Add initial mbedTLS v4 support #3477

airween · 2026-01-25T19:35:09Z

Let me check the new version on mbedtls, and make sure that all of these sources are necessary.

airween · 2026-01-25T19:40:43Z

Could you explain why did you changed the sha1 by sha256? This will gives a longer ID (sha1 length is 40 char hex, sha256's 64 char hex) - are we sure users want to use that?

And I'm not sure here sha256 gives any benefit (strong of cryptography is no matter here).

-Original file line number
+Diff line change
@@ -1,8 +1,6 @@
     #!/bin/sh
     rm -rf autom4te.cache
     rm -f aclocal.m4
     cd src
     rm -f headers.mk
     echo "noinst_HEADERS = \\" > headers.mk
@@ Expand All / @@ -23,13 +21,35 @@ ls -1 \ @@
         engine/*.h \
         *.h | tr "\012" " " >> headers.mk
     cd ../
+    ##############################################################################
+    # NEW: Automatically generate psa_crypto_driver_wrappers.h, path will be searched
+    ##############################################################################
+    echo "[+] Searching for psa_crypto_driver_wrappers.h …"
+    if ! find . -maxdepth 10 -type f -name 'psa_crypto_driver_wrappers.h' | grep -q \
+    .; then
+        echo "[+] File not found, searching for generate_driver_wrappers.py …"
+        GEN_SCRIPT=$(find . -maxdepth 10 -type f -name 'generate_driver_wrappers.py' | head -n 1)
+        if [ -n "$GEN_SCRIPT" ]; then
+            GEN_DIR=$(dirname "$GEN_SCRIPT")
+            echo "[+] Generator script found in: $GEN_DIR"
+            (
+                cd "$GEN_DIR" || exit 1
+                # optional: silently install Python dependencies
+                python3 -m pip install --user jinja2 jsonschema >/dev/null 2>&1 || true
+                echo "[+] Running: python3 $(basename "$GEN_SCRIPT")"
+                python3 "$(basename "$GEN_SCRIPT")"
+            )
+        else
+            echo "[!] No generate_driver_wrappers.py found – skipping this step."
+        fi
+    else
+        echo "[+] psa_crypto_driver_wrappers.h already exists, nothing to do."
+    fi
+    ##############################################################################
     case `uname` in Darwin*) glibtoolize --force --copy ;;
       *) libtoolize --force --copy ;; esac
     autoreconf --install
     autoheader
     automake --add-missing --foreign --copy --force-missing
     autoconf --force
     rm -rf autom4te.cache

