Add support for MbedTLS to libnetconf2

.github/workflows/ci.yml

@@ -37,12 +37,26 @@ jobs:
       matrix:
         config:
           - {
-            name: "Release, gcc",
+            name: "Release, gcc, OpenSSL",
             os: "ubuntu-22.04",
             build-type: "Release",
             dep-build-type: "Release",
             cc: "gcc",
             options: "-DENABLE_TESTS=ON -DENABLE_DNSSEC=ON",
+            tls-lib: "OpenSSL",
+            packages: "",
+            snaps: "",
+            make-prepend: "",
+            make-target: ""
+          }
+          - {
+            name: "Release, gcc, MbedTLS",
+            os: "ubuntu-22.04",
+            build-type: "Release",
+            dep-build-type: "Release",
+            cc: "gcc",
+            options: "-DENABLE_TESTS=ON -DENABLE_DNSSEC=ON",
+            tls-lib: "MbedTLS",
             packages: "",
             snaps: "",
             make-prepend: "",
@@ -55,18 +69,33 @@ jobs:
             dep-build-type: "Release",
             cc: "clang",
             options: "-DENABLE_TESTS=ON -DENABLE_DNSSEC=ON",
+            tls-lib: "OpenSSL",
             packages: "",
             snaps: "",
             make-prepend: "",
             make-target: ""
           }
           - {
-            name: "Debug, gcc",
+            name: "Debug, gcc, OpenSSL",
+            os: "ubuntu-22.04",
+            build-type: "Debug",
+            dep-build-type: "Release",
+            cc: "gcc",
+            options: "-DENABLE_DNSSEC=ON",
+            tls-lib: "OpenSSL",
+            packages: "valgrind",
+            snaps: "",
+            make-prepend: "",
+            make-target: ""
+          }
+          - {
+            name: "Debug, gcc, MbedTLS",
             os: "ubuntu-22.04",
             build-type: "Debug",
             dep-build-type: "Release",
             cc: "gcc",
             options: "-DENABLE_DNSSEC=ON",
+            tls-lib: "MbedTLS",
             packages: "valgrind",
             snaps: "",
             make-prepend: "",
@@ -79,6 +108,7 @@ jobs:
             dep-build-type: "Release",
             cc: "clang",
             options: "-DENABLE_DNSSEC=ON",
+            tls-lib: "OpenSSL",
             # no valgrind because it does not support DWARF5 yet generated by clang 14
             packages: "",
             snaps: "",
@@ -92,18 +122,33 @@ jobs:
             dep-build-type: "Release",
             cc: "gcc",
             options: "-DENABLE_SSH_TLS=OFF",
+            tls-lib: "",
             packages: "valgrind",
             snaps: "",
             make-prepend: "",
             make-target: ""
           }
           - {
-            name: "ASAN and UBSAN",
+            name: "ASAN and UBSAN, OpenSSL",
+            os: "ubuntu-22.04",
+            build-type: "Debug",
+            dep-build-type: "Release",
+            cc: "clang",
+            options: "-DCMAKE_C_FLAGS=-fsanitize=address,undefined -DENABLE_VALGRIND_TESTS=OFF",
+            tls-lib: "OpenSSL",
+            packages: "",
+            snaps: "",
+            make-prepend: "",
+            make-target: ""
+          }
+          - {
+            name: "ASAN and UBSAN, MbedTLS",
             os: "ubuntu-22.04",
             build-type: "Debug",
             dep-build-type: "Release",
             cc: "clang",
             options: "-DCMAKE_C_FLAGS=-fsanitize=address,undefined -DENABLE_VALGRIND_TESTS=OFF",
+            tls-lib: "MbedTLS",
             packages: "",
             snaps: "",
             make-prepend: "",
@@ -116,6 +161,7 @@ jobs:
             dep-build-type: "Debug",
             cc: "gcc",
             options: "",
+            tls-lib: "OpenSSL",
             packages: "abi-dumper abi-compliance-checker snap",
             snaps: "core universal-ctags",
             make-prepend: "",
@@ -145,7 +191,7 @@ jobs:
           CC=${{ matrix.config.cc }} cmake ..
           make
           sudo make install
-        if: ${{ matrix.config.name == 'Debug, gcc' }}
+        if: ${{ matrix.config.name == 'Debug, gcc, OpenSSL' || matrix.config.name == 'Debug, gcc, MbedTLS' }}
 
