* [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
@ 2024-04-16 18:59 Raymond Mao
2024-04-16 18:59 ` [PATCH 03/23] mbedtls: add mbedtls into the build system Raymond Mao
` (23 more replies)
0 siblings, 24 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 18:59 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Integrate MbedTLS v3.6 LTS (currently v3.6.0-RC1) with U-Boot.
Patch 01 and 02 are for introducing MbedTLS release package.
I have to split it into 2 parts due to the size limitation of Gmail.
Motivations:
1. MbedTLS is well maintained with LTS versions.
2. LWIP is integrated with MbedTLS and easily to enable HTTPS.
3. MbedTLS recently switched license back to GPLv2.
New Kconfig options:
`MBEDTLS_LIB` is for MbedTLS general switch.
`MBEDTLS_LIB_CRYPTO` is for replacing original digest and crypto libs with
MbedTLS.
`MBEDTLS_LIB_X509` is for replacing original X509, PKCS7, MSCode, ASN1,
and Pubkey parser with MbedTLS.
`MBEDTLS_LIB_TLS` is for SSL/TLS (Disabled until LWIP port for MbedTLS is
ready)
In this patch set, MBEDTLS_LIB, MBEDTLS_LIB_CRYPTO and MBEDTLS_LIB_X509
are by default enabled in qemu_arm64_defconfig for testing purpose.
Since U-Boot uses Microsoft Authentication Code to verify PE/COFFs
executables which is not supported by MbedTLS at the moment,
addtional patches for MbedTLS are created to adapt with the EFI loader:
1. Decoding of Microsoft Authentication Code.
2. Decoding of PKCS#9 Authenticate Attributes.
3. Extending MbedTLS PKCS#7 lib to support multiple signer's certificates.
4. MbedTLS native test suites for PKCS#7 signer's info.
All above 4 patches (tagged with `mbedtls/external`) are submitted to
MbedTLS project and being reviewed, eventually they should be part of
MbedTLS release.
See below PR for the reference:
https://github.com/Mbed-TLS/mbedtls/pull/9001
Minor fixes for arm EFI linker script and pytest script for testing EFI
secure boot.
Optimized MbedTLS library size by tailoring the config file.
After disabling all unnecessary features for EFI loader, enabling MbedTLS
increases U-Boot size by 6.03%.
Please see the output of bloat-o-meter for the reference [1].
Notes:
With current patch set we still build the original libs (rsa,
asn1_decoder, rsa_helper, md5, sha1, sha256, sha512) for those components
other than EFI loader.
They totally takes about 3% of U-Boot size.
So if we replace above libs completely, eventually U-Boot size will just
increase by about 3% when enabling MbedTLS.
In this patch set, MbedTLS is introduced by committing complete code base
instead of using git submodule, just in order to compliant with the
approach currently we have in U-Boot.
But I would strongly suggest to move this to git submodule as we can save
many efforts when updating the MbedTLS release later by only changing the
submodule commit ID.
Tests done:
EFI Secure Boot test (EFI variables loading and verifying, EFI signed image
verifying and booting) via U-Boot console.
EFI Secure Boot sandbox test passed.
Known issues:
Sanbox tests asn1 and efi_capsule failed when MbedTLS is enabled.
[1]: bloat-o-meter output between disabling/enabling MbedTLS
```
add/remove: 231/69 grow/shrink: 12/5 up/down: 60196/-11166 (49030)
Function old new delta
mbedtls_internal_sha1_process - 4540 +4540
mbedtls_x509_crt_parse_der_internal - 3072 +3072
mbedtls_internal_md5_process - 2928 +2928
mbedtls_internal_sha256_process - 2052 +2052
mbedtls_pkcs7_parse_der - 1608 +1608
mbedtls_rsa_private - 1468 +1468
pkcs7_parse_message 372 1612 +1240
mbedtls_mpi_div_mpi - 1168 +1168
mbedtls_internal_sha512_process - 1056 +1056
mbedtls_mpi_inv_mod - 1000 +1000
mbedtls_x509_dn_gets - 996 +996
x509_populate_cert - 948 +948
K - 896 +896
oid_x520_attr_type - 840 +840
__udivti3 - 832 +832
mbedtls_x509_get_rsassa_pss_params - 748 +748
mbedtls_x509_parse_subject_alt_name - 724 +724
mbedtls_rsa_deduce_primes - 720 +720
mbedtls_mpi_exp_mod - 668 +668
mbedtls_rsa_rsaes_oaep_decrypt - 664 +664
mbedtls_rsa_rsaes_pkcs1_v15_decrypt - 652 +652
pkcs7_get_signer_info - 632 +632
mbedtls_rsa_complete - 624 +624
mbedtls_rsa_validate_params - 608 +608
mbedtls_mpi_core_exp_mod - 560 +560
mbedtls_sha512_finish - 556 +556
mscode_parse 28 580 +552
mbedtls_x509_get_time - 552 +552
rsa_rsassa_pss_sign_no_mode_check - 516 +516
mbedtls_x509_get_name - 516 +516
mbedtls_rsa_rsassa_pss_verify_ext - 492 +492
mbedtls_sha256_finish - 484 +484
mbedtls_rsa_validate_crt - 464 +464
mbedtls_mpi_core_mla - 460 +460
rsa_rsassa_pkcs1_v15_encode - 420 +420
mbedtls_sha1_finish - 420 +420
mbedtls_rsa_rsaes_oaep_encrypt - 404 +404
mbedtls_mpi_gcd - 400 +400
oid_x509_ext - 360 +360
mgf_mask - 352 +352
mbedtls_x509_get_subject_alt_name_ext - 348 +348
mbedtls_sha512_starts - 340 +340
mbedtls_mpi_mul_mpi - 340 +340
mbedtls_rsa_rsassa_pkcs1_v15_sign - 336 +336
mbedtls_oid_get_numeric_string - 336 +336
mbedtls_md5_finish - 336 +336
mbedtls_pk_parse_subpubkey - 328 +328
oid_sig_alg - 320 +320
mbedtls_rsa_deduce_private_exponent - 312 +312
rsa_check_context.isra - 300 +300
mbedtls_rsa_rsaes_pkcs1_v15_encrypt - 288 +288
mbedtls_rsa_parse_pubkey - 284 +284
mbedtls_mpi_sub_abs - 284 +284
mbedtls_md_setup - 280 +280
mbedtls_mpi_core_montmul - 276 +276
mbedtls_rsa_rsassa_pkcs1_v15_verify - 268 +268
mbedtls_asn1_traverse_sequence_of - 268 +268
mbedtls_sha512_update - 264 +264
mbedtls_asn1_get_alg - 256 +256
mbedtls_sha256_update - 252 +252
mbedtls_mpi_add_abs - 248 +248
oid_md_alg - 240 +240
mbedtls_sha1_update - 236 +236
mbedtls_rsa_deduce_crt - 236 +236
mbedtls_md5_update - 236 +236
hash_mprime - 236 +236
mbedtls_rsa_import_raw - 232 +232
mbedtls_ct_memcpy_if - 228 +228
mbedtls_mpi_copy - 220 +220
mbedtls_x509_get_sig_alg - 216 +216
mbedtls_mpi_cmp_mpi - 212 +212
mbedtls_mpi_shrink - 208 +208
mbedtls_ct_memmove_left - 208 +208
mbedtls_rsa_public - 204 +204
rsa_sign_wrap - 196 +196
mbedtls_pk_parse_public_key - 196 +196
asn1_get_tagged_int - 196 +196
mbedtls_mpi_mul_int - 184 +184
mbedtls_mpi_core_write_be - 184 +184
mbedtls_md_free - 184 +184
mbedtls_pk_verify_restartable - 180 +180
mbedtls_mpi_mod_mpi - 180 +180
mbedtls_asn1_get_len - 180 +180
pk_get_pk_alg.isra - 176 +176
mbedtls_mpi_core_fill_random - 176 +176
mbedtls_x509_crt_free - 172 +172
x509_populate_pubkey - 164 +164
rsa_verify_wrap - 164 +164
mbedtls_mpi_core_shift_r - 164 +164
oid_pk_alg - 160 +160
mbedtls_ct_zeroize_if - 156 +156
rsa_encrypt_wrap - 152 +152
rsa_decrypt_wrap - 152 +152
mbedtls_mpi_cmp_abs - 152 +152
add_sub_mpi - 152 +152
mbedtls_sha512 - 148 +148
mbedtls_rsa_check_privkey - 148 +148
mbedtls_mpi_core_shift_l - 148 +148
mbedtls_x509_get_ext - 144 +144
mbedtls_x509_crl_free - 144 +144
mbedtls_mpi_grow - 144 +144
mbedtls_mpi_core_read_be - 144 +144
mbedtls_md5 - 144 +144
mbedtls_x509_get_serial - 140 +140
mbedtls_sha256 - 140 +140
mbedtls_asn1_write_len - 140 +140
pkcs7_get_one_cert - 136 +136
mbedtls_rsa_free - 136 +136
mbedtls_rsa_check_pubkey - 136 +136
mbedtls_x509_get_key_usage - 128 +128
mbedtls_asn1_get_bitstring - 128 +128
mbedtls_sha256_starts - 124 +124
mbedtls_sha1 - 124 +124
mbedtls_mpi_core_mul - 124 +124
mbedtls_asn1_get_alg_null - 124 +124
mbedtls_x509_get_sig - 120 +120
mbedtls_pkcs7_free - 120 +120
mbedtls_oid_get_x509_ext_type - 120 +120
mbedtls_oid_get_pk_alg - 120 +120
mbedtls_oid_get_md_alg - 120 +120
mbedtls_oid_get_attr_short_name - 120 +120
mbedtls_x509_get_subject_alt_name - 116 +116
mbedtls_md_starts - 116 +116
asn1_get_sequence_of_cb - 116 +116
mbedtls_x509_get_ns_cert_type - 108 +108
mbedtls_mpi_resize_clear - 108 +108
mbedtls_mpi_lset - 108 +108
mbedtls_mpi_fill_random - 108 +108
mbedtls_md - 108 +108
mbedtls_asn1_get_sequence_of - 108 +108
mbedtls_mpi_core_get_mont_r2_unsafe - 104 +104
oid_sig_alg_from_asn1 - 100 +100
mbedtls_mpi_shift_l - 100 +100
public_key_verify_signature 312 408 +96
mbedtls_rsa_info - 96 +96
mbedtls_pk_setup - 96 +96
mbedtls_mpi_read_binary - 96 +96
mbedtls_md_update - 96 +96
mbedtls_md_finish - 96 +96
mbedtls_rsa_check_pub_priv - 92 +92
mbedtls_mpi_lsb - 92 +92
mbedtls_asn1_get_bool - 92 +92
mbedtls_rsa_pkcs1_decrypt - 84 +84
mbedtls_mpi_core_bigendian_to_host - 84 +84
mbedtls_mpi_core_bitlen - 76 +76
mbedtls_asn1_get_bitstring_null - 76 +76
x509_free_mbedtls_ctx.part - 72 +72
mbedtls_sha1_starts - 72 +72
mbedtls_mpi_core_cond_assign - 72 +72
CSWTCH 1266 1338 +72
x509_populate_dn_name_string - 68 +68
mbedtls_pk_free - 68 +68
mbedtls_oid_get_sig_alg - 68 +68
mbedtls_mpi_free - 68 +68
mbedtls_mpi_core_sub - 68 +68
mbedtls_mpi_core_check_zero_ct - 68 +68
pkcs7_free_signer_info - 64 +64
pkcs7_free_message 124 188 +64
mbedtls_oid_get_oid_by_md - 64 +64
rsa_debug - 60 +60
mbedtls_mpi_sub_int - 60 +60
mbedtls_mpi_core_add - 60 +60
mbedtls_mpi_cmp_int - 60 +60
mbedtls_mpi_add_int - 60 +60
mbedtls_md5_starts - 60 +60
hash_init_sha512 52 112 +60
hash_init_sha256 52 112 +60
mbedtls_platform_zeroize - 56 +56
mbedtls_asn1_get_tag - 56 +56
rsa_alloc_wrap - 52 +52
mbedtls_rsa_pkcs1_verify - 52 +52
mbedtls_rsa_pkcs1_sign - 52 +52
mbedtls_rsa_pkcs1_encrypt - 52 +52
mbedtls_mpi_shift_r - 52 +52
mbedtls_mpi_core_montmul_init - 52 +52
mbedtls_mpi_core_from_mont_rep - 52 +52
mbedtls_mpi_core_clz - 52 +52
mbedtls_ct_memcmp - 52 +52
mbedtls_mpi_core_sub_int - 48 +48
mbedtls_asn1_write_tag - 48 +48
mbedtls_asn1_sequence_free - 48 +48
mbedtls_asn1_free_named_data_list_shallow - 48 +48
mbedtls_rsa_rsassa_pss_verify - 44 +44
mbedtls_rsa_rsassa_pss_sign - 44 +44
mbedtls_rsa_init - 44 +44
mbedtls_mpi_get_bit - 44 +44
hash_init_sha1 52 96 +44
x509_parse2_int - 40 +40
mbedtls_zeroize_and_free - 40 +40
mbedtls_mpi_core_exp_mod_working_limbs - 40 +40
rsa_free_wrap - 36 +36
mbedtls_md_info_from_type - 36 +36
mbedtls_x509_get_alg_null - 32 +32
mbedtls_x509_get_alg - 32 +32
mbedtls_pk_get_type - 28 +28
mbedtls_mpi_size - 28 +28
mbedtls_mpi_core_to_mont_rep - 28 +28
x509_get_timestamp - 24 +24
mbedtls_x509_free_subject_alt_name - 24 +24
mbedtls_pk_info_from_type - 20 +20
mbedtls_mpi_write_binary - 20 +20
mbedtls_md_get_size - 20 +20
rsa_can_do - 16 +16
mbedtls_x509_crt_parse_der - 16 +16
mbedtls_sha512_free - 16 +16
mbedtls_sha256_free - 16 +16
mbedtls_sha1_free - 16 +16
mbedtls_mpi_init - 16 +16
mbedtls_md5_free - 16 +16
hash_finish_sha512 72 88 +16
hash_finish_sha256 72 88 +16
hash_finish_sha1 72 88 +16
x509_free_certificate 88 100 +12
sha512_csum_wd_mb - 12 +12
sha384_csum_wd_mb - 12 +12
sha256_csum_wd_mb - 12 +12
rsa_check_pair_wrap - 12 +12
mbedtls_x509_crt_init - 12 +12
mbedtls_sha512_init - 12 +12
mbedtls_sha256_init - 12 +12
mbedtls_sha1_init - 12 +12
mbedtls_pkcs7_init - 12 +12
mbedtls_mpi_bitlen - 12 +12
mbedtls_md_init - 12 +12
mbedtls_md5_init - 12 +12
mbedtls_asn1_get_int - 12 +12
sha1_csum_wd_mb - 8 +8
rsa_get_bitlen - 8 +8
mpi_bigendian_to_host - 8 +8
memset_func - 8 +8
md5_wd_mb - 8 +8
mbedtls_sha512_info - 8 +8
mbedtls_sha384_info - 8 +8
mbedtls_sha256_info - 8 +8
mbedtls_sha1_info - 8 +8
mbedtls_rsa_get_len - 8 +8
mbedtls_rsa_get_bitlen - 8 +8
mbedtls_pk_verify - 8 +8
mbedtls_pk_init - 8 +8
mbedtls_mpi_sub_mpi - 8 +8
mbedtls_mpi_add_mpi - 8 +8
mbedtls_md5_info - 8 +8
mbedtls_ct_zero - 8 +8
version_string 70 64 -6
x509_note_not_before 12 - -12
x509_note_not_after 12 - -12
month_lengths 12 - -12
x509_akid_note_name 16 - -16
pkcs7_sig_note_skid 16 - -16
pkcs7_sig_note_serial 16 - -16
pkcs7_sig_note_issuer 16 - -16
pkcs7_check_content_type 20 - -20
hash_update_sha512 36 16 -20
hash_update_sha256 36 16 -20
hash_update_sha1 36 16 -20
x509_note_serial 24 - -24
x509_decoder 24 - -24
x509_akid_decoder 24 - -24
pkcs7_decoder 24 - -24
mscode_machine 24 - -24
mscode_decoder 24 - -24
mscode_action_table 24 - -24
x509_note_subject 28 - -28
x509_note_issuer 28 - -28
x509_note_tbs_certificate 32 - -32
pkcs7_note_data 32 - -32
hash_update_sha384 36 - -36
x509_note_params 40 - -40
x509_akid_action_table 40 - -40
pkcs7_note_content 40 - -40
pkcs7_note_signeddata_version 48 - -48
pkcs7_note_certificate_list 48 - -48
hash_init_sha384 52 - -52
MD5Init 56 - -56
sha512_csum_wd 68 - -68
sha384_csum_wd 68 - -68
sha256_csum_wd 68 - -68
sha1_csum_wd 68 - -68
md5_wd 68 - -68
mscode_note_digest 72 - -72
hash_finish_sha384 72 - -72
pkcs7_sig_note_set_of_authattrs 84 - -84
x509_note_OID 92 - -92
x509_akid_note_serial 92 - -92
x509_akid_note_kid 92 - -92
pkcs7_sig_note_pkey_algo 92 - -92
x509_akid_machine 93 - -93
x509_extract_name_segment 96 - -96
pkcs7_note_signerinfo_version 96 - -96
pkcs7_sig_note_signature 100 - -100
x509_action_table 104 - -104
x509_machine 113 - -113
x509_extract_key_data 116 - -116
pkcs7_note_OID 116 - -116
pkcs7_extract_cert 116 - -116
mscode_note_content_type 132 - -132
pkcs7_action_table 136 - -136
oid_index 150 - -150
x509_process_extension 168 - -168
x509_note_signature 172 - -172
MD5Final 196 - -196
pkcs7_note_signed_info 216 - -216
pkcs7_machine 239 - -239
pkcs7_sig_note_digest_algo 244 - -244
look_up_OID 244 - -244
sprint_oid 260 - -260
MD5Update 260 - -260
mscode_note_digest_algo 280 - -280
oid_search_table 296 - -296
x509_cert_parse 408 108 -300
x509_get_sig_params 304 - -304
pkcs7_sig_note_authenticated_attr 316 - -316
x509_note_pkey_algo 336 - -336
x509_fabricate_name.isra 460 - -460
oid_data 513 - -513
x509_decode_time 672 - -672
MD5Transform 2552 - -2552
Total: Before=812633, After=861663, chg +6.03%
```
Raymond Mao (23):
mbedtls/external: add MbedTLS (Part 1)
mbedtls/external: add MbedTLS (Part 2)
mbedtls: add mbedtls into the build system
arm: EFI linker script text section alignment
test: py: add sudo for virt-make-fs
image: remove redundant hash includes
efi_loader: remove redundant hash includes
mbedtls: add hash shim layer
hash: integrate hash on mbedtls
makefile: add mbedtls include directories
efi_loader: switch sha256 to mbedtls
image: switch sha256 to mbedtls
mbedtls/external: support MicroSoft Authentication Code
mbedtls/external: support PKCS9 Authenticate Attributes
mbedtls/external: support decoding multiple signer's cert
mbedtls/external: update MbedTLS PKCS7 test suites
lib/crypto: Port public_key on MbedTLS
lib/crypto: Port x509_cert_parser on MbedTLS
lib/crypto: port PKCS7 parser on MbedTLS
lib/crypto: port MSCode parser on MbedTLS
lib/crypto: remove dependence on ASN1 decoder
mbedtls: disable the unused features
configs: enable MbedTLS as default setting
Makefile | 13 +
arch/arm/lib/elf_aarch64_efi.lds | 1 +
boot/image-fit.c | 4 -
boot/image-pre-load.c | 10 +-
boot/image.c | 2 -
common/hash.c | 161 +
configs/qemu_arm64_defconfig | 5 +
configs/sandbox_defconfig | 4 +
include/crypto/mscode.h | 4 +
include/crypto/pkcs7_parser.h | 56 +
include/crypto/public_key.h | 6 +
include/crypto/x509_parser.h | 34 +
include/mbedtls/md5.h | 18 +
include/mbedtls/sha1.h | 27 +
include/mbedtls/sha256.h | 31 +
include/mbedtls/sha512.h | 39 +
include/stdio.h | 1 +
include/stdlib.h | 1 +
include/u-boot/hash-checksum.h | 6 +
lib/Kconfig | 4 +
lib/Makefile | 2 +
lib/crypto/Makefile | 19 +-
lib/crypto/asymmetric_type.c | 2 +-
lib/crypto/mscode_parser.c | 104 +
lib/crypto/pkcs7_parser.c | 482 +-
lib/crypto/public_key.c | 75 +
lib/crypto/x509_cert_parser.c | 430 +
lib/efi_loader/efi_signature.c | 1 -
lib/efi_loader/efi_tcg2.c | 12 +-
lib/mbedtls/Kconfig | 25 +
lib/mbedtls/Makefile | 120 +
lib/mbedtls/external/mbedtls/.gitignore | 69 +
.../external/mbedtls/3rdparty/.gitignore | 1 +
.../external/mbedtls/3rdparty/CMakeLists.txt | 2 +
.../external/mbedtls/3rdparty/Makefile.inc | 3 +
.../mbedtls/3rdparty/everest/.gitignore | 1 +
.../mbedtls/3rdparty/everest/CMakeLists.txt | 42 +
.../mbedtls/3rdparty/everest/Makefile.inc | 6 +
.../mbedtls/3rdparty/everest/README.md | 5 +
.../everest/include/everest/Hacl_Curve25519.h | 21 +
.../everest/include/everest/everest.h | 234 +
.../everest/include/everest/kremlib.h | 29 +
.../include/everest/kremlib/FStar_UInt128.h | 124 +
...64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h | 280 +
.../include/everest/kremlin/c_endianness.h | 204 +
.../everest/kremlin/internal/builtin.h | 16 +
.../everest/kremlin/internal/callconv.h | 46 +
.../include/everest/kremlin/internal/compat.h | 34 +
.../include/everest/kremlin/internal/debug.h | 57 +
.../include/everest/kremlin/internal/target.h | 102 +
.../include/everest/kremlin/internal/types.h | 61 +
.../everest/kremlin/internal/wasmsupport.h | 5 +
.../include/everest/vs2013/Hacl_Curve25519.h | 21 +
.../everest/include/everest/vs2013/inttypes.h | 36 +
.../everest/include/everest/vs2013/stdbool.h | 31 +
.../3rdparty/everest/include/everest/x25519.h | 190 +
.../everest/library/Hacl_Curve25519.c | 760 +
.../everest/library/Hacl_Curve25519_joined.c | 50 +
.../3rdparty/everest/library/everest.c | 102 +
.../library/kremlib/FStar_UInt128_extracted.c | 413 +
...64_FStar_UInt32_FStar_UInt16_FStar_UInt8.c | 100 +
.../everest/library/legacy/Hacl_Curve25519.c | 805 +
.../mbedtls/3rdparty/everest/library/x25519.c | 186 +
.../mbedtls/3rdparty/p256-m/CMakeLists.txt | 40 +
.../mbedtls/3rdparty/p256-m/Makefile.inc | 5 +
.../mbedtls/3rdparty/p256-m/README.md | 4 +
.../mbedtls/3rdparty/p256-m/p256-m/README.md | 544 +
.../mbedtls/3rdparty/p256-m/p256-m/p256-m.c | 1514 +
.../mbedtls/3rdparty/p256-m/p256-m/p256-m.h | 135 +
.../p256-m/p256-m_driver_entrypoints.c | 312 +
.../p256-m/p256-m_driver_entrypoints.h | 219 +
lib/mbedtls/external/mbedtls/BRANCHES.md | 115 +
lib/mbedtls/external/mbedtls/BUGS.md | 20 +
lib/mbedtls/external/mbedtls/CMakeLists.txt | 429 +
lib/mbedtls/external/mbedtls/CONTRIBUTING.md | 97 +
lib/mbedtls/external/mbedtls/ChangeLog | 6108 +++
.../external/mbedtls/ChangeLog.d/00README.md | 91 +
.../external/mbedtls/DartConfiguration.tcl | 4 +
lib/mbedtls/external/mbedtls/LICENSE | 553 +
lib/mbedtls/external/mbedtls/Makefile | 217 +
lib/mbedtls/external/mbedtls/README.md | 333 +
lib/mbedtls/external/mbedtls/SECURITY.md | 146 +
lib/mbedtls/external/mbedtls/SUPPORT.md | 16 +
.../mbedtls/cmake/MbedTLSConfig.cmake.in | 3 +
.../external/mbedtls/configs/README.txt | 24 +
.../mbedtls/configs/config-ccm-psk-dtls1_2.h | 92 +
.../mbedtls/configs/config-ccm-psk-tls1_2.h | 83 +
.../mbedtls/configs/config-no-entropy.h | 73 +
.../external/mbedtls/configs/config-suite-b.h | 106 +
.../mbedtls/configs/config-symmetric-only.h | 77 +
.../external/mbedtls/configs/config-tfm.h | 68 +
.../external/mbedtls/configs/config-thread.h | 76 +
.../configs/crypto-config-ccm-aes-sha256.h | 25 +
.../external/mbedtls/configs/ext/README.md | 25 +
.../external/mbedtls/configs/ext/config_tfm.h | 13 +
.../ext/crypto_config_profile_medium.h | 132 +
.../ext/mbedtls_entropy_nv_seed_config.h | 13 +
.../tfm_mbedcrypto_config_profile_medium.h | 573 +
lib/mbedtls/external/mbedtls/dco.txt | 37 +
lib/mbedtls/external/mbedtls/docs/.gitignore | 4 +
.../mbedtls/docs/3.0-migration-guide.md | 1039 +
lib/mbedtls/external/mbedtls/docs/Makefile | 40 +
.../mbedtls/docs/architecture/Makefile | 21 +
.../alternative-implementations.md | 91 +
.../mbed-crypto-storage-specification.md | 467 +
.../psa-crypto-implementation-structure.md | 175 +
.../psa-migration/md-cipher-dispatch.md | 616 +
.../psa-migration/outcome-analysis.sh | 140 +
.../psa-migration/psa-legacy-bridges.md | 344 +
.../psa-migration/psa-limitations.md | 337 +
.../architecture/psa-migration/strategy.md | 486 +
.../docs/architecture/psa-migration/syms.sh | 73 +
.../architecture/psa-migration/testing.md | 99 +
.../docs/architecture/psa-shared-memory.md | 685 +
.../architecture/psa-storage-resilience.md | 536 +
.../key-slot-state-transitions.png | Bin 0 -> 50367 bytes
.../psa-thread-safety/psa-thread-safety.md | 367 +
.../testing/driver-interface-test-strategy.md | 133 +
.../architecture/testing/invasive-testing.md | 367 +
.../testing/psa-storage-format-testing.md | 127 +
.../architecture/testing/test-framework.md | 64 +
.../docs/architecture/tls13-support.md | 435 +
lib/mbedtls/external/mbedtls/docs/conf.py | 34 +
.../mbedtls/docs/driver-only-builds.md | 460 +
lib/mbedtls/external/mbedtls/docs/index.rst | 20 +
.../external/mbedtls/docs/proposed/Makefile | 25 +
.../external/mbedtls/docs/proposed/README | 4 +
.../proposed/psa-conditional-inclusion-c.md | 253 +
.../proposed/psa-driver-developer-guide.md | 52 +
.../proposed/psa-driver-integration-guide.md | 39 +
.../docs/proposed/psa-driver-interface.md | 1460 +
...driver-wrappers-codegen-migration-guide.md | 40 +
.../docs/psa-driver-example-and-guide.md | 180 +
.../external/mbedtls/docs/psa-transition.md | 1322 +
.../external/mbedtls/docs/redirects.yaml | 11 +
.../external/mbedtls/docs/requirements.in | 3 +
.../external/mbedtls/docs/requirements.txt | 82 +
.../external/mbedtls/docs/tls13-early-data.md | 192 +
.../external/mbedtls/docs/use-psa-crypto.md | 174 +
.../mbedtls/doxygen/input/doc_encdec.h | 54 +
.../mbedtls/doxygen/input/doc_hashing.h | 30 +
.../mbedtls/doxygen/input/doc_mainpage.h | 19 +
.../external/mbedtls/doxygen/input/doc_rng.h | 27 +
.../mbedtls/doxygen/input/doc_ssltls.h | 37 +
.../mbedtls/doxygen/input/doc_tcpip.h | 32 +
.../external/mbedtls/doxygen/input/doc_x509.h | 31 +
.../external/mbedtls/doxygen/mbedtls.doxyfile | 55 +
.../external/mbedtls/include/.gitignore | 4 +
.../external/mbedtls/include/CMakeLists.txt | 22 +
.../external/mbedtls/include/mbedtls/aes.h | 631 +
.../external/mbedtls/include/mbedtls/aria.h | 343 +
.../external/mbedtls/include/mbedtls/asn1.h | 642 +
.../mbedtls/include/mbedtls/asn1write.h | 390 +
.../external/mbedtls/include/mbedtls/base64.h | 82 +
.../external/mbedtls/include/mbedtls/bignum.h | 1084 +
.../mbedtls/include/mbedtls/block_cipher.h | 76 +
.../mbedtls/include/mbedtls/build_info.h | 176 +
.../mbedtls/include/mbedtls/camellia.h | 305 +
.../external/mbedtls/include/mbedtls/ccm.h | 526 +
.../mbedtls/include/mbedtls/chacha20.h | 202 +
.../mbedtls/include/mbedtls/chachapoly.h | 342 +
.../mbedtls/include/mbedtls/check_config.h | 1127 +
.../external/mbedtls/include/mbedtls/cipher.h | 1173 +
.../external/mbedtls/include/mbedtls/cmac.h | 246 +
.../mbedtls/include/mbedtls/compat-2.x.h | 46 +
.../mbedtls/config_adjust_legacy_crypto.h | 457 +
.../mbedtls/config_adjust_legacy_from_psa.h | 888 +
.../mbedtls/config_adjust_psa_from_legacy.h | 349 +
.../config_adjust_psa_superset_legacy.h | 142 +
.../include/mbedtls/config_adjust_ssl.h | 81 +
.../include/mbedtls/config_adjust_x509.h | 25 +
.../mbedtls/include/mbedtls/config_psa.h | 55 +
.../mbedtls/include/mbedtls/constant_time.h | 36 +
.../mbedtls/include/mbedtls/ctr_drbg.h | 582 +
.../external/mbedtls/include/mbedtls/debug.h | 156 +
.../external/mbedtls/include/mbedtls/des.h | 385 +
.../external/mbedtls/include/mbedtls/dhm.h | 972 +
.../external/mbedtls/include/mbedtls/ecdh.h | 454 +
.../external/mbedtls/include/mbedtls/ecdsa.h | 671 +
.../mbedtls/include/mbedtls/ecjpake.h | 298 +
.../external/mbedtls/include/mbedtls/ecp.h | 1528 +
.../mbedtls/include/mbedtls/entropy.h | 273 +
.../external/mbedtls/include/mbedtls/error.h | 201 +
.../external/mbedtls/include/mbedtls/gcm.h | 384 +
.../external/mbedtls/include/mbedtls/hkdf.h | 124 +
.../mbedtls/include/mbedtls/hmac_drbg.h | 434 +
.../external/mbedtls/include/mbedtls/lms.h | 440 +
.../mbedtls/include/mbedtls/mbedtls_config.h | 4211 ++
.../external/mbedtls/include/mbedtls/md.h | 526 +
.../external/mbedtls/include/mbedtls/md5.h | 190 +
.../include/mbedtls/memory_buffer_alloc.h | 142 +
.../mbedtls/include/mbedtls/net_sockets.h | 299 +
.../mbedtls/include/mbedtls/nist_kw.h | 166 +
.../external/mbedtls/include/mbedtls/oid.h | 762 +
.../external/mbedtls/include/mbedtls/pem.h | 160 +
.../external/mbedtls/include/mbedtls/pk.h | 1288 +
.../external/mbedtls/include/mbedtls/pkcs12.h | 186 +
.../external/mbedtls/include/mbedtls/pkcs5.h | 198 +
.../external/mbedtls/include/mbedtls/pkcs7.h | 261 +
.../mbedtls/include/mbedtls/platform.h | 485 +
.../mbedtls/include/mbedtls/platform_time.h | 79 +
.../mbedtls/include/mbedtls/platform_util.h | 197 +
.../mbedtls/include/mbedtls/poly1305.h | 168 +
.../mbedtls/include/mbedtls/private_access.h | 20 +
.../mbedtls/include/mbedtls/psa_util.h | 188 +
.../mbedtls/include/mbedtls/ripemd160.h | 136 +
.../external/mbedtls/include/mbedtls/rsa.h | 1164 +
.../external/mbedtls/include/mbedtls/sha1.h | 219 +
.../external/mbedtls/include/mbedtls/sha256.h | 200 +
.../external/mbedtls/include/mbedtls/sha3.h | 172 +
.../external/mbedtls/include/mbedtls/sha512.h | 208 +
.../external/mbedtls/include/mbedtls/ssl.h | 5596 +++
.../mbedtls/include/mbedtls/ssl_cache.h | 187 +
.../include/mbedtls/ssl_ciphersuites.h | 482 +
.../mbedtls/include/mbedtls/ssl_cookie.h | 106 +
.../mbedtls/include/mbedtls/ssl_ticket.h | 197 +
.../mbedtls/include/mbedtls/threading.h | 137 +
.../external/mbedtls/include/mbedtls/timing.h | 94 +
.../mbedtls/include/mbedtls/version.h | 78 +
.../external/mbedtls/include/mbedtls/x509.h | 499 +
.../mbedtls/include/mbedtls/x509_crl.h | 184 +
.../mbedtls/include/mbedtls/x509_crt.h | 1208 +
.../mbedtls/include/mbedtls/x509_csr.h | 382 +
.../external/mbedtls/include/psa/build_info.h | 20 +
.../external/mbedtls/include/psa/crypto.h | 4835 ++
.../include/psa/crypto_adjust_auto_enabled.h | 21 +
.../psa/crypto_adjust_config_key_pair_types.h | 91 +
.../psa/crypto_adjust_config_synonyms.h | 39 +
.../include/psa/crypto_builtin_composites.h | 214 +
.../psa/crypto_builtin_key_derivation.h | 118 +
.../include/psa/crypto_builtin_primitives.h | 114 +
.../mbedtls/include/psa/crypto_compat.h | 230 +
.../mbedtls/include/psa/crypto_config.h | 159 +
.../include/psa/crypto_driver_common.h | 44 +
.../psa/crypto_driver_contexts_composites.h | 151 +
.../crypto_driver_contexts_key_derivation.h | 52 +
.../psa/crypto_driver_contexts_primitives.h | 105 +
.../mbedtls/include/psa/crypto_extra.h | 1883 +
.../mbedtls/include/psa/crypto_legacy.h | 88 +
.../mbedtls/include/psa/crypto_platform.h | 102 +
.../mbedtls/include/psa/crypto_se_driver.h | 1383 +
.../mbedtls/include/psa/crypto_sizes.h | 1292 +
.../mbedtls/include/psa/crypto_struct.h | 501 +
.../mbedtls/include/psa/crypto_types.h | 484 +
.../mbedtls/include/psa/crypto_values.h | 2783 ++
.../external/mbedtls/library/.gitignore | 11 +
.../external/mbedtls/library/CMakeLists.txt | 357 +
lib/mbedtls/external/mbedtls/library/Makefile | 403 +
lib/mbedtls/external/mbedtls/library/aes.c | 2294 +
lib/mbedtls/external/mbedtls/library/aesce.c | 618 +
lib/mbedtls/external/mbedtls/library/aesce.h | 136 +
lib/mbedtls/external/mbedtls/library/aesni.c | 835 +
lib/mbedtls/external/mbedtls/library/aesni.h | 162 +
.../external/mbedtls/library/alignment.h | 684 +
lib/mbedtls/external/mbedtls/library/aria.c | 969 +
.../external/mbedtls/library/asn1parse.c | 468 +
.../external/mbedtls/library/asn1write.c | 437 +
lib/mbedtls/external/mbedtls/library/base64.c | 299 +
.../mbedtls/library/base64_internal.h | 45 +
lib/mbedtls/external/mbedtls/library/bignum.c | 2464 +
.../external/mbedtls/library/bignum_core.c | 895 +
.../external/mbedtls/library/bignum_core.h | 763 +
.../external/mbedtls/library/bignum_mod.c | 394 +
.../external/mbedtls/library/bignum_mod.h | 452 +
.../external/mbedtls/library/bignum_mod_raw.c | 276 +
.../external/mbedtls/library/bignum_mod_raw.h | 416 +
.../mbedtls/library/bignum_mod_raw_invasive.h | 34 +
.../external/mbedtls/library/block_cipher.c | 203 +
.../mbedtls/library/block_cipher_internal.h | 99 +
lib/mbedtls/external/mbedtls/library/bn_mul.h | 1094 +
.../external/mbedtls/library/camellia.c | 1058 +
lib/mbedtls/external/mbedtls/library/ccm.c | 763 +
.../external/mbedtls/library/chacha20.c | 497 +
.../external/mbedtls/library/chachapoly.c | 478 +
.../mbedtls/library/check_crypto_config.h | 141 +
lib/mbedtls/external/mbedtls/library/cipher.c | 1680 +
.../external/mbedtls/library/cipher_wrap.c | 2482 +
.../external/mbedtls/library/cipher_wrap.h | 178 +
lib/mbedtls/external/mbedtls/library/cmac.c | 1067 +
lib/mbedtls/external/mbedtls/library/common.h | 435 +
.../external/mbedtls/library/constant_time.c | 248 +
.../mbedtls/library/constant_time_impl.h | 556 +
.../mbedtls/library/constant_time_internal.h | 579 +
lib/mbedtls/external/mbedtls/library/ctr.h | 35 +
.../external/mbedtls/library/ctr_drbg.c | 1016 +
lib/mbedtls/external/mbedtls/library/debug.c | 465 +
.../external/mbedtls/library/debug_internal.h | 172 +
lib/mbedtls/external/mbedtls/library/des.c | 1042 +
lib/mbedtls/external/mbedtls/library/dhm.c | 712 +
lib/mbedtls/external/mbedtls/library/ecdh.c | 694 +
lib/mbedtls/external/mbedtls/library/ecdsa.c | 867 +
.../external/mbedtls/library/ecjpake.c | 1216 +
lib/mbedtls/external/mbedtls/library/ecp.c | 3703 ++
.../external/mbedtls/library/ecp_curves.c | 5460 ++
.../external/mbedtls/library/ecp_curves_new.c | 6036 +++
.../mbedtls/library/ecp_internal_alt.h | 287 +
.../external/mbedtls/library/ecp_invasive.h | 325 +
.../external/mbedtls/library/entropy.c | 676 +
.../external/mbedtls/library/entropy_poll.c | 229 +
.../external/mbedtls/library/entropy_poll.h | 64 +
lib/mbedtls/external/mbedtls/library/error.c | 880 +
lib/mbedtls/external/mbedtls/library/gcm.c | 1330 +
lib/mbedtls/external/mbedtls/library/hkdf.c | 161 +
.../external/mbedtls/library/hmac_drbg.c | 633 +
lib/mbedtls/external/mbedtls/library/lmots.c | 778 +
lib/mbedtls/external/mbedtls/library/lmots.h | 288 +
lib/mbedtls/external/mbedtls/library/lms.c | 761 +
lib/mbedtls/external/mbedtls/library/md.c | 1108 +
lib/mbedtls/external/mbedtls/library/md5.c | 426 +
lib/mbedtls/external/mbedtls/library/md_psa.h | 26 +
.../external/mbedtls/library/md_wrap.h | 46 +
.../mbedtls/library/memory_buffer_alloc.c | 745 +
.../external/mbedtls/library/mps_common.h | 181 +
.../external/mbedtls/library/mps_error.h | 89 +
.../external/mbedtls/library/mps_reader.c | 538 +
.../external/mbedtls/library/mps_reader.h | 366 +
.../external/mbedtls/library/mps_trace.c | 112 +
.../external/mbedtls/library/mps_trace.h | 154 +
.../external/mbedtls/library/net_sockets.c | 696 +
.../external/mbedtls/library/nist_kw.c | 725 +
lib/mbedtls/external/mbedtls/library/oid.c | 1166 +
.../external/mbedtls/library/padlock.c | 157 +
.../external/mbedtls/library/padlock.h | 111 +
lib/mbedtls/external/mbedtls/library/pem.c | 547 +
lib/mbedtls/external/mbedtls/library/pk.c | 1531 +
lib/mbedtls/external/mbedtls/library/pk_ecc.c | 255 +
.../external/mbedtls/library/pk_internal.h | 207 +
.../external/mbedtls/library/pk_wrap.c | 1584 +
.../external/mbedtls/library/pk_wrap.h | 138 +
lib/mbedtls/external/mbedtls/library/pkcs12.c | 437 +
lib/mbedtls/external/mbedtls/library/pkcs5.c | 500 +
lib/mbedtls/external/mbedtls/library/pkcs7.c | 849 +
.../external/mbedtls/library/pkparse.c | 1392 +
.../external/mbedtls/library/pkwrite.c | 621 +
.../external/mbedtls/library/pkwrite.h | 121 +
.../external/mbedtls/library/platform.c | 402 +
.../external/mbedtls/library/platform_util.c | 263 +
.../external/mbedtls/library/poly1305.c | 492 +
.../external/mbedtls/library/psa_crypto.c | 9166 ++++
.../mbedtls/library/psa_crypto_aead.c | 649 +
.../mbedtls/library/psa_crypto_aead.h | 499 +
.../mbedtls/library/psa_crypto_cipher.c | 724 +
.../mbedtls/library/psa_crypto_cipher.h | 316 +
.../mbedtls/library/psa_crypto_client.c | 22 +
.../mbedtls/library/psa_crypto_core.h | 957 +
.../mbedtls/library/psa_crypto_core_common.h | 52 +
.../library/psa_crypto_driver_wrappers.h | 2897 ++
.../psa_crypto_driver_wrappers_no_static.c | 256 +
.../psa_crypto_driver_wrappers_no_static.h | 31 +
.../external/mbedtls/library/psa_crypto_ecp.c | 596 +
.../external/mbedtls/library/psa_crypto_ecp.h | 267 +
.../mbedtls/library/psa_crypto_ffdh.c | 321 +
.../mbedtls/library/psa_crypto_ffdh.h | 131 +
.../mbedtls/library/psa_crypto_hash.c | 470 +
.../mbedtls/library/psa_crypto_hash.h | 211 +
.../mbedtls/library/psa_crypto_invasive.h | 92 +
.../external/mbedtls/library/psa_crypto_its.h | 131 +
.../external/mbedtls/library/psa_crypto_mac.c | 496 +
.../external/mbedtls/library/psa_crypto_mac.h | 264 +
.../mbedtls/library/psa_crypto_pake.c | 571 +
.../mbedtls/library/psa_crypto_pake.h | 159 +
.../mbedtls/library/psa_crypto_random_impl.h | 135 +
.../external/mbedtls/library/psa_crypto_rsa.c | 706 +
.../external/mbedtls/library/psa_crypto_rsa.h | 327 +
.../external/mbedtls/library/psa_crypto_se.c | 373 +
.../external/mbedtls/library/psa_crypto_se.h | 192 +
.../library/psa_crypto_slot_management.c | 685 +
.../library/psa_crypto_slot_management.h | 285 +
.../mbedtls/library/psa_crypto_storage.c | 481 +
.../mbedtls/library/psa_crypto_storage.h | 385 +
.../external/mbedtls/library/psa_its_file.c | 254 +
.../external/mbedtls/library/psa_util.c | 602 +
.../mbedtls/library/psa_util_internal.h | 100 +
.../external/mbedtls/library/ripemd160.c | 490 +
lib/mbedtls/external/mbedtls/library/rsa.c | 3065 ++
.../mbedtls/library/rsa_alt_helpers.c | 447 +
.../mbedtls/library/rsa_alt_helpers.h | 206 +
.../external/mbedtls/library/rsa_internal.h | 121 +
lib/mbedtls/external/mbedtls/library/sha1.c | 480 +
lib/mbedtls/external/mbedtls/library/sha256.c | 976 +
lib/mbedtls/external/mbedtls/library/sha3.c | 721 +
lib/mbedtls/external/mbedtls/library/sha512.c | 1112 +
.../external/mbedtls/library/ssl_cache.c | 410 +
.../mbedtls/library/ssl_ciphersuites.c | 2050 +
.../library/ssl_ciphersuites_internal.h | 154 +
.../external/mbedtls/library/ssl_client.c | 1017 +
.../external/mbedtls/library/ssl_client.h | 22 +
.../external/mbedtls/library/ssl_cookie.c | 380 +
.../mbedtls/library/ssl_debug_helpers.h | 83 +
.../library/ssl_debug_helpers_generated.c | 251 +
.../external/mbedtls/library/ssl_misc.h | 2983 ++
.../external/mbedtls/library/ssl_msg.c | 6368 +++
.../external/mbedtls/library/ssl_ticket.c | 552 +
.../external/mbedtls/library/ssl_tls.c | 9922 ++++
.../mbedtls/library/ssl_tls12_client.c | 3601 ++
.../mbedtls/library/ssl_tls12_server.c | 4432 ++
.../mbedtls/library/ssl_tls13_client.c | 3181 ++
.../mbedtls/library/ssl_tls13_generic.c | 1853 +
.../mbedtls/library/ssl_tls13_invasive.h | 23 +
.../external/mbedtls/library/ssl_tls13_keys.c | 1885 +
.../external/mbedtls/library/ssl_tls13_keys.h | 651 +
.../mbedtls/library/ssl_tls13_server.c | 3599 ++
.../external/mbedtls/library/threading.c | 195 +
lib/mbedtls/external/mbedtls/library/timing.c | 154 +
.../external/mbedtls/library/version.c | 32 +
.../mbedtls/library/version_features.c | 841 +
lib/mbedtls/external/mbedtls/library/x509.c | 1776 +
.../external/mbedtls/library/x509_create.c | 563 +
.../external/mbedtls/library/x509_crl.c | 713 +
.../external/mbedtls/library/x509_crt.c | 3301 ++
.../external/mbedtls/library/x509_csr.c | 639 +
.../external/mbedtls/library/x509_internal.h | 86 +
.../external/mbedtls/library/x509write.c | 174 +
.../external/mbedtls/library/x509write_crt.c | 682 +
.../external/mbedtls/library/x509write_csr.c | 331 +
.../external/mbedtls/pkgconfig/CMakeLists.txt | 25 +
.../mbedtls/pkgconfig/JoinPaths.cmake | 27 +
.../mbedtls/pkgconfig/mbedcrypto.pc.in | 10 +
.../external/mbedtls/pkgconfig/mbedtls.pc.in | 11 +
.../external/mbedtls/pkgconfig/mbedx509.pc.in | 11 +
.../external/mbedtls/programs/.gitignore | 83 +
.../external/mbedtls/programs/CMakeLists.txt | 13 +
.../external/mbedtls/programs/Makefile | 431 +
.../external/mbedtls/programs/README.md | 118 +
.../mbedtls/programs/aes/CMakeLists.txt | 13 +
.../mbedtls/programs/aes/crypt_and_hash.c | 577 +
.../mbedtls/programs/cipher/CMakeLists.txt | 13 +
.../programs/cipher/cipher_aead_demo.c | 259 +
.../external/mbedtls/programs/demo_common.sh | 137 +
.../external/mbedtls/programs/fuzz/.gitignore | 10 +
.../mbedtls/programs/fuzz/CMakeLists.txt | 50 +
.../external/mbedtls/programs/fuzz/Makefile | 48 +
.../external/mbedtls/programs/fuzz/README.md | 68 +
.../external/mbedtls/programs/fuzz/common.c | 105 +
.../external/mbedtls/programs/fuzz/common.h | 25 +
.../mbedtls/programs/fuzz/corpuses/client | Bin 0 -> 4037 bytes
.../mbedtls/programs/fuzz/corpuses/dtlsclient | Bin 0 -> 4058 bytes
.../mbedtls/programs/fuzz/corpuses/dtlsserver | Bin 0 -> 1189 bytes
.../mbedtls/programs/fuzz/corpuses/server | Bin 0 -> 675 bytes
.../mbedtls/programs/fuzz/fuzz_client.c | 193 +
.../mbedtls/programs/fuzz/fuzz_client.options | 2 +
.../mbedtls/programs/fuzz/fuzz_dtlsclient.c | 136 +
.../programs/fuzz/fuzz_dtlsclient.options | 2 +
.../mbedtls/programs/fuzz/fuzz_dtlsserver.c | 181 +
.../programs/fuzz/fuzz_dtlsserver.options | 2 +
.../mbedtls/programs/fuzz/fuzz_pkcs7.c | 20 +
.../mbedtls/programs/fuzz/fuzz_pkcs7.options | 2 +
.../mbedtls/programs/fuzz/fuzz_privkey.c | 104 +
.../programs/fuzz/fuzz_privkey.options | 2 +
.../mbedtls/programs/fuzz/fuzz_pubkey.c | 90 +
.../mbedtls/programs/fuzz/fuzz_pubkey.options | 2 +
.../mbedtls/programs/fuzz/fuzz_server.c | 216 +
.../mbedtls/programs/fuzz/fuzz_server.options | 2 +
.../mbedtls/programs/fuzz/fuzz_x509crl.c | 39 +
.../programs/fuzz/fuzz_x509crl.options | 2 +
.../mbedtls/programs/fuzz/fuzz_x509crt.c | 39 +
.../programs/fuzz/fuzz_x509crt.options | 2 +
.../mbedtls/programs/fuzz/fuzz_x509csr.c | 39 +
.../programs/fuzz/fuzz_x509csr.options | 2 +
.../external/mbedtls/programs/fuzz/onefile.c | 69 +
.../mbedtls/programs/hash/CMakeLists.txt | 15 +
.../mbedtls/programs/hash/generic_sum.c | 209 +
.../external/mbedtls/programs/hash/hello.c | 45 +
.../mbedtls/programs/hash/md_hmac_demo.c | 136 +
.../mbedtls/programs/pkey/CMakeLists.txt | 41 +
.../mbedtls/programs/pkey/dh_client.c | 288 +
.../mbedtls/programs/pkey/dh_genprime.c | 161 +
.../mbedtls/programs/pkey/dh_prime.txt | 2 +
.../mbedtls/programs/pkey/dh_server.c | 306 +
.../mbedtls/programs/pkey/ecdh_curve25519.c | 189 +
.../external/mbedtls/programs/pkey/ecdsa.c | 220 +
.../external/mbedtls/programs/pkey/gen_key.c | 478 +
.../external/mbedtls/programs/pkey/key_app.c | 368 +
.../mbedtls/programs/pkey/key_app_writer.c | 495 +
.../external/mbedtls/programs/pkey/mpi_demo.c | 84 +
.../mbedtls/programs/pkey/pk_decrypt.c | 153 +
.../mbedtls/programs/pkey/pk_encrypt.c | 154 +
.../external/mbedtls/programs/pkey/pk_sign.c | 155 +
.../mbedtls/programs/pkey/pk_verify.c | 128 +
.../mbedtls/programs/pkey/rsa_decrypt.c | 172 +
.../mbedtls/programs/pkey/rsa_encrypt.c | 149 +
.../mbedtls/programs/pkey/rsa_genkey.c | 141 +
.../mbedtls/programs/pkey/rsa_priv.txt | 8 +
.../mbedtls/programs/pkey/rsa_pub.txt | 2 +
.../external/mbedtls/programs/pkey/rsa_sign.c | 155 +
.../mbedtls/programs/pkey/rsa_sign_pss.c | 161 +
.../mbedtls/programs/pkey/rsa_verify.c | 134 +
.../mbedtls/programs/pkey/rsa_verify_pss.c | 136 +
.../mbedtls/programs/psa/CMakeLists.txt | 48 +
.../external/mbedtls/programs/psa/aead_demo.c | 281 +
.../mbedtls/programs/psa/crypto_examples.c | 321 +
.../external/mbedtls/programs/psa/hmac_demo.c | 159 +
.../mbedtls/programs/psa/key_ladder_demo.c | 691 +
.../mbedtls/programs/psa/key_ladder_demo.sh | 51 +
.../mbedtls/programs/psa/psa_constant_names.c | 310 +
.../psa/psa_constant_names_generated.c | 474 +
.../external/mbedtls/programs/psa/psa_hash.c | 159 +
.../mbedtls/programs/psa/psa_hash_demo.sh | 20 +
.../mbedtls/programs/random/CMakeLists.txt | 14 +
.../mbedtls/programs/random/gen_entropy.c | 75 +
.../programs/random/gen_random_ctr_drbg.c | 107 +
.../mbedtls/programs/ssl/CMakeLists.txt | 61 +
.../mbedtls/programs/ssl/dtls_client.c | 342 +
.../mbedtls/programs/ssl/dtls_server.c | 408 +
.../mbedtls/programs/ssl/mini_client.c | 274 +
.../mbedtls/programs/ssl/ssl_client1.c | 288 +
.../mbedtls/programs/ssl/ssl_client2.c | 3230 ++
.../mbedtls/programs/ssl/ssl_context_info.c | 1012 +
.../mbedtls/programs/ssl/ssl_fork_server.c | 381 +
.../mbedtls/programs/ssl/ssl_mail_client.c | 804 +
.../mbedtls/programs/ssl/ssl_pthread_server.c | 489 +
.../mbedtls/programs/ssl/ssl_server.c | 362 +
.../mbedtls/programs/ssl/ssl_server2.c | 4357 ++
.../programs/ssl/ssl_test_common_source.c | 375 +
.../mbedtls/programs/ssl/ssl_test_lib.c | 648 +
.../mbedtls/programs/ssl/ssl_test_lib.h | 331 +
.../mbedtls/programs/test/CMakeLists.txt | 95 +
.../mbedtls/programs/test/benchmark.c | 1271 +
.../programs/test/cmake_package/.gitignore | 3 +
.../test/cmake_package/CMakeLists.txt | 38 +
.../test/cmake_package/cmake_package.c | 27 +
.../test/cmake_package_install/.gitignore | 3 +
.../test/cmake_package_install/CMakeLists.txt | 41 +
.../cmake_package_install.c | 28 +
.../programs/test/cmake_subproject/.gitignore | 3 +
.../test/cmake_subproject/CMakeLists.txt | 23 +
.../test/cmake_subproject/cmake_subproject.c | 28 +
.../external/mbedtls/programs/test/dlopen.c | 92 +
.../mbedtls/programs/test/dlopen_demo.sh | 42 +
.../programs/test/generate_cpp_dummy_build.sh | 78 +
.../external/mbedtls/programs/test/metatest.c | 484 +
.../programs/test/query_compile_time_config.c | 66 +
.../mbedtls/programs/test/query_config.c | 5257 ++
.../mbedtls/programs/test/query_config.h | 34 +
.../programs/test/query_included_headers.c | 29 +
.../external/mbedtls/programs/test/selftest.c | 584 +
.../mbedtls/programs/test/udp_proxy.c | 966 +
.../programs/test/udp_proxy_wrapper.sh | 120 +
.../external/mbedtls/programs/test/zeroize.c | 72 +
.../mbedtls/programs/util/CMakeLists.txt | 18 +
.../external/mbedtls/programs/util/pem2der.c | 265 +
.../external/mbedtls/programs/util/strerror.c | 61 +
.../external/mbedtls/programs/wince_main.c | 31 +
.../mbedtls/programs/x509/CMakeLists.txt | 24 +
.../external/mbedtls/programs/x509/cert_app.c | 456 +
.../external/mbedtls/programs/x509/cert_req.c | 514 +
.../mbedtls/programs/x509/cert_write.c | 1016 +
.../external/mbedtls/programs/x509/crl_app.c | 132 +
.../mbedtls/programs/x509/load_roots.c | 165 +
.../external/mbedtls/programs/x509/req_app.c | 132 +
.../external/mbedtls/scripts/abi_check.py | 658 +
.../external/mbedtls/scripts/apidoc_full.sh | 28 +
.../mbedtls/scripts/assemble_changelog.py | 534 +
.../mbedtls/scripts/basic.requirements.txt | 5 +
.../external/mbedtls/scripts/bump_version.sh | 148 +
.../mbedtls/scripts/ci.requirements.txt | 24 +
.../mbedtls/scripts/code_size_compare.py | 952 +
.../external/mbedtls/scripts/code_style.py | 230 +
.../external/mbedtls/scripts/common.make | 135 +
.../external/mbedtls/scripts/config.pl | 14 +
.../external/mbedtls/scripts/config.py | 603 +
.../driver_jsons/driver_opaque_schema.json | 71 +
.../driver_transparent_schema.json | 70 +
.../data_files/driver_jsons/driverlist.json | 1 +
.../mbedtls_test_opaque_driver.json | 20 +
.../mbedtls_test_transparent_driver.json | 22 +
.../driver_jsons/p256_transparent_driver.json | 20 +
.../driver_templates/OS-template-opaque.jinja | 17 +
.../OS-template-transparent.jinja | 19 +
.../psa_crypto_driver_wrappers.h.jinja | 2860 ++
...a_crypto_driver_wrappers_no_static.c.jinja | 224 +
.../mbedtls/scripts/data_files/error.fmt | 159 +
.../scripts/data_files/query_config.fmt | 121 +
.../scripts/data_files/version_features.fmt | 50 +
.../data_files/vs2017-app-template.vcxproj | 175 +
.../data_files/vs2017-main-template.vcxproj | 163 +
.../data_files/vs2017-sln-template.sln | 30 +
.../mbedtls/scripts/driver.requirements.txt | 19 +
.../external/mbedtls/scripts/ecc-heap.sh | 87 +
.../mbedtls/scripts/ecp_comb_table.py | 237 +
.../external/mbedtls/scripts/footprint.sh | 108 +
.../scripts/generate_driver_wrappers.py | 212 +
.../mbedtls/scripts/generate_errors.pl | 240 +
.../mbedtls/scripts/generate_features.pl | 79 +
.../mbedtls/scripts/generate_psa_constants.py | 332 +
.../mbedtls/scripts/generate_query_config.pl | 116 +
.../scripts/generate_ssl_debug_helpers.py | 414 +
.../mbedtls/scripts/generate_visualc_files.pl | 289 +
lib/mbedtls/external/mbedtls/scripts/lcov.sh | 88 +
.../scripts/maintainer.requirements.txt | 10 +
.../mbedtls/scripts/make_generated_files.bat | 15 +
.../external/mbedtls/scripts/massif_max.pl | 36 +
.../mbedtls/scripts/mbedtls_dev/__init__.py | 3 +
.../mbedtls_dev/asymmetric_key_data.py | 157 +
.../scripts/mbedtls_dev/bignum_common.py | 406 +
.../scripts/mbedtls_dev/bignum_core.py | 896 +
.../scripts/mbedtls_dev/bignum_data.py | 159 +
.../mbedtls/scripts/mbedtls_dev/bignum_mod.py | 102 +
.../scripts/mbedtls_dev/bignum_mod_raw.py | 242 +
.../mbedtls/scripts/mbedtls_dev/build_tree.py | 120 +
.../scripts/mbedtls_dev/c_build_helper.py | 162 +
.../scripts/mbedtls_dev/c_parsing_helper.py | 131 +
.../mbedtls_dev/c_wrapper_generator.py | 473 +
.../scripts/mbedtls_dev/crypto_data_tests.py | 112 +
.../scripts/mbedtls_dev/crypto_knowledge.py | 568 +
.../mbedtls/scripts/mbedtls_dev/ecp.py | 875 +
.../scripts/mbedtls_dev/logging_util.py | 46 +
.../scripts/mbedtls_dev/macro_collector.py | 539 +
.../scripts/mbedtls_dev/psa_information.py | 161 +
.../scripts/mbedtls_dev/psa_storage.py | 206 +
.../mbedtls/scripts/mbedtls_dev/test_case.py | 91 +
.../mbedtls_dev/test_data_generation.py | 224 +
.../scripts/mbedtls_dev/typing_util.py | 28 +
.../external/mbedtls/scripts/memory.sh | 129 +
.../mbedtls/scripts/min_requirements.py | 127 +
.../external/mbedtls/scripts/output_env.sh | 187 +
.../mbedtls/scripts/prepare_release.sh | 70 +
.../mbedtls/scripts/tmp_ignore_makefiles.sh | 47 +
.../mbedtls/scripts/windows_msbuild.bat | 20 +
lib/mbedtls/external/mbedtls/tests/.gitignore | 24 +
.../external/mbedtls/tests/CMakeLists.txt | 307 +
.../external/mbedtls/tests/Descriptions.txt | 22 +
lib/mbedtls/external/mbedtls/tests/Makefile | 248 +
.../mbedtls/tests/compat-in-docker.sh | 55 +
lib/mbedtls/external/mbedtls/tests/compat.sh | 1240 +
.../mbedtls/tests/configs/tls13-only.h | 31 +
.../tests/configs/user-config-for-test.h | 89 +
.../tests/configs/user-config-malloc-0-null.h | 22 +
.../configs/user-config-zeroize-memset.h | 17 +
.../external/mbedtls/tests/context-info.sh | 428 +
.../mbedtls/tests/data_files/.gitignore | 3 +
.../mbedtls/tests/data_files/Makefile | 2190 +
.../mbedtls/tests/data_files/Readme-x509.txt | 135 +
.../authorityKeyId_no_authorityKeyId.crt.der | Bin 0 -> 809 bytes
.../authorityKeyId_no_issuer.crt.der | Bin 0 -> 842 bytes
.../authorityKeyId_no_keyid.crt.der | Bin 0 -> 909 bytes
.../authorityKeyId_subjectKeyId.conf | 19 +
.../authorityKeyId_subjectKeyId.crt.der | Bin 0 -> 931 bytes
...subjectKeyId_issuer_tag1_malformed.crt.der | Bin 0 -> 931 bytes
...subjectKeyId_issuer_tag2_malformed.crt.der | Bin 0 -> 931 bytes
...bjectKeyId_keyid_tag_len_malformed.crt.der | Bin 0 -> 931 bytes
...d_subjectKeyId_keyid_tag_malformed.crt.der | Bin 0 -> 931 bytes
...eyId_subjectKeyId_length_malformed.crt.der | Bin 0 -> 931 bytes
...ubjectKeyId_sequence_tag_malformed.crt.der | Bin 0 -> 931 bytes
...eyId_subjectKeyId_sn_len_malformed.crt.der | Bin 0 -> 931 bytes
...eyId_subjectKeyId_sn_tag_malformed.crt.der | Bin 0 -> 931 bytes
...yId_subjectKeyId_tag_len_malformed.crt.der | Bin 0 -> 931 bytes
...tyKeyId_subjectKeyId_tag_malformed.crt.der | Bin 0 -> 931 bytes
.../tests/data_files/base64/cli_cid.txt | 2 +
.../data_files/base64/cli_ciphersuite.txt | 2 +
.../tests/data_files/base64/cli_def.txt | 2 +
.../tests/data_files/base64/cli_min_cfg.txt | 2 +
.../tests/data_files/base64/cli_no_alpn.txt | 3 +
.../data_files/base64/cli_no_keep_cert.txt | 2 +
.../tests/data_files/base64/cli_no_mfl.txt | 2 +
.../data_files/base64/cli_no_packing.txt | 2 +
.../data_files/base64/def_b64_too_big_1.txt | 2 +
.../data_files/base64/def_b64_too_big_2.txt | 2 +
.../data_files/base64/def_b64_too_big_3.txt | 2 +
.../tests/data_files/base64/def_bad_b64.txt | 2 +
.../mbedtls/tests/data_files/base64/empty.txt | 0
.../tests/data_files/base64/mfl_1024.txt | 2 +
.../tests/data_files/base64/mtu_10000.txt | 2 +
.../tests/data_files/base64/srv_cid.txt | 2 +
.../data_files/base64/srv_ciphersuite.txt | 2 +
.../tests/data_files/base64/srv_def.txt | 2 +
.../tests/data_files/base64/srv_min_cfg.txt | 2 +
.../tests/data_files/base64/srv_no_alpn.txt | 2 +
.../data_files/base64/srv_no_keep_cert.txt | 2 +
.../tests/data_files/base64/srv_no_mfl.txt | 2 +
.../data_files/base64/srv_no_packing.txt | 2 +
.../tests/data_files/base64/v2.19.1.txt | 2 +
.../tests/data_files/cert_example_multi.crt | 17 +
.../data_files/cert_example_multi_nocn.crt | 16 +
.../data_files/cert_example_wildcard.crt | 20 +
.../mbedtls/tests/data_files/cert_md5.crt | 20 +
.../mbedtls/tests/data_files/cert_md5.csr | 16 +
.../mbedtls/tests/data_files/cert_sha1.crt | 20 +
.../mbedtls/tests/data_files/cert_sha224.crt | 20 +
.../mbedtls/tests/data_files/cert_sha256.crt | 20 +
.../mbedtls/tests/data_files/cert_sha384.crt | 20 +
.../mbedtls/tests/data_files/cert_sha512.crt | 20 +
.../tests/data_files/cert_v1_with_ext.crt | 23 +
.../mbedtls/tests/data_files/cli-rsa-sha1.crt | 20 +
.../tests/data_files/cli-rsa-sha256.crt | 20 +
.../tests/data_files/cli-rsa-sha256.crt.der | Bin 0 -> 835 bytes
.../tests/data_files/cli-rsa-sha256.key.der | Bin 0 -> 1192 bytes
.../mbedtls/tests/data_files/cli-rsa.key | 27 +
.../mbedtls/tests/data_files/cli-rsa.key.der | Bin 0 -> 1192 bytes
.../mbedtls/tests/data_files/cli.opensslconf | 4 +
.../mbedtls/tests/data_files/cli2.crt | 13 +
.../mbedtls/tests/data_files/cli2.crt.der | Bin 0 -> 483 bytes
.../mbedtls/tests/data_files/cli2.key | 5 +
.../mbedtls/tests/data_files/cli2.key.der | Bin 0 -> 121 bytes
...ized-fuzz_x509crt-6666050834661376.crt.der | Bin 0 -> 396 bytes
.../mbedtls/tests/data_files/crl-ec-sha1.pem | 10 +
.../tests/data_files/crl-ec-sha256.pem | 10 +
.../mbedtls/tests/data_files/crl-future.pem | 11 +
.../data_files/crl-futureRevocationDate.pem | 11 +
.../data_files/crl-rsa-pss-sha1-badsign.pem | 14 +
.../tests/data_files/crl-rsa-pss-sha1.pem | 14 +
.../tests/data_files/crl-rsa-pss-sha224.pem | 16 +
.../tests/data_files/crl-rsa-pss-sha256.pem | 16 +
.../tests/data_files/crl-rsa-pss-sha384.pem | 16 +
.../tests/data_files/crl-rsa-pss-sha512.pem | 16 +
.../external/mbedtls/tests/data_files/crl.pem | 11 +
.../tests/data_files/crl_cat_ec-rsa.pem | 21 +
.../tests/data_files/crl_cat_ecfut-rsa.pem | 22 +
.../tests/data_files/crl_cat_rsa-ec.pem | 21 +
.../tests/data_files/crl_cat_rsabadpem-ec.pem | 21 +
.../mbedtls/tests/data_files/crl_expired.pem | 11 +
.../mbedtls/tests/data_files/crl_sha256.pem | 11 +
.../tests/data_files/crt_cat_rsaexp-ec.pem | 21 +
.../mbedtls/tests/data_files/dh.1000.pem | 34 +
.../mbedtls/tests/data_files/dh.998.pem | 17 +
.../mbedtls/tests/data_files/dh.999.pem | 17 +
.../mbedtls/tests/data_files/dh.optlen.der | Bin 0 -> 530 bytes
.../mbedtls/tests/data_files/dh.optlen.pem | 58 +
.../mbedtls/tests/data_files/dhparams.pem | 5 +
.../tests/data_files/dir-maxpath/00.crt | 11 +
.../tests/data_files/dir-maxpath/00.key | 8 +
.../tests/data_files/dir-maxpath/01.crt | 13 +
.../tests/data_files/dir-maxpath/01.key | 8 +
.../tests/data_files/dir-maxpath/02.crt | 12 +
.../tests/data_files/dir-maxpath/02.key | 8 +
.../tests/data_files/dir-maxpath/03.crt | 12 +
.../tests/data_files/dir-maxpath/03.key | 8 +
.../tests/data_files/dir-maxpath/04.crt | 12 +
.../tests/data_files/dir-maxpath/04.key | 8 +
.../tests/data_files/dir-maxpath/05.crt | 12 +
.../tests/data_files/dir-maxpath/05.key | 8 +
.../tests/data_files/dir-maxpath/06.crt | 12 +
.../tests/data_files/dir-maxpath/06.key | 8 +
.../tests/data_files/dir-maxpath/07.crt | 12 +
.../tests/data_files/dir-maxpath/07.key | 8 +
.../tests/data_files/dir-maxpath/08.crt | 12 +
.../tests/data_files/dir-maxpath/08.key | 8 +
.../tests/data_files/dir-maxpath/09.crt | 12 +
.../tests/data_files/dir-maxpath/09.key | 8 +
.../tests/data_files/dir-maxpath/10.crt | 12 +
.../tests/data_files/dir-maxpath/10.key | 8 +
.../tests/data_files/dir-maxpath/11.crt | 12 +
.../tests/data_files/dir-maxpath/11.key | 8 +
.../tests/data_files/dir-maxpath/12.crt | 12 +
.../tests/data_files/dir-maxpath/12.key | 8 +
.../tests/data_files/dir-maxpath/13.crt | 12 +
.../tests/data_files/dir-maxpath/13.key | 8 +
.../tests/data_files/dir-maxpath/14.crt | 12 +
.../tests/data_files/dir-maxpath/14.key | 8 +
.../tests/data_files/dir-maxpath/15.crt | 12 +
.../tests/data_files/dir-maxpath/15.key | 8 +
.../tests/data_files/dir-maxpath/16.crt | 12 +
.../tests/data_files/dir-maxpath/16.key | 8 +
.../tests/data_files/dir-maxpath/17.crt | 12 +
.../tests/data_files/dir-maxpath/17.key | 8 +
.../tests/data_files/dir-maxpath/18.crt | 12 +
.../tests/data_files/dir-maxpath/18.key | 8 +
.../tests/data_files/dir-maxpath/19.crt | 12 +
.../tests/data_files/dir-maxpath/19.key | 8 +
.../tests/data_files/dir-maxpath/20.crt | 12 +
.../tests/data_files/dir-maxpath/20.key | 8 +
.../tests/data_files/dir-maxpath/Readme.txt | 10 +
.../tests/data_files/dir-maxpath/c00.pem | 11 +
.../tests/data_files/dir-maxpath/c01.pem | 24 +
.../tests/data_files/dir-maxpath/c02.pem | 36 +
.../tests/data_files/dir-maxpath/c03.pem | 48 +
.../tests/data_files/dir-maxpath/c04.pem | 60 +
.../tests/data_files/dir-maxpath/c05.pem | 72 +
.../tests/data_files/dir-maxpath/c06.pem | 84 +
.../tests/data_files/dir-maxpath/c07.pem | 96 +
.../tests/data_files/dir-maxpath/c08.pem | 108 +
.../tests/data_files/dir-maxpath/c09.pem | 120 +
.../tests/data_files/dir-maxpath/c10.pem | 132 +
.../tests/data_files/dir-maxpath/c11.pem | 144 +
.../tests/data_files/dir-maxpath/c12.pem | 156 +
.../tests/data_files/dir-maxpath/c13.pem | 168 +
.../tests/data_files/dir-maxpath/c14.pem | 180 +
.../tests/data_files/dir-maxpath/c15.pem | 192 +
.../tests/data_files/dir-maxpath/c16.pem | 204 +
.../tests/data_files/dir-maxpath/c17.pem | 216 +
.../tests/data_files/dir-maxpath/c18.pem | 228 +
.../tests/data_files/dir-maxpath/c19.pem | 240 +
.../tests/data_files/dir-maxpath/c20.pem | 252 +
.../data_files/dir-maxpath/int.opensslconf | 4 +
.../tests/data_files/dir-maxpath/long.sh | 38 +
.../mbedtls/tests/data_files/dir1/test-ca.crt | 80 +
.../mbedtls/tests/data_files/dir2/test-ca.crt | 80 +
.../tests/data_files/dir2/test-ca2.crt | 15 +
.../mbedtls/tests/data_files/dir3/Readme | 1 +
.../mbedtls/tests/data_files/dir3/test-ca.crt | 80 +
.../tests/data_files/dir3/test-ca2.crt | 15 +
.../mbedtls/tests/data_files/dir4/Readme | 47 +
.../mbedtls/tests/data_files/dir4/cert11.crt | 18 +
.../mbedtls/tests/data_files/dir4/cert12.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert13.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert14.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert21.crt | 18 +
.../mbedtls/tests/data_files/dir4/cert22.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert23.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert31.crt | 18 +
.../mbedtls/tests/data_files/dir4/cert32.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert33.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert34.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert41.crt | 18 +
.../mbedtls/tests/data_files/dir4/cert42.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert43.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert44.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert45.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert51.crt | 18 +
.../mbedtls/tests/data_files/dir4/cert52.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert53.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert54.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert61.crt | 18 +
.../mbedtls/tests/data_files/dir4/cert62.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert63.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert71.crt | 18 +
.../mbedtls/tests/data_files/dir4/cert72.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert73.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert74.crt | 19 +
.../mbedtls/tests/data_files/dir4/cert81.crt | 11 +
.../mbedtls/tests/data_files/dir4/cert82.crt | 11 +
.../mbedtls/tests/data_files/dir4/cert83.crt | 11 +
.../mbedtls/tests/data_files/dir4/cert91.crt | 11 +
.../mbedtls/tests/data_files/dir4/cert92.crt | 11 +
.../tests/data_files/ec_224_prv.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_224_prv.pem | 5 +
.../tests/data_files/ec_224_pub.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_224_pub.pem | 4 +
.../tests/data_files/ec_256_long_prv.der | Bin 0 -> 121 bytes
.../tests/data_files/ec_256_long_prv.pem | 5 +
.../tests/data_files/ec_256_prv.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_256_prv.pem | 5 +
.../tests/data_files/ec_256_pub.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_256_pub.pem | 4 +
.../tests/data_files/ec_384_prv.comp.pem | 5 +
.../mbedtls/tests/data_files/ec_384_prv.pem | 6 +
.../tests/data_files/ec_384_pub.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_384_pub.pem | 5 +
.../tests/data_files/ec_521_prv.comp.pem | 6 +
.../mbedtls/tests/data_files/ec_521_prv.der | Bin 0 -> 223 bytes
.../mbedtls/tests/data_files/ec_521_prv.pem | 7 +
.../tests/data_files/ec_521_pub.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_521_pub.der | Bin 0 -> 158 bytes
.../mbedtls/tests/data_files/ec_521_pub.pem | 6 +
.../tests/data_files/ec_521_short_prv.der | Bin 0 -> 223 bytes
.../tests/data_files/ec_521_short_prv.pem | 7 +
.../tests/data_files/ec_bp256_prv.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_bp256_prv.pem | 5 +
.../tests/data_files/ec_bp256_pub.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_bp256_pub.pem | 4 +
.../tests/data_files/ec_bp384_prv.comp.pem | 5 +
.../mbedtls/tests/data_files/ec_bp384_prv.pem | 6 +
.../tests/data_files/ec_bp384_pub.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_bp384_pub.pem | 5 +
.../tests/data_files/ec_bp512_prv.comp.pem | 6 +
.../mbedtls/tests/data_files/ec_bp512_prv.der | Bin 0 -> 221 bytes
.../mbedtls/tests/data_files/ec_bp512_prv.pem | 7 +
.../tests/data_files/ec_bp512_pub.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_bp512_pub.der | Bin 0 -> 158 bytes
.../mbedtls/tests/data_files/ec_bp512_pub.pem | 6 +
.../mbedtls/tests/data_files/ec_prv.pk8.der | Bin 0 -> 113 bytes
.../mbedtls/tests/data_files/ec_prv.pk8.pem | 5 +
.../tests/data_files/ec_prv.pk8.pw.der | Bin 0 -> 148 bytes
.../tests/data_files/ec_prv.pk8.pw.pem | 6 +
.../tests/data_files/ec_prv.pk8nopub.der | Bin 0 -> 67 bytes
.../tests/data_files/ec_prv.pk8nopub.pem | 4 +
.../tests/data_files/ec_prv.pk8nopubparam.der | Bin 0 -> 79 bytes
.../tests/data_files/ec_prv.pk8nopubparam.pem | 4 +
.../tests/data_files/ec_prv.pk8param.der | Bin 0 -> 150 bytes
.../tests/data_files/ec_prv.pk8param.pem | 5 +
.../tests/data_files/ec_prv.sec1.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_prv.sec1.der | Bin 0 -> 97 bytes
.../mbedtls/tests/data_files/ec_prv.sec1.pem | 5 +
.../tests/data_files/ec_prv.sec1.pw.pem | 8 +
.../tests/data_files/ec_prv.specdom.der | Bin 0 -> 214 bytes
.../mbedtls/tests/data_files/ec_pub.comp.pem | 4 +
.../mbedtls/tests/data_files/ec_pub.der | Bin 0 -> 75 bytes
.../mbedtls/tests/data_files/ec_pub.pem | 4 +
.../tests/data_files/ec_x25519_prv.der | Bin 0 -> 48 bytes
.../tests/data_files/ec_x25519_prv.pem | 3 +
.../tests/data_files/ec_x25519_pub.der | Bin 0 -> 44 bytes
.../tests/data_files/ec_x25519_pub.pem | 3 +
.../mbedtls/tests/data_files/ec_x448_prv.der | Bin 0 -> 72 bytes
.../mbedtls/tests/data_files/ec_x448_prv.pem | 4 +
.../mbedtls/tests/data_files/ec_x448_pub.der | Bin 0 -> 68 bytes
.../mbedtls/tests/data_files/ec_x448_pub.pem | 4 +
.../tests/data_files/ecdsa_secp256r1.crt | 10 +
.../tests/data_files/ecdsa_secp256r1.key | 5 +
.../tests/data_files/ecdsa_secp384r1.crt | 11 +
.../tests/data_files/ecdsa_secp384r1.key | 6 +
.../tests/data_files/ecdsa_secp521r1.crt | 12 +
.../tests/data_files/ecdsa_secp521r1.key | 7 +
.../tests/data_files/enco-ca-prstr.pem | 15 +
.../tests/data_files/enco-cert-utf8str.pem | 14 +
.../mbedtls/tests/data_files/format_gen.key | 16 +
.../mbedtls/tests/data_files/format_gen.pub | 6 +
.../tests/data_files/format_pkcs12.fmt | Bin 0 -> 3381 bytes
.../mbedtls/tests/data_files/format_rsa.key | 15 +
.../mbedtls/tests/data_files/hash_file_1 | Bin 0 -> 5120 bytes
.../mbedtls/tests/data_files/hash_file_2 | 2 +
.../mbedtls/tests/data_files/hash_file_3 | Bin 0 -> 13 bytes
.../mbedtls/tests/data_files/hash_file_4 | 0
.../mbedtls/tests/data_files/hash_file_5 | 1 +
.../data_files/keyUsage.decipherOnly.crt | 14 +
...sigs_sha256_m32_h5_lmots_sha256_n32_w8_aux | Bin 0 -> 10916 bytes
...sigs_sha256_m32_h5_lmots_sha256_n32_w8_prv | Bin 0 -> 64 bytes
...sigs_sha256_m32_h5_lmots_sha256_n32_w8_pub | Bin 0 -> 60 bytes
...slms_sha256_m32_h5_lmots_sha256_n32_w8_prv | Bin 0 -> 71931 bytes
...slms_sha256_m32_h5_lmots_sha256_n32_w8_prv | Bin 0 -> 68 bytes
...slms_sha256_m32_h5_lmots_sha256_n32_w8_pub | Bin 0 -> 60 bytes
.../external/mbedtls/tests/data_files/mpi_16 | 1 +
.../mbedtls/tests/data_files/mpi_too_big | 1 +
.../data_files/opensslcnf/server9.crt.v3_ext | 4 +
.../parse_input/bitstring-in-dn.pem | 51 +
.../parse_input/cert_example_multi.crt | 17 +
.../parse_input/cert_example_multi_nocn.crt | 13 +
.../tests/data_files/parse_input/cert_md5.crt | 20 +
.../data_files/parse_input/cert_sha1.crt | 20 +
.../data_files/parse_input/cert_sha224.crt | 20 +
.../data_files/parse_input/cert_sha256.crt | 20 +
.../data_files/parse_input/cert_sha384.crt | 20 +
.../data_files/parse_input/cert_sha512.crt | 20 +
.../parse_input/cli-rsa-sha256-badalg.crt.der | Bin 0 -> 835 bytes
.../data_files/parse_input/crl-ec-sha1.pem | 10 +
.../data_files/parse_input/crl-ec-sha224.pem | 10 +
.../data_files/parse_input/crl-ec-sha256.pem | 10 +
.../data_files/parse_input/crl-ec-sha384.pem | 10 +
.../data_files/parse_input/crl-ec-sha512.pem | 10 +
.../tests/data_files/parse_input/crl-idp.pem | 12 +
.../data_files/parse_input/crl-idpnc.pem | 12 +
.../crl-malformed-trailing-spaces.pem | 20 +
.../parse_input/crl-rsa-pss-sha1.pem | 14 +
.../parse_input/crl-rsa-pss-sha224.pem | 16 +
.../parse_input/crl-rsa-pss-sha256.pem | 16 +
.../parse_input/crl-rsa-pss-sha384.pem | 16 +
.../parse_input/crl-rsa-pss-sha512.pem | 16 +
.../data_files/parse_input/crl_expired.pem | 11 +
.../tests/data_files/parse_input/crl_md5.pem | 11 +
.../tests/data_files/parse_input/crl_sha1.pem | 11 +
.../data_files/parse_input/crl_sha224.pem | 11 +
.../data_files/parse_input/crl_sha256.pem | 11 +
.../data_files/parse_input/crl_sha384.pem | 11 +
.../data_files/parse_input/crl_sha512.pem | 11 +
.../parse_input/keyUsage.decipherOnly.crt | 14 +
.../data_files/parse_input/multiple_san.crt | 12 +
.../non-ascii-string-in-issuer.crt | 22 +
.../parse_input/rsa_multiple_san_uri.crt.der | Bin 0 -> 954 bytes
.../parse_input/rsa_single_san_uri.crt.der | Bin 0 -> 898 bytes
.../parse_input/server1-ms.req.sha256 | 16 +
.../parse_input/server1.cert_type.crt | 20 +
.../tests/data_files/parse_input/server1.crt | 20 +
.../data_files/parse_input/server1.crt.der | Bin 0 -> 835 bytes
.../data_files/parse_input/server1.ext_ku.crt | 22 +
.../parse_input/server1.key_usage.crt | 20 +
.../parse_input/server1.req.commas.sha256 | 16 +
.../data_files/parse_input/server1.req.md5 | 16 +
.../data_files/parse_input/server1.req.sha1 | 16 +
.../data_files/parse_input/server1.req.sha224 | 16 +
.../data_files/parse_input/server1.req.sha256 | 16 +
.../data_files/parse_input/server1.req.sha384 | 16 +
.../data_files/parse_input/server1.req.sha512 | 16 +
.../parse_input/server1_pathlen_int_max-1.crt | 20 +
.../parse_input/server1_pathlen_int_max.crt | 20 +
.../tests/data_files/parse_input/server2.crt | 20 +
.../data_files/parse_input/server2.crt.der | Bin 0 -> 827 bytes
.../tests/data_files/parse_input/server3.crt | 17 +
.../tests/data_files/parse_input/server4.crt | 18 +
...erver5-directoryname-seq-malformed.crt.der | Bin 0 -> 525 bytes
.../parse_input/server5-directoryname.crt.der | Bin 0 -> 498 bytes
.../parse_input/server5-fan.crt.der | Bin 0 -> 408 bytes
.../parse_input/server5-non-compliant.crt | 12 +
.../server5-nonprintable_othername.crt.der | Bin 0 -> 483 bytes
.../parse_input/server5-othername.crt.der | Bin 0 -> 449 bytes
...second-directoryname-oid-malformed.crt.der | Bin 0 -> 525 bytes
.../data_files/parse_input/server5-sha1.crt | 14 +
.../data_files/parse_input/server5-sha224.crt | 14 +
.../data_files/parse_input/server5-sha384.crt | 14 +
.../data_files/parse_input/server5-sha512.crt | 14 +
.../server5-two-directorynames.crt.der | Bin 0 -> 525 bytes
.../server5-unsupported_othername.crt.der | Bin 0 -> 472 bytes
.../tests/data_files/parse_input/server5.crt | 14 +
.../data_files/parse_input/server5.req.sha1 | 8 +
.../data_files/parse_input/server5.req.sha224 | 8 +
.../data_files/parse_input/server5.req.sha256 | 8 +
.../data_files/parse_input/server5.req.sha384 | 8 +
.../data_files/parse_input/server5.req.sha512 | 8 +
.../parse_input/server7_all_space.crt | 47 +
.../data_files/parse_input/server7_int-ca.crt | 47 +
.../parse_input/server7_pem_space.crt | 47 +
.../parse_input/server7_trailing_space.crt | 47 +
.../data_files/parse_input/server9-sha224.crt | 20 +
.../data_files/parse_input/server9-sha256.crt | 20 +
.../data_files/parse_input/server9-sha384.crt | 20 +
.../data_files/parse_input/server9-sha512.crt | 20 +
.../tests/data_files/parse_input/server9.crt | 19 +
.../data_files/parse_input/server9.req.sha1 | 11 +
.../data_files/parse_input/server9.req.sha224 | 12 +
.../data_files/parse_input/server9.req.sha256 | 12 +
.../data_files/parse_input/server9.req.sha384 | 12 +
.../data_files/parse_input/server9.req.sha512 | 12 +
.../parse_input/test-ca-any_policy.crt | 19 +
.../parse_input/test-ca-any_policy_ec.crt | 12 +
.../test-ca-any_policy_with_qualifier.crt | 20 +
.../test-ca-any_policy_with_qualifier_ec.crt | 13 +
.../parse_input/test-ca-multi_policy.crt | 19 +
.../parse_input/test-ca-multi_policy_ec.crt | 12 +
.../test-ca-unsupported_policy.crt | 19 +
.../test-ca-unsupported_policy_ec.crt | 12 +
.../tests/data_files/parse_input/test-ca.crt | 20 +
.../data_files/parse_input/test-ca.crt.der | Bin 0 -> 837 bytes
.../parse_input/test_cert_rfc822name.crt.der | Bin 0 -> 677 bytes
.../parse_input/test_csr_v3_all.csr.der | Bin 0 -> 437 bytes
...ormed_attributes_extension_request.csr.der | Bin 0 -> 437 bytes
...es_extension_request_sequence_len1.csr.der | Bin 0 -> 437 bytes
...es_extension_request_sequence_len2.csr.der | Bin 0 -> 437 bytes
...tes_extension_request_sequence_tag.csr.der | Bin 0 -> 437 bytes
...tributes_extension_request_set_tag.csr.der | Bin 0 -> 437 bytes
...v3_all_malformed_attributes_id_tag.csr.der | Bin 0 -> 437 bytes
...r_v3_all_malformed_attributes_len1.csr.der | Bin 0 -> 437 bytes
...r_v3_all_malformed_attributes_len2.csr.der | Bin 0 -> 437 bytes
..._malformed_attributes_sequence_tag.csr.der | Bin 0 -> 437 bytes
...all_malformed_duplicated_extension.csr.der | Bin 0 -> 437 bytes
..._all_malformed_extension_data_len1.csr.der | Bin 0 -> 437 bytes
..._all_malformed_extension_data_len2.csr.der | Bin 0 -> 437 bytes
...3_all_malformed_extension_data_tag.csr.der | Bin 0 -> 437 bytes
..._v3_all_malformed_extension_id_tag.csr.der | Bin 0 -> 437 bytes
..._extension_key_usage_bitstream_tag.csr.der | Bin 0 -> 437 bytes
...ed_extension_ns_cert_bitstream_tag.csr.der | Bin 0 -> 437 bytes
...sion_subject_alt_name_sequence_tag.csr.der | Bin 0 -> 437 bytes
...3_all_malformed_extension_type_oid.csr.der | Bin 0 -> 437 bytes
..._malformed_extensions_sequence_tag.csr.der | Bin 0 -> 437 bytes
.../parse_input/test_csr_v3_keyUsage.csr.der | Bin 0 -> 368 bytes
.../test_csr_v3_nsCertType.csr.der | Bin 0 -> 374 bytes
.../test_csr_v3_subjectAltName.csr.der | Bin 0 -> 407 bytes
.../mbedtls/tests/data_files/passwd.psk | 1 +
.../tests/data_files/pkcs7-rsa-expired.crt | 20 +
.../tests/data_files/pkcs7-rsa-expired.der | Bin 0 -> 857 bytes
.../tests/data_files/pkcs7-rsa-expired.key | 28 +
.../tests/data_files/pkcs7-rsa-sha256-1.crt | 20 +
.../tests/data_files/pkcs7-rsa-sha256-1.der | Bin 0 -> 845 bytes
.../tests/data_files/pkcs7-rsa-sha256-1.key | 28 +
.../tests/data_files/pkcs7-rsa-sha256-1.pem | 48 +
.../tests/data_files/pkcs7-rsa-sha256-2.crt | 20 +
.../tests/data_files/pkcs7-rsa-sha256-2.der | Bin 0 -> 845 bytes
.../tests/data_files/pkcs7-rsa-sha256-2.key | 28 +
.../tests/data_files/pkcs7-rsa-sha256-2.pem | 48 +
.../tests/data_files/pkcs7-rsa-sha256-3.crt | 20 +
.../tests/data_files/pkcs7-rsa-sha256-3.key | 28 +
.../tests/data_files/pkcs7-rsa-sha256-3.pem | 48 +
.../tests/data_files/pkcs7_data_3_signed.der | Bin 0 -> 1185 bytes
.../data_files/pkcs7_data_cert_encrypted.der | Bin 0 -> 452 bytes
.../pkcs7_data_cert_signed_sha1.der | Bin 0 -> 1276 bytes
.../pkcs7_data_cert_signed_sha256.der | Bin 0 -> 1284 bytes
.../pkcs7_data_cert_signed_sha512.der | Bin 0 -> 1284 bytes
.../data_files/pkcs7_data_cert_signed_v2.der | Bin 0 -> 1284 bytes
.../pkcs7_data_cert_signeddata_sha256.der | Bin 0 -> 1265 bytes
.../pkcs7_data_multiple_certs_signed.der | Bin 0 -> 2504 bytes
.../data_files/pkcs7_data_multiple_signed.der | Bin 0 -> 810 bytes
.../data_files/pkcs7_data_no_signers.der | Bin 0 -> 52 bytes
.../data_files/pkcs7_data_rsa_expired.der | Bin 0 -> 1302 bytes
.../data_files/pkcs7_data_signed_badcert.der | Bin 0 -> 1284 bytes
.../pkcs7_data_signed_badsigner.der | Bin 0 -> 1284 bytes
.../pkcs7_data_signed_badsigner1_badsize.der | Bin 0 -> 1185 bytes
.../pkcs7_data_signed_badsigner1_badtag.der | Bin 0 -> 1185 bytes
.../pkcs7_data_signed_badsigner1_fuzzbad.der | Bin 0 -> 1185 bytes
.../pkcs7_data_signed_badsigner2_badsize.der | Bin 0 -> 1185 bytes
.../pkcs7_data_signed_badsigner2_badtag.der | Bin 0 -> 1185 bytes
.../pkcs7_data_signed_badsigner2_fuzzbad.der | Bin 0 -> 1185 bytes
.../data_files/pkcs7_data_with_signature.der | Bin 0 -> 445 bytes
.../pkcs7_data_without_cert_signed.der | Bin 0 -> 435 bytes
...o_1_serial_invalid_tag_after_long_name.der | Bin 0 -> 810 bytes
.../pkcs7_signerInfo_2_invalid_tag.der | Bin 0 -> 1185 bytes
.../pkcs7_signerInfo_issuer_invalid_size.der | Bin 0 -> 1284 bytes
.../pkcs7_signerInfo_serial_invalid_size.der | Bin 0 -> 1284 bytes
.../data_files/pkcs7_zerolendata_detached.der | Bin 0 -> 435 bytes
.../mbedtls/tests/data_files/print_c.pl | 38 +
.../mbedtls/tests/data_files/rsa4096_prv.der | Bin 0 -> 2349 bytes
.../mbedtls/tests/data_files/rsa4096_prv.pem | 51 +
.../mbedtls/tests/data_files/rsa4096_pub.der | Bin 0 -> 550 bytes
.../mbedtls/tests/data_files/rsa4096_pub.pem | 14 +
.../mbedtls/tests/data_files/rsa512.key | 9 +
.../mbedtls/tests/data_files/rsa521.key | 9 +
.../mbedtls/tests/data_files/rsa522.key | 9 +
.../mbedtls/tests/data_files/rsa528.key | 9 +
.../tests/data_files/rsa_multiple_san_uri.key | 28 +
.../tests/data_files/rsa_pkcs1_1024_3des.pem | 18 +
.../data_files/rsa_pkcs1_1024_aes128.pem | 18 +
.../data_files/rsa_pkcs1_1024_aes192.pem | 18 +
.../data_files/rsa_pkcs1_1024_aes256.pem | 18 +
.../tests/data_files/rsa_pkcs1_1024_clear.pem | 15 +
.../tests/data_files/rsa_pkcs1_1024_des.pem | 18 +
.../tests/data_files/rsa_pkcs1_2048_3des.pem | 30 +
.../data_files/rsa_pkcs1_2048_aes128.pem | 30 +
.../data_files/rsa_pkcs1_2048_aes192.pem | 30 +
.../data_files/rsa_pkcs1_2048_aes256.pem | 30 +
.../tests/data_files/rsa_pkcs1_2048_clear.pem | 27 +
.../tests/data_files/rsa_pkcs1_2048_des.pem | 30 +
.../data_files/rsa_pkcs1_2048_public.der | Bin 0 -> 270 bytes
.../data_files/rsa_pkcs1_2048_public.pem | 8 +
.../tests/data_files/rsa_pkcs1_4096_3des.pem | 54 +
.../data_files/rsa_pkcs1_4096_aes128.pem | 54 +
.../data_files/rsa_pkcs1_4096_aes192.pem | 54 +
.../data_files/rsa_pkcs1_4096_aes256.pem | 54 +
.../tests/data_files/rsa_pkcs1_4096_clear.pem | 51 +
.../tests/data_files/rsa_pkcs1_4096_des.pem | 54 +
.../data_files/rsa_pkcs8_1024_public.der | Bin 0 -> 162 bytes
.../data_files/rsa_pkcs8_2048_public.der | Bin 0 -> 294 bytes
.../data_files/rsa_pkcs8_2048_public.pem | 9 +
.../rsa_pkcs8_pbe_sha1_1024_2des.der | Bin 0 -> 678 bytes
.../rsa_pkcs8_pbe_sha1_1024_2des.pem | 17 +
.../rsa_pkcs8_pbe_sha1_1024_3des.der | Bin 0 -> 678 bytes
.../rsa_pkcs8_pbe_sha1_1024_3des.pem | 17 +
.../rsa_pkcs8_pbe_sha1_2048_2des.der | Bin 0 -> 1262 bytes
.../rsa_pkcs8_pbe_sha1_2048_2des.pem | 29 +
.../rsa_pkcs8_pbe_sha1_2048_3des.der | Bin 0 -> 1262 bytes
.../rsa_pkcs8_pbe_sha1_2048_3des.pem | 29 +
.../rsa_pkcs8_pbe_sha1_4096_2des.der | Bin 0 -> 2414 bytes
.../rsa_pkcs8_pbe_sha1_4096_2des.pem | 53 +
.../rsa_pkcs8_pbe_sha1_4096_3des.der | Bin 0 -> 2414 bytes
.../rsa_pkcs8_pbe_sha1_4096_3des.pem | 53 +
.../rsa_pkcs8_pbes2_pbkdf2_1024_3des.der | Bin 0 -> 714 bytes
.../rsa_pkcs8_pbes2_pbkdf2_1024_3des.pem | 17 +
...sa_pkcs8_pbes2_pbkdf2_1024_3des_sha224.der | Bin 0 -> 728 bytes
...sa_pkcs8_pbes2_pbkdf2_1024_3des_sha224.pem | 18 +
...sa_pkcs8_pbes2_pbkdf2_1024_3des_sha256.der | Bin 0 -> 728 bytes
...sa_pkcs8_pbes2_pbkdf2_1024_3des_sha256.pem | 18 +
...sa_pkcs8_pbes2_pbkdf2_1024_3des_sha384.der | Bin 0 -> 728 bytes
...sa_pkcs8_pbes2_pbkdf2_1024_3des_sha384.pem | 18 +
...sa_pkcs8_pbes2_pbkdf2_1024_3des_sha512.der | Bin 0 -> 728 bytes
...sa_pkcs8_pbes2_pbkdf2_1024_3des_sha512.pem | 18 +
.../rsa_pkcs8_pbes2_pbkdf2_1024_des.der | Bin 0 -> 711 bytes
.../rsa_pkcs8_pbes2_pbkdf2_1024_des.pem | 17 +
...rsa_pkcs8_pbes2_pbkdf2_1024_des_sha224.der | Bin 0 -> 725 bytes
...rsa_pkcs8_pbes2_pbkdf2_1024_des_sha224.pem | 18 +
...rsa_pkcs8_pbes2_pbkdf2_1024_des_sha256.der | Bin 0 -> 725 bytes
...rsa_pkcs8_pbes2_pbkdf2_1024_des_sha256.pem | 18 +
...rsa_pkcs8_pbes2_pbkdf2_1024_des_sha384.der | Bin 0 -> 725 bytes
...rsa_pkcs8_pbes2_pbkdf2_1024_des_sha384.pem | 18 +
...rsa_pkcs8_pbes2_pbkdf2_1024_des_sha512.der | Bin 0 -> 725 bytes
...rsa_pkcs8_pbes2_pbkdf2_1024_des_sha512.pem | 18 +
.../rsa_pkcs8_pbes2_pbkdf2_2048_3des.der | Bin 0 -> 1298 bytes
.../rsa_pkcs8_pbes2_pbkdf2_2048_3des.pem | 30 +
...sa_pkcs8_pbes2_pbkdf2_2048_3des_sha224.der | Bin 0 -> 1312 bytes
...sa_pkcs8_pbes2_pbkdf2_2048_3des_sha224.pem | 30 +