-Original file line number
+Diff line change
@@ Expand Up @@
     AC_SUBST([LIBINJECTION_VERSION])
     # Check for Mbed TLS
-    if ! test -f "${srcdir}/others/mbedtls/library/base64.c"; then
+    if ! test -f "${srcdir}/others/mbedtls/tf-psa-crypto/drivers/builtin/src/base64.c"; then
     AC_MSG_ERROR([\
@@ Expand Down Expand Up / @@ -372,6 +372,15 @@ case $assertions in @@
     esac
     GLOBAL_CPPFLAGS="$GLOBAL_CPPFLAGS $ASSERTIONS_CPPCFLAGS"
+    MBEDTLS_CPPFLAGS='-DMBEDTLS_CONFIG_FILE=\"mbedtls/mbedtls_config.h\" \
+    -I$(top_srcdir)/others/mbedtls/include \
+    -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/include \
+    -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/drivers/builtin/include \
+    -I$(top_srcdir)/others/mbedtls/include \
+    -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/core \
+    -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/drivers/builtin/src'
+    GLOBAL_CPPFLAGS="$GLOBAL_CPPFLAGS $MBEDTLS_CPPFLAGS"
     AC_SUBST(GLOBAL_LDADD)
     AC_SUBST(GLOBAL_CPPFLAGS)
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up / @@ -15,19 +15,99 @@ noinst_HEADERS = \ @@
     	libinjection/src/libinjection_sqli.h \
     	libinjection/src/libinjection_sqli_data.h \
     	libinjection/src/libinjection_xss.h \
-    	mbedtls/include/mbedtls/base64.h \
-    	mbedtls/include/mbedtls/check_config.h \
+    	mbedtls/tf-psa-crypto/include/mbedtls/base64.h \
+    	mbedtls/tf-psa-crypto/drivers/builtin/src/check_crypto_config.h \
     	mbedtls/include/mbedtls/mbedtls_config.h \
-    	mbedtls/include/mbedtls/md5.h \
-    	mbedtls/include/mbedtls/platform.h \
-    	mbedtls/include/mbedtls/sha1.h
+    	mbedtls/tf-psa-crypto/drivers/builtin/include/mbedtls/private/md5.h \
+    	mbedtls/tf-psa-crypto/include/mbedtls/platform.h \
+    	mbedtls/tf-psa-crypto/drivers/builtin/include/mbedtls/private/sha1.h
+    MBED_PSA_CORE_SOURCES = \
+            mbedtls/tf-psa-crypto/core/psa_crypto.c \
+            mbedtls/tf-psa-crypto/core/psa_crypto_client.c \
+            mbedtls/tf-psa-crypto/core/psa_crypto_slot_management.c \
+            mbedtls/tf-psa-crypto/core/psa_crypto_storage.c \
+            mbedtls/tf-psa-crypto/core/psa_its_file.c \
+            mbedtls/tf-psa-crypto/core/psa_crypto_driver_wrappers_no_static.c
+    MBED_BUILTIN_SOURCES = \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/aes.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/aesce.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/aesni.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/aria.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/asn1parse.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/asn1write.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/base64.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/bignum.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_core.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_mod.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/bignum_mod_raw.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/block_cipher.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/camellia.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ccm.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/chacha20.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/chachapoly.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/cipher.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/cipher_wrap.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/cmac.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/constant_time.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ctr_drbg.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ecdh.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ecdsa.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ecjpake.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ecp.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ecp_curves.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ecp_curves_new.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/entropy.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/entropy_poll.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/gcm.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/hmac_drbg.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/md.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/md5.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/memory_buffer_alloc.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/nist_kw.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/oid.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/pem.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/pk.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/pk_ecc.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/pk_rsa.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/pk_wrap.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/pkcs5.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/pkparse.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/pkwrite.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/platform.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/platform_util.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/poly1305.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_aead.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_cipher.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_ecp.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_ffdh.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_hash.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_mac.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_pake.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_crypto_rsa.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/psa_util.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/ripemd160.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/rsa.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/rsa_alt_helpers.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/sha1.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/sha256.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/sha3.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/sha512.c \
+            mbedtls/tf-psa-crypto/drivers/builtin/src/threading.c
     libmbedtls_la_SOURCES = \
-    	mbedtls/library/base64.c \
-    	mbedtls/library/md5.c \
-    	mbedtls/library/sha1.c \
-    	mbedtls/library/platform_util.c
+            $(MBED_PSA_CORE_SOURCES) \
+            $(MBED_BUILTIN_SOURCES)
-    libmbedtls_la_CFLAGS = -DMBEDTLS_CONFIG_FILE=\"mbedtls/mbedtls_config.h\" -I$(top_srcdir)/others/mbedtls/include
-    libmbedtls_la_CPPFLAGS =
+    libmbedtls_la_CPPFLAGS = \
+            -DMBEDTLS_CONFIG_FILE=\"mbedtls/mbedtls_config.h\" \
+            -I$(top_srcdir)/others/mbedtls/include \
+            -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/include \
+            -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/core \
+            -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/drivers/builtin/include \
+            -I$(top_srcdir)/others/mbedtls/tf-psa-crypto/drivers/builtin/src
+    #libmbedtls_la_CPPFLAGS =
     libmbedtls_la_LIBADD =

-Original file line number
+Diff line change
@@ Expand Up / @@ -56,7 +56,8 @@ @@
     #endif
     #include <string.h>
-    #include "src/utils/sha1.h"
+    /*#include "src/utils/sha1.h"*/
+    #include "src/utils/sha256.h"
     namespace modsecurity {
@@ Expand All / @@ -72,7 +73,7 @@ void UniqueId::fillUniqueId() { @@
         data = macAddress + name;
-        this->uniqueId_str = Utils::Sha1::hexdigest(data);
+        this->uniqueId_str = Utils::Sha256::hexdigest(data);
     }
     // Based on:
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up / @@ -16,17 +16,37 @@ @@
     #ifndef SRC_UTILS_MD5_H_
     #define SRC_UTILS_MD5_H_
-    #include "src/utils/sha1.h"
-    #include "mbedtls/md5.h"
+    #include "src/utils/sha1.h"   // uses DigestImpl + detail::ensure_psa_init()
     #include <string>
-    namespace modsecurity::Utils {
+    #include <psa/crypto.h>       // optional (since sha1.h already includes it), but ok
-    class Md5 : public DigestImpl<&mbedtls_md5, 16> {
-    };
+    namespace modsecurity::Utils {
+    // PSA wrapper with legacy signature
+    inline int modsec_psa_md5(const unsigned char *input,
+                              size_t ilen,
+                              unsigned char output[16])
+    {
+        if (!detail::ensure_psa_init()) {
+            return -1;
+        }
+        size_t out_len = 0;
+        psa_status_t status = psa_hash_compute(
+            PSA_ALG_MD5,
+            input,
+            ilen,
+            output,
+,
+            &out_len
+        );
+        return (status == PSA_SUCCESS && out_len == 16) ? 0 : -1;
+    }
+    class Md5 : public DigestImpl<&modsec_psa_md5, 16> {};
     }  // namespace modsecurity::Utils
-    #endif  // SRC_UTILS_MD5_H_
+    #endif  // SRC_UTILS_MD5_H_

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add initial mbedTLS v4 support #3477

Uh oh!

