Skip to content

Commit da51cc4

Browse files
Max Fillingercron2
authored andcommitted
Drop Mbed TLS 2.X compatibility
Mbed TLS 2.28 is out of support since March and adding support for Mbed TLS 4 will get ugly enough without the old compatibility code lying around too. Mbed TLS 2.28 still ships on some supported distributions (e.g. Ubuntu 24.04) but nobody is maintaining openvpn-mbedtls packages there. This commit will probably break on some test machines. Change-Id: Ia4afabcb6006dc9304a4c09f824d9c7c2d4d64ad Signed-off-by: Max Fillinger <maximilian.fillinger@sentyron.com> Acked-by: Frank Lichtenheld <frank@lichtenheld.com> Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1412 Message-Id: <20251201133956.29880-1-gert@greenie.muc.de> Signed-off-by: Gert Doering <gert@greenie.muc.de>
1 parent bcc7fb2 commit da51cc4

File tree

11 files changed

+42
-331
lines changed

11 files changed

+42
-331
lines changed

.github/workflows/build.yaml

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -136,21 +136,16 @@ jobs:
136136
fail-fast: false
137137
matrix:
138138
os: [ubuntu-22.04, ubuntu-24.04]
139-
sslpkg: [libmbedtls-dev]
140-
ssllib: [mbedtls]
141-
libname: [mbed TLS]
139+
sslpkg: [libssl-dev]
140+
ssllib: [openssl]
142141

143142
include:
144143
- os: ubuntu-22.04
145-
sslpkg: "libssl-dev"
146144
libname: OpenSSL 3.0.2
147-
ssllib: openssl
148145
pkcs11pkg: "libpkcs11-helper1-dev softhsm2 gnutls-bin"
149146
extraconf: --enable-pkcs11
150147
- os: ubuntu-24.04
151-
sslpkg: "libssl-dev"
152148
libname: OpenSSL 3.0.13
153-
ssllib: openssl
154149
pkcs11pkg: "libpkcs11-helper1-dev softhsm2 gnutls-bin"
155150
extraconf: --enable-pkcs11
156151

@@ -182,7 +177,7 @@ jobs:
182177
fail-fast: false
183178
matrix:
184179
os: [ubuntu-22.04, ubuntu-24.04]
185-
ssllib: [mbedtls, openssl]
180+
ssllib: [openssl]
186181

187182
name: "clang-asan - ${{matrix.os}} - ${{matrix.ssllib}}"
188183

@@ -192,7 +187,7 @@ jobs:
192187
runs-on: ${{matrix.os}}
193188
steps:
194189
- name: Install dependencies
195-
run: sudo apt update && sudo apt install -y liblzo2-dev libpam0g-dev liblz4-dev libcap-ng-dev libnl-genl-3-dev linux-libc-dev man2html clang libcmocka-dev python3-docutils libtool automake autoconf libmbedtls-dev
190+
run: sudo apt update && sudo apt install -y liblzo2-dev libpam0g-dev liblz4-dev libcap-ng-dev libnl-genl-3-dev linux-libc-dev man2html clang libcmocka-dev python3-docutils libtool automake autoconf
196191
- name: Checkout OpenVPN
197192
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
198193
- name: autoconf

CMakeLists.txt

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -300,10 +300,6 @@ function(check_mbed_configuration)
300300
set(CMAKE_REQUIRED_LINK_OPTIONS "-L${MBED_LIBRARY_PATH}")
301301
endif ()
302302
set(CMAKE_REQUIRED_LIBRARIES "mbedtls;mbedx509;mbedcrypto")
303-
check_symbol_exists(mbedtls_ctr_drbg_update_ret mbedtls/ctr_drbg.h HAVE_MBEDTLS_CTR_DRBG_UPDATE_RET)
304-
check_symbol_exists(mbedtls_ssl_conf_export_keys_ext_cb mbedtls/ssl.h HAVE_MBEDTLS_SSL_CONF_EXPORT_KEYS_EXT_CB)
305-
check_symbol_exists(mbedtls_ssl_set_export_keys_cb mbedtls/ssl.h HAVE_MBEDTLS_SSL_SET_EXPORT_KEYS_CB)
306-
check_symbol_exists(mbedtls_ssl_tls_prf mbedtls/ssl.h HAVE_MBEDTLS_SSL_TLS_PRF)
307303
check_include_files(psa/crypto.h HAVE_PSA_CRYPTO_H)
308304
endfunction()
309305