...sa_pkcs8_pbes2_pbkdf2_2048_3des_sha256.der | Bin 0 -> 1312 bytes
...sa_pkcs8_pbes2_pbkdf2_2048_3des_sha256.pem | 30 +
...sa_pkcs8_pbes2_pbkdf2_2048_3des_sha384.der | Bin 0 -> 1312 bytes
...sa_pkcs8_pbes2_pbkdf2_2048_3des_sha384.pem | 30 +
...sa_pkcs8_pbes2_pbkdf2_2048_3des_sha512.der | Bin 0 -> 1312 bytes
...sa_pkcs8_pbes2_pbkdf2_2048_3des_sha512.pem | 30 +
...cs8_pbes2_pbkdf2_2048_aes128cbc_sha384.der | Bin 0 -> 1329 bytes
...cs8_pbes2_pbkdf2_2048_aes128cbc_sha384.pem | 30 +
...cs8_pbes2_pbkdf2_2048_aes192cbc_sha384.der | Bin 0 -> 1329 bytes
...cs8_pbes2_pbkdf2_2048_aes192cbc_sha384.pem | 30 +
...cs8_pbes2_pbkdf2_2048_aes256cbc_sha384.der | Bin 0 -> 1328 bytes
...cs8_pbes2_pbkdf2_2048_aes256cbc_sha384.pem | 30 +
.../rsa_pkcs8_pbes2_pbkdf2_2048_des.der | Bin 0 -> 1295 bytes
.../rsa_pkcs8_pbes2_pbkdf2_2048_des.pem | 29 +
...rsa_pkcs8_pbes2_pbkdf2_2048_des_sha224.der | Bin 0 -> 1309 bytes
...rsa_pkcs8_pbes2_pbkdf2_2048_des_sha224.pem | 30 +
...rsa_pkcs8_pbes2_pbkdf2_2048_des_sha256.der | Bin 0 -> 1309 bytes
...rsa_pkcs8_pbes2_pbkdf2_2048_des_sha256.pem | 30 +
...rsa_pkcs8_pbes2_pbkdf2_2048_des_sha384.der | Bin 0 -> 1309 bytes
...rsa_pkcs8_pbes2_pbkdf2_2048_des_sha384.pem | 30 +
...rsa_pkcs8_pbes2_pbkdf2_2048_des_sha512.der | Bin 0 -> 1309 bytes
...rsa_pkcs8_pbes2_pbkdf2_2048_des_sha512.pem | 30 +
.../rsa_pkcs8_pbes2_pbkdf2_4096_3des.der | Bin 0 -> 2450 bytes
.../rsa_pkcs8_pbes2_pbkdf2_4096_3des.pem | 54 +
...sa_pkcs8_pbes2_pbkdf2_4096_3des_sha224.der | Bin 0 -> 2464 bytes
...sa_pkcs8_pbes2_pbkdf2_4096_3des_sha224.pem | 54 +
...sa_pkcs8_pbes2_pbkdf2_4096_3des_sha256.der | Bin 0 -> 2464 bytes
...sa_pkcs8_pbes2_pbkdf2_4096_3des_sha256.pem | 54 +
...sa_pkcs8_pbes2_pbkdf2_4096_3des_sha384.der | Bin 0 -> 2464 bytes
...sa_pkcs8_pbes2_pbkdf2_4096_3des_sha384.pem | 54 +
...sa_pkcs8_pbes2_pbkdf2_4096_3des_sha512.der | Bin 0 -> 2464 bytes
...sa_pkcs8_pbes2_pbkdf2_4096_3des_sha512.pem | 54 +
.../rsa_pkcs8_pbes2_pbkdf2_4096_des.der | Bin 0 -> 2447 bytes
.../rsa_pkcs8_pbes2_pbkdf2_4096_des.pem | 53 +
...rsa_pkcs8_pbes2_pbkdf2_4096_des_sha224.der | Bin 0 -> 2461 bytes
...rsa_pkcs8_pbes2_pbkdf2_4096_des_sha224.pem | 54 +
...rsa_pkcs8_pbes2_pbkdf2_4096_des_sha256.der | Bin 0 -> 2461 bytes
...rsa_pkcs8_pbes2_pbkdf2_4096_des_sha256.pem | 54 +
...rsa_pkcs8_pbes2_pbkdf2_4096_des_sha384.der | Bin 0 -> 2461 bytes
...rsa_pkcs8_pbes2_pbkdf2_4096_des_sha384.pem | 54 +
...rsa_pkcs8_pbes2_pbkdf2_4096_des_sha512.der | Bin 0 -> 2461 bytes
...rsa_pkcs8_pbes2_pbkdf2_4096_des_sha512.pem | 54 +
.../data_files/rsa_single_san_uri.crt.der | Bin 0 -> 898 bytes
.../tests/data_files/rsa_single_san_uri.key | 28 +
.../tests/data_files/server1-nospace.crt | 20 +
.../mbedtls/tests/data_files/server1-v1.crt | 19 +
.../tests/data_files/server1.80serial.crt | 20 +
.../data_files/server1.allSubjectAltNames.crt | 23 +
.../tests/data_files/server1.asciichars.crt | 20 +
.../mbedtls/tests/data_files/server1.ca.crt | 20 +
.../mbedtls/tests/data_files/server1.ca.der | Bin 0 -> 841 bytes
.../tests/data_files/server1.ca_noauthid.crt | 19 +
.../tests/data_files/server1.cert_type.crt | 20 +
.../server1.cert_type.crt.openssl.v3_ext | 5 +
.../data_files/server1.cert_type_noauthid.crt | 20 +
.../tests/data_files/server1.commas.crt | 20 +
.../mbedtls/tests/data_files/server1.crt | 20 +
.../data_files/server1.crt.openssl.v3_ext | 4 +
.../mbedtls/tests/data_files/server1.csr | 16 +
.../mbedtls/tests/data_files/server1.der | Bin 0 -> 835 bytes
.../tests/data_files/server1.hashsymbol.crt | 20 +
.../mbedtls/tests/data_files/server1.key | 27 +
.../mbedtls/tests/data_files/server1.key.der | Bin 0 -> 1190 bytes
.../data_files/server1.key_ext_usage.crt | 20 +
.../data_files/server1.key_ext_usages.crt | 21 +
.../tests/data_files/server1.key_usage.crt | 20 +
.../server1.key_usage.crt.openssl.v3_ext | 5 +
.../data_files/server1.key_usage_noauthid.crt | 20 +
.../tests/data_files/server1.long_serial.crt | 20 +
.../data_files/server1.long_serial_FF.crt | 20 +
.../tests/data_files/server1.noauthid.crt | 19 +
.../mbedtls/tests/data_files/server1.pubkey | 9 +
.../tests/data_files/server1.pubkey.der | Bin 0 -> 294 bytes
.../tests/data_files/server1.req.cert_type | 17 +
.../data_files/server1.req.cert_type_empty | 17 +
.../tests/data_files/server1.req.key_usage | 17 +
.../data_files/server1.req.key_usage_empty | 17 +
.../tests/data_files/server1.req.ku-ct | 17 +
.../mbedtls/tests/data_files/server1.req.md5 | 16 +
.../mbedtls/tests/data_files/server1.req.sha1 | 16 +
.../tests/data_files/server1.req.sha224 | 16 +
.../tests/data_files/server1.req.sha256 | 16 +
.../tests/data_files/server1.req.sha256.conf | 17 +
.../tests/data_files/server1.req.sha256.ext | 20 +
.../tests/data_files/server1.req.sha384 | 16 +
.../tests/data_files/server1.req.sha512 | 16 +
.../tests/data_files/server1.spaces.crt | 20 +
.../mbedtls/tests/data_files/server1.v1.crt | 18 +
.../tests/data_files/server10-badsign.crt | 10 +
.../tests/data_files/server10-bs_int3.pem | 22 +
.../mbedtls/tests/data_files/server10.crt | 10 +
.../mbedtls/tests/data_files/server10.key | 5 +
.../tests/data_files/server10_int3-bs.pem | 22 +
.../data_files/server10_int3_int-ca2.crt | 40 +
.../data_files/server10_int3_int-ca2_ca.crt | 60 +
.../server10_int3_spurious_int-ca2.crt | 64 +
.../mbedtls/tests/data_files/server1_ca.crt | 40 +
.../tests/data_files/server1_csr.opensslconf | 10 +
.../tests/data_files/server2-badsign.crt | 20 +
.../tests/data_files/server2-sha256.crt | 20 +
.../tests/data_files/server2-sha256.crt.der | Bin 0 -> 827 bytes
.../tests/data_files/server2-v1-chain.crt | 38 +
.../mbedtls/tests/data_files/server2-v1.crt | 19 +
.../mbedtls/tests/data_files/server2.crt | 20 +
.../mbedtls/tests/data_files/server2.crt.der | Bin 0 -> 827 bytes
.../mbedtls/tests/data_files/server2.der | Bin 0 -> 827 bytes
.../mbedtls/tests/data_files/server2.key | 27 +
.../mbedtls/tests/data_files/server2.key.der | Bin 0 -> 1192 bytes
.../mbedtls/tests/data_files/server2.key.enc | 30 +
.../tests/data_files/server2.ku-ds.crt | 20 +
.../tests/data_files/server2.ku-ds_ke.crt | 20 +
.../tests/data_files/server2.ku-ka.crt | 20 +
.../tests/data_files/server2.ku-ke.crt | 20 +
.../mbedtls/tests/data_files/server3.crt | 15 +
.../mbedtls/tests/data_files/server3.key | 5 +
.../mbedtls/tests/data_files/server4.crt | 17 +
.../mbedtls/tests/data_files/server4.key | 27 +
.../tests/data_files/server5-badsign.crt | 14 +
.../mbedtls/tests/data_files/server5-der0.crt | Bin 0 -> 548 bytes
.../tests/data_files/server5-der1a.crt | Bin 0 -> 549 bytes
.../tests/data_files/server5-der1b.crt | Bin 0 -> 549 bytes
.../mbedtls/tests/data_files/server5-der2.crt | Bin 0 -> 550 bytes
.../mbedtls/tests/data_files/server5-der4.crt | Bin 0 -> 552 bytes
.../mbedtls/tests/data_files/server5-der8.crt | Bin 0 -> 556 bytes
.../mbedtls/tests/data_files/server5-der9.crt | Bin 0 -> 557 bytes
.../tests/data_files/server5-expired.crt | 14 +
.../tests/data_files/server5-future.crt | 14 +
.../tests/data_files/server5-selfsigned.crt | 12 +
.../mbedtls/tests/data_files/server5-sha1.crt | 14 +
.../tests/data_files/server5-sha224.crt | 14 +
.../tests/data_files/server5-sha384.crt | 14 +
.../tests/data_files/server5-sha512.crt | 14 +
.../tests/data_files/server5-ss-expired.crt | 12 +
.../tests/data_files/server5-ss-forgeca.crt | 11 +
...erver5-tricky-ip-san-malformed-len.crt.der | Bin 0 -> 409 bytes
.../data_files/server5-tricky-ip-san.crt.der | Bin 0 -> 409 bytes
.../mbedtls/tests/data_files/server5.crt | 14 +
.../mbedtls/tests/data_files/server5.crt.der | Bin 0 -> 548 bytes
.../data_files/server5.crt.openssl.v3_ext | 3 +
.../tests/data_files/server5.eku-cli.crt | 13 +
.../tests/data_files/server5.eku-cs.crt | 13 +
.../tests/data_files/server5.eku-cs_any.crt | 13 +
.../tests/data_files/server5.eku-srv.crt | 13 +
.../tests/data_files/server5.eku-srv_cli.crt | 13 +
.../mbedtls/tests/data_files/server5.key | 5 +
.../mbedtls/tests/data_files/server5.key.der | Bin 0 -> 121 bytes
.../mbedtls/tests/data_files/server5.key.enc | 8 +
.../tests/data_files/server5.ku-ds.crt | 13 +
.../tests/data_files/server5.ku-ka.crt | 13 +
.../tests/data_files/server5.ku-ke.crt | 13 +
.../tests/data_files/server5.req.ku.sha1 | 8 +
.../tests/data_files/server6-ss-child.crt | 13 +
.../server6-ss-child.crt.openssl.v3_ext | 4 +
.../mbedtls/tests/data_files/server6.crt | 14 +
.../mbedtls/tests/data_files/server6.key | 5 +
.../tests/data_files/server7-badsign.crt | 47 +
.../tests/data_files/server7-expired.crt | 47 +
.../tests/data_files/server7-future.crt | 47 +
.../mbedtls/tests/data_files/server7.crt | 23 +
.../mbedtls/tests/data_files/server7.key | 5 +
.../tests/data_files/server7_int-ca-exp.crt | 47 +
.../tests/data_files/server7_int-ca.crt | 47 +
.../tests/data_files/server7_int-ca_ca2.crt | 60 +
.../data_files/server7_spurious_int-ca.crt | 65 +
.../mbedtls/tests/data_files/server8.crt | 17 +
.../mbedtls/tests/data_files/server8.key | 27 +
.../tests/data_files/server8_int-ca2.crt | 35 +
.../tests/data_files/server9-bad-mgfhash.crt | 21 +
.../tests/data_files/server9-bad-saltlen.crt | 21 +
.../tests/data_files/server9-badsign.crt | 19 +
.../tests/data_files/server9-defaults.crt | 18 +
.../tests/data_files/server9-sha224.crt | 21 +
.../tests/data_files/server9-sha256.crt | 21 +
.../tests/data_files/server9-sha384.crt | 21 +
.../tests/data_files/server9-sha512.crt | 21 +
.../tests/data_files/server9-with-ca.crt | 39 +
.../mbedtls/tests/data_files/server9.crt | 19 +
.../mbedtls/tests/data_files/server9.key | 15 +
.../mbedtls/tests/data_files/simplepass.psk | 1 +
.../tests/data_files/test-ca-alt-good.crt | 41 +
.../mbedtls/tests/data_files/test-ca-alt.crt | 21 +
.../mbedtls/tests/data_files/test-ca-alt.csr | 16 +
.../mbedtls/tests/data_files/test-ca-alt.key | 27 +
.../tests/data_files/test-ca-good-alt.crt | 41 +
.../mbedtls/tests/data_files/test-ca-sha1.crt | 20 +
.../tests/data_files/test-ca-sha1.crt.der | Bin 0 -> 837 bytes
.../tests/data_files/test-ca-sha256.crt | 20 +
.../tests/data_files/test-ca-sha256.crt.der | Bin 0 -> 837 bytes
.../mbedtls/tests/data_files/test-ca-v1.crt | 19 +
.../mbedtls/tests/data_files/test-ca.crt | 20 +
.../mbedtls/tests/data_files/test-ca.der | Bin 0 -> 837 bytes
.../mbedtls/tests/data_files/test-ca.key | 30 +
.../mbedtls/tests/data_files/test-ca.key.der | Bin 0 -> 1192 bytes
.../tests/data_files/test-ca.opensslconf | 125 +
.../tests/data_files/test-ca.req.sha256 | 16 +
.../tests/data_files/test-ca.req_ec.sha256 | 9 +
.../tests/data_files/test-ca.server1.db | 2 +
.../data_files/test-ca.server1.future-crl.db | 2 +
.../test-ca.server1.future-crl.opensslconf | 18 +
.../data_files/test-ca.server1.opensslconf | 18 +
.../test-ca.server1.test_serial.opensslconf | 25 +
.../tests/data_files/test-ca2-expired.crt | 13 +
.../mbedtls/tests/data_files/test-ca2.crt | 13 +
.../mbedtls/tests/data_files/test-ca2.crt.der | Bin 0 -> 523 bytes
.../mbedtls/tests/data_files/test-ca2.key | 6 +
.../mbedtls/tests/data_files/test-ca2.key.der | Bin 0 -> 167 bytes
.../mbedtls/tests/data_files/test-ca2.key.enc | 9 +
.../tests/data_files/test-ca2.ku-crl.crt | 12 +
.../test-ca2.ku-crl.crt.openssl.v3_ext | 4 +
.../tests/data_files/test-ca2.ku-crt.crt | 12 +
.../test-ca2.ku-crt.crt.openssl.v3_ext | 4 +
.../tests/data_files/test-ca2.ku-crt_crl.crt | 12 +
.../test-ca2.ku-crt_crl.crt.openssl.v3_ext | 4 +
.../tests/data_files/test-ca2.ku-ds.crt | 12 +
.../test-ca2.ku-ds.crt.openssl.v3_ext | 4 +
.../tests/data_files/test-ca2.req.sha256 | 9 +
.../test-ca2_cat-future-invalid.crt | 27 +
.../test-ca2_cat-future-present.crt | 26 +
.../data_files/test-ca2_cat-past-invalid.crt | 27 +
.../data_files/test-ca2_cat-past-present.crt | 26 +
.../test-ca2_cat-present-future.crt | 26 +
.../data_files/test-ca2_cat-present-past.crt | 26 +
.../tests/data_files/test-ca_cat12.crt | 33 +
.../tests/data_files/test-ca_cat21.crt | 33 +
.../tests/data_files/test-ca_printable.crt | 21 +
.../tests/data_files/test-ca_unenc.key | 27 +
.../tests/data_files/test-ca_uppercase.crt | 21 +
.../mbedtls/tests/data_files/test-ca_utf8.crt | 21 +
.../tests/data_files/test-int-ca-exp.crt | 24 +
.../mbedtls/tests/data_files/test-int-ca.crt | 24 +
.../mbedtls/tests/data_files/test-int-ca.key | 51 +
.../mbedtls/tests/data_files/test-int-ca2.crt | 18 +
.../mbedtls/tests/data_files/test-int-ca2.key | 6 +
.../tests/data_files/test-int-ca3-badsign.crt | 12 +
.../mbedtls/tests/data_files/test-int-ca3.crt | 12 +
.../mbedtls/tests/data_files/test-int-ca3.key | 8 +
.../tests/data_files/test_certs.h.jinja2 | 42 +
.../tests/data_files/tls13_early_data.txt | 4 +
.../mbedtls/tests/docker/bionic/Dockerfile | 158 +
.../mbedtls/tests/git-scripts/README.md | 16 +
.../mbedtls/tests/git-scripts/pre-push.sh | 34 +
.../mbedtls/tests/include/alt-dummy/aes_alt.h | 23 +
.../tests/include/alt-dummy/aria_alt.h | 16 +
.../tests/include/alt-dummy/camellia_alt.h | 16 +
.../mbedtls/tests/include/alt-dummy/ccm_alt.h | 16 +
.../tests/include/alt-dummy/chacha20_alt.h | 16 +
.../tests/include/alt-dummy/chachapoly_alt.h | 18 +
.../tests/include/alt-dummy/cmac_alt.h | 15 +
.../mbedtls/tests/include/alt-dummy/des_alt.h | 22 +
.../mbedtls/tests/include/alt-dummy/dhm_alt.h | 16 +
.../tests/include/alt-dummy/ecjpake_alt.h | 15 +
.../mbedtls/tests/include/alt-dummy/ecp_alt.h | 22 +
.../mbedtls/tests/include/alt-dummy/gcm_alt.h | 16 +
.../mbedtls/tests/include/alt-dummy/md5_alt.h | 16 +
.../tests/include/alt-dummy/nist_kw_alt.h | 15 +
.../tests/include/alt-dummy/platform_alt.h | 16 +
.../tests/include/alt-dummy/poly1305_alt.h | 16 +
.../tests/include/alt-dummy/ripemd160_alt.h | 16 +
.../mbedtls/tests/include/alt-dummy/rsa_alt.h | 16 +
.../tests/include/alt-dummy/sha1_alt.h | 16 +
.../tests/include/alt-dummy/sha256_alt.h | 16 +
.../tests/include/alt-dummy/sha512_alt.h | 16 +
.../tests/include/alt-dummy/threading_alt.h | 14 +
.../tests/include/alt-dummy/timing_alt.h | 19 +
.../tests/include/alt-extra/psa/crypto.h | 7 +
.../tests/include/baremetal-override/time.h | 6 +
.../mbedtls/tests/include/spe/crypto_spe.h | 131 +
.../mbedtls/tests/include/test/arguments.h | 26 +
.../mbedtls/tests/include/test/asn1_helpers.h | 38 +
.../tests/include/test/bignum_helpers.h | 98 +
.../mbedtls/tests/include/test/certs.h | 234 +
.../tests/include/test/constant_flow.h | 71 +
.../mbedtls/tests/include/test/drivers/aead.h | 121 +
.../test/drivers/asymmetric_encryption.h | 67 +
.../tests/include/test/drivers/cipher.h | 136 +
.../include/test/drivers/config_test_driver.h | 46 +
.../crypto_config_test_driver_extension.h | 674 +
.../mbedtls/tests/include/test/drivers/hash.h | 64 +
.../include/test/drivers/key_agreement.h | 62 +
.../include/test/drivers/key_management.h | 129 +
.../mbedtls/tests/include/test/drivers/mac.h | 125 +
.../mbedtls/tests/include/test/drivers/pake.h | 75 +
.../tests/include/test/drivers/signature.h | 112 +
.../tests/include/test/drivers/test_driver.h | 32 +
.../include/test/fake_external_rng_for_test.h | 40 +
.../mbedtls/tests/include/test/helpers.h | 404 +
.../mbedtls/tests/include/test/macros.h | 250 +
.../mbedtls/tests/include/test/memory.h | 108 +
.../tests/include/test/psa_crypto_helpers.h | 441 +
.../tests/include/test/psa_exercise_key.h | 286 +
.../mbedtls/tests/include/test/psa_helpers.h | 24 +
.../test/psa_memory_poisoning_wrappers.h | 40 +
.../tests/include/test/psa_test_wrappers.h | 739 +
.../mbedtls/tests/include/test/random.h | 91 +
.../mbedtls/tests/include/test/ssl_helpers.h | 664 +
.../tests/include/test/threading_helpers.h | 112 +
.../external/mbedtls/tests/make-in-docker.sh | 21 +
.../tests/opt-testcases/tls13-compat.sh | 15239 ++++++
.../tests/opt-testcases/tls13-kex-modes.sh | 3170 ++
.../mbedtls/tests/opt-testcases/tls13-misc.sh | 1190 +
.../mbedtls/tests/scripts/all-in-docker.sh | 27 +
.../external/mbedtls/tests/scripts/all.sh | 6531 +++
.../mbedtls/tests/scripts/analyze_outcomes.py | 720 +
.../tests/scripts/audit-validity-dates.py | 469 +
.../mbedtls/tests/scripts/basic-build-test.sh | 250 +
.../mbedtls/tests/scripts/basic-in-docker.sh | 37 +
.../tests/scripts/check-doxy-blocks.pl | 67 +
.../tests/scripts/check-generated-files.sh | 151 +
.../tests/scripts/check-python-files.sh | 68 +
.../mbedtls/tests/scripts/check_files.py | 537 +
.../mbedtls/tests/scripts/check_names.py | 965 +
.../mbedtls/tests/scripts/check_test_cases.py | 241 +
.../external/mbedtls/tests/scripts/depends.py | 557 +
.../mbedtls/tests/scripts/docker_env.sh | 90 +
.../external/mbedtls/tests/scripts/doxygen.sh | 32 +
.../mbedtls/tests/scripts/gen_ctr_drbg.pl | 96 +
.../mbedtls/tests/scripts/gen_gcm_decrypt.pl | 101 +
.../mbedtls/tests/scripts/gen_gcm_encrypt.pl | 84 +
.../scripts/gen_pkcs1_v21_sign_verify.pl | 74 +
.../tests/scripts/generate-afl-tests.sh | 71 +
.../tests/scripts/generate_bignum_tests.py | 187 +
.../tests/scripts/generate_ecp_tests.py | 22 +
.../tests/scripts/generate_pkcs7_tests.py | 183 +
.../tests/scripts/generate_psa_tests.py | 850 +
.../tests/scripts/generate_psa_wrappers.py | 257 +
.../scripts/generate_server9_bad_saltlen.py | 87 +
.../scripts/generate_test_cert_macros.py | 95 +
.../tests/scripts/generate_test_code.py | 1277 +
.../scripts/generate_tls13_compat_tests.py | 657 +
.../mbedtls/tests/scripts/list-identifiers.sh | 54 +
.../scripts/list_internal_identifiers.py | 45 +
.../tests/scripts/psa_collect_statuses.py | 128 +
.../mbedtls/tests/scripts/quiet/cmake | 19 +
.../external/mbedtls/tests/scripts/quiet/make | 19 +
.../mbedtls/tests/scripts/quiet/quiet.sh | 79 +
.../mbedtls/tests/scripts/recursion.pl | 47 +
.../mbedtls/tests/scripts/run-metatests.sh | 89 +
.../mbedtls/tests/scripts/run-test-suites.pl | 158 +
.../mbedtls/tests/scripts/run_demos.py | 63 +
.../mbedtls/tests/scripts/scripts_path.py | 17 +
.../scripts/set_psa_test_dependencies.py | 284 +
.../mbedtls/tests/scripts/tcp_client.pl | 89 +
.../mbedtls/tests/scripts/test-ref-configs.pl | 161 +
.../tests/scripts/test_config_script.py | 175 +
.../tests/scripts/test_generate_test_code.py | 1915 +
.../tests/scripts/test_psa_compliance.py | 159 +
.../tests/scripts/test_psa_constant_names.py | 191 +
.../mbedtls/tests/scripts/test_zeroize.gdb | 64 +
.../tests/scripts/translate_ciphers.py | 180 +
.../tests/scripts/travis-log-failure.sh | 35 +
.../external/mbedtls/tests/src/asn1_helpers.c | 62 +
.../mbedtls/tests/src/bignum_helpers.c | 145 +
.../external/mbedtls/tests/src/certs.c | 480 +
.../external/mbedtls/tests/src/drivers/hash.c | 199 +
.../tests/src/drivers/platform_builtin_keys.c | 78 +
.../tests/src/drivers/test_driver_aead.c | 462 +
.../test_driver_asymmetric_encryption.c | 181 +
.../tests/src/drivers/test_driver_cipher.c | 432 +
.../src/drivers/test_driver_key_agreement.c | 147 +
.../src/drivers/test_driver_key_management.c | 787 +
.../tests/src/drivers/test_driver_mac.c | 422 +
.../tests/src/drivers/test_driver_pake.c | 202 +
.../tests/src/drivers/test_driver_signature.c | 404 +
.../tests/src/fake_external_rng_for_test.c | 45 +
.../external/mbedtls/tests/src/helpers.c | 708 +
.../mbedtls/tests/src/psa_crypto_helpers.c | 207 +
.../mbedtls/tests/src/psa_crypto_stubs.c | 75 +
.../mbedtls/tests/src/psa_exercise_key.c | 1335 +
.../tests/src/psa_memory_poisoning_wrappers.c | 31 +
.../mbedtls/tests/src/psa_test_wrappers.c | 1321 +
.../external/mbedtls/tests/src/random.c | 136 +
.../external/mbedtls/tests/src/test_certs.h | 1226 +
.../tests/src/test_helpers/ssl_helpers.c | 2559 +
.../external/mbedtls/tests/src/test_memory.c | 60 +
.../mbedtls/tests/src/threading_helpers.c | 354 +
.../mbedtls/tests/ssl-opt-in-docker.sh | 55 +
lib/mbedtls/external/mbedtls/tests/ssl-opt.sh | 14036 ++++++
.../mbedtls/tests/suites/helpers.function | 112 +
.../mbedtls/tests/suites/host_test.function | 790 +
.../mbedtls/tests/suites/main_test.function | 266 +
.../tests/suites/test_suite_aes.cbc.data | 263 +
.../tests/suites/test_suite_aes.cfb.data | 507 +
.../tests/suites/test_suite_aes.ctr.data | 137 +
.../tests/suites/test_suite_aes.ecb.data | 289 +
.../tests/suites/test_suite_aes.function | 738 +
.../tests/suites/test_suite_aes.ofb.data | 35 +
.../tests/suites/test_suite_aes.rest.data | 23 +
.../tests/suites/test_suite_aes.xts.data | 169 +
.../tests/suites/test_suite_alignment.data | 119 +
.../suites/test_suite_alignment.function | 360 +
.../mbedtls/tests/suites/test_suite_aria.data | 92 +
.../tests/suites/test_suite_aria.function | 278 +
.../tests/suites/test_suite_asn1parse.data | 637 +
.../suites/test_suite_asn1parse.function | 774 +
.../tests/suites/test_suite_asn1write.data | 395 +
.../suites/test_suite_asn1write.function | 601 +
.../tests/suites/test_suite_base64.data | 195 +
.../tests/suites/test_suite_base64.function | 175 +
.../tests/suites/test_suite_bignum.function | 1420 +
.../suites/test_suite_bignum.generated.data | 975 +
.../tests/suites/test_suite_bignum.misc.data | 1810 +
.../suites/test_suite_bignum_core.function | 1319 +
.../test_suite_bignum_core.generated.data | 33191 +++++++++++++
.../suites/test_suite_bignum_core.misc.data | 525 +
.../suites/test_suite_bignum_mod.function | 742 +
.../test_suite_bignum_mod.generated.data | 6781 +++
.../suites/test_suite_bignum_mod.misc.data | 370 +
.../suites/test_suite_bignum_mod_raw.data | 181 +
.../suites/test_suite_bignum_mod_raw.function | 865 +
.../test_suite_bignum_mod_raw.generated.data | 9226 ++++
.../suites/test_suite_bignum_random.data | 340 +
.../suites/test_suite_bignum_random.function | 479 +
.../tests/suites/test_suite_block_cipher.data | 255 +
.../suites/test_suite_block_cipher.function | 129 +
.../suites/test_suite_block_cipher.psa.data | 35 +
.../tests/suites/test_suite_camellia.data | 204 +
.../tests/suites/test_suite_camellia.function | 197 +
.../mbedtls/tests/suites/test_suite_ccm.data | 1763 +
.../tests/suites/test_suite_ccm.function | 890 +
.../tests/suites/test_suite_chacha20.data | 26 +
.../tests/suites/test_suite_chacha20.function | 75 +
.../tests/suites/test_suite_chachapoly.data | 24 +
.../suites/test_suite_chachapoly.function | 164 +
.../tests/suites/test_suite_cipher.aes.data | 2271 +
.../tests/suites/test_suite_cipher.aria.data | 351 +
.../suites/test_suite_cipher.camellia.data | 1115 +
.../tests/suites/test_suite_cipher.ccm.data | 863 +
.../suites/test_suite_cipher.chacha20.data | 135 +
.../suites/test_suite_cipher.chachapoly.data | 143 +
.../tests/suites/test_suite_cipher.des.data | 623 +
.../tests/suites/test_suite_cipher.function | 1254 +
.../tests/suites/test_suite_cipher.gcm.data | 4747 ++
.../tests/suites/test_suite_cipher.misc.data | 5 +
.../suites/test_suite_cipher.nist_kw.data | 278 +
.../tests/suites/test_suite_cipher.null.data | 95 +
.../suites/test_suite_cipher.padding.data | 219 +
.../mbedtls/tests/suites/test_suite_cmac.data | 95 +
.../tests/suites/test_suite_cmac.function | 301 +
.../tests/suites/test_suite_common.data | 62 +
.../tests/suites/test_suite_common.function | 82 +
.../suites/test_suite_constant_time.data | 866 +
.../suites/test_suite_constant_time.function | 499 +
.../suites/test_suite_constant_time_hmac.data | 15 +
.../test_suite_constant_time_hmac.function | 159 +
.../tests/suites/test_suite_ctr_drbg.data | 1152 +
.../tests/suites/test_suite_ctr_drbg.function | 523 +
.../tests/suites/test_suite_debug.data | 67 +
.../tests/suites/test_suite_debug.function | 244 +
.../mbedtls/tests/suites/test_suite_des.data | 251 +
.../tests/suites/test_suite_des.function | 280 +
.../mbedtls/tests/suites/test_suite_dhm.data | 124 +
.../tests/suites/test_suite_dhm.function | 292 +
.../mbedtls/tests/suites/test_suite_ecdh.data | 118 +
.../tests/suites/test_suite_ecdh.function | 483 +
.../tests/suites/test_suite_ecdsa.data | 423 +
.../tests/suites/test_suite_ecdsa.function | 530 +
.../tests/suites/test_suite_ecjpake.data | 236 +
.../tests/suites/test_suite_ecjpake.function | 242 +
.../mbedtls/tests/suites/test_suite_ecp.data | 2273 +
.../tests/suites/test_suite_ecp.function | 1929 +
.../suites/test_suite_ecp.generated.data | 919 +
.../tests/suites/test_suite_entropy.data | 86 +
.../tests/suites/test_suite_entropy.function | 560 +
.../tests/suites/test_suite_error.data | 21 +
.../tests/suites/test_suite_error.function | 21 +
.../suites/test_suite_gcm.aes128_de.data | 735 +
.../suites/test_suite_gcm.aes128_en.data | 735 +
.../suites/test_suite_gcm.aes192_de.data | 679 +
.../suites/test_suite_gcm.aes192_en.data | 679 +
.../suites/test_suite_gcm.aes256_de.data | 679 +
.../suites/test_suite_gcm.aes256_en.data | 679 +
.../tests/suites/test_suite_gcm.camellia.data | 215 +
.../tests/suites/test_suite_gcm.function | 615 +
.../tests/suites/test_suite_gcm.misc.data | 14 +
.../mbedtls/tests/suites/test_suite_hkdf.data | 98 +
.../tests/suites/test_suite_hkdf.function | 158 +
.../suites/test_suite_hmac_drbg.function | 318 +
.../suites/test_suite_hmac_drbg.misc.data | 146 +
.../test_suite_hmac_drbg.no_reseed.data | 1200 +
.../suites/test_suite_hmac_drbg.nopr.data | 1200 +
.../tests/suites/test_suite_hmac_drbg.pr.data | 1200 +
.../tests/suites/test_suite_lmots.data | 151 +
.../tests/suites/test_suite_lmots.function | 246 +
.../mbedtls/tests/suites/test_suite_lms.data | 263 +
.../tests/suites/test_suite_lms.function | 198 +
.../mbedtls/tests/suites/test_suite_md.data | 1261 +
.../tests/suites/test_suite_md.function | 474 +
.../tests/suites/test_suite_md.psa.data | 135 +
.../mbedtls/tests/suites/test_suite_mdx.data | 51 +
.../tests/suites/test_suite_mdx.function | 58 +
.../test_suite_memory_buffer_alloc.data | 23 +
.../test_suite_memory_buffer_alloc.function | 264 +
.../mbedtls/tests/suites/test_suite_mps.data | 125 +
.../tests/suites/test_suite_mps.function | 1164 +
.../mbedtls/tests/suites/test_suite_net.data | 8 +
.../tests/suites/test_suite_net.function | 137 +
.../tests/suites/test_suite_nist_kw.data | 483 +
.../tests/suites/test_suite_nist_kw.function | 303 +
.../mbedtls/tests/suites/test_suite_oid.data | 243 +
.../tests/suites/test_suite_oid.function | 170 +
.../mbedtls/tests/suites/test_suite_pem.data | 86 +
.../tests/suites/test_suite_pem.function | 94 +
.../mbedtls/tests/suites/test_suite_pk.data | 1674 +
.../tests/suites/test_suite_pk.function | 2843 ++
.../tests/suites/test_suite_pkcs12.data | 71 +
.../tests/suites/test_suite_pkcs12.function | 181 +
.../tests/suites/test_suite_pkcs1_v15.data | 95 +
.../suites/test_suite_pkcs1_v15.function | 352 +
.../tests/suites/test_suite_pkcs1_v21.data | 1292 +
.../suites/test_suite_pkcs1_v21.function | 272 +
.../tests/suites/test_suite_pkcs5.data | 270 +
.../tests/suites/test_suite_pkcs5.function | 136 +
.../tests/suites/test_suite_pkcs7.data | 3257 ++
.../tests/suites/test_suite_pkcs7.function | 171 +
.../tests/suites/test_suite_pkparse.data | 1218 +
.../tests/suites/test_suite_pkparse.function | 335 +
.../tests/suites/test_suite_pkwrite.data | 155 +
.../tests/suites/test_suite_pkwrite.function | 225 +
.../tests/suites/test_suite_platform.data | 15 +
.../tests/suites/test_suite_platform.function | 136 +
.../suites/test_suite_platform_printf.data | 114 +
.../test_suite_platform_printf.function | 89 +
.../suites/test_suite_platform_util.data | 47 +
.../suites/test_suite_platform_util.function | 61 +
.../tests/suites/test_suite_poly1305.data | 39 +
.../tests/suites/test_suite_poly1305.function | 85 +
.../tests/suites/test_suite_psa_crypto.data | 7827 +++
.../suites/test_suite_psa_crypto.function | 10792 ++++
.../suites/test_suite_psa_crypto.pbkdf2.data | 16 +
.../test_suite_psa_crypto_attributes.data | 27 +
.../test_suite_psa_crypto_attributes.function | 132 +
...test_suite_psa_crypto_driver_wrappers.data | 867 +
..._suite_psa_crypto_driver_wrappers.function | 3289 ++
.../suites/test_suite_psa_crypto_entropy.data | 45 +
.../test_suite_psa_crypto_entropy.function | 251 +
...est_suite_psa_crypto_generate_key.function | 48 +
...ite_psa_crypto_generate_key.generated.data | 393 +
.../suites/test_suite_psa_crypto_hash.data | 670 +
.../test_suite_psa_crypto_hash.function | 148 +
.../suites/test_suite_psa_crypto_init.data | 72 +
.../test_suite_psa_crypto_init.function | 403 +
.../test_suite_psa_crypto_low_hash.function | 209 +
...t_suite_psa_crypto_low_hash.generated.data | 171 +
.../suites/test_suite_psa_crypto_memory.data | 62 +
.../test_suite_psa_crypto_memory.function | 258 +
.../test_suite_psa_crypto_metadata.data | 464 +
.../test_suite_psa_crypto_metadata.function | 737 +
...st_suite_psa_crypto_not_supported.function | 52 +
...te_psa_crypto_not_supported.generated.data | 1011 +
...t_suite_psa_crypto_not_supported.misc.data | 11 +
.../test_suite_psa_crypto_op_fail.function | 408 +
...st_suite_psa_crypto_op_fail.generated.data | 41374 ++++++++++++++++
.../test_suite_psa_crypto_op_fail.misc.data | 15 +
.../suites/test_suite_psa_crypto_pake.data | 243 +
.../test_suite_psa_crypto_pake.function | 1202 +
.../test_suite_psa_crypto_persistent_key.data | 135 +
...t_suite_psa_crypto_persistent_key.function | 340 +
.../test_suite_psa_crypto_se_driver_hal.data | 203 +
...st_suite_psa_crypto_se_driver_hal.function | 1533 +
..._suite_psa_crypto_se_driver_hal_mocks.data | 59 +
...te_psa_crypto_se_driver_hal_mocks.function | 671 +
...test_suite_psa_crypto_slot_management.data | 238 +
..._suite_psa_crypto_slot_management.function | 1041 +
...ite_psa_crypto_storage_format.current.data | 10703 ++++
...t_suite_psa_crypto_storage_format.function | 306 +
..._suite_psa_crypto_storage_format.misc.data | 11 +
...st_suite_psa_crypto_storage_format.v0.data | 11063 +++++
.../suites/test_suite_psa_crypto_util.data | 167 +
.../test_suite_psa_crypto_util.function | 91 +
.../tests/suites/test_suite_psa_its.data | 74 +
.../tests/suites/test_suite_psa_its.function | 303 +
.../tests/suites/test_suite_random.data | 55 +
.../tests/suites/test_suite_random.function | 217 +
.../mbedtls/tests/suites/test_suite_rsa.data | 836 +
.../tests/suites/test_suite_rsa.function | 1503 +
.../mbedtls/tests/suites/test_suite_shax.data | 2416 +
.../tests/suites/test_suite_shax.function | 313 +
.../mbedtls/tests/suites/test_suite_ssl.data | 3383 ++
.../tests/suites/test_suite_ssl.function | 5024 ++
.../suites/test_suite_ssl_decrypt.function | 312 +
.../suites/test_suite_ssl_decrypt.misc.data | 399 +
.../tests/suites/test_suite_test_helpers.data | 23 +
.../suites/test_suite_test_helpers.function | 40 +
.../tests/suites/test_suite_timing.data | 8 +
.../tests/suites/test_suite_timing.function | 57 +
.../tests/suites/test_suite_version.data | 15 +
.../tests/suites/test_suite_version.function | 73 +
.../tests/suites/test_suite_x509parse.data | 3441 ++
.../suites/test_suite_x509parse.function | 1736 +
.../tests/suites/test_suite_x509write.data | 270 +
.../suites/test_suite_x509write.function | 759 +
.../mbedtls/visualc/VS2017/.gitignore | 16 +
.../mbedtls/visualc/VS2017/aead_demo.vcxproj | 171 +
.../mbedtls/visualc/VS2017/benchmark.vcxproj | 171 +
.../mbedtls/visualc/VS2017/cert_app.vcxproj | 171 +
.../mbedtls/visualc/VS2017/cert_req.vcxproj | 171 +
.../mbedtls/visualc/VS2017/cert_write.vcxproj | 171 +
.../visualc/VS2017/cipher_aead_demo.vcxproj | 171 +
.../mbedtls/visualc/VS2017/crl_app.vcxproj | 171 +
.../visualc/VS2017/crypt_and_hash.vcxproj | 171 +
.../visualc/VS2017/crypto_examples.vcxproj | 171 +
.../mbedtls/visualc/VS2017/dh_client.vcxproj | 171 +
.../visualc/VS2017/dh_genprime.vcxproj | 171 +
.../mbedtls/visualc/VS2017/dh_server.vcxproj | 171 +
.../visualc/VS2017/dtls_client.vcxproj | 171 +
.../visualc/VS2017/dtls_server.vcxproj | 171 +
.../visualc/VS2017/ecdh_curve25519.vcxproj | 171 +
.../mbedtls/visualc/VS2017/ecdsa.vcxproj | 171 +
.../visualc/VS2017/gen_entropy.vcxproj | 171 +
.../mbedtls/visualc/VS2017/gen_key.vcxproj | 171 +
.../VS2017/gen_random_ctr_drbg.vcxproj | 171 +
.../visualc/VS2017/generic_sum.vcxproj | 171 +
.../mbedtls/visualc/VS2017/hello.vcxproj | 171 +
.../mbedtls/visualc/VS2017/hmac_demo.vcxproj | 171 +
.../mbedtls/visualc/VS2017/key_app.vcxproj | 171 +
.../visualc/VS2017/key_app_writer.vcxproj | 171 +
.../visualc/VS2017/key_ladder_demo.vcxproj | 171 +
.../mbedtls/visualc/VS2017/load_roots.vcxproj | 171 +
.../mbedtls/visualc/VS2017/mbedTLS.sln | 782 +
.../mbedtls/visualc/VS2017/mbedTLS.vcxproj | 482 +
.../visualc/VS2017/md_hmac_demo.vcxproj | 171 +
.../mbedtls/visualc/VS2017/metatest.vcxproj | 171 +
.../visualc/VS2017/mini_client.vcxproj | 171 +
.../mbedtls/visualc/VS2017/mpi_demo.vcxproj | 171 +
.../mbedtls/visualc/VS2017/pem2der.vcxproj | 171 +
.../mbedtls/visualc/VS2017/pk_decrypt.vcxproj | 171 +
.../mbedtls/visualc/VS2017/pk_encrypt.vcxproj | 171 +
.../mbedtls/visualc/VS2017/pk_sign.vcxproj | 171 +
.../mbedtls/visualc/VS2017/pk_verify.vcxproj | 171 +
.../visualc/VS2017/psa_constant_names.vcxproj | 171 +
.../mbedtls/visualc/VS2017/psa_hash.vcxproj | 171 +
.../VS2017/query_compile_time_config.vcxproj | 172 +
.../VS2017/query_included_headers.vcxproj | 171 +
.../mbedtls/visualc/VS2017/req_app.vcxproj | 171 +
.../visualc/VS2017/rsa_decrypt.vcxproj | 171 +
.../visualc/VS2017/rsa_encrypt.vcxproj | 171 +
.../mbedtls/visualc/VS2017/rsa_genkey.vcxproj | 171 +
.../mbedtls/visualc/VS2017/rsa_sign.vcxproj | 171 +
.../visualc/VS2017/rsa_sign_pss.vcxproj | 171 +
.../mbedtls/visualc/VS2017/rsa_verify.vcxproj | 171 +
.../visualc/VS2017/rsa_verify_pss.vcxproj | 171 +
.../mbedtls/visualc/VS2017/selftest.vcxproj | 171 +
.../visualc/VS2017/ssl_client1.vcxproj | 171 +
.../visualc/VS2017/ssl_client2.vcxproj | 173 +
.../visualc/VS2017/ssl_context_info.vcxproj | 171 +
.../visualc/VS2017/ssl_fork_server.vcxproj | 171 +
.../visualc/VS2017/ssl_mail_client.vcxproj | 171 +
.../mbedtls/visualc/VS2017/ssl_server.vcxproj | 171 +
.../visualc/VS2017/ssl_server2.vcxproj | 173 +
.../mbedtls/visualc/VS2017/strerror.vcxproj | 171 +
.../mbedtls/visualc/VS2017/udp_proxy.vcxproj | 171 +
.../mbedtls/visualc/VS2017/zeroize.vcxproj | 171 +
lib/mbedtls/hash_shim.c | 118 +
lib/mbedtls/mbedtls_def_config.h | 4125 ++
lib/mbedtls/port/assert.h | 12 +
lib/mbedtls/port/limits.h | 33 +
test/py/tests/test_efi_secboot/conftest.py | 4 +-
1801 files changed, 631033 insertions(+), 44 deletions(-)
create mode 100644 include/mbedtls/md5.h
create mode 100644 include/mbedtls/sha1.h
create mode 100644 include/mbedtls/sha256.h
create mode 100644 include/mbedtls/sha512.h
create mode 100644 lib/mbedtls/Kconfig
create mode 100644 lib/mbedtls/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/Makefile.inc
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/Makefile.inc
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/README.md
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/Hacl_Curve25519.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/everest.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlib.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlib/FStar_UInt128.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlin/c_endianness.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlin/internal/builtin.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlin/internal/callconv.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlin/internal/compat.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlin/internal/debug.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlin/internal/target.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlin/internal/types.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/kremlin/internal/wasmsupport.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/vs2013/Hacl_Curve25519.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/vs2013/inttypes.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/vs2013/stdbool.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/include/everest/x25519.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/library/Hacl_Curve25519.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/library/Hacl_Curve25519_joined.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/library/everest.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/library/kremlib/FStar_UInt128_extracted.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/library/kremlib/FStar_UInt64_FStar_UInt32_FStar_UInt16_FStar_UInt8.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/library/legacy/Hacl_Curve25519.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/everest/library/x25519.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/p256-m/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/p256-m/Makefile.inc
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/p256-m/README.md
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/p256-m/p256-m/README.md
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/p256-m/p256-m/p256-m.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/p256-m/p256-m/p256-m.h
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/p256-m/p256-m_driver_entrypoints.c
create mode 100644 lib/mbedtls/external/mbedtls/3rdparty/p256-m/p256-m_driver_entrypoints.h
create mode 100644 lib/mbedtls/external/mbedtls/BRANCHES.md
create mode 100644 lib/mbedtls/external/mbedtls/BUGS.md
create mode 100644 lib/mbedtls/external/mbedtls/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/CONTRIBUTING.md
create mode 100644 lib/mbedtls/external/mbedtls/ChangeLog
create mode 100644 lib/mbedtls/external/mbedtls/ChangeLog.d/00README.md
create mode 100644 lib/mbedtls/external/mbedtls/DartConfiguration.tcl
create mode 100644 lib/mbedtls/external/mbedtls/LICENSE
create mode 100644 lib/mbedtls/external/mbedtls/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/README.md
create mode 100644 lib/mbedtls/external/mbedtls/SECURITY.md
create mode 100644 lib/mbedtls/external/mbedtls/SUPPORT.md
create mode 100644 lib/mbedtls/external/mbedtls/cmake/MbedTLSConfig.cmake.in
create mode 100644 lib/mbedtls/external/mbedtls/configs/README.txt
create mode 100644 lib/mbedtls/external/mbedtls/configs/config-ccm-psk-dtls1_2.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/config-ccm-psk-tls1_2.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/config-no-entropy.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/config-suite-b.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/config-symmetric-only.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/config-tfm.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/config-thread.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/crypto-config-ccm-aes-sha256.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/ext/README.md
create mode 100644 lib/mbedtls/external/mbedtls/configs/ext/config_tfm.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/ext/crypto_config_profile_medium.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/ext/mbedtls_entropy_nv_seed_config.h
create mode 100644 lib/mbedtls/external/mbedtls/configs/ext/tfm_mbedcrypto_config_profile_medium.h
create mode 100644 lib/mbedtls/external/mbedtls/dco.txt
create mode 100644 lib/mbedtls/external/mbedtls/docs/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/docs/3.0-migration-guide.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/alternative-implementations.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/mbed-crypto-storage-specification.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-crypto-implementation-structure.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-migration/md-cipher-dispatch.md
create mode 100755 lib/mbedtls/external/mbedtls/docs/architecture/psa-migration/outcome-analysis.sh
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-migration/psa-legacy-bridges.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-migration/psa-limitations.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-migration/strategy.md
create mode 100755 lib/mbedtls/external/mbedtls/docs/architecture/psa-migration/syms.sh
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-migration/testing.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-shared-memory.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-storage-resilience.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-thread-safety/key-slot-state-transitions.png
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/psa-thread-safety/psa-thread-safety.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/testing/driver-interface-test-strategy.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/testing/invasive-testing.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/testing/psa-storage-format-testing.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/testing/test-framework.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/architecture/tls13-support.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/conf.py
create mode 100644 lib/mbedtls/external/mbedtls/docs/driver-only-builds.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/index.rst
create mode 100644 lib/mbedtls/external/mbedtls/docs/proposed/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/docs/proposed/README
create mode 100644 lib/mbedtls/external/mbedtls/docs/proposed/psa-conditional-inclusion-c.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/proposed/psa-driver-developer-guide.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/proposed/psa-driver-integration-guide.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/proposed/psa-driver-interface.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/proposed/psa-driver-wrappers-codegen-migration-guide.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/psa-driver-example-and-guide.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/psa-transition.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/redirects.yaml
create mode 100644 lib/mbedtls/external/mbedtls/docs/requirements.in
create mode 100644 lib/mbedtls/external/mbedtls/docs/requirements.txt
create mode 100644 lib/mbedtls/external/mbedtls/docs/tls13-early-data.md
create mode 100644 lib/mbedtls/external/mbedtls/docs/use-psa-crypto.md
create mode 100644 lib/mbedtls/external/mbedtls/doxygen/input/doc_encdec.h
create mode 100644 lib/mbedtls/external/mbedtls/doxygen/input/doc_hashing.h
create mode 100644 lib/mbedtls/external/mbedtls/doxygen/input/doc_mainpage.h
create mode 100644 lib/mbedtls/external/mbedtls/doxygen/input/doc_rng.h
create mode 100644 lib/mbedtls/external/mbedtls/doxygen/input/doc_ssltls.h
create mode 100644 lib/mbedtls/external/mbedtls/doxygen/input/doc_tcpip.h
create mode 100644 lib/mbedtls/external/mbedtls/doxygen/input/doc_x509.h
create mode 100644 lib/mbedtls/external/mbedtls/doxygen/mbedtls.doxyfile
create mode 100644 lib/mbedtls/external/mbedtls/include/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/include/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/aes.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/aria.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/asn1.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/asn1write.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/base64.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/bignum.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/block_cipher.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/build_info.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/camellia.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ccm.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/chacha20.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/chachapoly.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/check_config.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/cipher.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/cmac.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/compat-2.x.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/config_adjust_legacy_crypto.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/config_adjust_legacy_from_psa.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/config_adjust_psa_from_legacy.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/config_adjust_psa_superset_legacy.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/config_adjust_ssl.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/config_adjust_x509.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/config_psa.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/constant_time.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ctr_drbg.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/debug.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/des.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/dhm.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ecdh.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ecdsa.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ecjpake.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ecp.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/entropy.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/error.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/gcm.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/hkdf.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/hmac_drbg.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/lms.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/mbedtls_config.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/md.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/md5.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/memory_buffer_alloc.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/net_sockets.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/nist_kw.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/oid.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/pem.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/pk.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/pkcs12.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/pkcs5.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/platform.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/platform_time.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/platform_util.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/poly1305.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/private_access.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/psa_util.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ripemd160.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/rsa.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/sha1.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/sha256.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/sha3.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/sha512.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ssl.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ssl_cache.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ssl_ciphersuites.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ssl_cookie.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/ssl_ticket.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/threading.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/timing.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/version.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/x509.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/x509_crl.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/x509_crt.h
create mode 100644 lib/mbedtls/external/mbedtls/include/mbedtls/x509_csr.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/build_info.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_adjust_auto_enabled.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_adjust_config_key_pair_types.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_adjust_config_synonyms.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_builtin_composites.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_builtin_key_derivation.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_builtin_primitives.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_compat.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_config.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_driver_common.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_driver_contexts_composites.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_driver_contexts_key_derivation.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_driver_contexts_primitives.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_extra.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_legacy.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_platform.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_se_driver.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_sizes.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_struct.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_types.h
create mode 100644 lib/mbedtls/external/mbedtls/include/psa/crypto_values.h
create mode 100644 lib/mbedtls/external/mbedtls/library/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/library/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/library/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/library/aes.c
create mode 100644 lib/mbedtls/external/mbedtls/library/aesce.c
create mode 100644 lib/mbedtls/external/mbedtls/library/aesce.h
create mode 100644 lib/mbedtls/external/mbedtls/library/aesni.c
create mode 100644 lib/mbedtls/external/mbedtls/library/aesni.h
create mode 100644 lib/mbedtls/external/mbedtls/library/alignment.h
create mode 100644 lib/mbedtls/external/mbedtls/library/aria.c
create mode 100644 lib/mbedtls/external/mbedtls/library/asn1parse.c
create mode 100644 lib/mbedtls/external/mbedtls/library/asn1write.c
create mode 100644 lib/mbedtls/external/mbedtls/library/base64.c
create mode 100644 lib/mbedtls/external/mbedtls/library/base64_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/bignum.c
create mode 100644 lib/mbedtls/external/mbedtls/library/bignum_core.c
create mode 100644 lib/mbedtls/external/mbedtls/library/bignum_core.h
create mode 100644 lib/mbedtls/external/mbedtls/library/bignum_mod.c
create mode 100644 lib/mbedtls/external/mbedtls/library/bignum_mod.h
create mode 100644 lib/mbedtls/external/mbedtls/library/bignum_mod_raw.c
create mode 100644 lib/mbedtls/external/mbedtls/library/bignum_mod_raw.h
create mode 100644 lib/mbedtls/external/mbedtls/library/bignum_mod_raw_invasive.h
create mode 100644 lib/mbedtls/external/mbedtls/library/block_cipher.c
create mode 100644 lib/mbedtls/external/mbedtls/library/block_cipher_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/bn_mul.h
create mode 100644 lib/mbedtls/external/mbedtls/library/camellia.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ccm.c
create mode 100644 lib/mbedtls/external/mbedtls/library/chacha20.c
create mode 100644 lib/mbedtls/external/mbedtls/library/chachapoly.c
create mode 100644 lib/mbedtls/external/mbedtls/library/check_crypto_config.h
create mode 100644 lib/mbedtls/external/mbedtls/library/cipher.c
create mode 100644 lib/mbedtls/external/mbedtls/library/cipher_wrap.c
create mode 100644 lib/mbedtls/external/mbedtls/library/cipher_wrap.h
create mode 100644 lib/mbedtls/external/mbedtls/library/cmac.c
create mode 100644 lib/mbedtls/external/mbedtls/library/common.h
create mode 100644 lib/mbedtls/external/mbedtls/library/constant_time.c
create mode 100644 lib/mbedtls/external/mbedtls/library/constant_time_impl.h
create mode 100644 lib/mbedtls/external/mbedtls/library/constant_time_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ctr.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ctr_drbg.c
create mode 100644 lib/mbedtls/external/mbedtls/library/debug.c
create mode 100644 lib/mbedtls/external/mbedtls/library/debug_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/des.c
create mode 100644 lib/mbedtls/external/mbedtls/library/dhm.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ecdh.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ecdsa.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ecjpake.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ecp.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ecp_curves.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ecp_curves_new.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ecp_internal_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ecp_invasive.h
create mode 100644 lib/mbedtls/external/mbedtls/library/entropy.c
create mode 100644 lib/mbedtls/external/mbedtls/library/entropy_poll.c
create mode 100644 lib/mbedtls/external/mbedtls/library/entropy_poll.h
create mode 100644 lib/mbedtls/external/mbedtls/library/error.c
create mode 100644 lib/mbedtls/external/mbedtls/library/gcm.c
create mode 100644 lib/mbedtls/external/mbedtls/library/hkdf.c
create mode 100644 lib/mbedtls/external/mbedtls/library/hmac_drbg.c
create mode 100644 lib/mbedtls/external/mbedtls/library/lmots.c
create mode 100644 lib/mbedtls/external/mbedtls/library/lmots.h
create mode 100644 lib/mbedtls/external/mbedtls/library/lms.c
create mode 100644 lib/mbedtls/external/mbedtls/library/md.c
create mode 100644 lib/mbedtls/external/mbedtls/library/md5.c
create mode 100644 lib/mbedtls/external/mbedtls/library/md_psa.h
create mode 100644 lib/mbedtls/external/mbedtls/library/md_wrap.h
create mode 100644 lib/mbedtls/external/mbedtls/library/memory_buffer_alloc.c
create mode 100644 lib/mbedtls/external/mbedtls/library/mps_common.h
create mode 100644 lib/mbedtls/external/mbedtls/library/mps_error.h
create mode 100644 lib/mbedtls/external/mbedtls/library/mps_reader.c
create mode 100644 lib/mbedtls/external/mbedtls/library/mps_reader.h
create mode 100644 lib/mbedtls/external/mbedtls/library/mps_trace.c
create mode 100644 lib/mbedtls/external/mbedtls/library/mps_trace.h
create mode 100644 lib/mbedtls/external/mbedtls/library/net_sockets.c
create mode 100644 lib/mbedtls/external/mbedtls/library/nist_kw.c
create mode 100644 lib/mbedtls/external/mbedtls/library/oid.c
create mode 100644 lib/mbedtls/external/mbedtls/library/padlock.c
create mode 100644 lib/mbedtls/external/mbedtls/library/padlock.h
create mode 100644 lib/mbedtls/external/mbedtls/library/pem.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pk.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pk_ecc.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pk_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/pk_wrap.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pk_wrap.h
create mode 100644 lib/mbedtls/external/mbedtls/library/pkcs12.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pkcs5.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pkcs7.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pkparse.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pkwrite.c
create mode 100644 lib/mbedtls/external/mbedtls/library/pkwrite.h
create mode 100644 lib/mbedtls/external/mbedtls/library/platform.c
create mode 100644 lib/mbedtls/external/mbedtls/library/platform_util.c
create mode 100644 lib/mbedtls/external/mbedtls/library/poly1305.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_aead.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_aead.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_cipher.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_cipher.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_client.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_core.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_core_common.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_driver_wrappers.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_driver_wrappers_no_static.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_driver_wrappers_no_static.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_ecp.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_ecp.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_ffdh.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_ffdh.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_hash.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_hash.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_invasive.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_its.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_mac.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_mac.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_pake.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_pake.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_random_impl.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_rsa.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_rsa.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_se.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_se.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_slot_management.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_slot_management.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_storage.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_crypto_storage.h
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_its_file.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_util.c
create mode 100644 lib/mbedtls/external/mbedtls/library/psa_util_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ripemd160.c
create mode 100644 lib/mbedtls/external/mbedtls/library/rsa.c
create mode 100644 lib/mbedtls/external/mbedtls/library/rsa_alt_helpers.c
create mode 100644 lib/mbedtls/external/mbedtls/library/rsa_alt_helpers.h
create mode 100644 lib/mbedtls/external/mbedtls/library/rsa_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/sha1.c
create mode 100644 lib/mbedtls/external/mbedtls/library/sha256.c
create mode 100644 lib/mbedtls/external/mbedtls/library/sha3.c
create mode 100644 lib/mbedtls/external/mbedtls/library/sha512.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_cache.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_ciphersuites.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_ciphersuites_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_client.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_client.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_cookie.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_debug_helpers.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_debug_helpers_generated.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_misc.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_msg.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_ticket.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls12_client.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls12_server.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls13_client.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls13_generic.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls13_invasive.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls13_keys.c
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls13_keys.h
create mode 100644 lib/mbedtls/external/mbedtls/library/ssl_tls13_server.c
create mode 100644 lib/mbedtls/external/mbedtls/library/threading.c
create mode 100644 lib/mbedtls/external/mbedtls/library/timing.c
create mode 100644 lib/mbedtls/external/mbedtls/library/version.c
create mode 100644 lib/mbedtls/external/mbedtls/library/version_features.c
create mode 100644 lib/mbedtls/external/mbedtls/library/x509.c
create mode 100644 lib/mbedtls/external/mbedtls/library/x509_create.c
create mode 100644 lib/mbedtls/external/mbedtls/library/x509_crl.c
create mode 100644 lib/mbedtls/external/mbedtls/library/x509_crt.c
create mode 100644 lib/mbedtls/external/mbedtls/library/x509_csr.c
create mode 100644 lib/mbedtls/external/mbedtls/library/x509_internal.h
create mode 100644 lib/mbedtls/external/mbedtls/library/x509write.c
create mode 100644 lib/mbedtls/external/mbedtls/library/x509write_crt.c
create mode 100644 lib/mbedtls/external/mbedtls/library/x509write_csr.c
create mode 100644 lib/mbedtls/external/mbedtls/pkgconfig/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/pkgconfig/JoinPaths.cmake
create mode 100644 lib/mbedtls/external/mbedtls/pkgconfig/mbedcrypto.pc.in
create mode 100644 lib/mbedtls/external/mbedtls/pkgconfig/mbedtls.pc.in
create mode 100644 lib/mbedtls/external/mbedtls/pkgconfig/mbedx509.pc.in
create mode 100644 lib/mbedtls/external/mbedtls/programs/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/programs/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/programs/README.md
create mode 100644 lib/mbedtls/external/mbedtls/programs/aes/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/aes/crypt_and_hash.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/cipher/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/cipher/cipher_aead_demo.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/demo_common.sh
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/README.md
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/common.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/common.h
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/corpuses/client
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/corpuses/dtlsclient
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/corpuses/dtlsserver
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/corpuses/server
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_client.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_client.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_dtlsclient.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_dtlsclient.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_dtlsserver.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_dtlsserver.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_pkcs7.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_pkcs7.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_privkey.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_privkey.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_pubkey.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_pubkey.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_server.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_server.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_x509crl.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_x509crl.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_x509crt.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_x509crt.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_x509csr.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/fuzz_x509csr.options
create mode 100644 lib/mbedtls/external/mbedtls/programs/fuzz/onefile.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/hash/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/hash/generic_sum.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/hash/hello.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/hash/md_hmac_demo.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/dh_client.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/dh_genprime.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/dh_prime.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/dh_server.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/ecdh_curve25519.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/ecdsa.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/gen_key.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/key_app.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/key_app_writer.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/mpi_demo.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/pk_decrypt.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/pk_encrypt.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/pk_sign.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/pk_verify.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_decrypt.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_encrypt.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_genkey.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_priv.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_pub.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_sign.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_sign_pss.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_verify.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/pkey/rsa_verify_pss.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/psa/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/psa/aead_demo.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/psa/crypto_examples.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/psa/hmac_demo.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/psa/key_ladder_demo.c
create mode 100755 lib/mbedtls/external/mbedtls/programs/psa/key_ladder_demo.sh
create mode 100644 lib/mbedtls/external/mbedtls/programs/psa/psa_constant_names.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/psa/psa_constant_names_generated.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/psa/psa_hash.c
create mode 100755 lib/mbedtls/external/mbedtls/programs/psa/psa_hash_demo.sh
create mode 100644 lib/mbedtls/external/mbedtls/programs/random/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/random/gen_entropy.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/random/gen_random_ctr_drbg.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/dtls_client.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/dtls_server.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/mini_client.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_client1.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_client2.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_context_info.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_fork_server.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_mail_client.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_pthread_server.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_server.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_server2.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_test_common_source.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_test_lib.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/ssl/ssl_test_lib.h
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/benchmark.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_package/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_package/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_package/cmake_package.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_package_install/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_package_install/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_package_install/cmake_package_install.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_subproject/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_subproject/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/cmake_subproject/cmake_subproject.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/dlopen.c
create mode 100755 lib/mbedtls/external/mbedtls/programs/test/dlopen_demo.sh
create mode 100755 lib/mbedtls/external/mbedtls/programs/test/generate_cpp_dummy_build.sh
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/metatest.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/query_compile_time_config.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/query_config.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/query_config.h
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/query_included_headers.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/selftest.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/udp_proxy.c
create mode 100755 lib/mbedtls/external/mbedtls/programs/test/udp_proxy_wrapper.sh
create mode 100644 lib/mbedtls/external/mbedtls/programs/test/zeroize.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/util/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/util/pem2der.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/util/strerror.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/wince_main.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/x509/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/programs/x509/cert_app.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/x509/cert_req.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/x509/cert_write.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/x509/crl_app.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/x509/load_roots.c
create mode 100644 lib/mbedtls/external/mbedtls/programs/x509/req_app.c
create mode 100755 lib/mbedtls/external/mbedtls/scripts/abi_check.py
create mode 100755 lib/mbedtls/external/mbedtls/scripts/apidoc_full.sh
create mode 100755 lib/mbedtls/external/mbedtls/scripts/assemble_changelog.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/basic.requirements.txt
create mode 100755 lib/mbedtls/external/mbedtls/scripts/bump_version.sh
create mode 100644 lib/mbedtls/external/mbedtls/scripts/ci.requirements.txt
create mode 100755 lib/mbedtls/external/mbedtls/scripts/code_size_compare.py
create mode 100755 lib/mbedtls/external/mbedtls/scripts/code_style.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/common.make
create mode 100755 lib/mbedtls/external/mbedtls/scripts/config.pl
create mode 100755 lib/mbedtls/external/mbedtls/scripts/config.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_jsons/driver_opaque_schema.json
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_jsons/driver_transparent_schema.json
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_jsons/driverlist.json
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_jsons/mbedtls_test_opaque_driver.json
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_jsons/mbedtls_test_transparent_driver.json
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_jsons/p256_transparent_driver.json
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_templates/OS-template-opaque.jinja
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_templates/OS-template-transparent.jinja
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_templates/psa_crypto_driver_wrappers.h.jinja
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/driver_templates/psa_crypto_driver_wrappers_no_static.c.jinja
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/error.fmt
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/query_config.fmt
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/version_features.fmt
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/vs2017-app-template.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/vs2017-main-template.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/scripts/data_files/vs2017-sln-template.sln
create mode 100644 lib/mbedtls/external/mbedtls/scripts/driver.requirements.txt
create mode 100755 lib/mbedtls/external/mbedtls/scripts/ecc-heap.sh
create mode 100755 lib/mbedtls/external/mbedtls/scripts/ecp_comb_table.py
create mode 100755 lib/mbedtls/external/mbedtls/scripts/footprint.sh
create mode 100755 lib/mbedtls/external/mbedtls/scripts/generate_driver_wrappers.py
create mode 100755 lib/mbedtls/external/mbedtls/scripts/generate_errors.pl
create mode 100755 lib/mbedtls/external/mbedtls/scripts/generate_features.pl
create mode 100755 lib/mbedtls/external/mbedtls/scripts/generate_psa_constants.py
create mode 100755 lib/mbedtls/external/mbedtls/scripts/generate_query_config.pl
create mode 100755 lib/mbedtls/external/mbedtls/scripts/generate_ssl_debug_helpers.py
create mode 100755 lib/mbedtls/external/mbedtls/scripts/generate_visualc_files.pl
create mode 100755 lib/mbedtls/external/mbedtls/scripts/lcov.sh
create mode 100644 lib/mbedtls/external/mbedtls/scripts/maintainer.requirements.txt
create mode 100644 lib/mbedtls/external/mbedtls/scripts/make_generated_files.bat
create mode 100755 lib/mbedtls/external/mbedtls/scripts/massif_max.pl
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/__init__.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/asymmetric_key_data.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/bignum_common.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/bignum_core.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/bignum_data.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/bignum_mod.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/bignum_mod_raw.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/build_tree.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/c_build_helper.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/c_parsing_helper.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/c_wrapper_generator.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/crypto_data_tests.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/crypto_knowledge.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/ecp.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/logging_util.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/macro_collector.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/psa_information.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/psa_storage.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/test_case.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/test_data_generation.py
create mode 100644 lib/mbedtls/external/mbedtls/scripts/mbedtls_dev/typing_util.py
create mode 100755 lib/mbedtls/external/mbedtls/scripts/memory.sh
