Add mbedTLS 4.x support to the mbedTLS adapters - #681
Merged
Ewerton Scaboro da Silva (ewertons) merged 4 commits intoAug 24, 2026
Conversation
mbedTLS 4.0 moved all cryptography into TF-PSA-Crypto and removed several
APIs the SDK relied on:
- mbedtls/entropy.h and mbedtls/ctr_drbg.h are no longer public; all
randomness comes from the PSA Crypto RNG, which requires psa_crypto_init().
- mbedtls_ssl_conf_rng() was removed.
- mbedtls_ssl_conf_min_version() and MBEDTLS_SSL_{MAJOR,MINOR}_VERSION_3 were
removed in favor of mbedtls_ssl_conf_min_tls_version()/MBEDTLS_SSL_VERSION_TLS1_2.
- mbedtls_pk_parse_key() no longer takes f_rng/p_rng.
- mbedtls_pk_get_type()/MBEDTLS_PK_NONE became private.
tlsio_mbedtls.c and httpapi_curl.c now guard those call sites on
MBEDTLS_VERSION_NUMBER, so 2.16, 2.28, 3.x and 4.x all build from the same
source. Whether a private key has been parsed is now tracked by the adapter
itself instead of via mbedtls_pk_get_type().
Also fixes the non-MBEDTLS_SSL_MAX_FRAGMENT_LENGTH fallback, which still
referenced MBEDTLS_SSL_MAX_CONTENT_LEN (removed in mbedTLS 3.0).
Adds a CI job that builds and unit tests against mbedTLS 4.2.0.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
Author
|
Consumer-side CI coverage for this change: Azure/azure-iot-sdk-c#2744 (draft). That PR temporarily points its |
mbedtls/config.h was renamed to mbedtls/mbedtls_config.h in mbedTLS 3.0 and is pulled in automatically by mbedtls/build_info.h from 3.0 onwards, so the unconditional include broke the build on both 3.x and 4.x. Guard it to pre-3.0 and drop a duplicate mbedtls/version.h include, moving version.h first so MBEDTLS_VERSION_NUMBER is defined for the guards. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Two problems the mbedTLS 4.x job surfaced: - mbedtls_ssl_conf_min_tls_version() is a static inline function in the mbedTLS headers, so declaring it with MOCKABLE_FUNCTION produced a redefinition error. It is no longer mocked; the real inline runs and the corresponding STRICT_EXPECTED_CALL is dropped. - The mbedtls_ssl_write test hook assigned ssl->out_msgtype directly, which has been ssl->MBEDTLS_PRIVATE(out_msgtype) since mbedTLS 3.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot started reviewing on behalf of
Ewerton Scaboro da Silva (ewertons)
August 23, 2026 18:13
View session
There was a problem hiding this comment.
Pull request overview
Adds mbedTLS 4.x compatibility while retaining existing version-specific paths.
Changes:
- Adds PSA Crypto initialization and mbedTLS 4.x API guards.
- Updates key parsing, TLS configuration, and unit-test mocks.
- Adds an mbedTLS 4.2 CI job and fixes fragment-size compatibility.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
adapters/tlsio_mbedtls.c |
Adds mbedTLS 4.x TLS adapter support. |
adapters/httpapi_curl.c |
Adds mbedTLS 4.x key parsing support. |
tests/tlsio_mbedtls_ut/tlsio_mbedtls_ut.c |
Updates tests and mocks for version-specific APIs. |
build/.vsts-ci.yml |
Adds mbedTLS 4.2 build and test coverage. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Author
|
CI status: the new mbedTLS 4.x job passes (build 162375), and the existing mbedTLS (2.28) job stays green, so the 2.x/3.x paths are unaffected. 14/15 jobs green; Windows x64 still running. Two extra commits were needed to get the 4.x job green, both fixing pre-existing issues in
|
Addresses review feedback on both adapters. httpapi_curl.c: initializing PSA inside parse_key() was too late and, for the trusted-CA-only path, never happened at all - ssl_ctx_callback() calls mbedtls_x509_crt_parse() before parse_key(), and skips parse_key() entirely when only a CA chain is configured. mbedTLS 4.x requires a successful psa_crypto_init() before parsing a certificate as well as a key. A new init_psa_crypto() helper is now called once at the top of the mbedTLS branch of ssl_ctx_callback(), before any X.509 operation, and returns CURLE_SSL_CERTPROBLEM on failure. parse_key() keeps an idempotent call as a safety net for any future caller. tlsio_mbedtls.c: a failed psa_crypto_init() was only logged, so creation still reported success and handed back a handle that could not safely parse credentials or handshake. mbedtls_init() now returns int, performs the PSA initialization before touching any mbedTLS context so nothing needs unwinding when it fails, and tlsio_mbedtls_create() releases the socket IO, hostname and instance and returns NULL. Adds tlsio_mbedtls_create_psa_crypto_init_fails to cover the new failure path, and reorders the psa_crypto_init expectation to match. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ewerton Scaboro da Silva (ewertons)
left a comment
Ewerton Scaboro da Silva (ewertons)
left a comment
Contributor
Author
There was a problem hiding this comment.
