is part of the CircuitPython project: https://circuitpython.org +// +// SPDX-FileCopyrightText: Copyright (c) 2018-2019 Damien P. George +// SPDX-FileCopyrightText: Copyright (c) 2026 Dan Halbert for Adafruit Industries +// +// SPDX-License-Identifier: MIT + +// mbedtls TLS and X.509 configuration, selected with MBEDTLS_CONFIG_FILE. +// +// As of mbedtls 4.0 this file covers only TLS and X.509. Everything cryptographic -- +// algorithms, key types, the platform hooks and the RNG -- is configured in +// tf_psa_crypto_config.h next to this file, and selected with +// TF_PSA_CRYPTO_CONFIG_FILE. + +#pragma once + +// If you want to debug mbedtls, uncomment the following. SSLSocket.c raises the debug +// threshold to 4 when it is set. // #define MBEDTLS_DEBUG_C -// Set mbedtls configuration -#define MBEDTLS_PLATFORM_MEMORY -#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS -#define MBEDTLS_DEPRECATED_REMOVED -#define MBEDTLS_ENTROPY_HARDWARE_ALT -#define MBEDTLS_AES_ROM_TABLES -#define MBEDTLS_CIPHER_MODE_CBC -#define MBEDTLS_ECP_DP_SECP192R1_ENABLED -#define MBEDTLS_ECP_DP_SECP224R1_ENABLED -#define MBEDTLS_ECP_DP_SECP256R1_ENABLED -#define MBEDTLS_ECP_DP_SECP384R1_ENABLED -#define MBEDTLS_ECP_DP_SECP521R1_ENABLED -#define MBEDTLS_ECP_DP_SECP192K1_ENABLED -#define MBEDTLS_ECP_DP_SECP224K1_ENABLED -#define MBEDTLS_ECP_DP_SECP256K1_ENABLED -#define MBEDTLS_ECP_DP_BP256R1_ENABLED -#define MBEDTLS_ECP_DP_BP384R1_ENABLED -#define MBEDTLS_ECP_DP_BP512R1_ENABLED -#define MBEDTLS_ECP_DP_CURVE25519_ENABLED -#define MBEDTLS_ECP_NIST_OPTIM -#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED -#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED -#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED -#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED -#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED -#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED -#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED -#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED -#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED -#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED -#define MBEDTLS_NO_PLATFORM_ENTROPY -#define MBEDTLS_PKCS1_V15 -#define MBEDTLS_SHA256_SMALLER -#define MBEDTLS_SSL_PROTO_TLS1 -#define MBEDTLS_SSL_PROTO_TLS1_1 +// Protocol versions + +// TLS 1.0 and 1.1 were removed in mbedtls 3.0, and were obsolete long before that. +// +// TLS 1.3 is available in 4.x but is turned off, to match espressif +// It also cost 25648 bytes on Pico W, which has only ~50 KB of firmware +// space left. Enabling it here would also require enabling +// MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED, and PSA_WANT_ALG_HKDF* in +// tf_psa_crypto_config.h for the 1.3 key schedule. #define MBEDTLS_SSL_PROTO_TLS1_2 + +// DTLS is deliberately off: common_hal_ssl_sslcontext_wrap_socket() rejects anything +// that is not SOCKETPOOL_SOCK_STREAM, so it could never be reached. + +#define MBEDTLS_SSL_CLI_C +#define MBEDTLS_SSL_SRV_C +#define MBEDTLS_SSL_TLS_C + +// Key exchanges. Without at least one of these there are no TLS 1.2 ciphersuites at +// all, the ClientHello offers nothing, and the server answers with a fatal +// handshake_failure alert. These two are what espressif enables +// (CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_{RSA,ECDSA}) and cover the public web. The PSK +// and ECJPAKE exchanges that 4.x also still offers are not reachable from the ssl +// module, and the static-RSA and DHE exchanges the mbedtls 2.28 config enabled are +// gone from 4.x upstream. +#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED +#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED + +// Extensions + #define MBEDTLS_SSL_SERVER_NAME_INDICATION +#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE +#define MBEDTLS_SSL_ENCRYPT_THEN_MAC +#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET + +// Buffers -// Use a smaller output buffer to reduce size of SSL context +// Accept a full-size record inbound, since we do not control what the peer sends, +// but use a smaller outbound buffer to reduce the SSL context size. #define MBEDTLS_SSL_MAX_CONTENT_LEN (16384) #define MBEDTLS_SSL_IN_CONTENT_LEN (MBEDTLS_SSL_MAX_CONTENT_LEN) #define MBEDTLS_SSL_OUT_CONTENT_LEN (4096) -// Enable mbedtls modules -#define MBEDTLS_AES_C -#define MBEDTLS_ASN1_PARSE_C -#define MBEDTLS_ASN1_WRITE_C -#define MBEDTLS_BASE64_C -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_CIPHER_C -#define MBEDTLS_CTR_DRBG_C -#define MBEDTLS_ECDH_C -#define MBEDTLS_ECDSA_C -#define MBEDTLS_ECP_C -#define MBEDTLS_ENTROPY_C -#define MBEDTLS_ERROR_C -#define MBEDTLS_GCM_C -#define MBEDTLS_MD_C -#define MBEDTLS_MD5_C -#define MBEDTLS_OID_C -#define MBEDTLS_PKCS5_C -#define MBEDTLS_PEM_PARSE_C -#define MBEDTLS_PK_C -#define MBEDTLS_PK_HAVE_ECC_KEYS -#define MBEDTLS_PK_PARSE_C -#define MBEDTLS_PLATFORM_C -#define MBEDTLS_RSA_C -#define MBEDTLS_SHA1_C -#define MBEDTLS_SHA256_C -#define MBEDTLS_SHA512_C -#define MBEDTLS_SSL_CLI_C -#define MBEDTLS_SSL_PROTO_DTLS -#define MBEDTLS_SSL_SRV_C -#define MBEDTLS_SSL_TLS_C -#define MBEDTLS_TLS_DEFAULT_ALLOW_SHA1_IN_KEY_EXCHANGE -#define MBEDTLS_X509_CRT_PARSE_C +// X.509 + #define MBEDTLS_X509_USE_C -#define MBEDTLS_HAVE_TIME -#define MBEDTLS_DHM_C // needed by DHE_PSK -#undef MBEDTLS_HAVE_TIME_DATE - -// Memory allocation hooks -#include -#include -void *m_tracked_calloc(size_t nmemb, size_t size); -void m_tracked_free(void *ptr); -#define MBEDTLS_PLATFORM_STD_CALLOC m_tracked_calloc -#define MBEDTLS_PLATFORM_STD_FREE m_tracked_free -#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf - -// Time hook -#include -time_t rp2_rtctime_seconds(time_t *timer); -#define MBEDTLS_PLATFORM_TIME_MACRO rp2_rtctime_seconds - -#include "mbedtls/check_config.h" - -#endif /* MICROPY_INCLUDED_MBEDTLS_CONFIG_H */ +#define MBEDTLS_X509_CRT_PARSE_C +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT + +// MBEDTLS_HAVE_TIME_DATE is deliberately left off, so certificate notBefore/notAfter +// are not checked (see the BADCERT_EXPIRED/BADCERT_FUTURE tests in x509_crt.c, which +// are compiled out without it). CircuitPython does not know the wall clock time unless +// the program sets it explicitly, which often does not happen; with an unset clock, +// checking the dates would reject valid certificates rather than catch expired ones. +// espressif does not set CONFIG_MBEDTLS_HAVE_TIME_DATE either. +// +// Nothing else we enable consumes time -- no session tickets, no context +// serialization, no DTLS, no TLS 1.3 -- so MBEDTLS_HAVE_TIME is off as well, and +// mbedtls_port.c needs neither a wall clock nor mbedtls_ms_time(). + +// Error strings + +// SSLSocket.c keys off MBEDTLS_ERROR_C to decide whether to put a message on the +// OSError it raises. mbedtls's own error.c is not built; lib/mbedtls_errors supplies +// a smaller mbedtls_strerror() instead. +#define MBEDTLS_ERROR_C + +// Sanity checks +// +// mbedtls's own mbedtls_check_config.h only validates the prerequisites of options +// that are enabled, so it says nothing when a whole category is missing. This is where +// TF_PSA_CRYPTO_CONFIG_FILE replacing psa/crypto_config.h rather than overlaying it +// bites: every default we rely on has to be restated here, and forgetting one produces +// a build that compiles and links but cannot complete a handshake. +#if !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) && \ + !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) && \ + !defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) && \ + !defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) && \ + !defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) +#error "No MBEDTLS_KEY_EXCHANGE_* enabled: ciphersuite_definitions[] would be empty, " \ + "so the ClientHello would offer nothing and every TLS 1.2 handshake would fail." +#endif diff --git a/lib/mbedtls_config/mbedtls_port.c b/lib/mbedtls_config/mbedtls_port.c index b7e8ceae5de..cc29145e803 100644 --- a/lib/mbedtls_config/mbedtls_port.c +++ b/lib/mbedtls_config/mbedtls_port.c @@ -1,53 +1,29 @@ -/* - * This file is part of the MicroPython project, http://micropython.org/ - * - * The MIT License (MIT) - * - * Copyright (c) 2019 Damien P. George - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN - * THE SOFTWARE. - */ -#include +// This file is part of the CircuitPython project: https://circuitpython.org +// +// SPDX-FileCopyrightText: Copyright (c) 2018-2019 Damien P. George +// SPDX-FileCopyrightText: Copyright (c) 2026 Dan Halbert for Adafruit Industries + +#include "py/mpconfig.h" #if CIRCUITPY_SSL_MBEDTLS -#include "py/runtime.h" -#include "mbedtls_config.h" -#include "mbedtls/entropy_poll.h" +#include "psa/crypto.h" -#include "shared/timeutils/timeutils.h" #include "shared-bindings/os/__init__.h" -#include "shared-bindings/time/__init__.h" - -extern uint8_t rosc_random_u8(size_t cycles); - -int mbedtls_hardware_poll(void *data, unsigned char *output, size_t len, size_t *olen) { - *olen = len; - common_hal_os_urandom(data, len); - return 0; -} -time_t rp2_rtctime_seconds(time_t *timer) { - mp_obj_t datetime = mp_load_attr(MP_STATE_VM(rtc_time_source), MP_QSTR_datetime); - timeutils_struct_time_t tm; - struct_time_to_tm(datetime, &tm); - return timeutils_seconds_since_epoch(tm.tm_year, tm.tm_mon, tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec); +// The RNG behind MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. mbedtls asks for randomness through +// this instead of seeding its own entropy accumulator and CTR-DRBG, so the port's TRNG +// is the only source. `context` is unused; mbedtls initializes it to 0 and we keep no +// state of our own. +psa_status_t