Changes.rst

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -217,10 +217,11 @@ OpenSSL 1.0.2 support has been removed.
217217
Support for building with OpenSSL 1.0.2 has been removed. The minimum
218218
supported OpenSSL version is now 1.1.0.
219219

220-
Support for mbedTLS older than 2.18.0 has been removed.
221-
We now require all SSL libraries to have support for exporting
222-
keying material. The only previously supported library versions
223-
this affects are older mbedTLS releases.
220+
mbedTLS 2.x support has been removed
221+
Support for building with mbedTLS 2.x has been removed (it is out
222+
of support since March 2025, and the necessary compatibility code
223+
is making maintenance and support for mbedTLS 4.x hard).
224+
The minimum supported mbedTLS version is now 3.2.1.
224225

225226
Compression on send has been removed.
226227
OpenVPN 2.7 will never compress data before sending. Decompression of

README.mbedtls

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,8 @@ To build and install,
77
make
88
make install
99

10-
This version requires mbed TLS version >= 2.0.0 or >= 3.2.1.
10+
This version requires mbed TLS version >= 3.2.1. Versions >= 4.0.0 are not
11+
yet supported. Support for TLS 1.3 requires an Mbed TLS version >= 3.6.4.
1112

1213
*************************************************************************
1314

@@ -23,12 +24,3 @@ Plugin/Script features:
2324

2425
* X.509 subject line has a different format than the OpenSSL subject line
2526
* X.509 certificate tracking
26-
27-
*************************************************************************
28-
29-
Mbed TLS 3 has implemented TLS 1.3, but support in OpenVPN requires the
30-
function mbedtls_ssl_export_keying_material() which is currently not in
31-
any released version. It is available when building mbed TLS from source
32-
(mbedtls-3.6 or development branch).
33-
34-
Without this function, only TLS 1.2 is available.

config.h.cmake.in

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -340,10 +340,6 @@
340340

341341
/* Availability of different mbed TLS features and APIs */
342342
#cmakedefine HAVE_PSA_CRYPTO_H
343-
#cmakedefine HAVE_MBEDTLS_SSL_SET_EXPORT_KEYS_CB
344-
#cmakedefine HAVE_MBEDTLS_SSL_CONF_EXPORT_KEYS_EXT_CB
345-
#cmakedefine HAVE_MBEDTLS_CTR_DRBG_UPDATE_RET
346-
#cmakedefine HAVE_MBEDTLS_SSL_TLS_PRF
347343

348344
/* Path to ifconfig tool */
349345
#define IFCONFIG_PATH "@IFCONFIG_PATH@"

configure.ac

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -913,7 +913,7 @@ elif test "${with_crypto_library}" = "mbedtls"; then
913913
if test -z "${MBEDTLS_CFLAGS}" -a -z "${MBEDTLS_LIBS}"; then
914914
# if the user did not explicitly specify flags, try to autodetect
915915
PKG_CHECK_MODULES([MBEDTLS],
916-
[mbedtls >= 2.0.0 mbedx509 >= 2.0.0 mbedcrypto >= 2.0.0],
916+
[mbedtls >= 3.2.1 mbedx509 >= 3.2.1 mbedcrypto >= 3.2.1],
917917
[have_mbedtls="yes"],
918918
[LIBS="${LIBS} -lmbedtls -lmbedx509 -lmbedcrypto"]
919919
)
@@ -938,35 +938,17 @@ elif test "${with_crypto_library}" = "mbedtls"; then
938938
#include <mbedtls/version.h>
939939
]],
940940
[[
941-
#if MBEDTLS_VERSION_NUMBER < 0x02000000 || (MBEDTLS_VERSION_NUMBER >= 0x03000000 && MBEDTLS_VERSION_NUMBER < 0x03020100)
941+
#if MBEDTLS_VERSION_NUMBER < 0x03020100
942942
#error invalid version
943943
#endif
944944
]]
945945
)],
946946
[AC_MSG_RESULT([ok])],
947-
[AC_MSG_ERROR([mbed TLS version >= 2.0.0 or >= 3.2.1 required])]
947+
[AC_MSG_ERROR([mbed TLS version >= 3.2.1 required])]
948948
)
949949

