Skip to content

Commit 9328b6c

Browse files
author
jens
committed
improve-mbedtls-v4-integration-for-macos-and-windows
1 parent 61cbe42 commit 9328b6c

8 files changed

Lines changed: 399 additions & 107 deletions

File tree

‎.github/workflows/ci_new.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -206,7 +206,7 @@ jobs:
206206

207207
- name: Install cppcheck
208208
run: |
209-
brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep
209+
brew install autoconf automake libtool cppcheck libmaxminddb yajl lua lmdb ssdeep python3
210210
211211
- name: Configure project
212212
run: |
@@ -256,7 +256,9 @@ jobs:
256256
libfuzzy-dev \
257257
pcre2-utils \
258258
bison \
259-
flex
259+
flex \
260+
python3 \
261+
python3-venv
260262
261263
- name: Run build preparation script
262264
run: ./build.sh

‎Makefile.am‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,12 @@ parser:
5454
cat src/parser/seclang-parser.hh | sed "s/return \*new (yyas_<T> ()) T (t)/return *new (yyas_<T> ()) T (std::move((T\&)t))/g" > src/parser/seclang-parser.hh.fix && mv src/parser/seclang-parser.hh.fix src/parser/seclang-parser.hh
5555

5656

57+
CPPCHECK_EXCLUDES = \
58+
src/parser/seclang-parser.cc \
59+
src/parser/seclang-scanner.cc \
60+
others \
61+
.build-venv
62+
5763

5864
cppcheck:
5965
@cppcheck -U YYSTYPE -U MBEDTLS_MD5_ALT -U MBEDTLS_SHA1_ALT \
@@ -65,8 +71,7 @@ cppcheck:
6571
--template="warning: {file},{line},{severity},{id},{message}" \
6672
-I headers -I . -I $(top_srcdir)/others -I $(top_srcdir)/src -I $(top_srcdir)/others/mbedtls/include \
6773
--error-exitcode=1 \
68-
-i "src/parser/seclang-parser.cc" -i "src/parser/seclang-scanner.cc" \
69-
-i others \
74+
$(foreach path,$(CPPCHECK_EXCLUDES),-i "$(path)") \
7075
--std=c++17 \
7176
--force --verbose .
7277

‎build.sh‎

Lines changed: 3 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -21,31 +21,9 @@ ls -1 \
2121
engine/*.h \
2222
*.h | tr "\012" " " >> headers.mk
2323
cd ../
24-
##############################################################################
25-
# NEW: Automatically generate psa_crypto_driver_wrappers.h, path will be searched
26-
##############################################################################
27-
echo "[+] Searching for psa_crypto_driver_wrappers.h …"
28-
if ! find . -maxdepth 10 -type f -name 'psa_crypto_driver_wrappers.h' | grep -q \
29-
.; then
30-
echo "[+] File not found, searching for generate_driver_wrappers.py …"
31-
GEN_SCRIPT=$(find . -maxdepth 10 -type f -name 'generate_driver_wrappers.py' | head -n 1)
32-
if [ -n "$GEN_SCRIPT" ]; then
33-
GEN_DIR=$(dirname "$GEN_SCRIPT")
34-
echo "[+] Generator script found in: $GEN_DIR"
35-
(
36-
cd "$GEN_DIR" || exit 1
37-
# optional: silently install Python dependencies
38-
python3 -m pip install --user jinja2 jsonschema >/dev/null 2>&1 || true
39-
echo "[+] Running: python3 $(basename "$GEN_SCRIPT")"
40-
python3 "$(basename "$GEN_SCRIPT")"
41-
)
42-
else
43-
echo "[!] No generate_driver_wrappers.py found – skipping this step."
44-
fi
45-
else
46-
echo "[+] psa_crypto_driver_wrappers.h already exists, nothing to do."
47-
fi
48-
##############################################################################
24+
25+
./build/gen-mbedtls-sources.py
26+
4927
case `uname` in Darwin*) glibtoolize --force --copy ;;
5028
*) libtoolize --force --copy ;; esac
5129
autoreconf --install