mbedtls_psa_external_get_random( + mbedtls_psa_external_random_context_t *context, + uint8_t *output, size_t output_size, size_t *output_length) { + (void)context; + if (!common_hal_os_urandom(output, output_size)) { + return PSA_ERROR_INSUFFICIENT_ENTROPY; + } + *output_length = output_size; + return PSA_SUCCESS; } #endif diff --git a/lib/mbedtls_config/tf_psa_crypto_config.h b/lib/mbedtls_config/tf_psa_crypto_config.h new file mode 100644 index 00000000000..72e69ba5f63 --- /dev/null +++ b/lib/mbedtls_config/tf_psa_crypto_config.h @@ -0,0 +1,133 @@ +// This file is part of the CircuitPython project: https://circuitpython.org +// +// SPDX-FileCopyrightText: Copyright (c) 2018-2019 Damien P. George +// SPDX-FileCopyrightText: Copyright (c) 2026 Dan Halbert for Adafruit Industries +// +// SPDX-License-Identifier: MIT + +// TF-PSA-Crypto configuration, selected with TF_PSA_CRYPTO_CONFIG_FILE. +// +// mbedtls 4.0 split its configuration in two: MBEDTLS_CONFIG_FILE now covers only +// TLS and X.509 (see mbedtls_config.h next to this file), and everything +// cryptographic moved here. Algorithms and key types are requested with PSA_WANT_* +// rather than the old MBEDTLS__C module switches; the builtin implementations +// they need are derived from those by tf-psa-crypto's own config_adjust headers. + +#pragma once + +// Platform integration /////////////////////////////////////////////////////// + +#define MBEDTLS_PLATFORM_C +#define MBEDTLS_PLATFORM_MEMORY +#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +#define MBEDTLS_DEPRECATED_REMOVED + +// Memory allocation hooks, so mbedtls allocations are tracked like the rest of the +// VM's. +#include +#include +void *m_tracked_calloc(size_t nmemb, size_t size); +void m_tracked_free(void *ptr); +#define MBEDTLS_PLATFORM_STD_CALLOC m_tracked_calloc +#define MBEDTLS_PLATFORM_STD_FREE m_tracked_free +#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf + +// Randomness ///////////////////////////////////////////////////////////////// + +// Take randomness straight from the port's TRNG rather than seeding mbedtls's own +// entropy accumulator and CTR-DRBG. mbedtls 4.x dropped MBEDTLS_ENTROPY_HARDWARE_ALT, +// which is how this was wired before, and going direct also keeps entropy.c and +// ctr_drbg.c out of the build. mbedtls_psa_external_get_random() is in +// mbedtls_port.c. +#define MBEDTLS_PSA_CRYPTO_C +#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + +// Size/speed tradeoffs /////////////////////////////////////////////////////// + +#define MBEDTLS_AES_ROM_TABLES +#define MBEDTLS_SHA256_SMALLER +#define MBEDTLS_ECP_NIST_OPTIM + +// Hashes ///////////////////////////////////////////////////////////////////// + +// SHA-1 is still needed to parse certificates that sign with it, and is what +// hashlib exposes as "sha1". +#define PSA_WANT_ALG_SHA_1 +#define PSA_WANT_ALG_SHA_224 +#define PSA_WANT_ALG_SHA_256 +#define PSA_WANT_ALG_SHA_384 +#define PSA_WANT_ALG_SHA_512 +#define PSA_WANT_ALG_HMAC +#define PSA_WANT_KEY_TYPE_HMAC + +// Key derivation ///////////////////////////////////////////////////////////// + +// The TLS 1.2 key schedule. HKDF is deliberately absent: it is the TLS 1.3 key +// schedule, and mbedtls_config.h enables TLS 1.2 only. +#define PSA_WANT_ALG_TLS12_PRF +#define PSA_WANT_ALG_TLS12_PSK_TO_MS +#define PSA_WANT_KEY_TYPE_DERIVE +#define PSA_WANT_KEY_TYPE_RAW_DATA + +// Bulk ciphers /////////////////////////////////////////////////////////////// + +#define PSA_WANT_KEY_TYPE_AES +#define PSA_WANT_ALG_GCM +#define PSA_WANT_ALG_CCM +#define PSA_WANT_ALG_CBC_NO_PADDING +#define PSA_WANT_ALG_CBC_PKCS7 +#define PSA_WANT_ALG_ECB_NO_PADDING + +// RP2 has no AES accelerator, so ChaCha20-Poly1305 is 40-70% faster than AES-GCM here, +// measured over HTTPS on Pico W and Pico 2 W. mbedtls offers it ahead of AES-GCM, and +// real-world CDNs do negotiate it. Costs about 6 kB. espressif leaves it off, since +// ESP32 has AES hardware. +#define PSA_WANT_KEY_TYPE_CHACHA20 +#define PSA_WANT_ALG_CHACHA20_POLY1305 + +// Public key ///////////////////////////////////////////////////////////////// + +#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN +#define PSA_WANT_ALG_RSA_PSS +#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC +#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT + +#define PSA_WANT_ALG_ECDH +#define PSA_WANT_ALG_ECDSA +#define PSA_WANT_ALG_DETERMINISTIC_ECDSA +#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT +// An ECDHE handshake generates an ephemeral key pair, sends its public part, then +// runs the key agreement, so it needs GENERATE, EXPORT and DERIVE as well as the two +// above. Without them psa_generate_key() fails and the TLS 1.2 client reports +// MBEDTLS_ERR_SSL_HW_ACCEL_FAILED -- a legacy name that in 4.x just means a PSA call +// failed. See ssl_tls12_client.c. +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT +#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE + +// P-256 and P-384 cover essentially every public CA. Curve25519 is here for x25519 +// ECDHE, which servers commonly prefer (RFC 8422). Deliberately absent: +// - P-521: no public CA issues from it, and it cost 5792 bytes on Pico W. +// - Brainpool and secp256k1: unused on the public web. espressif enables secp256k1 +// only because ESP-IDF defaults it on. +// The 192- and 224-bit curves the mbedtls 2.28 config enabled are gone from 4.x +// upstream; there is no PSA_WANT_ECC_SECP_R1_192/_224 to select. +#define PSA_WANT_ECC_SECP_R1_256 +#define PSA_WANT_ECC_SECP_R1_384 +#define PSA_WANT_ECC_MONTGOMERY_255 + +// Key and certificate parsing //////////////////////////////////////////////// + +#define MBEDTLS_PK_C +#define MBEDTLS_PK_PARSE_C +#define MBEDTLS_PK_WRITE_C +#define MBEDTLS_MD_C +#define MBEDTLS_PEM_PARSE_C +#define MBEDTLS_BASE64_C +#define MBEDTLS_PKCS5_C +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C diff --git a/lib/mbedtls_config/tf_psa_crypto_config_hashlib.h b/lib/mbedtls_config/tf_psa_crypto_config_hashlib.h new file mode 100644 index 00000000000..0dbf9b13542 --- /dev/null +++ b/lib/mbedtls_config/tf_psa_crypto_config_hashlib.h @@ -0,0 +1,48 @@ +// This file is part of the CircuitPython project: https://circuitpython.org +// +// SPDX-FileCopyrightText: Copyright (c) 2018-2019 Damien P. George +// SPDX-FileCopyrightText: Copyright (c) 2026 Dan Halbert for Adafruit Industries +// +// SPDX-License-Identifier: MIT + +// TF-PSA-Crypto configuration for ports that want hashlib but not ssl, selected with +// TF_PSA_CRYPTO_CONFIG_FILE when CIRCUITPY_HASHLIB_MBEDTLS_ONLY is set. +// +// Only the crypto config is needed here: nothing on this path includes +// mbedtls/build_info.h, so no TLS/X.509 configuration is required. +// +// The PSA core is enabled so that hashlib can use the same psa_hash_*() interface on +// every port. It also means PSA_WANT_* behaves as documented: tf-psa-crypto/build_info.h +// only derives the builtin implementations from PSA_WANT_* when MBEDTLS_PSA_CRYPTO_C is +// set, so without it PSA_WANT_ALG_SHA_256 would silently select nothing. + +#pragma once + +#define MBEDTLS_PLATFORM_C +#define MBEDTLS_PLATFORM_MEMORY +#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +#define MBEDTLS_DEPRECATED_REMOVED + +#undef MBEDTLS_HAVE_TIME +#undef MBEDTLS_HAVE_TIME_DATE + +// The digests hashlib exposes. +#define PSA_WANT_ALG_SHA_1 +#define PSA_WANT_ALG_SHA_256 + +// psa_crypto_init() initializes the RNG subsystem even in a build that only hashes, so +// a random generator has to be available. Take it straight from the port TRNG, which +// keeps entropy.c and ctr_drbg.c out of the build; see hashlib_psa_port.c. +#define MBEDTLS_PSA_CRYPTO_C +#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + +#define MBEDTLS_SHA256_SMALLER + +// Memory allocation hooks +#include +#include +void *m_tracked_calloc(size_t nmemb, size_t size); +void m_tracked_free(void *ptr); +#define MBEDTLS_PLATFORM_STD_CALLOC m_tracked_calloc +#define MBEDTLS_PLATFORM_STD_FREE m_tracked_free +#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf diff --git a/lib/mbedtls_errors/do-mp.sh b/lib/mbedtls_errors/do-mp.sh index 5c6b9711794..3713b0087a7 100755 --- a/lib/mbedtls_errors/do-mp.sh +++ b/lib/mbedtls_errors/do-mp.sh @@ -1,4 +1,15 @@ #! /bin/bash -e # Generate mp_mbedtls_errors.c for inclusion in ports that use $MPY/lib/mbedtls +# +# As of mbedtls 4.0 the error #defines live in two trees: TLS and X.509 in +# mbedtls/include/mbedtls, and the legacy crypto modules in tf-psa-crypto, so +# generate_errors.pl now takes the crypto include directory as well. patch -o mp_generate_errors.pl ../mbedtls/scripts/generate_errors.pl -#if defined(MBEDTLS_AES_C) -#include "mbedtls/aes.h" +#if defined(MBEDTLS_NET_C) +#include "mbedtls/net_sockets.h" #endif -#if defined(MBEDTLS_ARC4_C) -#include "mbedtls/arc4.h" +#if defined(MBEDTLS_PKCS7_C) +#include "mbedtls/pkcs7.h" #endif -#if defined(MBEDTLS_ARIA_C) -#include "mbedtls/aria.h" +#if defined(MBEDTLS_SSL_TLS_C) +#include "mbedtls/ssl.h" #endif -#if defined(MBEDTLS_ASN1_PARSE_C) -#include "mbedtls/asn1.h" +#if defined(MBEDTLS_X509_USE_C) || \ + defined(MBEDTLS_X509_CREATE_C) +#include "mbedtls/x509.h" #endif -#if defined(MBEDTLS_BASE64_C) -#include "mbedtls/base64.h" +#if defined(MBEDTLS_AES_C) +#include "mbedtls/private/aes.h" #endif -#if defined(MBEDTLS_BIGNUM_C) -#include "mbedtls/bignum.h" +#if defined(MBEDTLS_ARIA_C) +#include "mbedtls/private/aria.h" #endif -#if defined(MBEDTLS_BLOWFISH_C) -#include "mbedtls/blowfish.h" +#if defined(MBEDTLS_BIGNUM_C) +#include "mbedtls/private/bignum.h" #endif #if defined(MBEDTLS_CAMELLIA_C) -#include "mbedtls/camellia.h" -#endif - -#if defined(MBEDTLS_CCM_C) -#include "mbedtls/ccm.h" -#endif - -#if