diff mbox series

[Openvpn-devel,v2] mbedtls: Work-around bug in mbedtls 4.1.0 and 4.2.0

Message ID 20260828201757.744-1-gert@greenie.muc.de
State New
Headers
Series [Openvpn-devel,v2] mbedtls: Work-around bug in mbedtls 4.1.0 and 4.2.0 |

Commit Message

Gert Doering Aug. 28, 2026, 8:17 p.m. UTC 
  From: Frank Lichtenheld <frank@lichtenheld.com>

Since the first distros have started to pick up these
versions before a fix is released, let's make our tests
pass on these versions.

A fix is merged, so it might be fixed in 4.3.0. But I
didn't want to add that to the version check until we
have verified that.

Change-Id: I694410615958afbb422d9ead71f04c1a60edc640
Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1849
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1849
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Razvan Cojocaru <razvanc@mailbox.org>

Comments

Gert Doering Aug. 30, 2026, 4:43 p.m. UTC | #1 
Thanks for that... :-)  (I have no idea what is the bug here, but it fixes
the mbedTLS 4.1 self test failures, so it must be good :-) ).

Tested via Gerrit/BB and GHA (mbedTLS 4.2.0).

Your patch has been applied to the master and release/2.7 branch
(long-term compat).

commit 5f6f272a11b64cf93513a54ef8b07d34ff2bd89e (master)
commit 2c825c240ac1fba639258bc304ee5c019c5a0b1c (release/2.7)
Author: Frank Lichtenheld
Date:   Fri Aug 28 22:17:50 2026 +0200

     mbedtls: Work-around bug in mbedtls 4.1.0 and 4.2.0

     Signed-off-by: Frank Lichtenheld <frank@lichtenheld.com>
     Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
     Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1849
     Message-Id: <20260828201757.744-1-gert@greenie.muc.de>
     URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg38802.html
     Signed-off-by: Gert Doering <gert@greenie.muc.de>


--
kind regards,

Gert Doering
diff mbox series

Patch

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 29e8be2a..56dd3ed 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -365,7 +365,7 @@ 
       ovpnlibdesc: mbed TLS 4.
       # versioning=semver-coerced
       ghrepo: Mbed-TLS/mbedtls
-      gitref: v4.0.0
+      gitref: v4.2.0
       libconfigure: cmake -B build -DCMAKE_INSTALL_PREFIX=$LIBPREFIX
       libmake: cmake --build build
       libinstall: sudo cmake --install build
diff --git a/src/openvpn/mbedtls_compat.h b/src/openvpn/mbedtls_compat.h
index 50739b6..ec45a0f 100644
--- a/src/openvpn/mbedtls_compat.h
+++ b/src/openvpn/mbedtls_compat.h
@@ -43,6 +43,7 @@ 
 #include "crypto_mbedtls_legacy.h"
 #else
 #include <mbedtls/oid.h>
+#include "crypto_mbedtls.h"
 #endif /* MBEDTLS_VERSION_NUMBER < 0x04000000 */
 
 #ifdef HAVE_PSA_CRYPTO_H
@@ -228,6 +229,18 @@ 
 mbedtls_compat_pk_check_pair(const mbedtls_pk_context *pub, const mbedtls_pk_context *prv)
 {
 #if MBEDTLS_VERSION_NUMBER >= 0x04000000
+    /* work around bug in mbedtls 4.1.0 by adding missing public key information in prv
+     * cf. https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/807 */
+#if MBEDTLS_VERSION_NUMBER >= 0x04010000
+    if (prv->MBEDTLS_PRIVATE(pub_raw_len) == 0)
+    {
+        mbedtls_pk_context *mut_prv = (mbedtls_pk_context *)prv; /* remove const */
+        ASSERT(mbed_ok(psa_export_public_key(mut_prv->MBEDTLS_PRIVATE(priv_id),
+                                             mut_prv->MBEDTLS_PRIVATE(pub_raw),
+                                             sizeof(mut_prv->MBEDTLS_PRIVATE(pub_raw)),
+                                             &mut_prv->MBEDTLS_PRIVATE(pub_raw_len))));
+    }
+#endif
     return mbedtls_pk_check_pair(pub, prv);
 #else
     return mbedtls_pk_check_pair(pub, prv, mbedtls_ctr_drbg_random, rand_ctx_get());