Repository navigation
The mbedtls submodule targets an old, unsupported branch #11355
Description
Activity
@dpgeorge in the meantime an update to
mbedtls-2.28wouldn't be a bad idea, it was pretty straightforward i.e.
just a git check-out and including/removing some components inextmod.*make files.diff --git a/extmod/extmod.cmake b/extmod/extmod.cmake index 7cf16fa1b..b053b3aef 100644 --- a/extmod/extmod.cmake +++ b/extmod/extmod.cmake @@ -154,7 +154,7 @@ if(MICROPY_SSL_MBEDTLS) ${MICROPY_LIB_MBEDTLS_DIR}/library/md4.c ${MICROPY_LIB_MBEDTLS_DIR}/library/md5.c ${MICROPY_LIB_MBEDTLS_DIR}/library/md.c - ${MICROPY_LIB_MBEDTLS_DIR}/library/md_wrap.c ${MICROPY_LIB_MBEDTLS_DIR}/library/oid.c ${MICROPY_LIB_MBEDTLS_DIR}/library/padlock.c ${MICROPY_LIB_MBEDTLS_DIR}/library/pem.c @@ -179,9 +179,11 @@ if(MICROPY_SSL_MBEDTLS) ${MICROPY_LIB_MBEDTLS_DIR}/library/ssl_cli.c ${MICROPY_LIB_MBEDTLS_DIR}/library/ssl_cookie.c ${MICROPY_LIB_MBEDTLS_DIR}/library/ssl_srv.c + ${MICROPY_LIB_MBEDTLS_DIR}/library/ssl_msg.c ${MICROPY_LIB_MBEDTLS_DIR}/library/ssl_ticket.c ${MICROPY_LIB_MBEDTLS_DIR}/library/ssl_tls.c ${MICROPY_LIB_MBEDTLS_DIR}/library/timing.c + ${MICROPY_LIB_MBEDTLS_DIR}/library/constant_time.c ${MICROPY_LIB_MBEDTLS_DIR}/library/x509.c ${MICROPY_LIB_MBEDTLS_DIR}/library/x509_create.c ${MICROPY_LIB_MBEDTLS_DIR}/library/x509_crl.c diff --git a/extmod/extmod.mk b/extmod/extmod.mk index e895c8169..259ceea91 100644 --- a/extmod/extmod.mk +++ b/extmod/extmod.mk @@ -172,7 +172,6 @@ SRC_THIRDPARTY_C += $(addprefix $(MBEDTLS_DIR)/library/,\ md4.c \ md5.c \ md.c \ - md_wrap.c \ oid.c \ padlock.c \ pem.c \ @@ -197,9 +196,11 @@ SRC_THIRDPARTY_C += $(addprefix $(MBEDTLS_DIR)/library/,\ ssl_cli.c \ ssl_cookie.c \ ssl_srv.c \ + ssl_msg.c \ ssl_ticket.c \ ssl_tls.c \ timing.c \ + constant_time.c \ x509.c \ x509_create.c \ x509_crl.c \
All tests seem OK too. 👍🏼 (Tested with ports
unixandesp32@esp-idfv4.4)Thanks, that's an improvement. But why 2.28.1? That's the long-time support branch, but not the latest release in that branch. The latest long-time support release, including security fixes, is currently 2.28.3.
MicroPython now uses mbedtls v3.5.1.
Micropython currently pulls in Mbed TLS at commit https://github.com/ARMmbed/mbedtls/tree/1bc2c9cb8b8fe4659bd94b8ebba5a4c02029b7fa which is from the Mbed TLS 2.16 branch. Support for Mbed TLS 2.16 ended in January 2022. An old branch of a security library is very likely to have known vulnerabilities.
Please upgrade to a maintained version of Mbed TLS. At the moment, the choices are:
mbedtls-2.28— long-time support branch, only getting bug fixes. We plan to support this branch until December 2024. APIs are fully compatible with 2.16.development— development branch, with new features (which can mean an increase in code size). This is a new major version of Mbed TLS (3.x series) compared to the current one, so some application code may need to be rewritten due to API changes.Furthermore, in the future, to avoid shipping software that embeds a library version which may have known vulnerabilities, please upgrade Mbed TLS regularly. Releases ship through GitHub and are announced on the mbed-tls-announce mailing list.