defined(MBEDTLS_CHACHA20_C) -#include "mbedtls/chacha20.h" +#include "mbedtls/private/camellia.h" #endif #if defined(MBEDTLS_CHACHAPOLY_C) -#include "mbedtls/chachapoly.h" +#include "mbedtls/private/chachapoly.h" #endif #if defined(MBEDTLS_CIPHER_C) -#include "mbedtls/cipher.h" -#endif - -#if defined(MBEDTLS_CMAC_C) -#include "mbedtls/cmac.h" +#include "mbedtls/private/cipher.h" #endif #if defined(MBEDTLS_CTR_DRBG_C) -#include "mbedtls/ctr_drbg.h" -#endif - -#if defined(MBEDTLS_DES_C) -#include "mbedtls/des.h" -#endif - -#if defined(MBEDTLS_DHM_C) -#include "mbedtls/dhm.h" +#include "mbedtls/private/ctr_drbg.h" #endif #if defined(MBEDTLS_ECP_C) -#include "mbedtls/ecp.h" +#include "mbedtls/private/ecp.h" #endif #if defined(MBEDTLS_ENTROPY_C) -#include "mbedtls/entropy.h" -#endif - -#if defined(MBEDTLS_ERROR_C) -#include "mbedtls/error.h" -#endif - -#if defined(MBEDTLS_GCM_C) -#include "mbedtls/gcm.h" -#endif - -#if defined(MBEDTLS_HKDF_C) -#include "mbedtls/hkdf.h" +#include "mbedtls/private/entropy.h" #endif #if defined(MBEDTLS_HMAC_DRBG_C) -#include "mbedtls/hmac_drbg.h" -#endif - -#if defined(MBEDTLS_MD_C) -#include "mbedtls/md.h" -#endif - -#if defined(MBEDTLS_MD2_C) -#include "mbedtls/md2.h" -#endif - -#if defined(MBEDTLS_MD4_C) -#include "mbedtls/md4.h" -#endif - -#if defined(MBEDTLS_MD5_C) -#include "mbedtls/md5.h" -#endif - -#if defined(MBEDTLS_NET_C) -#include "mbedtls/net_sockets.h" -#endif - -#if defined(MBEDTLS_OID_C) -#include "mbedtls/oid.h" -#endif - -#if defined(MBEDTLS_PADLOCK_C) -#if defined(MBEDTLS_PADLOCK_FILE) -#include MBEDTLS_PADLOCK_FILE -#else -#include "mbedtls/padlock.h" -#endif -#endif - -#if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C) -#include "mbedtls/pem.h" -#endif - -#if defined(MBEDTLS_PK_C) -#include "mbedtls/pk.h" -#endif - -#if defined(MBEDTLS_PKCS12_C) -#include "mbedtls/pkcs12.h" +#include "mbedtls/private/hmac_drbg.h" #endif #if defined(MBEDTLS_PKCS5_C) -#include "mbedtls/pkcs5.h" -#endif - -#if defined(MBEDTLS_PLATFORM_C) -#include "mbedtls/platform.h" -#endif - -#if defined(MBEDTLS_POLY1305_C) -#include "mbedtls/poly1305.h" -#endif - -#if defined(MBEDTLS_RIPEMD160_C) -#include "mbedtls/ripemd160.h" +#include "mbedtls/private/pkcs5.h" #endif #if defined(MBEDTLS_RSA_C) -#include "mbedtls/rsa.h" -#endif - -#if defined(MBEDTLS_SHA1_C) -#include "mbedtls/sha1.h" -#endif - -#if defined(MBEDTLS_SHA256_C) -#include "mbedtls/sha256.h" -#endif - -#if defined(MBEDTLS_SHA512_C) -#include "mbedtls/sha512.h" -#endif - -#if defined(MBEDTLS_SSL_TLS_C) -#include "mbedtls/ssl.h" -#endif - -#if defined(MBEDTLS_THREADING_C) -#include "mbedtls/threading.h" -#endif - -#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C) -#include "mbedtls/x509.h" -#endif - -#if defined(MBEDTLS_XTEA_C) -#include "mbedtls/xtea.h" +#include "mbedtls/private/rsa.h" #endif @@ -231,197 +112,44 @@ struct ssl_errs { // Table of high level error codes static const struct ssl_errs mbedtls_high_level_error_tab[] = { // BEGIN generated code -#if defined(MBEDTLS_CIPHER_C) - { -(MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE), "CIPHER_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA), "CIPHER_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_CIPHER_ALLOC_FAILED), "CIPHER_ALLOC_FAILED" }, - { -(MBEDTLS_ERR_CIPHER_INVALID_PADDING), "CIPHER_INVALID_PADDING" }, - { -(MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED), "CIPHER_FULL_BLOCK_EXPECTED" }, - { -(MBEDTLS_ERR_CIPHER_AUTH_FAILED), "CIPHER_AUTH_FAILED" }, - { -(MBEDTLS_ERR_CIPHER_INVALID_CONTEXT), "CIPHER_INVALID_CONTEXT" }, -#if defined(MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED), "CIPHER_HW_ACCEL_FAILED" }, -#endif -#endif /* MBEDTLS_CIPHER_C */ - -#if defined(MBEDTLS_DHM_C) - { -(MBEDTLS_ERR_DHM_BAD_INPUT_DATA), "DHM_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_DHM_READ_PARAMS_FAILED), "DHM_READ_PARAMS_FAILED" }, - { -(MBEDTLS_ERR_DHM_MAKE_PARAMS_FAILED), "DHM_MAKE_PARAMS_FAILED" }, - { -(MBEDTLS_ERR_DHM_READ_PUBLIC_FAILED), "DHM_READ_PUBLIC_FAILED" }, - { -(MBEDTLS_ERR_DHM_MAKE_PUBLIC_FAILED), "DHM_MAKE_PUBLIC_FAILED" }, - { -(MBEDTLS_ERR_DHM_CALC_SECRET_FAILED), "DHM_CALC_SECRET_FAILED" }, - { -(MBEDTLS_ERR_DHM_INVALID_FORMAT), "DHM_INVALID_FORMAT" }, - { -(MBEDTLS_ERR_DHM_ALLOC_FAILED), "DHM_ALLOC_FAILED" }, - { -(MBEDTLS_ERR_DHM_FILE_IO_ERROR), "DHM_FILE_IO_ERROR" }, - { -(MBEDTLS_ERR_DHM_HW_ACCEL_FAILED), "DHM_HW_ACCEL_FAILED" }, - { -(MBEDTLS_ERR_DHM_SET_GROUP_FAILED), "DHM_SET_GROUP_FAILED" }, -#endif /* MBEDTLS_DHM_C */ - -#if defined(MBEDTLS_ECP_C) - { -(MBEDTLS_ERR_ECP_BAD_INPUT_DATA), "ECP_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL), "ECP_BUFFER_TOO_SMALL" }, - { -(MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE), "ECP_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_ECP_VERIFY_FAILED), "ECP_VERIFY_FAILED" }, - { -(MBEDTLS_ERR_ECP_ALLOC_FAILED), "ECP_ALLOC_FAILED" }, - { -(MBEDTLS_ERR_ECP_RANDOM_FAILED), "ECP_RANDOM_FAILED" }, - { -(MBEDTLS_ERR_ECP_INVALID_KEY), "ECP_INVALID_KEY" }, - { -(MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH), "ECP_SIG_LEN_MISMATCH" }, -#if defined(MBEDTLS_ERR_ECP_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_ECP_HW_ACCEL_FAILED), "ECP_HW_ACCEL_FAILED" }, -#endif - { -(MBEDTLS_ERR_ECP_IN_PROGRESS), "ECP_IN_PROGRESS" }, -#endif /* MBEDTLS_ECP_C */ - -#if defined(MBEDTLS_MD_C) - { -(MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE), "MD_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_MD_BAD_INPUT_DATA), "MD_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_MD_ALLOC_FAILED), "MD_ALLOC_FAILED" }, - { -(MBEDTLS_ERR_MD_FILE_IO_ERROR), "MD_FILE_IO_ERROR" }, -#if defined(MBEDTLS_ERR_MD_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_MD_HW_ACCEL_FAILED), "MD_HW_ACCEL_FAILED" }, -#endif -#endif /* MBEDTLS_MD_C */ - -#if defined(MBEDTLS_PEM_PARSE_C) || defined(MBEDTLS_PEM_WRITE_C) - { -(MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT), "PEM_NO_HEADER_FOOTER_PRESENT" }, - { -(MBEDTLS_ERR_PEM_INVALID_DATA), "PEM_INVALID_DATA" }, - { -(MBEDTLS_ERR_PEM_ALLOC_FAILED), "PEM_ALLOC_FAILED" }, - { -(MBEDTLS_ERR_PEM_INVALID_ENC_IV), "PEM_INVALID_ENC_IV" }, - { -(MBEDTLS_ERR_PEM_UNKNOWN_ENC_ALG), "PEM_UNKNOWN_ENC_ALG" }, - { -(MBEDTLS_ERR_PEM_PASSWORD_REQUIRED), "PEM_PASSWORD_REQUIRED" }, - { -(MBEDTLS_ERR_PEM_PASSWORD_MISMATCH), "PEM_PASSWORD_MISMATCH" }, - { -(MBEDTLS_ERR_PEM_FEATURE_UNAVAILABLE), "PEM_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_PEM_BAD_INPUT_DATA), "PEM_BAD_INPUT_DATA" }, -#endif /* MBEDTLS_PEM_PARSE_C || MBEDTLS_PEM_WRITE_C */ - -#if defined(MBEDTLS_PK_C) - { -(MBEDTLS_ERR_PK_ALLOC_FAILED), "PK_ALLOC_FAILED" }, - { -(MBEDTLS_ERR_PK_TYPE_MISMATCH), "PK_TYPE_MISMATCH" }, - { -(MBEDTLS_ERR_PK_BAD_INPUT_DATA), "PK_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_PK_FILE_IO_ERROR), "PK_FILE_IO_ERROR" }, - { -(MBEDTLS_ERR_PK_KEY_INVALID_VERSION), "PK_KEY_INVALID_VERSION" }, - { -(MBEDTLS_ERR_PK_KEY_INVALID_FORMAT), "PK_KEY_INVALID_FORMAT" }, - { -(MBEDTLS_ERR_PK_UNKNOWN_PK_ALG), "PK_UNKNOWN_PK_ALG" }, - { -(MBEDTLS_ERR_PK_PASSWORD_REQUIRED), "PK_PASSWORD_REQUIRED" }, - { -(MBEDTLS_ERR_PK_PASSWORD_MISMATCH), "PK_PASSWORD_MISMATCH" }, - { -(MBEDTLS_ERR_PK_INVALID_PUBKEY), "PK_INVALID_PUBKEY" }, - { -(MBEDTLS_ERR_PK_INVALID_ALG), "PK_INVALID_ALG" }, - { -(MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE), "PK_UNKNOWN_NAMED_CURVE" }, - { -(MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE), "PK_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_PK_SIG_LEN_MISMATCH), "PK_SIG_LEN_MISMATCH" }, -#if defined(MBEDTLS_ERR_PK_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_PK_HW_ACCEL_FAILED), "PK_HW_ACCEL_FAILED" }, -#endif -#endif /* MBEDTLS_PK_C */ - -#if defined(MBEDTLS_PKCS12_C) - { -(MBEDTLS_ERR_PKCS12_BAD_INPUT_DATA), "PKCS12_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_PKCS12_FEATURE_UNAVAILABLE), "PKCS12_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_PKCS12_PBE_INVALID_FORMAT), "PKCS12_PBE_INVALID_FORMAT" }, - { -(MBEDTLS_ERR_PKCS12_PASSWORD_MISMATCH), "PKCS12_PASSWORD_MISMATCH" }, -#endif /* MBEDTLS_PKCS12_C */ - -#if defined(MBEDTLS_PKCS5_C) - { -(MBEDTLS_ERR_PKCS5_BAD_INPUT_DATA), "PKCS5_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_PKCS5_INVALID_FORMAT), "PKCS5_INVALID_FORMAT" }, - { -(MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE), "PKCS5_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH), "PKCS5_PASSWORD_MISMATCH" }, -#endif /* MBEDTLS_PKCS5_C */ - -#if defined(MBEDTLS_RSA_C) - { -(MBEDTLS_ERR_RSA_BAD_INPUT_DATA), "RSA_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_RSA_INVALID_PADDING), "RSA_INVALID_PADDING" }, - { -(MBEDTLS_ERR_RSA_KEY_GEN_FAILED), "RSA_KEY_GEN_FAILED" }, - { -(MBEDTLS_ERR_RSA_KEY_CHECK_FAILED), "RSA_KEY_CHECK_FAILED" }, - { -(MBEDTLS_ERR_RSA_PUBLIC_FAILED), "RSA_PUBLIC_FAILED" }, - { -(MBEDTLS_ERR_RSA_PRIVATE_FAILED), "RSA_PRIVATE_FAILED" }, - { -(MBEDTLS_ERR_RSA_VERIFY_FAILED), "RSA_VERIFY_FAILED" }, - { -(MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE), "RSA_OUTPUT_TOO_LARGE" }, - { -(MBEDTLS_ERR_RSA_RNG_FAILED), "RSA_RNG_FAILED" }, -#if defined(MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION) - { -(MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION), "RSA_UNSUPPORTED_OPERATION" }, -#endif -#if defined(MBEDTLS_ERR_RSA_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_RSA_HW_ACCEL_FAILED), "RSA_HW_ACCEL_FAILED" }, -#endif -#endif /* MBEDTLS_RSA_C */ +#if