950950
AC_CHECK_HEADERS(psa/crypto.h)
951951

952-
AC_CHECK_FUNCS([mbedtls_ssl_tls_prf mbedtls_ssl_conf_export_keys_ext_cb])
953-
954-
if test "x$ac_cv_func_mbedtls_ssl_conf_export_keys_ext_cb" != xyes; then
955-
AC_CHECK_FUNCS([mbedtls_ssl_set_export_keys_cb])
956-
if test "x$ac_cv_func_mbedtls_ssl_set_export_keys_cb" != xyes; then
957-
AC_CHECK_FUNC([mbedtls_ssl_export_keying_material])
958-
if test "x$ac_cv_func_mbedtls_ssl_export_keying_material" != xyes; then
959-
AC_MSG_ERROR(This version of mbed TLS has no support for exporting key material.)
960-
fi
961-
fi
962-
fi
963-
964-
AC_CHECK_FUNC(
965-
[mbedtls_ctr_drbg_update_ret],
966-
AC_DEFINE([HAVE_MBEDTLS_CTR_DRBG_UPDATE_RET], [1],
967-
[Use mbedtls_ctr_drbg_update_ret from mbed TLS]),
968-
)
969-
970952
CFLAGS="${saved_CFLAGS}"
971953
LIBS="${saved_LIBS}"
972954
AC_DEFINE([ENABLE_CRYPTO_MBEDTLS], [1], [Use mbed TLS library])

src/openvpn/crypto_mbedtls.c

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@
4141
#include "integer.h"
4242
#include "crypto_backend.h"
4343
#include "otime.h"
44-
#include "mbedtls_compat.h"
4544
#include "misc.h"
4645

4746
#include <mbedtls/base64.h>
@@ -987,17 +986,7 @@ memcmp_constant_time(const void *a, const void *b, size_t size)
987986

988987
return diff;
989988
}
990-
/* mbedtls-2.18.0 or newer implements tls_prf, but prf_tls1 is removed
991-
* from recent versions, so we use our own implementation if necessary. */
992-
#if defined(HAVE_MBEDTLS_SSL_TLS_PRF) && defined(MBEDTLS_SSL_TLS_PRF_TLS1)
993-
bool
994-
ssl_tls1_PRF(const uint8_t *seed, size_t seed_len, const uint8_t *secret, size_t secret_len,
995-
uint8_t *output, size_t output_len)
996-
{
997-
return mbed_ok(mbedtls_ssl_tls_prf(MBEDTLS_SSL_TLS_PRF_TLS1, secret, secret_len, "", seed,
998-
seed_len, output, output_len));
999-
}
1000-
#else /* defined(HAVE_MBEDTLS_SSL_TLS_PRF) && defined(MBEDTLS_SSL_TLS_PRF_TLS1) */
989+
1001990
#if defined(__GNUC__) || defined(__clang__)
1002991
#pragma GCC diagnostic push
1003992
#pragma GCC diagnostic ignored "-Wconversion"
@@ -1135,6 +1124,5 @@ ssl_tls1_PRF(const uint8_t *label, size_t label_len, const uint8_t *sec, size_t
11351124
#if defined(__GNUC__) || defined(__clang__)
11361125
#pragma GCC diagnostic pop
11371126
#endif
1138-
#endif /* HAVE_MBEDTLS_SSL_TLS_PRF && defined(MBEDTLS_SSL_TLS_PRF_TLS1) */
11391127

11401128
#endif /* ENABLE_CRYPTO_MBEDTLS */

src/openvpn/mbedtls_compat.h

Lines changed: 2 additions & 179 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,8 @@
2323
/**
2424
* @file
2525
* mbedtls compatibility stub.
26-
* This file provide compatibility stubs for the mbedtls libraries
27-
* prior to version 3. This version made most fields in structs private
28-
* and requires accessor functions to be used. For earlier versions, we
29-
* implement the accessor functions here.
26+
* This file provides compatibility stubs to handle API differences between
27+
* different versions of Mbed TLS.
3028
*/
3129