create mode 100755 lib/mbedtls/external/mbedtls/scripts/min_requirements.py
create mode 100755 lib/mbedtls/external/mbedtls/scripts/output_env.sh
create mode 100755 lib/mbedtls/external/mbedtls/scripts/prepare_release.sh
create mode 100755 lib/mbedtls/external/mbedtls/scripts/tmp_ignore_makefiles.sh
create mode 100644 lib/mbedtls/external/mbedtls/scripts/windows_msbuild.bat
create mode 100644 lib/mbedtls/external/mbedtls/tests/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/tests/CMakeLists.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/Descriptions.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/Makefile
create mode 100755 lib/mbedtls/external/mbedtls/tests/compat-in-docker.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/compat.sh
create mode 100644 lib/mbedtls/external/mbedtls/tests/configs/tls13-only.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/configs/user-config-for-test.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/configs/user-config-malloc-0-null.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/configs/user-config-zeroize-memset.h
create mode 100755 lib/mbedtls/external/mbedtls/tests/context-info.sh
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/Makefile
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/Readme-x509.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_no_authorityKeyId.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_no_issuer.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_no_keyid.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId.conf
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_issuer_tag1_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_issuer_tag2_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_keyid_tag_len_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_keyid_tag_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_length_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_sequence_tag_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_sn_len_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_sn_tag_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_tag_len_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/authorityKeyId_subjectKeyId_tag_malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/cli_cid.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/cli_ciphersuite.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/cli_def.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/cli_min_cfg.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/cli_no_alpn.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/cli_no_keep_cert.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/cli_no_mfl.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/cli_no_packing.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/def_b64_too_big_1.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/def_b64_too_big_2.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/def_b64_too_big_3.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/def_bad_b64.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/empty.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/mfl_1024.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/mtu_10000.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/srv_cid.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/srv_ciphersuite.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/srv_def.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/srv_min_cfg.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/srv_no_alpn.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/srv_no_keep_cert.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/srv_no_mfl.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/srv_no_packing.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/base64/v2.19.1.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_example_multi.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_example_multi_nocn.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_example_wildcard.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_md5.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_md5.csr
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_sha1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_sha224.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_sha256.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_sha384.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_sha512.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cert_v1_with_ext.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli-rsa-sha1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli-rsa-sha256.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli-rsa-sha256.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli-rsa-sha256.key.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli-rsa.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli-rsa.key.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli.opensslconf
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli2.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli2.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/cli2.key.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/clusterfuzz-testcase-minimized-fuzz_x509crt-6666050834661376.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-ec-sha1.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-ec-sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-future.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-futureRevocationDate.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-rsa-pss-sha1-badsign.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-rsa-pss-sha1.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-rsa-pss-sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-rsa-pss-sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-rsa-pss-sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl-rsa-pss-sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl_cat_ec-rsa.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl_cat_ecfut-rsa.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl_cat_rsa-ec.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl_cat_rsabadpem-ec.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl_expired.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crl_sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/crt_cat_rsaexp-ec.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dh.1000.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dh.998.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dh.999.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dh.optlen.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dh.optlen.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dhparams.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/00.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/00.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/01.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/01.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/02.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/02.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/03.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/03.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/04.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/04.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/05.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/05.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/06.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/06.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/07.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/07.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/08.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/08.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/09.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/09.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/10.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/10.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/11.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/11.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/12.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/12.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/13.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/13.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/14.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/14.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/15.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/15.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/16.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/16.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/17.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/17.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/18.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/18.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/19.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/19.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/20.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/20.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/Readme.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c00.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c01.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c02.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c03.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c04.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c05.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c06.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c07.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c08.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c09.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c10.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c11.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c12.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c13.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c14.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c15.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c16.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c17.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c18.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c19.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/c20.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/int.opensslconf
create mode 100755 lib/mbedtls/external/mbedtls/tests/data_files/dir-maxpath/long.sh
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir1/test-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir2/test-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir2/test-ca2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir3/Readme
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir3/test-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir3/test-ca2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/Readme
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert11.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert12.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert13.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert14.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert21.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert22.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert23.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert31.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert32.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert33.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert34.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert41.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert42.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert43.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert44.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert45.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert51.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert52.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert53.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert54.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert61.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert62.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert63.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert71.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert72.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert73.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert74.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert81.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert82.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert83.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert91.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/dir4/cert92.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_224_prv.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_224_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_224_pub.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_224_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_256_long_prv.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_256_long_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_256_prv.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_256_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_256_pub.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_256_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_384_prv.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_384_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_384_pub.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_384_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_521_prv.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_521_prv.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_521_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_521_pub.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_521_pub.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_521_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_521_short_prv.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_521_short_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp256_prv.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp256_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp256_pub.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp256_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp384_prv.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp384_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp384_pub.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp384_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp512_prv.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp512_prv.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp512_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp512_pub.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp512_pub.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_bp512_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8.pw.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8.pw.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8nopub.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8nopub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8nopubparam.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8nopubparam.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8param.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.pk8param.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.sec1.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.sec1.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.sec1.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.sec1.pw.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_prv.specdom.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_pub.comp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_pub.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_x25519_prv.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_x25519_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_x25519_pub.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_x25519_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_x448_prv.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_x448_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_x448_pub.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ec_x448_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ecdsa_secp256r1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ecdsa_secp256r1.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ecdsa_secp384r1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ecdsa_secp384r1.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ecdsa_secp521r1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/ecdsa_secp521r1.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/enco-ca-prstr.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/enco-cert-utf8str.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/format_gen.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/format_gen.pub
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/format_pkcs12.fmt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/format_rsa.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/hash_file_1
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/hash_file_2
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/hash_file_3
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/hash_file_4
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/hash_file_5
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/keyUsage.decipherOnly.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/lms_hash-sigs_sha256_m32_h5_lmots_sha256_n32_w8_aux
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/lms_hash-sigs_sha256_m32_h5_lmots_sha256_n32_w8_prv
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/lms_hash-sigs_sha256_m32_h5_lmots_sha256_n32_w8_pub
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/lms_hsslms_sha256_m32_h5_lmots_sha256_n32_w8_prv
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/lms_pyhsslms_sha256_m32_h5_lmots_sha256_n32_w8_prv
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/lms_pyhsslms_sha256_m32_h5_lmots_sha256_n32_w8_pub
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/mpi_16
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/mpi_too_big
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/opensslcnf/server9.crt.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/bitstring-in-dn.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cert_example_multi.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cert_example_multi_nocn.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cert_md5.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cert_sha1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cert_sha224.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cert_sha256.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cert_sha384.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cert_sha512.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/cli-rsa-sha256-badalg.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-ec-sha1.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-ec-sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-ec-sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-ec-sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-ec-sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-idp.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-idpnc.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-malformed-trailing-spaces.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-rsa-pss-sha1.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-rsa-pss-sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-rsa-pss-sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-rsa-pss-sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl-rsa-pss-sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl_expired.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl_md5.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl_sha1.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl_sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl_sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/crl_sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/keyUsage.decipherOnly.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/multiple_san.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/non-ascii-string-in-issuer.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/rsa_multiple_san_uri.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/rsa_single_san_uri.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1-ms.req.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.cert_type.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.ext_ku.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.key_usage.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.req.commas.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.req.md5
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.req.sha1
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.req.sha224
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.req.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.req.sha384
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1.req.sha512
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1_pathlen_int_max-1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server1_pathlen_int_max.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server2.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server3.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server4.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-directoryname-seq-malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-directoryname.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-fan.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-non-compliant.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-nonprintable_othername.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-othername.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-second-directoryname-oid-malformed.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-sha1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-sha224.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-sha384.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-sha512.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-two-directorynames.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5-unsupported_othername.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5.req.sha1
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5.req.sha224
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5.req.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5.req.sha384
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server5.req.sha512
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server7_all_space.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server7_int-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server7_pem_space.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server7_trailing_space.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9-sha224.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9-sha256.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9-sha384.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9-sha512.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9.req.sha1
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9.req.sha224
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9.req.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9.req.sha384
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/server9.req.sha512
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca-any_policy.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca-any_policy_ec.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca-any_policy_with_qualifier.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca-any_policy_with_qualifier_ec.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca-multi_policy.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca-multi_policy_ec.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca-unsupported_policy.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca-unsupported_policy_ec.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test-ca.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_cert_rfc822name.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len1.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_len2.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_sequence_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_extension_request_set_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_id_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_len1.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_len2.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_attributes_sequence_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_duplicated_extension.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extension_data_len1.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extension_data_len2.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extension_data_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extension_id_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extension_key_usage_bitstream_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extension_ns_cert_bitstream_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extension_subject_alt_name_sequence_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extension_type_oid.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_all_malformed_extensions_sequence_tag.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_keyUsage.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_nsCertType.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/parse_input/test_csr_v3_subjectAltName.csr.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/passwd.psk
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-expired.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-expired.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-expired.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-1.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-1.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-1.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-2.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-2.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-2.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-3.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-3.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7-rsa-sha256-3.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_3_signed.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_cert_encrypted.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_cert_signed_sha1.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_cert_signed_sha256.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_cert_signed_sha512.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_cert_signed_v2.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_cert_signeddata_sha256.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_multiple_certs_signed.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_multiple_signed.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_no_signers.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_rsa_expired.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_signed_badcert.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_signed_badsigner.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_signed_badsigner1_badsize.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_signed_badsigner1_badtag.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_signed_badsigner1_fuzzbad.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_signed_badsigner2_badsize.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_signed_badsigner2_badtag.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_signed_badsigner2_fuzzbad.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_with_signature.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_data_without_cert_signed.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_signerInfo_1_serial_invalid_tag_after_long_name.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_signerInfo_2_invalid_tag.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_signerInfo_issuer_invalid_size.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_signerInfo_serial_invalid_size.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/pkcs7_zerolendata_detached.der
create mode 100755 lib/mbedtls/external/mbedtls/tests/data_files/print_c.pl
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa4096_prv.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa4096_prv.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa4096_pub.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa4096_pub.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa512.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa521.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa522.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa528.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_multiple_san_uri.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_1024_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_1024_aes128.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_1024_aes192.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_1024_aes256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_1024_clear.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_1024_des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_2048_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_2048_aes128.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_2048_aes192.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_2048_aes256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_2048_clear.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_2048_des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_2048_public.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_2048_public.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_4096_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_4096_aes128.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_4096_aes192.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_4096_aes256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_4096_clear.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs1_4096_des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_1024_public.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_2048_public.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_2048_public.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_1024_2des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_1024_2des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_1024_3des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_1024_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_2048_2des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_2048_2des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_2048_3des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_2048_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_4096_2des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_4096_2des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_4096_3des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbe_sha1_4096_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des_sha224.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des_sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des_sha256.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des_sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des_sha512.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_3des_sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des_sha224.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des_sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des_sha256.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des_sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des_sha512.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_1024_des_sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha224.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha256.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha512.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_aes128cbc_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_aes128cbc_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_aes192cbc_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_aes192cbc_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_aes256cbc_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_aes256cbc_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des_sha224.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des_sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des_sha256.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des_sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des_sha512.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_2048_des_sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des_sha224.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des_sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des_sha256.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des_sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des_sha512.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_3des_sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des_sha224.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des_sha224.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des_sha256.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des_sha256.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des_sha384.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des_sha384.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des_sha512.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_pkcs8_pbes2_pbkdf2_4096_des_sha512.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_single_san_uri.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/rsa_single_san_uri.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1-nospace.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1-v1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.80serial.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.allSubjectAltNames.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.asciichars.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.ca.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.ca_noauthid.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.cert_type.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.cert_type.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.cert_type_noauthid.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.commas.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.csr
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.hashsymbol.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.key.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.key_ext_usage.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.key_ext_usages.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.key_usage.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.key_usage.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.key_usage_noauthid.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.long_serial.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.long_serial_FF.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.noauthid.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.pubkey
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.pubkey.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.cert_type
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.cert_type_empty
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.key_usage
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.key_usage_empty
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.ku-ct
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.md5
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.sha1
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.sha224
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.sha256.conf
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.sha256.ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.sha384
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.req.sha512
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.spaces.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1.v1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server10-badsign.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server10-bs_int3.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server10.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server10.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server10_int3-bs.pem
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server10_int3_int-ca2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server10_int3_int-ca2_ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server10_int3_spurious_int-ca2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1_ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server1_csr.opensslconf
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2-badsign.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2-sha256.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2-sha256.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2-v1-chain.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2-v1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.key.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.key.enc
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.ku-ds.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.ku-ds_ke.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.ku-ka.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server2.ku-ke.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server3.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server3.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server4.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server4.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-badsign.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-der0.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-der1a.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-der1b.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-der2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-der4.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-der8.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-der9.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-expired.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-future.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-selfsigned.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-sha1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-sha224.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-sha384.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-sha512.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-ss-expired.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-ss-forgeca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-tricky-ip-san-malformed-len.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5-tricky-ip-san.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.eku-cli.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.eku-cs.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.eku-cs_any.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.eku-srv.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.eku-srv_cli.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.key.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.key.enc
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.ku-ds.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.ku-ka.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.ku-ke.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server5.req.ku.sha1
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server6-ss-child.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server6-ss-child.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server6.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server6.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7-badsign.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7-expired.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7-future.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7_int-ca-exp.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7_int-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7_int-ca_ca2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server7_spurious_int-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server8.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server8.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server8_int-ca2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-bad-mgfhash.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-bad-saltlen.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-badsign.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-defaults.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-sha224.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-sha256.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-sha384.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-sha512.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9-with-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/server9.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/simplepass.psk
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-alt-good.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-alt.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-alt.csr
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-alt.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-good-alt.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-sha1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-sha1.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-sha256.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-sha256.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca-v1.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.key.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.opensslconf
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.req.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.req_ec.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.server1.db
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.server1.future-crl.db
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.server1.future-crl.opensslconf
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.server1.opensslconf
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca.server1.test_serial.opensslconf
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2-expired.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.crt.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.key.der
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.key.enc
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.ku-crl.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.ku-crl.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.ku-crt.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.ku-crt.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.ku-crt_crl.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.ku-crt_crl.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.ku-ds.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.ku-ds.crt.openssl.v3_ext
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2.req.sha256
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2_cat-future-invalid.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2_cat-future-present.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2_cat-past-invalid.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2_cat-past-present.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2_cat-present-future.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca2_cat-present-past.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca_cat12.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca_cat21.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca_printable.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca_unenc.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca_uppercase.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-ca_utf8.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-int-ca-exp.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-int-ca.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-int-ca.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-int-ca2.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-int-ca2.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-int-ca3-badsign.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-int-ca3.crt
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test-int-ca3.key
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/test_certs.h.jinja2
create mode 100644 lib/mbedtls/external/mbedtls/tests/data_files/tls13_early_data.txt
create mode 100644 lib/mbedtls/external/mbedtls/tests/docker/bionic/Dockerfile
create mode 100644 lib/mbedtls/external/mbedtls/tests/git-scripts/README.md
create mode 100755 lib/mbedtls/external/mbedtls/tests/git-scripts/pre-push.sh
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/aes_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/aria_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/camellia_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/ccm_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/chacha20_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/chachapoly_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/cmac_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/des_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/dhm_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/ecjpake_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/ecp_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/gcm_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/md5_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/nist_kw_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/platform_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/poly1305_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/ripemd160_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/rsa_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/sha1_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/sha256_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/sha512_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/threading_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-dummy/timing_alt.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/alt-extra/psa/crypto.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/baremetal-override/time.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/spe/crypto_spe.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/arguments.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/asn1_helpers.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/bignum_helpers.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/certs.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/constant_flow.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/aead.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/asymmetric_encryption.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/cipher.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/config_test_driver.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/crypto_config_test_driver_extension.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/hash.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/key_agreement.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/key_management.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/mac.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/pake.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/signature.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/drivers/test_driver.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/fake_external_rng_for_test.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/helpers.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/macros.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/memory.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/psa_crypto_helpers.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/psa_exercise_key.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/psa_helpers.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/psa_memory_poisoning_wrappers.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/psa_test_wrappers.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/random.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/ssl_helpers.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/include/test/threading_helpers.h
create mode 100755 lib/mbedtls/external/mbedtls/tests/make-in-docker.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/opt-testcases/tls13-compat.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/opt-testcases/tls13-kex-modes.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/opt-testcases/tls13-misc.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/all-in-docker.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/all.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/analyze_outcomes.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/audit-validity-dates.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/basic-build-test.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/basic-in-docker.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/check-doxy-blocks.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/check-generated-files.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/check-python-files.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/check_files.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/check_names.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/check_test_cases.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/depends.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/docker_env.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/doxygen.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/gen_ctr_drbg.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/gen_gcm_decrypt.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/gen_gcm_encrypt.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/gen_pkcs1_v21_sign_verify.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate-afl-tests.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_bignum_tests.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_ecp_tests.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_pkcs7_tests.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_psa_tests.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_psa_wrappers.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_server9_bad_saltlen.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_test_cert_macros.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_test_code.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/generate_tls13_compat_tests.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/list-identifiers.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/list_internal_identifiers.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/psa_collect_statuses.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/quiet/cmake
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/quiet/make
create mode 100644 lib/mbedtls/external/mbedtls/tests/scripts/quiet/quiet.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/recursion.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/run-metatests.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/run-test-suites.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/run_demos.py
create mode 100644 lib/mbedtls/external/mbedtls/tests/scripts/scripts_path.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/set_psa_test_dependencies.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/tcp_client.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/test-ref-configs.pl
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/test_config_script.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/test_generate_test_code.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/test_psa_compliance.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/test_psa_constant_names.py
create mode 100644 lib/mbedtls/external/mbedtls/tests/scripts/test_zeroize.gdb
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/translate_ciphers.py
create mode 100755 lib/mbedtls/external/mbedtls/tests/scripts/travis-log-failure.sh
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/asn1_helpers.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/bignum_helpers.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/certs.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/hash.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/platform_builtin_keys.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/test_driver_aead.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/test_driver_asymmetric_encryption.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/test_driver_cipher.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/test_driver_key_agreement.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/test_driver_key_management.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/test_driver_mac.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/test_driver_pake.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/drivers/test_driver_signature.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/fake_external_rng_for_test.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/helpers.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/psa_crypto_helpers.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/psa_crypto_stubs.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/psa_exercise_key.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/psa_memory_poisoning_wrappers.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/psa_test_wrappers.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/random.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/test_certs.h
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/test_helpers/ssl_helpers.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/test_memory.c
create mode 100644 lib/mbedtls/external/mbedtls/tests/src/threading_helpers.c
create mode 100755 lib/mbedtls/external/mbedtls/tests/ssl-opt-in-docker.sh
create mode 100755 lib/mbedtls/external/mbedtls/tests/ssl-opt.sh
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/helpers.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/host_test.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/main_test.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aes.cbc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aes.cfb.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aes.ctr.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aes.ecb.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aes.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aes.ofb.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aes.rest.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aes.xts.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_alignment.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_alignment.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aria.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_aria.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_asn1parse.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_asn1parse.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_asn1write.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_asn1write.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_base64.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_base64.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_core.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_core.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_core.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_mod.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_mod.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_mod.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_mod_raw.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_mod_raw.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_mod_raw.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_random.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_bignum_random.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_block_cipher.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_block_cipher.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_block_cipher.psa.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_camellia.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_camellia.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ccm.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ccm.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_chacha20.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_chacha20.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_chachapoly.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_chachapoly.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.aes.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.aria.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.camellia.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.ccm.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.chacha20.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.chachapoly.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.des.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.gcm.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.nist_kw.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.null.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cipher.padding.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cmac.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_cmac.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_common.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_common.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_constant_time.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_constant_time.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_constant_time_hmac.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_constant_time_hmac.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ctr_drbg.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ctr_drbg.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_debug.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_debug.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_des.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_des.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_dhm.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_dhm.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecdh.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecdh.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecdsa.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecdsa.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecjpake.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecjpake.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecp.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecp.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ecp.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_entropy.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_entropy.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_error.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_error.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.aes128_de.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.aes128_en.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.aes192_de.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.aes192_en.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.aes256_de.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.aes256_en.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.camellia.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_gcm.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_hkdf.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_hkdf.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_hmac_drbg.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_hmac_drbg.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_hmac_drbg.no_reseed.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_hmac_drbg.nopr.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_hmac_drbg.pr.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_lmots.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_lmots.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_lms.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_lms.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_md.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_md.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_md.psa.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_mdx.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_mdx.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_memory_buffer_alloc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_memory_buffer_alloc.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_mps.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_mps.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_net.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_net.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_nist_kw.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_nist_kw.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_oid.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_oid.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pem.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pem.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pk.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pk.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs12.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs12.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs1_v15.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs1_v15.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs1_v21.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs1_v21.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs5.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs5.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs7.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs7.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkparse.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkparse.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkwrite.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkwrite.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_platform.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_platform.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_platform_printf.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_platform_printf.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_platform_util.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_platform_util.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_poly1305.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_poly1305.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto.pbkdf2.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_attributes.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_attributes.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_driver_wrappers.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_driver_wrappers.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_entropy.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_entropy.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_generate_key.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_generate_key.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_hash.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_hash.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_init.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_init.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_low_hash.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_low_hash.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_memory.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_memory.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_metadata.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_metadata.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_not_supported.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_not_supported.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_not_supported.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_op_fail.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_op_fail.generated.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_op_fail.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_pake.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_pake.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_persistent_key.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_persistent_key.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_se_driver_hal.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_se_driver_hal.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_se_driver_hal_mocks.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_se_driver_hal_mocks.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_slot_management.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_slot_management.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_storage_format.current.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_storage_format.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_storage_format.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_storage_format.v0.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_util.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_crypto_util.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_its.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_psa_its.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_random.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_random.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_rsa.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_rsa.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_shax.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_shax.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ssl.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ssl.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ssl_decrypt.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_ssl_decrypt.misc.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_test_helpers.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_test_helpers.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_timing.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_timing.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_version.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_version.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_x509parse.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_x509parse.function
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_x509write.data
create mode 100644 lib/mbedtls/external/mbedtls/tests/suites/test_suite_x509write.function
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/.gitignore
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/aead_demo.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/benchmark.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/cert_app.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/cert_req.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/cert_write.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/cipher_aead_demo.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/crl_app.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/crypt_and_hash.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/crypto_examples.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/dh_client.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/dh_genprime.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/dh_server.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/dtls_client.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/dtls_server.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ecdh_curve25519.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ecdsa.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/gen_entropy.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/gen_key.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/gen_random_ctr_drbg.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/generic_sum.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/hello.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/hmac_demo.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/key_app.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/key_app_writer.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/key_ladder_demo.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/load_roots.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/mbedTLS.sln
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/mbedTLS.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/md_hmac_demo.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/metatest.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/mini_client.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/mpi_demo.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/pem2der.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/pk_decrypt.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/pk_encrypt.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/pk_sign.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/pk_verify.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/psa_constant_names.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/psa_hash.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/query_compile_time_config.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/query_included_headers.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/req_app.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/rsa_decrypt.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/rsa_encrypt.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/rsa_genkey.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/rsa_sign.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/rsa_sign_pss.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/rsa_verify.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/rsa_verify_pss.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/selftest.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ssl_client1.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ssl_client2.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ssl_context_info.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ssl_fork_server.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ssl_mail_client.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ssl_server.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/ssl_server2.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/strerror.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/udp_proxy.vcxproj
create mode 100644 lib/mbedtls/external/mbedtls/visualc/VS2017/zeroize.vcxproj
create mode 100644 lib/mbedtls/hash_shim.c
create mode 100644 lib/mbedtls/mbedtls_def_config.h
create mode 100644 lib/mbedtls/port/assert.h
create mode 100644 lib/mbedtls/port/limits.h
--
2.25.1
^ permalink raw reply [flat|nested] 40+ messages in thread
* [PATCH 03/23] mbedtls: add mbedtls into the build system
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
@ 2024-04-16 18:59 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 04/23] arm: EFI linker script text section alignment Raymond Mao
` (22 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 18:59 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Port mbedtls with dummy libc header files.
