mbedtls4

Author: lws-team

cmake/lws_config.h.in

@@ -216,6 +216,7 @@
 #cmakedefine LWS_WITH_LWSAC
 #cmakedefine LWS_LOGS_TIMESTAMP
 #cmakedefine LWS_WITH_MBEDTLS
+#cmakedefine LWS_HAVE_MBEDTLS_V4
 #cmakedefine LWS_WITH_BEARSSL
 #cmakedefine LWS_WITH_SCHANNEL
 #cmakedefine LWS_WITH_GNUTLS

include/libwebsockets.h

@@ -411,8 +411,10 @@ typedef void X509_VERIFY_PARAM;
 
 #if defined(LWS_WITH_TLS)
 #include <mbedtls/ssl.h>
+#if !defined(LWS_HAVE_MBEDTLS_V4)
 #include <mbedtls/entropy.h>
 #include <mbedtls/ctr_drbg.h>
+#endif
 #include <mbedtls/version.h>
 
 #if !defined(MBEDTLS_PRIVATE)
@@ -907,10 +909,14 @@ lws_fx_string(const lws_fx_t *a, char *buf, size_t size);
 #include <libwebsockets/lws-quic.h>
 
 #if defined(LWS_WITH_MBEDTLS)
+#if !defined(LWS_HAVE_MBEDTLS_V4)
 #include <mbedtls/md5.h>
 #include <mbedtls/sha1.h>
 #include <mbedtls/sha256.h>
 #include <mbedtls/sha512.h>
+#else
+#include <psa/crypto.h>
+#endif
 #endif
 #if defined(LWS_WITH_BEARSSL)
 #include <bearssl.h>

include/libwebsockets/lws-genaes.h

@@ -34,8 +34,12 @@
 ///@{
 
 #if defined(LWS_WITH_MBEDTLS)
+#if !defined(LWS_HAVE_MBEDTLS_V4)
 #include <mbedtls/aes.h>
 #include <mbedtls/gcm.h>
+#else
+#include <psa/crypto.h>
+#endif
 #endif
 
 enum enum_aes_modes {
@@ -67,13 +71,20 @@ enum enum_aes_padding {
 
 struct lws_genaes_ctx {
 #if defined(LWS_WITH_MBEDTLS)
+#if !defined(LWS_HAVE_MBEDTLS_V4)
 	union {
 		mbedtls_aes_context ctx;
 #if defined(MBEDTLS_CIPHER_MODE_XTS)
 		mbedtls_aes_xts_context ctx_xts;
 #endif
 		mbedtls_gcm_context ctx_gcm;
 	} u;
+#else
+	psa_key_id_t key_id;
+	psa_algorithm_t alg;
+	psa_cipher_operation_t cipher_ctx;
+	psa_aead_operation_t aead_ctx;
+#endif
 #elif defined(LWS_WITH_SCHANNEL)
 	struct {
 		void *hAlg;

include/libwebsockets/lws-genchacha.h

@@ -28,7 +28,11 @@
 #include <stdint.h>
 
 #if defined(LWS_WITH_MBEDTLS)
+#if !defined(LWS_HAVE_MBEDTLS_V4)
 #include <mbedtls/chachapoly.h>
+#else
+#include <psa/crypto.h>
+#endif
 #endif
 
 /*! \defgroup generic chacha

include/libwebsockets/lws-gendtls.h

@@ -37,8 +37,10 @@
 
 #if defined(LWS_WITH_MBEDTLS)
 #include <mbedtls/ssl.h>
+#if !defined(LWS_HAVE_MBEDTLS_V4)
 #include <mbedtls/entropy.h>
 #include <mbedtls/ctr_drbg.h>
+#endif
 #include <mbedtls/ssl_cookie.h>
 #elif defined(LWS_WITH_GNUTLS)
 #include <gnutls/gnutls.h>

include/libwebsockets/lws-genec.h

@@ -32,10 +32,17 @@ enum enum_genec_alg {
 
 struct lws_genec_ctx {
 #if defined(LWS_WITH_MBEDTLS)
+#if !defined(LWS_HAVE_MBEDTLS_V4)
 	union {
 		mbedtls_ecdh_context *ctx_ecdh;
 		mbedtls_ecdsa_context *ctx_ecdsa;
 	} u;
+#else
+	psa_key_id_t key_id;
+	psa_algorithm_t alg;
+	uint8_t *peer_key;
+	size_t peer_key_len;
+#endif
 #elif defined(LWS_WITH_SCHANNEL)
 	struct {
 		void *hAlg;
@@ -60,7 +67,7 @@ struct lws_genec_ctx {
 	char has_private;
 };
 
