mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-08-11 21:01:24 +00:00
54b3c1d072
* Add Mbed TLS 4.x support (PSA Crypto) for macOS Auto-detect Mbed TLS 4.x via MBEDTLS_VERSION_MAJOR and adapt the backend: - Include psa/crypto.h and drop the headers removed in 4.x (ctr_drbg, entropy, md5, sha*), gated behind the version macro. - Compute MD5/SHA-256/SHA-512 via PSA (psa_hash_compute) and initialize PSA Crypto once with std::call_once. - Drop the explicit entropy/CTR-DRBG RNG (PSA provides the TLS RNG) and skip the RNG-callback overloads of pk_parse_key/pk_check_pair on 4.x. - Retry on a TLS 1.3 NewSessionTicket (the 4.x default) in connect, read, write and is_peer_closed via a single mbedtls_is_session_ticket() helper, so online HTTPS works, including large redirected downloads where the ticket arrives mid-write. Note V4 implies V3, so 3.x-only paths now check V3 && !V4. Build systems (macOS): the CMake config and pkg-config shipped by Homebrew resolve 4.x transitively, so CMakeLists.txt and meson.build need no change for linking; the Makefile links libtfpsacrypto when present, else libmbedcrypto. Tests: generate the encrypted client key as both PBES2-AES (3.6+/4.x, OpenSSL, wolfSSL) and PBES1-3DES (Mbed TLS 2.28) and pick by version, since 4.x dropped DES and 2.28 lacks PBES2. Also generate the IP-host certs in test/meson.build to match gen-certs.sh and CMakeLists.txt. * CI: test Mbed TLS 4.x on macOS, 3.x on Ubuntu 26.04 Homebrew's default mbedtls is now 4.x, so switch the macOS build and CI job to it (drop the mbedtls@3 pin). That leaves 3.x (Ubuntu 24.04 apt ships 2.28, macOS now 4.x) uncovered, so add an ubuntu-26.04 job whose apt provides Mbed TLS 3.6. Net coverage: 2.28 (ubuntu-latest), 3.6 (ubuntu-26.04), 4.2 (macOS). ubuntu-26.04 is a public-preview runner image; fold it into the main ubuntu matrix once ubuntu-latest moves to 26.04. * Document Mbed TLS 4.x support and libtfpsacrypto rename Update README.md and the tour's TLS setup pages (en/ja) to note that Mbed TLS 4.x is now auto-detected and that it renames libmbedcrypto to libtfpsacrypto.
36 lines
2.3 KiB
Bash
Executable File
36 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
if [[ $(openssl version) =~ 3\.[2-9]\.[0-9]+ ]]; then
|
|
OPENSSL_X509_FLAG='-x509v1'
|
|
else
|
|
OPENSSL_X509_FLAG='-x509'
|
|
fi
|
|
|
|
openssl genrsa 2048 > key.pem
|
|
openssl req -new -batch -config test.conf -key key.pem | openssl x509 -days 3650 -req -signkey key.pem > cert.pem
|
|
openssl req -x509 -config test.conf -key key.pem -sha256 -days 3650 -nodes -out cert2.pem -extensions SAN
|
|
openssl genrsa 2048 > rootCA.key.pem
|
|
openssl req $OPENSSL_X509_FLAG -new -batch -config test.rootCA.conf -key rootCA.key.pem -days 1024 > rootCA.cert.pem
|
|
openssl genrsa 2048 > client.key.pem
|
|
openssl req -new -batch -config test.conf -key client.key.pem | openssl x509 -days 370 -req -CA rootCA.cert.pem -CAkey rootCA.key.pem -CAcreateserial > client.cert.pem
|
|
openssl genrsa -passout pass:test123! 2048 > key_encrypted.pem
|
|
openssl req -new -batch -config test.conf -key key_encrypted.pem | openssl x509 -days 3650 -req -signkey key_encrypted.pem > cert_encrypted.pem
|
|
# Encrypted client key: make an unencrypted key + cert first, then wrap the same
|
|
# key two ways. Mbed TLS 4.x dropped DES/PBES1, while Ubuntu's Mbed TLS 2.28 has
|
|
# no PBES2-AES, so ship both and let test.cc pick by version.
|
|
openssl genrsa 2048 > client_encrypted.tmp.key.pem
|
|
openssl req -new -batch -config test.conf -key client_encrypted.tmp.key.pem | openssl x509 -days 370 -req -CA rootCA.cert.pem -CAkey rootCA.key.pem -CAcreateserial > client_encrypted.cert.pem
|
|
openssl pkcs8 -topk8 -v2 aes-256-cbc -in client_encrypted.tmp.key.pem -passout pass:test012! -out client_encrypted.key.pem
|
|
openssl pkcs8 -topk8 -v1 PBE-SHA1-3DES -in client_encrypted.tmp.key.pem -passout pass:test012! -out client_encrypted_pbes1.key.pem
|
|
rm -f client_encrypted.tmp.key.pem
|
|
|
|
# Certificates for IP-host hostname verification regression tests.
|
|
# cert_ip_cn.pem: CN is an IPv4 literal with NO subjectAltName. An IP host must
|
|
# NOT be authenticated via the CN, so verifying it against this
|
|
# cert must fail.
|
|
openssl req -x509 -key key.pem -sha256 -days 3650 -nodes -subj "/CN=127.0.0.1" -out cert_ip_cn.pem
|
|
|
|
# cert_ipv6.pem: CN is an IPv6 literal plus an IPv6 iPAddress SAN for a
|
|
# different address. The SAN address must match; the CN address
|
|
# must be ignored.
|
|
openssl req -x509 -key key.pem -sha256 -days 3650 -nodes -subj "/CN=::1" -addext "subjectAltName=IP:2001:db8::1" -out cert_ipv6.pem
|