Add mbedtls default config header file.
Add mbedtls kbuild makefile.
Add Kconfig and mbedtls config submenu.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
include/stdio.h | 1 +
include/stdlib.h | 1 +
lib/Kconfig | 4 +
lib/Makefile | 2 +
lib/mbedtls/Kconfig | 25 +
lib/mbedtls/Makefile | 117 +
lib/mbedtls/mbedtls_def_config.h | 4125 ++++++++++++++++++++++++++++++
lib/mbedtls/port/assert.h | 12 +
lib/mbedtls/port/limits.h | 33 +
9 files changed, 4320 insertions(+)
create mode 100644 lib/mbedtls/Kconfig
create mode 100644 lib/mbedtls/Makefile
create mode 100644 lib/mbedtls/mbedtls_def_config.h
create mode 100644 lib/mbedtls/port/assert.h
create mode 100644 lib/mbedtls/port/limits.h
diff --git a/include/stdio.h b/include/stdio.h
index 3241e2d493..874279c60d 100644
--- a/include/stdio.h
+++ b/include/stdio.h
@@ -3,6 +3,7 @@
#include <stdarg.h>
#include <linux/compiler.h>
+#include <vsprintf.h>
/* stdin */
int getchar(void);
diff --git a/include/stdlib.h b/include/stdlib.h
index 9c175d4d74..dedfd52a14 100644
--- a/include/stdlib.h
+++ b/include/stdlib.h
@@ -7,5 +7,6 @@
#define __STDLIB_H_
#include <malloc.h>
+#include <rand.h>
#endif /* __STDLIB_H_ */
diff --git a/lib/Kconfig b/lib/Kconfig
index efb77978a6..a56c873f0c 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -420,6 +420,10 @@ source lib/dhry/Kconfig
menu "Security support"
+menu "mbedtls libraries"
+source lib/mbedtls/Kconfig
+endmenu
+
config AES
bool "Support the AES algorithm"
help
diff --git a/lib/Makefile b/lib/Makefile
index 2a76acf100..a4600b09f4 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -94,6 +94,8 @@ obj-$(CONFIG_LIBAVB) += libavb/
obj-$(CONFIG_$(SPL_TPL_)OF_LIBFDT) += libfdt/
obj-$(CONFIG_$(SPL_TPL_)OF_REAL) += fdtdec_common.o fdtdec.o
+obj-$(CONFIG_MBEDTLS_LIB) += mbedtls/
+
ifdef CONFIG_SPL_BUILD
obj-$(CONFIG_SPL_YMODEM_SUPPORT) += crc16-ccitt.o
obj-$(CONFIG_$(SPL_TPL_)HASH) += crc16-ccitt.o
diff --git a/lib/mbedtls/Kconfig b/lib/mbedtls/Kconfig
new file mode 100644
index 0000000000..d6e77d5687
--- /dev/null
+++ b/lib/mbedtls/Kconfig
@@ -0,0 +1,25 @@
+menuconfig MBEDTLS_LIB
+ bool "Use mbedtls libraries"
+ select MBEDTLS_LIB_CRYPTO
+ select MBEDTLS_LIB_X509
+ help
+ Enable mbedtls libraries
+
+if MBEDTLS_LIB
+
+config MBEDTLS_LIB_CRYPTO
+ bool "Crypto library"
+ help
+ Enable mbedtls crypto library
+
+config MBEDTLS_LIB_X509
+ bool "X509 library"
+ help
+ Enable mbedtls X509 library
+
+config MBEDTLS_LIB_TLS
+ bool "TLS library"
+ help
+ Enable mbedtls TLS library
+
+endif # MBEDTLS_LIB
diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile
new file mode 100644
index 0000000000..85f0a3cfd0
--- /dev/null
+++ b/lib/mbedtls/Makefile
@@ -0,0 +1,117 @@
+# SPDX-License-Identifier: GPL-2.0+
+#
+# Copyright (c) 2023 Linaro Limited
+# Author: Raymond Mao <raymond.mao@linaro.org>
+
+MBEDTLS_LIB_DIR = external/mbedtls/library
+
+# mbedtls default config file
+ccflags-y += "-DMBEDTLS_CONFIG_FILE=\"mbedtls_def_config.h\""
+
+ccflags-y += \
+ -I$(src)/port \
+ -I$(src)/external/mbedtls/include \
+ -I$(src)/external/mbedtls/library \
+ # This line is intentionally left blank
+
+obj-$(CONFIG_MBEDTLS_LIB_CRYPTO) += mbedtls_lib_crypto.o
+mbedtls_lib_crypto-y := \
+ $(MBEDTLS_LIB_DIR)/aes.o \
+ $(MBEDTLS_LIB_DIR)/aesni.o \
+ $(MBEDTLS_LIB_DIR)/aesce.o \
+ $(MBEDTLS_LIB_DIR)/aria.o \
+ $(MBEDTLS_LIB_DIR)/asn1parse.o \
+ $(MBEDTLS_LIB_DIR)/asn1write.o \
+ $(MBEDTLS_LIB_DIR)/base64.o \
+ $(MBEDTLS_LIB_DIR)/bignum.o \
+ $(MBEDTLS_LIB_DIR)/bignum_core.o \
+ $(MBEDTLS_LIB_DIR)/bignum_mod.o \
+ $(MBEDTLS_LIB_DIR)/bignum_mod_raw.o \
+ $(MBEDTLS_LIB_DIR)/camellia.o \
+ $(MBEDTLS_LIB_DIR)/ccm.o \
+ $(MBEDTLS_LIB_DIR)/chacha20.o \
+ $(MBEDTLS_LIB_DIR)/chachapoly.o \
+ $(MBEDTLS_LIB_DIR)/cipher.o \
+ $(MBEDTLS_LIB_DIR)/cipher_wrap.o \
+ $(MBEDTLS_LIB_DIR)/cmac.o \
+ $(MBEDTLS_LIB_DIR)/constant_time.o \
+ $(MBEDTLS_LIB_DIR)/ctr_drbg.o \
+ $(MBEDTLS_LIB_DIR)/des.o \
+ $(MBEDTLS_LIB_DIR)/dhm.o \
+ $(MBEDTLS_LIB_DIR)/ecdh.o \
+ $(MBEDTLS_LIB_DIR)/ecdsa.o \
+ $(MBEDTLS_LIB_DIR)/ecjpake.o \
+ $(MBEDTLS_LIB_DIR)/ecp.o \
+ $(MBEDTLS_LIB_DIR)/ecp_curves.o \
+ $(MBEDTLS_LIB_DIR)/ecp_curves_new.o \
+ $(MBEDTLS_LIB_DIR)/entropy.o \
+ $(MBEDTLS_LIB_DIR)/entropy_poll.o \
+ $(MBEDTLS_LIB_DIR)/error.o \
+ $(MBEDTLS_LIB_DIR)/gcm.o \
+ $(MBEDTLS_LIB_DIR)/hkdf.o \
+ $(MBEDTLS_LIB_DIR)/hmac_drbg.o \
+ $(MBEDTLS_LIB_DIR)/lmots.o \
+ $(MBEDTLS_LIB_DIR)/lms.o \
+ $(MBEDTLS_LIB_DIR)/md.o \
+ $(MBEDTLS_LIB_DIR)/md5.o \
+ $(MBEDTLS_LIB_DIR)/memory_buffer_alloc.o \
+ $(MBEDTLS_LIB_DIR)/nist_kw.o \
+ $(MBEDTLS_LIB_DIR)/oid.o \
+ $(MBEDTLS_LIB_DIR)/padlock.o \
+ $(MBEDTLS_LIB_DIR)/pem.o \
+ $(MBEDTLS_LIB_DIR)/pk.o \
+ $(MBEDTLS_LIB_DIR)/pk_wrap.o \
+ $(MBEDTLS_LIB_DIR)/pkcs12.o \
+ $(MBEDTLS_LIB_DIR)/pkcs5.o \
+ $(MBEDTLS_LIB_DIR)/pkparse.o \
+ $(MBEDTLS_LIB_DIR)/pkwrite.o \
+ $(MBEDTLS_LIB_DIR)/platform.o \
+ $(MBEDTLS_LIB_DIR)/platform_util.o \
+ $(MBEDTLS_LIB_DIR)/poly1305.o \
+ $(MBEDTLS_LIB_DIR)/ripemd160.o \
+ $(MBEDTLS_LIB_DIR)/rsa.o \
+ $(MBEDTLS_LIB_DIR)/rsa_alt_helpers.o \
+ $(MBEDTLS_LIB_DIR)/sha1.o \
+ $(MBEDTLS_LIB_DIR)/sha256.o \
+ $(MBEDTLS_LIB_DIR)/sha512.o \
+ $(MBEDTLS_LIB_DIR)/sha3.o \
+ $(MBEDTLS_LIB_DIR)/threading.o \
+ $(MBEDTLS_LIB_DIR)/timing.o \
+ $(MBEDTLS_LIB_DIR)/version.o \
+ $(MBEDTLS_LIB_DIR)/version_features.o \
+ # This line is intentionally left blank
+
+obj-$(CONFIG_MBEDTLS_LIB_X509) += mbedtls_lib_x509.o
+mbedtls_lib_x509-y := \
+ $(MBEDTLS_LIB_DIR)/x509.o \
+ $(MBEDTLS_LIB_DIR)/x509_create.o \
+ $(MBEDTLS_LIB_DIR)/x509_crl.o \
+ $(MBEDTLS_LIB_DIR)/x509_crt.o \
+ $(MBEDTLS_LIB_DIR)/x509_csr.o \
+ $(MBEDTLS_LIB_DIR)/x509write.o \
+ $(MBEDTLS_LIB_DIR)/x509write_crt.o \
+ $(MBEDTLS_LIB_DIR)/x509write_csr.o \
+ $(MBEDTLS_LIB_DIR)/pkcs7.o \
+ # This line is intentionally left blank
+
+obj-$(CONFIG_MBEDTLS_LIB_TLS) += mbedtls_lib_tls.o
+mbedtls_lib_tls-y := \
+ $(MBEDTLS_LIB_DIR)/debug.o \
+ $(MBEDTLS_LIB_DIR)/mps_reader.o \
+ $(MBEDTLS_LIB_DIR)/mps_trace.o \
+ $(MBEDTLS_LIB_DIR)/net_sockets.o \
+ $(MBEDTLS_LIB_DIR)/ssl_cache.o \
+ $(MBEDTLS_LIB_DIR)/ssl_ciphersuites.o \
+ $(MBEDTLS_LIB_DIR)/ssl_client.o \
+ $(MBEDTLS_LIB_DIR)/ssl_cookie.o \
+ $(MBEDTLS_LIB_DIR)/ssl_debug_helpers_generated.o \
+ $(MBEDTLS_LIB_DIR)/ssl_msg.o \
+ $(MBEDTLS_LIB_DIR)/ssl_ticket.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls12_client.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls12_server.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls13_keys.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls13_client.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls13_server.o \
+ $(MBEDTLS_LIB_DIR)/ssl_tls13_generic.o \
+ # This line is intentionally left blank
diff --git a/lib/mbedtls/mbedtls_def_config.h b/lib/mbedtls/mbedtls_def_config.h
new file mode 100644
index 0000000000..6e6d66716a
--- /dev/null
+++ b/lib/mbedtls/mbedtls_def_config.h
@@ -0,0 +1,4125 @@
+/**
+ * \file mbedtls_config.h
+ *
+ * \brief Configuration options (set of defines)
+ *
+ * This set of compile-time options may be used to enable
+ * or disable features selectively, and reduce the global
+ * memory footprint.
+ */
+/*
+ * Copyright The Mbed TLS Contributors
+ * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+/**
+ * This is an optional version symbol that enables compatibility handling of
+ * config files.
+ *
+ * It is equal to the #MBEDTLS_VERSION_NUMBER of the Mbed TLS version that
+ * introduced the config format we want to be compatible with.
+ */
+//#define MBEDTLS_CONFIG_VERSION 0x03000000
+
+/**
+ * \name SECTION: System support
+ *
+ * This section sets system specific settings.
+ * \{
+ */
+
+/**
+ * \def MBEDTLS_HAVE_ASM
+ *
+ * The compiler has support for asm().
+ *
+ * Requires support for asm() in compiler.
+ *
+ * Used in:
+ * library/aesni.h
+ * library/aria.c
+ * library/bn_mul.h
+ * library/constant_time.c
+ * library/padlock.h
+ *
+ * Required by:
+ * MBEDTLS_AESCE_C
+ * MBEDTLS_AESNI_C (on some platforms)
+ * MBEDTLS_PADLOCK_C
+ *
+ * Comment to disable the use of assembly code.
+ */
+#define MBEDTLS_HAVE_ASM
+
+/**
+ * \def MBEDTLS_NO_UDBL_DIVISION
+ *
+ * The platform lacks support for double-width integer division (64-bit
+ * division on a 32-bit platform, 128-bit division on a 64-bit platform).
+ *
+ * Used in:
+ * include/mbedtls/bignum.h
+ * library/bignum.c
+ *
+ * The bignum code uses double-width division to speed up some operations.
+ * Double-width division is often implemented in software that needs to
+ * be linked with the program. The presence of a double-width integer
+ * type is usually detected automatically through preprocessor macros,
+ * but the automatic detection cannot know whether the code needs to
+ * and can be linked with an implementation of division for that type.
+ * By default division is assumed to be usable if the type is present.
+ * Uncomment this option to prevent the use of double-width division.
+ *
+ * Note that division for the native integer type is always required.
+ * Furthermore, a 64-bit type is always required even on a 32-bit
+ * platform, but it need not support multiplication or division. In some
+ * cases it is also desirable to disable some double-width operations. For
+ * example, if double-width division is implemented in software, disabling
+ * it can reduce code size in some embedded targets.
+ */
+//#define MBEDTLS_NO_UDBL_DIVISION
+
+/**
+ * \def MBEDTLS_NO_64BIT_MULTIPLICATION
+ *
+ * The platform lacks support for 32x32 -> 64-bit multiplication.
+ *
+ * Used in:
+ * library/poly1305.c
+ *
+ * Some parts of the library may use multiplication of two unsigned 32-bit
+ * operands with a 64-bit result in order to speed up computations. On some
+ * platforms, this is not available in hardware and has to be implemented in
+ * software, usually in a library provided by the toolchain.
+ *
+ * Sometimes it is not desirable to have to link to that library. This option
+ * removes the dependency of that library on platforms that lack a hardware
+ * 64-bit multiplier by embedding a software implementation in Mbed TLS.
+ *
+ * Note that depending on the compiler, this may decrease performance compared
+ * to using the library function provided by the toolchain.
+ */
+//#define MBEDTLS_NO_64BIT_MULTIPLICATION
+
+/**
+ * \def MBEDTLS_HAVE_SSE2
+ *
+ * CPU supports SSE2 instruction set.
+ *
+ * Uncomment if the CPU supports SSE2 (IA-32 specific).
+ */
+//#define MBEDTLS_HAVE_SSE2
+
+/**
+ * \def MBEDTLS_HAVE_TIME
+ *
+ * System has time.h and time().
+ * The time does not need to be correct, only time differences are used,
+ * by contrast with MBEDTLS_HAVE_TIME_DATE
+ *
+ * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT,
+ * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and
+ * MBEDTLS_PLATFORM_STD_TIME.
+ *
+ * Comment if your system does not support time functions.
+ *
+ * \note If MBEDTLS_TIMING_C is set - to enable the semi-portable timing
+ * interface - timing.c will include time.h on suitable platforms
+ * regardless of the setting of MBEDTLS_HAVE_TIME, unless
+ * MBEDTLS_TIMING_ALT is used. See timing.c for more information.
+ */
+//#define MBEDTLS_HAVE_TIME
+
+/**
+ * \def MBEDTLS_HAVE_TIME_DATE
+ *
+ * System has time.h, time(), and an implementation for
+ * mbedtls_platform_gmtime_r() (see below).
+ * The time needs to be correct (not necessarily very accurate, but at least
+ * the date should be correct). This is used to verify the validity period of
+ * X.509 certificates.
+ *
+ * Comment if your system does not have a correct clock.
+ *
+ * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that
+ * behaves similarly to the gmtime_r() function from the C standard. Refer to
+ * the documentation for mbedtls_platform_gmtime_r() for more information.
+ *
+ * \note It is possible to configure an implementation for
+ * mbedtls_platform_gmtime_r() at compile-time by using the macro
+ * MBEDTLS_PLATFORM_GMTIME_R_ALT.
+ */
+//#define MBEDTLS_HAVE_TIME_DATE
+
+/**
+ * \def MBEDTLS_PLATFORM_MEMORY
+ *
+ * Enable the memory allocation layer.
+ *
+ * By default Mbed TLS uses the system-provided calloc() and free().
+ * This allows different allocators (self-implemented or provided) to be
+ * provided to the platform abstraction layer.
+ *
+ * Enabling #MBEDTLS_PLATFORM_MEMORY without the
+ * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide
+ * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and
+ * free() function pointer at runtime.
+ *
+ * Enabling #MBEDTLS_PLATFORM_MEMORY and specifying
+ * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the
+ * alternate function at compile time.
+ *
+ * An overview of how the value of mbedtls_calloc is determined:
+ *
+ * - if !MBEDTLS_PLATFORM_MEMORY
+ * - mbedtls_calloc = calloc
+ * - if MBEDTLS_PLATFORM_MEMORY
+ * - if (MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO):
+ * - mbedtls_calloc = MBEDTLS_PLATFORM_CALLOC_MACRO
+ * - if !(MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO):
+ * - Dynamic setup via mbedtls_platform_set_calloc_free is now possible with a default value MBEDTLS_PLATFORM_STD_CALLOC.
+ * - How is MBEDTLS_PLATFORM_STD_CALLOC handled?
+ * - if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS:
+ * - MBEDTLS_PLATFORM_STD_CALLOC is not set to anything;
+ * - MBEDTLS_PLATFORM_STD_MEM_HDR can be included if present;
+ * - if !MBEDTLS_PLATFORM_NO_STD_FUNCTIONS:
+ * - if MBEDTLS_PLATFORM_STD_CALLOC is present:
+ * - User-defined MBEDTLS_PLATFORM_STD_CALLOC is respected;
+ * - if !MBEDTLS_PLATFORM_STD_CALLOC:
+ * - MBEDTLS_PLATFORM_STD_CALLOC = calloc
+ *
+ * - At this point the presence of MBEDTLS_PLATFORM_STD_CALLOC is checked.
+ * - if !MBEDTLS_PLATFORM_STD_CALLOC
+ * - MBEDTLS_PLATFORM_STD_CALLOC = uninitialized_calloc
+ *
+ * - mbedtls_calloc = MBEDTLS_PLATFORM_STD_CALLOC.
+ *
+ * Defining MBEDTLS_PLATFORM_CALLOC_MACRO and #MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible.
+ * MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time.
+ * #MBEDTLS_PLATFORM_STD_CALLOC and #MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used,
+ * dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases.
+ * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer.
+ * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything.
+ *
+ * Requires: MBEDTLS_PLATFORM_C
+ *
+ * Enable this layer to allow use of alternative memory allocators.
+ */
+//#define MBEDTLS_PLATFORM_MEMORY
+
+/**
+ * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
+ *
+ * Do not assign standard functions in the platform layer (e.g. calloc() to
+ * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
+ *
+ * This makes sure there are no linking errors on platforms that do not support
+ * these functions. You will HAVE to provide alternatives, either at runtime
+ * via the platform_set_xxx() functions or at compile time by setting
+ * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a
+ * MBEDTLS_PLATFORM_XXX_MACRO.
+ *
+ * Requires: MBEDTLS_PLATFORM_C
+ *
+ * Uncomment to prevent default assignment of standard functions in the
+ * platform layer.
+ */
+//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
+
+/**
+ * \def MBEDTLS_PLATFORM_EXIT_ALT
+ *
+ * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let Mbed TLS support the
+ * function in the platform abstraction layer.
+ *
+ * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, Mbed TLS will
+ * provide a function "mbedtls_platform_set_printf()" that allows you to set an
+ * alternative printf function pointer.
+ *
+ * All these define require MBEDTLS_PLATFORM_C to be defined!
+ *
+ * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows;
+ * it will be enabled automatically by check_config.h
+ *
+ * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as
+ * MBEDTLS_PLATFORM_XXX_MACRO!
+ *
+ * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME
+ *
+ * Uncomment a macro to enable alternate implementation of specific base
+ * platform function
+ */
+//#define MBEDTLS_PLATFORM_SETBUF_ALT
+//#define MBEDTLS_PLATFORM_EXIT_ALT
+//#define MBEDTLS_PLATFORM_TIME_ALT
+//#define MBEDTLS_PLATFORM_FPRINTF_ALT
+//#define MBEDTLS_PLATFORM_PRINTF_ALT
+//#define MBEDTLS_PLATFORM_SNPRINTF_ALT
+//#define MBEDTLS_PLATFORM_VSNPRINTF_ALT
+//#define MBEDTLS_PLATFORM_NV_SEED_ALT
+//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT
+//#define MBEDTLS_PLATFORM_MS_TIME_ALT
+
+/**
+ * Uncomment the macro to let Mbed TLS use your alternate implementation of
+ * mbedtls_platform_gmtime_r(). This replaces the default implementation in
+ * platform_util.c.
+ *
+ * gmtime() is not a thread-safe function as defined in the C standard. The
+ * library will try to use safer implementations of this function, such as
+ * gmtime_r() when available. However, if Mbed TLS cannot identify the target
+ * system, the implementation of mbedtls_platform_gmtime_r() will default to
+ * using the standard gmtime(). In this case, calls from the library to
+ * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex
+ * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the
+ * library are also guarded with this mutex to avoid race conditions. However,
+ * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will
+ * unconditionally use the implementation for mbedtls_platform_gmtime_r()
+ * supplied at compile time.
+ */
+//#define MBEDTLS_PLATFORM_GMTIME_R_ALT
+
+/**
+ * Uncomment the macro to let Mbed TLS use your alternate implementation of
+ * mbedtls_platform_zeroize(), to wipe sensitive data in memory. This replaces
+ * the default implementation in platform_util.c.
+ *
+ * By default, the library uses a system function such as memset_s()
+ * (optional feature of C11), explicit_bzero() (BSD and compatible), or
+ * SecureZeroMemory (Windows). If no such function is detected, the library
+ * falls back to a plain C implementation. Compilers are technically
+ * permitted to optimize this implementation out, meaning that the memory is
+ * not actually wiped. The library tries to prevent that, but the C language
+ * makes it impossible to guarantee that the memory will always be wiped.
+ *
+ * If your platform provides a guaranteed method to wipe memory which
+ * `platform_util.c` does not detect, define this macro to the name of
+ * a function that takes two arguments, a `void *` pointer and a length,
+ * and wipes that many bytes starting at the specified address. For example,
+ * if your platform has explicit_bzero() but `platform_util.c` does not
+ * detect its presence, define `MBEDTLS_PLATFORM_ZEROIZE_ALT` to be
+ * `explicit_bzero` to use that function as mbedtls_platform_zeroize().
+ */
+//#define MBEDTLS_PLATFORM_ZEROIZE_ALT
+
+/**
+ * \def MBEDTLS_DEPRECATED_WARNING
+ *
+ * Mark deprecated functions and features so that they generate a warning if
+ * used. Functionality deprecated in one version will usually be removed in the
+ * next version. You can enable this to help you prepare the transition to a
+ * new major version by making sure your code is not using this functionality.
+ *
+ * This only works with GCC and Clang. With other compilers, you may want to
+ * use MBEDTLS_DEPRECATED_REMOVED
+ *
+ * Uncomment to get warnings on using deprecated functions and features.
+ */
+//#define MBEDTLS_DEPRECATED_WARNING
+
+/**
+ * \def MBEDTLS_DEPRECATED_REMOVED
+ *
+ * Remove deprecated functions and features so that they generate an error if
+ * used. Functionality deprecated in one version will usually be removed in the
+ * next version. You can enable this to help you prepare the transition to a
+ * new major version by making sure your code is not using this functionality.
+ *
+ * Uncomment to get errors on using deprecated functions and features.
+ */
+//#define MBEDTLS_DEPRECATED_REMOVED
+
+/** \} name SECTION: System support */
+
+/**
+ * \name SECTION: Mbed TLS feature support
+ *
+ * This section sets support for features that are or are not needed
+ * within the modules that are enabled.
+ * \{
+ */
+
+/**
+ * \def MBEDTLS_TIMING_ALT
+ *
+ * Uncomment to provide your own alternate implementation for
+ * mbedtls_timing_get_timer(), mbedtls_set_alarm(), mbedtls_set/get_delay()
+ *
+ * Only works if you have MBEDTLS_TIMING_C enabled.
+ *
+ * You will need to provide a header "timing_alt.h" and an implementation at
+ * compile time.
+ */
+//#define MBEDTLS_TIMING_ALT
+
+/**
+ * \def MBEDTLS_AES_ALT
+ *
+ * MBEDTLS__MODULE_NAME__ALT: Uncomment a macro to let Mbed TLS use your
+ * alternate core implementation of a symmetric crypto, an arithmetic or hash
+ * module (e.g. platform specific assembly optimized implementations). Keep
+ * in mind that the function prototypes should remain the same.
+ *
+ * This replaces the whole module. If you only want to replace one of the
+ * functions, use one of the MBEDTLS__FUNCTION_NAME__ALT flags.
+ *
+ * Example: In case you uncomment MBEDTLS_AES_ALT, Mbed TLS will no longer
+ * provide the "struct mbedtls_aes_context" definition and omit the base
+ * function declarations and implementations. "aes_alt.h" will be included from
+ * "aes.h" to include the new function definitions.
+ *
+ * Uncomment a macro to enable alternate implementation of the corresponding
+ * module.
+ *
+ * \warning MD5, DES and SHA-1 are considered weak and their
+ * use constitutes a security risk. If possible, we recommend
+ * avoiding dependencies on them, and considering stronger message
+ * digests and ciphers instead.
+ *
+ */
+//#define MBEDTLS_AES_ALT
+//#define MBEDTLS_ARIA_ALT
+//#define MBEDTLS_CAMELLIA_ALT
+//#define MBEDTLS_CCM_ALT
+//#define MBEDTLS_CHACHA20_ALT
+//#define MBEDTLS_CHACHAPOLY_ALT
+//#define MBEDTLS_CMAC_ALT
+//#define MBEDTLS_DES_ALT
+//#define MBEDTLS_DHM_ALT
+//#define MBEDTLS_ECJPAKE_ALT
+//#define MBEDTLS_GCM_ALT
+//#define MBEDTLS_NIST_KW_ALT
+//#define MBEDTLS_MD5_ALT
+//#define MBEDTLS_POLY1305_ALT
+//#define MBEDTLS_RIPEMD160_ALT
+//#define MBEDTLS_RSA_ALT
+//#define MBEDTLS_SHA1_ALT
+//#define MBEDTLS_SHA256_ALT
+//#define MBEDTLS_SHA512_ALT
+
+/*
+ * When replacing the elliptic curve module, please consider, that it is
+ * implemented with two .c files:
+ * - ecp.c
+ * - ecp_curves.c
+ * You can replace them very much like all the other MBEDTLS__MODULE_NAME__ALT
+ * macros as described above. The only difference is that you have to make sure
+ * that you provide functionality for both .c files.
+ */
+//#define MBEDTLS_ECP_ALT
+
+/**
+ * \def MBEDTLS_SHA256_PROCESS_ALT
+ *
+ * MBEDTLS__FUNCTION_NAME__ALT: Uncomment a macro to let Mbed TLS use you
+ * alternate core implementation of symmetric crypto or hash function. Keep in
+ * mind that function prototypes should remain the same.
+ *
+ * This replaces only one function. The header file from Mbed TLS is still
+ * used, in contrast to the MBEDTLS__MODULE_NAME__ALT flags.
+ *
+ * Example: In case you uncomment MBEDTLS_SHA256_PROCESS_ALT, Mbed TLS will
+ * no longer provide the mbedtls_sha1_process() function, but it will still provide
+ * the other function (using your mbedtls_sha1_process() function) and the definition
+ * of mbedtls_sha1_context, so your implementation of mbedtls_sha1_process must be compatible
+ * with this definition.
+ *
+ * \note If you use the AES_xxx_ALT macros, then it is recommended to also set
+ * MBEDTLS_AES_ROM_TABLES in order to help the linker garbage-collect the AES
+ * tables.
+ *
+ * Uncomment a macro to enable alternate implementation of the corresponding
+ * function.
+ *
+ * \warning MD5, DES and SHA-1 are considered weak and their use
+ * constitutes a security risk. If possible, we recommend avoiding
+ * dependencies on them, and considering stronger message digests
+ * and ciphers instead.
+ *
+ * \warning If both MBEDTLS_ECDSA_SIGN_ALT and MBEDTLS_ECDSA_DETERMINISTIC are
+ * enabled, then the deterministic ECDH signature functions pass the
+ * the static HMAC-DRBG as RNG to mbedtls_ecdsa_sign(). Therefore
+ * alternative implementations should use the RNG only for generating
+ * the ephemeral key and nothing else. If this is not possible, then
+ * MBEDTLS_ECDSA_DETERMINISTIC should be disabled and an alternative
+ * implementation should be provided for mbedtls_ecdsa_sign_det_ext().
+ *
+ */
+//#define MBEDTLS_MD5_PROCESS_ALT
+//#define MBEDTLS_RIPEMD160_PROCESS_ALT
+//#define MBEDTLS_SHA1_PROCESS_ALT
+//#define MBEDTLS_SHA256_PROCESS_ALT
+//#define MBEDTLS_SHA512_PROCESS_ALT
+//#define MBEDTLS_DES_SETKEY_ALT
+//#define MBEDTLS_DES_CRYPT_ECB_ALT
+//#define MBEDTLS_DES3_CRYPT_ECB_ALT
+//#define MBEDTLS_AES_SETKEY_ENC_ALT
+//#define MBEDTLS_AES_SETKEY_DEC_ALT
+//#define MBEDTLS_AES_ENCRYPT_ALT
+//#define MBEDTLS_AES_DECRYPT_ALT
+//#define MBEDTLS_ECDH_GEN_PUBLIC_ALT
+//#define MBEDTLS_ECDH_COMPUTE_SHARED_ALT
+//#define MBEDTLS_ECDSA_VERIFY_ALT
+//#define MBEDTLS_ECDSA_SIGN_ALT
+//#define MBEDTLS_ECDSA_GENKEY_ALT
+
+/**
+ * \def MBEDTLS_ECP_INTERNAL_ALT
+ *
+ * Expose a part of the internal interface of the Elliptic Curve Point module.
+ *
+ * MBEDTLS_ECP__FUNCTION_NAME__ALT: Uncomment a macro to let Mbed TLS use your
+ * alternative core implementation of elliptic curve arithmetic. Keep in mind
+ * that function prototypes should remain the same.
+ *
+ * This partially replaces one function. The header file from Mbed TLS is still
+ * used, in contrast to the MBEDTLS_ECP_ALT flag. The original implementation
+ * is still present and it is used for group structures not supported by the
+ * alternative.
+ *
+ * The original implementation can in addition be removed by setting the
+ * MBEDTLS_ECP_NO_FALLBACK option, in which case any function for which the
+ * corresponding MBEDTLS_ECP__FUNCTION_NAME__ALT macro is defined will not be
+ * able to fallback to curves not supported by the alternative implementation.
+ *
+ * Any of these options become available by defining MBEDTLS_ECP_INTERNAL_ALT
+ * and implementing the following functions:
+ * unsigned char mbedtls_internal_ecp_grp_capable(
+ * const mbedtls_ecp_group *grp )
+ * int mbedtls_internal_ecp_init( const mbedtls_ecp_group *grp )
+ * void mbedtls_internal_ecp_free( const mbedtls_ecp_group *grp )
+ * The mbedtls_internal_ecp_grp_capable function should return 1 if the
+ * replacement functions implement arithmetic for the given group and 0
+ * otherwise.
+ * The functions mbedtls_internal_ecp_init and mbedtls_internal_ecp_free are
+ * called before and after each point operation and provide an opportunity to
+ * implement optimized set up and tear down instructions.
+ *
+ * Example: In case you set MBEDTLS_ECP_INTERNAL_ALT and
+ * MBEDTLS_ECP_DOUBLE_JAC_ALT, Mbed TLS will still provide the ecp_double_jac()
+ * function, but will use your mbedtls_internal_ecp_double_jac() if the group
+ * for the operation is supported by your implementation (i.e. your
+ * mbedtls_internal_ecp_grp_capable() function returns 1 for this group). If the
+ * group is not supported by your implementation, then the original Mbed TLS
+ * implementation of ecp_double_jac() is used instead, unless this fallback
+ * behaviour is disabled by setting MBEDTLS_ECP_NO_FALLBACK (in which case
+ * ecp_double_jac() will return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE).
+ *
+ * The function prototypes and the definition of mbedtls_ecp_group and
+ * mbedtls_ecp_point will not change based on MBEDTLS_ECP_INTERNAL_ALT, so your
+ * implementation of mbedtls_internal_ecp__function_name__ must be compatible
+ * with their definitions.
+ *
+ * Uncomment a macro to enable alternate implementation of the corresponding
+ * function.
+ */
+/* Required for all the functions in this section */
+//#define MBEDTLS_ECP_INTERNAL_ALT
+/* Turn off software fallback for curves not supported in hardware */
+//#define MBEDTLS_ECP_NO_FALLBACK
+/* Support for Weierstrass curves with Jacobi representation */
+//#define MBEDTLS_ECP_RANDOMIZE_JAC_ALT
+//#define MBEDTLS_ECP_ADD_MIXED_ALT
+//#define MBEDTLS_ECP_DOUBLE_JAC_ALT
+//#define MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT
+//#define MBEDTLS_ECP_NORMALIZE_JAC_ALT
+/* Support for curves with Montgomery arithmetic */
+//#define MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT
+//#define MBEDTLS_ECP_RANDOMIZE_MXZ_ALT
+//#define MBEDTLS_ECP_NORMALIZE_MXZ_ALT
+
+/**
+ * \def MBEDTLS_ENTROPY_HARDWARE_ALT
+ *
+ * Uncomment this macro to let Mbed TLS use your own implementation of a
+ * hardware entropy collector.
+ *
+ * Your function must be called \c mbedtls_hardware_poll(), have the same
+ * prototype as declared in library/entropy_poll.h, and accept NULL as first
+ * argument.
+ *
+ * Uncomment to use your own hardware entropy collector.
+ */
+//#define MBEDTLS_ENTROPY_HARDWARE_ALT
+
+/**
+ * \def MBEDTLS_AES_ROM_TABLES
+ *
+ * Use precomputed AES tables stored in ROM.
+ *
+ * Uncomment this macro to use precomputed AES tables stored in ROM.
+ * Comment this macro to generate AES tables in RAM at runtime.
+ *
+ * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb
+ * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the
+ * initialization time before the first AES operation can be performed.
+ * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c
+ * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded
+ * performance if ROM access is slower than RAM access.
+ *
+ * This option is independent of \c MBEDTLS_AES_FEWER_TABLES.
+ */
+//#define MBEDTLS_AES_ROM_TABLES
+
+/**
+ * \def MBEDTLS_AES_FEWER_TABLES
+ *
+ * Use less ROM/RAM for AES tables.
+ *
+ * Uncommenting this macro omits 75% of the AES tables from
+ * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES)
+ * by computing their values on the fly during operations
+ * (the tables are entry-wise rotations of one another).
+ *
+ * Tradeoff: Uncommenting this reduces the RAM / ROM footprint
+ * by ~6kb but at the cost of more arithmetic operations during
+ * runtime. Specifically, one has to compare 4 accesses within
+ * different tables to 4 accesses with additional arithmetic
+ * operations within the same table. The performance gain/loss
+ * depends on the system and memory details.
+ *
+ * This option is independent of \c MBEDTLS_AES_ROM_TABLES.
+ */
+//#define MBEDTLS_AES_FEWER_TABLES
+
+/**
+ * \def MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+ *
+ * Use only 128-bit keys in AES operations to save ROM.
+ *
+ * Uncomment this macro to remove support for AES operations that use 192-
+ * or 256-bit keys.
+ *
+ * Uncommenting this macro reduces the size of AES code by ~300 bytes
+ * on v8-M/Thumb2.
+ *
+ * Module: library/aes.c
+ *
+ * Requires: MBEDTLS_AES_C
+ */
+//#define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH
+
+/*
+ * Disable plain C implementation for AES.
+ *
+ * When the plain C implementation is enabled, and an implementation using a
+ * special CPU feature (such as MBEDTLS_AESCE_C) is also enabled, runtime
+ * detection will be used to select between them.
+ *
+ * If only one implementation is present, runtime detection will not be used.
+ * This configuration will crash at runtime if running on a CPU without the
+ * necessary features. It will not build unless at least one of MBEDTLS_AESCE_C
+ * and/or MBEDTLS_AESNI_C is enabled & present in the build.
+ */
+//#define MBEDTLS_AES_USE_HARDWARE_ONLY
+
+/**
+ * \def MBEDTLS_CAMELLIA_SMALL_MEMORY
+ *
+ * Use less ROM for the Camellia implementation (saves about 768 bytes).
+ *
+ * Uncomment this macro to use less memory for Camellia.
+ */
+//#define MBEDTLS_CAMELLIA_SMALL_MEMORY
+
+/**
+ * \def MBEDTLS_CHECK_RETURN_WARNING
+ *
+ * If this macro is defined, emit a compile-time warning if application code
+ * calls a function without checking its return value, but the return value
+ * should generally be checked in portable applications.
+ *
+ * This is only supported on platforms where #MBEDTLS_CHECK_RETURN is
+ * implemented. Otherwise this option has no effect.
+ *
+ * Uncomment to get warnings on using fallible functions without checking
+ * their return value.
+ *
+ * \note This feature is a work in progress.
+ * Warnings will be added to more functions in the future.
+ *
+ * \note A few functions are considered critical, and ignoring the return
+ * value of these functions will trigger a warning even if this
+ * macro is not defined. To completely disable return value check
+ * warnings, define #MBEDTLS_CHECK_RETURN with an empty expansion.
+ */
+//#define MBEDTLS_CHECK_RETURN_WARNING
+
+/**
+ * \def MBEDTLS_CIPHER_MODE_CBC
+ *
+ * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers.
+ */
+#define MBEDTLS_CIPHER_MODE_CBC
+
+/**
+ * \def MBEDTLS_CIPHER_MODE_CFB
+ *
+ * Enable Cipher Feedback mode (CFB) for symmetric ciphers.
+ */
+#define MBEDTLS_CIPHER_MODE_CFB
+
+/**
+ * \def MBEDTLS_CIPHER_MODE_CTR
+ *
+ * Enable Counter Block Cipher mode (CTR) for symmetric ciphers.
+ */
+#define MBEDTLS_CIPHER_MODE_CTR
+
+/**
+ * \def MBEDTLS_CIPHER_MODE_OFB
+ *
+ * Enable Output Feedback mode (OFB) for symmetric ciphers.
+ */
+#define MBEDTLS_CIPHER_MODE_OFB
+
+/**
+ * \def MBEDTLS_CIPHER_MODE_XTS
+ *
+ * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES.
+ */
+#define MBEDTLS_CIPHER_MODE_XTS
+
+/**
+ * \def MBEDTLS_CIPHER_NULL_CIPHER
+ *
+ * Enable NULL cipher.
+ * Warning: Only do so when you know what you are doing. This allows for
+ * encryption or channels without any security!
+ *
+ * To enable the following ciphersuites:
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_NULL_SHA
+ * MBEDTLS_TLS_ECDH_RSA_WITH_NULL_SHA
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_NULL_SHA
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_NULL_SHA
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA
+ * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA256
+ * MBEDTLS_TLS_DHE_PSK_WITH_NULL_SHA
+ * MBEDTLS_TLS_RSA_WITH_NULL_SHA256
+ * MBEDTLS_TLS_RSA_WITH_NULL_SHA
+ * MBEDTLS_TLS_RSA_WITH_NULL_MD5
+ * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_NULL_SHA
+ * MBEDTLS_TLS_PSK_WITH_NULL_SHA384
+ * MBEDTLS_TLS_PSK_WITH_NULL_SHA256
+ * MBEDTLS_TLS_PSK_WITH_NULL_SHA
+ *
+ * Uncomment this macro to enable the NULL cipher and ciphersuites
+ */
+//#define MBEDTLS_CIPHER_NULL_CIPHER
+
+/**
+ * \def MBEDTLS_CIPHER_PADDING_PKCS7
+ *
+ * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for
+ * specific padding modes in the cipher layer with cipher modes that support
+ * padding (e.g. CBC)
+ *
+ * If you disable all padding modes, only full blocks can be used with CBC.
+ *
+ * Enable padding modes in the cipher layer.
+ */
+#define MBEDTLS_CIPHER_PADDING_PKCS7
+#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS
+#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN
+#define MBEDTLS_CIPHER_PADDING_ZEROS
+
+/** \def MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
+ *
+ * Uncomment this macro to use a 128-bit key in the CTR_DRBG module.
+ * Without this, CTR_DRBG uses a 256-bit key
+ * unless \c MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH is set.
+ */
+//#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY
+
+/**
+ * Enable the verified implementations of ECDH primitives from Project Everest
+ * (currently only Curve25519). This feature changes the layout of ECDH
+ * contexts and therefore is a compatibility break for applications that access
+ * fields of a mbedtls_ecdh_context structure directly. See also
+ * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h.
+ *
+ * The Everest code is provided under the Apache 2.0 license only; therefore enabling this
+ * option is not compatible with taking the library under the GPL v2.0-or-later license.
+ */
+//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED
+
+/**
+ * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED
+ *
+ * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve
+ * module. By default all supported curves are enabled.
+ *
+ * Comment macros to disable the curve and functions for it
+ */
+/* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */
+#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
+#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
+#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
+#define MBEDTLS_ECP_DP_BP256R1_ENABLED
+#define MBEDTLS_ECP_DP_BP384R1_ENABLED
+#define MBEDTLS_ECP_DP_BP512R1_ENABLED
+/* Montgomery curves (supporting ECP) */
+#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
+#define MBEDTLS_ECP_DP_CURVE448_ENABLED
+
+/**
+ * \def MBEDTLS_ECP_NIST_OPTIM
+ *
+ * Enable specific 'modulo p' routines for each NIST prime.
+ * Depending on the prime and architecture, makes operations 4 to 8 times
+ * faster on the corresponding curve.
+ *
+ * Comment this macro to disable NIST curves optimisation.
+ */
+#define MBEDTLS_ECP_NIST_OPTIM
+
+/**
+ * \def MBEDTLS_ECP_RESTARTABLE
+ *
+ * Enable "non-blocking" ECC operations that can return early and be resumed.
+ *
+ * This allows various functions to pause by returning
+ * #MBEDTLS_ERR_ECP_IN_PROGRESS (or, for functions in the SSL module,
+ * #MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS) and then be called later again in
+ * order to further progress and eventually complete their operation. This is
+ * controlled through mbedtls_ecp_set_max_ops() which limits the maximum
+ * number of ECC operations a function may perform before pausing; see
+ * mbedtls_ecp_set_max_ops() for more information.
+ *
+ * This is useful in non-threaded environments if you want to avoid blocking
+ * for too long on ECC (and, hence, X.509 or SSL/TLS) operations.
+ *
+ * This option:
+ * - Adds xxx_restartable() variants of existing operations in the
+ * following modules, with corresponding restart context types:
+ * - ECP (for Short Weierstrass curves only): scalar multiplication (mul),
+ * linear combination (muladd);
+ * - ECDSA: signature generation & verification;
+ * - PK: signature generation & verification;
+ * - X509: certificate chain verification.
+ * - Adds mbedtls_ecdh_enable_restart() in the ECDH module.
+ * - Changes the behaviour of TLS 1.2 clients (not servers) when using the
+ * ECDHE-ECDSA key exchange (not other key exchanges) to make all ECC
+ * computations restartable:
+ * - ECDH operations from the key exchange, only for Short Weierstrass
+ * curves, only when MBEDTLS_USE_PSA_CRYPTO is not enabled.
+ * - verification of the server's key exchange signature;
+ * - verification of the server's certificate chain;
+ * - generation of the client's signature if client authentication is used,
+ * with an ECC key/certificate.
+ *
+ * \note In the cases above, the usual SSL/TLS functions, such as
+ * mbedtls_ssl_handshake(), can now return
+ * MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS.
+ *
+ * \note When this option and MBEDTLS_USE_PSA_CRYPTO are both enabled,
+ * restartable operations in PK, X.509 and TLS (see above) are not
+ * using PSA. On the other hand, ECDH computations in TLS are using
+ * PSA, and are not restartable. These are temporary limitations that
+ * should be lifted in the future.
+ *
+ * \note This option only works with the default software implementation of
+ * elliptic curve functionality. It is incompatible with
+ * MBEDTLS_ECP_ALT, MBEDTLS_ECDH_XXX_ALT, MBEDTLS_ECDSA_XXX_ALT.
+ *
+ * Requires: MBEDTLS_ECP_C
+ *
+ * Uncomment this macro to enable restartable ECC computations.
+ */
+//#define MBEDTLS_ECP_RESTARTABLE
+
+/**
+ * Uncomment to enable using new bignum code in the ECC modules.
+ *
+ * \warning This is currently experimental, incomplete and therefore should not
+ * be used in production.
+ */
+//#define MBEDTLS_ECP_WITH_MPI_UINT
+
+/**
+ * \def MBEDTLS_ECDSA_DETERMINISTIC
+ *
+ * Enable deterministic ECDSA (RFC 6979).
+ * Standard ECDSA is "fragile" in the sense that lack of entropy when signing
+ * may result in a compromise of the long-term signing key. This is avoided by
+ * the deterministic variant.
+ *
+ * Requires: MBEDTLS_HMAC_DRBG_C, MBEDTLS_ECDSA_C
+ *
+ * Comment this macro to disable deterministic ECDSA.
+ */
+#define MBEDTLS_ECDSA_DETERMINISTIC
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+ *
+ * Enable the PSK based ciphersuite modes in SSL / TLS.
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
+ */
+#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
+ *
+ * Enable the DHE-PSK based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_DHM_C
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
+ *
+ * \warning Using DHE constitutes a security risk as it
+ * is not possible to validate custom DH parameters.
+ * If possible, it is recommended users should consider
+ * preferring other methods of key exchange.
+ * See dhm.h for more details.
+ *
+ */
+#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
+ *
+ * Enable the ECDHE-PSK based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH)
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
+ */
+#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
+ *
+ * Enable the RSA-PSK based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
+ * MBEDTLS_X509_CRT_PARSE_C
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
+ */
+#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
+ *
+ * Enable the RSA-only based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
+ * MBEDTLS_X509_CRT_PARSE_C
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
+ * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
+ */
+#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
+ *
+ * Enable the DHE-RSA based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_DHM_C, MBEDTLS_RSA_C, MBEDTLS_PKCS1_V15,
+ * MBEDTLS_X509_CRT_PARSE_C
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
+ *
+ * \warning Using DHE constitutes a security risk as it
+ * is not possible to validate custom DH parameters.
+ * If possible, it is recommended users should consider
+ * preferring other methods of key exchange.
+ * See dhm.h for more details.
+ *
+ */
+#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+ *
+ * Enable the ECDHE-RSA based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH)
+ * MBEDTLS_RSA_C
+ * MBEDTLS_PKCS1_V15
+ * MBEDTLS_X509_CRT_PARSE_C
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
+ */
+#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+ *
+ * Enable the ECDHE-ECDSA based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH)
+ * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA)
+ * MBEDTLS_X509_CRT_PARSE_C
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
+ */
+#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
+ *
+ * Enable the ECDH-ECDSA based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH)
+ * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA)
+ * MBEDTLS_X509_CRT_PARSE_C
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
+ */
+#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+ *
+ * Enable the ECDH-RSA based ciphersuite modes in SSL / TLS.
+ *
+ * Requires: MBEDTLS_ECDH_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDH)
+ * MBEDTLS_RSA_C
+ * MBEDTLS_X509_CRT_PARSE_C
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
+ */
+#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+
+/**
+ * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
+ *
+ * Enable the ECJPAKE based ciphersuite modes in SSL / TLS.
+ *
+ * \warning This is currently experimental. EC J-PAKE support is based on the
+ * Thread v1.0.0 specification; incompatible changes to the specification
+ * might still happen. For this reason, this is disabled by default.
+ *
+ * Requires: MBEDTLS_ECJPAKE_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_JPAKE)
+ * SHA-256 (via MBEDTLS_SHA256_C or a PSA driver)
+ * MBEDTLS_ECP_DP_SECP256R1_ENABLED
+ *
+ * \warning If SHA-256 is provided only by a PSA driver, you must call
+ * psa_crypto_init() before the first hanshake (even if
+ * MBEDTLS_USE_PSA_CRYPTO is disabled).
+ *
+ * This enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
+ */
+//#define MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
+
+/**
+ * \def MBEDTLS_PK_PARSE_EC_EXTENDED
+ *
+ * Enhance support for reading EC keys using variants of SEC1 not allowed by
+ * RFC 5915 and RFC 5480.
+ *
+ * Currently this means parsing the SpecifiedECDomain choice of EC
+ * parameters (only known groups are supported, not arbitrary domains, to
+ * avoid validation issues).
+ *
+ * Disable if you only need to support RFC 5915 + 5480 key formats.
+ */
+#define MBEDTLS_PK_PARSE_EC_EXTENDED
+
+/**
+ * \def MBEDTLS_PK_PARSE_EC_COMPRESSED
+ *
+ * Enable the support for parsing public keys of type Short Weierstrass
+ * (MBEDTLS_ECP_DP_SECP_XXX and MBEDTLS_ECP_DP_BP_XXX) which are using the
+ * compressed point format. This parsing is done through ECP module's functions.
+ *
+ * \note As explained in the description of MBEDTLS_ECP_PF_COMPRESSED (in ecp.h)
+ * the only unsupported curves are MBEDTLS_ECP_DP_SECP224R1 and
+ * MBEDTLS_ECP_DP_SECP224K1.
+ */
+#define MBEDTLS_PK_PARSE_EC_COMPRESSED
+
+/**
+ * \def MBEDTLS_ERROR_STRERROR_DUMMY
+ *
+ * Enable a dummy error function to make use of mbedtls_strerror() in
+ * third party libraries easier when MBEDTLS_ERROR_C is disabled
+ * (no effect when MBEDTLS_ERROR_C is enabled).
+ *
+ * You can safely disable this if MBEDTLS_ERROR_C is enabled, or if you're
+ * not using mbedtls_strerror() or error_strerror() in your application.
+ *
+ * Disable if you run into name conflicts and want to really remove the
+ * mbedtls_strerror()
+ */
+#define MBEDTLS_ERROR_STRERROR_DUMMY
+
+/**
+ * \def MBEDTLS_GENPRIME
+ *
+ * Enable the prime-number generation code.
+ *
+ * Requires: MBEDTLS_BIGNUM_C
+ */
+#define MBEDTLS_GENPRIME
+
+/**
+ * \def MBEDTLS_FS_IO
+ *
+ * Enable functions that use the filesystem.
+ */
+//#define MBEDTLS_FS_IO
+
+/**
+ * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
+ *
+ * Do not add default entropy sources in mbedtls_entropy_init().
+ *
+ * This is useful to have more control over the added entropy sources in an
+ * application.
+ *
+ * Uncomment this macro to prevent loading of default entropy functions.
+ */
+//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES
+
+/**
+ * \def MBEDTLS_NO_PLATFORM_ENTROPY
+ *
+ * Do not use built-in platform entropy functions.
+ * This is useful if your platform does not support
+ * standards like the /dev/urandom or Windows CryptoAPI.
+ *
+ * Uncomment this macro to disable the built-in platform entropy functions.
+ */
+//#define MBEDTLS_NO_PLATFORM_ENTROPY
+
+/**
+ * \def MBEDTLS_ENTROPY_FORCE_SHA256
+ *
+ * Force the entropy accumulator to use a SHA-256 accumulator instead of the
+ * default SHA-512 based one (if both are available).
+ *
+ * Requires: MBEDTLS_SHA256_C
+ *
+ * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option
+ * if you have performance concerns.
+ *
+ * This option is only useful if both MBEDTLS_SHA256_C and
+ * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
+ */
+//#define MBEDTLS_ENTROPY_FORCE_SHA256
+
+/**
+ * \def MBEDTLS_ENTROPY_NV_SEED
+ *
+ * Enable the non-volatile (NV) seed file-based entropy source.
+ * (Also enables the NV seed read/write functions in the platform layer)
+ *
+ * This is crucial (if not required) on systems that do not have a
+ * cryptographic entropy source (in hardware or kernel) available.
+ *
+ * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C
+ *
+ * \note The read/write functions that are used by the entropy source are
+ * determined in the platform layer, and can be modified at runtime and/or
+ * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used.
+ *
+ * \note If you use the default implementation functions that read a seedfile
+ * with regular fopen(), please make sure you make a seedfile with the
+ * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at
+ * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from
+ * and written to or you will get an entropy source error! The default
+ * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE
+ * bytes from the file.
+ *
+ * \note The entropy collector will write to the seed file before entropy is
+ * given to an external source, to update it.
+ */
+//#define MBEDTLS_ENTROPY_NV_SEED
+
+/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
+ *
+ * Enable key identifiers that encode a key owner identifier.
+ *
+ * The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t
+ * which is currently hard-coded to be int32_t.
+ *
+ * Note that this option is meant for internal use only and may be removed
+ * without notice.
+ */
+//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
+
+/**
+ * \def MBEDTLS_MEMORY_DEBUG
+ *
+ * Enable debugging of buffer allocator memory issues. Automatically prints
+ * (to stderr) all (fatal) messages on memory allocation issues. Enables
+ * function for 'debug output' of allocated memory.
+ *
+ * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
+ *
+ * Uncomment this macro to let the buffer allocator print out error messages.
+ */
+//#define MBEDTLS_MEMORY_DEBUG
+
+/**
+ * \def MBEDTLS_MEMORY_BACKTRACE
+ *
+ * Include backtrace information with each allocated block.
+ *
+ * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C
+ * GLIBC-compatible backtrace() and backtrace_symbols() support
+ *
+ * Uncomment this macro to include backtrace information
+ */
+//#define MBEDTLS_MEMORY_BACKTRACE
+
+/**
+ * \def MBEDTLS_PK_RSA_ALT_SUPPORT
+ *
+ * Support external private RSA keys (eg from a HSM) in the PK layer.
+ *
+ * Comment this macro to disable support for external private RSA keys.
+ */
+#define MBEDTLS_PK_RSA_ALT_SUPPORT
+
+/**
+ * \def MBEDTLS_PKCS1_V15
+ *
+ * Enable support for PKCS#1 v1.5 encoding.
+ *
+ * Requires: MBEDTLS_RSA_C
+ *
+ * This enables support for PKCS#1 v1.5 operations.
+ */
+#define MBEDTLS_PKCS1_V15
+
+/**
+ * \def MBEDTLS_PKCS1_V21
+ *
+ * Enable support for PKCS#1 v2.1 encoding.
+ *
+ * Requires: MBEDTLS_RSA_C
+ *
+ * \warning If using a hash that is only provided by PSA drivers, you must
+ * call psa_crypto_init() before doing any PKCS#1 v2.1 operation.
+ *
+ * This enables support for RSAES-OAEP and RSASSA-PSS operations.
+ */
+#define MBEDTLS_PKCS1_V21
+
+/** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
+ *
+ * Enable support for platform built-in keys. If you enable this feature,
+ * you must implement the function mbedtls_psa_platform_get_builtin_key().
+ * See the documentation of that function for more information.
+ *
+ * Built-in keys are typically derived from a hardware unique key or
+ * stored in a secure element.
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_C.
+ *
+ * \warning This interface is experimental and may change or be removed
+ * without notice.
+ */
+//#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
+
+/** \def MBEDTLS_PSA_CRYPTO_CLIENT
+ *
+ * Enable support for PSA crypto client.
+ *
+ * \note This option allows to include the code necessary for a PSA
+ * crypto client when the PSA crypto implementation is not included in
+ * the library (MBEDTLS_PSA_CRYPTO_C disabled). The code included is the
+ * code to set and get PSA key attributes.
+ * The development of PSA drivers partially relying on the library to
+ * fulfill the hardware gaps is another possible usage of this option.
+ *
+ * \warning This interface is experimental and may change or be removed
+ * without notice.
+ */
+//#define MBEDTLS_PSA_CRYPTO_CLIENT
+
+/** \def MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
+ *
+ * Make the PSA Crypto module use an external random generator provided
+ * by a driver, instead of Mbed TLS's entropy and DRBG modules.
+ *
+ * \note This random generator must deliver random numbers with cryptographic
+ * quality and high performance. It must supply unpredictable numbers
+ * with a uniform distribution. The implementation of this function
+ * is responsible for ensuring that the random generator is seeded
+ * with sufficient entropy. If you have a hardware TRNG which is slow
+ * or delivers non-uniform output, declare it as an entropy source
+ * with mbedtls_entropy_add_source() instead of enabling this option.
+ *
+ * If you enable this option, you must configure the type
+ * ::mbedtls_psa_external_random_context_t in psa/crypto_platform.h
+ * and define a function called mbedtls_psa_external_get_random()
+ * with the following prototype:
+ * ```
+ * psa_status_t mbedtls_psa_external_get_random(
+ * mbedtls_psa_external_random_context_t *context,
+ * uint8_t *output, size_t output_size, size_t *output_length);
+ * );
+ * ```
+ * The \c context value is initialized to 0 before the first call.
+ * The function must fill the \c output buffer with \c output_size bytes
+ * of random data and set \c *output_length to \c output_size.
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_C
+ *
+ * \warning If you enable this option, code that uses the PSA cryptography
+ * interface will not use any of the entropy sources set up for
+ * the entropy module, nor the NV seed that MBEDTLS_ENTROPY_NV_SEED
+ * enables.
+ *
+ * \note This option is experimental and may be removed without notice.
+ */
+//#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_SPM
+ *
+ * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure
+ * Partition Manager) integration which separates the code into two parts: a
+ * NSPE (Non-Secure Process Environment) and an SPE (Secure Process
+ * Environment).