-#if defined(LWS_WITH_MBEDTLS)
+#if defined(LWS_WITH_MBEDTLS) && !defined(LWS_HAVE_MBEDTLS_V4)
 enum enum_lws_dh_side {
 	LDHS_OURS = MBEDTLS_ECDH_OURS,
 	LDHS_THEIRS = MBEDTLS_ECDH_THEIRS

include/libwebsockets/lws-genhash.h

@@ -40,6 +40,10 @@
 #include <openssl/hmac.h>
 #endif
 
+#if defined(LWS_HAVE_MBEDTLS_V4)
+#include <psa/crypto.h>
+#endif
+
 
 enum lws_genhash_types {
 	LWS_GENHASH_TYPE_UNKNOWN,
@@ -65,13 +69,17 @@ enum lws_genhmac_types {
 struct lws_genhash_ctx {
         uint8_t type;
 #if defined(LWS_WITH_MBEDTLS)
+#if defined(LWS_HAVE_MBEDTLS_V4)
+	psa_hash_operation_t hash_ctx;
+#else
         union {
 		mbedtls_md5_context md5;
         	mbedtls_sha1_context sha1;
 		mbedtls_sha256_context sha256;
 		mbedtls_sha512_context sha512; /* 384 also uses this */
 		const mbedtls_md_info_t *hmac;
         } u;
+#endif
 #elif defined(LWS_WITH_SCHANNEL)
 	struct {
 		void *hAlg;
@@ -98,8 +106,13 @@ struct lws_genhash_ctx {
 struct lws_genhmac_ctx {
         uint8_t type;
 #if defined(LWS_WITH_MBEDTLS)
+#if defined(LWS_HAVE_MBEDTLS_V4)
+	psa_mac_operation_t mac_ctx;
+	psa_key_id_t key_id;
+#else
 	const mbedtls_md_info_t *hmac;
 	mbedtls_md_context_t ctx;
+#endif
 #elif defined(LWS_WITH_SCHANNEL)
 	struct {
 		void *hAlg;

include/libwebsockets/lws-genrsa.h

@@ -44,7 +44,11 @@ enum enum_genrsa_mode {
 
 struct lws_genrsa_ctx {
 #if defined(LWS_WITH_MBEDTLS)
+#if !defined(LWS_HAVE_MBEDTLS_V4)
 	mbedtls_rsa_context *ctx;
+#else
+	psa_key_id_t key_id;
+#endif
 #elif defined(LWS_WITH_SCHANNEL)
 	struct {
 		void *hAlg;

lib/core/context.c

@@ -855,7 +855,11 @@ lws_create_context(const struct lws_context_creation_info *info)
 		char mbedtls_version[32];
 
 #if defined(MBEDTLS_VERSION_C)
+#if defined(LWS_HAVE_MBEDTLS_V4)
+		lws_snprintf(mbedtls_version, sizeof(mbedtls_version), "%s", mbedtls_version_get_string());
+#else
 		mbedtls_version_get_string(mbedtls_version);
+#endif
 #else
 		lws_snprintf(mbedtls_version, sizeof(mbedtls_version), "%s", MBEDTLS_VERSION_STRING);
 #endif

lib/core/private-lib-core.h

@@ -693,7 +693,7 @@ struct lws_context {
 	const char *username, *groupname;
 #endif
 
-#if defined(LWS_WITH_MBEDTLS)
+#if defined(LWS_WITH_MBEDTLS) && !defined(LWS_HAVE_MBEDTLS_V4)
 	mbedtls_entropy_context mec;
 	mbedtls_ctr_drbg_context mcdc;
 #endif