3230
#ifndef MBEDTLS_COMPAT_H_
@@ -36,27 +34,10 @@
3634

3735
#include "errlevel.h"
3836

39-
#include <mbedtls/cipher.h>
40-
#include <mbedtls/ctr_drbg.h>
41-
#include <mbedtls/dhm.h>
42-
#include <mbedtls/ecp.h>
43-
#include <mbedtls/md.h>
44-
#include <mbedtls/pem.h>
45-
#include <mbedtls/pk.h>
46-
#include <mbedtls/ssl.h>
47-
#include <mbedtls/version.h>
48-
#include <mbedtls/x509_crt.h>
49-
5037
#ifdef HAVE_PSA_CRYPTO_H
5138
#include <psa/crypto.h>
5239
#endif
5340

54-
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
55-
typedef uint16_t mbedtls_compat_group_id;
56-
#else
57-
typedef mbedtls_ecp_group_id mbedtls_compat_group_id;
58-
#endif
59-
6041
static inline void
6142
mbedtls_compat_psa_crypto_init(void)
6243
{
@@ -70,162 +51,4 @@ mbedtls_compat_psa_crypto_init(void)
7051
#endif
7152
}
7253

73-
static inline mbedtls_compat_group_id
74-
mbedtls_compat_get_group_id(const mbedtls_ecp_curve_info *curve_info)
75-
{
76-
#if MBEDTLS_VERSION_NUMBER >= 0x03000000
77-
return curve_info->tls_id;
78-
#else
79-
return curve_info->grp_id;
80-
#endif
81-
}
82-
83-
/*
84-
* In older versions of mbedtls, mbedtls_ctr_drbg_update() did not return an
85-
* error code, and it was deprecated in favor of mbedtls_ctr_drbg_update_ret()
86-
* which does.
87-
*
88-
* In mbedtls 3, this function was removed and mbedtls_ctr_drbg_update() returns
89-
* an error code.
90-
*/
91-
static inline int
92-
mbedtls_compat_ctr_drbg_update(mbedtls_ctr_drbg_context *ctx, const unsigned char *additional,
93-
size_t add_len)
94-
{
95-
#if MBEDTLS_VERSION_NUMBER > 0x03000000
96-
return mbedtls_ctr_drbg_update(ctx, additional, add_len);
97-
#elif defined(HAVE_MBEDTLS_CTR_DRBG_UPDATE_RET)
98-
return mbedtls_ctr_drbg_update_ret(ctx, additional, add_len);
99-
#else
100-
mbedtls_ctr_drbg_update(ctx, additional, add_len);
101-
return 0;
102-
#endif /* HAVE_MBEDTLS_CTR_DRBG_UPDATE_RET */
103-
}
104-
105-
static inline int
106-
mbedtls_compat_pk_check_pair(const mbedtls_pk_context *pub, const mbedtls_pk_context *prv,
107-
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
108-
{
109-
#if MBEDTLS_VERSION_NUMBER < 0x03020100
110-
return mbedtls_pk_check_pair(pub, prv);
111-
#else
112-
return mbedtls_pk_check_pair(pub, prv, f_rng, p_rng);
113-
#endif /* MBEDTLS_VERSION_NUMBER < 0x03020100 */
114-
}
115-
116-
static inline int
117-
mbedtls_compat_pk_parse_key(mbedtls_pk_context *ctx, const unsigned char *key, size_t keylen,
118-
const unsigned char *pwd, size_t pwdlen,
119-
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
120-
{
121-
#if MBEDTLS_VERSION_NUMBER < 0x03020100
122-
return mbedtls_pk_parse_key(ctx, key, keylen, pwd, pwdlen);
123-
#else
124-
return mbedtls_pk_parse_key(ctx, key, keylen, pwd, pwdlen, f_rng, p_rng);
125-
#endif
126-
}
127-
128-
static inline int
129-
mbedtls_compat_pk_parse_keyfile(mbedtls_pk_context *ctx, const char *path, const char *password,
130-
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
131-
{
132-