+ *
+ * If you enable this option, your build environment must include a header
+ * file `"crypto_spe.h"` (either in the `psa` subdirectory of the Mbed TLS
+ * header files, or in another directory on the compiler's include search
+ * path). Alternatively, your platform may customize the header
+ * `psa/crypto_platform.h`, in which case it can skip or replace the
+ * inclusion of `"crypto_spe.h"`.
+ *
+ * Module: library/psa_crypto.c
+ * Requires: MBEDTLS_PSA_CRYPTO_C
+ *
+ */
+//#define MBEDTLS_PSA_CRYPTO_SPM
+
+/**
+ * Uncomment to enable p256-m. This is an alternative implementation of
+ * key generation, ECDH and (randomized) ECDSA on the curve SECP256R1.
+ * Compared to the default implementation:
+ *
+ * - p256-m has a much smaller code size and RAM footprint.
+ * - p256-m is only available via the PSA API. This includes the pk module
+ * when #MBEDTLS_USE_PSA_CRYPTO is enabled.
+ * - p256-m does not support deterministic ECDSA, EC-JPAKE, custom protocols
+ * over the core arithmetic, or deterministic derivation of keys.
+ *
+ * We recommend enabling this option if your application uses the PSA API
+ * and the only elliptic curve support it needs is ECDH and ECDSA over
+ * SECP256R1.
+ *
+ * If you enable this option, you do not need to enable any ECC-related
+ * MBEDTLS_xxx option. You do need to separately request support for the
+ * cryptographic mechanisms through the PSA API:
+ * - #MBEDTLS_PSA_CRYPTO_C and #MBEDTLS_PSA_CRYPTO_CONFIG for PSA-based
+ * configuration;
+ * - #MBEDTLS_USE_PSA_CRYPTO if you want to use p256-m from PK, X.509 or TLS;
+ * - #PSA_WANT_ECC_SECP_R1_256;
+ * - #PSA_WANT_ALG_ECDH and/or #PSA_WANT_ALG_ECDSA as needed;
+ * - #PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY, #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC,
+ * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT,
+ * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT and/or
+ * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE as needed.
+ *
+ * \note To benefit from the smaller code size of p256-m, make sure that you
+ * do not enable any ECC-related option not supported by p256-m: this
+ * would cause the built-in ECC implementation to be built as well, in
+ * order to provide the required option.
+ * Make sure #PSA_WANT_ALG_DETERMINISTIC_ECDSA, #PSA_WANT_ALG_JPAKE and
+ * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE, and curves other than
+ * SECP256R1 are disabled as they are not supported by this driver.
+ * Also, avoid defining #MBEDTLS_PK_PARSE_EC_COMPRESSED or
+ * #MBEDTLS_PK_PARSE_EC_EXTENDED as those currently require a subset of
+ * the built-in ECC implementation, see docs/driver-only-builds.md.
+ */
+//#define MBEDTLS_PSA_P256M_DRIVER_ENABLED
+
+/**
+ * \def MBEDTLS_PSA_INJECT_ENTROPY
+ *
+ * Enable support for entropy injection at first boot. This feature is
+ * required on systems that do not have a built-in entropy source (TRNG).
+ * This feature is currently not supported on systems that have a built-in
+ * entropy source.
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_STORAGE_C, MBEDTLS_ENTROPY_NV_SEED
+ *
+ */
+//#define MBEDTLS_PSA_INJECT_ENTROPY
+
+/**
+ * \def MBEDTLS_RSA_NO_CRT
+ *
+ * Do not use the Chinese Remainder Theorem
+ * for the RSA private operation.
+ *
+ * Uncomment this macro to disable the use of CRT in RSA.
+ *
+ */
+//#define MBEDTLS_RSA_NO_CRT
+
+/**
+ * \def MBEDTLS_SELF_TEST
+ *
+ * Enable the checkup functions (*_self_test).
+ */
+#define MBEDTLS_SELF_TEST
+
+/**
+ * \def MBEDTLS_SHA256_SMALLER
+ *
+ * Enable an implementation of SHA-256 that has lower ROM footprint but also
+ * lower performance.
+ *
+ * The default implementation is meant to be a reasonable compromise between
+ * performance and size. This version optimizes more aggressively for size at
+ * the expense of performance. Eg on Cortex-M4 it reduces the size of
+ * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about
+ * 30%.
+ *
+ * Uncomment to enable the smaller implementation of SHA256.
+ */
+//#define MBEDTLS_SHA256_SMALLER
+
+/**
+ * \def MBEDTLS_SHA512_SMALLER
+ *
+ * Enable an implementation of SHA-512 that has lower ROM footprint but also
+ * lower performance.
+ *
+ * Uncomment to enable the smaller implementation of SHA512.
+ */
+//#define MBEDTLS_SHA512_SMALLER
+
+/**
+ * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES
+ *
+ * Enable sending of alert messages in case of encountered errors as per RFC.
+ * If you choose not to send the alert messages, Mbed TLS can still communicate
+ * with other servers, only debugging of failures is harder.
+ *
+ * The advantage of not sending alert messages, is that no information is given
+ * about reasons for failures thus preventing adversaries of gaining intel.
+ *
+ * Enable sending of all alert messages
+ */
+#define MBEDTLS_SSL_ALL_ALERT_MESSAGES
+
+/**
+ * \def MBEDTLS_SSL_DTLS_CONNECTION_ID
+ *
+ * Enable support for the DTLS Connection ID (CID) extension,
+ * which allows to identify DTLS connections across changes
+ * in the underlying transport. The CID functionality is described
+ * in RFC 9146.
+ *
+ * Setting this option enables the SSL APIs `mbedtls_ssl_set_cid()`,
+ * mbedtls_ssl_get_own_cid()`, `mbedtls_ssl_get_peer_cid()` and
+ * `mbedtls_ssl_conf_cid()`. See the corresponding documentation for
+ * more information.
+ *
+ * The maximum lengths of outgoing and incoming CIDs can be configured
+ * through the options
+ * - MBEDTLS_SSL_CID_OUT_LEN_MAX
+ * - MBEDTLS_SSL_CID_IN_LEN_MAX.
+ *
+ * Requires: MBEDTLS_SSL_PROTO_DTLS
+ *
+ * Uncomment to enable the Connection ID extension.
+ */
+#define MBEDTLS_SSL_DTLS_CONNECTION_ID
+
+/**
+ * \def MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT
+ *
+ * Defines whether RFC 9146 (default) or the legacy version
+ * (version draft-ietf-tls-dtls-connection-id-05,
+ * https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05)
+ * is used.
+ *
+ * Set the value to 0 for the standard version, and
+ * 1 for the legacy draft version.
+ *
+ * \deprecated Support for the legacy version of the DTLS
+ * Connection ID feature is deprecated. Please
+ * switch to the standardized version defined
+ * in RFC 9146 enabled by utilizing
+ * MBEDTLS_SSL_DTLS_CONNECTION_ID without use
+ * of MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT.
+ *
+ * Requires: MBEDTLS_SSL_DTLS_CONNECTION_ID
+ */
+#define MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT 0
+
+/**
+ * \def MBEDTLS_SSL_ASYNC_PRIVATE
+ *
+ * Enable asynchronous external private key operations in SSL. This allows
+ * you to configure an SSL connection to call an external cryptographic
+ * module to perform private key operations instead of performing the
+ * operation inside the library.
+ *
+ * Requires: MBEDTLS_X509_CRT_PARSE_C
+ */
+//#define MBEDTLS_SSL_ASYNC_PRIVATE
+
+/**
+ * \def MBEDTLS_SSL_CONTEXT_SERIALIZATION
+ *
+ * Enable serialization of the TLS context structures, through use of the
+ * functions mbedtls_ssl_context_save() and mbedtls_ssl_context_load().
+ *
+ * This pair of functions allows one side of a connection to serialize the
+ * context associated with the connection, then free or re-use that context
+ * while the serialized state is persisted elsewhere, and finally deserialize
+ * that state to a live context for resuming read/write operations on the
+ * connection. From a protocol perspective, the state of the connection is
+ * unaffected, in particular this is entirely transparent to the peer.
+ *
+ * Note: this is distinct from TLS session resumption, which is part of the
+ * protocol and fully visible by the peer. TLS session resumption enables
+ * establishing new connections associated to a saved session with shorter,
+ * lighter handshakes, while context serialization is a local optimization in
+ * handling a single, potentially long-lived connection.
+ *
+ * Enabling these APIs makes some SSL structures larger, as 64 extra bytes are
+ * saved after the handshake to allow for more efficient serialization, so if
+ * you don't need this feature you'll save RAM by disabling it.
+ *
+ * Requires: MBEDTLS_GCM_C or MBEDTLS_CCM_C or MBEDTLS_CHACHAPOLY_C
+ *
+ * Comment to disable the context serialization APIs.
+ */
+#define MBEDTLS_SSL_CONTEXT_SERIALIZATION
+
+/**
+ * \def MBEDTLS_SSL_DEBUG_ALL
+ *
+ * Enable the debug messages in SSL module for all issues.
+ * Debug messages have been disabled in some places to prevent timing
+ * attacks due to (unbalanced) debugging function calls.
+ *
+ * If you need all error reporting you should enable this during debugging,
+ * but remove this for production servers that should log as well.
+ *
+ * Uncomment this macro to report all debug messages on errors introducing
+ * a timing side-channel.
+ *
+ */
+//#define MBEDTLS_SSL_DEBUG_ALL
+
+/** \def MBEDTLS_SSL_ENCRYPT_THEN_MAC
+ *
+ * Enable support for Encrypt-then-MAC, RFC 7366.
+ *
+ * This allows peers that both support it to use a more robust protection for
+ * ciphersuites using CBC, providing deep resistance against timing attacks
+ * on the padding or underlying cipher.
+ *
+ * This only affects CBC ciphersuites, and is useless if none is defined.
+ *
+ * Requires: MBEDTLS_SSL_PROTO_TLS1_2
+ *
+ * Comment this macro to disable support for Encrypt-then-MAC
+ */
+#define MBEDTLS_SSL_ENCRYPT_THEN_MAC
+
+/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET
+ *
+ * Enable support for RFC 7627: Session Hash and Extended Master Secret
+ * Extension.
+ *
+ * This was introduced as "the proper fix" to the Triple Handshake family of
+ * attacks, but it is recommended to always use it (even if you disable
+ * renegotiation), since it actually fixes a more fundamental issue in the
+ * original SSL/TLS design, and has implications beyond Triple Handshake.
+ *
+ * Requires: MBEDTLS_SSL_PROTO_TLS1_2
+ *
+ * Comment this macro to disable support for Extended Master Secret.
+ */
+#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET
+
+/**
+ * \def MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
+ *
+ * This option controls the availability of the API mbedtls_ssl_get_peer_cert()
+ * giving access to the peer's certificate after completion of the handshake.
+ *
+ * Unless you need mbedtls_ssl_peer_cert() in your application, it is
+ * recommended to disable this option for reduced RAM usage.
+ *
+ * \note If this option is disabled, mbedtls_ssl_get_peer_cert() is still
+ * defined, but always returns \c NULL.
+ *
+ * \note This option has no influence on the protection against the
+ * triple handshake attack. Even if it is disabled, Mbed TLS will
+ * still ensure that certificates do not change during renegotiation,
+ * for example by keeping a hash of the peer's certificate.
+ *
+ * \note This option is required if MBEDTLS_SSL_PROTO_TLS1_3 is set.
+ *
+ * Comment this macro to disable storing the peer's certificate
+ * after the handshake.
+ */
+#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
+
+/**
+ * \def MBEDTLS_SSL_RENEGOTIATION
+ *
+ * Enable support for TLS renegotiation.
+ *
+ * The two main uses of renegotiation are (1) refresh keys on long-lived
+ * connections and (2) client authentication after the initial handshake.
+ * If you don't need renegotiation, it's probably better to disable it, since
+ * it has been associated with security issues in the past and is easy to
+ * misuse/misunderstand.
+ *
+ * Requires: MBEDTLS_SSL_PROTO_TLS1_2
+ *
+ * Comment this to disable support for renegotiation.
+ *
+ * \note Even if this option is disabled, both client and server are aware
+ * of the Renegotiation Indication Extension (RFC 5746) used to
+ * prevent the SSL renegotiation attack (see RFC 5746 Sect. 1).
+ * (See \c mbedtls_ssl_conf_legacy_renegotiation for the
+ * configuration of this extension).
+ *
+ */
+#define MBEDTLS_SSL_RENEGOTIATION
+
+/**
+ * \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+ *
+ * Enable support for RFC 6066 max_fragment_length extension in SSL.
+ *
+ * Comment this macro to disable support for the max_fragment_length extension
+ */
+#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+
+/**
+ * \def MBEDTLS_SSL_RECORD_SIZE_LIMIT
+ *
+ * Enable support for RFC 8449 record_size_limit extension in SSL (TLS 1.3 only).
+ *
+ * \warning This extension is currently in development and must NOT be used except
+ * for testing purposes.
+ *
+ * Requires: MBEDTLS_SSL_PROTO_TLS1_3
+ *
+ * Uncomment this macro to enable support for the record_size_limit extension
+ */
+//#define MBEDTLS_SSL_RECORD_SIZE_LIMIT
+
+/**
+ * \def MBEDTLS_SSL_PROTO_TLS1_2
+ *
+ * Enable support for TLS 1.2 (and DTLS 1.2 if DTLS is enabled).
+ *
+ * Requires: Without MBEDTLS_USE_PSA_CRYPTO: MBEDTLS_MD_C and
+ * (MBEDTLS_SHA256_C or MBEDTLS_SHA384_C or
+ * SHA-256 or SHA-512 provided by a PSA driver)
+ * With MBEDTLS_USE_PSA_CRYPTO:
+ * PSA_WANT_ALG_SHA_256 or PSA_WANT_ALG_SHA_384
+ *
+ * \warning If building with MBEDTLS_USE_PSA_CRYPTO, or if the hash(es) used
+ * are only provided by PSA drivers, you must call psa_crypto_init() before
+ * doing any TLS operations.
+ *
+ * Comment this macro to disable support for TLS 1.2 / DTLS 1.2
+ */
+#define MBEDTLS_SSL_PROTO_TLS1_2
+
+/**
+ * \def MBEDTLS_SSL_PROTO_TLS1_3
+ *
+ * Enable support for TLS 1.3.
+ *
+ * \note See docs/architecture/tls13-support.md for a description of the TLS
+ * 1.3 support that this option enables.
+ *
+ * Requires: MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
+ * Requires: MBEDTLS_PSA_CRYPTO_C
+ *
+ * \note TLS 1.3 uses PSA crypto for cryptographic operations that are
+ * directly performed by TLS 1.3 code. As a consequence, you must
+ * call psa_crypto_init() before the first TLS 1.3 handshake.
+ *
+ * \note Cryptographic operations performed indirectly via another module
+ * (X.509, PK) or by code shared with TLS 1.2 (record protection,
+ * running handshake hash) only use PSA crypto if
+ * #MBEDTLS_USE_PSA_CRYPTO is enabled.
+ *
+ * Uncomment this macro to enable the support for TLS 1.3.
+ */
+//#define MBEDTLS_SSL_PROTO_TLS1_3
+
+/**
+ * \def MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+ *
+ * Enable TLS 1.3 middlebox compatibility mode.
+ *
+ * As specified in Section D.4 of RFC 8446, TLS 1.3 offers a compatibility
+ * mode to make a TLS 1.3 connection more likely to pass through middle boxes
+ * expecting TLS 1.2 traffic.
+ *
+ * Turning on the compatibility mode comes at the cost of a few added bytes
+ * on the wire, but it doesn't affect compatibility with TLS 1.3 implementations
+ * that don't use it. Therefore, unless transmission bandwidth is critical and
+ * you know that middlebox compatibility issues won't occur, it is therefore
+ * recommended to set this option.
+ *
+ * Comment to disable compatibility mode for TLS 1.3. If
+ * MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not have any
+ * effect on the build.
+ *
+ */
+//#define MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
+
+/**
+ * \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
+ *
+ * Enable TLS 1.3 PSK key exchange mode.
+ *
+ * Comment to disable support for the PSK key exchange mode in TLS 1.3. If
+ * MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not have any
+ * effect on the build.
+ *
+ */
+#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
+
+/**
+ * \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
+ *
+ * Enable TLS 1.3 ephemeral key exchange mode.
+ *
+ * Requires: PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH
+ * MBEDTLS_X509_CRT_PARSE_C
+ * and at least one of:
+ * MBEDTLS_ECDSA_C or (MBEDTLS_USE_PSA_CRYPTO and PSA_WANT_ALG_ECDSA)
+ * MBEDTLS_PKCS1_V21
+ *
+ * Comment to disable support for the ephemeral key exchange mode in TLS 1.3.
+ * If MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not have any
+ * effect on the build.
+ *
+ */
+#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
+
+/**
+ * \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
+ *
+ * Enable TLS 1.3 PSK ephemeral key exchange mode.
+ *
+ * Requires: PSA_WANT_ALG_ECDH or PSA_WANT_ALG_FFDH
+ *
+ * Comment to disable support for the PSK ephemeral key exchange mode in
+ * TLS 1.3. If MBEDTLS_SSL_PROTO_TLS1_3 is not enabled, this option does not
+ * have any effect on the build.
+ *
+ */
+#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
+
+/**
+ * \def MBEDTLS_SSL_EARLY_DATA
+ *
+ * Enable support for RFC 8446 TLS 1.3 early data.
+ *
+ * Requires: MBEDTLS_SSL_SESSION_TICKETS and either
+ * MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED or
+ * MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
+ *
+ * Comment this to disable support for early data. If MBEDTLS_SSL_PROTO_TLS1_3
+ * is not enabled, this option does not have any effect on the build.
+ *
+ * This feature is experimental, not completed and thus not ready for
+ * production.
+ *
+ * \note The maximum amount of early data can be set with
+ * MBEDTLS_SSL_MAX_EARLY_DATA_SIZE.
+ *
+ */
+//#define MBEDTLS_SSL_EARLY_DATA
+
+/**
+ * \def MBEDTLS_SSL_PROTO_DTLS
+ *
+ * Enable support for DTLS (all available versions).
+ *
+ * Enable this and MBEDTLS_SSL_PROTO_TLS1_2 to enable DTLS 1.2.
+ *
+ * Requires: MBEDTLS_SSL_PROTO_TLS1_2
+ *
+ * Comment this macro to disable support for DTLS
+ */
+#define MBEDTLS_SSL_PROTO_DTLS
+
+/**
+ * \def MBEDTLS_SSL_ALPN
+ *
+ * Enable support for RFC 7301 Application Layer Protocol Negotiation.
+ *
+ * Comment this macro to disable support for ALPN.
+ */
+#define MBEDTLS_SSL_ALPN
+
+/**
+ * \def MBEDTLS_SSL_DTLS_ANTI_REPLAY
+ *
+ * Enable support for the anti-replay mechanism in DTLS.
+ *
+ * Requires: MBEDTLS_SSL_TLS_C
+ * MBEDTLS_SSL_PROTO_DTLS
+ *
+ * \warning Disabling this is often a security risk!
+ * See mbedtls_ssl_conf_dtls_anti_replay() for details.
+ *
+ * Comment this to disable anti-replay in DTLS.
+ */
+#define MBEDTLS_SSL_DTLS_ANTI_REPLAY
+
+/**
+ * \def MBEDTLS_SSL_DTLS_HELLO_VERIFY
+ *
+ * Enable support for HelloVerifyRequest on DTLS servers.
+ *
+ * This feature is highly recommended to prevent DTLS servers being used as
+ * amplifiers in DoS attacks against other hosts. It should always be enabled
+ * unless you know for sure amplification cannot be a problem in the
+ * environment in which your server operates.
+ *
+ * \warning Disabling this can be a security risk! (see above)
+ *
+ * Requires: MBEDTLS_SSL_PROTO_DTLS
+ *
+ * Comment this to disable support for HelloVerifyRequest.
+ */
+#define MBEDTLS_SSL_DTLS_HELLO_VERIFY
+
+/**
+ * \def MBEDTLS_SSL_DTLS_SRTP
+ *
+ * Enable support for negotiation of DTLS-SRTP (RFC 5764)
+ * through the use_srtp extension.
+ *
+ * \note This feature provides the minimum functionality required
+ * to negotiate the use of DTLS-SRTP and to allow the derivation of
+ * the associated SRTP packet protection key material.
+ * In particular, the SRTP packet protection itself, as well as the
+ * demultiplexing of RTP and DTLS packets at the datagram layer
+ * (see Section 5 of RFC 5764), are not handled by this feature.
+ * Instead, after successful completion of a handshake negotiating
+ * the use of DTLS-SRTP, the extended key exporter API
+ * mbedtls_ssl_conf_export_keys_cb() should be used to implement
+ * the key exporter described in Section 4.2 of RFC 5764 and RFC 5705
+ * (this is implemented in the SSL example programs).
+ * The resulting key should then be passed to an SRTP stack.
+ *
+ * Setting this option enables the runtime API
+ * mbedtls_ssl_conf_dtls_srtp_protection_profiles()
+ * through which the supported DTLS-SRTP protection
+ * profiles can be configured. You must call this API at
+ * runtime if you wish to negotiate the use of DTLS-SRTP.
+ *
+ * Requires: MBEDTLS_SSL_PROTO_DTLS
+ *
+ * Uncomment this to enable support for use_srtp extension.
+ */
+//#define MBEDTLS_SSL_DTLS_SRTP
+
+/**
+ * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
+ *
+ * Enable server-side support for clients that reconnect from the same port.
+ *
+ * Some clients unexpectedly close the connection and try to reconnect using the
+ * same source port. This needs special support from the server to handle the
+ * new connection securely, as described in section 4.2.8 of RFC 6347. This
+ * flag enables that support.
+ *
+ * Requires: MBEDTLS_SSL_DTLS_HELLO_VERIFY
+ *
+ * Comment this to disable support for clients reusing the source port.
+ */
+#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
+
+/**
+ * \def MBEDTLS_SSL_SESSION_TICKETS
+ *
+ * Enable support for RFC 5077 session tickets in SSL.
+ * Client-side, provides full support for session tickets (maintenance of a
+ * session store remains the responsibility of the application, though).
+ * Server-side, you also need to provide callbacks for writing and parsing
+ * tickets, including authenticated encryption and key management. Example
+ * callbacks are provided by MBEDTLS_SSL_TICKET_C.
+ *
+ * Comment this macro to disable support for SSL session tickets
+ */
+#define MBEDTLS_SSL_SESSION_TICKETS
+
+/**
+ * \def MBEDTLS_SSL_SERVER_NAME_INDICATION
+ *
+ * Enable support for RFC 6066 server name indication (SNI) in SSL.
+ *
+ * Requires: MBEDTLS_X509_CRT_PARSE_C
+ *
+ * Comment this macro to disable support for server name indication in SSL
+ */
+#define MBEDTLS_SSL_SERVER_NAME_INDICATION
+
+/**
+ * \def MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
+ *
+ * When this option is enabled, the SSL buffer will be resized automatically
+ * based on the negotiated maximum fragment length in each direction.
+ *
+ * Requires: MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+ */
+//#define MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
+
+/**
+ * \def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN
+ *
+ * Enable testing of the constant-flow nature of some sensitive functions with
+ * clang's MemorySanitizer. This causes some existing tests to also test
+ * this non-functional property of the code under test.
+ *
+ * This setting requires compiling with clang -fsanitize=memory. The test
+ * suites can then be run normally.
+ *
+ * \warning This macro is only used for extended testing; it is not considered
+ * part of the library's API, so it may change or disappear at any time.
+ *
+ * Uncomment to enable testing of the constant-flow nature of selected code.
+ */
+//#define MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN
+
+/**
+ * \def MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND
+ *
+ * Enable testing of the constant-flow nature of some sensitive functions with
+ * valgrind's memcheck tool. This causes some existing tests to also test
+ * this non-functional property of the code under test.
+ *
+ * This setting requires valgrind headers for building, and is only useful for
+ * testing if the tests suites are run with valgrind's memcheck. This can be
+ * done for an individual test suite with 'valgrind ./test_suite_xxx', or when
+ * using CMake, this can be done for all test suites with 'make memcheck'.
+ *
+ * \warning This macro is only used for extended testing; it is not considered
+ * part of the library's API, so it may change or disappear at any time.
+ *
+ * Uncomment to enable testing of the constant-flow nature of selected code.
+ */
+//#define MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND
+
+/**
+ * \def MBEDTLS_TEST_HOOKS
+ *
+ * Enable features for invasive testing such as introspection functions and
+ * hooks for fault injection. This enables additional unit tests.
+ *
+ * Merely enabling this feature should not change the behavior of the product.
+ * It only adds new code, and new branching points where the default behavior
+ * is the same as when this feature is disabled.
+ * However, this feature increases the attack surface: there is an added
+ * risk of vulnerabilities, and more gadgets that can make exploits easier.
+ * Therefore this feature must never be enabled in production.
+ *
+ * See `docs/architecture/testing/mbed-crypto-invasive-testing.md` for more
+ * information.
+ *
+ * Uncomment to enable invasive tests.
+ */
+//#define MBEDTLS_TEST_HOOKS
+
+/**
+ * \def MBEDTLS_THREADING_ALT
+ *
+ * Provide your own alternate threading implementation.
+ *
+ * Requires: MBEDTLS_THREADING_C
+ *
+ * Uncomment this to allow your own alternate threading implementation.
+ */
+//#define MBEDTLS_THREADING_ALT
+
+/**
+ * \def MBEDTLS_THREADING_PTHREAD
+ *
+ * Enable the pthread wrapper layer for the threading layer.
+ *
+ * Requires: MBEDTLS_THREADING_C
+ *
+ * Uncomment this to enable pthread mutexes.
+ */
+//#define MBEDTLS_THREADING_PTHREAD
+
+/**
+ * \def MBEDTLS_USE_PSA_CRYPTO
+ *
+ * Make the X.509 and TLS libraries use PSA for cryptographic operations as
+ * much as possible, and enable new APIs for using keys handled by PSA Crypto.
+ *
+ * \note Development of this option is currently in progress, and parts of Mbed
+ * TLS's X.509 and TLS modules are not ported to PSA yet. However, these parts
+ * will still continue to work as usual, so enabling this option should not
+ * break backwards compatibility.
+ *
+ * \warning If you enable this option, you need to call `psa_crypto_init()`
+ * before calling any function from the SSL/TLS, X.509 or PK modules, except
+ * for the various mbedtls_xxx_init() functions which can be called at any time.
+ *
+ * \note An important and desirable effect of this option is that it allows
+ * PK, X.509 and TLS to take advantage of PSA drivers. For example, enabling
+ * this option is what allows use of drivers for ECDSA, ECDH and EC J-PAKE in
+ * those modules. However, note that even with this option disabled, some code
+ * in PK, X.509, TLS or the crypto library might still use PSA drivers, if it
+ * can determine it's safe to do so; currently that's the case for hashes.
+ *
+ * \note See docs/use-psa-crypto.md for a complete description this option.
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_C.
+ *
+ * Uncomment this to enable internal use of PSA Crypto and new associated APIs.
+ */
+//#define MBEDTLS_USE_PSA_CRYPTO
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_CONFIG
+ *
+ * This setting allows support for cryptographic mechanisms through the PSA
+ * API to be configured separately from support through the mbedtls API.
+ *
+ * When this option is disabled, the PSA API exposes the cryptographic
+ * mechanisms that can be implemented on top of the `mbedtls_xxx` API
+ * configured with `MBEDTLS_XXX` symbols.
+ *
+ * When this option is enabled, the PSA API exposes the cryptographic
+ * mechanisms requested by the `PSA_WANT_XXX` symbols defined in
+ * include/psa/crypto_config.h. The corresponding `MBEDTLS_XXX` settings are
+ * automatically enabled if required (i.e. if no PSA driver provides the
+ * mechanism). You may still freely enable additional `MBEDTLS_XXX` symbols
+ * in mbedtls_config.h.
+ *
+ * If the symbol #MBEDTLS_PSA_CRYPTO_CONFIG_FILE is defined, it specifies
+ * an alternative header to include instead of include/psa/crypto_config.h.
+ *
+ * \warning This option is experimental, in that the set of `PSA_WANT_XXX`
+ * symbols is not completely finalized yet, and the configuration
+ * tooling is not ideally adapted to having two separate configuration
+ * files.
+ * Future minor releases of Mbed TLS may make minor changes to those
+ * symbols, but we will endeavor to provide a transition path.
+ * Nonetheless, this option is considered mature enough to use in
+ * production, as long as you accept that you may need to make
+ * minor changes to psa/crypto_config.h when upgrading Mbed TLS.
+ */
+//#define MBEDTLS_PSA_CRYPTO_CONFIG
+
+/**
+ * \def MBEDTLS_VERSION_FEATURES
+ *
+ * Allow run-time checking of compile-time enabled features. Thus allowing users
+ * to check at run-time if the library is for instance compiled with threading
+ * support via mbedtls_version_check_feature().
+ *
+ * Requires: MBEDTLS_VERSION_C
+ *
+ * Comment this to disable run-time checking and save ROM space
+ */
+#define MBEDTLS_VERSION_FEATURES
+
+/**
+ * \def MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
+ *
+ * If set, this enables the X.509 API `mbedtls_x509_crt_verify_with_ca_cb()`
+ * and the SSL API `mbedtls_ssl_conf_ca_cb()` which allow users to configure
+ * the set of trusted certificates through a callback instead of a linked
+ * list.
+ *
+ * This is useful for example in environments where a large number of trusted
+ * certificates is present and storing them in a linked list isn't efficient
+ * enough, or when the set of trusted certificates changes frequently.
+ *
+ * See the documentation of `mbedtls_x509_crt_verify_with_ca_cb()` and
+ * `mbedtls_ssl_conf_ca_cb()` for more information.
+ *
+ * Requires: MBEDTLS_X509_CRT_PARSE_C
+ *
+ * Uncomment to enable trusted certificate callbacks.
+ */
+//#define MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
+
+/**
+ * \def MBEDTLS_X509_REMOVE_INFO
+ *
+ * Disable mbedtls_x509_*_info() and related APIs.
+ *
+ * Uncomment to omit mbedtls_x509_*_info(), as well as mbedtls_debug_print_crt()
+ * and other functions/constants only used by these functions, thus reducing
+ * the code footprint by several KB.
+ */
+//#define MBEDTLS_X509_REMOVE_INFO
+
+/**
+ * \def MBEDTLS_X509_RSASSA_PSS_SUPPORT
+ *
+ * Enable parsing and verification of X.509 certificates, CRLs and CSRS
+ * signed with RSASSA-PSS (aka PKCS#1 v2.1).
+ *
+ * Comment this macro to disallow using RSASSA-PSS in certificates.
+ */
+#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
+/** \} name SECTION: Mbed TLS feature support */
+
+/**
+ * \name SECTION: Mbed TLS modules
+ *
+ * This section enables or disables entire modules in Mbed TLS
+ * \{
+ */
+
+/**
+ * \def MBEDTLS_AESNI_C
+ *
+ * Enable AES-NI support on x86-64 or x86-32.
+ *
+ * \note AESNI is only supported with certain compilers and target options:
+ * - Visual Studio 2013: supported.
+ * - GCC, x86-64, target not explicitly supporting AESNI:
+ * requires MBEDTLS_HAVE_ASM.
+ * - GCC, x86-32, target not explicitly supporting AESNI:
+ * not supported.
+ * - GCC, x86-64 or x86-32, target supporting AESNI: supported.
+ * For this assembly-less implementation, you must currently compile
+ * `library/aesni.c` and `library/aes.c` with machine options to enable
+ * SSE2 and AESNI instructions: `gcc -msse2 -maes -mpclmul` or
+ * `clang -maes -mpclmul`.
+ * - Non-x86 targets: this option is silently ignored.
+ * - Other compilers: this option is silently ignored.
+ *
+ * \note
+ * Above, "GCC" includes compatible compilers such as Clang.
+ * The limitations on target support are likely to be relaxed in the future.
+ *
+ * Module: library/aesni.c
+ * Caller: library/aes.c
+ *
+ * Requires: MBEDTLS_HAVE_ASM (on some platforms, see note)
+ *
+ * This modules adds support for the AES-NI instructions on x86.
+ */
+#define MBEDTLS_AESNI_C
+
+/**
+ * \def MBEDTLS_AESCE_C
+ *
+ * Enable AES cryptographic extension support on 64-bit Arm.
+ *
+ * Module: library/aesce.c
+ * Caller: library/aes.c
+ *
+ * Requires: MBEDTLS_AES_C
+ *
+ * \warning Runtime detection only works on Linux. For non-Linux operating
+ * system, Armv8-A Cryptographic Extensions must be supported by
+ * the CPU when this option is enabled.
+ *
+ * \note Minimum compiler versions for this feature are Clang 4.0,
+ * armclang 6.6, GCC 6.0 or MSVC 2019 version 16.11.2.
+ *
+ * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for
+ * armclang <= 6.9
+ *
+ * This module adds support for the AES Armv8-A Cryptographic Extensions on Aarch64 systems.
+ */
+//#define MBEDTLS_AESCE_C
+
+/**
+ * \def MBEDTLS_AES_C
+ *
+ * Enable the AES block cipher.
+ *
+ * Module: library/aes.c
+ * Caller: library/cipher.c
+ * library/pem.c
+ * library/ctr_drbg.c
+ *
+ * This module enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_DHE_PSK_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_RSA_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_RSA_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_AES_128_CBC_SHA
+ * MBEDTLS_TLS_PSK_WITH_AES_256_GCM_SHA384
+ * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA384
+ * MBEDTLS_TLS_PSK_WITH_AES_256_CBC_SHA
+ * MBEDTLS_TLS_PSK_WITH_AES_128_GCM_SHA256
+ * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA256
+ * MBEDTLS_TLS_PSK_WITH_AES_128_CBC_SHA
+ *
+ * PEM_PARSE uses AES for decrypting encrypted keys.
+ */
+#define MBEDTLS_AES_C
+
+/**
+ * \def MBEDTLS_ASN1_PARSE_C
+ *
+ * Enable the generic ASN1 parser.
+ *
+ * Module: library/asn1.c
+ * Caller: library/x509.c
+ * library/dhm.c
+ * library/pkcs12.c
+ * library/pkcs5.c
+ * library/pkparse.c
+ */
+#define MBEDTLS_ASN1_PARSE_C
+
+/**
+ * \def MBEDTLS_ASN1_WRITE_C
+ *
+ * Enable the generic ASN1 writer.
+ *
+ * Module: library/asn1write.c
+ * Caller: library/ecdsa.c
+ * library/pkwrite.c
+ * library/x509_create.c
+ * library/x509write_crt.c
+ * library/x509write_csr.c
+ */
+#define MBEDTLS_ASN1_WRITE_C
+
+/**
+ * \def MBEDTLS_BASE64_C
+ *
+ * Enable the Base64 module.
+ *
+ * Module: library/base64.c
+ * Caller: library/pem.c
+ *
+ * This module is required for PEM support (required by X.509).
+ */
+#define MBEDTLS_BASE64_C
+
+/**
+ * \def MBEDTLS_BIGNUM_C
+ *
+ * Enable the multi-precision integer library.
+ *
+ * Module: library/bignum.c
+ * library/bignum_core.c
+ * library/bignum_mod.c
+ * library/bignum_mod_raw.c
+ * Caller: library/dhm.c
+ * library/ecp.c
+ * library/ecdsa.c
+ * library/rsa.c
+ * library/rsa_alt_helpers.c
+ * library/ssl_tls.c
+ *
+ * This module is required for RSA, DHM and ECC (ECDH, ECDSA) support.
+ */
+#define MBEDTLS_BIGNUM_C
+
+/**
+ * \def MBEDTLS_CAMELLIA_C
+ *
+ * Enable the Camellia block cipher.
+ *
+ * Module: library/camellia.c
+ * Caller: library/cipher.c
+ *
+ * This module enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
+ * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
+ * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
+ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384
+ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384
+ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
+ * MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
+ */
+#define MBEDTLS_CAMELLIA_C
+
+/**
+ * \def MBEDTLS_ARIA_C
+ *
+ * Enable the ARIA block cipher.
+ *
+ * Module: library/aria.c
+ * Caller: library/cipher.c
+ *
+ * This module enables the following ciphersuites (if other requisites are
+ * enabled as well):
+ *
+ * MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384
+ * MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256
+ * MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256
+ * MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384
+ */
+#define MBEDTLS_ARIA_C
+
+/**
+ * \def MBEDTLS_CCM_C
+ *
+ * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher.
+ *
+ * Module: library/ccm.c
+ *
+ * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or
+ * MBEDTLS_ARIA_C
+ *
+ * This module enables the AES-CCM ciphersuites, if other requisites are
+ * enabled as well.
+ */
+#define MBEDTLS_CCM_C
+
+/**
+ * \def MBEDTLS_CHACHA20_C
+ *
+ * Enable the ChaCha20 stream cipher.
+ *
+ * Module: library/chacha20.c
+ */
+#define MBEDTLS_CHACHA20_C
+
+/**
+ * \def MBEDTLS_CHACHAPOLY_C
+ *
+ * Enable the ChaCha20-Poly1305 AEAD algorithm.
+ *
+ * Module: library/chachapoly.c
+ *
+ * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C
+ */
+#define MBEDTLS_CHACHAPOLY_C
+
+/**
+ * \def MBEDTLS_CIPHER_C
+ *
+ * Enable the generic cipher layer.
+ *
+ * Module: library/cipher.c
+ * Caller: library/ccm.c
+ * library/cmac.c
+ * library/gcm.c
+ * library/nist_kw.c
+ * library/pkcs12.c
+ * library/pkcs5.c
+ * library/psa_crypto_aead.c
+ * library/psa_crypto_mac.c
+ * library/ssl_ciphersuites.c
+ * library/ssl_msg.c
+ * library/ssl_ticket.c (unless MBEDTLS_USE_PSA_CRYPTO is enabled)
+ *
+ * Uncomment to enable generic cipher wrappers.
+ */
+#define MBEDTLS_CIPHER_C
+
+/**
+ * \def MBEDTLS_CMAC_C
+ *
+ * Enable the CMAC (Cipher-based Message Authentication Code) mode for block
+ * ciphers.
+ *
+ * \note When #MBEDTLS_CMAC_ALT is active, meaning that the underlying
+ * implementation of the CMAC algorithm is provided by an alternate
+ * implementation, that alternate implementation may opt to not support
+ * AES-192 or 3DES as underlying block ciphers for the CMAC operation.
+ *
+ * Module: library/cmac.c
+ *
+ * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_DES_C
+ *
+ */
+#define MBEDTLS_CMAC_C
+
+/**
+ * \def MBEDTLS_CTR_DRBG_C
+ *
+ * Enable the CTR_DRBG AES-based random generator.
+ * The CTR_DRBG generator uses AES-256 by default.
+ * To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above.
+ *
+ * \note AES-128 will be used if \c MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH is set.
+ *
+ * \note To achieve a 256-bit security strength with CTR_DRBG,
+ * you must use AES-256 *and* use sufficient entropy.
+ * See ctr_drbg.h for more details.
+ *
+ * Module: library/ctr_drbg.c
+ * Caller:
+ *
+ * Requires: MBEDTLS_AES_C
+ *
+ * This module provides the CTR_DRBG AES random number generator.
+ */
+#define MBEDTLS_CTR_DRBG_C
+
+/**
+ * \def MBEDTLS_DEBUG_C
+ *
+ * Enable the debug functions.
+ *
+ * Module: library/debug.c
+ * Caller: library/ssl_msg.c
+ * library/ssl_tls.c
+ * library/ssl_tls12_*.c
+ * library/ssl_tls13_*.c
+ *
+ * This module provides debugging functions.
+ */
+#define MBEDTLS_DEBUG_C
+
+/**
+ * \def MBEDTLS_DES_C
+ *
+ * Enable the DES block cipher.
+ *
+ * Module: library/des.c
+ * Caller: library/pem.c
+ * library/cipher.c
+ *
+ * PEM_PARSE uses DES/3DES for decrypting encrypted keys.
+ *
+ * \warning DES/3DES are considered weak ciphers and their use constitutes a
+ * security risk. We recommend considering stronger ciphers instead.
+ */
+#define MBEDTLS_DES_C
+
+/**
+ * \def MBEDTLS_DHM_C
+ *
+ * Enable the Diffie-Hellman-Merkle module.
+ *
+ * Module: library/dhm.c
+ * Caller: library/ssl_tls.c
+ * library/ssl*_client.c
+ * library/ssl*_server.c
+ *
+ * This module is used by the following key exchanges:
+ * DHE-RSA, DHE-PSK
+ *
+ * \warning Using DHE constitutes a security risk as it
+ * is not possible to validate custom DH parameters.
+ * If possible, it is recommended users should consider
+ * preferring other methods of key exchange.
+ * See dhm.h for more details.
+ *
+ */
+#define MBEDTLS_DHM_C
+
+/**
+ * \def MBEDTLS_ECDH_C
+ *
+ * Enable the elliptic curve Diffie-Hellman library.
+ *
+ * Module: library/ecdh.c
+ * Caller: library/psa_crypto.c
+ * library/ssl_tls.c
+ * library/ssl*_client.c
+ * library/ssl*_server.c
+ *
+ * This module is used by the following key exchanges:
+ * ECDHE-ECDSA, ECDHE-RSA, DHE-PSK
+ *
+ * Requires: MBEDTLS_ECP_C
+ */
+#define MBEDTLS_ECDH_C
+
+/**
+ * \def MBEDTLS_ECDSA_C
+ *
+ * Enable the elliptic curve DSA library.
+ *
+ * Module: library/ecdsa.c
+ * Caller:
+ *
+ * This module is used by the following key exchanges:
+ * ECDHE-ECDSA
+ *
+ * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C,
+ * and at least one MBEDTLS_ECP_DP_XXX_ENABLED for a
+ * short Weierstrass curve.
+ */
+#define MBEDTLS_ECDSA_C
+
+/**
+ * \def MBEDTLS_ECJPAKE_C
+ *
+ * Enable the elliptic curve J-PAKE library.
+ *
+ * \note EC J-PAKE support is based on the Thread v1.0.0 specification.
+ * It has not been reviewed for compliance with newer standards such as
+ * Thread v1.1 or RFC 8236.
+ *
+ * Module: library/ecjpake.c
+ * Caller:
+ *
+ * This module is used by the following key exchanges:
+ * ECJPAKE
+ *
+ * Requires: MBEDTLS_ECP_C and either MBEDTLS_MD_C or MBEDTLS_PSA_CRYPTO_C
+ *
+ * \warning If using a hash that is only provided by PSA drivers, you must
+ * call psa_crypto_init() before doing any EC J-PAKE operations.
+ */
+#define MBEDTLS_ECJPAKE_C
+
+/**
+ * \def MBEDTLS_ECP_C
+ *
+ * Enable the elliptic curve over GF(p) library.
+ *
+ * Module: library/ecp.c
+ * Caller: library/ecdh.c
+ * library/ecdsa.c
+ * library/ecjpake.c
+ *
+ * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED
+ */
+#define MBEDTLS_ECP_C
+
+/**
+ * \def MBEDTLS_ENTROPY_C
+ *
+ * Enable the platform-specific entropy code.
+ *
+ * Module: library/entropy.c
+ * Caller:
+ *
+ * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C
+ *
+ * This module provides a generic entropy pool
+ */
+//#define MBEDTLS_ENTROPY_C
+
+/**
+ * \def MBEDTLS_ERROR_C
+ *
+ * Enable error code to error string conversion.
+ *
+ * Module: library/error.c
+ * Caller:
+ *
+ * This module enables mbedtls_strerror().
+ */
+//#define MBEDTLS_ERROR_C
+
+/**
+ * \def MBEDTLS_GCM_C
+ *
+ * Enable the Galois/Counter Mode (GCM).
+ *
+ * Module: library/gcm.c
+ *
+ * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or
+ * MBEDTLS_ARIA_C
+ *
+ * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other
+ * requisites are enabled as well.
+ */
+#define MBEDTLS_GCM_C
+
+/**
+ * \def MBEDTLS_HKDF_C
+ *
+ * Enable the HKDF algorithm (RFC 5869).
+ *
+ * Module: library/hkdf.c
+ * Caller:
+ *
+ * Requires: MBEDTLS_MD_C
+ *
+ * This module adds support for the Hashed Message Authentication Code
+ * (HMAC)-based key derivation function (HKDF).
+ */
+#define MBEDTLS_HKDF_C
+
+/**
+ * \def MBEDTLS_HMAC_DRBG_C
+ *
+ * Enable the HMAC_DRBG random generator.
+ *
+ * Module: library/hmac_drbg.c
+ * Caller:
+ *
+ * Requires: MBEDTLS_MD_C
+ *
+ * Uncomment to enable the HMAC_DRBG random number generator.
+ */
+#define MBEDTLS_HMAC_DRBG_C
+
+/**
+ * \def MBEDTLS_LMS_C
+ *
+ * Enable the LMS stateful-hash asymmetric signature algorithm.
+ *
+ * Module: library/lms.c
+ * Caller:
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_C
+ *
+ * Uncomment to enable the LMS verification algorithm and public key operations.
+ */
+//#define MBEDTLS_LMS_C
+
+/**
+ * \def MBEDTLS_LMS_PRIVATE
+ *
+ * Enable LMS private-key operations and signing code. Functions enabled by this
+ * option are experimental, and should not be used in production.
+ *
+ * Requires: MBEDTLS_LMS_C
+ *
+ * Uncomment to enable the LMS signature algorithm and private key operations.
+ */
+//#define MBEDTLS_LMS_PRIVATE
+
+/**
+ * \def MBEDTLS_NIST_KW_C
+ *
+ * Enable the Key Wrapping mode for 128-bit block ciphers,
+ * as defined in NIST SP 800-38F. Only KW and KWP modes
+ * are supported. At the moment, only AES is approved by NIST.
+ *
+ * Module: library/nist_kw.c
+ *
+ * Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C
+ */
+#define MBEDTLS_NIST_KW_C
+
+/**
+ * \def MBEDTLS_MD_C
+ *
+ * Enable the generic layer for message digest (hashing) and HMAC.
+ *
+ * Requires: one of: MBEDTLS_MD5_C, MBEDTLS_RIPEMD160_C, MBEDTLS_SHA1_C,
+ * MBEDTLS_SHA224_C, MBEDTLS_SHA256_C, MBEDTLS_SHA384_C,
+ * MBEDTLS_SHA512_C, or MBEDTLS_PSA_CRYPTO_C with at least
+ * one hash.
+ * Module: library/md.c
+ * Caller: library/constant_time.c
+ * library/ecdsa.c
+ * library/ecjpake.c
+ * library/hkdf.c
+ * library/hmac_drbg.c
+ * library/pk.c
+ * library/pkcs5.c
+ * library/pkcs12.c
+ * library/psa_crypto_ecp.c
+ * library/psa_crypto_rsa.c
+ * library/rsa.c
+ * library/ssl_cookie.c
+ * library/ssl_msg.c
+ * library/ssl_tls.c
+ * library/x509.c
+ * library/x509_crt.c
+ * library/x509write_crt.c
+ * library/x509write_csr.c
+ *
+ * Uncomment to enable generic message digest wrappers.
+ */
+//#define MBEDTLS_MD_C
+
+/**
+ * \def MBEDTLS_MD5_C
+ *
+ * Enable the MD5 hash algorithm.
+ *
+ * Module: library/md5.c
+ * Caller: library/md.c
+ * library/pem.c
+ * library/ssl_tls.c
+ *
+ * This module is required for TLS 1.2 depending on the handshake parameters.
+ * Further, it is used for checking MD5-signed certificates, and for PBKDF1
+ * when decrypting PEM-encoded encrypted keys.
+ *
+ * \warning MD5 is considered a weak message digest and its use constitutes a
+ * security risk. If possible, we recommend avoiding dependencies on
+ * it, and considering stronger message digests instead.
+ *
+ */
+#if CONFIG_IS_ENABLED(MD5)
+#define MBEDTLS_MD5_C
+#endif
+
+/**
+ * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
+ *
+ * Enable the buffer allocator implementation that makes use of a (stack)
+ * based buffer to 'allocate' dynamic memory. (replaces calloc() and free()
+ * calls)
+ *
+ * Module: library/memory_buffer_alloc.c
+ *
+ * Requires: MBEDTLS_PLATFORM_C
+ * MBEDTLS_PLATFORM_MEMORY (to use it within Mbed TLS)
+ *
+ * Enable this module to enable the buffer memory allocator.
+ */
+//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C
+
+/**
+ * \def MBEDTLS_NET_C
+ *
+ * Enable the TCP and UDP over IPv6/IPv4 networking routines.
+ *
+ * \note This module only works on POSIX/Unix (including Linux, BSD and OS X)
+ * and Windows. For other platforms, you'll want to disable it, and write your
+ * own networking callbacks to be passed to \c mbedtls_ssl_set_bio().
+ *
+ * \note See also our Knowledge Base article about porting to a new
+ * environment:
+ * https://mbed-tls.readthedocs.io/en/latest/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS
+ *
+ * Module: library/net_sockets.c
+ *
+ * This module provides networking routines.
+ */
+//#define MBEDTLS_NET_C
+
+/**
+ * \def MBEDTLS_OID_C
+ *
+ * Enable the OID database.
+ *
+ * Module: library/oid.c
+ * Caller: library/asn1write.c
+ * library/pkcs5.c
+ * library/pkparse.c
+ * library/pkwrite.c
+ * library/rsa.c
+ * library/x509.c
+ * library/x509_create.c
+ * library/x509_crl.c
+ * library/x509_crt.c
+ * library/x509_csr.c
+ * library/x509write_crt.c
+ * library/x509write_csr.c
+ *
+ * This modules translates between OIDs and internal values.
+ */
+#define MBEDTLS_OID_C
+
+/**
+ * \def MBEDTLS_PADLOCK_C
+ *
+ * Enable VIA Padlock support on x86.
+ *
+ * Module: library/padlock.c
+ * Caller: library/aes.c
+ *
+ * Requires: MBEDTLS_HAVE_ASM
+ *
+ * This modules adds support for the VIA PadLock on x86.
+ */
+#define MBEDTLS_PADLOCK_C
+
+/**
+ * \def MBEDTLS_PEM_PARSE_C
+ *
+ * Enable PEM decoding / parsing.
+ *
+ * Module: library/pem.c
+ * Caller: library/dhm.c
+ * library/pkparse.c
+ * library/x509_crl.c
+ * library/x509_crt.c
+ * library/x509_csr.c
+ *
+ * Requires: MBEDTLS_BASE64_C
+ * optionally MBEDTLS_MD5_C, or PSA Crypto with MD5 (see below)
+ *
+ * \warning When parsing password-protected files, if MD5 is provided only by
+ * a PSA driver, you must call psa_crypto_init() before the first file.
+ *
+ * This modules adds support for decoding / parsing PEM files.
+ */
+#define MBEDTLS_PEM_PARSE_C
+
+/**
+ * \def MBEDTLS_PEM_WRITE_C
+ *
+ * Enable PEM encoding / writing.
+ *
+ * Module: library/pem.c
+ * Caller: library/pkwrite.c
+ * library/x509write_crt.c
+ * library/x509write_csr.c
+ *
+ * Requires: MBEDTLS_BASE64_C
+ *
+ * This modules adds support for encoding / writing PEM files.
+ */
+#define MBEDTLS_PEM_WRITE_C
+
+/**
+ * \def MBEDTLS_PK_C
+ *
+ * Enable the generic public (asymmetric) key layer.
+ *
+ * Module: library/pk.c
+ * Caller: library/psa_crypto_rsa.c
+ * library/ssl_tls.c
+ * library/ssl*_client.c
+ * library/ssl*_server.c
+ * library/x509.c
+ *
+ * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C or MBEDTLS_ECP_C
+ *
+ * Uncomment to enable generic public key wrappers.
+ */
+#define MBEDTLS_PK_C
+
+/**
+ * \def MBEDTLS_PK_PARSE_C
+ *
+ * Enable the generic public (asymmetric) key parser.
+ *
+ * Module: library/pkparse.c
+ * Caller: library/x509_crt.c
+ * library/x509_csr.c
+ *
+ * Requires: MBEDTLS_PK_C
+ *
+ * Uncomment to enable generic public key parse functions.
+ */
+#define MBEDTLS_PK_PARSE_C
+
+/**
+ * \def MBEDTLS_PK_WRITE_C
+ *
+ * Enable the generic public (asymmetric) key writer.
+ *
+ * Module: library/pkwrite.c
+ * Caller: library/x509write.c
+ *
+ * Requires: MBEDTLS_PK_C
+ *
+ * Uncomment to enable generic public key write functions.
+ */
+#define MBEDTLS_PK_WRITE_C
+
+/**
+ * \def MBEDTLS_PKCS5_C
+ *
+ * Enable PKCS#5 functions.
+ *
+ * Module: library/pkcs5.c
+ *
+ * Requires: MBEDTLS_CIPHER_C
+ * Auto-enables: MBEDTLS_MD_C
+ *
+ * \warning If using a hash that is only provided by PSA drivers, you must
+ * call psa_crypto_init() before doing any PKCS5 operations.
+ *
+ * This module adds support for the PKCS#5 functions.
+ */
+#define MBEDTLS_PKCS5_C
+
+/**
+ * \def MBEDTLS_PKCS7_C
+ *
+ * Enable PKCS #7 core for using PKCS #7-formatted signatures.
+ * RFC Link - https://tools.ietf.org/html/rfc2315
+ *
+ * Module: library/pkcs7.c
+ *
+ * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_OID_C, MBEDTLS_PK_PARSE_C,
+ * MBEDTLS_X509_CRT_PARSE_C MBEDTLS_X509_CRL_PARSE_C,
+ * MBEDTLS_BIGNUM_C, MBEDTLS_MD_C
+ *
+ * This module is required for the PKCS #7 parsing modules.
+ */
+#define MBEDTLS_PKCS7_C
+
+/**
+ * \def MBEDTLS_PKCS12_C
+ *
+ * Enable PKCS#12 PBE functions.
+ * Adds algorithms for parsing PKCS#8 encrypted private keys
+ *
+ * Module: library/pkcs12.c
+ * Caller: library/pkparse.c
+ *
+ * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_CIPHER_C and either
+ * MBEDTLS_MD_C or MBEDTLS_PSA_CRYPTO_C.
+ *
+ * \warning If using a hash that is only provided by PSA drivers, you must
+ * call psa_crypto_init() before doing any PKCS12 operations.
+ *
+ * This module enables PKCS#12 functions.
+ */
+#define MBEDTLS_PKCS12_C
+
+/**
+ * \def MBEDTLS_PLATFORM_C
+ *
+ * Enable the platform abstraction layer that allows you to re-assign
+ * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit().
+ *
+ * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT
+ * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned
+ * above to be specified at runtime or compile time respectively.
+ *
+ * \note This abstraction layer must be enabled on Windows (including MSYS2)
+ * as other modules rely on it for a fixed snprintf implementation.
+ *
+ * Module: library/platform.c
+ * Caller: Most other .c files
+ *
+ * This module enables abstraction of common (libc) functions.
+ */
+#define MBEDTLS_PLATFORM_C
+
+/**
+ * \def MBEDTLS_POLY1305_C
+ *
+ * Enable the Poly1305 MAC algorithm.
+ *
+ * Module: library/poly1305.c
+ * Caller: library/chachapoly.c
+ */
+#define MBEDTLS_POLY1305_C
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_C
+ *
+ * Enable the Platform Security Architecture cryptography API.
+ *
+ * Module: library/psa_crypto.c
+ *
+ * Requires: MBEDTLS_CIPHER_C,
+ * either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C,
+ * or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C,
+ * or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG.
+ *
+ */
+//#define MBEDTLS_PSA_CRYPTO_C
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_SE_C
+ *
+ * Enable dynamic secure element support in the Platform Security Architecture
+ * cryptography API.
+ *
+ * \deprecated This feature is deprecated. Please switch to the PSA driver
+ * interface.
+ *
+ * Module: library/psa_crypto_se.c
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_C
+ *
+ */
+//#define MBEDTLS_PSA_CRYPTO_SE_C
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_STORAGE_C
+ *
+ * Enable the Platform Security Architecture persistent key storage.
+ *
+ * Module: library/psa_crypto_storage.c
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_C,
+ * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of
+ * the PSA ITS interface
+ */
+//#define MBEDTLS_PSA_CRYPTO_STORAGE_C
+
+/**
+ * \def MBEDTLS_PSA_ITS_FILE_C
+ *
+ * Enable the emulation of the Platform Security Architecture
+ * Internal Trusted Storage (PSA ITS) over files.
+ *
+ * Module: library/psa_its_file.c
+ *
+ * Requires: MBEDTLS_FS_IO
+ */
+//#define MBEDTLS_PSA_ITS_FILE_C
+
+/**
+ * \def MBEDTLS_RIPEMD160_C
+ *
+ * Enable the RIPEMD-160 hash algorithm.
+ *
+ * Module: library/ripemd160.c
+ * Caller: library/md.c
+ *
+ */
+#define MBEDTLS_RIPEMD160_C
+
+/**
+ * \def MBEDTLS_RSA_C
+ *
+ * Enable the RSA public-key cryptosystem.
+ *
+ * Module: library/rsa.c
+ * library/rsa_alt_helpers.c
+ * Caller: library/pk.c
+ * library/psa_crypto.c
+ * library/ssl_tls.c
+ * library/ssl*_client.c
+ * library/ssl*_server.c
+ *
+ * This module is used by the following key exchanges:
+ * RSA, DHE-RSA, ECDHE-RSA, RSA-PSK
+ *
+ * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C
+ */
+#define MBEDTLS_RSA_C
+
+/**
+ * \def MBEDTLS_SHA1_C
+ *
+ * Enable the SHA1 cryptographic hash algorithm.
+ *
+ * Module: library/sha1.c
+ * Caller: library/md.c
+ * library/psa_crypto_hash.c
+ *
+ * This module is required for TLS 1.2 depending on the handshake parameters,
+ * and for SHA1-signed certificates.
+ *
+ * \warning SHA-1 is considered a weak message digest and its use constitutes
+ * a security risk. If possible, we recommend avoiding dependencies
+ * on it, and considering stronger message digests instead.
+ *
+ */
+#if CONFIG_IS_ENABLED(SHA1)
+#define MBEDTLS_SHA1_C
+#endif
+
+/**
+ * \def MBEDTLS_SHA224_C
+ *
+ * Enable the SHA-224 cryptographic hash algorithm.
+ *
+ * Module: library/sha256.c
+ * Caller: library/md.c
+ * library/ssl_cookie.c
+ *
+ * This module adds support for SHA-224.
+ */
+//#define MBEDTLS_SHA224_C
+
+/**
+ * \def MBEDTLS_SHA256_C
+ *
+ * Enable the SHA-256 cryptographic hash algorithm.
+ *
+ * Module: library/sha256.c
+ * Caller: library/entropy.c
+ * library/md.c
+ * library/ssl_tls.c
+ * library/ssl*_client.c
+ * library/ssl*_server.c
+ *
+ * This module adds support for SHA-256.
+ * This module is required for the SSL/TLS 1.2 PRF function.
+ */
+#if CONFIG_IS_ENABLED(SHA256)
+#define MBEDTLS_SHA256_C
+#endif
+
+/**
+ * \def MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
+ *
+ * Enable acceleration of the SHA-256 and SHA-224 cryptographic hash algorithms
+ * with the ARMv8 cryptographic extensions if they are available at runtime.
+ * If not, the library will fall back to the C implementation.
+ *
+ * \note If MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT is defined when building
+ * for a non-Aarch64 build it will be silently ignored.
+ *
+ * \note Minimum compiler versions for this feature are Clang 4.0,
+ * armclang 6.6 or GCC 6.0.
+ *
+ * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for
+ * armclang <= 6.9
+ *
+ * \warning MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT cannot be defined at the
+ * same time as MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY.
+ *
+ * Requires: MBEDTLS_SHA256_C.
+ *
+ * Module: library/sha256.c
+ *
+ * Uncomment to have the library check for the A64 SHA-256 crypto extensions
+ * and use them if available.
+ */
+//#define MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
+
+/**
+ * \def MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY
+ *
+ * Enable acceleration of the SHA-256 and SHA-224 cryptographic hash algorithms
+ * with the ARMv8 cryptographic extensions, which must be available at runtime
+ * or else an illegal instruction fault will occur.
+ *
+ * \note This allows builds with a smaller code size than with
+ * MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT
+ *
+ * \note Minimum compiler versions for this feature are Clang 4.0,
+ * armclang 6.6 or GCC 6.0.
+ *
+ * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for
+ * armclang <= 6.9
+ *
+ * \warning MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY cannot be defined at the same
+ * time as MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT.
+ *
+ * Requires: MBEDTLS_SHA256_C.
+ *
+ * Module: library/sha256.c
+ *
+ * Uncomment to have the library use the A64 SHA-256 crypto extensions
+ * unconditionally.
+ */
+//#define MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY
+
+/**
+ * \def MBEDTLS_SHA384_C
+ *
+ * Enable the SHA-384 cryptographic hash algorithm.
+ *
+ * Module: library/sha512.c
+ * Caller: library/md.c
+ * library/psa_crypto_hash.c
+ * library/ssl_tls.c
+ * library/ssl*_client.c
+ * library/ssl*_server.c
+ *
+ * Comment to disable SHA-384
+ */
+#if CONFIG_IS_ENABLED(SHA384)
+#define MBEDTLS_SHA384_C
+#endif
+
+/**
+ * \def MBEDTLS_SHA512_C
+ *
+ * Enable SHA-512 cryptographic hash algorithms.
+ *
+ * Module: library/sha512.c
+ * Caller: library/entropy.c
+ * library/md.c
+ * library/ssl_tls.c
+ * library/ssl_cookie.c
+ *
+ * This module adds support for SHA-512.
+ */
+#if CONFIG_IS_ENABLED(SHA512)
+#define MBEDTLS_SHA512_C
+#endif
+
+/**
+ * \def MBEDTLS_SHA3_C
+ *
+ * Enable the SHA3 cryptographic hash algorithm.
+ *
+ * Module: library/sha3.c
+ *
+ * This module adds support for SHA3.
+ */
+//#define MBEDTLS_SHA3_C
+
+/**
+ * \def MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
+ *
+ * Enable acceleration of the SHA-512 and SHA-384 cryptographic hash algorithms
+ * with the ARMv8 cryptographic extensions if they are available at runtime.