Approved
This was referenced Aug 24, 2026
Avishek (avishekpant)
approved these changes
Aug 24, 2026
Ewerton Scaboro da Silva (ewertons)
deleted the
ewertons/mbedtls-4x-support
branch
August 24, 2026 18:45
Ewerton Scaboro da Silva (ewertons)
added a commit
to Azure/azure-uamqp-c
that referenced
this pull request
Aug 24, 2026
mbedTLS 3.6 LTS goes EOL in March 2027. mbedTLS 4.0 removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), and requires psa_crypto_init() before any cryptographic operation. c-utility's mbedTLS adapters guard those call sites on MBEDTLS_VERSION_NUMBER. Points at azure-c-shared-utility master (262123bc), the merge commit of Azure/azure-c-shared-utility#681. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ewerton Scaboro da Silva (ewertons)
added a commit
to Azure/azure-umqtt-c
that referenced
this pull request
Aug 24, 2026
mbedTLS 3.6 LTS goes EOL in March 2027. mbedTLS 4.0 removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), and requires psa_crypto_init() before any cryptographic operation. c-utility's mbedTLS adapters guard those call sites on MBEDTLS_VERSION_NUMBER. Points at azure-c-shared-utility master (262123bc), the merge commit of Azure/azure-c-shared-utility#681. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ewerton Scaboro da Silva (ewertons)
added a commit
to Azure/azure-uhttp-c
that referenced
this pull request
Aug 24, 2026
mbedTLS 3.6 LTS goes EOL in March 2027. mbedTLS 4.0 removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), and requires psa_crypto_init() before any cryptographic operation. c-utility's mbedTLS adapters guard those call sites on MBEDTLS_VERSION_NUMBER. Points at azure-c-shared-utility master (262123bc), the merge commit of Azure/azure-c-shared-utility#681. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ewerton Scaboro da Silva (ewertons)
added a commit
to Azure/azure-utpm-c
that referenced
this pull request
Aug 24, 2026
mbedTLS 3.6 LTS goes EOL in March 2027. mbedTLS 4.0 removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), and requires psa_crypto_init() before any cryptographic operation. c-utility's mbedTLS adapters guard those call sites on MBEDTLS_VERSION_NUMBER. Points at azure-c-shared-utility master (262123bc), the merge commit of Azure/azure-c-shared-utility#681. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ewerton Scaboro da Silva (ewertons)
added a commit
to Azure/azure-uhttp-c
that referenced
this pull request
Aug 25, 2026
mbedTLS 3.6 LTS goes EOL in March 2027. mbedTLS 4.0 removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), and requires psa_crypto_init() before any cryptographic operation. c-utility's mbedTLS adapters guard those call sites on MBEDTLS_VERSION_NUMBER. Points at azure-c-shared-utility master (262123bc), the merge commit of Azure/azure-c-shared-utility#681. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ewerton Scaboro da Silva (ewertons)
added a commit
to Azure/azure-umqtt-c
that referenced
this pull request
Aug 25, 2026
mbedTLS 3.6 LTS goes EOL in March 2027. mbedTLS 4.0 removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), and requires psa_crypto_init() before any cryptographic operation. c-utility's mbedTLS adapters guard those call sites on MBEDTLS_VERSION_NUMBER. Points at azure-c-shared-utility master (262123bc), the merge commit of Azure/azure-c-shared-utility#681. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ewerton Scaboro da Silva (ewertons)
added a commit
to Azure/azure-utpm-c
that referenced
this pull request
Aug 25, 2026
mbedTLS 3.6 LTS goes EOL in March 2027. mbedTLS 4.0 removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), and requires psa_crypto_init() before any cryptographic operation. c-utility's mbedTLS adapters guard those call sites on MBEDTLS_VERSION_NUMBER. Points at azure-c-shared-utility master (262123bc), the merge commit of Azure/azure-c-shared-utility#681. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ewerton Scaboro da Silva (ewertons)
added a commit
to Azure/azure-uamqp-c
that referenced
this pull request
Aug 25, 2026
mbedTLS 3.6 LTS goes EOL in March 2027. mbedTLS 4.0 removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), and requires psa_crypto_init() before any cryptographic operation. c-utility's mbedTLS adapters guard those call sites on MBEDTLS_VERSION_NUMBER. Points at azure-c-shared-utility master (262123bc), the merge commit of Azure/azure-c-shared-utility#681. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds mbedTLS 4.x support to the mbedTLS adapters.
mbedTLS 3.6 LTS reaches end of life in March 2027. mbedTLS 4.0 moved cryptography into TF-PSA-Crypto and removed several APIs the adapters used:
mbedtls/entropy.h,mbedtls/ctr_drbg.hmbedtls_ssl_conf_rng()mbedtls_ssl_conf_min_version(),MBEDTLS_SSL_{MAJOR,MINOR}_VERSION_3mbedtls_ssl_conf_min_tls_version()/MBEDTLS_SSL_VERSION_TLS1_2mbedtls_pk_parse_key()f_rng/p_rngmbedtls_pk_get_type(),MBEDTLS_PK_NONEpsa_crypto_init()MBEDTLS_SSL_MAX_CONTENT_LENChanges
adapters/tlsio_mbedtls.c: version guards for the above.psa_crypto_init()runs first inmbedtls_init(), which now returns an error sotlsio_mbedtls_create()fails instead of returning an unusable handle.psa_crypto_free()is not called, since the PSA subsystem is process-global. TLS 1.2 minimum is preserved on every version.mbedtls_pk_get_type()replaced by an adapter-trackedpkey_parsedflag.adapters/httpapi_curl.c:init_psa_crypto()called before any X.509 or key parsing inssl_ctx_callback(), covering the trusted-CA-only path.MBEDTLS_SSL_MAX_FRAGMENT_LENGTH-disabled fallback, which still usedMBEDTLS_SSL_MAX_CONTENT_LEN(removed in 3.0); nowMBEDTLS_SSL_OUT_CONTENT_LENon 3.x+.tests/tlsio_mbedtls_ut: version-guarded mocks, apsa_crypto_initfailure test, and two pre-existing fixes — an unguardedmbedtls/config.hinclude (renamed in 3.0) and a directssl->out_msgtypewrite (private since 3.0).build/.vsts-ci.yml:linux_mbed_4xjob building and unit-testing against 4.2.0.The 2.16, 2.28 and 3.x paths are unchanged. No public API change.