       - name: Deps-libyang
         shell: bash
@@ -167,6 +213,18 @@ jobs:
           make -j2
           sudo make install
 
+      - name: Deps-MbedTLS
+        shell: bash
+        run: |
+          git clone -b mbedtls-3.5.2 https://github.com/Mbed-TLS/mbedtls.git
+          cd mbedtls
+          mkdir build
+          cd build
+          CC=${{ matrix.config.cc }} cmake -DUSE_SHARED_MBEDTLS_LIBRARY=On -DENABLE_TESTING=Off ..
+          make -j2
+          sudo make install
+        if: ${{ matrix.config.tls-lib == 'MbedTLS' }}
+
       - name: Configure
         shell: bash
         working-directory: ${{ github.workspace }}

CMakeLists.txt

@@ -210,8 +210,10 @@ endif()
 # use compat
 use_compat()
 
-# netconf2 target
-add_library(netconf2 ${libsrc} ${compatsrc})
+# netconf2 sourceless target - need it for linking libs, but the required sources will be added later
+add_library(netconf2)
+
+# set the shared library version
 set_target_properties(netconf2 PROPERTIES VERSION ${LIBNETCONF2_SOVERSION_FULL} SOVERSION ${LIBNETCONF2_SOVERSION})
 
 # include repository files with highest priority
@@ -231,10 +233,23 @@ check_include_file("shadow.h" HAVE_SHADOW)
 check_include_file("termios.h" HAVE_TERMIOS)
 
 if(ENABLE_SSH_TLS)
-    # dependencies - openssl
-    find_package(OpenSSL 3.0.0 REQUIRED)
-    target_link_libraries(netconf2 ${OPENSSL_LIBRARIES})
-    include_directories(${OPENSSL_INCLUDE_DIR})
+    # dependencies - mbedTLS (higher preference) or OpenSSL
+    find_package(MbedTLS 3.5.0)
+    if (MBEDTLS_FOUND)
+        # dependencies - mbedtls
+        set(HAVE_MBEDTLS TRUE)
+        list(APPEND libsrc src/session_mbedtls.c)
+        include_directories(${MBEDTLS_INCLUDE_DIRS})
+        target_link_libraries(netconf2 ${MBEDTLS_LIBRARIES})
+        list(APPEND CMAKE_REQUIRED_LIBRARIES ${MBEDTLS_LIBRARIES})
+    else()
+        # dependencies - openssl
+        find_package(OpenSSL 3.0.0 REQUIRED)
+        list(APPEND libsrc src/session_openssl.c)
+        include_directories(${OPENSSL_INCLUDE_DIR})
+        target_link_libraries(netconf2 ${OPENSSL_LIBRARIES})
+        list(APPEND CMAKE_REQUIRED_LIBRARIES ${OPENSSL_LIBRARIES})
+    endif()
 
     # dependencies - libssh
     find_package(LibSSH 0.9.5 REQUIRED)
@@ -301,6 +316,9 @@ if(${CMAKE_SYSTEM_NAME} MATCHES "QNX")
     list(REMOVE_ITEM CMAKE_REQUIRED_DEFINITIONS -D_QNX_SOURCE)
 endif()
 
+# set sources
+target_sources(netconf2 PRIVATE ${libsrc} ${compatsrc})
+
 # generate config file
 configure_file("${PROJECT_SOURCE_DIR}/src/config.h.in" "${PROJECT_BINARY_DIR}/src/config.h" ESCAPE_QUOTES @ONLY)
 