+ * If not, the library will fall back to the C implementation.
+ *
+ * \note If MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT is defined when building
+ * for a non-Aarch64 build it will be silently ignored.
+ *
+ * \note Minimum compiler versions for this feature are Clang 7.0,
+ * armclang 6.9 or GCC 8.0.
+ *
+ * \note \c CFLAGS must be set to a minimum of \c -march=armv8.2-a+sha3 for
+ * armclang 6.9
+ *
+ * \warning MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT cannot be defined at the
+ * same time as MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY.
+ *
+ * Requires: MBEDTLS_SHA512_C.
+ *
+ * Module: library/sha512.c
+ *
+ * Uncomment to have the library check for the A64 SHA-512 crypto extensions
+ * and use them if available.
+ */
+//#define MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
+
+/**
+ * \def MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY
+ *
+ * Enable acceleration of the SHA-512 and SHA-384 cryptographic hash algorithms
+ * with the ARMv8 cryptographic extensions, which must be available at runtime
+ * or else an illegal instruction fault will occur.
+ *
+ * \note This allows builds with a smaller code size than with
+ * MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT
+ *
+ * \note Minimum compiler versions for this feature are Clang 7.0,
+ * armclang 6.9 or GCC 8.0.
+ *
+ * \note \c CFLAGS must be set to a minimum of \c -march=armv8.2-a+sha3 for
+ * armclang 6.9
+ *
+ * \warning MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY cannot be defined at the same
+ * time as MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT.
+ *
+ * Requires: MBEDTLS_SHA512_C.
+ *
+ * Module: library/sha512.c
+ *
+ * Uncomment to have the library use the A64 SHA-512 crypto extensions
+ * unconditionally.
+ */
+//#define MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY
+
+/**
+ * \def MBEDTLS_SSL_CACHE_C
+ *
+ * Enable simple SSL cache implementation.
+ *
+ * Module: library/ssl_cache.c
+ * Caller:
+ *
+ * Requires: MBEDTLS_SSL_CACHE_C
+ */
+#define MBEDTLS_SSL_CACHE_C
+
+/**
+ * \def MBEDTLS_SSL_COOKIE_C
+ *
+ * Enable basic implementation of DTLS cookies for hello verification.
+ *
+ * Module: library/ssl_cookie.c
+ * Caller:
+ */
+#define MBEDTLS_SSL_COOKIE_C
+
+/**
+ * \def MBEDTLS_SSL_TICKET_C
+ *
+ * Enable an implementation of TLS server-side callbacks for session tickets.
+ *
+ * Module: library/ssl_ticket.c
+ * Caller:
+ *
+ * Requires: (MBEDTLS_CIPHER_C || MBEDTLS_USE_PSA_CRYPTO) &&
+ * (MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C)
+ */
+#define MBEDTLS_SSL_TICKET_C
+
+/**
+ * \def MBEDTLS_SSL_CLI_C
+ *
+ * Enable the SSL/TLS client code.
+ *
+ * Module: library/ssl*_client.c
+ * Caller:
+ *
+ * Requires: MBEDTLS_SSL_TLS_C
+ *
+ * This module is required for SSL/TLS client support.
+ */
+#define MBEDTLS_SSL_CLI_C
+
+/**
+ * \def MBEDTLS_SSL_SRV_C
+ *
+ * Enable the SSL/TLS server code.
+ *
+ * Module: library/ssl*_server.c
+ * Caller:
+ *
+ * Requires: MBEDTLS_SSL_TLS_C
+ *
+ * This module is required for SSL/TLS server support.
+ */
+#define MBEDTLS_SSL_SRV_C
+
+/**
+ * \def MBEDTLS_SSL_TLS_C
+ *
+ * Enable the generic SSL/TLS code.
+ *
+ * Module: library/ssl_tls.c
+ * Caller: library/ssl*_client.c
+ * library/ssl*_server.c
+ *
+ * Requires: MBEDTLS_CIPHER_C, MBEDTLS_MD_C
+ * and at least one of the MBEDTLS_SSL_PROTO_XXX defines
+ *
+ * This module is required for SSL/TLS.
+ */
+#define MBEDTLS_SSL_TLS_C
+
+/**
+ * \def MBEDTLS_THREADING_C
+ *
+ * Enable the threading abstraction layer.
+ * By default Mbed TLS assumes it is used in a non-threaded environment or that
+ * contexts are not shared between threads. If you do intend to use contexts
+ * between threads, you will need to enable this layer to prevent race
+ * conditions. See also our Knowledge Base article about threading:
+ * https://mbed-tls.readthedocs.io/en/latest/kb/development/thread-safety-and-multi-threading
+ *
+ * Module: library/threading.c
+ *
+ * This allows different threading implementations (self-implemented or
+ * provided).
+ *
+ * You will have to enable either MBEDTLS_THREADING_ALT or
+ * MBEDTLS_THREADING_PTHREAD.
+ *
+ * Enable this layer to allow use of mutexes within Mbed TLS
+ */
+//#define MBEDTLS_THREADING_C
+
+/**
+ * \def MBEDTLS_TIMING_C
+ *
+ * Enable the semi-portable timing interface.
+ *
+ * \note The provided implementation only works on POSIX/Unix (including Linux,
+ * BSD and OS X) and Windows. On other platforms, you can either disable that
+ * module and provide your own implementations of the callbacks needed by
+ * \c mbedtls_ssl_set_timer_cb() for DTLS, or leave it enabled and provide
+ * your own implementation of the whole module by setting
+ * \c MBEDTLS_TIMING_ALT in the current file.
+ *
+ * \note The timing module will include time.h on suitable platforms
+ * regardless of the setting of MBEDTLS_HAVE_TIME, unless
+ * MBEDTLS_TIMING_ALT is used. See timing.c for more information.
+ *
+ * \note See also our Knowledge Base article about porting to a new
+ * environment:
+ * https://mbed-tls.readthedocs.io/en/latest/kb/how-to/how-do-i-port-mbed-tls-to-a-new-environment-OS
+ *
+ * Module: library/timing.c
+ */
+//#define MBEDTLS_TIMING_C
+
+/**
+ * \def MBEDTLS_VERSION_C
+ *
+ * Enable run-time version information.
+ *
+ * Module: library/version.c
+ *
+ * This module provides run-time version information.
+ */
+#define MBEDTLS_VERSION_C
+
+/**
+ * \def MBEDTLS_X509_USE_C
+ *
+ * Enable X.509 core for using certificates.
+ *
+ * Module: library/x509.c
+ * Caller: library/x509_crl.c
+ * library/x509_crt.c
+ * library/x509_csr.c
+ *
+ * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_PARSE_C,
+ * (MBEDTLS_MD_C or MBEDTLS_USE_PSA_CRYPTO)
+ *
+ * \warning If building with MBEDTLS_USE_PSA_CRYPTO, you must call
+ * psa_crypto_init() before doing any X.509 operation.
+ *
+ * This module is required for the X.509 parsing modules.
+ */
+#define MBEDTLS_X509_USE_C
+
+/**
+ * \def MBEDTLS_X509_CRT_PARSE_C
+ *
+ * Enable X.509 certificate parsing.
+ *
+ * Module: library/x509_crt.c
+ * Caller: library/ssl_tls.c
+ * library/ssl*_client.c
+ * library/ssl*_server.c
+ *
+ * Requires: MBEDTLS_X509_USE_C
+ *
+ * This module is required for X.509 certificate parsing.
+ */
+#define MBEDTLS_X509_CRT_PARSE_C
+
+/**
+ * \def MBEDTLS_X509_CRL_PARSE_C
+ *
+ * Enable X.509 CRL parsing.
+ *
+ * Module: library/x509_crl.c
+ * Caller: library/x509_crt.c
+ *
+ * Requires: MBEDTLS_X509_USE_C
+ *
+ * This module is required for X.509 CRL parsing.
+ */
+#define MBEDTLS_X509_CRL_PARSE_C
+
+/**
+ * \def MBEDTLS_X509_CSR_PARSE_C
+ *
+ * Enable X.509 Certificate Signing Request (CSR) parsing.
+ *
+ * Module: library/x509_csr.c
+ * Caller: library/x509_crt_write.c
+ *
+ * Requires: MBEDTLS_X509_USE_C
+ *
+ * This module is used for reading X.509 certificate request.
+ */
+#define MBEDTLS_X509_CSR_PARSE_C
+
+/**
+ * \def MBEDTLS_X509_CREATE_C
+ *
+ * Enable X.509 core for creating certificates.
+ *
+ * Module: library/x509_create.c
+ *
+ * Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_PARSE_C,
+ * (MBEDTLS_MD_C or MBEDTLS_USE_PSA_CRYPTO)
+ *
+ * \warning If building with MBEDTLS_USE_PSA_CRYPTO, you must call
+ * psa_crypto_init() before doing any X.509 create operation.
+ *
+ * This module is the basis for creating X.509 certificates and CSRs.
+ */
+#define MBEDTLS_X509_CREATE_C
+
+/**
+ * \def MBEDTLS_X509_CRT_WRITE_C
+ *
+ * Enable creating X.509 certificates.
+ *
+ * Module: library/x509_crt_write.c
+ *
+ * Requires: MBEDTLS_X509_CREATE_C
+ *
+ * This module is required for X.509 certificate creation.
+ */
+#define MBEDTLS_X509_CRT_WRITE_C
+
+/**
+ * \def MBEDTLS_X509_CSR_WRITE_C
+ *
+ * Enable creating X.509 Certificate Signing Requests (CSR).
+ *
+ * Module: library/x509_csr_write.c
+ *
+ * Requires: MBEDTLS_X509_CREATE_C
+ *
+ * This module is required for X.509 certificate request writing.
+ */
+#define MBEDTLS_X509_CSR_WRITE_C
+
+/** \} name SECTION: Mbed TLS modules */
+
+/**
+ * \name SECTION: General configuration options
+ *
+ * This section contains Mbed TLS build settings that are not associated
+ * with a particular module.
+ *
+ * \{
+ */
+
+/**
+ * \def MBEDTLS_CONFIG_FILE
+ *
+ * If defined, this is a header which will be included instead of
+ * `"mbedtls/mbedtls_config.h"`.
+ * This header file specifies the compile-time configuration of Mbed TLS.
+ * Unlike other configuration options, this one must be defined on the
+ * compiler command line: a definition in `mbedtls_config.h` would have
+ * no effect.
+ *
+ * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
+ * non-standard feature of the C language, so this feature is only available
+ * with compilers that perform macro expansion on an <tt>\#include</tt> line.
+ *
+ * The value of this symbol is typically a path in double quotes, either
+ * absolute or relative to a directory on the include search path.
+ */
+//#define MBEDTLS_CONFIG_FILE "mbedtls/mbedtls_config.h"
+
+/**
+ * \def MBEDTLS_USER_CONFIG_FILE
+ *
+ * If defined, this is a header which will be included after
+ * `"mbedtls/mbedtls_config.h"` or #MBEDTLS_CONFIG_FILE.
+ * This allows you to modify the default configuration, including the ability
+ * to undefine options that are enabled by default.
+ *
+ * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
+ * non-standard feature of the C language, so this feature is only available
+ * with compilers that perform macro expansion on an <tt>\#include</tt> line.
+ *
+ * The value of this symbol is typically a path in double quotes, either
+ * absolute or relative to a directory on the include search path.
+ */
+//#define MBEDTLS_USER_CONFIG_FILE "/dev/null"
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_CONFIG_FILE
+ *
+ * If defined, this is a header which will be included instead of
+ * `"psa/crypto_config.h"`.
+ * This header file specifies which cryptographic mechanisms are available
+ * through the PSA API when #MBEDTLS_PSA_CRYPTO_CONFIG is enabled, and
+ * is not used when #MBEDTLS_PSA_CRYPTO_CONFIG is disabled.
+ *
+ * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
+ * non-standard feature of the C language, so this feature is only available
+ * with compilers that perform macro expansion on an <tt>\#include</tt> line.
+ *
+ * The value of this symbol is typically a path in double quotes, either
+ * absolute or relative to a directory on the include search path.
+ */
+//#define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h"
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE
+ *
+ * If defined, this is a header which will be included after
+ * `"psa/crypto_config.h"` or #MBEDTLS_PSA_CRYPTO_CONFIG_FILE.
+ * This allows you to modify the default configuration, including the ability
+ * to undefine options that are enabled by default.
+ *
+ * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
+ * non-standard feature of the C language, so this feature is only available
+ * with compilers that perform macro expansion on an <tt>\#include</tt> line.
+ *
+ * The value of this symbol is typically a path in double quotes, either
+ * absolute or relative to a directory on the include search path.
+ */
+//#define MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null"
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_PLATFORM_FILE
+ *
+ * If defined, this is a header which will be included instead of
+ * `"psa/crypto_platform.h"`. This file should declare the same identifiers
+ * as the one in Mbed TLS, but with definitions adapted to the platform on
+ * which the library code will run.
+ *
+ * \note The required content of this header can vary from one version of
+ * Mbed TLS to the next. Integrators who provide an alternative file
+ * should review the changes in the original file whenever they
+ * upgrade Mbed TLS.
+ *
+ * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
+ * non-standard feature of the C language, so this feature is only available
+ * with compilers that perform macro expansion on an <tt>\#include</tt> line.
+ *
+ * The value of this symbol is typically a path in double quotes, either
+ * absolute or relative to a directory on the include search path.
+ */
+//#define MBEDTLS_PSA_CRYPTO_PLATFORM_FILE "psa/crypto_platform_alt.h"
+
+/**
+ * \def MBEDTLS_PSA_CRYPTO_STRUCT_FILE
+ *
+ * If defined, this is a header which will be included instead of
+ * `"psa/crypto_struct.h"`. This file should declare the same identifiers
+ * as the one in Mbed TLS, but with definitions adapted to the environment
+ * in which the library code will run. The typical use for this feature
+ * is to provide alternative type definitions on the client side in
+ * client-server integrations of PSA crypto, where operation structures
+ * contain handles instead of cryptographic data.
+ *
+ * \note The required content of this header can vary from one version of
+ * Mbed TLS to the next. Integrators who provide an alternative file
+ * should review the changes in the original file whenever they
+ * upgrade Mbed TLS.
+ *
+ * This macro is expanded after an <tt>\#include</tt> directive. This is a popular but
+ * non-standard feature of the C language, so this feature is only available
+ * with compilers that perform macro expansion on an <tt>\#include</tt> line.
+ *
+ * The value of this symbol is typically a path in double quotes, either
+ * absolute or relative to a directory on the include search path.
+ */
+//#define MBEDTLS_PSA_CRYPTO_STRUCT_FILE "psa/crypto_struct_alt.h"
+
+/** \} name SECTION: General configuration options */
+
+/**
+ * \name SECTION: Module configuration options
+ *
+ * This section allows for the setting of module specific sizes and
+ * configuration options. The default values are already present in the
+ * relevant header files and should suffice for the regular use cases.
+ *
+ * Our advice is to enable options and change their values here
+ * only if you have a good reason and know the consequences.
+ * \{
+ */
+/* The Doxygen documentation here is used when a user comments out a
+ * setting and runs doxygen themselves. On the other hand, when we typeset
+ * the full documentation including disabled settings, the documentation
+ * in specific modules' header files is used if present. When editing this
+ * file, make sure that each option is documented in exactly one place,
+ * plus optionally a same-line Doxygen comment here if there is a Doxygen
+ * comment in the specific module. */
+
+/* MPI / BIGNUM options */
+//#define MBEDTLS_MPI_WINDOW_SIZE 2 /**< Maximum window size used. */
+//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */
+
+/* CTR_DRBG options */
+//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */
+//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
+//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
+//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
+//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
+
+/* HMAC_DRBG options */
+//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */
+//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */
+//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */
+//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */
+
+/* ECP options */
+//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */
+//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */
+
+/* Entropy options */
+//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */
+//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */
+//#define MBEDTLS_ENTROPY_MIN_HARDWARE 32 /**< Default minimum number of bytes required for the hardware entropy source mbedtls_hardware_poll() before entropy is released */
+
+/* Memory buffer allocator options */
+//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */
+
+/* Platform options */
+//#define MBEDTLS_PLATFORM_STD_MEM_HDR <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
+
+/** \def MBEDTLS_PLATFORM_STD_CALLOC
+ *
+ * Default allocator to use, can be undefined.
+ * It must initialize the allocated buffer memory to zeroes.
+ * The size of the buffer is the product of the two parameters.
+ * The calloc function returns either a null pointer or a pointer to the allocated space.
+ * If the product is 0, the function may either return NULL or a valid pointer to an array of size 0 which is a valid input to the deallocation function.
+ * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer.
+ * See the description of #MBEDTLS_PLATFORM_MEMORY for more details.
+ * The corresponding deallocation function is #MBEDTLS_PLATFORM_STD_FREE.
+ */
+//#define MBEDTLS_PLATFORM_STD_CALLOC calloc
+
+/** \def MBEDTLS_PLATFORM_STD_FREE
+ *
+ * Default free to use, can be undefined.
+ * NULL is a valid parameter, and the function must do nothing.
+ * A non-null parameter will always be a pointer previously returned by #MBEDTLS_PLATFORM_STD_CALLOC and not yet freed.
+ * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything.
+ * See the description of #MBEDTLS_PLATFORM_MEMORY for more details (same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply).
+ */
+//#define MBEDTLS_PLATFORM_STD_FREE free
+//#define MBEDTLS_PLATFORM_STD_SETBUF setbuf /**< Default setbuf to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
+//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */
+/* Note: your snprintf must correctly zero-terminate the buffer! */
+//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */
+
+/* To use the following function macros, MBEDTLS_PLATFORM_C must be enabled. */
+/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */
+//#define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_CALLOC for requirements. */
+//#define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_FREE for requirements. */
+//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */
+//#define MBEDTLS_PLATFORM_SETBUF_MACRO setbuf /**< Default setbuf macro to use, can be undefined */
+//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
+//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */
+//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */
+//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */
+/* Note: your snprintf must correctly zero-terminate the buffer! */
+//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */
+//#define MBEDTLS_PLATFORM_VSNPRINTF_MACRO vsnprintf /**< Default vsnprintf macro to use, can be undefined */
+//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */
+//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */
+//#define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO int64_t //#define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO int64_t /**< Default milliseconds time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled. It must be signed, and at least 64 bits. If it is changed from the default, MBEDTLS_PRINTF_MS_TIME must be updated to match.*/
+//#define MBEDTLS_PRINTF_MS_TIME PRId64 /**< Default fmt for printf. That's avoid compiler warning if mbedtls_ms_time_t is redefined */
+
+/** \def MBEDTLS_CHECK_RETURN
+ *
+ * This macro is used at the beginning of the declaration of a function
+ * to indicate that its return value should be checked. It should
+ * instruct the compiler to emit a warning or an error if the function
+ * is called without checking its return value.
+ *
+ * There is a default implementation for popular compilers in platform_util.h.
+ * You can override the default implementation by defining your own here.
+ *
+ * If the implementation here is empty, this will effectively disable the
+ * checking of functions' return values.
+ */
+//#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__))
+
+/** \def MBEDTLS_IGNORE_RETURN
+ *
+ * This macro requires one argument, which should be a C function call.
+ * If that function call would cause a #MBEDTLS_CHECK_RETURN warning, this
+ * warning is suppressed.
+ */
+//#define MBEDTLS_IGNORE_RETURN( result ) ((void) !(result))
+
+/* PSA options */
+/**
+ * Use HMAC_DRBG with the specified hash algorithm for HMAC_DRBG for the
+ * PSA crypto subsystem.
+ *
+ * If this option is unset:
+ * - If CTR_DRBG is available, the PSA subsystem uses it rather than HMAC_DRBG.
+ * - Otherwise, the PSA subsystem uses HMAC_DRBG with either
+ * #MBEDTLS_MD_SHA512 or #MBEDTLS_MD_SHA256 based on availability and
+ * on unspecified heuristics.
+ */
+//#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA256
+
+/** \def MBEDTLS_PSA_KEY_SLOT_COUNT
+ * Restrict the PSA library to supporting a maximum amount of simultaneously
+ * loaded keys. A loaded key is a key stored by the PSA Crypto core as a
+ * volatile key, or a persistent key which is loaded temporarily by the
+ * library as part of a crypto operation in flight.
+ *
+ * If this option is unset, the library will fall back to a default value of
+ * 32 keys.
+ */
+//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32
+
+/* RSA OPTIONS */
+//#define MBEDTLS_RSA_GEN_KEY_MIN_BITS 1024 /**< Minimum RSA key size that can be generated in bits (Minimum possible value is 128 bits) */
+
+/* SSL Cache options */
+//#define MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT 86400 /**< 1 day */
+//#define MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES 50 /**< Maximum entries in cache */
+
+/* SSL options */
+
+/** \def MBEDTLS_SSL_IN_CONTENT_LEN
+ *
+ * Maximum length (in bytes) of incoming plaintext fragments.
+ *
+ * This determines the size of the incoming TLS I/O buffer in such a way
+ * that it is capable of holding the specified amount of plaintext data,
+ * regardless of the protection mechanism used.
+ *
+ * \note When using a value less than the default of 16KB on the client, it is
+ * recommended to use the Maximum Fragment Length (MFL) extension to
+ * inform the server about this limitation. On the server, there
+ * is no supported, standardized way of informing the client about
+ * restriction on the maximum size of incoming messages, and unless
+ * the limitation has been communicated by other means, it is recommended
+ * to only change the outgoing buffer size #MBEDTLS_SSL_OUT_CONTENT_LEN
+ * while keeping the default value of 16KB for the incoming buffer.
+ *
+ * Uncomment to set the maximum plaintext size of the incoming I/O buffer.
+ */
+//#define MBEDTLS_SSL_IN_CONTENT_LEN 16384
+
+/** \def MBEDTLS_SSL_CID_IN_LEN_MAX
+ *
+ * The maximum length of CIDs used for incoming DTLS messages.
+ *
+ */
+//#define MBEDTLS_SSL_CID_IN_LEN_MAX 32
+
+/** \def MBEDTLS_SSL_CID_OUT_LEN_MAX
+ *
+ * The maximum length of CIDs used for outgoing DTLS messages.
+ *
+ */
+//#define MBEDTLS_SSL_CID_OUT_LEN_MAX 32
+
+/** \def MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY
+ *
+ * This option controls the use of record plaintext padding
+ * in TLS 1.3 and when using the Connection ID extension in DTLS 1.2.
+ *
+ * The padding will always be chosen so that the length of the
+ * padded plaintext is a multiple of the value of this option.
+ *
+ * Note: A value of \c 1 means that no padding will be used
+ * for outgoing records.
+ *
+ * Note: On systems lacking division instructions,
+ * a power of two should be preferred.
+ */
+//#define MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY 16
+
+/** \def MBEDTLS_SSL_OUT_CONTENT_LEN
+ *
+ * Maximum length (in bytes) of outgoing plaintext fragments.
+ *
+ * This determines the size of the outgoing TLS I/O buffer in such a way
+ * that it is capable of holding the specified amount of plaintext data,
+ * regardless of the protection mechanism used.
+ *
+ * It is possible to save RAM by setting a smaller outward buffer, while keeping
+ * the default inward 16384 byte buffer to conform to the TLS specification.
+ *
+ * The minimum required outward buffer size is determined by the handshake
+ * protocol's usage. Handshaking will fail if the outward buffer is too small.
+ * The specific size requirement depends on the configured ciphers and any
+ * certificate data which is sent during the handshake.
+ *
+ * Uncomment to set the maximum plaintext size of the outgoing I/O buffer.
+ */
+//#define MBEDTLS_SSL_OUT_CONTENT_LEN 16384
+
+/** \def MBEDTLS_SSL_DTLS_MAX_BUFFERING
+ *
+ * Maximum number of heap-allocated bytes for the purpose of
+ * DTLS handshake message reassembly and future message buffering.
+ *
+ * This should be at least 9/8 * MBEDTLS_SSL_IN_CONTENT_LEN
+ * to account for a reassembled handshake message of maximum size,
+ * together with its reassembly bitmap.
+ *
+ * A value of 2 * MBEDTLS_SSL_IN_CONTENT_LEN (32768 by default)
+ * should be sufficient for all practical situations as it allows
+ * to reassembly a large handshake message (such as a certificate)
+ * while buffering multiple smaller handshake messages.
+ *
+ */
+//#define MBEDTLS_SSL_DTLS_MAX_BUFFERING 32768
+
+//#define MBEDTLS_PSK_MAX_LEN 32 /**< Max size of TLS pre-shared keys, in bytes (default 256 or 384 bits) */
+//#define MBEDTLS_SSL_COOKIE_TIMEOUT 60 /**< Default expiration delay of DTLS cookies, in seconds if HAVE_TIME, or in number of cookies issued */
+
+/**
+ * Complete list of ciphersuites to use, in order of preference.
+ *
+ * \warning No dependency checking is done on that field! This option can only
+ * be used to restrict the set of available ciphersuites. It is your
+ * responsibility to make sure the needed modules are active.
+ *
+ * Use this to save a few hundred bytes of ROM (default ordering of all
+ * available ciphersuites) and a few to a few hundred bytes of RAM.
+ *
+ * The value below is only an example, not the default.
+ */
+//#define MBEDTLS_SSL_CIPHERSUITES MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+
+/**
+ * \def MBEDTLS_SSL_MAX_EARLY_DATA_SIZE
+ *
+ * The default maximum amount of 0-RTT data. See the documentation of
+ * \c mbedtls_ssl_tls13_conf_max_early_data_size() for more information.
+ *
+ * It must be positive and smaller than UINT32_MAX.
+ *
+ * If MBEDTLS_SSL_EARLY_DATA is not defined, this default value does not
+ * have any impact on the build.
+ *
+ * This feature is experimental, not completed and thus not ready for
+ * production.
+ *
+ */
+//#define MBEDTLS_SSL_MAX_EARLY_DATA_SIZE 1024
+
+/**
+ * \def MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE
+ *
+ * Maximum time difference in milliseconds tolerated between the age of a
+ * ticket from the server and client point of view.
+ * From the client point of view, the age of a ticket is the time difference
+ * between the time when the client proposes to the server to use the ticket
+ * (time of writing of the Pre-Shared Key Extension including the ticket) and
+ * the time the client received the ticket from the server.
+ * From the server point of view, the age of a ticket is the time difference
+ * between the time when the server receives a proposition from the client
+ * to use the ticket and the time when the ticket was created by the server.
+ * The server age is expected to be always greater than the client one and
+ * MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE defines the
+ * maximum difference tolerated for the server to accept the ticket.
+ * This is not used in TLS 1.2.
+ *
+ */
+//#define MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE 6000
+
+/**
+ * \def MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH
+ *
+ * Size in bytes of a ticket nonce. This is not used in TLS 1.2.
+ *
+ * This must be less than 256.
+ */
+//#define MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH 32
+
+/**
+ * \def MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS
+ *
+ * Default number of NewSessionTicket messages to be sent by a TLS 1.3 server
+ * after handshake completion. This is not used in TLS 1.2 and relevant only if
+ * the MBEDTLS_SSL_SESSION_TICKETS option is enabled.
+ *
+ */
+//#define MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS 1
+
+/* X509 options */
+//#define MBEDTLS_X509_MAX_INTERMEDIATE_CA 8 /**< Maximum number of intermediate CAs in a verification chain. */
+//#define MBEDTLS_X509_MAX_FILE_PATH_LEN 512 /**< Maximum length of a path/filename string in bytes including the null terminator character ('\0'). */
+
+/** \} name SECTION: Module configuration options */
diff --git a/lib/mbedtls/port/assert.h b/lib/mbedtls/port/assert.h
new file mode 100644
index 0000000000..490701aa9d
--- /dev/null
+++ b/lib/mbedtls/port/assert.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Dummy file to allow mbedtls linked with U-Boot to include assert.h
+ *
+ * Copyright (c) 2023 Linaro Limited
+ * Author: Raymond Mao <raymond.mao@linaro.org>
+ */
+
+#ifndef _MBEDTLS_ASSERT_H
+#define _MBEDTLS_ASSERT_H
+
+#endif /* _MBEDTLS_ASSERT_H */
diff --git a/lib/mbedtls/port/limits.h b/lib/mbedtls/port/limits.h
new file mode 100644
index 0000000000..9bfbeb22e1
--- /dev/null
+++ b/lib/mbedtls/port/limits.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Dummy file to allow mbedtls linked with U-Boot to include limits.h
+ *
+ * Copyright (c) 2023 Linaro Limited
+ * Author: Raymond Mao <raymond.mao@linaro.org>
+ */
+
+#ifndef _MBEDTLS_LIMITS_H
+#define _MBEDTLS_LIMITS_H
+
+#undef INT_MAX
+#define INT_MAX 0x7fffffff
+
+#undef UINT_MAX
+#define UINT_MAX 0xffffffffUL
+
+#undef CHAR_BIT
+#define CHAR_BIT 8
+
+#undef UINT32_MAX
+#define UINT32_MAX 0xffffffffUL
+
+#undef UINTPTR_MAX
+#define UINTPTR_MAX 0xffffffffffffffffUL
+
+#undef SIZE_MAX
+#define SIZE_MAX UINTPTR_MAX
+
+#undef UINT64_MAX
+#define UINT64_MAX UINTPTR_MAX
+
+#endif /* _MBEDTLS_LIMITS_H */
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 04/23] arm: EFI linker script text section alignment
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
2024-04-16 18:59 ` [PATCH 03/23] mbedtls: add mbedtls into the build system Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 05/23] test: py: add sudo for virt-make-fs Raymond Mao
` (21 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Add text section alignment to fix sbsign signing warning
'gaps in the section table may result in different checksums'
which causes a failure of efi_image_verify_diges()
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
arch/arm/lib/elf_aarch64_efi.lds | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/lib/elf_aarch64_efi.lds b/arch/arm/lib/elf_aarch64_efi.lds
index 5dd9809169..bffd9a0447 100644
--- a/arch/arm/lib/elf_aarch64_efi.lds
+++ b/arch/arm/lib/elf_aarch64_efi.lds
@@ -28,6 +28,7 @@ SECTIONS
*(.dynamic);
. = ALIGN(512);
}
+ . = ALIGN(4096);
.rela.dyn : { *(.rela.dyn) }
.rela.plt : { *(.rela.plt) }
.rela.got : { *(.rela.got) }
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 05/23] test: py: add sudo for virt-make-fs
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
2024-04-16 18:59 ` [PATCH 03/23] mbedtls: add mbedtls into the build system Raymond Mao
2024-04-16 19:00 ` [PATCH 04/23] arm: EFI linker script text section alignment Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:19 ` Tom Rini
2024-04-16 19:00 ` [PATCH 06/23] image: remove redundant hash includes Raymond Mao
` (20 subsequent siblings)
23 siblings, 1 reply; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Fix a permission issue when running virt-make-fs
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
test/py/tests/test_efi_secboot/conftest.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/test/py/tests/test_efi_secboot/conftest.py b/test/py/tests/test_efi_secboot/conftest.py
index ff7ac7c810..30357913f0 100644
--- a/test/py/tests/test_efi_secboot/conftest.py
+++ b/test/py/tests/test_efi_secboot/conftest.py
@@ -113,7 +113,7 @@ def efi_boot_env(request, u_boot_config):
% (mnt_point, EFITOOLS_PATH),
shell=True)
- check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format(
+ check_call('sudo virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format(
mnt_point, image_path), shell=True)
check_call('rm -rf {}'.format(mnt_point), shell=True)
@@ -232,7 +232,7 @@ def efi_boot_env_intca(request, u_boot_config):
check_call('cd %s; cat TestSub.crt TestRoot.crt > TestSubRoot.crt; %ssbsign --key TestCert.key --cert TestCert.crt --addcert TestSubRoot.crt --out helloworld.efi.signed_abc helloworld.efi'
% (mnt_point, SBSIGN_PATH), shell=True)
- check_call('virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format(mnt_point, image_path), shell=True)
+ check_call('sudo virt-make-fs --partition=gpt --size=+1M --type=vfat {} {}'.format(mnt_point, image_path), shell=True)
check_call('rm -rf {}'.format(mnt_point), shell=True)
except CalledProcessError as e:
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 06/23] image: remove redundant hash includes
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (2 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 05/23] test: py: add sudo for virt-make-fs Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:19 ` Tom Rini
2024-04-16 19:00 ` [PATCH 07/23] efi_loader: " Raymond Mao
` (19 subsequent siblings)
23 siblings, 1 reply; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Remove the redundant includes of u-boot/md5.h, u-boot/sha1.h,
u-boot/sha256.h and u-boot/sha512.h
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
boot/image-fit.c | 4 ----
boot/image.c | 2 --
2 files changed, 6 deletions(-)
diff --git a/boot/image-fit.c b/boot/image-fit.c
index 89e377563c..1efc39f440 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -38,10 +38,6 @@ DECLARE_GLOBAL_DATA_PTR;
#include <image.h>
#include <bootstage.h>
#include <u-boot/crc.h>
-#include <u-boot/md5.h>
-#include <u-boot/sha1.h>
-#include <u-boot/sha256.h>
-#include <u-boot/sha512.h>
/*****************************************************************************/
/* New uImage format routines */
diff --git a/boot/image.c b/boot/image.c
index 073931cd7a..e57d6eae52 100644
--- a/boot/image.c
+++ b/boot/image.c
@@ -26,8 +26,6 @@
#endif
#include <asm/global_data.h>
-#include <u-boot/md5.h>
-#include <u-boot/sha1.h>
#include <linux/errno.h>
#include <asm/io.h>
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 07/23] efi_loader: remove redundant hash includes
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (3 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 06/23] image: remove redundant hash includes Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 08/23] mbedtls: add hash shim layer Raymond Mao
` (18 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Remove the redundant includes of u-boot/sha1.h, u-boot/sha256.h
and u-boot/sha512.h
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
lib/efi_loader/efi_signature.c | 1 -
lib/efi_loader/efi_tcg2.c | 3 ---
2 files changed, 4 deletions(-)
diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c
index f338e73275..184eac8cdd 100644
--- a/lib/efi_loader/efi_signature.c
+++ b/lib/efi_loader/efi_signature.c
@@ -17,7 +17,6 @@
#include <linux/oid_registry.h>
#include <u-boot/hash-checksum.h>
#include <u-boot/rsa.h>
-#include <u-boot/sha256.h>
const efi_guid_t efi_guid_sha256 = EFI_CERT_SHA256_GUID;
const efi_guid_t efi_guid_cert_rsa2048 = EFI_CERT_RSA2048_GUID;
diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index b07e0099c2..ac056dcfc5 100644
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -19,9 +19,6 @@
#include <tpm-v2.h>
#include <tpm_api.h>
#include <u-boot/hash-checksum.h>
-#include <u-boot/sha1.h>
-#include <u-boot/sha256.h>
-#include <u-boot/sha512.h>
#include <linux/unaligned/be_byteshift.h>
#include <linux/unaligned/le_byteshift.h>
#include <linux/unaligned/generic.h>
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 08/23] mbedtls: add hash shim layer
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (4 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 07/23] efi_loader: " Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 09/23] hash: integrate hash on mbedtls Raymond Mao
` (17 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Create a hash shim layer on top of mbedtls crypto library.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
include/mbedtls/md5.h | 18 ++++++
include/mbedtls/sha1.h | 27 +++++++++
include/mbedtls/sha256.h | 31 ++++++++++
include/mbedtls/sha512.h | 39 +++++++++++++
lib/mbedtls/Makefile | 3 +
lib/mbedtls/hash_shim.c | 118 +++++++++++++++++++++++++++++++++++++++
6 files changed, 236 insertions(+)
create mode 100644 include/mbedtls/md5.h
create mode 100644 include/mbedtls/sha1.h
create mode 100644 include/mbedtls/sha256.h
create mode 100644 include/mbedtls/sha512.h
create mode 100644 lib/mbedtls/hash_shim.c
diff --git a/include/mbedtls/md5.h b/include/mbedtls/md5.h
new file mode 100644
index 0000000000..e5a205efda
--- /dev/null
+++ b/include/mbedtls/md5.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (c) 2023 Linaro Limited
+ * Author: Raymond Mao <raymond.mao@linaro.org>
+ */
+#include <external/mbedtls/include/mbedtls/md5.h>
+
+#ifndef _MBEDTLS_MD5_H
+#define _MBEDTLS_MD5_H
+
+#define MD5_SUM_LEN 16
+
+void
+md5_wd_mb(const unsigned char *input, unsigned int len,
+ unsigned char output[16],
+ unsigned int __always_unused chunk_sz);
+
+#endif /* _MBEDTLS_MD5_H */
diff --git a/include/mbedtls/sha1.h b/include/mbedtls/sha1.h
new file mode 100644
index 0000000000..f7aff6f652
--- /dev/null
+++ b/include/mbedtls/sha1.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (c) 2023 Linaro Limited
+ * Author: Raymond Mao <raymond.mao@linaro.org>
+ */
+#include <external/mbedtls/include/mbedtls/sha1.h>
+
+#ifndef _MBEDTLS_SHA1_H
+#define _MBEDTLS_SHA1_H
+
+#define SHA1_SUM_LEN 20
+#define SHA1_DER_LEN 15
+
+#define CHUNKSZ_SHA1 (64 * 1024)
+
+extern const u8 sha1_der_prefix[];
+
+typedef mbedtls_sha1_context sha1_context;
+
+void sha1_starts_mb(sha1_context *ctx);
+void sha1_update_mb(sha1_context *ctx, const unsigned char *input,
+ unsigned int length);
+void sha1_finish_mb(sha1_context *ctx, unsigned char output[SHA1_SUM_LEN]);
+void sha1_csum_wd_mb(const unsigned char *input, unsigned int length,
+ unsigned char *output, unsigned int chunk_sz);
+
+#endif /* _MBEDTLS_SHA1_H */
diff --git a/include/mbedtls/sha256.h b/include/mbedtls/sha256.h
new file mode 100644
index 0000000000..804f2ce8ab
--- /dev/null
+++ b/include/mbedtls/sha256.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (c) 2023 Linaro Limited
+ * Author: Raymond Mao <raymond.mao@linaro.org>
+ */
+#include <external/mbedtls/include/mbedtls/sha256.h>
+
+#ifndef _MBEDTLS_SHA256_H
+#define _MBEDTLS_SHA256_H
+
+#define SHA224_SUM_LEN 28
+#define SHA256_SUM_LEN 32
+
+#define SHA224_DER_LEN 19
+#define SHA256_DER_LEN 19
+
+#define CHUNKSZ_SHA224 (64 * 1024)
+#define CHUNKSZ_SHA256 (64 * 1024)
+
+extern const u8 sha256_der_prefix[];
+
+typedef mbedtls_sha256_context sha256_context;
+
+void sha256_starts_mb(sha256_context *ctx);
+void
+sha256_update_mb(sha256_context *ctx, const uint8_t *input, uint32_t length);
+void sha256_finish_mb(sha256_context *ctx, uint8_t digest[SHA256_SUM_LEN]);
+void sha256_csum_wd_mb(const unsigned char *input, unsigned int length,
+ unsigned char *output, unsigned int chunk_sz);
+
+#endif /* _MBEDTLS_SHA256_H */
diff --git a/include/mbedtls/sha512.h b/include/mbedtls/sha512.h
new file mode 100644
index 0000000000..bc7f2faa0d
--- /dev/null
+++ b/include/mbedtls/sha512.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright (c) 2023 Linaro Limited
+ * Author: Raymond Mao <raymond.mao@linaro.org>
+ */
+#include <external/mbedtls/include/mbedtls/sha512.h>
+
+#ifndef _MBEDTLS_SHA512_H
+#define _MBEDTLS_SHA512_H
+
+#define SHA384_SUM_LEN 48
+#define SHA512_SUM_LEN 64
+
+#define SHA384_DER_LEN 19
+#define SHA512_DER_LEN 19
+
+#define CHUNKSZ_SHA384 (16 * 1024)
+#define CHUNKSZ_SHA512 (16 * 1024)
+
+extern const u8 sha384_der_prefix[];
+extern const u8 sha512_der_prefix[];
+
+typedef mbedtls_sha512_context sha384_context;
+typedef mbedtls_sha512_context sha512_context;
+
+void sha384_starts_mb(sha512_context *ctx);
+void
+sha384_update_mb(sha512_context *ctx, const uint8_t *input, uint32_t length);
+void sha384_finish_mb(sha512_context *ctx, uint8_t digest[SHA384_SUM_LEN]);
+void sha384_csum_wd_mb(const unsigned char *input, unsigned int length,
+ unsigned char *output, unsigned int chunk_sz);
+void sha512_starts_mb(sha512_context *ctx);
+void
+sha512_update_mb(sha512_context *ctx, const uint8_t *input, uint32_t length);
+void sha512_finish_mb(sha512_context *ctx, uint8_t digest[SHA512_SUM_LEN]);
+void sha512_csum_wd_mb(const unsigned char *input, unsigned int length,
+ unsigned char *output, unsigned int chunk_sz);
+
+#endif /* _MBEDTLS_SHA512_H */
diff --git a/lib/mbedtls/Makefile b/lib/mbedtls/Makefile
index 85f0a3cfd0..5d41ddbd8d 100644
--- a/lib/mbedtls/Makefile
+++ b/lib/mbedtls/Makefile
@@ -14,6 +14,9 @@ ccflags-y += \
-I$(src)/external/mbedtls/library \
# This line is intentionally left blank
+# shim layer for hash
+obj-$(CONFIG_MBEDTLS_LIB_CRYPTO) += hash_shim.o
+
obj-$(CONFIG_MBEDTLS_LIB_CRYPTO) += mbedtls_lib_crypto.o
mbedtls_lib_crypto-y := \
$(MBEDTLS_LIB_DIR)/aes.o \
diff --git a/lib/mbedtls/hash_shim.c b/lib/mbedtls/hash_shim.c
new file mode 100644
index 0000000000..982718efed
--- /dev/null
+++ b/lib/mbedtls/hash_shim.c
@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Hash shim layer on MbedTLS Crypto library
+ *
+ * Copyright (c) 2023 Linaro Limited
+ * Author: Raymond Mao <raymond.mao@linaro.org>
+ */
+
+#include "common.h"
+#include <malloc.h>
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>
+#include <mbedtls/md5.h>
+
+void sha1_starts_mb(sha1_context *ctx)
+{
+ mbedtls_sha1_init(ctx);
+ mbedtls_sha1_starts(ctx);
+}
+
+void sha1_update_mb(sha1_context *ctx, const unsigned char *input,
+ unsigned int length)
+{
+ mbedtls_sha1_update(ctx, input, length);
+}
+
+void sha1_finish_mb(sha1_context *ctx, unsigned char output[SHA1_SUM_LEN])
+{
+ mbedtls_sha1_finish(ctx, output);
+ mbedtls_sha1_free(ctx);
+}
+
+void sha1_csum_wd_mb(const unsigned char *input, unsigned int length,
+ unsigned char *output, unsigned int chunk_sz)
+{
+ mbedtls_sha1(input, length, output);
+}
+
+void sha256_starts_mb(sha256_context *ctx)
+{
+ mbedtls_sha256_init(ctx);
+ mbedtls_sha256_starts(ctx, 0);
+}
+
+void
+sha256_update_mb(sha256_context *ctx, const uint8_t *input, uint32_t length)
+{
+ mbedtls_sha256_update(ctx, input, length);
+}
+
+void sha256_finish_mb(sha256_context *ctx, uint8_t digest[SHA256_SUM_LEN])
+{
+ mbedtls_sha256_finish(ctx, digest);
+ mbedtls_sha256_free(ctx);
+}
+
+void sha256_csum_wd_mb(const unsigned char *input, unsigned int length,
+ unsigned char *output, unsigned int chunk_sz)
+{
+ mbedtls_sha256(input, length, output, 0);
+}
+
+void sha384_starts_mb(sha512_context *ctx)
+{
+ mbedtls_sha512_init(ctx);
+ mbedtls_sha512_starts(ctx, 1);
+}
+
+void
+sha384_update_mb(sha512_context *ctx, const uint8_t *input, uint32_t length)
+{
+ mbedtls_sha512_update(ctx, input, length);
+}
+
+void sha384_finish_mb(sha512_context *ctx, uint8_t digest[SHA384_SUM_LEN])
+{
+ mbedtls_sha512_finish(ctx, digest);
+ mbedtls_sha512_free(ctx);
+}
+
+void sha384_csum_wd_mb(const unsigned char *input, unsigned int length,
+ unsigned char *output, unsigned int chunk_sz)
+{
+ mbedtls_sha512(input, length, output, 1);
+}
+
+void sha512_starts_mb(sha512_context *ctx)
+{
+ mbedtls_sha512_init(ctx);
+ mbedtls_sha512_starts(ctx, 0);
+}
+
+void
+sha512_update_mb(sha512_context *ctx, const uint8_t *input, uint32_t length)
+{
+ mbedtls_sha512_update(ctx, input, length);
+}
+
+void sha512_finish_mb(sha512_context *ctx, uint8_t digest[SHA512_SUM_LEN])
+{
+ mbedtls_sha512_finish(ctx, digest);
+ mbedtls_sha512_free(ctx);
+}
+
+void sha512_csum_wd_mb(const unsigned char *input, unsigned int length,
+ unsigned char *output, unsigned int chunk_sz)
+{
+ mbedtls_sha512(input, length, output, 0);
+}
+
+void
+md5_wd_mb(const unsigned char *input, unsigned int len,
+ unsigned char output[16], unsigned int __always_unused chunk_sz)
+{
+ mbedtls_md5(input, len, output);
+}
+
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 09/23] hash: integrate hash on mbedtls
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (5 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 08/23] mbedtls: add hash shim layer Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 10/23] makefile: add mbedtls include directories Raymond Mao
` (16 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Integrate common/hash.c on the hash shim layer so that hash APIs
from mbedtls can be leveraged by boot/image and efi_loader.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
common/hash.c | 161 +++++++++++++++++++++++++++++++++
include/u-boot/hash-checksum.h | 6 ++
2 files changed, 167 insertions(+)
diff --git a/common/hash.c b/common/hash.c
index 3d6b84de47..5352ba88e3 100644
--- a/common/hash.c
+++ b/common/hash.c
@@ -31,10 +31,143 @@
#include <hash.h>
#include <image.h>
#include <u-boot/crc.h>
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>
+#include <mbedtls/md5.h>
+#else
#include <u-boot/sha1.h>
#include <u-boot/sha256.h>
#include <u-boot/sha512.h>
#include <u-boot/md5.h>
+#endif
+
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+
+static int hash_init_sha1(struct hash_algo *algo, void **ctxp)
+{
+ int ret;
+ mbedtls_sha1_context *ctx = malloc(sizeof(mbedtls_sha1_context));
+
+ mbedtls_sha1_init(ctx);
+ ret = mbedtls_sha1_starts(ctx);
+ if (!ret) {
+ *ctxp = ctx;
+ } else {
+ mbedtls_sha1_free(ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_update_sha1(struct hash_algo *algo, void *ctx, const void *buf,
+ unsigned int size, int is_last)
+{
+ return mbedtls_sha1_update((mbedtls_sha1_context *)ctx, buf, size);
+}
+
+static int
+hash_finish_sha1(struct hash_algo *algo, void *ctx, void *dest_buf, int size)
+{
+ int ret;
+
+ if (size < algo->digest_size)
+ return -1;
+
+ ret = mbedtls_sha1_finish((mbedtls_sha1_context *)ctx, dest_buf);
+ if (!ret) {
+ mbedtls_sha1_free((mbedtls_sha1_context *)ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_init_sha256(struct hash_algo *algo, void **ctxp)
+{
+ int ret;
+ int is224 = algo->digest_size == SHA224_SUM_LEN ? 1 : 0;
+ mbedtls_sha256_context *ctx = malloc(sizeof(mbedtls_sha256_context));
+
+ mbedtls_sha256_init(ctx);
+ ret = mbedtls_sha256_starts(ctx, is224);
+ if (!ret) {
+ *ctxp = ctx;
+ } else {
+ mbedtls_sha256_free(ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_update_sha256(struct hash_algo *algo, void *ctx, const void *buf,
+ uint size, int is_last)
+{
+ return mbedtls_sha256_update((mbedtls_sha256_context *)ctx, buf, size);
+}
+
+static int
+hash_finish_sha256(struct hash_algo *algo, void *ctx, void *dest_buf, int size)
+{
+ int ret;
+
+ if (size < algo->digest_size)
+ return -1;
+
+ ret = mbedtls_sha256_finish((mbedtls_sha256_context *)ctx, dest_buf);
+ if (!ret) {
+ mbedtls_sha256_free((mbedtls_sha256_context *)ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_init_sha512(struct hash_algo *algo, void **ctxp)
+{
+ int ret;
+ int is384 = algo->digest_size == SHA384_SUM_LEN ? 1 : 0;
+ mbedtls_sha512_context *ctx = malloc(sizeof(mbedtls_sha512_context));
+
+ mbedtls_sha512_init(ctx);
+ ret = mbedtls_sha512_starts(ctx, is384);
+ if (!ret) {
+ *ctxp = ctx;
+ } else {
+ mbedtls_sha512_free(ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+static int hash_update_sha512(struct hash_algo *algo, void *ctx, const void *buf,
+ uint size, int is_last)
+{
+ return mbedtls_sha512_update((mbedtls_sha512_context *)ctx, buf, size);
+}
+
+static int
+hash_finish_sha512(struct hash_algo *algo, void *ctx, void *dest_buf, int size)
+{
+ int ret;
+
+ if (size < algo->digest_size)
+ return -1;
+
+ ret = mbedtls_sha512_finish((mbedtls_sha512_context *)ctx, dest_buf);
+ if (!ret) {
+ mbedtls_sha512_free((mbedtls_sha512_context *)ctx);
+ free(ctx);
+ }
+
+ return ret;
+}
+
+#else /* CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO) */
static int __maybe_unused hash_init_sha1(struct hash_algo *algo, void **ctxp)
{
@@ -144,6 +277,8 @@ static int __maybe_unused hash_finish_sha512(struct hash_algo *algo, void *ctx,
return 0;
}
+#endif /* CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO) */
+
static int hash_init_crc16_ccitt(struct hash_algo *algo, void **ctxp)
{
uint16_t *ctx = malloc(sizeof(uint16_t));
@@ -209,7 +344,11 @@ static struct hash_algo hash_algo[] = {
.name = "md5",
.digest_size = MD5_SUM_LEN,
.chunk_size = CHUNKSZ_MD5,
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = md5_wd_mb,
+#else
.hash_func_ws = md5_wd,
+#endif
},
#endif
#if CONFIG_IS_ENABLED(SHA1)
@@ -219,9 +358,13 @@ static struct hash_algo hash_algo[] = {
.chunk_size = CHUNKSZ_SHA1,
#if CONFIG_IS_ENABLED(SHA_HW_ACCEL)
.hash_func_ws = hw_sha1,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = sha1_csum_wd_mb,
#else
.hash_func_ws = sha1_csum_wd,
#endif
+#endif
#if CONFIG_IS_ENABLED(SHA_PROG_HW_ACCEL)
.hash_init = hw_sha_init,
.hash_update = hw_sha_update,
@@ -240,9 +383,13 @@ static struct hash_algo hash_algo[] = {
.chunk_size = CHUNKSZ_SHA256,
#if CONFIG_IS_ENABLED(SHA_HW_ACCEL)
.hash_func_ws = hw_sha256,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = sha256_csum_wd_mb,
#else
.hash_func_ws = sha256_csum_wd,
#endif
+#endif
#if CONFIG_IS_ENABLED(SHA_PROG_HW_ACCEL)
.hash_init = hw_sha_init,
.hash_update = hw_sha_update,
@@ -261,17 +408,27 @@ static struct hash_algo hash_algo[] = {
.chunk_size = CHUNKSZ_SHA384,
#if CONFIG_IS_ENABLED(SHA512_HW_ACCEL)
.hash_func_ws = hw_sha384,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = sha384_csum_wd_mb,
#else
.hash_func_ws = sha384_csum_wd,
#endif
+#endif
#if CONFIG_IS_ENABLED(SHA512_HW_ACCEL) && CONFIG_IS_ENABLED(SHA_PROG_HW_ACCEL)
.hash_init = hw_sha_init,
.hash_update = hw_sha_update,
.hash_finish = hw_sha_finish,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_init = hash_init_sha512,
+ .hash_update = hash_update_sha512,
+ .hash_finish = hash_finish_sha512,
#else
.hash_init = hash_init_sha384,
.hash_update = hash_update_sha384,
.hash_finish = hash_finish_sha384,
+#endif
#endif
},
#endif
@@ -282,9 +439,13 @@ static struct hash_algo hash_algo[] = {
.chunk_size = CHUNKSZ_SHA512,
#if CONFIG_IS_ENABLED(SHA512_HW_ACCEL)
.hash_func_ws = hw_sha512,
+#else
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ .hash_func_ws = sha512_csum_wd_mb,
#else
.hash_func_ws = sha512_csum_wd,
#endif
+#endif
#if CONFIG_IS_ENABLED(SHA512_HW_ACCEL) && CONFIG_IS_ENABLED(SHA_PROG_HW_ACCEL)
.hash_init = hw_sha_init,
.hash_update = hw_sha_update,
diff --git a/include/u-boot/hash-checksum.h b/include/u-boot/hash-checksum.h
index bcc6ba48fc..7f898b0b35 100644
--- a/include/u-boot/hash-checksum.h
+++ b/include/u-boot/hash-checksum.h
@@ -7,9 +7,15 @@
#define _RSA_CHECKSUM_H
#include <errno.h>
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/sha512.h>
+#else
#include <u-boot/sha1.h>
#include <u-boot/sha256.h>
#include <u-boot/sha512.h>
+#endif
struct image_region;
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 10/23] makefile: add mbedtls include directories
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (6 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 09/23] hash: integrate hash on mbedtls Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 11/23] efi_loader: switch sha256 to mbedtls Raymond Mao
` (15 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Add the mbedtls include directories into the build system.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
Makefile | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/Makefile b/Makefile
index 7321fe1499..80db1dfd8e 100644
--- a/Makefile
+++ b/Makefile
@@ -829,6 +829,12 @@ KBUILD_HOSTCFLAGS += $(if $(CONFIG_TOOLS_DEBUG),-g)
UBOOTINCLUDE := \
-Iinclude \
$(if $(KBUILD_SRC), -I$(srctree)/include) \
+ $(if $(KBUILD_SRC), \
+ $(if $(CONFIG_MBEDTLS_LIB), \
+ "-DMBEDTLS_CONFIG_FILE=\"mbedtls_def_config.h\"" \
+ -I$(srctree)/lib/mbedtls \
+ -I$(srctree)/lib/mbedtls/port \
+ -I$(srctree)/lib/mbedtls/external/mbedtls/include)) \
$(if $(CONFIG_$(SPL_)SYS_THUMB_BUILD), \
$(if $(CONFIG_HAS_THUMB2), \
$(if $(CONFIG_CPU_V7M), \
@@ -840,6 +846,13 @@ UBOOTINCLUDE := \
NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
+ifeq ($(CONFIG_MBEDTLS_LIB),y)
+PLATFORM_CPPFLAGS += "-DMBEDTLS_CONFIG_FILE=\"mbedtls_def_config.h\"" \
+ -I$(srctree)/lib/mbedtls \
+ -I$(srctree)/lib/mbedtls/port \
+ -I$(srctree)/lib/mbedtls/external/mbedtls/include
+endif
+
# FIX ME
cpp_flags := $(KBUILD_CPPFLAGS) $(PLATFORM_CPPFLAGS) $(UBOOTINCLUDE) \
$(NOSTDINC_FLAGS)
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 11/23] efi_loader: switch sha256 to mbedtls
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (7 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 10/23] makefile: add mbedtls include directories Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:22 ` Tom Rini
2024-04-16 19:00 ` [PATCH 12/23] image: " Raymond Mao
` (14 subsequent siblings)
23 siblings, 1 reply; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
When MBEDTLS_LIB_CRYPTO is enabled, use the APIs of sha256 from
hash shim layer instead.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
lib/efi_loader/efi_tcg2.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/lib/efi_loader/efi_tcg2.c b/lib/efi_loader/efi_tcg2.c
index ac056dcfc5..3c356abc6e 100644
--- a/lib/efi_loader/efi_tcg2.c
+++ b/lib/efi_loader/efi_tcg2.c
@@ -1321,12 +1321,21 @@ efi_status_t efi_tcg2_measure_dtb(void *dtb)
/* Measure populated areas of the DTB */
header = dtb;
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ sha256_starts_mb(&hash_ctx);
+ sha256_update_mb(&hash_ctx, (u8 *)header, sizeof(struct fdt_header));
+ sha256_update_mb(&hash_ctx, (u8 *)dtb + fdt_off_dt_struct(dtb), fdt_size_dt_strings(dtb));
+ sha256_update_mb(&hash_ctx, (u8 *)dtb + fdt_off_dt_strings(dtb), fdt_size_dt_struct(dtb));
+ sha256_update_mb(&hash_ctx, (u8 *)dtb + fdt_off_mem_rsvmap(dtb), rsvmap_size);
+ sha256_finish_mb(&hash_ctx, blob->data + blob->blob_description_size);
+#else
sha256_starts(&hash_ctx);
sha256_update(&hash_ctx, (u8 *)header, sizeof(struct fdt_header));
sha256_update(&hash_ctx, (u8 *)dtb + fdt_off_dt_struct(dtb), fdt_size_dt_strings(dtb));
sha256_update(&hash_ctx, (u8 *)dtb + fdt_off_dt_strings(dtb), fdt_size_dt_struct(dtb));
sha256_update(&hash_ctx, (u8 *)dtb + fdt_off_mem_rsvmap(dtb), rsvmap_size);
sha256_finish(&hash_ctx, blob->data + blob->blob_description_size);
+#endif
ret = measure_event(dev, 0, EV_POST_CODE, event_size, (u8 *)blob);
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 12/23] image: switch sha256 to mbedtls
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (8 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 11/23] efi_loader: switch sha256 to mbedtls Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 13/23] mbedtls/external: support MicroSoft Authentication Code Raymond Mao
` (13 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
When MBEDTLS_LIB_CRYPTO is enabled, use the APIs of sha256 from
hash shim layer instead.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
boot/image-pre-load.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/boot/image-pre-load.c b/boot/image-pre-load.c
index b504ab42a5..85d5ff3ab7 100644
--- a/boot/image-pre-load.c
+++ b/boot/image-pre-load.c
@@ -8,8 +8,11 @@
DECLARE_GLOBAL_DATA_PTR;
#include <image.h>
#include <mapmem.h>
-
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+#include <mbedtls/sha256.h>
+#else
#include <u-boot/sha256.h>
+#endif
/*
* Offset of the image
@@ -240,8 +243,13 @@ static int image_pre_load_sig_check_img_sig_sha256(struct image_sig_info *info,
goto out_sig_header;
}
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_CRYPTO)
+ sha256_csum_wd_mb(header + offset_img_sig, info->sig_size,
+ sha256_img_sig, CHUNKSZ_SHA256);
+#else
sha256_csum_wd(header + offset_img_sig, info->sig_size,
sha256_img_sig, CHUNKSZ_SHA256);
+#endif
ret = memcmp(sig_header->sha256_img_sig, sha256_img_sig, SHA256_SUM_LEN);
if (ret) {
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 13/23] mbedtls/external: support MicroSoft Authentication Code
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (9 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 12/23] image: " Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 14/23] mbedtls/external: support PKCS9 Authenticate Attributes Raymond Mao
` (12 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Populate MicroSoft Authentication Code from the content data
into PKCS7 decoding context if it exists in a PKCS7 message.
Add OIDs for describing objects using for MicroSoft Authentication
Code.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
.../external/mbedtls/include/mbedtls/oid.h | 30 ++++++++++
.../external/mbedtls/include/mbedtls/pkcs7.h | 10 ++++
lib/mbedtls/external/mbedtls/library/pkcs7.c | 60 +++++++++++++++----
3 files changed, 90 insertions(+), 10 deletions(-)
diff --git a/lib/mbedtls/external/mbedtls/include/mbedtls/oid.h b/lib/mbedtls/external/mbedtls/include/mbedtls/oid.h
index fdc25ebf88..2ee982808f 100644
--- a/lib/mbedtls/external/mbedtls/include/mbedtls/oid.h
+++ b/lib/mbedtls/external/mbedtls/include/mbedtls/oid.h
@@ -352,6 +352,36 @@
#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_128_CBC MBEDTLS_OID_PKCS12_PBE "\x05" /**< pbeWithSHAAnd128BitRC2-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 5} */
#define MBEDTLS_OID_PKCS12_PBE_SHA1_RC2_40_CBC MBEDTLS_OID_PKCS12_PBE "\x06" /**< pbeWithSHAAnd40BitRC2-CBC OBJECT IDENTIFIER ::= {pkcs-12PbeIds 6} */
+/*
+ * MicroSoft Authenticate Code OIDs
+ */
+#define MBEDTLS_OID_PRIVATE_ENTERPRISE MBEDTLS_OID_INTERNET "\x04\x01" /* {iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) */
+#define MBEDTLS_OID_MICROSOFT "\x82\x37" /* {microsoft(311)} */
+/*
+ * OID_msIndirectData: (1.3.6.1.4.1.311.2.1.4)
+ * {iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) microsoft(311) 2(2) 1(1) 4(4)}
+ */
+#define MBEDTLS_OID_MICROSOFT_INDIRECTDATA MBEDTLS_OID_PRIVATE_ENTERPRISE MBEDTLS_OID_MICROSOFT \
+ "\x02\x01\x04"
+/*
+ * OID_msStatementType: (1.3.6.1.4.1.311.2.1.11)
+ * {iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) microsoft(311) 2(2) 1(1) 11(11)}
+ */
+#define MBEDTLS_OID_MICROSOFT_STATETYPE MBEDTLS_OID_PRIVATE_ENTERPRISE MBEDTLS_OID_MICROSOFT \
+ "\x02\x01\x0b"
+/*
+ * OID_msSpOpusInfo: (1.3.6.1.4.1.311.2.1.12)
+ * {iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) microsoft(311) 2(2) 1(1) 12(12)}
+ */
+#define MBEDTLS_OID_MICROSOFT_SPOPUSINFO MBEDTLS_OID_PRIVATE_ENTERPRISE MBEDTLS_OID_MICROSOFT \
+ "\x02\x01\x0b"
+/*
+ * OID_msPeImageDataObjId: (1.3.6.1.4.1.311.2.1.15)
+ * {iso(1) identified-organization(3) dod(6) internet(1) private(4) enterprise(1) microsoft(311) 2(2) 1(1) 15(15)}
+ */
+#define MBEDTLS_OID_MICROSOFT_PEIMAGEDATA MBEDTLS_OID_PRIVATE_ENTERPRISE MBEDTLS_OID_MICROSOFT \
+ "\x02\x01\x0f"
+
/*
* EC key algorithms from RFC 5480
*/
diff --git a/lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h b/lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h
index e9b482208e..9e29b74af7 100644
--- a/lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h
+++ b/lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h
@@ -132,12 +132,22 @@ typedef struct mbedtls_pkcs7_signed_data {
}
mbedtls_pkcs7_signed_data;
+/* Content Data for MicroSoft Authentication Code using in U-Boot Secure Boot */
+typedef struct mbedtls_pkcs7_conten_data {
+ int data_type; /* Type of Data */
+ size_t data_len; /* Length of Data */
+ size_t data_hdrlen; /* Length of Data ASN.1 header */
+ void *data; /* Content Data */
+}
+mbedtls_pkcs7_conten_data;
+
/**
* Structure holding PKCS #7 structure, only signed data for now
*/
typedef struct mbedtls_pkcs7 {
mbedtls_pkcs7_buf MBEDTLS_PRIVATE(raw);
mbedtls_pkcs7_signed_data MBEDTLS_PRIVATE(signed_data);
+ mbedtls_pkcs7_conten_data content_data;
}
mbedtls_pkcs7;
diff --git a/lib/mbedtls/external/mbedtls/library/pkcs7.c b/lib/mbedtls/external/mbedtls/library/pkcs7.c
index 3aac662ba6..0c2436b56b 100644
--- a/lib/mbedtls/external/mbedtls/library/pkcs7.c
+++ b/lib/mbedtls/external/mbedtls/library/pkcs7.c
@@ -29,6 +29,13 @@
#include <time.h>
#endif
+enum OID {
+ /* PKCS#7 {iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-7(7)} */
+ MBEDTLS_OID_DATA = 13, /* 1.2.840.113549.1.7.1 */
+ /* Microsoft Authenticode & Software Publishing */
+ MBEDTLS_OID_MS_INDIRECTDATA = 24, /* 1.3.6.1.4.1.311.2.1.4 */
+};
+
/**
* Initializes the mbedtls_pkcs7 structure.
