From 3abfbd580c1ad766de414d00b739fa588252d0bc Mon Sep 17 00:00:00 2001 From: Dusko Simidzija Date: Wed, 2 Sep 2026 17:20:16 +0200 Subject: [PATCH] obs-outputs: upgrade mbedtls dependency to v4 This aims to close #13601, the official migration guide was used for the following: * update cmake target modules and versions (mbedcrypto => tfpsacrypto) * remove deprecated entropy configuration (ctr_drbg + entropy) * migrate MD5 and HMAC to the new PSA API The official migration guide: https://github.com/Mbed-TLS/mbedtls/blob/development/docs/4.0-migration-guide.md --- cmake/finders/FindMbedTLS.cmake | 4 +-- frontend/cmake/feature-whatsnew.cmake | 2 +- frontend/cmake/os-windows.cmake | 2 +- plugins/obs-outputs/CMakeLists.txt | 2 +- plugins/obs-outputs/librtmp/handshake.h | 30 +++++++++++++------ plugins/obs-outputs/librtmp/rtmp.c | 38 +++++++++---------------- plugins/obs-outputs/librtmp/rtmp.h | 5 ---- plugins/obs-outputs/obs-outputs.c | 8 ++++++ 8 files changed, 48 insertions(+), 43 deletions(-) diff --git a/cmake/finders/FindMbedTLS.cmake b/cmake/finders/FindMbedTLS.cmake index f6fa184e9376c4..234d8dddb81422 100644 --- a/cmake/finders/FindMbedTLS.cmake +++ b/cmake/finders/FindMbedTLS.cmake @@ -65,7 +65,7 @@ include(FindPackageHandleStandardArgs) find_package(PkgConfig QUIET) if(PKG_CONFIG_FOUND) - pkg_check_modules(PC_MbedTLS QUIET mbedtls mbedcrypto mbedx509) + pkg_check_modules(PC_MbedTLS QUIET mbedtls tfpsacrypto mbedx509) endif() # MbedTLS_set_soname: Set SONAME on imported library targets @@ -235,7 +235,7 @@ if(MbedTLS_FOUND) set(MbedTLS_LIBRARIES ${MbedTLS_LIBRARY}) else() set(MbedTLS_LIBRARIES ${MbedTLS_LIBRARY} ${MbedCrypto_LIBRARY} ${MbedX509_LIBRARY}) - set_property(TARGET MbedTLS::mbedtls PROPERTY INTERFACE_LINK_LIBRARIES MbedTLS::mbedcrypto MbedTLS::mbedx509) + set_property(TARGET MbedTLS::mbedtls PROPERTY INTERFACE_LINK_LIBRARIES MbedTLS::tfpsacrypto MbedTLS::mbedx509) endif() endif() diff --git a/frontend/cmake/feature-whatsnew.cmake b/frontend/cmake/feature-whatsnew.cmake index 46620fad1348dc..a6d19cdc9cde15 100644 --- a/frontend/cmake/feature-whatsnew.cmake +++ b/frontend/cmake/feature-whatsnew.cmake @@ -7,7 +7,7 @@ if(ENABLE_WHATSNEW AND TARGET OBS::browser-panels) include(cmake/feature-macos-update.cmake) elseif(OS_LINUX) set(CMAKE_FIND_PACKAGE_PREFER_CONFIG TRUE) - find_package(MbedTLS 3...<4 REQUIRED) + find_package(MbedTLS 4...<5 REQUIRED) set(CMAKE_FIND_PACKAGE_PREFER_CONFIG FALSE) find_package(nlohmann_json 3.11 REQUIRED) diff --git a/frontend/cmake/os-windows.cmake b/frontend/cmake/os-windows.cmake index 4c65aca6b378b7..ac8c5729490af9 100644 --- a/frontend/cmake/os-windows.cmake +++ b/frontend/cmake/os-windows.cmake @@ -7,7 +7,7 @@ if(NOT TARGET OBS::w32-pthreads) endif() set(CMAKE_FIND_PACKAGE_PREFER_CONFIG TRUE) -find_package(MbedTLS 3...<4 REQUIRED) +find_package(MbedTLS 4...<5 REQUIRED) set(CMAKE_FIND_PACKAGE_PREFER_CONFIG FALSE) find_package(Detours REQUIRED) find_package(nlohmann_json 3.11 REQUIRED) diff --git a/plugins/obs-outputs/CMakeLists.txt b/plugins/obs-outputs/CMakeLists.txt index ef669862b5097e..4e75714739b335 100644 --- a/plugins/obs-outputs/CMakeLists.txt +++ b/plugins/obs-outputs/CMakeLists.txt @@ -1,7 +1,7 @@ cmake_minimum_required(VERSION 3.28...3.30) set(CMAKE_FIND_PACKAGE_PREFER_CONFIG TRUE) -find_package(MbedTLS 3...