Add Mbed TLS 4.x support#2499
Closed
daveisfera wants to merge 4 commits into
Closed
Conversation
Auto-detect Mbed TLS 4.x and adapt the TLS backend for PSA init, removed CTR-DRBG/RNG callbacks, tfpsacrypto linking, and TLS 1.3 session-ticket retries so 2.x/3.x/4.x all work through CPPHTTPLIB_MBEDTLS_SUPPORT. Co-authored-by: Cursor <cursoragent@cursor.com>
Mbed TLS 4 rejects PBE-SHA1-3DES encrypted client keys used by gen-certs, so generate PBES2 AES-wrapped keys instead. Also satisfy clang-format 18. Co-authored-by: Cursor <cursoragent@cursor.com>
Ubuntu's Mbed TLS 2.28 can only decrypt DES/PBES1 keys, while 4.x rejects DES. Generate both wraps from one keypair and select by Mbed TLS version. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Author
|
Looks like you made your own version of this with #2502 so close this if you'd like |
Owner
|
@daveisfera, thanks for the pull request! The reason httplib didn’t support MbedTLS 4.x is that package managers like apt and Homebrew didn’t provide 4.x packages yet. However, Homebrew has now started using 4.x as the default instead of 3.5, so I can use it without building from source. I’ve just tried implementing 4.x support in my version with as few changes as possible. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CPPHTTPLIB_MBEDTLS_V4): PSA Crypto init, drop CTR-DRBG/mbedtls_ssl_conf_rng, use PSA hashes, and linklibtfpsacryptowhen present.MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKETas non-fatal so online HTTPS works on 4.x.mbedtls4CI coverage on Ubuntu (build from release tarball), macOS (Homebrew), and proxy tests.Test plan
ubuntu (mbedtls4),macos (mbedtls4),proxy (mbedtls4)mbedtls(3.x) jobs still greenMade with Cursor