*/
@@ -449,7 +456,7 @@ cleanup:
* signerInfos SignerInfos }
*/
static int pkcs7_get_signed_data(unsigned char *buf, size_t buflen,
- mbedtls_pkcs7_signed_data *signed_data)
+ mbedtls_pkcs7 *pkcs7)
{
unsigned char *p = buf;
unsigned char *end = buf + buflen;
@@ -457,6 +464,7 @@ static int pkcs7_get_signed_data(unsigned char *buf, size_t buflen,
size_t len = 0;
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
mbedtls_md_type_t md_alg;
+ mbedtls_pkcs7_signed_data *signed_data = &pkcs7->signed_data;
ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_CONSTRUCTED
| MBEDTLS_ASN1_SEQUENCE);
@@ -493,25 +501,57 @@ static int pkcs7_get_signed_data(unsigned char *buf, size_t buflen,
if (ret != 0) {
return ret;
}
- if (MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS7_DATA, &content_type)) {
+
+ /*
+ * We should only support 1.2.840.113549.1.7.1 (PKCS7 DATA) and
+ * 1.3.6.1.4.1.311.2.1.4 (MicroSoft Authentication Code) that is for
+ * U-Boot Secure Boot
+ */
+ if (!MBEDTLS_OID_CMP(MBEDTLS_OID_PKCS7_DATA, &content_type)) {
+ pkcs7->content_data.data_type = MBEDTLS_OID_DATA;
+ } else if (!MBEDTLS_OID_CMP(MBEDTLS_OID_MICROSOFT_INDIRECTDATA,
+ &content_type)) {
+ pkcs7->content_data.data_type = MBEDTLS_OID_MS_INDIRECTDATA;
+ } else {
return MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO;
}
if (p != end_content_info) {
+ unsigned char *tmp_p = p;
+
/* Determine if valid content is present */
ret = mbedtls_asn1_get_tag(&p,
end_content_info,
&len,
- MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_CONTEXT_SPECIFIC);
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC);
+ if (ret != 0 || p + len != end_content_info) {
+ return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO,
+ ret);
+ }
+
+ /*
+ * U-Boot Secure Boot needs to calculate the digest of MicroSoft
+ * Authentication Code during verifying an EFI image.
+ * Thus we need to save the context of Content Data.
+ */
+ pkcs7->content_data.data_hdrlen = p - tmp_p;
+ /* Parse the content data from a sequence */
+ ret = mbedtls_asn1_get_tag(&p, end_content_info, &len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SEQUENCE);
if (ret != 0) {
- return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO, ret);
+ /* TODO: Other Content Data formats are not supported at the moment */
+ return MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE;
+ } else if (p + len != end_content_info) {
+ return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO,
+ ret);
}
+
+ pkcs7->content_data.data = p;
+ pkcs7->content_data.data_len = len;
+
p += len;
- if (p != end_content_info) {
- return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO, ret);
- }
- /* Valid content is present - this is not supported */
- return MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE;
}
/* Look for certificates, there may or may not be any */
@@ -624,7 +664,7 @@ int mbedtls_pkcs7_parse_der(mbedtls_pkcs7 *pkcs7, const unsigned char *buf,
}
try_data:
- ret = pkcs7_get_signed_data(p, len, &pkcs7->signed_data);
+ ret = pkcs7_get_signed_data(p, len, pkcs7);
if (ret != 0) {
goto out;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 14/23] mbedtls/external: support PKCS9 Authenticate Attributes
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (10 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 13/23] mbedtls/external: support MicroSoft Authentication Code Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 15/23] mbedtls/external: support decoding multiple signer's cert Raymond Mao
` (11 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Populate PKCS9 Authenticate Attributes from signer info if it exists
in a PKCS7 message.
Add OIDs for describing objects using for Authenticate Attributes.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
.../external/mbedtls/include/mbedtls/oid.h | 5 +++++
.../external/mbedtls/include/mbedtls/pkcs7.h | 11 +++++++++++
lib/mbedtls/external/mbedtls/library/pkcs7.c | 19 ++++++++++++++++++-
3 files changed, 34 insertions(+), 1 deletion(-)
diff --git a/lib/mbedtls/external/mbedtls/include/mbedtls/oid.h b/lib/mbedtls/external/mbedtls/include/mbedtls/oid.h
index 2ee982808f..43cef99f1e 100644
--- a/lib/mbedtls/external/mbedtls/include/mbedtls/oid.h
+++ b/lib/mbedtls/external/mbedtls/include/mbedtls/oid.h
@@ -238,6 +238,11 @@
#define MBEDTLS_OID_RSA_SHA_OBS "\x2B\x0E\x03\x02\x1D"
#define MBEDTLS_OID_PKCS9_EMAIL MBEDTLS_OID_PKCS9 "\x01" /**< emailAddress AttributeType ::= { pkcs-9 1 } */
+#define MBEDTLS_OID_PKCS9_CONTENTTYPE MBEDTLS_OID_PKCS9 "\x03" /**< contentType AttributeType ::= { pkcs-9 3 } */
+#define MBEDTLS_OID_PKCS9_MESSAGEDIGEST MBEDTLS_OID_PKCS9 "\x04" /**< messageDigest AttributeType ::= { pkcs-9 4 } */
+#define MBEDTLS_OID_PKCS9_SIGNINGTIME MBEDTLS_OID_PKCS9 "\x05" /**< signingTime AttributeType ::= { pkcs-9 5 } */
+#define MBEDTLS_OID_PKCS9_SMIMECAP MBEDTLS_OID_PKCS9 "\x0f" /**< smimeCapabilites AttributeType ::= { pkcs-9 15 } */
+#define MBEDTLS_OID_PKCS9_SMIMEAA MBEDTLS_OID_PKCS9 "\x10\x02\x0b" /**< smimeCapabilites AttributeType ::= { pkcs-9 16 2 11} */
/* RFC 4055 */
#define MBEDTLS_OID_RSASSA_PSS MBEDTLS_OID_PKCS1 "\x0a" /**< id-RSASSA-PSS ::= { pkcs-1 10 } */
diff --git a/lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h b/lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h
index 9e29b74af7..a88a5e858f 100644
--- a/lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h
+++ b/lib/mbedtls/external/mbedtls/include/mbedtls/pkcs7.h
@@ -102,6 +102,16 @@ typedef enum {
}
mbedtls_pkcs7_type;
+/*
+ * Authenticate Attributes for MicroSoft Authentication Code using in U-Boot
+ * Secure Boot
+ */
+typedef struct mbedtls_pkcs7_authattrs {
+ size_t data_len;
+ void *data;
+}
+mbedtls_pkcs7_authattrs;
+
/**
* Structure holding PKCS #7 signer info
*/
@@ -113,6 +123,7 @@ typedef struct mbedtls_pkcs7_signer_info {
mbedtls_x509_buf MBEDTLS_PRIVATE(alg_identifier);
mbedtls_x509_buf MBEDTLS_PRIVATE(sig_alg_identifier);
mbedtls_x509_buf MBEDTLS_PRIVATE(sig);
+ mbedtls_pkcs7_authattrs authattrs;
struct mbedtls_pkcs7_signer_info *MBEDTLS_PRIVATE(next);
}
mbedtls_pkcs7_signer_info;
diff --git a/lib/mbedtls/external/mbedtls/library/pkcs7.c b/lib/mbedtls/external/mbedtls/library/pkcs7.c
index 0c2436b56b..da73fb341d 100644
--- a/lib/mbedtls/external/mbedtls/library/pkcs7.c
+++ b/lib/mbedtls/external/mbedtls/library/pkcs7.c
@@ -288,6 +288,7 @@ static int pkcs7_get_signer_info(unsigned char **p, unsigned char *end,
unsigned char *end_signer, *end_issuer_and_sn;
int asn1_ret = 0, ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
size_t len = 0;
+ unsigned char *tmp_p;
asn1_ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_CONSTRUCTED
| MBEDTLS_ASN1_SEQUENCE);
@@ -349,7 +350,23 @@ static int pkcs7_get_signer_info(unsigned char **p, unsigned char *end,
goto out;
}
- /* Assume authenticatedAttributes is nonexistent */
+ /* Save authenticatedAttributes if present */
+ if (*p < end_signer &&
+ **p == (MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0)) {
+ tmp_p = *p;
+
+ ret = mbedtls_asn1_get_tag(p, end_signer, &len,
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC |
+ MBEDTLS_ASN1_CONSTRUCTED | 0);
+ if (ret != 0) {
+ goto out;
+ }
+
+ signer->authattrs.data = tmp_p;
+ signer->authattrs.data_len = len + *p - tmp_p;
+ *p += len;
+ }
+
ret = pkcs7_get_digest_algorithm(p, end_signer, &signer->sig_alg_identifier);
if (ret != 0) {
goto out;
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 15/23] mbedtls/external: support decoding multiple signer's cert
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (11 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 14/23] mbedtls/external: support PKCS9 Authenticate Attributes Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 16/23] mbedtls/external: update MbedTLS PKCS7 test suites Raymond Mao
` (10 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Support decoding multiple signer's cert in the signed data within
a PKCS7 message.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
lib/mbedtls/external/mbedtls/library/pkcs7.c | 75 ++++++++++++--------
1 file changed, 47 insertions(+), 28 deletions(-)
diff --git a/lib/mbedtls/external/mbedtls/library/pkcs7.c b/lib/mbedtls/external/mbedtls/library/pkcs7.c
index da73fb341d..01105227d7 100644
--- a/lib/mbedtls/external/mbedtls/library/pkcs7.c
+++ b/lib/mbedtls/external/mbedtls/library/pkcs7.c
@@ -61,6 +61,36 @@ static int pkcs7_get_next_content_len(unsigned char **p, unsigned char *end,
return ret;
}
+/**
+ * Get and decode one cert from a sequence.
+ * Return 0 for success,
+ * Return negative error code for failure.
+ **/
+static int pkcs7_get_one_cert(unsigned char **p, unsigned char *end,
+ mbedtls_x509_crt *certs)
+{
+ int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+ size_t len = 0;
+ unsigned char *start = *p;
+ unsigned char *end_cert;
+
+ ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_CONSTRUCTED
+ | MBEDTLS_ASN1_SEQUENCE);
+ if (ret != 0) {
+ return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_CERT, ret);
+ }
+
+ end_cert = *p + len;
+
+ if ((ret = mbedtls_x509_crt_parse_der(certs, start, end_cert - start)) < 0) {
+ return MBEDTLS_ERR_PKCS7_INVALID_CERT;
+ }
+
+ *p = end_cert;
+
+ return 0;
+}
+
/**
* version Version
* Version ::= INTEGER
@@ -178,11 +208,12 @@ static int pkcs7_get_certificates(unsigned char **p, unsigned char *end,
mbedtls_x509_crt *certs)
{
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
- size_t len1 = 0;
- size_t len2 = 0;
- unsigned char *end_set, *end_cert, *start;
+ size_t len = 0;
+ unsigned char *end_set;
+ int num_of_certs = 0;
- ret = mbedtls_asn1_get_tag(p, end, &len1, MBEDTLS_ASN1_CONSTRUCTED
+ /* Get the set of certs */
+ ret = mbedtls_asn1_get_tag(p, end, &len, MBEDTLS_ASN1_CONSTRUCTED
| MBEDTLS_ASN1_CONTEXT_SPECIFIC);
if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
return 0;
@@ -190,38 +221,26 @@ static int pkcs7_get_certificates(unsigned char **p, unsigned char *end,
if (ret != 0) {
return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_FORMAT, ret);
}
- start = *p;
- end_set = *p + len1;
+ end_set = *p + len;
- ret = mbedtls_asn1_get_tag(p, end_set, &len2, MBEDTLS_ASN1_CONSTRUCTED
- | MBEDTLS_ASN1_SEQUENCE);
+ ret = pkcs7_get_one_cert(p, end_set, certs);
if (ret != 0) {
- return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_PKCS7_INVALID_CERT, ret);
+ return ret;
}
- end_cert = *p + len2;
+ num_of_certs++;
- /*
- * This is to verify that there is only one signer certificate. It seems it is
- * not easy to differentiate between the chain vs different signer's certificate.
- * So, we support only the root certificate and the single signer.
- * The behaviour would be improved with addition of multiple signer support.
- */
- if (end_cert != end_set) {
- return MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE;
- }
-
- if ((ret = mbedtls_x509_crt_parse_der(certs, start, len1)) < 0) {
- return MBEDTLS_ERR_PKCS7_INVALID_CERT;
+ while (*p != end_set) {
+ ret = pkcs7_get_one_cert(p, end_set, certs);
+ if (ret != 0) {
+ return ret;
+ }
+ num_of_certs++;
}
- *p = end_cert;
+ *p = end_set;
- /*
- * Since in this version we strictly support single certificate, and reaching
- * here implies we have parsed successfully, we return 1.
- */
- return 1;
+ return num_of_certs;
}
/**
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 16/23] mbedtls/external: update MbedTLS PKCS7 test suites
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (12 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 15/23] mbedtls/external: support decoding multiple signer's cert Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 17/23] lib/crypto: Port public_key on MbedTLS Raymond Mao
` (9 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Update the PKCS7 test suites for multiple certs.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
.../external/mbedtls/tests/suites/test_suite_pkcs7.data | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs7.data b/lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs7.data
index d3b83cdf0a..2dd1c56109 100644
--- a/lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs7.data
+++ b/lib/mbedtls/external/mbedtls/tests/suites/test_suite_pkcs7.data
@@ -14,9 +14,9 @@ PKCS7 Signed Data Parse with zero signers
depends_on:MBEDTLS_MD_CAN_SHA256
pkcs7_parse:"data_files/pkcs7_data_no_signers.der":MBEDTLS_PKCS7_SIGNED_DATA
-PKCS7 Signed Data Parse Fail with multiple certs #4
+PKCS7 Signed Data Parse Pass with multiple certs #4
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
-pkcs7_parse:"data_files/pkcs7_data_multiple_certs_signed.der":MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE
+pkcs7_parse:"data_files/pkcs7_data_multiple_certs_signed.der":MBEDTLS_PKCS7_SIGNED_DATA
PKCS7 Signed Data Parse Fail with corrupted cert #5.0
depends_on:MBEDTLS_MD_CAN_SHA256:MBEDTLS_RSA_C
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 17/23] lib/crypto: Port public_key on MbedTLS
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (13 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 16/23] mbedtls/external: update MbedTLS PKCS7 test suites Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 18/23] lib/crypto: Port x509_cert_parser " Raymond Mao
` (8 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Integrate function public_key_verify_signature on top of MbedTLS
pk library.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
include/crypto/public_key.h | 6 +++
lib/crypto/asymmetric_type.c | 2 +-
lib/crypto/public_key.c | 75 ++++++++++++++++++++++++++++++++++++
3 files changed, 82 insertions(+), 1 deletion(-)
diff --git a/include/crypto/public_key.h b/include/crypto/public_key.h
index 3ba90fcc34..55cd4c2b01 100644
--- a/include/crypto/public_key.h
+++ b/include/crypto/public_key.h
@@ -12,6 +12,12 @@
#ifdef __UBOOT__
#include <linux/types.h>
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+#include <external/mbedtls/library/common.h>
+#include <external/mbedtls/include/mbedtls/pk.h>
+#include <external/mbedtls/include/mbedtls/x509_crt.h>
+#include <external/mbedtls/include/mbedtls/md.h>
+#endif
#else
#include <linux/keyctl.h>
#endif
diff --git a/lib/crypto/asymmetric_type.c b/lib/crypto/asymmetric_type.c
index 24c2d15ef9..95b82cd8e8 100644
--- a/lib/crypto/asymmetric_type.c
+++ b/lib/crypto/asymmetric_type.c
@@ -12,7 +12,6 @@
#include <keys/asymmetric-subtype.h>
#include <keys/asymmetric-parser.h>
#endif
-#include <crypto/public_key.h>
#ifdef __UBOOT__
#include <linux/bug.h>
#include <linux/compat.h>
@@ -26,6 +25,7 @@
#include <linux/slab.h>
#include <linux/ctype.h>
#endif
+#include <crypto/public_key.h>
#ifdef __UBOOT__
#include <keys/asymmetric-type.h>
#else
diff --git a/lib/crypto/public_key.c b/lib/crypto/public_key.c
index 6efe951c05..29576684f1 100644
--- a/lib/crypto/public_key.c
+++ b/lib/crypto/public_key.c
@@ -94,6 +94,80 @@ EXPORT_SYMBOL_GPL(public_key_signature_free);
*
* Return: 0 - verified, non-zero error code - otherwise
*/
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+int public_key_verify_signature(const struct public_key *pkey,
+ const struct public_key_signature *sig)
+{
+ mbedtls_md_type_t mb_hash_algo;
+ mbedtls_pk_context pk_ctx;
+ int ret;
+
+ if (!pkey || !sig || pkey->key_is_private)
+ return -EINVAL;
+
+ /*
+ * ECRDSA (Elliptic Curve RedDSA) from Red Hat is not supported by
+ * MbedTLS
+ */
+ if (strcmp(pkey->pkey_algo, "rsa")) {
+ pr_err("Encryption is not RSA: %s\n", sig->pkey_algo);
+ return -EINVAL;
+ }
+
+ /*
+ * Can be pkcs1 or raw, but pkcs1 is expected.
+ * This is just for argument checking, not necessarily passed to MbedTLS,
+ * For RSA signatures, MbedTLS typically supports the PKCS#1 v1.5
+ * (aka. pkcs1) encoding by default.
+ * The library internally handles the details of decoding and verifying
+ * the signature according to the expected encoding for the specified algorithm.
+ */
+ if (strcmp(sig->encoding, "pkcs1")) {
+ pr_err("Encoding %s is not supported, only supports pkcs1\n",
+ sig->encoding);
+ return -EINVAL;
+ }
+
+ if (!strcmp(sig->hash_algo, "sha1"))
+ mb_hash_algo = MBEDTLS_MD_SHA1;
+ else if (!strcmp(sig->hash_algo, "sha224"))
+ mb_hash_algo = MBEDTLS_MD_SHA224;
+ else if (!strcmp(sig->hash_algo, "sha256"))
+ mb_hash_algo = MBEDTLS_MD_SHA256;
+ else if (!strcmp(sig->hash_algo, "sha384"))
+ mb_hash_algo = MBEDTLS_MD_SHA384;
+ else if (!strcmp(sig->hash_algo, "sha512"))
+ mb_hash_algo = MBEDTLS_MD_SHA512;
+ else /* Unknown or unsupported hash algorithm */
+ return -EINVAL;
+ /* Initialize the mbedtls_pk_context with RSA key type */
+ mbedtls_pk_init(&pk_ctx);
+
+ /* Parse the DER-encoded public key */
+ ret = mbedtls_pk_parse_public_key(&pk_ctx, pkey->key, pkey->keylen);
+ if (ret) {
+ pr_err("Failed to parse public key, ret:-0x%04x\n",
+ (unsigned int)-ret);
+ ret = -EINVAL;
+ goto err_key;
+ }
+
+ /* Ensure that it is a RSA key */
+ if (mbedtls_pk_get_type(&pk_ctx) != MBEDTLS_PK_RSA) {
+ pr_err("Only RSA keys are supported\n");
+ ret = -EKEYREJECTED;
+ goto err_key;
+ }
+
+ /* Verify the hash */
+ ret = mbedtls_pk_verify(&pk_ctx, mb_hash_algo, sig->digest,
+ sig->digest_size, sig->s, sig->s_size);
+
+err_key:
+ mbedtls_pk_free(&pk_ctx);
+ return ret;
+}
+#else /* !CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
int public_key_verify_signature(const struct public_key *pkey,
const struct public_key_signature *sig)
{
@@ -142,6 +216,7 @@ int public_key_verify_signature(const struct public_key *pkey,
pr_devel("<==%s() = %d\n", __func__, ret);
return ret;
}
+#endif /* CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
#else
/*
* Destroy a public key algorithm key.
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 18/23] lib/crypto: Port x509_cert_parser on MbedTLS
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (14 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 17/23] lib/crypto: Port public_key on MbedTLS Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 19/23] lib/crypto: port PKCS7 parser " Raymond Mao
` (7 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Integrate x509_cert_parser on top of MbedTLS x509 library.
Add API x509_populate_cert and x509_populate_pubkey for code
reusability between x509 and pkcs7 parsers.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
include/crypto/x509_parser.h | 34 +++
lib/crypto/x509_cert_parser.c | 430 ++++++++++++++++++++++++++++++++++
2 files changed, 464 insertions(+)
diff --git a/include/crypto/x509_parser.h b/include/crypto/x509_parser.h
index 4cbdc1d661..6048e2fa4f 100644
--- a/include/crypto/x509_parser.h
+++ b/include/crypto/x509_parser.h
@@ -11,8 +11,36 @@
#include <linux/time.h>
#include <crypto/public_key.h>
#include <keys/asymmetric-type.h>
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+#include <image.h>
+#include <external/mbedtls/include/mbedtls/error.h>
+#include <external/mbedtls/include/mbedtls/asn1.h>
+#endif
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+/* Backup of part of the parsing context */
+struct x509_cert_mbedtls_ctx {
+ void *tbs; /* Signed data */
+ void *raw_serial; /* Raw serial number in ASN.1 */
+ void *raw_issuer; /* Raw issuer name in ASN.1 */
+ void *raw_subject; /* Raw subject name in ASN.1 */
+ void *raw_skid; /* Raw subjectKeyId in ASN.1 */
+};
+#endif
+
+/*
+ * MbedTLS integration Notes:
+ *
+ * Fields we don't need to populate from MbedTLS:
+ * 'raw_sig' and 'raw_sig_size' are buffer for x509_parse_context,
+ * not needed for MbedTLS.
+ * 'signer' and 'seen' are used internally by pkcs7_verify.
+ * 'verified' is not inuse.
+ */
struct x509_certificate {
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+ struct x509_cert_mbedtls_ctx *mbedtls_ctx;
+#endif
struct x509_certificate *next;
struct x509_certificate *signer; /* Certificate that signed this one */
struct public_key *pub; /* Public key details */
@@ -48,6 +76,12 @@ struct x509_certificate {
* x509_cert_parser.c
*/
extern void x509_free_certificate(struct x509_certificate *cert);
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+int x509_populate_pubkey(mbedtls_x509_crt *cert, struct public_key **pub_key);
+int x509_populate_cert(mbedtls_x509_crt *mbedtls_cert,
+ struct x509_certificate **pcert);
+time64_t x509_get_timestamp(const mbedtls_x509_time *x509_time);
+#endif
extern struct x509_certificate *x509_cert_parse(const void *data, size_t datalen);
extern int x509_decode_time(time64_t *_t, size_t hdrlen,
unsigned char tag,
diff --git a/lib/crypto/x509_cert_parser.c b/lib/crypto/x509_cert_parser.c
index a0f0689118..4c5b802afa 100644
--- a/lib/crypto/x509_cert_parser.c
+++ b/lib/crypto/x509_cert_parser.c
@@ -25,8 +25,10 @@
#else
#include "x509_parser.h"
#endif
+#if !CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
#include "x509.asn1.h"
#include "x509_akid.asn1.h"
+#endif
struct x509_parse_context {
struct x509_certificate *cert; /* Certificate being constructed */
@@ -52,6 +54,270 @@ struct x509_parse_context {
unsigned akid_raw_issuer_size;
};
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+
+static void x509_free_mbedtls_ctx(struct x509_cert_mbedtls_ctx *ctx)
+{
+ if (ctx) {
+ kfree(ctx->tbs);
+ kfree(ctx->raw_serial);
+ kfree(ctx->raw_issuer);
+ kfree(ctx->raw_subject);
+ kfree(ctx->raw_skid);
+ kfree(ctx);
+ }
+}
+
+static int x509_set_cert_flags(struct x509_certificate *cert)
+{
+ struct public_key_signature *sig = cert->sig;
+
+ if (!sig || !cert->pub) {
+ pr_err("Signature or public key is not initialized\n");
+ return -ENOPKG;
+ }
+
+ if (!cert->pub->pkey_algo)
+ cert->unsupported_key = true;
+
+ if (!sig->pkey_algo)
+ cert->unsupported_sig = true;
+
+ if (!sig->hash_algo)
+ cert->unsupported_sig = true;
+
+ /* TODO: is_hash_blacklisted()? */
+
+ /* Detect self-signed certificates and set self_signed flag */
+ return x509_check_for_self_signed(cert);
+}
+
+time64_t x509_get_timestamp(const mbedtls_x509_time *x509_time)
+{
+ unsigned int year, mon, day, hour, min, sec;
+
+ /* Adjust for year since 1900 */
+ year = x509_time->year - 1900;
+ /* Adjust for 0-based month */
+ mon = x509_time->mon - 1;
+ day = x509_time->day;
+ hour = x509_time->hour;
+ min = x509_time->min;
+ sec = x509_time->sec;
+
+ return (time64_t)mktime64(year, mon, day, hour, min, sec);
+}
+
+static char *x509_populate_dn_name_string(const mbedtls_x509_name *name)
+{
+ size_t len = 256;
+ size_t wb;
+ char *name_str;
+
+ do {
+ name_str = kzalloc(len, GFP_KERNEL);
+ if (!name_str)
+ return NULL;
+
+ wb = mbedtls_x509_dn_gets(name_str, len, name);
+ if (wb < 0) {
+ pr_err("Get DN string failed, ret:-0x%04x\n",
+ (unsigned int)-wb);
+ kfree(name_str);
+ len = len * 2; /* Try with a bigger buffer */
+ }
+ } while (wb < 0);
+
+ name_str[wb] = '\0'; /* add the terminator */
+
+ return name_str;
+}
+
+static int x509_populate_signature_params(const mbedtls_x509_crt *cert,
+ struct public_key_signature **sig)
+{
+ struct public_key_signature *s;
+ struct image_region region;
+ size_t akid_len;
+ unsigned char *akid_data;
+ int ret;
+
+ /* Check if signed data exist */
+ if (!cert->tbs.p || !cert->tbs.len)
+ return -EINVAL;
+
+ region.data = cert->tbs.p;
+ region.size = cert->tbs.len;
+
+ s = kzalloc(sizeof(*s), GFP_KERNEL);
+ if (!s)
+ return -ENOMEM;
+
+ /*
+ * Get the public key algorithm.
+ * Note: ECRDSA (Elliptic Curve RedDSA) from Red Hat is not supported by
+ * MbedTLS.
+ */
+ switch (cert->sig_pk) {
+ case MBEDTLS_PK_RSA:
+ s->pkey_algo = "rsa";
+ break;
+ default:
+ ret = -EINVAL;
+ goto error_sig;
+ }
+
+ /* Get the hash algorithm */
+ switch (cert->sig_md) {
+ case MBEDTLS_MD_SHA1:
+ s->hash_algo = "sha1";
+ s->digest_size = SHA1_SUM_LEN;
+ break;
+ case MBEDTLS_MD_SHA256:
+ s->hash_algo = "sha256";
+ s->digest_size = SHA256_SUM_LEN;
+ break;
+ case MBEDTLS_MD_SHA384:
+ s->hash_algo = "sha384";
+ s->digest_size = SHA384_SUM_LEN;
+ break;
+ case MBEDTLS_MD_SHA512:
+ s->hash_algo = "sha512";
+ s->digest_size = SHA512_SUM_LEN;
+ break;
+ /* Unsupported algo */
+ case MBEDTLS_MD_MD5:
+ case MBEDTLS_MD_SHA224:
+ default:
+ ret = -EINVAL;
+ goto error_sig;
+ }
+
+ /*
+ * Optional attributes:
+ * auth_ids holds AuthorityKeyIdentifier (information of issuer),
+ * aka akid, which is used to match with a cert's id or skid to
+ * indicate that is the issuer when we lookup a cert chain.
+ *
+ * auth_ids[0]:
+ * [PKCS#7 or CMS ver 1] - generated from "Issuer + Serial number"
+ * [CMS ver 3] - generated from skid (subjectKeyId)
+ * auth_ids[1]: generated from skid (subjectKeyId)
+ *
+ * Assume that we are using PKCS#7 (msg->version=1),
+ * not CMS ver 3 (msg->version=3).
+ */
+ akid_len = cert->authority_key_id.authorityCertSerialNumber.len;
+ akid_data = cert->authority_key_id.authorityCertSerialNumber.p;
+
+ /* Check if serial number exists */
+ if (akid_len && akid_data) {
+ s->auth_ids[0] = asymmetric_key_generate_id(akid_data,
+ akid_len,
+ cert->issuer_raw.p,
+ cert->issuer_raw.len);
+ if (!s->auth_ids[0]) {
+ ret = -ENOMEM;
+ goto error_sig;
+ }
+ }
+
+ akid_len = cert->authority_key_id.keyIdentifier.len;
+ akid_data = cert->authority_key_id.keyIdentifier.p;
+
+ /* Check if subjectKeyId exists */
+ if (akid_len && akid_data) {
+ s->auth_ids[1] = asymmetric_key_generate_id(akid_data,
+ akid_len,
+ "", 0);
+ if (!s->auth_ids[1]) {
+ ret = -ENOMEM;
+ goto error_sig;
+ }
+ }
+
+ /*
+ * Encoding can be pkcs1 or raw, but only pkcs1 is supported.
+ * Set the encoding explicitly to pkcs1.
+ */
+ s->encoding = "pkcs1";
+
+ /* Copy the signature data */
+ s->s = kmemdup(cert->sig.p, cert->sig.len, GFP_KERNEL);
+ if (!s->s) {
+ ret = -ENOMEM;
+ goto error_sig;
+ }
+ s->s_size = cert->sig.len;
+
+ /* Calculate the digest of signed data (tbs) */
+ s->digest = kzalloc(s->digest_size, GFP_KERNEL);
+ if (!s->digest) {
+ ret = -ENOMEM;
+ goto error_sig;
+ }
+
+ ret = hash_calculate(s->hash_algo, ®ion, 1, s->digest);
+ if (!ret)
+ *sig = s;
+
+ return ret;
+
+error_sig:
+ public_key_signature_free(s);
+ return ret;
+}
+
+static int x509_save_mbedtls_ctx(const mbedtls_x509_crt *cert,
+ struct x509_cert_mbedtls_ctx **pctx)
+{
+ struct x509_cert_mbedtls_ctx *ctx;
+
+ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ if (!ctx)
+ return -ENOMEM;
+
+ /* Signed data (tbs - The part that is To Be Signed)*/
+ ctx->tbs = kmemdup(cert->tbs.p, cert->tbs.len,
+ GFP_KERNEL);
+ if (!ctx->tbs)
+ goto error_ctx;
+
+ /* Raw serial number */
+ ctx->raw_serial = kmemdup(cert->serial.p,
+ cert->serial.len, GFP_KERNEL);
+ if (!ctx->raw_serial)
+ goto error_ctx;
+
+ /* Raw issuer */
+ ctx->raw_issuer = kmemdup(cert->issuer_raw.p,
+ cert->issuer_raw.len, GFP_KERNEL);
+ if (!ctx->raw_issuer)
+ goto error_ctx;
+
+ /* Raw subject */
+ ctx->raw_subject = kmemdup(cert->subject_raw.p,
+ cert->subject_raw.len, GFP_KERNEL);
+ if (!ctx->raw_subject)
+ goto error_ctx;
+
+ /* Raw subjectKeyId */
+ ctx->raw_skid = kmemdup(cert->subject_key_id.p,
+ cert->subject_key_id.len, GFP_KERNEL);
+ if (!ctx->raw_skid)
+ goto error_ctx;
+
+ *pctx = ctx;
+
+ return 0;
+
+error_ctx:
+ x509_free_mbedtls_ctx(ctx);
+ return -ENOMEM;
+}
+
+#endif /* CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
+
/*
* Free an X.509 certificate
*/
@@ -64,11 +330,174 @@ void x509_free_certificate(struct x509_certificate *cert)
kfree(cert->subject);
kfree(cert->id);
kfree(cert->skid);
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+ x509_free_mbedtls_ctx(cert->mbedtls_ctx);
+#endif
kfree(cert);
}
}
EXPORT_SYMBOL_GPL(x509_free_certificate);
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+int x509_populate_pubkey(mbedtls_x509_crt *cert, struct public_key **pub_key)
+{
+ struct public_key *pk;
+
+ pk = kzalloc(sizeof(*pk), GFP_KERNEL);
+ if (!pk)
+ return -ENOMEM;
+
+ pk->key = kzalloc(cert->pk_raw.len, GFP_KERNEL);
+ if (!pk->key) {
+ kfree(pk);
+ return -ENOMEM;
+ }
+ memcpy(pk->key, cert->pk_raw.p, cert->pk_raw.len);
+ pk->keylen = cert->pk_raw.len;
+
+ /*
+ * For ECC keys, params field might include information about the curve used,
+ * the generator point, or other algorithm-specific parameters.
+ * For RSA keys, it's common for the params field to be NULL.
+ * FIXME: Assume that we just support RSA keys with id_type X509.
+ */
+ pk->params = NULL;
+ pk->paramlen = 0;
+
+ pk->key_is_private = false;
+ pk->id_type = "X509";
+ pk->pkey_algo = "rsa";
+ pk->algo = OID_rsaEncryption;
+
+ *pub_key = pk;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(x509_populate_pubkey);
+
+int x509_populate_cert(mbedtls_x509_crt *mbedtls_cert,
+ struct x509_certificate **pcert)
+{
+ struct x509_certificate *cert;
+ struct asymmetric_key_id *kid;
+ struct asymmetric_key_id *skid;
+ int ret;
+
+ cert = kzalloc(sizeof(*cert), GFP_KERNEL);
+ if (!cert)
+ return -ENOMEM;
+
+ /* Public key details */
+ ret = x509_populate_pubkey(mbedtls_cert, &cert->pub);
+ if (ret)
+ goto error_cert_pop;
+
+ /* Signature parameters */
+ ret = x509_populate_signature_params(mbedtls_cert, &cert->sig);
+ if (ret)
+ goto error_cert_pop;
+
+ ret = -ENOMEM;
+
+ /* Name of certificate issuer */
+ cert->issuer = x509_populate_dn_name_string(&mbedtls_cert->issuer);
+ if (!cert->issuer)
+ goto error_cert_pop;
+
+ /* Name of certificate subject */
+ cert->subject = x509_populate_dn_name_string(&mbedtls_cert->subject);
+ if (!cert->subject)
+ goto error_cert_pop;
+
+ /* Certificate validity */
+ cert->valid_from = x509_get_timestamp(&mbedtls_cert->valid_from);
+ cert->valid_to = x509_get_timestamp(&mbedtls_cert->valid_to);
+
+ /* Save mbedtls context we need */
+ ret = x509_save_mbedtls_ctx(mbedtls_cert, &cert->mbedtls_ctx);
+ if (ret)
+ goto error_cert_pop;
+
+ /* Signed data (tbs - The part that is To Be Signed)*/
+ cert->tbs = cert->mbedtls_ctx->tbs;
+ cert->tbs_size = mbedtls_cert->tbs.len;
+
+ /* Raw serial number */
+ cert->raw_serial = cert->mbedtls_ctx->raw_serial;
+ cert->raw_serial_size = mbedtls_cert->serial.len;
+
+ /* Raw issuer */
+ cert->raw_issuer = cert->mbedtls_ctx->raw_issuer;
+ cert->raw_issuer_size = mbedtls_cert->issuer_raw.len;
+
+ /* Raw subject */
+ cert->raw_subject = cert->mbedtls_ctx->raw_subject;
+ cert->raw_subject_size = mbedtls_cert->subject_raw.len;
+
+ /* Raw subjectKeyId */
+ cert->raw_skid = cert->mbedtls_ctx->raw_skid;
+ cert->raw_skid_size = mbedtls_cert->subject_key_id.len;
+
+ /* Generate cert issuer + serial number key ID */
+ kid = asymmetric_key_generate_id(cert->raw_serial,
+ cert->raw_serial_size,
+ cert->raw_issuer,
+ cert->raw_issuer_size);
+ if (IS_ERR(kid)) {
+ ret = PTR_ERR(kid);
+ goto error_cert_pop;
+ }
+ cert->id = kid;
+
+ /* Generate subject + subjectKeyId */
+ skid = asymmetric_key_generate_id(cert->raw_skid, cert->raw_skid_size, "", 0);
+ if (IS_ERR(skid)) {
+ ret = PTR_ERR(skid);
+ goto error_cert_pop;
+ }
+ cert->skid = skid;
+
+ /*
+ * Set the certificate flags:
+ * self_signed, unsupported_key, unsupported_sig, blacklisted
+ */
+ ret = x509_set_cert_flags(cert);
+ if (!ret) {
+ *pcert = cert;
+ return 0;
+ }
+
+error_cert_pop:
+ x509_free_certificate(cert);
+ return ret;
+}
+EXPORT_SYMBOL_GPL(x509_populate_cert);
+
+struct x509_certificate *x509_cert_parse(const void *data, size_t datalen)
+{
+ mbedtls_x509_crt mbedtls_cert;
+ struct x509_certificate *cert = NULL;
+ long ret;
+
+ /* Parse DER encoded certificate */
+ mbedtls_x509_crt_init(&mbedtls_cert);
+ ret = mbedtls_x509_crt_parse_der(&mbedtls_cert, data, datalen);
+ if (ret)
+ goto clean_up_ctx;
+
+ /* Populate x509_certificate from mbedtls_x509_crt */
+ ret = x509_populate_cert(&mbedtls_cert, &cert);
+ if (ret)
+ goto clean_up_ctx;
+
+clean_up_ctx:
+ mbedtls_x509_crt_free(&mbedtls_cert);
+ if (!ret)
+ return cert;
+
+ return ERR_PTR(ret);
+}
+#else /* !CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
/*
* Parse an X.509 certificate
*/
@@ -700,3 +1129,4 @@ int x509_akid_note_serial(void *context, size_t hdrlen,
ctx->cert->sig->auth_ids[0] = kid;
return 0;
}
+#endif /* CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 19/23] lib/crypto: port PKCS7 parser on MbedTLS
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (15 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 18/23] lib/crypto: Port x509_cert_parser " Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 20/23] lib/crypto: port MSCode " Raymond Mao
` (6 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Integrate PKCS7 parser on top of MbedTLS PKCS7 library.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
include/crypto/pkcs7_parser.h | 56 ++++
lib/crypto/pkcs7_parser.c | 482 ++++++++++++++++++++++++++++++++--
2 files changed, 510 insertions(+), 28 deletions(-)
diff --git a/include/crypto/pkcs7_parser.h b/include/crypto/pkcs7_parser.h
index 2c45cce523..9f4549871f 100644
--- a/include/crypto/pkcs7_parser.h
+++ b/include/crypto/pkcs7_parser.h
@@ -11,6 +11,12 @@
#include <linux/oid_registry.h>
#include <crypto/pkcs7.h>
#include <crypto/x509_parser.h>
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+#include <external/mbedtls/include/mbedtls/pkcs7.h>
+#include <external/mbedtls/library/x509_internal.h>
+#include <external/mbedtls/include/mbedtls/asn1.h>
+#include <external/mbedtls/include/mbedtls/oid.h>
+#endif
#include <linux/printk.h>
#define kenter(FMT, ...) \
@@ -18,7 +24,54 @@
#define kleave(FMT, ...) \
pr_devel("<== %s()"FMT"\n", __func__, ##__VA_ARGS__)
+/* Backup the parsed MedTLS context that we need */
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+struct pkcs7_mbedtls_ctx {
+ void *content_data;
+};
+
+struct pkcs7_sinfo_mbedtls_ctx {
+ void *authattrs_data;
+ void *content_data_digest;
+};
+#endif
+
+/*
+ * MbedTLS integration Notes:
+ *
+ * MbedTLS PKCS#7 library does not originally support parsing MicroSoft
+ * Authentication Code which is used for verifying the PE image digest.
+ *
+ * 1. Authenticated Attributes (authenticatedAttributes)
+ * MbedTLS assumes unauthenticatedAttributes and authenticatedAttributes
+ * fields not exist.
+ * See MbedTLS function 'pkcs7_get_signer_info' for details.
+ *
+ * 2. MicroSoft Authentication Code (mscode)
+ * MbedTLS only supports Content Data type defined as 1.2.840.113549.1.7.1
+ * (MBEDTLS_OID_PKCS7_DATA, aka OID_data).
+ * 1.3.6.1.4.1.311.2.1.4 (MicroSoft Authentication Code, aka
+ * OID_msIndirectData) is not supported.
+ * See MbedTLS function 'pkcs7_get_content_info_type' for details.
+ *
+ * But the EFI loader assumes that a PKCS#7 message with an EFI image always
+ * contains MicroSoft Authentication Code as Content Data (msg->data is NOT
+ * NULL), see function 'efi_signature_verify'.
+ *
+ * MbedTLS patch "0002-support-MicroSoft-authentication-code-in-PKCS7-lib.patch"
+ * is to support both above features by parsing the Content Data and
+ * Authenticate Attributes from a given PKCS#7 message.
+ *
+ * Other fields we don't need to populate from MbedTLS, which are used
+ * internally by pkcs7_verify:
+ * 'signer', 'unsupported_crypto', 'blacklisted'
+ * 'sig->digest' is used internally by pkcs7_digest to calculate the hash of
+ * Content Data or Authenticate Attributes.
+ */
struct pkcs7_signed_info {
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+ struct pkcs7_sinfo_mbedtls_ctx *mbedtls_ctx;
+#endif
struct pkcs7_signed_info *next;
struct x509_certificate *signer; /* Signing certificate (in msg->certs) */
unsigned index;
@@ -55,6 +108,9 @@ struct pkcs7_signed_info {
};
struct pkcs7_message {
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+ struct pkcs7_mbedtls_ctx *mbedtls_ctx;
+#endif
struct x509_certificate *certs; /* Certificate list */
struct x509_certificate *crl; /* Revocation list */
struct pkcs7_signed_info *signed_infos;
diff --git a/lib/crypto/pkcs7_parser.c b/lib/crypto/pkcs7_parser.c
index d5efa828d6..3c819d934e 100644
--- a/lib/crypto/pkcs7_parser.c
+++ b/lib/crypto/pkcs7_parser.c
@@ -27,7 +27,9 @@
#else
#include "pkcs7_parser.h"
#endif
+#if !CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
#include "pkcs7.asn1.h"
+#endif
MODULE_DESCRIPTION("PKCS#7 parser");
MODULE_AUTHOR("Red Hat, Inc.");
@@ -52,6 +54,352 @@ struct pkcs7_parse_context {
bool expect_skid;
};
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+
+static void pkcs7_free_mbedtls_ctx(struct pkcs7_mbedtls_ctx *ctx)
+{
+ if (ctx) {
+ kfree(ctx->content_data);
+ kfree(ctx);
+ }
+}
+
+static void pkcs7_free_sinfo_mbedtls_ctx(struct pkcs7_sinfo_mbedtls_ctx *ctx)
+{
+ if (ctx) {
+ kfree(ctx->authattrs_data);
+ kfree(ctx->content_data_digest);
+ kfree(ctx);
+ }
+}
+
+/*
+ * Parse Authenticate Attributes
+ * TODO: Shall we consider to integrate decoding of authenticate attribute into
+ * MbedTLS library?
+ *
+ * Structure of the data:
+ *
+ * [C.P.0] {
+ * U.P.SEQUENCE {
+ * U.P.OBJECTIDENTIFIER <contentType_OID>
+ * U.P.SET {
+ * U.P.OBJECTIDENTIFIER <msIndirectData_OID>
+ * }
+ * }
+ * U.P.SEQUENCE {
+ * U.P.OBJECTIDENTIFIER <signingTime_OID>
+ * U.P.SET {
+ * U.P.UTCTime <signingTime>
+ * }
+ * }
+ * U.P.SEQUENCE {
+ * U.P.OBJECTIDENTIFIER <messageDigest_OID>
+ * U.P.SET {
+ * U.P.OCTETSTRING <messageDigest>
+ * }
+ * }
+ * U.P.SEQUENCE {
+ * U.P.OBJECTIDENTIFIER <S/MIME capabilities_OID>
+ * U.P.SET {
+ * U.P.SEQUENCE {
+ * [...]
+ * }
+ * }
+ * }
+ * }
+ */
+static int authattrs_parse(struct pkcs7_message *msg, void *aa, size_t aa_len,
+ struct pkcs7_signed_info *sinfo)
+{
+ unsigned char *p = (unsigned char *)aa;
+ unsigned char *end = (unsigned char *)aa + aa_len;
+ size_t len = 0;
+ int ret;
+ unsigned char *inner_p;
+ size_t seq_len = 0;
+
+ ret = mbedtls_asn1_get_tag(&p, end, &seq_len,
+ MBEDTLS_ASN1_CONTEXT_SPECIFIC |
+ MBEDTLS_ASN1_CONSTRUCTED);
+ if (ret)
+ return ret;
+
+ while (!mbedtls_asn1_get_tag(&p, end, &seq_len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SEQUENCE)) {
+ inner_p = p;
+ ret = mbedtls_asn1_get_tag(&inner_p, p + seq_len, &len,
+ MBEDTLS_ASN1_OID);
+ if (ret)
+ return ret;
+
+ if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_PKCS9_CONTENTTYPE, inner_p, len)) {
+ inner_p += len;
+ ret = mbedtls_asn1_get_tag(&inner_p, p + seq_len, &len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SET);
+ if (ret)
+ return ret;
+
+ ret = mbedtls_asn1_get_tag(&inner_p, p + seq_len, &len,
+ MBEDTLS_ASN1_OID);
+ if (ret)
+ return ret;
+
+ if (MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_MICROSOFT_INDIRECTDATA,
+ inner_p, len))
+ return -EINVAL;
+
+ if (__test_and_set_bit(sinfo_has_content_type, &sinfo->aa_set))
+ return -EINVAL;
+ } else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_PKCS9_MESSAGEDIGEST, inner_p,
+ len)) {
+ inner_p += len;
+ ret = mbedtls_asn1_get_tag(&inner_p, p + seq_len, &len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SET);
+ if (ret)
+ return ret;
+
+ ret = mbedtls_asn1_get_tag(&inner_p, p + seq_len, &len,
+ MBEDTLS_ASN1_OCTET_STRING);
+ if (ret)
+ return ret;
+
+ sinfo->msgdigest = inner_p;
+ sinfo->msgdigest_len = len;
+
+ if (__test_and_set_bit(sinfo_has_message_digest, &sinfo->aa_set))
+ return -EINVAL;
+ } else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_PKCS9_SIGNINGTIME, inner_p,
+ len)) {
+ mbedtls_x509_time st;
+
+ inner_p += len;
+ ret = mbedtls_asn1_get_tag(&inner_p, p + seq_len, &len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SET);
+ if (ret)
+ return ret;
+
+ ret = mbedtls_x509_get_time(&inner_p, p + seq_len, &st);
+ if (ret)
+ return ret;
+ sinfo->signing_time = x509_get_timestamp(&st);
+
+ if (__test_and_set_bit(sinfo_has_signing_time, &sinfo->aa_set))
+ return -EINVAL;
+ } else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_PKCS9_SMIMECAP, inner_p,
+ len)) {
+ if (__test_and_set_bit(sinfo_has_smime_caps, &sinfo->aa_set))
+ return -EINVAL;
+
+ if (msg->data_type != OID_msIndirectData &&
+ msg->data_type != OID_data)
+ return -EINVAL;
+ } else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_MICROSOFT_SPOPUSINFO, inner_p,
+ len)) {
+ if (__test_and_set_bit(sinfo_has_ms_opus_info, &sinfo->aa_set))
+ return -EINVAL;
+ } else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_MICROSOFT_STATETYPE, inner_p,
+ len)) {
+ if (__test_and_set_bit(sinfo_has_ms_statement_type, &sinfo->aa_set))
+ return -EINVAL;
+ }
+
+ p += seq_len;
+ }
+
+ if (ret && ret != MBEDTLS_ERR_ASN1_OUT_OF_DATA)
+ return ret;
+
+ msg->have_authattrs = true;
+
+ /*
+ * Skip the leading tag byte (MBEDTLS_ASN1_CONTEXT_SPECIFIC |
+ * MBEDTLS_ASN1_CONSTRUCTED) to satisfy pkcs7_digest() when calculating
+ * the digest of authattrs.
+ */
+ sinfo->authattrs = aa + 1;
+ sinfo->authattrs_len = aa_len - 1;
+
+ return 0;
+}
+
+static int x509_populate_content_data(struct pkcs7_message *msg,
+ mbedtls_pkcs7 *pkcs7_ctx)
+{
+ struct pkcs7_mbedtls_ctx *mctx;
+
+ if (!pkcs7_ctx->content_data.data ||
+ !pkcs7_ctx->content_data.data_len)
+ return 0;
+
+ mctx = kzalloc(sizeof(*mctx), GFP_KERNEL);
+ if (!mctx)
+ return -ENOMEM;
+
+ mctx->content_data = kmemdup(pkcs7_ctx->content_data.data,
+ pkcs7_ctx->content_data.data_len,
+ GFP_KERNEL);
+ if (!mctx->content_data) {
+ pkcs7_free_mbedtls_ctx(mctx);
+ return -ENOMEM;
+ }
+
+ msg->data = mctx->content_data;
+ msg->data_len = pkcs7_ctx->content_data.data_len;
+ msg->data_hdrlen = pkcs7_ctx->content_data.data_hdrlen;
+ msg->data_type = pkcs7_ctx->content_data.data_type;
+
+ msg->mbedtls_ctx = mctx;
+ return 0;
+}
+
+static int x509_populate_sinfo(struct pkcs7_message *msg,
+ mbedtls_pkcs7_signer_info *mb_sinfo,
+ struct pkcs7_signed_info **sinfo)
+{
+ struct pkcs7_signed_info *signed_info;
+ struct public_key_signature *s;
+ mbedtls_md_type_t md_alg;
+ struct pkcs7_sinfo_mbedtls_ctx *mctx;
+ int ret;
+
+ signed_info = kzalloc(sizeof(*signed_info), GFP_KERNEL);
+ if (!signed_info)
+ return -ENOMEM;
+
+ s = kzalloc(sizeof(*s), GFP_KERNEL);
+ if (!s) {
+ ret = -ENOMEM;
+ goto out_no_sig;
+ }
+
+ mctx = kzalloc(sizeof(*mctx), GFP_KERNEL);
+ if (!mctx) {
+ ret = -ENOMEM;
+ goto out_no_mctx;
+ }
+
+ /*
+ * Hash algorithm:
+ *
+ * alg_identifier = digestAlgorithm (DigestAlgorithmIdentifier)
+ * MbedTLS internally checks this field to ensure
+ * it is the same as digest_alg_identifiers.
+ * sig_alg_identifier = digestEncryptionAlgorithm
+ * (DigestEncryptionAlgorithmIdentifier)
+ * MbedTLS just saves this field without any actions.
+ * See function pkcs7_get_signer_info() for reference.
+ *
+ * Public key algorithm:
+ * No information related to public key algorithm under MbedTLS signer
+ * info. Assume that we are using RSA.
+ */
+ ret = mbedtls_oid_get_md_alg(&mb_sinfo->alg_identifier, &md_alg);
+ if (ret)
+ goto out_err_sinfo;
+ s->pkey_algo = "rsa";
+
+ /* Translate the hash algorithm */
+ switch (md_alg) {
+ case MBEDTLS_MD_SHA1:
+ s->hash_algo = "sha1";
+ s->digest_size = SHA1_SUM_LEN;
+ break;
+ case MBEDTLS_MD_SHA256:
+ s->hash_algo = "sha256";
+ s->digest_size = SHA256_SUM_LEN;
+ break;
+ case MBEDTLS_MD_SHA384:
+ s->hash_algo = "sha384";
+ s->digest_size = SHA384_SUM_LEN;
+ break;
+ case MBEDTLS_MD_SHA512:
+ s->hash_algo = "sha512";
+ s->digest_size = SHA512_SUM_LEN;
+ break;
+ /* Unsupported algo */
+ case MBEDTLS_MD_MD5:
+ case MBEDTLS_MD_SHA224:
+ default:
+ ret = -EINVAL;
+ goto out_err_sinfo;
+ }
+
+ /*
+ * auth_ids holds AuthorityKeyIdentifier, aka akid
+ * auth_ids[0]:
+ * [PKCS#7 or CMS ver 1] - generated from "Issuer + Serial number"
+ * [CMS ver 3] - generated from skid (subjectKeyId)
+ * auth_ids[1]: generated from skid (subjectKeyId)
+ *
+ * Assume that we are using PKCS#7 (msg->version=1),
+ * not CMS ver 3 (msg->version=3).
+ */
+ s->auth_ids[0] = asymmetric_key_generate_id(mb_sinfo->serial.p,
+ mb_sinfo->serial.len,
+ mb_sinfo->issuer_raw.p,
+ mb_sinfo->issuer_raw.len);
+ if (!s->auth_ids[0]) {
+ ret = -ENOMEM;
+ goto out_err_sinfo;
+ }
+
+ /* skip s->auth_ids[1], no subjectKeyId in MbedTLS signer info ctx */
+
+ /*
+ * Encoding can be pkcs1 or raw, but only pkcs1 is supported.
+ * Set the encoding explicitly to pkcs1.
+ */
+ s->encoding = "pkcs1";
+
+ /* Copy the signature data */
+ s->s = kmemdup(mb_sinfo->sig.p, mb_sinfo->sig.len, GFP_KERNEL);
+ if (!s->s) {
+ ret = -ENOMEM;
+ goto out_err_sinfo;
+ }
+ s->s_size = mb_sinfo->sig.len;
+ signed_info->sig = s;
+
+ /* Save the Authenticate Attributes data if exists */
+ if (!mb_sinfo->authattrs.data || !mb_sinfo->authattrs.data_len)
+ goto no_authattrs;
+
+ mctx->authattrs_data = kmemdup(mb_sinfo->authattrs.data,
+ mb_sinfo->authattrs.data_len,
+ GFP_KERNEL);
+ if (!mctx->authattrs_data) {
+ ret = -ENOMEM;
+ goto out_err_sinfo;
+ }
+ signed_info->mbedtls_ctx = mctx;
+
+ /* If authattrs exists, decode it and parse msgdigest from it */
+ ret = authattrs_parse(msg, mctx->authattrs_data,
+ mb_sinfo->authattrs.data_len,
+ signed_info);
+ if (ret)
+ goto out_err_sinfo;
+
+no_authattrs:
+ *sinfo = signed_info;
+ return 0;
+
+out_err_sinfo:
+ pkcs7_free_sinfo_mbedtls_ctx(mctx);
+out_no_mctx:
+ public_key_signature_free(s);
+out_no_sig:
+ kfree(signed_info);
+ return ret;
+}
+
+#endif /* CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
+
/*
* Free a signed information block.
*/
@@ -59,6 +407,9 @@ static void pkcs7_free_signed_info(struct pkcs7_signed_info *sinfo)
{
if (sinfo) {
public_key_signature_free(sinfo->sig);
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+ pkcs7_free_sinfo_mbedtls_ctx(sinfo->mbedtls_ctx);
+#endif
kfree(sinfo);
}
}
@@ -88,11 +439,85 @@ void pkcs7_free_message(struct pkcs7_message *pkcs7)
pkcs7->signed_infos = sinfo->next;
pkcs7_free_signed_info(sinfo);
}
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+ pkcs7_free_mbedtls_ctx(pkcs7->mbedtls_ctx);
+#endif
kfree(pkcs7);
}
}
EXPORT_SYMBOL_GPL(pkcs7_free_message);
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+struct pkcs7_message *pkcs7_parse_message(const void *data, size_t datalen)
+{
+ int i;
+ int ret;
+ mbedtls_pkcs7 pkcs7_ctx;
+ mbedtls_pkcs7_signer_info *mb_sinfos;
+ mbedtls_x509_crt *mb_certs;
+ struct pkcs7_message *msg;
+ struct x509_certificate **cert;
+ struct pkcs7_signed_info **sinfos;
+
+ msg = kzalloc(sizeof(*msg), GFP_KERNEL);
+ if (!msg) {
+ ret = -ENOMEM;
+ goto out_no_msg;
+ }
+
+ /* Parse the DER encoded PKCS#7 message using MbedTLS */
+ mbedtls_pkcs7_init(&pkcs7_ctx);
+ ret = mbedtls_pkcs7_parse_der(&pkcs7_ctx, data, datalen);
+ /* Check if it is a PKCS#7 message with signed data */
+ if (ret != MBEDTLS_PKCS7_SIGNED_DATA)
+ goto parse_fail;
+
+ /* Assume that we are using PKCS#7, not CMS ver 3 */
+ msg->version = 1; /* 1 for [PKCS#7 or CMS ver 1] */
+
+ /* Populate the certs to msg->certs */
+ for (i = 0, cert = &msg->certs, mb_certs = &pkcs7_ctx.signed_data.certs;
+ i < pkcs7_ctx.signed_data.no_of_certs && mb_certs;
+ i++, cert = &(*cert)->next, mb_certs = mb_certs->next) {
+ ret = x509_populate_cert(mb_certs, cert);
+ if (ret)
+ goto parse_fail;
+
+ (*cert)->index = i + 1;
+ }
+
+ /*
+ * Skip populating crl, that is not currently in-use.
+ */
+
+ /* Populate content data */
+ ret = x509_populate_content_data(msg, &pkcs7_ctx);
+ if (ret)
+ goto parse_fail;
+
+ /* Populate signed info to msg->signed_infos */
+ for (i = 0, sinfos = &msg->signed_infos,
+ mb_sinfos = &pkcs7_ctx.signed_data.signers;
+ i < pkcs7_ctx.signed_data.no_of_signers && mb_sinfos;
+ i++, sinfos = &(*sinfos)->next, mb_sinfos = mb_sinfos->next) {
+ ret = x509_populate_sinfo(msg, mb_sinfos, sinfos);
+ if (ret)
+ goto parse_fail;
+
+ (*sinfos)->index = i + 1;
+ }
+
+ mbedtls_pkcs7_free(&pkcs7_ctx);
+ return msg;
+
+parse_fail:
+ mbedtls_pkcs7_free(&pkcs7_ctx);
+ pkcs7_free_message(msg);
+out_no_msg:
+ msg = ERR_PTR(ret);
+ return msg;
+}
+#else /* !CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
/*
* Check authenticatedAttributes are provided or not provided consistently.
*/
@@ -182,34 +607,6 @@ out_no_ctx:
}
EXPORT_SYMBOL_GPL(pkcs7_parse_message);
-/**
- * pkcs7_get_content_data - Get access to the PKCS#7 content
- * @pkcs7: The preparsed PKCS#7 message to access
- * @_data: Place to return a pointer to the data
- * @_data_len: Place to return the data length
- * @_headerlen: Size of ASN.1 header not included in _data
- *
- * Get access to the data content of the PKCS#7 message. The size of the
- * header of the ASN.1 object that contains it is also provided and can be used
- * to adjust *_data and *_data_len to get the entire object.
- *
- * Returns -ENODATA if the data object was missing from the message.
- */
-int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
- const void **_data, size_t *_data_len,
- size_t *_headerlen)
-{
- if (!pkcs7->data)
- return -ENODATA;
-
- *_data = pkcs7->data;
- *_data_len = pkcs7->data_len;
- if (_headerlen)
- *_headerlen = pkcs7->data_hdrlen;
- return 0;
-}
-EXPORT_SYMBOL_GPL(pkcs7_get_content_data);
-
/*
* Note an OID when we find one for later processing when we know how
* to interpret it.
@@ -698,3 +1095,32 @@ int pkcs7_note_signed_info(void *context, size_t hdrlen,
return -ENOMEM;
return 0;
}
+#endif /* CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
+
+/**
+ * pkcs7_get_content_data - Get access to the PKCS#7 content
+ * @pkcs7: The preparsed PKCS#7 message to access
+ * @_data: Place to return a pointer to the data
+ * @_data_len: Place to return the data length
+ * @_headerlen: Size of ASN.1 header not included in _data
+ *
+ * Get access to the data content of the PKCS#7 message. The size of the
+ * header of the ASN.1 object that contains it is also provided and can be used
+ * to adjust *_data and *_data_len to get the entire object.
+ *
+ * Returns -ENODATA if the data object was missing from the message.