CMakeModules/FindMbedTLS.cmake

@@ -0,0 +1,110 @@
+# - Try to find MbedTLS
+# Once done this will define
+#
+#  MBEDTLS_FOUND - MbedTLS was found
+#  MBEDTLS_INCLUDE_DIRS - MbedTLS include directories
+#  MBEDTLS_LIBRARIES - link these to use MbedTLS
+#  MBEDTLS_VERSION - version of MbedTLS
+#
+#  Author Roman Janota <[email protected]>
+#  Copyright (c) 2024 CESNET, z.s.p.o.
+#
+#  Redistribution and use in source and binary forms, with or without
+#  modification, are permitted provided that the following conditions
+#  are met:
+#
+#  1. Redistributions of source code must retain the copyright
+#     notice, this list of conditions and the following disclaimer.
+#  2. Redistributions in binary form must reproduce the copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution.
+#  3. The name of the author may not be used to endorse or promote products
+#     derived from this software without specific prior written permission.
+#
+#  THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+#  IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+#  OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+#  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+#  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+#  NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+#  DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+#  THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+#  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+#  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+include(FindPackageHandleStandardArgs)
+
+if(MBEDTLS_LIBRARIES AND MBEDTLS_INCLUDE_DIRS)
+    # in cache already
+    set(MBEDTLS_FOUND TRUE)
+else()
+    find_path(MBEDTLS_INCLUDE_DIR
+        NAMES
+            mbedtls/ssl.h
+        PATHS
+            /opt/local/include
+            /sw/include
+            ${CMAKE_INCLUDE_PATH}
+            ${CMAKE_INSTALL_PREFIX}/include
+    )
+
+    find_library(MBEDTLS_LIBRARY
+        NAMES
+            libmbedtls.so
+        PATHS
+            /usr/lib
+            /usr/lib64
+            /opt/local/lib
+            /sw/lib
+            ${CMAKE_LIBRARY_PATH}
+            ${CMAKE_INSTALL_PREFIX}/lib
+    )
+
+    find_library(MBEDX509_LIBRARY
+        NAMES
+            libmbedx509.so
+        PATHS
+            /usr/lib
+            /usr/lib64
+            /opt/local/lib
+            /sw/lib
+            ${CMAKE_LIBRARY_PATH}
+            ${CMAKE_INSTALL_PREFIX}/lib
+    )
+
+    find_library(MBEDCRYPTO_LIBRARY
+        NAMES
+            libmbedcrypto.so
+        PATHS
+            /usr/lib
+            /usr/lib64
+            /opt/local/lib
+            /sw/lib
+            ${CMAKE_LIBRARY_PATH}
+            ${CMAKE_INSTALL_PREFIX}/lib
+    )
+
+    if(MBEDTLS_INCLUDE_DIR AND MBEDTLS_LIBRARY AND MBEDX509_LIBRARY AND MBEDCRYPTO_LIBRARY)
+        # learn MbedTLS version
+        if(EXISTS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h")
+            file(STRINGS "${MBEDTLS_INCLUDE_DIR}/mbedtls/build_info.h" MBEDTLS_VERSION
+                REGEX "#define[ \t]+MBEDTLS_VERSION_STRING[ \t]+\"([0-9]+\.[0-9]+\.[0-9]+)\"")
+            string(REGEX MATCH "[0-9]+\\.[0-9]+\\.[0-9]+" MBEDTLS_VERSION ${MBEDTLS_VERSION})
+        endif()
+        if(NOT MBEDTLS_VERSION)
+            message(STATUS "MBEDTLS_VERSION not found, assuming MbedTLS is too old and cannot be used!")
+            set(MBEDTLS_INCLUDE_DIR "MBEDTLS_INCLUDE_DIR-NOTFOUND")
+            set(MBEDTLS_LIBRARY "MBEDTLS_LIBRARY-NOTFOUND")
+        endif()
+    endif()
+
+    set(MBEDTLS_INCLUDE_DIRS ${MBEDTLS_INCLUDE_DIR})
+    set(MBEDTLS_LIBRARIES ${MBEDTLS_LIBRARY} ${MBEDX509_LIBRARY} ${MBEDCRYPTO_LIBRARY})
+
+    find_package_handle_standard_args(MbedTLS FOUND_VAR MBEDTLS_FOUND
+        REQUIRED_VARS MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARIES
+        VERSION_VAR MBEDTLS_VERSION)
+
+    # show the MBEDTLS_INCLUDE_DIR and MBEDTLS_LIBRARIES variables only in the advanced view
+    mark_as_advanced(MBEDTLS_INCLUDE_DIRS MBEDTLS_LIBRARIES)
+endif()

README.md

@@ -64,7 +64,7 @@ the `distro` directory.
 * crypt(3)
 * [libyang](https://github.com/CESNET/libyang)
 * libssh >= 0.9.5 (for SSH support)
-* OpenSSL >= 3.0.0 (for TLS support)
+* OpenSSL >= 3.0.0 or MbedTLS >= 3.5.0 (for TLS support)
 * curl >= 7.30.0
 
 #### Optional

src/config.h.in

@@ -44,6 +44,11 @@
  */
 #cmakedefine HAVE_LIBPAM
 
+/*
+ * Use MbedTLS as TLS back-end
+ */
+#cmakedefine HAVE_MBEDTLS
+
 /*
  * Location of installed YANG modules on the system
  */