defined(MBEDTLS_PKCS7_C) + { -(MBEDTLS_ERR_PKCS7_INVALID_FORMAT), "PKCS7_INVALID_FORMAT" }, + { -(MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE), "PKCS7_FEATURE_UNAVAILABLE" }, + { -(MBEDTLS_ERR_PKCS7_INVALID_VERSION), "PKCS7_INVALID_VERSION" }, + { -(MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO), "PKCS7_INVALID_CONTENT_INFO" }, + { -(MBEDTLS_ERR_PKCS7_INVALID_ALG), "PKCS7_INVALID_ALG" }, + { -(MBEDTLS_ERR_PKCS7_INVALID_CERT), "PKCS7_INVALID_CERT" }, + { -(MBEDTLS_ERR_PKCS7_INVALID_SIGNATURE), "PKCS7_INVALID_SIGNATURE" }, + { -(MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO), "PKCS7_INVALID_SIGNER_INFO" }, + { -(MBEDTLS_ERR_PKCS7_CERT_DATE_INVALID), "PKCS7_CERT_DATE_INVALID" }, +#endif /* MBEDTLS_PKCS7_C */ #if defined(MBEDTLS_SSL_TLS_C) + { -(MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS), "SSL_CRYPTO_IN_PROGRESS" }, { -(MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE), "SSL_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_SSL_BAD_INPUT_DATA), "SSL_BAD_INPUT_DATA" }, { -(MBEDTLS_ERR_SSL_INVALID_MAC), "SSL_INVALID_MAC" }, { -(MBEDTLS_ERR_SSL_INVALID_RECORD), "SSL_INVALID_RECORD" }, { -(MBEDTLS_ERR_SSL_CONN_EOF), "SSL_CONN_EOF" }, -#if defined(MBEDTLS_ERR_SSL_UNKNOWN_CIPHER) - { -(MBEDTLS_ERR_SSL_UNKNOWN_CIPHER), "SSL_UNKNOWN_CIPHER" }, -#endif -#if defined(MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN) - { -(MBEDTLS_ERR_SSL_NO_CIPHER_CHOSEN), "SSL_NO_CIPHER_CHOSEN" }, -#endif + { -(MBEDTLS_ERR_SSL_DECODE_ERROR), "SSL_DECODE_ERROR" }, { -(MBEDTLS_ERR_SSL_NO_RNG), "SSL_NO_RNG" }, { -(MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE), "SSL_NO_CLIENT_CERTIFICATE" }, -#if defined(MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE) - { -(MBEDTLS_ERR_SSL_CERTIFICATE_TOO_LARGE), "SSL_CERTIFICATE_TOO_LARGE" }, -#endif -#if defined(MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED) - { -(MBEDTLS_ERR_SSL_CERTIFICATE_REQUIRED), "SSL_CERTIFICATE_REQUIRED" }, -#endif + { -(MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION), "SSL_UNSUPPORTED_EXTENSION" }, + { -(MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL), "SSL_NO_APPLICATION_PROTOCOL" }, { -(MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED), "SSL_PRIVATE_KEY_REQUIRED" }, { -(MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED), "SSL_CA_CHAIN_REQUIRED" }, { -(MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE), "SSL_UNEXPECTED_MESSAGE" }, -#if defined(MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED) - { -(MBEDTLS_ERR_SSL_PEER_VERIFY_FAILED), "SSL_PEER_VERIFY_FAILED" }, -#endif + { -(MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME), "SSL_UNRECOGNIZED_NAME" }, { -(MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY), "SSL_PEER_CLOSE_NOTIFY" }, -#if defined(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO) - { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO), "SSL_BAD_HS_CLIENT_HELLO" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO) - { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO), "SSL_BAD_HS_SERVER_HELLO" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE) - { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE), "SSL_BAD_HS_CERTIFICATE" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST) - { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_REQUEST), "SSL_BAD_HS_CERTIFICATE_REQUEST" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE) - { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_KEY_EXCHANGE), "SSL_BAD_HS_SERVER_KEY_EXCHANGE" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE) - { -(MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO_DONE), "SSL_BAD_HS_SERVER_HELLO_DONE" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE) - { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP) - { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE_RP" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS) - { -(MBEDTLS_ERR_SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS), "SSL_BAD_HS_CLIENT_KEY_EXCHANGE_CS" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY) - { -(MBEDTLS_ERR_SSL_BAD_HS_CERTIFICATE_VERIFY), "SSL_BAD_HS_CERTIFICATE_VERIFY" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC) - { -(MBEDTLS_ERR_SSL_BAD_HS_CHANGE_CIPHER_SPEC), "SSL_BAD_HS_CHANGE_CIPHER_SPEC" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_FINISHED) - { -(MBEDTLS_ERR_SSL_BAD_HS_FINISHED), "SSL_BAD_HS_FINISHED" }, -#endif - { -(MBEDTLS_ERR_SSL_ALLOC_FAILED), "SSL_ALLOC_FAILED" }, + { -(MBEDTLS_ERR_SSL_BAD_CERTIFICATE), "SSL_BAD_CERTIFICATE" }, + { -(MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET), "SSL_RECEIVED_NEW_SESSION_TICKET" }, + { -(MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA), "SSL_CANNOT_READ_EARLY_DATA" }, + { -(MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA), "SSL_RECEIVED_EARLY_DATA" }, + { -(MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA), "SSL_CANNOT_WRITE_EARLY_DATA" }, + { -(MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND), "SSL_CACHE_ENTRY_NOT_FOUND" }, { -(MBEDTLS_ERR_SSL_HW_ACCEL_FAILED), "SSL_HW_ACCEL_FAILED" }, { -(MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH), "SSL_HW_ACCEL_FALLTHROUGH" }, -#if defined(MBEDTLS_ERR_SSL_COMPRESSION_FAILED) - { -(MBEDTLS_ERR_SSL_COMPRESSION_FAILED), "SSL_COMPRESSION_FAILED" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION) - { -(MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION), "SSL_BAD_HS_PROTOCOL_VERSION" }, -#endif -#if defined(MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET) - { -(MBEDTLS_ERR_SSL_BAD_HS_NEW_SESSION_TICKET), "SSL_BAD_HS_NEW_SESSION_TICKET" }, -#endif + { -(MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION), "SSL_BAD_PROTOCOL_VERSION" }, + { -(MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE), "SSL_HANDSHAKE_FAILURE" }, { -(MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED), "SSL_SESSION_TICKET_EXPIRED" }, { -(MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH), "SSL_PK_TYPE_MISMATCH" }, { -(MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY), "SSL_UNKNOWN_IDENTITY" }, @@ -429,29 +157,24 @@ static const struct ssl_errs mbedtls_high_level_error_tab[] = { { -(MBEDTLS_ERR_SSL_COUNTER_WRAPPING), "SSL_COUNTER_WRAPPING" }, { -(MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO), "SSL_WAITING_SERVER_HELLO_RENEGO" }, { -(MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED), "SSL_HELLO_VERIFY_REQUIRED" }, - { -(MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL), "SSL_BUFFER_TOO_SMALL" }, -#if defined(MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE) - { -(MBEDTLS_ERR_SSL_NO_USABLE_CIPHERSUITE), "SSL_NO_USABLE_CIPHERSUITE" }, -#endif { -(MBEDTLS_ERR_SSL_WANT_READ), "SSL_WANT_READ" }, { -(MBEDTLS_ERR_SSL_WANT_WRITE), "SSL_WANT_WRITE" }, { -(MBEDTLS_ERR_SSL_TIMEOUT), "SSL_TIMEOUT" }, { -(MBEDTLS_ERR_SSL_CLIENT_RECONNECT), "SSL_CLIENT_RECONNECT" }, { -(MBEDTLS_ERR_SSL_UNEXPECTED_RECORD), "SSL_UNEXPECTED_RECORD" }, { -(MBEDTLS_ERR_SSL_NON_FATAL), "SSL_NON_FATAL" }, -#if defined(MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH) - { -(MBEDTLS_ERR_SSL_INVALID_VERIFY_HASH), "SSL_INVALID_VERIFY_HASH" }, -#endif + { -(MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER), "SSL_ILLEGAL_PARAMETER" }, { -(MBEDTLS_ERR_SSL_CONTINUE_PROCESSING), "SSL_CONTINUE_PROCESSING" }, { -(MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS), "SSL_ASYNC_IN_PROGRESS" }, { -(MBEDTLS_ERR_SSL_EARLY_MESSAGE), "SSL_EARLY_MESSAGE" }, { -(MBEDTLS_ERR_SSL_UNEXPECTED_CID), "SSL_UNEXPECTED_CID" }, { -(MBEDTLS_ERR_SSL_VERSION_MISMATCH), "SSL_VERSION_MISMATCH" }, - { -(MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS), "SSL_CRYPTO_IN_PROGRESS" }, { -(MBEDTLS_ERR_SSL_BAD_CONFIG), "SSL_BAD_CONFIG" }, + { -(MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME), "SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME" }, #endif /* MBEDTLS_SSL_TLS_C */ -#if defined(MBEDTLS_X509_USE_C) || defined(MBEDTLS_X509_CREATE_C) +#if defined(MBEDTLS_X509_USE_C) || \ + defined(MBEDTLS_X509_CREATE_C) { -(MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE), "X509_FEATURE_UNAVAILABLE" }, { -(MBEDTLS_ERR_X509_UNKNOWN_OID), "X509_UNKNOWN_OID" }, { -(MBEDTLS_ERR_X509_INVALID_FORMAT), "X509_INVALID_FORMAT" }, @@ -468,11 +191,34 @@ static const struct ssl_errs mbedtls_high_level_error_tab[] = { { -(MBEDTLS_ERR_X509_CERT_VERIFY_FAILED), "X509_CERT_VERIFY_FAILED" }, { -(MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT), "X509_CERT_UNKNOWN_FORMAT" }, { -(MBEDTLS_ERR_X509_BAD_INPUT_DATA), "X509_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_X509_ALLOC_FAILED), "X509_ALLOC_FAILED" }, { -(MBEDTLS_ERR_X509_FILE_IO_ERROR), "X509_FILE_IO_ERROR" }, - { -(MBEDTLS_ERR_X509_BUFFER_TOO_SMALL), "X509_BUFFER_TOO_SMALL" }, { -(MBEDTLS_ERR_X509_FATAL_ERROR), "X509_FATAL_ERROR" }, -#endif /* MBEDTLS_X509_USE_C || MBEDTLS_X509_CREATE_C */ +#endif /* MBEDTLS_X509_USE_C || + MBEDTLS_X509_CREATE_C */ + +#if defined(MBEDTLS_CIPHER_C) + { -(MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE), "CIPHER_FEATURE_UNAVAILABLE" }, + { -(MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED), "CIPHER_FULL_BLOCK_EXPECTED" }, + { -(MBEDTLS_ERR_CIPHER_INVALID_CONTEXT), "CIPHER_INVALID_CONTEXT" }, +#endif /* MBEDTLS_CIPHER_C */ + +#if defined(MBEDTLS_ECP_C) + { -(MBEDTLS_ERR_ECP_INVALID_KEY), "ECP_INVALID_KEY" }, +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_PKCS5_C) + { -(MBEDTLS_ERR_PKCS5_INVALID_FORMAT), "PKCS5_INVALID_FORMAT" }, + { -(MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE), "PKCS5_FEATURE_UNAVAILABLE" }, + { -(MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH), "PKCS5_PASSWORD_MISMATCH" }, +#endif /* MBEDTLS_PKCS5_C */ + +#if defined(MBEDTLS_RSA_C) + { -(MBEDTLS_ERR_RSA_KEY_GEN_FAILED), "RSA_KEY_GEN_FAILED" }, + { -(MBEDTLS_ERR_RSA_KEY_CHECK_FAILED), "RSA_KEY_CHECK_FAILED" }, + { -(MBEDTLS_ERR_RSA_PUBLIC_FAILED), "RSA_PUBLIC_FAILED" }, + { -(MBEDTLS_ERR_RSA_PRIVATE_FAILED), "RSA_PRIVATE_FAILED" }, + { -(MBEDTLS_ERR_RSA_RNG_FAILED), "RSA_RNG_FAILED" }, +#endif /* MBEDTLS_RSA_C */ // END generated code }; @@ -480,98 +226,46 @@ static const struct ssl_errs mbedtls_low_level_error_tab[] = { // Low level error codes // // BEGIN generated code +#if defined(MBEDTLS_NET_C) + { -(MBEDTLS_ERR_NET_SOCKET_FAILED), "NET_SOCKET_FAILED" }, + { -(MBEDTLS_ERR_NET_CONNECT_FAILED), "NET_CONNECT_FAILED" }, + { -(MBEDTLS_ERR_NET_BIND_FAILED), "NET_BIND_FAILED" }, + { -(MBEDTLS_ERR_NET_LISTEN_FAILED), "NET_LISTEN_FAILED" }, + { -(MBEDTLS_ERR_NET_ACCEPT_FAILED), "NET_ACCEPT_FAILED" }, + { -(MBEDTLS_ERR_NET_RECV_FAILED), "NET_RECV_FAILED" }, + { -(MBEDTLS_ERR_NET_SEND_FAILED), "NET_SEND_FAILED" }, + { -(MBEDTLS_ERR_NET_CONN_RESET), "NET_CONN_RESET" }, + { -(MBEDTLS_ERR_NET_UNKNOWN_HOST), "NET_UNKNOWN_HOST" }, + { -(MBEDTLS_ERR_NET_INVALID_CONTEXT), "NET_INVALID_CONTEXT" }, + { -(MBEDTLS_ERR_NET_POLL_FAILED), "NET_POLL_FAILED" }, + { -(MBEDTLS_ERR_NET_BAD_INPUT_DATA), "NET_BAD_INPUT_DATA" }, +#endif /* MBEDTLS_NET_C */ + #if defined(MBEDTLS_AES_C) { -(MBEDTLS_ERR_AES_INVALID_KEY_LENGTH), "AES_INVALID_KEY_LENGTH" }, { -(MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH), "AES_INVALID_INPUT_LENGTH" }, - { -(MBEDTLS_ERR_AES_BAD_INPUT_DATA), "AES_BAD_INPUT_DATA" }, -#if defined(MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE) - { -(MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE), "AES_FEATURE_UNAVAILABLE" }, -#endif -#if defined(MBEDTLS_ERR_AES_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_AES_HW_ACCEL_FAILED), "AES_HW_ACCEL_FAILED" }, -#endif #endif /* MBEDTLS_AES_C */ -#if defined(MBEDTLS_ARC4_C) - { -(MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED), "ARC4_HW_ACCEL_FAILED" }, -#endif /* MBEDTLS_ARC4_C */ - #if defined(MBEDTLS_ARIA_C) - { -(MBEDTLS_ERR_ARIA_BAD_INPUT_DATA), "ARIA_BAD_INPUT_DATA" }, { -(MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH), "ARIA_INVALID_INPUT_LENGTH" }, -#if defined(MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE) - { -(MBEDTLS_ERR_ARIA_FEATURE_UNAVAILABLE), "ARIA_FEATURE_UNAVAILABLE" }, -#endif -#if defined(MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_ARIA_HW_ACCEL_FAILED), "ARIA_HW_ACCEL_FAILED" }, -#endif #endif /* MBEDTLS_ARIA_C */ -#if defined(MBEDTLS_ASN1_PARSE_C) - { -(MBEDTLS_ERR_ASN1_OUT_OF_DATA), "ASN1_OUT_OF_DATA" }, - { -(MBEDTLS_ERR_ASN1_UNEXPECTED_TAG), "ASN1_UNEXPECTED_TAG" }, - { -(MBEDTLS_ERR_ASN1_INVALID_LENGTH), "ASN1_INVALID_LENGTH" }, - { -(MBEDTLS_ERR_ASN1_LENGTH_MISMATCH), "ASN1_LENGTH_MISMATCH" }, - { -(MBEDTLS_ERR_ASN1_INVALID_DATA), "ASN1_INVALID_DATA" }, - { -(MBEDTLS_ERR_ASN1_ALLOC_FAILED), "ASN1_ALLOC_FAILED" }, - { -(MBEDTLS_ERR_ASN1_BUF_TOO_SMALL), "ASN1_BUF_TOO_SMALL" }, -#endif /* MBEDTLS_ASN1_PARSE_C */ - -#if defined(MBEDTLS_BASE64_C) - { -(MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL), "BASE64_BUFFER_TOO_SMALL" }, - { -(MBEDTLS_ERR_BASE64_INVALID_CHARACTER), "BASE64_INVALID_CHARACTER" }, -#endif /* MBEDTLS_BASE64_C */ - #if defined(MBEDTLS_BIGNUM_C) { -(MBEDTLS_ERR_MPI_FILE_IO_ERROR), "MPI_FILE_IO_ERROR" }, - { -(MBEDTLS_ERR_MPI_BAD_INPUT_DATA), "MPI_BAD_INPUT_DATA" }, { -(MBEDTLS_ERR_MPI_INVALID_CHARACTER), "MPI_INVALID_CHARACTER" }, - { -(MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL), "MPI_BUFFER_TOO_SMALL" }, { -(MBEDTLS_ERR_MPI_NEGATIVE_VALUE), "MPI_NEGATIVE_VALUE" }, { -(MBEDTLS_ERR_MPI_DIVISION_BY_ZERO), "MPI_DIVISION_BY_ZERO" }, { -(MBEDTLS_ERR_MPI_NOT_ACCEPTABLE), "MPI_NOT_ACCEPTABLE" }, - { -(MBEDTLS_ERR_MPI_ALLOC_FAILED), "MPI_ALLOC_FAILED" }, #endif /* MBEDTLS_BIGNUM_C */ -#if defined(MBEDTLS_BLOWFISH_C) - { -(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA), "BLOWFISH_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH), "BLOWFISH_INVALID_INPUT_LENGTH" }, - { -(MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED), "BLOWFISH_HW_ACCEL_FAILED" }, -#endif /* MBEDTLS_BLOWFISH_C */ - #if defined(MBEDTLS_CAMELLIA_C) - { -(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA), "CAMELLIA_BAD_INPUT_DATA" }, { -(MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH), "CAMELLIA_INVALID_INPUT_LENGTH" }, - { -(MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED), "CAMELLIA_HW_ACCEL_FAILED" }, #endif /* MBEDTLS_CAMELLIA_C */ -#if defined(MBEDTLS_CCM_C) - { -(MBEDTLS_ERR_CCM_BAD_INPUT), "CCM_BAD_INPUT" }, - { -(MBEDTLS_ERR_CCM_AUTH_FAILED), "CCM_AUTH_FAILED" }, -#if defined(MBEDTLS_ERR_CCM_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_CCM_HW_ACCEL_FAILED), "CCM_HW_ACCEL_FAILED" }, -#endif -#endif /* MBEDTLS_CCM_C */ - -#if defined(MBEDTLS_CHACHA20_C) - { -(MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA), "CHACHA20_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_CHACHA20_FEATURE_UNAVAILABLE), "CHACHA20_FEATURE_UNAVAILABLE" }, -#if defined(MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_CHACHA20_HW_ACCEL_FAILED), "CHACHA20_HW_ACCEL_FAILED" }, -#endif -#endif /* MBEDTLS_CHACHA20_C */ - #if defined(MBEDTLS_CHACHAPOLY_C) { -(MBEDTLS_ERR_CHACHAPOLY_BAD_STATE), "CHACHAPOLY_BAD_STATE" }, - { -(MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED), "CHACHAPOLY_AUTH_FAILED" }, #endif /* MBEDTLS_CHACHAPOLY_C */ -#if defined(MBEDTLS_CMAC_C) -#if defined(MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED), "CMAC_HW_ACCEL_FAILED" }, -#endif -#endif /* MBEDTLS_CMAC_C */ - #if defined(MBEDTLS_CTR_DRBG_C) { -(MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED), "CTR_DRBG_ENTROPY_SOURCE_FAILED" }, { -(MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG), "CTR_DRBG_REQUEST_TOO_BIG" }, @@ -579,128 +273,19 @@ static const struct ssl_errs mbedtls_low_level_error_tab[] = { { -(MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR), "CTR_DRBG_FILE_IO_ERROR" }, #endif /* MBEDTLS_CTR_DRBG_C */ -#if defined(MBEDTLS_DES_C) - { -(MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH), "DES_INVALID_INPUT_LENGTH" }, - { -(MBEDTLS_ERR_DES_HW_ACCEL_FAILED), "DES_HW_ACCEL_FAILED" }, -#endif /* MBEDTLS_DES_C */ - #if defined(MBEDTLS_ENTROPY_C) - { -(MBEDTLS_ERR_ENTROPY_SOURCE_FAILED), "ENTROPY_SOURCE_FAILED" }, { -(MBEDTLS_ERR_ENTROPY_MAX_SOURCES), "ENTROPY_MAX_SOURCES" }, { -(MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED), "ENTROPY_NO_SOURCES_DEFINED" }, { -(MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE), "ENTROPY_NO_STRONG_SOURCE" }, { -(MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR), "ENTROPY_FILE_IO_ERROR" }, #endif /* MBEDTLS_ENTROPY_C */ -#if defined(MBEDTLS_ERROR_C) - { -(MBEDTLS_ERR_ERROR_GENERIC_ERROR), "ERROR_GENERIC_ERROR" }, - { -(MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED), "ERROR_CORRUPTION_DETECTED" }, -#endif /* MBEDTLS_ERROR_C */ - -#if defined(MBEDTLS_GCM_C) - { -(MBEDTLS_ERR_GCM_AUTH_FAILED), "GCM_AUTH_FAILED" }, -#if defined(MBEDTLS_ERR_GCM_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_GCM_HW_ACCEL_FAILED), "GCM_HW_ACCEL_FAILED" }, -#endif - { -(MBEDTLS_ERR_GCM_BAD_INPUT), "GCM_BAD_INPUT" }, -#endif /* MBEDTLS_GCM_C */ - -#if defined(MBEDTLS_HKDF_C) - { -(MBEDTLS_ERR_HKDF_BAD_INPUT_DATA), "HKDF_BAD_INPUT_DATA" }, -#endif /* MBEDTLS_HKDF_C */ - #if defined(MBEDTLS_HMAC_DRBG_C) { -(MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG), "HMAC_DRBG_REQUEST_TOO_BIG" }, { -(MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG), "HMAC_DRBG_INPUT_TOO_BIG" }, { -(MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR), "HMAC_DRBG_FILE_IO_ERROR" }, { -(MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED), "HMAC_DRBG_ENTROPY_SOURCE_FAILED" }, #endif /* MBEDTLS_HMAC_DRBG_C */ - -#if defined(MBEDTLS_MD2_C) - { -(MBEDTLS_ERR_MD2_HW_ACCEL_FAILED), "MD2_HW_ACCEL_FAILED" }, -#endif /* MBEDTLS_MD2_C */ - -#if defined(MBEDTLS_MD4_C) - { -(MBEDTLS_ERR_MD4_HW_ACCEL_FAILED), "MD4_HW_ACCEL_FAILED" }, -#endif /* MBEDTLS_MD4_C */ - -#if defined(MBEDTLS_MD5_C) -#if defined(MBEDTLS_ERR_MD5_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_MD5_HW_ACCEL_FAILED), "MD5_HW_ACCEL_FAILED" }, -#endif -#endif /* MBEDTLS_MD5_C */ - -#if defined(MBEDTLS_NET_C) - { -(MBEDTLS_ERR_NET_SOCKET_FAILED), "NET_SOCKET_FAILED" }, - { -(MBEDTLS_ERR_NET_CONNECT_FAILED), "NET_CONNECT_FAILED" }, - { -(MBEDTLS_ERR_NET_BIND_FAILED), "NET_BIND_FAILED" }, - { -(MBEDTLS_ERR_NET_LISTEN_FAILED), "NET_LISTEN_FAILED" }, - { -(MBEDTLS_ERR_NET_ACCEPT_FAILED), "NET_ACCEPT_FAILED" }, - { -(MBEDTLS_ERR_NET_RECV_FAILED), "NET_RECV_FAILED" }, - { -(MBEDTLS_ERR_NET_SEND_FAILED), "NET_SEND_FAILED" }, - { -(MBEDTLS_ERR_NET_CONN_RESET), "NET_CONN_RESET" }, - { -(MBEDTLS_ERR_NET_UNKNOWN_HOST), "NET_UNKNOWN_HOST" }, - { -(MBEDTLS_ERR_NET_BUFFER_TOO_SMALL), "NET_BUFFER_TOO_SMALL" }, - { -(MBEDTLS_ERR_NET_INVALID_CONTEXT), "NET_INVALID_CONTEXT" }, - { -(MBEDTLS_ERR_NET_POLL_FAILED), "NET_POLL_FAILED" }, - { -(MBEDTLS_ERR_NET_BAD_INPUT_DATA), "NET_BAD_INPUT_DATA" }, -#endif /* MBEDTLS_NET_C */ - -#if defined(MBEDTLS_OID_C) - { -(MBEDTLS_ERR_OID_NOT_FOUND), "OID_NOT_FOUND" }, - { -(MBEDTLS_ERR_OID_BUF_TOO_SMALL), "OID_BUF_TOO_SMALL" }, -#endif /* MBEDTLS_OID_C */ - -#if defined(MBEDTLS_PADLOCK_C) - { -(MBEDTLS_ERR_PADLOCK_DATA_MISALIGNED), "PADLOCK_DATA_MISALIGNED" }, -#endif /* MBEDTLS_PADLOCK_C */ - -#if defined(MBEDTLS_PLATFORM_C) - { -(MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED), "PLATFORM_HW_ACCEL_FAILED" }, - { -(MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED), "PLATFORM_FEATURE_UNSUPPORTED" }, -#endif /* MBEDTLS_PLATFORM_C */ - -#if defined(MBEDTLS_POLY1305_C) - { -(MBEDTLS_ERR_POLY1305_BAD_INPUT_DATA), "POLY1305_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_POLY1305_FEATURE_UNAVAILABLE), "POLY1305_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_POLY1305_HW_ACCEL_FAILED), "POLY1305_HW_ACCEL_FAILED" }, -#endif /* MBEDTLS_POLY1305_C */ - -#if defined(MBEDTLS_RIPEMD160_C) - { -(MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED), "RIPEMD160_HW_ACCEL_FAILED" }, -#endif /* MBEDTLS_RIPEMD160_C */ - -#if defined(MBEDTLS_SHA1_C) -#if defined(MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED), "SHA1_HW_ACCEL_FAILED" }, -#endif - { -(MBEDTLS_ERR_SHA1_BAD_INPUT_DATA), "SHA1_BAD_INPUT_DATA" }, -#endif /* MBEDTLS_SHA1_C */ - -#if defined(MBEDTLS_SHA256_C) -#if defined(MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED), "SHA256_HW_ACCEL_FAILED" }, -#endif - { -(MBEDTLS_ERR_SHA256_BAD_INPUT_DATA), "SHA256_BAD_INPUT_DATA" }, -#endif /* MBEDTLS_SHA256_C */ - -#if defined(MBEDTLS_SHA512_C) -#if defined(MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED) - { -(MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED), "SHA512_HW_ACCEL_FAILED" }, -#endif - { -(MBEDTLS_ERR_SHA512_BAD_INPUT_DATA), "SHA512_BAD_INPUT_DATA" }, -#endif /* MBEDTLS_SHA512_C */ - -#if defined(MBEDTLS_THREADING_C) - { -(MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE), "THREADING_FEATURE_UNAVAILABLE" }, - { -(MBEDTLS_ERR_THREADING_BAD_INPUT_DATA), "THREADING_BAD_INPUT_DATA" }, - { -(MBEDTLS_ERR_THREADING_MUTEX_ERROR), "THREADING_MUTEX_ERROR" }, -#endif /* MBEDTLS_THREADING_C */ - -#if defined(MBEDTLS_XTEA_C) - { -(MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH), "XTEA_INVALID_INPUT_LENGTH" }, - { -(MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED), "XTEA_HW_ACCEL_FAILED" }, -#endif /* MBEDTLS_XTEA_C */ // END generated code }; diff --git a/locale/circuitpython.pot b/locale/circuitpython.pot index 8640ff1078c..dbd6d902194 100644 --- a/locale/circuitpython.pot +++ b/locale/circuitpython.pot @@ -715,7 +715,7 @@ msgstr "" #: ports/analog/common-hal/busio/SPI.c ports/analog/common-hal/busio/UART.c #: ports/stm/common-hal/audioio/AudioOut.c #: shared-bindings/digitalio/DigitalInOutProtocol.c -#: shared-module/busdisplay/BusDisplay.c +#: shared-module/busdisplay/BusDisplay.c shared-module/ssl/SSLContext.c msgid "%q init failed" msgstr "" diff --git a/ports/raspberrypi/Makefile b/ports/raspberrypi/Makefile index 7e13f2428cb..5dc7768c2cf 100644 --- a/ports/raspberrypi/Makefile +++ b/ports/raspberrypi/Makefile @@ -607,89 +607,89 @@ $(BUILD)/common-hal/sdioio/sdfat_pio/SdCard/PioSdio/PioSdioCard.o: CXXFLAGS += - endif ifeq ($(CIRCUITPY_SSL),1) -CFLAGS += -isystem $(TOP)/mbedtls/include -SRC_MBEDTLS := $(addprefix lib/mbedtls/library/, \ - aes.c \ - aesni.c \ - arc4.c \ - asn1parse.c \ - asn1write.c \ - base64.c \ - bignum.c \ - blowfish.c \ - camellia.c \ - ccm.c \ - certs.c \ - chacha20.c \ - chachapoly.c \ - cipher.c \ - cipher_wrap.c \ - cmac.c \ - constant_time.c \ - ctr_drbg.c \ - debug.c \ - des.c \ - dhm.c \ - ecdh.c \ - ecdsa.c \ - ecjpake.c \ - ecp.c \ - ecp_curves.c \ - entropy.c \ - entropy_poll.c \ - gcm.c \ - havege.c \ - hmac_drbg.c \ - md2.c \ - md4.c \ - md5.c \ - md.c \ - oid.c \ - padlock.c \ - pem.c \ - pk.c \ - pkcs11.c \ - pkcs12.c \ - pkcs5.c \ - pkparse.c \ - pk_wrap.c \ - pkwrite.c \ - platform.c \ - platform_util.c \ - poly1305.c \ - ripemd160.c \ - rsa.c \ - rsa_internal.c \ - sha1.c \ - sha256.c \ - sha512.c \ - ssl_cache.c \ - ssl_ciphersuites.c \ - ssl_cli.c \ - ssl_cookie.c \ - ssl_msg.c \ - ssl_srv.c \ - ssl_ticket.c \ - ssl_tls.c \ - timing.c \ - x509.c \ - x509_create.c \ - x509_crl.c \ - x509_crt.c \ - x509_csr.c \ - x509write_crt.c \ - x509write_csr.c \ - xtea.c \ - ) +# mbedtls 4.x keeps only TLS and X.509 in library/; crypto lives in the tf-psa-crypto +# submodule, split across core/, drivers/builtin/src/, extras/, platform/ and +# utilities/. +# +# Deliberately excluded: +# - mbedtls_config.c, tf_psa_crypto_config.c: pure config-validation translation +# units that #include generated *_config_check_*.h headers. Skipping them is what +# lets us skip that second code generator. +# - net_sockets.c: CircuitPython drives the socket through socketpool callbacks. +# - pkcs7.c: unused, and MBEDTLS_PKCS7_C is off. +# - psa_its_file.c: filesystem-backed PSA key storage; we have no persistent keys. +# - drivers/{everest,p256-m,pqcp}: alternative curve and ML-DSA implementations. +mbedtls_sources = $(patsubst $(TOP)/%,%,$(filter-out $(2),$(wildcard $(TOP)/$(1)/*.c))) + +SRC_MBEDTLS := \ + $(call mbedtls_sources,lib/mbedtls/library,\ + $(TOP)/lib/mbedtls/library/mbedtls_config.c \ + $(TOP)/lib/mbedtls/library/net_sockets.c \ + $(TOP)/lib/mbedtls/library/pkcs7.c) \ + $(call mbedtls_sources,lib/mbedtls/tf-psa-crypto/core,\ + $(TOP)/lib/mbedtls/tf-psa-crypto/core/psa_its_file.c \ + $(TOP)/lib/mbedtls/tf-psa-crypto/core/tf_psa_crypto_config.c) \ + $(call mbedtls_sources,lib/mbedtls/tf-psa-crypto/drivers/builtin/src) \ + $(call mbedtls_sources,lib/mbedtls/tf-psa-crypto/extras) \ + $(call mbedtls_sources,lib/mbedtls/tf-psa-crypto/platform) \ + $(call mbedtls_sources,lib/mbedtls/tf-psa-crypto/utilities) SRC_C += $(SRC_MBEDTLS) lib/mbedtls_config/mbedtls_port.c lib/mbedtls_config/crt_bundle.c +# Public headers of mbedtls and of tf-psa-crypto, then the internal ones. mbedtls 4.x +# still reaches into tf-psa-crypto's internals, so upstream compiles the TLS layer +# with both; see TF_PSA_CRYPTO_LIBRARY_{PUBLIC,PRIVATE}_INCLUDE in +# lib/mbedtls/tf-psa-crypto/scripts/crypto-common.make. CFLAGS += \ -isystem $(TOP)/lib/mbedtls/include \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/include \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/drivers/builtin/include \ + -isystem $(TOP)/lib/mbedtls/library \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/core \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/dispatch \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/drivers/builtin/src \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/extras \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/platform \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/utilities \ -DMBEDTLS_CONFIG_FILE='"$(TOP)/lib/mbedtls_config/mbedtls_config.h"' \ + -DTF_PSA_CRYPTO_CONFIG_FILE='"$(TOP)/lib/mbedtls_config/tf_psa_crypto_config.h"' \ $(BUILD)/x509_crt_bundle.S: $(TOP)/lib/certificates/data/roots-full.pem $(TOP)/tools/gen_crt_bundle.py $(Q)$(PYTHON) $(TOP)/tools/gen_crt_bundle.py -i $< -o $@ --asm OBJ_MBEDTLS := $(BUILD)/x509_crt_bundle.o -$(patsubst %.c,$(BUILD)/%.o,$(SRC_MBEDTLS))): CFLAGS += -Wno-suggest-attribute=format + +# mbedtls 4.x dispatches PSA crypto through a wrapper layer that is generated from +# jinja templates rather than shipped in the repo, so build it. +# It is the same each time, so we could save it, but this makes updating mbedtls easier. +# +# generate_driver_wrappers.py resolves `mbedtls_framework` relative to its own tree, +# which would mean initializing a third nested submodule (tf-psa-crypto/framework). +# Point PYTHONPATH at the top-level framework submodule instead; mbedtls pins both to +# the same commit. +MBEDTLS_GEN := $(BUILD)/tf-psa-crypto +MBEDTLS_WRAPPERS_H := $(MBEDTLS_GEN)/psa_crypto_driver_wrappers.h +MBEDTLS_WRAPPERS_C := $(MBEDTLS_GEN)/psa_crypto_driver_wrappers_no_static.c + +# The script writes both files at once. Naming both as targets of one rule would run +# it twice; see the same workaround in py/py.mk. +$(MBEDTLS_WRAPPERS_C): $(MBEDTLS_WRAPPERS_H) + @true + +$(MBEDTLS_WRAPPERS_H): $(TOP)/lib/mbedtls/tf-psa-crypto/scripts/generate_driver_wrappers.py + $(STEPECHO) "GEN $@" + $(Q)mkdir -p $(MBEDTLS_GEN) + $(Q)PYTHONPATH=$(TOP)/lib/mbedtls/framework/scripts $(PYTHON) $< $(MBEDTLS_GEN) + +OBJ_MBEDTLS += $(MBEDTLS_WRAPPERS_C:.c=.o) +CFLAGS += -I$(MBEDTLS_GEN) + +# psa_crypto.c and friends #include the generated header, so it has to exist before +# any of them compile. +$(patsubst %.c,$(BUILD)/%.o,$(SRC_MBEDTLS)) $(OBJ_MBEDTLS): $(MBEDTLS_WRAPPERS_H) +# Vendored third-party code, so don't hold it to CircuitPython's warning settings. The +# unused-but-set variables are real but harmless: they are in key-exchange paths that +# are compiled out. +$(patsubst %.c,$(BUILD)/%.o,$(SRC_MBEDTLS)) $(OBJ_MBEDTLS): CFLAGS += \ + -Wno-suggest-attribute=format \ + -Wno-unused-but-set-variable else OBJ_MBEDTLS := endif diff --git a/ports/raspberrypi/supervisor/port.c b/ports/raspberrypi/supervisor/port.c index 555269bb962..617d05f99e5 100644 --- a/ports/raspberrypi/supervisor/port.c +++ b/ports/raspberrypi/supervisor/port.c @@ -29,6 +29,7 @@ #if CIRCUITPY_SSL #include "shared-module/ssl/__init__.h" +#include "psa/crypto.h" #endif #if CIRCUITPY_WIFI @@ -500,6 +501,9 @@ void reset_port(void) { #if CIRCUITPY_SSL ssl_reset(); + + // Done separately from ssl_reset() because ESP-IDF has its own PSA setup. + mbedtls_psa_crypto_free(); #endif #if CIRCUITPY_WATCHDOG diff --git a/py/circuitpy_defns.mk b/py/circuitpy_defns.mk index 7dfb9ae7c7d..955d872c751 100644 --- a/py/circuitpy_defns.mk +++ b/py/circuitpy_defns.mk @@ -944,15 +944,58 @@ $(BUILD)/lib/tjpgd/src/tjpgd.o: CFLAGS += -Wno-shadow -Wno-cast-align endif ifeq ($(CIRCUITPY_HASHLIB_MBEDTLS_ONLY),1) -SRC_MOD += $(addprefix lib/mbedtls/library/, \ - sha1.c \ - sha256.c \ - sha512.c \ - platform_util.c \ - ) +# mbedtls 4.x moved the crypto implementations out of lib/mbedtls/library into the +# tf-psa-crypto submodule and made the legacy mbedtls_sha256_*() headers private, so +# hashlib goes through the PSA hash API. That needs the PSA core, whose driver dispatch +# layer is generated rather than shipped -- see the same rule in ports/raspberrypi/Makefile. +SRC_MOD += \ + $(addprefix lib/mbedtls/tf-psa-crypto/core/, \ + psa_crypto.c \ + psa_crypto_client.c \ + psa_crypto_slot_management.c \ + psa_util.c \ + ) \ + $(addprefix lib/mbedtls/tf-psa-crypto/drivers/builtin/src/, \ + psa_crypto_hash.c \ + psa_util_internal.c \ + sha1.c \ + sha256.c \ + ) \ + $(addprefix lib/mbedtls/tf-psa-crypto/platform/, \ + platform.c \ + platform_util.c \ + ) \ + lib/mbedtls/tf-psa-crypto/utilities/constant_time.c \ + lib/mbedtls_config/hashlib_psa_port.c + +MBEDTLS_HASHLIB_GEN := $(BUILD)/tf-psa-crypto +MBEDTLS_HASHLIB_WRAPPERS_H := $(MBEDTLS_HASHLIB_GEN)/psa_crypto_driver_wrappers.h +MBEDTLS_HASHLIB_WRAPPERS_C := $(MBEDTLS_HASHLIB_GEN)/psa_crypto_driver_wrappers_no_static.c +SRC_MOD += $(MBEDTLS_HASHLIB_WRAPPERS_C:$(BUILD)/%=%) + +# The script writes both files at once; naming both as targets would run it twice. +$(MBEDTLS_HASHLIB_WRAPPERS_C): $(MBEDTLS_HASHLIB_WRAPPERS_H) + @true + +$(MBEDTLS_HASHLIB_WRAPPERS_H): $(TOP)/lib/mbedtls/tf-psa-crypto/scripts/generate_driver_wrappers.py + $(STEPECHO) "GEN $@" + $(Q)mkdir -p $(MBEDTLS_HASHLIB_GEN) + $(Q)PYTHONPATH=$(TOP)/lib/mbedtls/framework/scripts $(PYTHON) $< $(MBEDTLS_HASHLIB_GEN) + +# psa_crypto.c and friends #include the generated header. +$(addprefix $(BUILD)/, $(SRC_MOD:.c=.o)): $(MBEDTLS_HASHLIB_WRAPPERS_H) + CFLAGS += \ - -isystem $(TOP)/lib/mbedtls/include \ - -DMBEDTLS_CONFIG_FILE='"$(TOP)/lib/mbedtls_config/mbedtls_config_hashlib.h"' \ + -I$(MBEDTLS_HASHLIB_GEN) \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/include \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/drivers/builtin/include \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/drivers/builtin/src \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/core \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/dispatch \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/extras \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/platform \ + -isystem $(TOP)/lib/mbedtls/tf-psa-crypto/utilities \ + -DTF_PSA_CRYPTO_CONFIG_FILE='"$(TOP)/lib/mbedtls_config/tf_psa_crypto_config_hashlib.h"' \ endif diff --git a/py/circuitpy_mpconfig.h b/py/circuitpy_mpconfig.h index 381cb9538e4..58d7fe74ea6 100644 --- a/py/circuitpy_mpconfig.h +++ b/py/circuitpy_mpconfig.h @@ -78,7 +78,9 @@ extern void common_hal_mcu_enable_interrupts(void); #define MICROPY_ENABLE_SELECTIVE_COLLECT (1) #define MICROPY_ENABLE_GC (1) #define MICROPY_ENABLE_PYSTACK (1) -#define MICROPY_TRACKED_ALLOC (CIRCUITPY_SSL_MBEDTLS) +// mbedtls allocates through m_tracked_calloc/m_tracked_free. hashlib-only ports need +// them too as of mbedtls 4.x: hashlib uses mbedtls_md_*(), which allocates on the heap. +#define MICROPY_TRACKED_ALLOC (CIRCUITPY_SSL_MBEDTLS || CIRCUITPY_HASHLIB_MBEDTLS_ONLY) #define MICROPY_ENABLE_SOURCE_LINE (1) #define MICROPY_EPOCH_IS_1970 (1) #define MICROPY_ERROR_REPORTING (CIRCUITPY_FULL_BUILD ? MICROPY_ERROR_REPORTING_NORMAL : MICROPY_ERROR_REPORTING_TERSE) diff --git a/requirements-dev.txt b/requirements-dev.txt index aca235d6346..a6fedc4b4af 100644 --- a/requirements-dev.txt +++ b/requirements-dev.txt @@ -3,6 +3,9 @@ cascadetoml jinja2 typer +# for generating mbedtls's PSA driver wrappers (jinja2, above, is also required) +jsonschema + sh click<8.2.0 cpp-coveralls diff --git a/shared-module/hashlib/Hash.c b/shared-module/hashlib/Hash.c index 64fcf2d941f..4b46198ac5d 100644 --- a/shared-module/hashlib/Hash.c +++ b/shared-module/hashlib/Hash.c @@ -7,10 +7,6 @@ #include "shared-bindings/hashlib/Hash.h" #include "shared-module/hashlib/__init__.h" -#include "mbedtls/version.h" - -#if MBEDTLS_VERSION_MAJOR >= 4 - #include "psa/crypto.h" void common_hal_hashlib_hash_update(hashlib_hash_obj_t *self, const uint8_t *data, size_t datalen) { @@ -31,61 +27,3 @@ void common_hal_hashlib_hash_digest(hashlib_hash_obj_t *self, uint8_t *data, siz size_t common_hal_hashlib_hash_get_digest_size(hashlib_hash_obj_t *self) { return PSA_HASH_LENGTH(self->hash_alg); } - -#else - -#include "mbedtls/ssl.h" - -// In mbedtls 2.x, the _ret suffix functions are the recommended API. -// In mbedtls 3.x, the _ret suffix was removed and the base names return int. -#if MBEDTLS_VERSION_MAJOR < 3 -#define SHA1_UPDATE mbedtls_sha1_update_ret -#define SHA1_FINISH mbedtls_sha1_finish_ret -#define SHA256_UPDATE mbedtls_sha256_update_ret -#define SHA256_FINISH mbedtls_sha256_finish_ret -#else -#define SHA1_UPDATE mbedtls_sha1_update -#define SHA1_FINISH mbedtls_sha1_finish -#define SHA256_UPDATE mbedtls_sha256_update -#define SHA256_FINISH mbedtls_sha256_finish -#endif - -void common_hal_hashlib_hash_update(hashlib_hash_obj_t *self, const uint8_t *data, size_t datalen) { - if (self->hash_type == MBEDTLS_SSL_HASH_SHA1) { - SHA1_UPDATE(&self->sha1, data, datalen); - return; - } else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) { - SHA256_UPDATE(&self->sha256, data, datalen); - return; - } -} - -void common_hal_hashlib_hash_digest(hashlib_hash_obj_t *self, uint8_t *data, size_t datalen) { - if (datalen < common_hal_hashlib_hash_get_digest_size(self)) { - return; - } - if (self->hash_type == MBEDTLS_SSL_HASH_SHA1) { - // We copy the sha1 state so we can continue to update if needed or get - // the digest a second time. - mbedtls_sha1_context copy; - mbedtls_sha1_clone(©, &self->sha1); - SHA1_FINISH(&self->sha1, data); - mbedtls_sha1_clone(&self->sha1, ©); - } else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) { - mbedtls_sha256_context copy; - mbedtls_sha256_clone(©, &self->sha256); - SHA256_FINISH(&self->sha256, data); - mbedtls_sha256_clone(&self->sha256, ©); - } -} - -size_t common_hal_hashlib_hash_get_digest_size(hashlib_hash_obj_t *self) { - if (self->hash_type == MBEDTLS_SSL_HASH_SHA1) { - return 20; - } else if (self->hash_type == MBEDTLS_SSL_HASH_SHA256) { - return 32; - } - return 0; -} - -#endif diff --git a/shared-module/hashlib/Hash.h b/shared-module/hashlib/Hash.h index 035368e7c2f..961335eea7a 100644 --- a/shared-module/hashlib/Hash.h +++ b/shared-module/hashlib/Hash.h @@ -6,10 +6,6 @@ #pragma once -#include "mbedtls/version.h" - -#if MBEDTLS_VERSION_MAJOR >= 4 - #include "psa/crypto.h" typedef struct { @@ -17,20 +13,3 @@ typedef struct { psa_hash_operation_t hash_op; psa_algorithm_t hash_alg; } hashlib_hash_obj_t; - -#else - -#include "mbedtls/sha1.h" -#include "mbedtls/sha256.h" - -typedef struct { - mp_obj_base_t base; - union { - mbedtls_sha1_context sha1; - mbedtls_sha256_context sha256; - }; - // Of MBEDTLS_SSL_HASH_* - uint8_t hash_type; -} hashlib_hash_obj_t; - -#endif diff --git a/shared-module/hashlib/__init__.c b/shared-module/hashlib/__init__.c index d2a19386431..50477a4dc2d 100644 --- a/shared-module/hashlib/__init__.c +++ b/shared-module/hashlib/__init__.c @@ -7,10 +7,6 @@ #include "shared-bindings/hashlib/__init__.h" #include "shared-module/hashlib/__init__.h" -#include "mbedtls/version.h" - -#if MBEDTLS_VERSION_MAJOR >= 4 - #include "psa/crypto.h" bool common_hal_hashlib_new(hashlib_hash_obj_t *self, const char *algorithm) { @@ -21,38 +17,12 @@ bool common_hal_hashlib_new(hashlib_hash_obj_t *self, const char *algorithm) { } else { return false; } - self->hash_op = psa_hash_operation_init(); - psa_hash_setup(&self->hash_op, self->hash_alg); - return true; -} - -#else - -#include "mbedtls/ssl.h" - -// In mbedtls 2.x, the _ret suffix functions are the recommended API. -// In mbedtls 3.x, the _ret suffix was removed and the base names return int. -#if MBEDTLS_VERSION_MAJOR < 3 -#define SHA1_STARTS mbedtls_sha1_starts_ret -#define SHA256_STARTS mbedtls_sha256_starts_ret -#else -#define SHA1_STARTS mbedtls_sha1_starts -#define SHA256_STARTS mbedtls_sha256_starts -#endif - -bool common_hal_hashlib_new(hashlib_hash_obj_t *self, const char *algorithm) { - if (strcmp(algorithm, "sha1") == 0) { - self->hash_type = MBEDTLS_SSL_HASH_SHA1; - mbedtls_sha1_init(&self->sha1); - SHA1_STARTS(&self->sha1); - return true; - } else if (strcmp(algorithm, "sha256") == 0) { - self->hash_type = MBEDTLS_SSL_HASH_SHA256; - mbedtls_sha256_init(&self->sha256); - SHA256_STARTS(&self->sha256, 0); - return true; + // PSA has to be initialized before any of it is used. OK to psa_crypto_init() + // multiple times. On espressif, ESP-IDF has already done this during its own system + // init and this call is a no-op. + if (psa_crypto_init() != PSA_SUCCESS) { + return false; } - return false; + self->hash_op = psa_hash_operation_init(); + return psa_hash_setup(&self->hash_op, self->hash_alg) == PSA_SUCCESS; } - -#endif diff --git a/shared-module/hashlib/__init__.h b/shared-module/hashlib/__init__.h index 847bd8a8347..2088d352f20 100644 --- a/shared-module/hashlib/__init__.h +++ b/shared-module/hashlib/__init__.h @@ -6,16 +6,3 @@ // SPDX-License-Identifier: MIT #pragma once - -#include "mbedtls/version.h" - -#if MBEDTLS_VERSION_NUMBER < 0x02070000 || MBEDTLS_VERSION_NUMBER >= 0x03000000 -#define mbedtls_sha1_starts_ret mbedtls_sha1_starts -#define mbedtls_sha1_update_ret mbedtls_sha1_update -#define mbedtls_sha1_finish_ret mbedtls_sha1_finish - -#define mbedtls_sha256_starts_ret mbedtls_sha256_starts -#define mbedtls_sha256_update_ret mbedtls_sha256_update -#define mbedtls_sha256_finish_ret mbedtls_sha256_finish - -#endif diff --git a/shared-module/ssl/SSLContext.c b/shared-module/ssl/SSLContext.c index e58074ea3ea..47e8b9f3149 100644 --- a/shared-module/ssl/SSLContext.c +++ b/shared-module/ssl/SSLContext.c @@ -12,7 +12,15 @@ #include "lib/mbedtls_config/crt_bundle.h" +#include "psa/crypto.h" + void common_hal_ssl_sslcontext_construct(ssl_sslcontext_obj_t *self) { + // TLS is built on PSA crypto, which has to be initialized before any of it is + // used. OK to psa_crypto_init() multiple times. On espressif, ESP-IDF has already done this during + // its own system init and this call is a no-op. + if (psa_crypto_init() != PSA_SUCCESS) { + mp_raise_RuntimeError_varg(MP_ERROR_TEXT("%q init failed"), MP_QSTR_ssl); + } common_hal_ssl_sslcontext_set_default_verify_paths(self); } diff --git a/shared-module/ssl/SSLSocket.c