+ */
+int pkcs7_get_content_data(const struct pkcs7_message *pkcs7,
+ const void **_data, size_t *_data_len,
+ size_t *_headerlen)
+{
+ if (!pkcs7->data)
+ return -ENODATA;
+
+ *_data = pkcs7->data;
+ *_data_len = pkcs7->data_len;
+ if (_headerlen)
+ *_headerlen = pkcs7->data_hdrlen;
+ return 0;
+}
+EXPORT_SYMBOL_GPL(pkcs7_get_content_data);
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 20/23] lib/crypto: port MSCode parser on MbedTLS
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (16 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 19/23] lib/crypto: port PKCS7 parser " Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 21/23] lib/crypto: remove dependence on ASN1 decoder Raymond Mao
` (5 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Integrate MicroSoft Authenticate Code parser on top of MbedTLS
ASN.1 decoder.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
include/crypto/mscode.h | 4 ++
lib/crypto/mscode_parser.c | 104 +++++++++++++++++++++++++++++++++++++
2 files changed, 108 insertions(+)
diff --git a/include/crypto/mscode.h b/include/crypto/mscode.h
index 551058b96e..c214fc87e4 100644
--- a/include/crypto/mscode.h
+++ b/include/crypto/mscode.h
@@ -9,6 +9,10 @@
#ifndef __UBOOT__
#include <crypto/hash_info.h>
#endif
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+#include <external/mbedtls/include/mbedtls/asn1.h>
+#include <external/mbedtls/include/mbedtls/oid.h>
+#endif
struct pefile_context {
#ifndef __UBOOT__
diff --git a/lib/crypto/mscode_parser.c b/lib/crypto/mscode_parser.c
index 90d5b37a6c..167304def5 100644
--- a/lib/crypto/mscode_parser.c
+++ b/lib/crypto/mscode_parser.c
@@ -18,11 +18,113 @@
#else
#include "verify_pefile.h"
#endif
+#if !CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
#include "mscode.asn1.h"
+#endif
/*
* Parse a Microsoft Individual Code Signing blob
+ *
+ * U.P.SEQUENCE {
+ * U.P.OBJECTIDENTIFIER 1.3.6.1.4.1.311.2.1.15 (SPC_PE_IMAGE_DATA_OBJID)
+ * U.P.SEQUENCE {
+ * U.P.BITSTRING NaN : 0 unused bit(s);
+ * [C.P.0] {
+ * [C.P.2] {
+ * [C.P.0] <arbitrary string>
+ * }
+ * }
+ * }
+ * }
+ * U.P.SEQUENCE {
+ * U.P.SEQUENCE {
+ * U.P.OBJECTIDENTIFIER <digest algorithm OID>
+ * U.P.NULL
+ * }
+ * U.P.OCTETSTRING <PE image digest>
+ * }
+ *
*/
+#if CONFIG_IS_ENABLED(MBEDTLS_LIB_X509)
+
+int mscode_parse(void *_ctx, const void *content_data, size_t data_len,
+ size_t asn1hdrlen)
+{
+ struct pefile_context *ctx = _ctx;
+ unsigned char *p = (unsigned char *)content_data;
+ unsigned char *end = (unsigned char *)content_data + data_len;
+ size_t len = 0;
+ int ret;
+ unsigned char *inner_p;
+ size_t seq_len = 0;
+
+ ret = mbedtls_asn1_get_tag(&p, end, &seq_len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SEQUENCE);
+ if (ret)
+ return ret;
+
+ inner_p = p;
+ ret = mbedtls_asn1_get_tag(&inner_p, inner_p + seq_len, &len, MBEDTLS_ASN1_OID);
+ if (ret)
+ return ret;
+
+ /* Sanity check on the PE Image Data OID (1.3.6.1.4.1.311.2.1.15) */
+ if (MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_MICROSOFT_PEIMAGEDATA, inner_p, len))
+ return -EINVAL;
+
+ p += seq_len;
+ ret = mbedtls_asn1_get_tag(&p, end, &seq_len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SEQUENCE);
+ if (ret)
+ return ret;
+
+ ret = mbedtls_asn1_get_tag(&p, p + seq_len, &seq_len,
+ MBEDTLS_ASN1_CONSTRUCTED |
+ MBEDTLS_ASN1_SEQUENCE);
+ if (ret)
+ return ret;
+
+ inner_p = p;
+
+ /*
+ * Check if the inner sequence contains a supported hash
+ * algorithm OID
+ */
+ ret = mbedtls_asn1_get_tag(&inner_p, inner_p + seq_len, &len, MBEDTLS_ASN1_OID);
+ if (ret)
+ return ret;
+
+ if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_DIGEST_ALG_MD5, inner_p, len))
+ ctx->digest_algo = "md5";
+ else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_DIGEST_ALG_SHA1, inner_p, len))
+ ctx->digest_algo = "sha1";
+ else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_DIGEST_ALG_SHA224, inner_p, len))
+ ctx->digest_algo = "sha224";
+ else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_DIGEST_ALG_SHA256, inner_p, len))
+ ctx->digest_algo = "sha256";
+ else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_DIGEST_ALG_SHA384, inner_p, len))
+ ctx->digest_algo = "sha384";
+ else if (!MBEDTLS_OID_CMP_RAW(MBEDTLS_OID_DIGEST_ALG_SHA512, inner_p, len))
+ ctx->digest_algo = "sha512";
+
+ if (!ctx->digest_algo)
+ return -EINVAL;
+
+ p += seq_len;
+ ret = mbedtls_asn1_get_tag(&p, end, &len, MBEDTLS_ASN1_OCTET_STRING);
+ if (ret)
+ return ret;
+
+ ctx->digest = p;
+ ctx->digest_len = len;
+
+ return 0;
+}
+
+#else /* !CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
+
int mscode_parse(void *_ctx, const void *content_data, size_t data_len,
size_t asn1hdrlen)
{
@@ -36,6 +138,8 @@ int mscode_parse(void *_ctx, const void *content_data, size_t data_len,
return asn1_ber_decoder(&mscode_decoder, ctx, content_data, data_len);
}
+#endif /* CONFIG_IS_ENABLED(MBEDTLS_LIB_X509) */
+
/*
* Check the content type OID
*/
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 21/23] lib/crypto: remove dependence on ASN1 decoder
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (17 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 20/23] lib/crypto: port MSCode " Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 22/23] mbedtls: disable the unused features Raymond Mao
` (4 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
When building with MbedTLS, we are using MbedTLS to decode ASN1 data
for x509, pkcs7 and mscode. So we can remove the dependence on ASN1
decoder when MBEDTLS_LIB_X509 is enabled.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
lib/crypto/Makefile | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/lib/crypto/Makefile b/lib/crypto/Makefile
index bec1bc95a6..00fbda05ae 100644
--- a/lib/crypto/Makefile
+++ b/lib/crypto/Makefile
@@ -31,6 +31,11 @@ endif
# X.509 Certificate handling
#
obj-$(CONFIG_$(SPL_)X509_CERTIFICATE_PARSER) += x509_key_parser.o
+ifdef CONFIG_MBEDTLS_LIB_X509
+x509_key_parser-y := \
+ x509_cert_parser.o \
+ x509_public_key.o
+else
x509_key_parser-y := \
x509.asn1.o \
x509_akid.asn1.o \
@@ -43,27 +48,37 @@ $(obj)/x509_cert_parser.o: \
$(obj)/x509.asn1.o: $(obj)/x509.asn1.c $(obj)/x509.asn1.h
$(obj)/x509_akid.asn1.o: $(obj)/x509_akid.asn1.c $(obj)/x509_akid.asn1.h
+endif
#
# PKCS#7 message handling
#
obj-$(CONFIG_$(SPL_)PKCS7_MESSAGE_PARSER) += pkcs7_message.o
+ifdef CONFIG_MBEDTLS_LIB_X509
+pkcs7_message-y := \
+ pkcs7_parser.o
+else
pkcs7_message-y := \
pkcs7.asn1.o \
pkcs7_parser.o
-obj-$(CONFIG_$(SPL_)PKCS7_VERIFY) += pkcs7_verify.o
$(obj)/pkcs7_parser.o: $(obj)/pkcs7.asn1.h
$(obj)/pkcs7.asn1.o: $(obj)/pkcs7.asn1.c $(obj)/pkcs7.asn1.h
+endif
+obj-$(CONFIG_$(SPL_)PKCS7_VERIFY) += pkcs7_verify.o
#
# Signed PE binary-wrapped key handling
#
obj-$(CONFIG_$(SPL_)MSCODE_PARSER) += mscode.o
-
+ifdef CONFIG_MBEDTLS_LIB_X509
+mscode-y := \
+ mscode_parser.o
+else
mscode-y := \
mscode_parser.o \
mscode.asn1.o
$(obj)/mscode_parser.o: $(obj)/mscode.asn1.h $(obj)/mscode.asn1.h
$(obj)/mscode.asn1.o: $(obj)/mscode.asn1.c $(obj)/mscode.asn1.h
+endif
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 22/23] mbedtls: disable the unused features
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (18 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 21/23] lib/crypto: remove dependence on ASN1 decoder Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 23/23] configs: enable MbedTLS as default setting Raymond Mao
` (3 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Disable the unused features of MbedTLS to reduce the target size.
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
lib/mbedtls/mbedtls_def_config.h | 186 +++++++++++++++----------------
1 file changed, 93 insertions(+), 93 deletions(-)
diff --git a/lib/mbedtls/mbedtls_def_config.h b/lib/mbedtls/mbedtls_def_config.h
index 6e6d66716a..2a31ad7603 100644
--- a/lib/mbedtls/mbedtls_def_config.h
+++ b/lib/mbedtls/mbedtls_def_config.h
@@ -49,7 +49,7 @@
*
* Comment to disable the use of assembly code.
*/
-#define MBEDTLS_HAVE_ASM
+//#define MBEDTLS_HAVE_ASM
/**
* \def MBEDTLS_NO_UDBL_DIVISION
@@ -650,35 +650,35 @@
*
* Enable Cipher Block Chaining mode (CBC) for symmetric ciphers.
*/
-#define MBEDTLS_CIPHER_MODE_CBC
+//#define MBEDTLS_CIPHER_MODE_CBC
/**
* \def MBEDTLS_CIPHER_MODE_CFB
*
* Enable Cipher Feedback mode (CFB) for symmetric ciphers.
*/
-#define MBEDTLS_CIPHER_MODE_CFB
+//#define MBEDTLS_CIPHER_MODE_CFB
/**
* \def MBEDTLS_CIPHER_MODE_CTR
*
* Enable Counter Block Cipher mode (CTR) for symmetric ciphers.
*/
-#define MBEDTLS_CIPHER_MODE_CTR
+//#define MBEDTLS_CIPHER_MODE_CTR
/**
* \def MBEDTLS_CIPHER_MODE_OFB
*
* Enable Output Feedback mode (OFB) for symmetric ciphers.
*/
-#define MBEDTLS_CIPHER_MODE_OFB
+//#define MBEDTLS_CIPHER_MODE_OFB
/**
* \def MBEDTLS_CIPHER_MODE_XTS
*
* Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES.
*/
-#define MBEDTLS_CIPHER_MODE_XTS
+//#define MBEDTLS_CIPHER_MODE_XTS
/**
* \def MBEDTLS_CIPHER_NULL_CIPHER
@@ -757,20 +757,20 @@
* Comment macros to disable the curve and functions for it
*/
/* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */
-#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
-#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
-#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
-#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
-#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
-#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
-#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
-#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
-#define MBEDTLS_ECP_DP_BP256R1_ENABLED
-#define MBEDTLS_ECP_DP_BP384R1_ENABLED
-#define MBEDTLS_ECP_DP_BP512R1_ENABLED
+// #define MBEDTLS_ECP_DP_SECP192R1_ENABLED
+// #define MBEDTLS_ECP_DP_SECP224R1_ENABLED
+// #define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+// #define MBEDTLS_ECP_DP_SECP384R1_ENABLED
+// #define MBEDTLS_ECP_DP_SECP521R1_ENABLED
+// #define MBEDTLS_ECP_DP_SECP192K1_ENABLED
+// #define MBEDTLS_ECP_DP_SECP224K1_ENABLED
+// #define MBEDTLS_ECP_DP_SECP256K1_ENABLED
+// #define MBEDTLS_ECP_DP_BP256R1_ENABLED
+// #define MBEDTLS_ECP_DP_BP384R1_ENABLED
+// #define MBEDTLS_ECP_DP_BP512R1_ENABLED
/* Montgomery curves (supporting ECP) */
-#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
-#define MBEDTLS_ECP_DP_CURVE448_ENABLED
+// #define MBEDTLS_ECP_DP_CURVE25519_ENABLED
+// #define MBEDTLS_ECP_DP_CURVE448_ENABLED
/**
* \def MBEDTLS_ECP_NIST_OPTIM
@@ -781,7 +781,7 @@
*
* Comment this macro to disable NIST curves optimisation.
*/
-#define MBEDTLS_ECP_NIST_OPTIM
+// #define MBEDTLS_ECP_NIST_OPTIM
/**
* \def MBEDTLS_ECP_RESTARTABLE
@@ -858,7 +858,7 @@
*
* Comment this macro to disable deterministic ECDSA.
*/
-#define MBEDTLS_ECDSA_DETERMINISTIC
+// #define MBEDTLS_ECDSA_DETERMINISTIC
/**
* \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
@@ -878,7 +878,7 @@
* MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
* MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
*/
-#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
@@ -907,7 +907,7 @@
* See dhm.h for more details.
*
*/
-#define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
@@ -925,7 +925,7 @@
* MBEDTLS_TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA
* MBEDTLS_TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256
*/
-#define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
@@ -948,7 +948,7 @@
* MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256
* MBEDTLS_TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256
*/
-#define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
@@ -1005,7 +1005,7 @@
* See dhm.h for more details.
*
*/
-#define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
@@ -1030,7 +1030,7 @@
* MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
* MBEDTLS_TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256
*/
-#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
@@ -1054,7 +1054,7 @@
* MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
* MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256
*/
-#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
@@ -1078,7 +1078,7 @@
* MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
* MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
*/
-#define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
@@ -1102,7 +1102,7 @@
* MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
* MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
*/
-#define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
+// #define MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
/**
* \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
@@ -1139,7 +1139,7 @@
*
* Disable if you only need to support RFC 5915 + 5480 key formats.
*/
-#define MBEDTLS_PK_PARSE_EC_EXTENDED
+// #define MBEDTLS_PK_PARSE_EC_EXTENDED
/**
* \def MBEDTLS_PK_PARSE_EC_COMPRESSED
@@ -1152,7 +1152,7 @@
* the only unsupported curves are MBEDTLS_ECP_DP_SECP224R1 and
* MBEDTLS_ECP_DP_SECP224K1.
*/
-#define MBEDTLS_PK_PARSE_EC_COMPRESSED
+// #define MBEDTLS_PK_PARSE_EC_COMPRESSED
/**
* \def MBEDTLS_ERROR_STRERROR_DUMMY
@@ -1167,7 +1167,7 @@
* Disable if you run into name conflicts and want to really remove the
* mbedtls_strerror()
*/
-#define MBEDTLS_ERROR_STRERROR_DUMMY
+// #define MBEDTLS_ERROR_STRERROR_DUMMY
/**
* \def MBEDTLS_GENPRIME
@@ -1176,7 +1176,7 @@
*
* Requires: MBEDTLS_BIGNUM_C
*/
-#define MBEDTLS_GENPRIME
+// #define MBEDTLS_GENPRIME
/**
* \def MBEDTLS_FS_IO
@@ -1296,7 +1296,7 @@
*
* Comment this macro to disable support for external private RSA keys.
*/
-#define MBEDTLS_PK_RSA_ALT_SUPPORT
+// #define MBEDTLS_PK_RSA_ALT_SUPPORT
/**
* \def MBEDTLS_PKCS1_V15
@@ -1484,7 +1484,7 @@
*
* Enable the checkup functions (*_self_test).
*/
-#define MBEDTLS_SELF_TEST
+// #define MBEDTLS_SELF_TEST
/**
* \def MBEDTLS_SHA256_SMALLER
@@ -1524,7 +1524,7 @@
*
* Enable sending of all alert messages
*/
-#define MBEDTLS_SSL_ALL_ALERT_MESSAGES
+// #define MBEDTLS_SSL_ALL_ALERT_MESSAGES
/**
* \def MBEDTLS_SSL_DTLS_CONNECTION_ID
@@ -1548,7 +1548,7 @@
*
* Uncomment to enable the Connection ID extension.
*/
-#define MBEDTLS_SSL_DTLS_CONNECTION_ID
+// #define MBEDTLS_SSL_DTLS_CONNECTION_ID
/**
* \def MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT
@@ -1570,7 +1570,7 @@
*
* Requires: MBEDTLS_SSL_DTLS_CONNECTION_ID
*/
-#define MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT 0
+// #define MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT 0
/**
* \def MBEDTLS_SSL_ASYNC_PRIVATE
@@ -1611,7 +1611,7 @@
*
* Comment to disable the context serialization APIs.
*/
-#define MBEDTLS_SSL_CONTEXT_SERIALIZATION
+// #define MBEDTLS_SSL_CONTEXT_SERIALIZATION
/**
* \def MBEDTLS_SSL_DEBUG_ALL
@@ -1643,7 +1643,7 @@
*
* Comment this macro to disable support for Encrypt-then-MAC
*/
-#define MBEDTLS_SSL_ENCRYPT_THEN_MAC
+// #define MBEDTLS_SSL_ENCRYPT_THEN_MAC
/** \def MBEDTLS_SSL_EXTENDED_MASTER_SECRET
*
@@ -1659,7 +1659,7 @@
*
* Comment this macro to disable support for Extended Master Secret.
*/
-#define MBEDTLS_SSL_EXTENDED_MASTER_SECRET
+// #define MBEDTLS_SSL_EXTENDED_MASTER_SECRET
/**
* \def MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
@@ -1683,7 +1683,7 @@
* Comment this macro to disable storing the peer's certificate
* after the handshake.
*/
-#define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
+// #define MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
/**
* \def MBEDTLS_SSL_RENEGOTIATION
@@ -1707,7 +1707,7 @@
* configuration of this extension).
*
*/
-#define MBEDTLS_SSL_RENEGOTIATION
+// #define MBEDTLS_SSL_RENEGOTIATION
/**
* \def MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
@@ -1716,7 +1716,7 @@
*
* Comment this macro to disable support for the max_fragment_length extension
*/
-#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+// #define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
/**
* \def MBEDTLS_SSL_RECORD_SIZE_LIMIT
@@ -1773,7 +1773,7 @@
*
* Uncomment this macro to enable the support for TLS 1.3.
*/
-//#define MBEDTLS_SSL_PROTO_TLS1_3
+// #define MBEDTLS_SSL_PROTO_TLS1_3
/**
* \def MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
@@ -1807,7 +1807,7 @@
* effect on the build.
*
*/
-#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
+// #define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
/**
* \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
@@ -1825,7 +1825,7 @@
* effect on the build.
*
*/
-#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
+// #define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
/**
* \def MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
@@ -1839,7 +1839,7 @@
* have any effect on the build.
*
*/
-#define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
+// #define MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
/**
* \def MBEDTLS_SSL_EARLY_DATA
@@ -1873,7 +1873,7 @@
*
* Comment this macro to disable support for DTLS
*/
-#define MBEDTLS_SSL_PROTO_DTLS
+// #define MBEDTLS_SSL_PROTO_DTLS
/**
* \def MBEDTLS_SSL_ALPN
@@ -1882,7 +1882,7 @@
*
* Comment this macro to disable support for ALPN.
*/
-#define MBEDTLS_SSL_ALPN
+// #define MBEDTLS_SSL_ALPN
/**
* \def MBEDTLS_SSL_DTLS_ANTI_REPLAY
@@ -1897,7 +1897,7 @@
*
* Comment this to disable anti-replay in DTLS.
*/
-#define MBEDTLS_SSL_DTLS_ANTI_REPLAY
+// #define MBEDTLS_SSL_DTLS_ANTI_REPLAY
/**
* \def MBEDTLS_SSL_DTLS_HELLO_VERIFY
@@ -1915,7 +1915,7 @@
*
* Comment this to disable support for HelloVerifyRequest.
*/
-#define MBEDTLS_SSL_DTLS_HELLO_VERIFY
+// #define MBEDTLS_SSL_DTLS_HELLO_VERIFY
/**
* \def MBEDTLS_SSL_DTLS_SRTP
@@ -1962,7 +1962,7 @@
*
* Comment this to disable support for clients reusing the source port.
*/
-#define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
+// #define MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
/**
* \def MBEDTLS_SSL_SESSION_TICKETS
@@ -1976,7 +1976,7 @@
*
* Comment this macro to disable support for SSL session tickets
*/
-#define MBEDTLS_SSL_SESSION_TICKETS
+// #define MBEDTLS_SSL_SESSION_TICKETS
/**
* \def MBEDTLS_SSL_SERVER_NAME_INDICATION
@@ -1987,7 +1987,7 @@
*
* Comment this macro to disable support for server name indication in SSL
*/
-#define MBEDTLS_SSL_SERVER_NAME_INDICATION
+// #define MBEDTLS_SSL_SERVER_NAME_INDICATION
/**
* \def MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
@@ -2150,7 +2150,7 @@
*
* Comment this to disable run-time checking and save ROM space
*/
-#define MBEDTLS_VERSION_FEATURES
+// #define MBEDTLS_VERSION_FEATURES
/**
* \def MBEDTLS_X509_TRUSTED_CERTIFICATE_CALLBACK
@@ -2232,7 +2232,7 @@
*
* This modules adds support for the AES-NI instructions on x86.
*/
-#define MBEDTLS_AESNI_C
+// #define MBEDTLS_AESNI_C
/**
* \def MBEDTLS_AESCE_C
@@ -2331,7 +2331,7 @@
*
* PEM_PARSE uses AES for decrypting encrypted keys.
*/
-#define MBEDTLS_AES_C
+// #define MBEDTLS_AES_C
/**
* \def MBEDTLS_ASN1_PARSE_C
@@ -2371,7 +2371,7 @@
*
* This module is required for PEM support (required by X.509).
*/
-#define MBEDTLS_BASE64_C
+// #define MBEDTLS_BASE64_C
/**
* \def MBEDTLS_BIGNUM_C
@@ -2446,7 +2446,7 @@
* MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
* MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
*/
-#define MBEDTLS_CAMELLIA_C
+// #define MBEDTLS_CAMELLIA_C
/**
* \def MBEDTLS_ARIA_C
@@ -2498,7 +2498,7 @@
* MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256
* MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384
*/
-#define MBEDTLS_ARIA_C
+// #define MBEDTLS_ARIA_C
/**
* \def MBEDTLS_CCM_C
@@ -2513,7 +2513,7 @@
* This module enables the AES-CCM ciphersuites, if other requisites are
* enabled as well.
*/
-#define MBEDTLS_CCM_C
+// #define MBEDTLS_CCM_C
/**
* \def MBEDTLS_CHACHA20_C
@@ -2522,7 +2522,7 @@
*
* Module: library/chacha20.c
*/
-#define MBEDTLS_CHACHA20_C
+// #define MBEDTLS_CHACHA20_C
/**
* \def MBEDTLS_CHACHAPOLY_C
@@ -2533,7 +2533,7 @@
*
* This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C
*/
-#define MBEDTLS_CHACHAPOLY_C
+// #define MBEDTLS_CHACHAPOLY_C
/**
* \def MBEDTLS_CIPHER_C
@@ -2573,7 +2573,7 @@
* Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_DES_C
*
*/
-#define MBEDTLS_CMAC_C
+// #define MBEDTLS_CMAC_C
/**
* \def MBEDTLS_CTR_DRBG_C
@@ -2595,7 +2595,7 @@
*
* This module provides the CTR_DRBG AES random number generator.
*/
-#define MBEDTLS_CTR_DRBG_C
+// #define MBEDTLS_CTR_DRBG_C
/**
* \def MBEDTLS_DEBUG_C
@@ -2610,7 +2610,7 @@
*
* This module provides debugging functions.
*/
-#define MBEDTLS_DEBUG_C
+// #define MBEDTLS_DEBUG_C
/**
* \def MBEDTLS_DES_C
@@ -2626,7 +2626,7 @@
* \warning DES/3DES are considered weak ciphers and their use constitutes a
* security risk. We recommend considering stronger ciphers instead.
*/
-#define MBEDTLS_DES_C
+// #define MBEDTLS_DES_C
/**
* \def MBEDTLS_DHM_C
@@ -2648,7 +2648,7 @@
* See dhm.h for more details.
*
*/
-#define MBEDTLS_DHM_C
+// #define MBEDTLS_DHM_C
/**
* \def MBEDTLS_ECDH_C
@@ -2666,7 +2666,7 @@
*
* Requires: MBEDTLS_ECP_C
*/
-#define MBEDTLS_ECDH_C
+// #define MBEDTLS_ECDH_C
/**
* \def MBEDTLS_ECDSA_C
@@ -2683,7 +2683,7 @@
* and at least one MBEDTLS_ECP_DP_XXX_ENABLED for a
* short Weierstrass curve.
*/
-#define MBEDTLS_ECDSA_C
+// #define MBEDTLS_ECDSA_C
/**
* \def MBEDTLS_ECJPAKE_C
@@ -2705,7 +2705,7 @@
* \warning If using a hash that is only provided by PSA drivers, you must
* call psa_crypto_init() before doing any EC J-PAKE operations.
*/
-#define MBEDTLS_ECJPAKE_C
+// #define MBEDTLS_ECJPAKE_C
/**
* \def MBEDTLS_ECP_C
@@ -2719,7 +2719,7 @@
*
* Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED
*/
-#define MBEDTLS_ECP_C
+// #define MBEDTLS_ECP_C
/**
* \def MBEDTLS_ENTROPY_C
@@ -2760,7 +2760,7 @@
* This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other
* requisites are enabled as well.
*/
-#define MBEDTLS_GCM_C
+// #define MBEDTLS_GCM_C
/**
* \def MBEDTLS_HKDF_C
@@ -2775,7 +2775,7 @@
* This module adds support for the Hashed Message Authentication Code
* (HMAC)-based key derivation function (HKDF).
*/
-#define MBEDTLS_HKDF_C
+// #define MBEDTLS_HKDF_C
/**
* \def MBEDTLS_HMAC_DRBG_C
@@ -2789,7 +2789,7 @@
*
* Uncomment to enable the HMAC_DRBG random number generator.
*/
-#define MBEDTLS_HMAC_DRBG_C
+// #define MBEDTLS_HMAC_DRBG_C
/**
* \def MBEDTLS_LMS_C
@@ -2828,7 +2828,7 @@
*
* Requires: MBEDTLS_AES_C and MBEDTLS_CIPHER_C
*/
-#define MBEDTLS_NIST_KW_C
+// #define MBEDTLS_NIST_KW_C
/**
* \def MBEDTLS_MD_C
@@ -2861,7 +2861,7 @@
*
* Uncomment to enable generic message digest wrappers.
*/
-//#define MBEDTLS_MD_C
+#define MBEDTLS_MD_C
/**
* \def MBEDTLS_MD5_C
@@ -2956,7 +2956,7 @@
*
* This modules adds support for the VIA PadLock on x86.
*/
-#define MBEDTLS_PADLOCK_C
+// #define MBEDTLS_PADLOCK_C
/**
* \def MBEDTLS_PEM_PARSE_C
@@ -2978,7 +2978,7 @@
*
* This modules adds support for decoding / parsing PEM files.
*/
-#define MBEDTLS_PEM_PARSE_C
+// #define MBEDTLS_PEM_PARSE_C
/**
* \def MBEDTLS_PEM_WRITE_C
@@ -2994,7 +2994,7 @@
*
* This modules adds support for encoding / writing PEM files.
*/
-#define MBEDTLS_PEM_WRITE_C
+// #define MBEDTLS_PEM_WRITE_C
/**
* \def MBEDTLS_PK_C
@@ -3058,7 +3058,7 @@
*
* This module adds support for the PKCS#5 functions.
*/
-#define MBEDTLS_PKCS5_C
+// #define MBEDTLS_PKCS5_C
/**
* \def MBEDTLS_PKCS7_C
@@ -3093,7 +3093,7 @@
*
* This module enables PKCS#12 functions.
*/
-#define MBEDTLS_PKCS12_C
+// #define MBEDTLS_PKCS12_C
/**
* \def MBEDTLS_PLATFORM_C
@@ -3113,7 +3113,7 @@
*
* This module enables abstraction of common (libc) functions.
*/
-#define MBEDTLS_PLATFORM_C
+// #define MBEDTLS_PLATFORM_C
/**
* \def MBEDTLS_POLY1305_C
@@ -3123,7 +3123,7 @@
* Module: library/poly1305.c
* Caller: library/chachapoly.c
*/
-#define MBEDTLS_POLY1305_C
+// #define MBEDTLS_POLY1305_C
/**
* \def MBEDTLS_PSA_CRYPTO_C
@@ -3190,7 +3190,7 @@
* Caller: library/md.c
*
*/
-#define MBEDTLS_RIPEMD160_C
+// #define MBEDTLS_RIPEMD160_C
/**
* \def MBEDTLS_RSA_C
@@ -3433,7 +3433,7 @@
*
* Requires: MBEDTLS_SSL_CACHE_C
*/
-#define MBEDTLS_SSL_CACHE_C
+// #define MBEDTLS_SSL_CACHE_C
/**
* \def MBEDTLS_SSL_COOKIE_C
@@ -3443,7 +3443,7 @@
* Module: library/ssl_cookie.c
* Caller:
*/
-#define MBEDTLS_SSL_COOKIE_C
+// #define MBEDTLS_SSL_COOKIE_C
/**
* \def MBEDTLS_SSL_TICKET_C
@@ -3456,7 +3456,7 @@
* Requires: (MBEDTLS_CIPHER_C || MBEDTLS_USE_PSA_CRYPTO) &&
* (MBEDTLS_GCM_C || MBEDTLS_CCM_C || MBEDTLS_CHACHAPOLY_C)
*/
-#define MBEDTLS_SSL_TICKET_C
+// #define MBEDTLS_SSL_TICKET_C
/**
* \def MBEDTLS_SSL_CLI_C
@@ -3470,7 +3470,7 @@
*
* This module is required for SSL/TLS client support.
*/
-#define MBEDTLS_SSL_CLI_C
+// #define MBEDTLS_SSL_CLI_C
/**
* \def MBEDTLS_SSL_SRV_C
@@ -3484,7 +3484,7 @@
*
* This module is required for SSL/TLS server support.
*/
-#define MBEDTLS_SSL_SRV_C
+// #define MBEDTLS_SSL_SRV_C
/**
* \def MBEDTLS_SSL_TLS_C
@@ -3557,7 +3557,7 @@
*
* This module provides run-time version information.
*/
-#define MBEDTLS_VERSION_C
+// #define MBEDTLS_VERSION_C
/**
* \def MBEDTLS_X509_USE_C
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* [PATCH 23/23] configs: enable MbedTLS as default setting
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (19 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 22/23] mbedtls: disable the unused features Raymond Mao
@ 2024-04-16 19:00 ` Raymond Mao
2024-04-16 19:23 ` [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Tom Rini
` (2 subsequent siblings)
23 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 19:00 UTC (permalink / raw)
To: u-boot; +Cc: raymond.mao, trini, ilias.apalodimas, xypron.glpk
Enable MbedTLS as default setting for qemu arm64
Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
---
configs/qemu_arm64_defconfig | 5 +++++
configs/sandbox_defconfig | 4 ++++
2 files changed, 9 insertions(+)
diff --git a/configs/qemu_arm64_defconfig b/configs/qemu_arm64_defconfig
index 7e166f4390..587a3fb912 100644
--- a/configs/qemu_arm64_defconfig
+++ b/configs/qemu_arm64_defconfig
@@ -67,4 +67,9 @@ CONFIG_TPM2_MMIO=y
CONFIG_USB_EHCI_HCD=y
CONFIG_USB_EHCI_PCI=y
CONFIG_SEMIHOSTING=y
+CONFIG_MBEDTLS_LIB=y
+CONFIG_MBEDTLS_LIB_CRYPTO=y
+CONFIG_MBEDTLS_LIB_X509=y
+# CONFIG_MBEDTLS_LIB_TLS is not set
CONFIG_TPM=y
+CONFIG_EFI_SECURE_BOOT=y
diff --git a/configs/sandbox_defconfig b/configs/sandbox_defconfig
index 93b52f2de5..6f36fa0ac8 100644
--- a/configs/sandbox_defconfig
+++ b/configs/sandbox_defconfig
@@ -343,6 +343,10 @@ CONFIG_FS_CBFS=y
CONFIG_FS_CRAMFS=y
CONFIG_ADDR_MAP=y
CONFIG_CMD_DHRYSTONE=y
+CONFIG_MBEDTLS_LIB=y
+CONFIG_MBEDTLS_LIB_CRYPTO=y
+CONFIG_MBEDTLS_LIB_X509=y
+# CONFIG_MBEDTLS_LIB_TLS is not set
CONFIG_ECDSA=y
CONFIG_ECDSA_VERIFY=y
CONFIG_TPM=y
--
2.25.1
^ permalink raw reply related [flat|nested] 40+ messages in thread
* Re: [PATCH 05/23] test: py: add sudo for virt-make-fs
2024-04-16 19:00 ` [PATCH 05/23] test: py: add sudo for virt-make-fs Raymond Mao
@ 2024-04-16 19:19 ` Tom Rini
2024-04-16 23:52 ` Raymond Mao
0 siblings, 1 reply; 40+ messages in thread
From: Tom Rini @ 2024-04-16 19:19 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 422 bytes --]
On Tue, Apr 16, 2024 at 12:00:01PM -0700, Raymond Mao wrote:
> Fix a permission issue when running virt-make-fs
>
> Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
> ---
> test/py/tests/test_efi_secboot/conftest.py | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
Can you elaborate please? The point of virt-make-fs was, I could have
sworn, is that it doesn't require privileges.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 06/23] image: remove redundant hash includes
2024-04-16 19:00 ` [PATCH 06/23] image: remove redundant hash includes Raymond Mao
@ 2024-04-16 19:19 ` Tom Rini
2024-04-17 0:13 ` Raymond Mao
0 siblings, 1 reply; 40+ messages in thread
From: Tom Rini @ 2024-04-16 19:19 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 415 bytes --]
On Tue, Apr 16, 2024 at 12:00:02PM -0700, Raymond Mao wrote:
> Remove the redundant includes of u-boot/md5.h, u-boot/sha1.h,
> u-boot/sha256.h and u-boot/sha512.h
>
> Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
> ---
> boot/image-fit.c | 4 ----
> boot/image.c | 2 --
> 2 files changed, 6 deletions(-)
Can you please explain how these are redundant? It's not clear, thanks.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 11/23] efi_loader: switch sha256 to mbedtls
2024-04-16 19:00 ` [PATCH 11/23] efi_loader: switch sha256 to mbedtls Raymond Mao
@ 2024-04-16 19:22 ` Tom Rini
2024-04-17 0:22 ` Raymond Mao
0 siblings, 1 reply; 40+ messages in thread
From: Tom Rini @ 2024-04-16 19:22 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 454 bytes --]
On Tue, Apr 16, 2024 at 12:00:07PM -0700, Raymond Mao wrote:
> When MBEDTLS_LIB_CRYPTO is enabled, use the APIs of sha256 from
> hash shim layer instead.
>
> Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
> ---
> lib/efi_loader/efi_tcg2.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
Why can't we have the abstraction be at the level where we include one
library or the other so that the calling code doesn't change?
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (20 preceding siblings ...)
2024-04-16 19:00 ` [PATCH 23/23] configs: enable MbedTLS as default setting Raymond Mao
@ 2024-04-16 19:23 ` Tom Rini
2024-04-17 20:48 ` Raymond Mao
2024-04-16 20:26 ` Tom Rini
2024-04-16 23:12 ` Tom Rini
23 siblings, 1 reply; 40+ messages in thread
From: Tom Rini @ 2024-04-16 19:23 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 469 bytes --]
On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
> Integrate MbedTLS v3.6 LTS (currently v3.6.0-RC1) with U-Boot.
>
> Patch 01 and 02 are for introducing MbedTLS release package.
> I have to split it into 2 parts due to the size limitation of Gmail.
So to be clear, for v2 you need to switch this to subtrees, like we do
for upstream dts files now. And a script to automate the "merge a new
release" should be done as well. Thanks!
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (21 preceding siblings ...)
2024-04-16 19:23 ` [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Tom Rini
@ 2024-04-16 20:26 ` Tom Rini
2024-04-16 23:32 ` Raymond Mao
2024-04-16 23:12 ` Tom Rini
23 siblings, 1 reply; 40+ messages in thread
From: Tom Rini @ 2024-04-16 20:26 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 216 bytes --]
On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
> Integrate MbedTLS v3.6 LTS (currently v3.6.0-RC1) with U-Boot.
Please look in to:
https://source.denx.de/u-boot/u-boot/-/jobs/818534
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
` (22 preceding siblings ...)
2024-04-16 20:26 ` Tom Rini
@ 2024-04-16 23:12 ` Tom Rini
2024-04-16 23:47 ` Raymond Mao
23 siblings, 1 reply; 40+ messages in thread
From: Tom Rini @ 2024-04-16 23:12 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 1007 bytes --]
On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
[snip]
> [1]: bloat-o-meter output between disabling/enabling MbedTLS
> ```
> add/remove: 231/69 grow/shrink: 12/5 up/down: 60196/-11166 (49030)
I don't know if this is qemu_arm64 or sandbox. With buildman's size
comparison functions we see:
qemu_arm64 : all +75537 bss -88 data +24 rodata +6349 text +69252
u-boot: add: 274/-12, grow: 12/-4 bytes: 72002/-3800 (68202)
...
sandbox : all +57008 bss +32 data +1632 rodata +352 text +54992
u-boot: add: 143/-75, grow: 21/-18 bytes: 64058/-16523 (47535)
So please look in to using buildman to get more details about what's
changing, size-wise. Also, my goodness, that's far too much growth, and
we aren't removing anything? This needs to be a whole switch, not just
an addition. And then look in to what we can tweak / remove. Are we
perhaps not getting our usual link time garbage collection done?
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-16 20:26 ` Tom Rini
@ 2024-04-16 23:32 ` Raymond Mao
0 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 23:32 UTC (permalink / raw)
To: Tom Rini; +Cc: u-boot, ilias.apalodimas, xypron.glpk
Hi Tom,
On Tue, 16 Apr 2024 at 16:26, Tom Rini <trini@konsulko.com> wrote:
> On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
>
> > Integrate MbedTLS v3.6 LTS (currently v3.6.0-RC1) with U-Boot.
>
> Please look in to:
> https://source.denx.de/u-boot/u-boot/-/jobs/818534
Yes. I am aware of the test failures of capsule UT and stated in the cover
letter.
This will be addressed when we have agreement on the current approach.
Regards,
Raymond
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-16 23:12 ` Tom Rini
@ 2024-04-16 23:47 ` Raymond Mao
2024-04-16 23:50 ` Tom Rini
0 siblings, 1 reply; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 23:47 UTC (permalink / raw)
To: Tom Rini; +Cc: u-boot, ilias.apalodimas, xypron.glpk
Hi Tom,
On Tue, 16 Apr 2024 at 19:12, Tom Rini <trini@konsulko.com> wrote:
> On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
>
> [snip]
> > [1]: bloat-o-meter output between disabling/enabling MbedTLS
> > ```
> > add/remove: 231/69 grow/shrink: 12/5 up/down: 60196/-11166 (49030)
>
> I don't know if this is qemu_arm64 or sandbox. With buildman's size
> comparison functions we see:
> qemu_arm64 : all +75537 bss -88 data +24 rodata +6349 text
> +69252
> u-boot: add: 274/-12, grow: 12/-4 bytes: 72002/-3800 (68202)
> ...
> sandbox : all +57008 bss +32 data +1632 rodata +352
> text +54992
> u-boot: add: 143/-75, grow: 21/-18 bytes: 64058/-16523
> (47535)
>
> So please look in to using buildman to get more details about what's
> changing, size-wise. Also, my goodness, that's far too much growth, and
> we aren't removing anything? This needs to be a whole switch, not just
> an addition. And then look in to what we can tweak / remove. Are we
> perhaps not getting our usual link time garbage collection done?
>
As stated in the cover letter, with this patch set, we still build the
original libs
(lib/rsa, lib/asn1_decoder.c, lib/crypto/rsa_helper.c, lib/md5.c,
lib/sha1.c,
lib/sha256.c, lib/sha512.c) for the components outside of EFI loader.
Eventually all these will be completely switched and removed.
But I think we should do this in a sparated patch set - It is too big for
one
patch set.
So, as the first patch set, this one will introduce MbedTLS and enable it
with
EFI loader, after they are merged, the next patch set will switch other
components
to use MbedTLS and remove the original libs.
What are your thoughts?
Thanks and regards,
Raymond
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-16 23:47 ` Raymond Mao
@ 2024-04-16 23:50 ` Tom Rini
2024-04-17 0:03 ` Raymond Mao
0 siblings, 1 reply; 40+ messages in thread
From: Tom Rini @ 2024-04-16 23:50 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 2312 bytes --]
On Tue, Apr 16, 2024 at 07:47:44PM -0400, Raymond Mao wrote:
> Hi Tom,
>
> On Tue, 16 Apr 2024 at 19:12, Tom Rini <trini@konsulko.com> wrote:
>
> > On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
> >
> > [snip]
> > > [1]: bloat-o-meter output between disabling/enabling MbedTLS
> > > ```
> > > add/remove: 231/69 grow/shrink: 12/5 up/down: 60196/-11166 (49030)
> >
> > I don't know if this is qemu_arm64 or sandbox. With buildman's size
> > comparison functions we see:
> > qemu_arm64 : all +75537 bss -88 data +24 rodata +6349 text
> > +69252
> > u-boot: add: 274/-12, grow: 12/-4 bytes: 72002/-3800 (68202)
> > ...
> > sandbox : all +57008 bss +32 data +1632 rodata +352
> > text +54992
> > u-boot: add: 143/-75, grow: 21/-18 bytes: 64058/-16523
> > (47535)
> >
> > So please look in to using buildman to get more details about what's
> > changing, size-wise. Also, my goodness, that's far too much growth, and
> > we aren't removing anything? This needs to be a whole switch, not just
> > an addition. And then look in to what we can tweak / remove. Are we
> > perhaps not getting our usual link time garbage collection done?
> >
> As stated in the cover letter, with this patch set, we still build the
> original libs
> (lib/rsa, lib/asn1_decoder.c, lib/crypto/rsa_helper.c, lib/md5.c,
> lib/sha1.c,
> lib/sha256.c, lib/sha512.c) for the components outside of EFI loader.
> Eventually all these will be completely switched and removed.
> But I think we should do this in a sparated patch set - It is too big for
> one
> patch set.
> So, as the first patch set, this one will introduce MbedTLS and enable it
> with
> EFI loader, after they are merged, the next patch set will switch other
> components
> to use MbedTLS and remove the original libs.
> What are your thoughts?
My thoughts are that we need to implement this as the optional
replacement for the existing libraries. We already have abstractions for
most if not all of the algorithms I believe. And we need to be able to
see how much size growth we get from this change because long term we
don't really want to have two sets of libraries for this functionality
(as a SW rather than HW implementation).
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 05/23] test: py: add sudo for virt-make-fs
2024-04-16 19:19 ` Tom Rini
@ 2024-04-16 23:52 ` Raymond Mao
0 siblings, 0 replies; 40+ messages in thread
From: Raymond Mao @ 2024-04-16 23:52 UTC (permalink / raw)
To: Tom Rini; +Cc: u-boot, ilias.apalodimas, xypron.glpk
Hi Tom,
On Tue, 16 Apr 2024 at 15:19, Tom Rini <trini@konsulko.com> wrote:
> On Tue, Apr 16, 2024 at 12:00:01PM -0700, Raymond Mao wrote:
>
> > Fix a permission issue when running virt-make-fs
> >
> > Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
> > ---
> > test/py/tests/test_efi_secboot/conftest.py | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
>
> Can you elaborate please? The point of virt-make-fs was, I could have
> sworn, is that it doesn't require privileges.
>
> We can drop this patch from v2. The privileges issue is due to my Ubuntu
host setup (missing the permissions to access /boot/vmlinuz-*).
Thanks and regards,
Raymond
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-16 23:50 ` Tom Rini
@ 2024-04-17 0:03 ` Raymond Mao
2024-04-17 0:07 ` Tom Rini
0 siblings, 1 reply; 40+ messages in thread
From: Raymond Mao @ 2024-04-17 0:03 UTC (permalink / raw)
To: Tom Rini; +Cc: u-boot, ilias.apalodimas, xypron.glpk
Hi Tom,
On Tue, 16 Apr 2024 at 19:50, Tom Rini <trini@konsulko.com> wrote:
> On Tue, Apr 16, 2024 at 07:47:44PM -0400, Raymond Mao wrote:
> > Hi Tom,
> >
> > On Tue, 16 Apr 2024 at 19:12, Tom Rini <trini@konsulko.com> wrote:
> >
> > > On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
> > >
> > > [snip]
> > > > [1]: bloat-o-meter output between disabling/enabling MbedTLS
> > > > ```
> > > > add/remove: 231/69 grow/shrink: 12/5 up/down: 60196/-11166 (49030)
> > >
> > > I don't know if this is qemu_arm64 or sandbox. With buildman's size
> > > comparison functions we see:
> > > qemu_arm64 : all +75537 bss -88 data +24 rodata +6349
> text
> > > +69252
> > > u-boot: add: 274/-12, grow: 12/-4 bytes: 72002/-3800
> (68202)
> > > ...
> > > sandbox : all +57008 bss +32 data +1632 rodata +352
> > > text +54992
> > > u-boot: add: 143/-75, grow: 21/-18 bytes: 64058/-16523
> > > (47535)
> > >
> > > So please look in to using buildman to get more details about what's
> > > changing, size-wise. Also, my goodness, that's far too much growth, and
> > > we aren't removing anything? This needs to be a whole switch, not just
> > > an addition. And then look in to what we can tweak / remove. Are we
> > > perhaps not getting our usual link time garbage collection done?
> > >
> > As stated in the cover letter, with this patch set, we still build the
> > original libs
> > (lib/rsa, lib/asn1_decoder.c, lib/crypto/rsa_helper.c, lib/md5.c,
> > lib/sha1.c,
> > lib/sha256.c, lib/sha512.c) for the components outside of EFI loader.
> > Eventually all these will be completely switched and removed.
> > But I think we should do this in a sparated patch set - It is too big for
> > one
> > patch set.
> > So, as the first patch set, this one will introduce MbedTLS and enable it
> > with
> > EFI loader, after they are merged, the next patch set will switch other
> > components
> > to use MbedTLS and remove the original libs.
> > What are your thoughts?
>
> My thoughts are that we need to implement this as the optional
> replacement for the existing libraries. We already have abstractions for
> most if not all of the algorithms I believe. And we need to be able to
> see how much size growth we get from this change because long term we
> don't really want to have two sets of libraries for this functionality
> (as a SW rather than HW implementation).
>
> I see. With this version most of the lib/crypto that are used by EFI loader
(pkcs7, x509, public_key, mscode_parser, etc) are sharing the same
abstractions except the ones for hash.
I can replace them in v2, so that we can compare the final growth by
switching
on/off the MbedTLS build options.
Thanks and regards,
Raymond
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-17 0:03 ` Raymond Mao
@ 2024-04-17 0:07 ` Tom Rini
0 siblings, 0 replies; 40+ messages in thread
From: Tom Rini @ 2024-04-17 0:07 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 3126 bytes --]
On Tue, Apr 16, 2024 at 08:03:34PM -0400, Raymond Mao wrote:
> Hi Tom,
>
> On Tue, 16 Apr 2024 at 19:50, Tom Rini <trini@konsulko.com> wrote:
>
> > On Tue, Apr 16, 2024 at 07:47:44PM -0400, Raymond Mao wrote:
> > > Hi Tom,
> > >
> > > On Tue, 16 Apr 2024 at 19:12, Tom Rini <trini@konsulko.com> wrote:
> > >
> > > > On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
> > > >
> > > > [snip]
> > > > > [1]: bloat-o-meter output between disabling/enabling MbedTLS
> > > > > ```
> > > > > add/remove: 231/69 grow/shrink: 12/5 up/down: 60196/-11166 (49030)
> > > >
> > > > I don't know if this is qemu_arm64 or sandbox. With buildman's size
> > > > comparison functions we see:
> > > > qemu_arm64 : all +75537 bss -88 data +24 rodata +6349
> > text
> > > > +69252
> > > > u-boot: add: 274/-12, grow: 12/-4 bytes: 72002/-3800
> > (68202)
> > > > ...
> > > > sandbox : all +57008 bss +32 data +1632 rodata +352
> > > > text +54992
> > > > u-boot: add: 143/-75, grow: 21/-18 bytes: 64058/-16523
> > > > (47535)
> > > >
> > > > So please look in to using buildman to get more details about what's
> > > > changing, size-wise. Also, my goodness, that's far too much growth, and
> > > > we aren't removing anything? This needs to be a whole switch, not just
> > > > an addition. And then look in to what we can tweak / remove. Are we
> > > > perhaps not getting our usual link time garbage collection done?
> > > >
> > > As stated in the cover letter, with this patch set, we still build the
> > > original libs
> > > (lib/rsa, lib/asn1_decoder.c, lib/crypto/rsa_helper.c, lib/md5.c,
> > > lib/sha1.c,
> > > lib/sha256.c, lib/sha512.c) for the components outside of EFI loader.
> > > Eventually all these will be completely switched and removed.
> > > But I think we should do this in a sparated patch set - It is too big for
> > > one
> > > patch set.
> > > So, as the first patch set, this one will introduce MbedTLS and enable it
> > > with
> > > EFI loader, after they are merged, the next patch set will switch other
> > > components
> > > to use MbedTLS and remove the original libs.
> > > What are your thoughts?
> >
> > My thoughts are that we need to implement this as the optional
> > replacement for the existing libraries. We already have abstractions for
> > most if not all of the algorithms I believe. And we need to be able to
> > see how much size growth we get from this change because long term we
> > don't really want to have two sets of libraries for this functionality
> > (as a SW rather than HW implementation).
> >
> > I see. With this version most of the lib/crypto that are used by EFI loader
> (pkcs7, x509, public_key, mscode_parser, etc) are sharing the same
> abstractions except the ones for hash.
> I can replace them in v2, so that we can compare the final growth by
> switching
> on/off the MbedTLS build options.
If there's abstractions we need first, lets get that done as a prereq
series and then see what things are before/after. Thanks.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 06/23] image: remove redundant hash includes
2024-04-16 19:19 ` Tom Rini
@ 2024-04-17 0:13 ` Raymond Mao
2024-04-17 0:19 ` Tom Rini
0 siblings, 1 reply; 40+ messages in thread
From: Raymond Mao @ 2024-04-17 0:13 UTC (permalink / raw)
To: Tom Rini; +Cc: u-boot, ilias.apalodimas, xypron.glpk
Hi Tom,
On Tue, 16 Apr 2024 at 15:19, Tom Rini <trini@konsulko.com> wrote:
> On Tue, Apr 16, 2024 at 12:00:02PM -0700, Raymond Mao wrote:
>
> > Remove the redundant includes of u-boot/md5.h, u-boot/sha1.h,
> > u-boot/sha256.h and u-boot/sha512.h
> >
> > Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
> > ---
> > boot/image-fit.c | 4 ----
> > boot/image.c | 2 --
> > 2 files changed, 6 deletions(-)
>
> Can you please explain how these are redundant? It's not clear, thanks.
>
> Both image.c and image-fit.c include image.h that
includes <u-boot/hash-checksum.h>.
So we don't need to explicitly repeat "#include <u-boot/<digest>.h>" in
both files.
Thanks and regards,
Raymond
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 06/23] image: remove redundant hash includes
2024-04-17 0:13 ` Raymond Mao
@ 2024-04-17 0:19 ` Tom Rini
0 siblings, 0 replies; 40+ messages in thread
From: Tom Rini @ 2024-04-17 0:19 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 961 bytes --]
On Tue, Apr 16, 2024 at 08:13:53PM -0400, Raymond Mao wrote:
> Hi Tom,
>
> On Tue, 16 Apr 2024 at 15:19, Tom Rini <trini@konsulko.com> wrote:
>
> > On Tue, Apr 16, 2024 at 12:00:02PM -0700, Raymond Mao wrote:
> >
> > > Remove the redundant includes of u-boot/md5.h, u-boot/sha1.h,
> > > u-boot/sha256.h and u-boot/sha512.h
> > >
> > > Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
> > > ---
> > > boot/image-fit.c | 4 ----
> > > boot/image.c | 2 --
> > > 2 files changed, 6 deletions(-)
> >
> > Can you please explain how these are redundant? It's not clear, thanks.
> >
> > Both image.c and image-fit.c include image.h that
> includes <u-boot/hash-checksum.h>.
> So we don't need to explicitly repeat "#include <u-boot/<digest>.h>" in
> both files.
OK, so lets move this to a prep series patch then please, and then later
<u-boot/hash-checksum.h> can if/as needed get the right headers for
mbedtls or not.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 11/23] efi_loader: switch sha256 to mbedtls
2024-04-16 19:22 ` Tom Rini
@ 2024-04-17 0:22 ` Raymond Mao
2024-04-17 0:25 ` Tom Rini
0 siblings, 1 reply; 40+ messages in thread
From: Raymond Mao @ 2024-04-17 0:22 UTC (permalink / raw)
To: Tom Rini; +Cc: u-boot, ilias.apalodimas, xypron.glpk
Hi Tom,
On Tue, 16 Apr 2024 at 15:22, Tom Rini <trini@konsulko.com> wrote:
> On Tue, Apr 16, 2024 at 12:00:07PM -0700, Raymond Mao wrote:
>
> > When MBEDTLS_LIB_CRYPTO is enabled, use the APIs of sha256 from
> > hash shim layer instead.
> >
> > Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
> > ---
> > lib/efi_loader/efi_tcg2.c | 9 +++++++++
> > 1 file changed, 9 insertions(+)
>
> Why can't we have the abstraction be at the level where we include one
> library or the other so that the calling code doesn't change?
>
> Yes, we can do this - The only reason I added new hash APIs with "_mb" is
just to
avoid vendor drivers that are using hash functions switch to MbedTLS with
this
patch set (As a [RFC], I was going to control all effects within the EFI
loader).
But if you think a complete switching has more benefits for estimation, I
can unify
all APIs between on/off MbedTLS.
Thanks and Regards,
Raymond
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 11/23] efi_loader: switch sha256 to mbedtls
2024-04-17 0:22 ` Raymond Mao
@ 2024-04-17 0:25 ` Tom Rini
0 siblings, 0 replies; 40+ messages in thread
From: Tom Rini @ 2024-04-17 0:25 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 1079 bytes --]
On Tue, Apr 16, 2024 at 08:22:23PM -0400, Raymond Mao wrote:
> Hi Tom,
>
> On Tue, 16 Apr 2024 at 15:22, Tom Rini <trini@konsulko.com> wrote:
>
> > On Tue, Apr 16, 2024 at 12:00:07PM -0700, Raymond Mao wrote:
> >
> > > When MBEDTLS_LIB_CRYPTO is enabled, use the APIs of sha256 from
> > > hash shim layer instead.
> > >
> > > Signed-off-by: Raymond Mao <raymond.mao@linaro.org>
> > > ---
> > > lib/efi_loader/efi_tcg2.c | 9 +++++++++
> > > 1 file changed, 9 insertions(+)
> >
> > Why can't we have the abstraction be at the level where we include one
> > library or the other so that the calling code doesn't change?
> >
> > Yes, we can do this - The only reason I added new hash APIs with "_mb" is
> just to
> avoid vendor drivers that are using hash functions switch to MbedTLS with
> this
> patch set (As a [RFC], I was going to control all effects within the EFI
> loader).
> But if you think a complete switching has more benefits for estimation, I
> can unify
> all APIs between on/off MbedTLS.
Yes, please, a complete switch.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-16 19:23 ` [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Tom Rini
@ 2024-04-17 20:48 ` Raymond Mao
2024-04-17 20:54 ` Tom Rini
0 siblings, 1 reply; 40+ messages in thread
From: Raymond Mao @ 2024-04-17 20:48 UTC (permalink / raw)
To: Tom Rini; +Cc: u-boot, ilias.apalodimas, xypron.glpk
Hi Tom,
On Tue, 16 Apr 2024 at 15:23, Tom Rini <trini@konsulko.com> wrote:
> On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
>
> > Integrate MbedTLS v3.6 LTS (currently v3.6.0-RC1) with U-Boot.
> >
> > Patch 01 and 02 are for introducing MbedTLS release package.
> > I have to split it into 2 parts due to the size limitation of Gmail.
>
> So to be clear, for v2 you need to switch this to subtrees, like we do
> for upstream dts files now. And a script to automate the "merge a new
> release" should be done as well. Thanks!
>
> Just to confirm, for v2, I don't need to send the commit that was generated
by "git subtree add ***" but just state the command as a prerequisite in the
commit message, right? Like what was done for the commit id
"5b825032957c2613ef2f8f639e949ae02cb5bdff".
Thanks and regards,
Raymond
^ permalink raw reply [flat|nested] 40+ messages in thread
* Re: [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot
2024-04-17 20:48 ` Raymond Mao
@ 2024-04-17 20:54 ` Tom Rini
0 siblings, 0 replies; 40+ messages in thread
From: Tom Rini @ 2024-04-17 20:54 UTC (permalink / raw)
To: Raymond Mao; +Cc: u-boot, ilias.apalodimas, xypron.glpk
[-- Attachment #1: Type: text/plain, Size: 1219 bytes --]
On Wed, Apr 17, 2024 at 04:48:14PM -0400, Raymond Mao wrote:
> Hi Tom,
>
> On Tue, 16 Apr 2024 at 15:23, Tom Rini <trini@konsulko.com> wrote:
>
> > On Tue, Apr 16, 2024 at 11:59:56AM -0700, Raymond Mao wrote:
> >
> > > Integrate MbedTLS v3.6 LTS (currently v3.6.0-RC1) with U-Boot.
> > >
> > > Patch 01 and 02 are for introducing MbedTLS release package.
> > > I have to split it into 2 parts due to the size limitation of Gmail.
> >
> > So to be clear, for v2 you need to switch this to subtrees, like we do
> > for upstream dts files now. And a script to automate the "merge a new
> > release" should be done as well. Thanks!
> >
> Just to confirm, for v2, I don't need to send the commit that was generated
> by "git subtree add ***" but just state the command as a prerequisite in the
> commit message, right? Like what was done for the commit id
> "5b825032957c2613ef2f8f639e949ae02cb5bdff".
Yes, correct. For testing, people will be expected to either:
- Manually "git subtree add ..."
- Use the script that your series will add for syncing, to perform the
initial import.
The script for devicetree-rebasing handles this already so should be a
good model, I believe.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 40+ messages in thread
end of thread, other threads:[~2024-04-17 20:54 UTC | newest]
Thread overview: 40+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-04-16 18:59 [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Raymond Mao
2024-04-16 18:59 ` [PATCH 03/23] mbedtls: add mbedtls into the build system Raymond Mao
2024-04-16 19:00 ` [PATCH 04/23] arm: EFI linker script text section alignment Raymond Mao
2024-04-16 19:00 ` [PATCH 05/23] test: py: add sudo for virt-make-fs Raymond Mao
2024-04-16 19:19 ` Tom Rini
2024-04-16 23:52 ` Raymond Mao
2024-04-16 19:00 ` [PATCH 06/23] image: remove redundant hash includes Raymond Mao
2024-04-16 19:19 ` Tom Rini
2024-04-17 0:13 ` Raymond Mao
2024-04-17 0:19 ` Tom Rini
2024-04-16 19:00 ` [PATCH 07/23] efi_loader: " Raymond Mao
2024-04-16 19:00 ` [PATCH 08/23] mbedtls: add hash shim layer Raymond Mao
2024-04-16 19:00 ` [PATCH 09/23] hash: integrate hash on mbedtls Raymond Mao
2024-04-16 19:00 ` [PATCH 10/23] makefile: add mbedtls include directories Raymond Mao
2024-04-16 19:00 ` [PATCH 11/23] efi_loader: switch sha256 to mbedtls Raymond Mao
2024-04-16 19:22 ` Tom Rini
2024-04-17 0:22 ` Raymond Mao
2024-04-17 0:25 ` Tom Rini
2024-04-16 19:00 ` [PATCH 12/23] image: " Raymond Mao
2024-04-16 19:00 ` [PATCH 13/23] mbedtls/external: support MicroSoft Authentication Code Raymond Mao
2024-04-16 19:00 ` [PATCH 14/23] mbedtls/external: support PKCS9 Authenticate Attributes Raymond Mao
2024-04-16 19:00 ` [PATCH 15/23] mbedtls/external: support decoding multiple signer's cert Raymond Mao
2024-04-16 19:00 ` [PATCH 16/23] mbedtls/external: update MbedTLS PKCS7 test suites Raymond Mao
2024-04-16 19:00 ` [PATCH 17/23] lib/crypto: Port public_key on MbedTLS Raymond Mao
2024-04-16 19:00 ` [PATCH 18/23] lib/crypto: Port x509_cert_parser " Raymond Mao
2024-04-16 19:00 ` [PATCH 19/23] lib/crypto: port PKCS7 parser " Raymond Mao
2024-04-16 19:00 ` [PATCH 20/23] lib/crypto: port MSCode " Raymond Mao
2024-04-16 19:00 ` [PATCH 21/23] lib/crypto: remove dependence on ASN1 decoder Raymond Mao
2024-04-16 19:00 ` [PATCH 22/23] mbedtls: disable the unused features Raymond Mao
2024-04-16 19:00 ` [PATCH 23/23] configs: enable MbedTLS as default setting Raymond Mao
2024-04-16 19:23 ` [PATCH 00/23] [RFC] Integrate MbedTLS v3.6 LTS with U-Boot Tom Rini
2024-04-17 20:48 ` Raymond Mao
2024-04-17 20:54 ` Tom Rini
2024-04-16 20:26 ` Tom Rini
2024-04-16 23:32 ` Raymond Mao
2024-04-16 23:12 ` Tom Rini
2024-04-16 23:47 ` Raymond Mao
2024-04-16 23:50 ` Tom Rini
2024-04-17 0:03 ` Raymond Mao
2024-04-17 0:07 ` Tom Rini
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.