<4 REQUIRED) +find_package(MbedTLS 4...<5 REQUIRED) set(CMAKE_FIND_PACKAGE_PREFER_CONFIG FALSE) find_package(ZLIB REQUIRED) find_package(jansson REQUIRED) diff --git a/plugins/obs-outputs/librtmp/handshake.h b/plugins/obs-outputs/librtmp/handshake.h index 0114bdec0f4042..01840b0fe31ef3 100644 --- a/plugins/obs-outputs/librtmp/handshake.h +++ b/plugins/obs-outputs/librtmp/handshake.h @@ -25,17 +25,25 @@ /* This file is #included in rtmp.c, it is not meant to be compiled alone */ #if defined(USE_MBEDTLS) -#include +#include #ifndef SHA256_DIGEST_LENGTH #define SHA256_DIGEST_LENGTH 32 #endif -typedef mbedtls_md_context_t *HMAC_CTX; -#define HMAC_setup(ctx, key, len) ctx = malloc(sizeof(mbedtls_md_context_t)); mbedtls_md_init(ctx); \ - mbedtls_md_setup(ctx, mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), 1); \ - mbedtls_md_hmac_starts(ctx, (const unsigned char *)key, len) -#define HMAC_crunch(ctx, buf, len) mbedtls_md_hmac_update(ctx, buf, len) -#define HMAC_finish(ctx, dig) mbedtls_md_hmac_finish(ctx, dig) -#define HMAC_close(ctx) mbedtls_md_free(ctx); free(ctx); ctx = NULL +typedef psa_mac_operation_t HMAC_CTX; +const psa_algorithm_t mbedtls_hmac_alg = PSA_ALG_HMAC(PSA_ALG_SHA_256); + +#define HMAC_setup(ctx, key, len) psa_crypto_init(); \ + ctx = psa_mac_operation_init(); \ + mbedtls_svc_key_id_t key_id; \ + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; \ + psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE); \ + psa_set_key_algorithm(&attributes, mbedtls_hmac_alg); \ + psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC); \ + psa_import_key(&attributes, key, len, &key_id); \ + psa_mac_sign_setup(&ctx, key_id, mbedtls_hmac_alg) +#define HMAC_crunch(ctx, buf, len) psa_mac_update(&ctx, buf, len) +#define HMAC_finish(ctx, dig, digestLen) psa_mac_sign_finish(&ctx, dig, SHA256_DIGEST_LENGTH, &digestLen) +#define HMAC_close(ctx) psa_mac_abort(&ctx) #elif defined(USE_POLARSSL) #include @@ -171,13 +179,17 @@ static void HMACsha256(const uint8_t *message, size_t messageLen, const uint8_t *key, size_t keylen, uint8_t *digest) { +#if defined(USE_MBEDTLS) + size_t digestLen; +#else unsigned int digestLen; +#endif HMAC_CTX ctx; HMAC_setup(ctx, key, keylen); HMAC_crunch(ctx, message, messageLen); -#if defined(USE_MBEDTLS) || defined(USE_POLARSSL) || defined(USE_GNUTLS) +#if defined(USE_POLARSSL) || defined(USE_GNUTLS) digestLen = SHA256_DIGEST_LENGTH; HMAC_finish(ctx, digest); #else diff --git a/plugins/obs-outputs/librtmp/rtmp.c b/plugins/obs-outputs/librtmp/rtmp.c index 1898558f51927a..1ccc81a6e2ba6b 100644 --- a/plugins/obs-outputs/librtmp/rtmp.c +++ b/plugins/obs-outputs/librtmp/rtmp.c @@ -53,8 +53,7 @@ #include #endif -#include -#include +#include #include #define MD5_DIGEST_LENGTH 16 @@ -373,18 +372,10 @@ RTMP_TLS_Init(RTMP *r) { #ifdef CRYPTO #if defined(USE_MBEDTLS) - const char * pers = "RTMP_TLS"; r->RTMP_TLS_ctx = calloc(1,sizeof(struct tls_ctx)); + psa_crypto_init(); mbedtls_ssl_config_init(&r->RTMP_TLS_ctx->conf); - mbedtls_ctr_drbg_init(&r->RTMP_TLS_ctx->ctr_drbg); - mbedtls_entropy_init(&r->RTMP_TLS_ctx->entropy); - - mbedtls_ctr_drbg_seed(&r->RTMP_TLS_ctx->ctr_drbg, - mbedtls_entropy_func, - &r->RTMP_TLS_ctx->entropy, - (const