‎build/gen-mbedtls-sources.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/usr/bin/env python3
2+
from pathlib import Path
3+
4+
root = Path(__file__).resolve().parents[1]
5+
core_dir = root / "others/mbedtls/tf-psa-crypto/core"
6+
builtin_dir = root / "others/mbedtls/tf-psa-crypto/drivers/builtin/src"
7+
out = root / "others/mbedtls_sources.mk"
8+
9+
header = "# Auto-generated by build/gen-mbedtls-sources.py. Do not edit manually.\n"
10+
11+
if not core_dir.is_dir() or not builtin_dir.is_dir():
12+
raise SystemExit(
13+
"mbedTLS submodule is not initialized. Run: git submodule update --init --recursive others/mbedtls"
14+
)
15+
16+
core = [
17+
p.relative_to(root / "others").as_posix()
18+
for p in sorted(core_dir.glob("*.c"))
19+
if p.name != "psa_crypto_driver_wrappers_no_static.c"
20+
]
21+
builtin = [p.relative_to(root / "others").as_posix() for p in sorted(builtin_dir.glob("*.c"))]
22+
23+
24+
def emit(name: str, items: list[str]) -> str:
25+
if not items:
26+
return f"{name} =\n"
27+
lines = [f"{name} = \\\n"]
28+
for i, item in enumerate(items):
29+
suffix = " \\\n" if i < len(items) - 1 else "\n"
30+
lines.append(f" {item}{suffix}")
31+
return "".join(lines)
32+
33+
out.write_text(header + emit("MBED_PSA_CORE_SOURCES", core) + "\n" + emit("MBED_BUILTIN_SOURCES", builtin), encoding="utf-8")

‎build/win32/CMakeLists.txt‎

Lines changed: 133 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,118 @@ project(mbedcrypto C)
5252

5353
set(MBEDTLS_DIR ${BASE_DIR}/others/mbedtls)
5454

55-
add_library(mbedcrypto STATIC ${MBEDTLS_DIR}/library/base64.c ${MBEDTLS_DIR}/library/sha1.c ${MBEDTLS_DIR}/library/md5.c ${MBEDTLS_DIR}/library/platform_util.c ${MBEDTLS_DIR}/library/constant_time.c)
55+
set(TF_PSA_CRYPTO_CORE_DIR ${MBEDTLS_DIR}/tf-psa-crypto/core)
56+
set(TF_PSA_CRYPTO_BUILTIN_DIR ${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/src)
57+
set(TF_PSA_CRYPTO_INCLUDE_DIR ${MBEDTLS_DIR}/tf-psa-crypto/include)
58+
set(TF_PSA_CRYPTO_BUILTIN_INCLUDE_DIR ${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/include)
59+
set(MBEDTLS_PSA_WRAPPERS_C ${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated/psa_crypto_driver_wrappers_no_static.c)
60+
set(MBEDTLS_PSA_WRAPPERS_H ${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated/psa_crypto_driver_wrappers.h)
61+
set(MBEDTLS_TF_PSA_CONFIG_HEADERS
62+
${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated/tf_psa_crypto_config_check_before.h
63+
${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated/tf_psa_crypto_config_check_final.h
64+
${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated/tf_psa_crypto_config_check_user.h
65+
)
66+
67+
find_package(Python3 COMPONENTS Interpreter REQUIRED)
68+
69+
execute_process(
70+
COMMAND ${Python3_EXECUTABLE} -c "import venv"
71+
RESULT_VARIABLE MBEDTLS_PYTHON_VENV_RESULT
72+
OUTPUT_QUIET
73+
ERROR_QUIET
74+
)
75+
76+
if(NOT MBEDTLS_PYTHON_VENV_RESULT EQUAL 0)
77+
message(FATAL_ERROR
78+
"python3 module 'venv' is required for mbedTLS v4 wrapper generation environment setup. "
79+
"Please install python3-venv (or equivalent) for ${Python3_EXECUTABLE}.")
80+
endif()
81+
82+
set(MBEDTLS_PYTHON_VENV_DIR ${CMAKE_CURRENT_BINARY_DIR}/.build-venv)
83+
if(WIN32)
84+
set(MBEDTLS_PYTHON ${MBEDTLS_PYTHON_VENV_DIR}/Scripts/python.exe)
85+
else()
86+
set(MBEDTLS_PYTHON ${MBEDTLS_PYTHON_VENV_DIR}/bin/python)
87+
endif()
88+
89+
if(NOT EXISTS ${MBEDTLS_PYTHON})
90+
execute_process(
91+
COMMAND ${Python3_EXECUTABLE} -m venv ${MBEDTLS_PYTHON_VENV_DIR}
92+
RESULT_VARIABLE MBEDTLS_VENV_CREATE_RESULT
93+
)
94+
if(NOT MBEDTLS_VENV_CREATE_RESULT EQUAL 0)
95+
message(FATAL_ERROR "Failed to create Python virtual environment: ${MBEDTLS_PYTHON_VENV_DIR}")
96+
endif()
97+
endif()
5698