Diff view

Diff view

There are no files selected for viewing

airween Jan 25, 2026

Uh oh!

airween Jan 25, 2026

Uh oh!

Uh oh!

-Original file line number
+Diff line change
@@ Expand Up / @@ -16,60 +16,104 @@ @@
     #ifndef SRC_UTILS_SHA1_H_
     #define SRC_UTILS_SHA1_H_
+    #include <array>
+    #include <cstddef>
+    #include <cstring>
+    #include <mutex>
     #include <string>
-    #include <cassert>
+    #include <string_view>
     #include "src/utils/string.h"
-    #include "mbedtls/sha1.h"
+    #include <psa/crypto.h>
     namespace modsecurity::Utils {
+    namespace detail {
-    using DigestOp = int (*)(const unsigned char *, size_t, unsigned char []);
+    // Thread-safe PSA initialization shared by all digests
+    inline bool ensure_psa_init() {
+        static std::once_flag once;
+        static psa_status_t init_status = PSA_ERROR_GENERIC_ERROR;
+        std::call_once(once, []() { init_status = psa_crypto_init(); });
-    template<DigestOp digestOp, int DigestSize>
+        return init_status == PSA_SUCCESS;
+    }
+    }  // namespace detail
+    // C-friendly digest function signature (matches legacy wrappers like modsec_psa_md5)
+    template <std::size_t DigestSize>
+    using DigestOp = int (*)(const unsigned char* input,
+                             std::size_t input_len,
+                             unsigned char* output);
+    // Generic digest implementation
+    template <auto DigestFn, std::size_t DigestSize>
     class DigestImpl {
      public:
         static std::string digest(const std::string& input) {
-            return digestHelper(input, [](const auto digest) {
-                return std::string(digest);
+            return digestHelper(input, [](std::string_view d) {
+                return std::string{d};
             });
         }
         static void digestReplace(std::string& value) {
-            digestHelper(value, [&value](const auto digest) mutable {
-                value = digest;
-            });
+            value = digest(value);
         }
-        static std::string hexdigest(const std::string &input) {
-            return digestHelper(input, [](const auto digest) {
-                return utils::string::string_to_hex(digest);
+        static std::string hexdigest(const std::string& input) {
+            return digestHelper(input, [](std::string_view d) {
+                return utils::string::string_to_hex(d);
             });
         }
-    private:
+     private:
+        template <typename ConvertOp>
+        static auto digestHelper(const std::string& input, ConvertOp convertOp)
+            -> decltype(convertOp(std::string_view{})) {
-        template<typename ConvertOp>
-        static auto digestHelper(const std::string &input,
-            ConvertOp convertOp) -> auto {
-            char digest[DigestSize];
+            std::array<unsigned char, DigestSize> out{};
+            const std::string_view sv{input};
-            const auto ret = (*digestOp)(reinterpret_cast<const unsigned char *>(input.c_str()),
-                     input.size(), reinterpret_cast<unsigned char *>(digest));
-            assert(ret == 0);
+            const auto* in_ptr =
+                reinterpret_cast<const unsigned char*>(sv.data());
+            const std::size_t in_len = sv.size();
-            return convertOp(std::string_view(digest, DigestSize));
+            if (DigestFn(in_ptr, in_len, out.data()) != 0) {
+                return convertOp(std::string_view{});
+            }
+            std::string raw(DigestSize, '\0');
+            std::memcpy(raw.data(), out.data(), DigestSize);
+            return convertOp(std::string_view{raw});
         }
     };
+    // PSA wrapper for SHA-1 (0 = success, non-zero = error)
+    inline int modsec_psa_sha1(const unsigned char* input,
+                               std::size_t ilen,
+                               unsigned char* output) {
+        if (!detail::ensure_psa_init()) {
+            return -1;
+        }
-    class Sha1 : public DigestImpl<&mbedtls_sha1, 20> {
-    };
+        size_t out_len = 0;
+        psa_status_t status = psa_hash_compute(
+            PSA_ALG_SHA_1,
+            input,
+            ilen,
+            output,
+,
+            &out_len
+        );
+        return (status == PSA_SUCCESS && out_len == 20) ? 0 : -1;
+    }
+    class Sha1 : public DigestImpl<&modsec_psa_sha1, 20> {};
     }  // namespace modsecurity::Utils
     #endif  // SRC_UTILS_SHA1_H_

Add initial mbedTLS v4 support #3477

Are you sure you want to change the base?

Uh oh!

Add initial mbedTLS v4 support #3477

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

airween Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

airween Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!