lib/mbedtls: Update to mbedtls v3.6.2. #15547

gstrauss · 2024-07-25T07:51:03Z

Summary

lib/mbedtls: Update to mbedtls v3.6.2 for security fixes

gstrauss · 2024-07-25T07:54:47Z

converting to draft. probably need to update defines to pull build mbedtls with needed functions.

github-actions · 2024-07-25T07:58:18Z

Code size report:

   bare-arm:    +0 +0.000% 
minimal x86:    +0 +0.000% 
   unix x64: +1888 +0.223% standard[incl +64(data)]
      stm32:    +0 +0.000% PYBV10
     mimxrt:    +0 +0.000% TEENSY40
        rp2: +2336 +0.256% RPI_PICO_W
       samd:    +0 +0.000% ADAFRUIT_ITSYBITSY_M4_EXPRESS
  qemu rv32:    +0 +0.000% VIRT_RV32

gstrauss · 2024-07-25T09:31:32Z

On unix port/* platforms: 1 tests failed: ssl_keycert
This weekend, I'll try to reproduce locally.

projectgus · 2024-07-31T01:13:31Z

On unix port/* platforms: 1 tests failed: ssl_keycert

The fix for this failure is most likely here: #14385

s-t-e-v-e-n-k · 2024-10-17T08:13:18Z

Should probably change this PR to upgrade to 3.6.2 to fix another security issue -- https://nvd.nist.gov/vuln/detail/CVE-2024-49195

projectgus · 2024-10-23T22:37:11Z

Should probably change this PR to upgrade to 3.6.2 to fix another security issue -- https://nvd.nist.gov/vuln/detail/CVE-2024-49195

Agree we should update, although this particular issue is in the mbedtls_pk_write_key_der() and mbedtls_pk_write_key_pem() functions which MicroPython doesn't use or expose. So I think this would only be an issue for a custom build that added C code to call these.

(To reiterate, we should still update all the same.)

codecov · 2024-10-24T04:24:15Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.58%. Comparing base (624bd48) to head (f2cd1a3).
Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #15547   +/-   ##
=======================================
  Coverage   98.58%   98.58%           
=======================================
  Files         167      167           
  Lines       21596    21596           
=======================================
  Hits        21291    21291           
  Misses        305      305

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

gstrauss · 2024-10-24T04:36:56Z

#14385 was merged in Aug.

I rebased to tip of master and modified the mbedtls submodule to point to mbedtls 3.6.2 (changed from 3.6.0 originally set in this PR)

Two github CI tests fail:

In CI coverage_32bit test ("unix port / coverage_32bit (pull_request)"):
1 tests failed: thread_lock4
(which I believe is unrelated to the contents of this PR)

In CI annotations test ("Check commit message formatting / build (pull request)"):
there are error messages for commits which are not part of this PR. Perhaps the CI for annotations test should better handle determining changes in a force push by re-checking for changes against the base branch.

gstrauss · 2024-10-24T05:05:10Z

FYI: the coverage_32bit and thread_lock4 tests pass in CI on my branch
https://github.com/gstrauss/micropython/actions/runs/11492756466
I think that the thread_lock4 test might be racey with a false positive in the CI run here.

(On my branch, the CI "coverage" test failed due to me not having a token with appropriate permissions. That test passed in the most recent CI run here.)

projectgus · 2024-10-24T07:13:38Z

Thanks for the update, @gstrauss!

In CI coverage_32bit test ("unix port / coverage_32bit (pull_request)"):
1 tests failed: thread_lock4
(which I believe is unrelated to the contents of this PR)

Yes, the thread tests are a tiny bit flaky on unix CI. I've retried and it passed.

In CI annotations test ("Check commit message formatting / build (pull request)"):
there are error messages for commits which are not part of this PR. Perhaps the CI for annotations test should better
handle determining changes in a force push by re-checking for changes against the base branch.
In CI annotations test ("Check commit message formatting / build (pull request)"):
there are error messages for commits which are not part of this PR. Perhaps the CI for annotations test should better > handle determining changes in a force push by re-checking for changes against the base branch.

Yeah, thanks for pointing this out. It's not the force push exactly, I think the bug is caused when the PR branch is behind the tip of master (your branch is one commit behind, from about the time you rebased so no fault of yours). Will submit a fix for the CI bug, but please don't stress about it for this PR.

The main thing with updating mbedTLS is on-device testing. I'll try to make time to do some soon.

dpgeorge · 2024-10-24T12:12:15Z

extmod/mbedtls/mbedtls_config_common.h

@@ -79,6 +79,7 @@
 #define MBEDTLS_OID_C
 #define MBEDTLS_PKCS5_C
 #define MBEDTLS_PK_C
+#define MBEDTLS_PK_HAVE_ECC_KEYS


Is this enabling a feature that wasn't enabled before? Or is this needed to retain the same set of features with the new mbedTLS version?

needed to retain the same set of features with the new mbedTLS version

The latter. Some code moved to a new (separate) file with previously available features now exposed by a compile-time macro, as I noted in my second comment above (#15547 (comment))

Fixes the problem noted here micropython#15547 (comment) which is that because default CI HEAD for a PR is a (generated) merge commit into master branch HEAD, then if the PR branch isn't fully rebased then the commit check runs against commits from master as well! This PR also simplifies having to do a second fetch in order to find the merge base, by passing it in from GitHub's metadata instead. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <[email protected]>

Fixes the problem noted here micropython#15547 (comment) which is that because default CI HEAD for a PR is a (generated) merge commit into the master branch's current HEAD, then if the PR branch isn't fully rebased then the commit check runs against commits from master as well! Also drops running this check on push, the pull_request event is triggered by default on open and update ("synchronized" event), which probably covers the cases where this check should run. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <[email protected]>

Fixes the problem noted at micropython#15547 (comment) which is that, because default CI HEAD for a PR is a (generated) merge commit into the master branch's current HEAD, then if the PR branch isn't fully rebased then the commit check runs against commits from master as well! Also drops running this check on push, the pull_request event is triggered by default on open and update ("synchronized" event), which probably covers the cases where this check should run. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <[email protected]>

projectgus

Thanks @gstrauss for submitting and updating this!