57-
target_include_directories(mbedcrypto PRIVATE ${MBEDTLS_DIR}/include)
99+
execute_process(
100+
COMMAND ${MBEDTLS_PYTHON} -m pip --version
101+
RESULT_VARIABLE MBEDTLS_PIP_CHECK_RESULT
102+
OUTPUT_QUIET
103+
ERROR_QUIET
104+
)
105+
if(NOT MBEDTLS_PIP_CHECK_RESULT EQUAL 0)
106+
execute_process(
107+
COMMAND ${MBEDTLS_PYTHON} -m ensurepip --upgrade
108+
RESULT_VARIABLE MBEDTLS_ENSUREPIP_RESULT
109+
)
110+
if(NOT MBEDTLS_ENSUREPIP_RESULT EQUAL 0)
111+
message(FATAL_ERROR "Failed to bootstrap pip in ${MBEDTLS_PYTHON_VENV_DIR}")
112+
endif()
113+
endif()
114+
115+
execute_process(
116+
COMMAND ${MBEDTLS_PYTHON} -c "import jinja2, jsonschema"
117+
RESULT_VARIABLE MBEDTLS_PYTHON_MODULES_RESULT
118+
OUTPUT_QUIET
119+
ERROR_QUIET
120+
)
121+
if(NOT MBEDTLS_PYTHON_MODULES_RESULT EQUAL 0)
122+
execute_process(
123+
COMMAND ${MBEDTLS_PYTHON} -m pip install --disable-pip-version-check jinja2 jsonschema
124+
RESULT_VARIABLE MBEDTLS_PIP_INSTALL_RESULT
125+
)
126+
if(NOT MBEDTLS_PIP_INSTALL_RESULT EQUAL 0)
127+
message(FATAL_ERROR
128+
"Failed to install Python modules 'jinja2' and 'jsonschema' into ${MBEDTLS_PYTHON_VENV_DIR}. "
129+
"Please verify network/package access and re-run CMake.")
130+
endif()
131+
endif()
132+
133+
add_custom_command(
134+
OUTPUT ${MBEDTLS_PSA_WRAPPERS_C} ${MBEDTLS_PSA_WRAPPERS_H} ${MBEDTLS_TF_PSA_CONFIG_HEADERS}
135+
COMMAND ${CMAKE_COMMAND} -E make_directory ${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated
136+
COMMAND ${MBEDTLS_PYTHON} ${MBEDTLS_DIR}/tf-psa-crypto/scripts/generate_driver_wrappers.py ${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated
137+
COMMAND ${CMAKE_COMMAND} -E chdir ${MBEDTLS_DIR}/tf-psa-crypto ${MBEDTLS_PYTHON} scripts/generate_config_checks.py ${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated
138+
DEPENDS
139+
${MBEDTLS_DIR}/tf-psa-crypto/scripts/generate_driver_wrappers.py
140+
${MBEDTLS_DIR}/tf-psa-crypto/scripts/generate_config_checks.py
141+
${MBEDTLS_DIR}/tf-psa-crypto/scripts/data_files/driver_templates/psa_crypto_driver_wrappers.h.jinja
142+
${MBEDTLS_DIR}/tf-psa-crypto/scripts/data_files/driver_templates/psa_crypto_driver_wrappers_no_static.c.jinja
143+
)
144+
145+
file(GLOB MBEDTLS_PSA_CORE_SOURCES CONFIGURE_DEPENDS ${TF_PSA_CRYPTO_CORE_DIR}/*.c)
146+
list(FILTER MBEDTLS_PSA_CORE_SOURCES EXCLUDE REGEX "psa_crypto_driver_wrappers_no_static\\.c$")
147+
file(GLOB MBEDTLS_BUILTIN_SOURCES CONFIGURE_DEPENDS ${TF_PSA_CRYPTO_BUILTIN_DIR}/*.c)
148+
149+
add_library(mbedcrypto STATIC
150+
${MBEDTLS_PSA_CORE_SOURCES}
151+
${MBEDTLS_BUILTIN_SOURCES}
152+
${MBEDTLS_PSA_WRAPPERS_C}
153+
${MBEDTLS_PSA_WRAPPERS_H}
154+
${MBEDTLS_TF_PSA_CONFIG_HEADERS}
155+
)
156+
157+
target_include_directories(mbedcrypto PRIVATE
158+
${MBEDTLS_DIR}/include
159+
${TF_PSA_CRYPTO_INCLUDE_DIR}
160+
${TF_PSA_CRYPTO_CORE_DIR}
161+
${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated
162+
${TF_PSA_CRYPTO_BUILTIN_INCLUDE_DIR}
163+
${TF_PSA_CRYPTO_BUILTIN_DIR}
164+
)
165+
166+
target_link_libraries(mbedcrypto PRIVATE bcrypt)
58167