unsigned char *)pers, - strlen(pers)); RTMP_TLS_LoadCerts(r); #elif defined(USE_POLARSSL) @@ -423,8 +414,6 @@ RTMP_TLS_Free(RTMP *r) { if (!r->RTMP_TLS_ctx) return; mbedtls_ssl_config_free(&r->RTMP_TLS_ctx->conf); - mbedtls_ctr_drbg_free(&r->RTMP_TLS_ctx->ctr_drbg); - mbedtls_entropy_free(&r->RTMP_TLS_ctx->entropy); if (r->RTMP_TLS_ctx->cacert) { mbedtls_x509_crt_free(r->RTMP_TLS_ctx->cacert); @@ -2618,17 +2607,18 @@ b64enc(const unsigned char *input, int length, char *output, int maxsize) } #if defined(USE_MBEDTLS) -typedef mbedtls_md5_context MD5_CTX; - -#if MBEDTLS_VERSION_NUMBER >= 0x02070000 && MBEDTLS_VERSION_MAJOR < 3 -#define MD5_Init(ctx) mbedtls_md5_init(ctx); mbedtls_md5_starts_ret(ctx) -#define MD5_Update(ctx,data,len) mbedtls_md5_update_ret(ctx,(unsigned char *)data,len) -#define MD5_Final(dig,ctx) mbedtls_md5_finish_ret(ctx,dig); mbedtls_md5_free(ctx) -#else -#define MD5_Init(ctx) mbedtls_md5_init(ctx); mbedtls_md5_starts(ctx) -#define MD5_Update(ctx,data,len) mbedtls_md5_update(ctx,(unsigned char *)data,len) -#define MD5_Final(dig,ctx) mbedtls_md5_finish(ctx,dig); mbedtls_md5_free(ctx) -#endif +typedef psa_hash_operation_t MD5_CTX; +const psa_algorithm_t mbedtls_md5_alg = PSA_ALG_MD5; +#define MD5_Init(ctx) psa_crypto_init(); \ + *ctx = psa_hash_operation_init(); \ + psa_hash_setup(ctx, mbedtls_md5_alg) +#define MD5_Update(ctx,data,len) psa_hash_update(ctx,(const uint8_t *)data,len) +#define MD5_Final(dig,ctx) \ + do { \ + size_t hash_len; \ + psa_hash_finish(ctx, dig, sizeof(dig), &hash_len); \ + psa_hash_abort(ctx); \ + } while (0) #elif defined(USE_POLARSSL) #define MD5_CTX md5_context diff --git a/plugins/obs-outputs/librtmp/rtmp.h b/plugins/obs-outputs/librtmp/rtmp.h index c1b8d906175111..b50bd3524e2681 100644 --- a/plugins/obs-outputs/librtmp/rtmp.h +++ b/plugins/obs-outputs/librtmp/rtmp.h @@ -60,8 +60,6 @@ #endif #include -#include -#include #define my_dhm_P \ "E4004C1F94182000103D883A448B3F80" \ @@ -79,8 +77,6 @@ typedef struct tls_ctx { - mbedtls_entropy_context entropy; - mbedtls_ctr_drbg_context ctr_drbg; mbedtls_ssl_config conf; mbedtls_ssl_session ssn; mbedtls_x509_crt *cacert; @@ -93,7 +89,6 @@ typedef tls_ctx *TLS_CTX; s = malloc(sizeof(mbedtls_ssl_context));\ mbedtls_ssl_init(s);\ mbedtls_ssl_config_defaults(&ctx->conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);\ - mbedtls_ssl_conf_rng(&ctx->conf, mbedtls_ctr_drbg_random, &ctx->ctr_drbg);\ mbedtls_ssl_conf_authmode(&ctx->conf, MBEDTLS_SSL_VERIFY_REQUIRED);\ mbedtls_ssl_setup(s, &ctx->conf) diff --git a/plugins/obs-outputs/obs-outputs.c b/plugins/obs-outputs/obs-outputs.c index 02371260c912e4..122cbfeca0099f 100644 --- a/plugins/obs-outputs/obs-outputs.c +++ b/plugins/obs-outputs/obs-outputs.c @@ -5,6 +5,10 @@ #include #endif +#if defined(USE_MBEDTLS) +#include +#endif + OBS_DECLARE_MODULE() OBS_MODULE_USE_DEFAULT_LOCALE("obs-outputs", "en-US") MODULE_EXPORT const char *obs_module_description(void) @@ -70,6 +74,10 @@ bool obs_module_load(void) void obs_module_unload(void) { +#if defined(USE_MBEDTLS) + mbedtls_psa_crypto_free(); +#endif + #ifdef _WIN32 #ifdef MBEDTLS_THREADING_ALT mbedtls_threading_free_alt();