#if MBEDTLS_VERSION_NUMBER < 0x03020100
133-
return mbedtls_pk_parse_keyfile(ctx, path, password);
134-
#else
135-
return mbedtls_pk_parse_keyfile(ctx, path, password, f_rng, p_rng);
136-
#endif
137-
}
138-
139-
#if MBEDTLS_VERSION_NUMBER < 0x03020100
140-
typedef enum
141-
{
142-
MBEDTLS_SSL_VERSION_UNKNOWN, /*!< Context not in use or version not yet negotiated. */
143-
MBEDTLS_SSL_VERSION_TLS1_2 = 0x0303, /*!< (D)TLS 1.2 */
144-
MBEDTLS_SSL_VERSION_TLS1_3 = 0x0304, /*!< (D)TLS 1.3 */
145-
} mbedtls_ssl_protocol_version;
146-
147-
static inline void
148-
mbedtls_ssl_conf_min_tls_version(mbedtls_ssl_config *conf, mbedtls_ssl_protocol_version tls_version)
149-
{
150-
int major = (tls_version >> 8) & 0xff;
151-
int minor = tls_version & 0xff;
152-
mbedtls_ssl_conf_min_version(conf, major, minor);
153-
}
154-
155-
static inline void
156-
mbedtls_ssl_conf_max_tls_version(mbedtls_ssl_config *conf, mbedtls_ssl_protocol_version tls_version)
157-
{
158-
int major = (tls_version >> 8) & 0xff;
159-
int minor = tls_version & 0xff;
160-
mbedtls_ssl_conf_max_version(conf, major, minor);
161-
}
162-
163-
static inline void
164-
mbedtls_ssl_conf_groups(mbedtls_ssl_config *conf, mbedtls_compat_group_id *groups)
165-
{
166-
mbedtls_ssl_conf_curves(conf, groups);
167-
}
168-
169-
static inline size_t
170-
mbedtls_cipher_info_get_block_size(const mbedtls_cipher_info_t *cipher)
171-
{
172-
return (size_t)cipher->block_size;
173-
}
174-
175-
static inline size_t
176-
mbedtls_cipher_info_get_iv_size(const mbedtls_cipher_info_t *cipher)
177-
{
178-
return (size_t)cipher->iv_size;
179-
}
180-
181-
static inline size_t
182-
mbedtls_cipher_info_get_key_bitlen(const mbedtls_cipher_info_t *cipher)
183-
{
184-
return (size_t)cipher->key_bitlen;
185-
}
186-
187-
static inline mbedtls_cipher_mode_t
188-
mbedtls_cipher_info_get_mode(const mbedtls_cipher_info_t *cipher)
189-
{
190-
return cipher->mode;
191-
}
192-
193-
static inline const char *
194-
mbedtls_cipher_info_get_name(const mbedtls_cipher_info_t *cipher)
195-
{
196-
return cipher->name;
197-
}
198-
199-
static inline mbedtls_cipher_type_t
200-
mbedtls_cipher_info_get_type(const mbedtls_cipher_info_t *cipher)
201-
{
202-
return cipher->type;
203-
}
204-
205-
static inline size_t
206-
mbedtls_dhm_get_bitlen(const mbedtls_dhm_context *ctx)
207-
{
208-
return 8 * ctx->len;
209-
}
210-
211-
static inline const mbedtls_md_info_t *
212-
mbedtls_md_info_from_ctx(const mbedtls_md_context_t *ctx)
213-
{
214-
return ctx->md_info;
215-
}
216-
217-
static inline const unsigned char *
218-
mbedtls_pem_get_buffer(const mbedtls_pem_context *ctx, size_t *buf_size)
219-
{
220-
*buf_size = ctx->buflen;
221-
return ctx->buf;
222-
}
223-
224-
static inline int
225-
mbedtls_x509_crt_has_ext_type(const mbedtls_x509_crt *ctx, int ext_type)
226-
{
227-
return ctx->ext_types & ext_type;
228-
}
229-
#endif /* MBEDTLS_VERSION_NUMBER < 0x03020100 */
230-
23154
#endif /* MBEDTLS_COMPAT_H_ */

0 commit comments

Comments
 (0)