Repository navigation
Fix mbedTLS 4.x compatibility - #579
Merged
Merged
Conversation
mbedTLS 4.0 removed ctr_drbg/entropy headers and APIs in favour of the PSA Crypto RNG, and dropped the rng parameters from mbedtls_pk_parse_keyfile and mbedtls_ssl_conf_rng. Guard all affected includes and call-sites with MBEDTLS_VERSION_MAJOR < 4 preprocessor checks, and replace runtime version if-checks with compile-time #if for psa_crypto_init / mbedtls_psa_crypto_free. Fixes #577 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
bsergean
pushed a commit
that referenced
this pull request
Oct 14, 2026
…612) (#613) * Add regression test for process-global PSA state surviving a socket close Closing one SocketMbedTLS must not invalidate PSA crypto state (RNG, key slots) used by other live sockets in the same process. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Release PSA crypto state in uninitNetSystem(), not per socket (fix #612) SocketMbedTLS::close() called mbedtls_psa_crypto_free() for every socket. That function is process-global: it wipes all PSA key slots and the shared entropy/RNG state, so closing one TLS socket broke every other live TLS socket in the process. With several concurrent TLS WebSocket clients reconnecting on their own threads this showed up as PSA_ERROR_BAD_STATE failures and heap-corruption aborts. - close() no longer calls mbedtls_psa_crypto_free(). - uninitNetSystem() now calls mbedtls_psa_crypto_free() on all platforms when built with mbedTLS >= 3.6, mirroring the existing WSAStartup/WSACleanup pairing. It must be called only after all sockets are closed. - initMBedTLS() is guarded by a per-socket flag so the ctor + init() double call no longer re-initialises live mbedTLS contexts (which re-inits mutexes under MBEDTLS_THREADING_C). close() clears the flag so a socket can be re-initialised. - init() checks psa_crypto_init() and fails the connect with an error message instead of running TLS on uninitialised PSA state. Affected releases: v11.4.6, v12.0.0, v12.0.1 and master (introduced in #527, widened to mbedTLS 4.x in #579), only when built against mbedTLS >= 3.6. v11.4.5 and earlier are not affected. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * Guard the PSA include for pre-3.6 mbedTLS and keep the PSA test binary non-empty - IXNetSystem.cpp: include <psa/crypto.h> only for mbedTLS >= 3.6, so builds against mbedTLS 2.x (no psa/ headers) still compile. - The PSA lifetime test compiles to a single passing placeholder case below mbedTLS 3.6 instead of an empty binary, which Catch2 reports as "no tests ran" (exit 2) and would fail ctest for a supported config. - Document in usage.md that uninitNetSystem() now also releases process-global TLS (PSA) state and must follow the last socket close. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mbedtls/ctr_drbg.handmbedtls/entropy.hwere removed in mbedTLS 4.0 (RNG is now handled by the PSA Crypto API), causing build failures when using mbedTLS 4.x (reported in fatal error: mbedtls/ctr_drbg.h: No such file or directory #577)#includes, member variables, and call-sites with#if MBEDTLS_VERSION_MAJOR < 4mbedtls_ssl_conf_rngwas also removed in 4.0 — same guard appliedmbedtls_pk_parse_keyfiledropped its RNG parameters in 4.0 (same as the pre-3 signature); replace theIXWEBSOCKET_USE_MBED_TLS_MIN_VERSION_3macro check with#if MBEDTLS_VERSION_MAJOR == 3if (MBEDTLS_VERSION_MAJOR >= ...)checks forpsa_crypto_init/mbedtls_psa_crypto_freewith compile-time#ifguardsTest plan
ctr_drbg.hFixes #577
🤖 Generated with Claude Code