b/shared-module/ssl/SSLSocket.c index 70275945803..0c374da771f 100644 --- a/shared-module/ssl/SSLSocket.c +++ b/shared-module/ssl/SSLSocket.c @@ -28,10 +28,6 @@ #include "../../lib/mbedtls_errors/mp_mbedtls_errors.c" #endif -#if MBEDTLS_VERSION_MAJOR >= 3 -#include "shared-bindings/os/__init__.h" -#endif - #ifdef MBEDTLS_DEBUG_C #include "mbedtls/debug.h" static void mbedtls_debug(void *ctx, int level, const char *file, int line, const char *str) { @@ -200,16 +196,6 @@ static int _mbedtls_ssl_recv(void *ctx, byte *buf, size_t len) { } -#if MBEDTLS_VERSION_MAJOR == 3 -static int urandom_adapter(void *unused, unsigned char *buf, size_t n) { - int result = common_hal_os_urandom(buf, n); - if (result) { - return 0; - } - return MBEDTLS_ERR_SSL_INTERNAL_ERROR; -} -#endif - ssl_sslsocket_obj_t *common_hal_ssl_sslcontext_wrap_socket(ssl_sslcontext_obj_t *self, mp_obj_t socket, bool server_side, const char *server_hostname) { @@ -238,26 +224,12 @@ ssl_sslsocket_obj_t *common_hal_ssl_sslcontext_wrap_socket(ssl_sslcontext_obj_t mbedtls_x509_crt_init(&o->cacert); mbedtls_x509_crt_init(&o->cert); mbedtls_pk_init(&o->pkey); - #if MBEDTLS_VERSION_MAJOR < 4 - mbedtls_ctr_drbg_init(&o->ctr_drbg); - #endif #ifdef MBEDTLS_DEBUG_C // Debug level (0-4) 1=warning, 2=info, 3=debug, 4=verbose mbedtls_debug_set_threshold(4); #endif - #if MBEDTLS_VERSION_MAJOR < 4 - mbedtls_entropy_init(&o->entropy); - const byte seed[] = "upy"; - int ret = mbedtls_ctr_drbg_seed(&o->ctr_drbg, mbedtls_entropy_func, &o->entropy, seed, sizeof(seed)); - if (ret != 0) { - goto cleanup; - } - #else - int ret; - #endif - - ret = mbedtls_ssl_config_defaults(&o->conf, + int ret = mbedtls_ssl_config_defaults(&o->conf, server_side ? MBEDTLS_SSL_IS_SERVER : MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT); @@ -279,9 +251,6 @@ ssl_sslsocket_obj_t *common_hal_ssl_sslcontext_wrap_socket(ssl_sslcontext_obj_t } else { mbedtls_ssl_conf_authmode(&o->conf, MBEDTLS_SSL_VERIFY_NONE); } - #if MBEDTLS_VERSION_MAJOR < 4 - mbedtls_ssl_conf_rng(&o->conf, mbedtls_ctr_drbg_random, &o->ctr_drbg); - #endif #ifdef MBEDTLS_DEBUG_C mbedtls_ssl_conf_dbg(&o->conf, mbedtls_debug, NULL); #endif @@ -301,13 +270,7 @@ ssl_sslsocket_obj_t *common_hal_ssl_sslcontext_wrap_socket(ssl_sslcontext_obj_t mbedtls_ssl_set_bio(&o->ssl, o, _mbedtls_ssl_send, _mbedtls_ssl_recv, NULL); if (self->cert_buf.buf != NULL) { - #if MBEDTLS_VERSION_MAJOR >= 4 - ret = mbedtls_pk_parse_key(&o->pkey, self->key_buf.buf, self->key_buf.len + 1, NULL, 0); - #elif MBEDTLS_VERSION_MAJOR >= 3 - ret = mbedtls_pk_parse_key(&o->pkey, self->key_buf.buf, self->key_buf.len + 1, NULL, 0, urandom_adapter, NULL); - #else ret = mbedtls_pk_parse_key(&o->pkey, self->key_buf.buf, self->key_buf.len + 1, NULL, 0); - #endif if (ret != 0) { goto cleanup; } @@ -328,10 +291,6 @@ ssl_sslsocket_obj_t *common_hal_ssl_sslcontext_wrap_socket(ssl_sslcontext_obj_t mbedtls_x509_crt_free(&o->cacert); mbedtls_ssl_free(&o->ssl); mbedtls_ssl_config_free(&o->conf); - #if MBEDTLS_VERSION_MAJOR < 4 - mbedtls_ctr_drbg_free(&o->ctr_drbg); - mbedtls_entropy_free(&o->entropy); - #endif if (ret == MBEDTLS_ERR_SSL_ALLOC_FAILED) { mp_raise_type(&mp_type_MemoryError); @@ -394,10 +353,6 @@ void common_hal_ssl_sslsocket_close(ssl_sslsocket_obj_t *self) { mbedtls_x509_crt_free(&self->cacert); mbedtls_ssl_free(&self->ssl); mbedtls_ssl_config_free(&self->conf); - #if MBEDTLS_VERSION_MAJOR < 4 - mbedtls_ctr_drbg_free(&self->ctr_drbg); - mbedtls_entropy_free(&self->entropy); - #endif } static void do_handshake(ssl_sslsocket_obj_t *self) { @@ -422,10 +377,6 @@ static void do_handshake(ssl_sslsocket_obj_t *self) { mbedtls_x509_crt_free(&self->cacert); mbedtls_ssl_free(&self->ssl); mbedtls_ssl_config_free(&self->conf); - #if MBEDTLS_VERSION_MAJOR < 4 - mbedtls_ctr_drbg_free(&self->ctr_drbg); - mbedtls_entropy_free(&self->entropy); - #endif if (ret == MBEDTLS_ERR_SSL_ALLOC_FAILED) { mp_raise_type(&mp_type_MemoryError); diff --git a/shared-module/ssl/SSLSocket.h b/shared-module/ssl/SSLSocket.h index 9373734d27c..f3bb858a00d 100644 --- a/shared-module/ssl/SSLSocket.h +++ b/shared-module/ssl/SSLSocket.h @@ -15,20 +15,11 @@ #include "mbedtls/ssl.h" #include "mbedtls/x509_crt.h" #include "mbedtls/pk.h" -#include "mbedtls/version.h" -#if MBEDTLS_VERSION_MAJOR < 4 -#include "mbedtls/entropy.h" -#include "mbedtls/ctr_drbg.h" -#endif typedef struct ssl_sslsocket_obj { mp_obj_base_t base; mp_obj_t sock_obj; ssl_sslcontext_obj_t *ssl_context; - #if MBEDTLS_VERSION_MAJOR < 4 - mbedtls_entropy_context entropy; - mbedtls_ctr_drbg_context ctr_drbg; - #endif mbedtls_ssl_context ssl; mbedtls_ssl_config conf; mbedtls_x509_crt cacert; diff --git a/tools/ci_fetch_deps.py b/tools/ci_fetch_deps.py index 05559ac2d12..8994e54c338 100644 --- a/tools/ci_fetch_deps.py +++ b/tools/ci_fetch_deps.py @@ -144,6 +144,22 @@ def fetch(where): for s in matching_submodules([w for w in where if w.startswith("frozen")]): run(f"Ensure tags exist in {s}", "git fetch --tags --depth 1", cwd=TOP / s) + # mbedtls 4.x keeps its crypto in a nested tf-psa-crypto submodule, and the PSA + # driver-wrapper generator needs the framework submodule. Init them by name rather + # than with --recursive, which would also pull tf-psa-crypto's own framework copy + # and drivers/pqcp/mldsa-native. Those are not needed to build. + # Keyed off the checkout rather than off `where`, because the targets that pull + # lib/mbedtls name it several different ways ("lib/mbedtls/", "lib/", or "." for + # the `all` target). + mbedtls = TOP / "lib" / "mbedtls" + if (mbedtls / ".gitmodules").exists(): + depth_maybe = "" if clone_supports_filter else "--depth 1" + run( + "Init mbedtls nested submodules", + f"git submodule update --init {filter_maybe} {depth_maybe} tf-psa-crypto framework", + cwd=mbedtls, + ) + def set_output(name, value): if "GITHUB_OUTPUT" in os.environ: From b9a6ed5c86615d1c879b995312b34c63a9cc9f51 Mon Sep 17 00:00:00 2001 From: Dan Halbert Date: Thu, 30 Jul 2026 09:07:11 -0400 Subject: [PATCH 2/4] shrink one board; add jsonschema to windows build --- .github/workflows/build.yml | 2 +- ports/raspberrypi/boards/pajenicko_picopad/mpconfigboard.mk | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index bd803a5eb6b..832a4d6097e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -258,7 +258,7 @@ jobs: pip install --break-system-packages wheel # requirements-dev.txt doesn't install on windows. (with msys2 python) # instead, pick a subset for what we want to do - pip install --break-system-packages cascadetoml jinja2 typer click intelhex + pip install --break-system-packages cascadetoml jinja2 typer click intelhex jsonschema # check that installed packages work....? which python; python --version; python -c "import cascadetoml" which python3; python3 --version; python3 -c "import cascadetoml" diff --git a/ports/raspberrypi/boards/pajenicko_picopad/mpconfigboard.mk b/ports/raspberrypi/boards/pajenicko_picopad/mpconfigboard.mk index 1c3801edaac..8a364e4b840 100644 --- a/ports/raspberrypi/boards/pajenicko_picopad/mpconfigboard.mk +++ b/ports/raspberrypi/boards/pajenicko_picopad/mpconfigboard.mk @@ -9,6 +9,8 @@ CHIP_FAMILY = rp2 EXTERNAL_FLASH_DEVICES = "W25Q16JVxQ" +CIRCUITPY_USB_HOST = 0 + CIRCUITPY_KEYPAD = 1 CIRCUITPY_STAGE = 1 CIRCUITPY_AUDIOIO = 1 From a09920aeabdd6f2a844653d42c1e41219d18d59b Mon Sep 17 00:00:00 2001 From: Dan Halbert Date: Thu, 30 Jul 2026 10:09:12 -0400 Subject: [PATCH 3/4] Pin jsonschema<4.18 for the windows build jsonschema 4.18+ pulls in rpds-py, which has no wheel for msys2 python and cannot be built from source there. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 832a4d6097e..f28591e4f56 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -258,7 +258,12 @@ jobs: pip install --break-system-packages wheel # requirements-dev.txt doesn't install on windows. (with msys2 python) # instead, pick a subset for what we want to do - pip install --break-system-packages cascadetoml jinja2 typer click intelhex jsonschema + # jsonschema is needed by mbedtls' generate_driver_wrappers.py. Pin it below 4.18: + # 4.18 and later depend on rpds-py, a Rust extension with no wheel for msys2 python + # (SOABI cpython-3xx-x86_64-cygwin), and maturin refuses to build it from source + # ("Unsupported platform: x86_64-cygwin"). 4.17.3 uses attrs and pyrsistent instead, + # both of which install without a Rust toolchain. + pip install --break-system-packages cascadetoml jinja2 typer click intelhex 'jsonschema<4.18' # check that installed packages work....? which python; python --version; python -c "import cascadetoml" which python3; python3 --version; python3 -c "import cascadetoml" From 5bd36ea2d39a0f7c4b56bc2fa73c11664fe98f29 Mon Sep 17 00:00:00 2001 From: Dan Halbert Date: Thu, 30 Jul 2026 13:34:26 -0400 Subject: [PATCH 4/4] clarify comment for mbedtls_psa_crypto_free() call --- ports/raspberrypi/supervisor/port.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/ports/raspberrypi/supervisor/port.c b/ports/raspberrypi/supervisor/port.c index 617d05f99e5..23a318454ed 100644 --- a/ports/raspberrypi/supervisor/port.c +++ b/ports/raspberrypi/supervisor/port.c @@ -502,7 +502,12 @@ void reset_port(void) { #if CIRCUITPY_SSL ssl_reset(); - // Done separately from ssl_reset() because ESP-IDF has its own PSA setup. + // For raspberrypi, we must free PSA crypto, because there are GC-heap objects + // in the key slots. We can't put this call in ssl_reset() because that's a + // shared-module implementation. Unlike raspberrypi, espressif ESP-IDF inits PSA + // once at boot and would never re-init it. + // common_hal_ssl_sslcontext_construct() re-inits PSA on demand. + // So for raspberrypi, we must call mbedtls_psa_crypto_free() explicitly. mbedtls_psa_crypto_free(); #endif