I rebased this branch and flashed to an RPI_PICO_W board. net_inet and multi_net tests all pass.

projectgus · 2025-01-14T05:14:40Z

Oh, I also had a quick look at the code size increase. It looks like a significant part is the new bignum API. MicroPython doesn't call any bignum interfaces from what I can tell, but IIUC mbedTLS currently uses a mixture of the old and new bignum APIs internally - https://mbed-tls.readthedocs.io/en/latest/project/long-term-plans/#bignum-redesign - so this may drop down again in the future.

dpgeorge · 2025-01-14T06:21:20Z

@projectgus should we put this in 1.25.0, or wait to 1.26.0? I'm happy either way, seems like a low risk change.

projectgus · 2025-01-14T23:22:23Z

@projectgus should we put this in 1.25.0, or wait to 1.26.0? I'm happy either way, seems like a low risk change.

If you're happy to have it in 1.25.0 then it seems like a reasonable choice to me. I think there is some chance of an issue just due to all the APIs that are moving around, but agree it's pretty low risk - and good to be up to date with security fixes.

dpgeorge · 2025-01-15T00:54:58Z

I tested this thoroughly on unix, PYBD_SF6, RPI_PICO2_W, running all possible combinations of WLAN tests against those three. Everything passes.

Let's merge this!

Signed-off-by: Glenn Strauss <[email protected]>

Fixes the problem noted at micropython#15547 (comment) which is that, because default CI HEAD for a PR is a (generated) merge commit into the master branch's current HEAD, then if the PR branch isn't fully rebased then the commit check runs against commits from master as well! Also drops running this check on push, the pull_request event is triggered by default on open and update ("synchronized" event), which probably covers the cases where this check should run. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <[email protected]>

gstrauss marked this pull request as draft July 25, 2024 07:53

gstrauss force-pushed the mbedtls-3.6.0 branch 2 times, most recently from 5fdd5dd to 1dbca84 Compare July 25, 2024 08:20

gstrauss force-pushed the mbedtls-3.6.0 branch from 1dbca84 to 4647093 Compare October 24, 2024 04:21

gstrauss changed the title ~~lib/mbedtls: Update to mbedtls v3.6.0.~~ lib/mbedtls: Update to mbedtls v3.6.2. Oct 24, 2024

gstrauss mentioned this pull request Oct 24, 2024

micropython: update to 1.24.0 and fix compile on external mbedtls3 openwrt/packages#24664

Merged

gstrauss marked this pull request as ready for review October 24, 2024 04:48

dpgeorge reviewed Oct 24, 2024

View reviewed changes

projectgus mentioned this pull request Oct 30, 2024

tools/ci: Fix commit message checking when PR branch HEAD behind master. #16114

Merged

projectgus self-requested a review November 20, 2024 03:21

projectgus approved these changes Jan 14, 2025

View reviewed changes

projectgus modified the milestone: release-1.25.0 Jan 14, 2025

projectgus added this to the release-1.26.0 milestone Jan 14, 2025

dpgeorge modified the milestones: release-1.26.0, release-1.25.0 Jan 15, 2025

lib/mbedtls: Update to mbedtls v3.6.2.

f2cd1a3

Signed-off-by: Glenn Strauss <[email protected]>

dpgeorge force-pushed the mbedtls-3.6.0 branch from 4647093 to f2cd1a3 Compare January 16, 2025 23:12

dpgeorge merged commit f2cd1a3 into micropython:master Jan 16, 2025
62 checks passed

Uh oh!

lib/mbedtls: Update to mbedtls v3.6.2. #15547

lib/mbedtls: Update to mbedtls v3.6.2. #15547

Uh oh!

Conversation

gstrauss commented Jul 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

gstrauss commented Jul 25, 2024

Uh oh!

github-actions bot commented Jul 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gstrauss commented Jul 25, 2024

Uh oh!

projectgus commented Jul 31, 2024

Uh oh!

s-t-e-v-e-n-k commented Oct 17, 2024

Uh oh!

projectgus commented Oct 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Oct 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

gstrauss commented Oct 24, 2024

Uh oh!

gstrauss commented Oct 24, 2024

Uh oh!

projectgus commented Oct 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dpgeorge Oct 24, 2024

Choose a reason for hiding this comment

Uh oh!

gstrauss Oct 24, 2024

Choose a reason for hiding this comment

Uh oh!

projectgus left a comment

Choose a reason for hiding this comment

Uh oh!

projectgus commented Jan 14, 2025

Uh oh!

dpgeorge commented Jan 14, 2025

Uh oh!

projectgus commented Jan 14, 2025

Uh oh!

dpgeorge commented Jan 15, 2025

Uh oh!

Uh oh!

Uh oh!

gstrauss commented Jul 25, 2024 •

edited

Loading

github-actions bot commented Jul 25, 2024 •

edited

Loading

projectgus commented Oct 23, 2024 •

edited

Loading

codecov bot commented Oct 24, 2024 •

edited

Loading

projectgus commented Oct 24, 2024 •

edited

Loading