59168
# get mbedtls version with git describe
60169
execute_process(
@@ -137,7 +246,17 @@ file(GLOB_RECURSE libModSecuritySources ${BASE_DIR}/src/*.cc)
137246
add_library(libModSecurity SHARED ${libModSecuritySources})
138247

139248
target_compile_definitions(libModSecurity PRIVATE WITH_PCRE2)
140-
target_include_directories(libModSecurity PRIVATE ${BASE_DIR} ${BASE_DIR}/headers ${BASE_DIR}/others ${MBEDTLS_DIR}/include)
249+
target_include_directories(libModSecurity PRIVATE
250+
${BASE_DIR}
251+
${BASE_DIR}/headers
252+
${BASE_DIR}/others
253+
${MBEDTLS_DIR}/include
254+
${TF_PSA_CRYPTO_INCLUDE_DIR}
255+
${TF_PSA_CRYPTO_CORE_DIR}
256+
${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated
257+
${TF_PSA_CRYPTO_BUILTIN_INCLUDE_DIR}
258+
${TF_PSA_CRYPTO_BUILTIN_DIR}
259+
)
141260
target_link_libraries(libModSecurity PRIVATE pcre2::pcre2 libinjection mbedcrypto Poco::Poco Iphlpapi.lib)
142261

143262
macro(add_package_dependency project compile_definition link_library flag)
@@ -164,7 +283,17 @@ project(libModSecurityTests)
164283

165284
function(setTestTargetProperties executable)
166285
target_compile_definitions(${executable} PRIVATE WITH_PCRE2)
167-
target_include_directories(${executable} PRIVATE ${BASE_DIR} ${BASE_DIR}/headers)
286+
target_include_directories(${executable} PRIVATE
287+
${BASE_DIR}
288+
${BASE_DIR}/headers
289+
${BASE_DIR}/others
290+
${MBEDTLS_DIR}/include
291+
${TF_PSA_CRYPTO_INCLUDE_DIR}
292+
${TF_PSA_CRYPTO_CORE_DIR}
293+
${CMAKE_CURRENT_BINARY_DIR}/mbedtls_generated
294+
${TF_PSA_CRYPTO_BUILTIN_INCLUDE_DIR}
295+
${TF_PSA_CRYPTO_BUILTIN_DIR}
296+
)
168297
target_link_libraries(${executable} PRIVATE libModSecurity pcre2::pcre2 dirent::dirent)
169298
add_package_dependency(${executable} WITH_YAJL yajl::yajl HAVE_YAJL)
170299
endfunction()

0 commit comments

Comments
 (0)