diff --git a/CMakeLists.txt b/CMakeLists.txt index 527b443050..d263f18240 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -131,9 +131,149 @@ if(NOT MBEDTLS_AS_SUBPROJECT) FORCE) endif() -# Make MBEDTLS_CONFIG_FILE and MBEDTLS_USER_CONFIG_FILE into PATHs +# Make configuration file options into PATHs set(MBEDTLS_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS config file (overrides default).") set(MBEDTLS_USER_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS user config file (appended to default).") +set(MBEDTLS_CONFIG_BASE_FILE "" CACHE FILEPATH "Mbed TLS config to copy and optionally transform.") +set(MBEDTLS_CONFIG_NAME "" CACHE STRING "Named Mbed TLS configuration (see config.py).") +set(MBEDTLS_CONFIG_SET "" CACHE STRING "Options to set, separated by semicolons (OPTION or OPTION=VALUE).") +set(MBEDTLS_CONFIG_UNSET "" CACHE STRING "Options to unset, separated by semicolons.") +set(TF_PSA_CRYPTO_CONFIG_BASE_FILE "" CACHE FILEPATH "TF-PSA-Crypto config to copy and optionally transform.") + +set(MBEDTLS_CONFIG_TRANSFORMED FALSE) +if(NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_SET}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_UNSET}" STREQUAL "") + set(MBEDTLS_CONFIG_TRANSFORMED TRUE) +endif() + +if(NOT "${MBEDTLS_CONFIG_FILE}" STREQUAL "" AND + (NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_SET}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_UNSET}" STREQUAL "")) + message(FATAL_ERROR + "MBEDTLS_CONFIG_FILE cannot be combined with MBEDTLS_CONFIG_BASE_FILE, " + "MBEDTLS_CONFIG_NAME, MBEDTLS_CONFIG_SET or MBEDTLS_CONFIG_UNSET.") +endif() + +if(MBEDTLS_CONFIG_TRANSFORMED AND + NOT "${TF_PSA_CRYPTO_CONFIG_FILE}" STREQUAL "") + message(FATAL_ERROR + "TF_PSA_CRYPTO_CONFIG_FILE cannot be combined with " + "MBEDTLS_CONFIG_NAME, MBEDTLS_CONFIG_SET or MBEDTLS_CONFIG_UNSET.") +endif() + +if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_SET}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_UNSET}" STREQUAL "") + if("${CMAKE_CURRENT_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_BINARY_DIR}") + message(FATAL_ERROR + "MBEDTLS_CONFIG_BASE_FILE, MBEDTLS_CONFIG_NAME, " + "MBEDTLS_CONFIG_SET and MBEDTLS_CONFIG_UNSET are not supported " + "in an in-tree build.") + endif() + + if((NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_SET}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_UNSET}" STREQUAL "") AND + "${MBEDTLS_PYTHON_EXECUTABLE}" STREQUAL "") + message(FATAL_ERROR "Python 3 is required to generate an Mbed TLS configuration file.") + endif() + + if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "") + set(MBEDTLS_BASE_CONFIG_FILE "${MBEDTLS_CONFIG_BASE_FILE}") + if(NOT EXISTS "${MBEDTLS_BASE_CONFIG_FILE}") + file(RELATIVE_PATH MBEDTLS_CONFIG_BASE_FILE_RELATIVE + "${CMAKE_CURRENT_BINARY_DIR}" "${MBEDTLS_CONFIG_BASE_FILE}") + set(MBEDTLS_BASE_CONFIG_FILE + "${CMAKE_CURRENT_SOURCE_DIR}/${MBEDTLS_CONFIG_BASE_FILE_RELATIVE}") + endif() + else() + set(MBEDTLS_BASE_CONFIG_FILE + "${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/mbedtls_config.h") + endif() + if(NOT EXISTS "${MBEDTLS_BASE_CONFIG_FILE}") + message(FATAL_ERROR "Mbed TLS configuration file not found: ${MBEDTLS_BASE_CONFIG_FILE}") + endif() + + set(MBEDTLS_GENERATED_CONFIG_DIR "${CMAKE_CURRENT_BINARY_DIR}/generated/include") + set(MBEDTLS_GENERATED_CONFIG_FILE "${MBEDTLS_GENERATED_CONFIG_DIR}/mbedtls/mbedtls_config.h") + file(MAKE_DIRECTORY "${MBEDTLS_GENERATED_CONFIG_DIR}/mbedtls") + configure_file("${MBEDTLS_BASE_CONFIG_FILE}" + "${MBEDTLS_GENERATED_CONFIG_FILE}" COPYONLY) + + if(MBEDTLS_CONFIG_TRANSFORMED) + if(NOT "${TF_PSA_CRYPTO_CONFIG_BASE_FILE}" STREQUAL "") + set(MBEDTLS_BASE_CRYPTO_CONFIG_FILE + "${TF_PSA_CRYPTO_CONFIG_BASE_FILE}") + if(NOT EXISTS "${MBEDTLS_BASE_CRYPTO_CONFIG_FILE}") + file(RELATIVE_PATH TF_PSA_CRYPTO_CONFIG_BASE_FILE_RELATIVE + "${CMAKE_CURRENT_BINARY_DIR}" + "${TF_PSA_CRYPTO_CONFIG_BASE_FILE}") + set(MBEDTLS_BASE_CRYPTO_CONFIG_FILE + "${CMAKE_CURRENT_SOURCE_DIR}/${TF_PSA_CRYPTO_CONFIG_BASE_FILE_RELATIVE}") + endif() + else() + set(MBEDTLS_BASE_CRYPTO_CONFIG_FILE + "${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/include/psa/crypto_config.h") + endif() + if(NOT EXISTS "${MBEDTLS_BASE_CRYPTO_CONFIG_FILE}") + message(FATAL_ERROR + "TF-PSA-Crypto configuration file not found: " + "${MBEDTLS_BASE_CRYPTO_CONFIG_FILE}") + endif() + + set(MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE + "${MBEDTLS_GENERATED_CONFIG_DIR}/psa/crypto_config.h") + file(MAKE_DIRECTORY "${MBEDTLS_GENERATED_CONFIG_DIR}/psa") + configure_file("${MBEDTLS_BASE_CRYPTO_CONFIG_FILE}" + "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" COPYONLY) + endif() + + function(mbedtls_configure_generated_file) + execute_process( + COMMAND + ${MBEDTLS_PYTHON_EXECUTABLE} + "${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.py" + --file "${MBEDTLS_GENERATED_CONFIG_FILE}" + --cryptofile "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" + ${ARGN} + RESULT_VARIABLE result + ) + if(result) + message(FATAL_ERROR "Failed to configure the generated Mbed TLS configuration file") + endif() + endfunction(mbedtls_configure_generated_file) + + if(NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "") + mbedtls_configure_generated_file("${MBEDTLS_CONFIG_NAME}") + endif() + foreach(option IN LISTS MBEDTLS_CONFIG_UNSET) + mbedtls_configure_generated_file(unset "${option}") + endforeach(option) + foreach(option IN LISTS MBEDTLS_CONFIG_SET) + string(FIND "${option}" "=" separator) + if(separator EQUAL -1) + mbedtls_configure_generated_file(--force set "${option}") + else() + string(SUBSTRING "${option}" 0 ${separator} name) + math(EXPR value_start "${separator} + 1") + string(SUBSTRING "${option}" ${value_start} -1 value) + mbedtls_configure_generated_file(--force set "${name}" "${value}") + endif() + endforeach(option) + + set(MBEDTLS_CONFIG_FILE + "$$") + if(MBEDTLS_CONFIG_TRANSFORMED) + # TF-PSA-Crypto applies its own transformations after the PSA changes + # made by the Mbed TLS configuration tool. + set(TF_PSA_CRYPTO_CONFIG_BASE_FILE_OVERRIDE + "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}") + endif() +endif() # Create a symbolic link from ${base_name} in the binary directory # to the corresponding path in the source directory. @@ -307,19 +447,19 @@ endfunction(set_msvc_base_compile_options) function(set_config_files_compile_definitions target) # Pass-through MBEDTLS_CONFIG_FILE, MBEDTLS_USER_CONFIG_FILE, # TF_PSA_CRYPTO_CONFIG_FILE and TF_PSA_CRYPTO_USER_CONFIG_FILE - if(MBEDTLS_CONFIG_FILE) + if(NOT "${MBEDTLS_CONFIG_FILE}" STREQUAL "") target_compile_definitions(${target} PUBLIC MBEDTLS_CONFIG_FILE="${MBEDTLS_CONFIG_FILE}") endif() - if(MBEDTLS_USER_CONFIG_FILE) + if(NOT "${MBEDTLS_USER_CONFIG_FILE}" STREQUAL "") target_compile_definitions(${target} PUBLIC MBEDTLS_USER_CONFIG_FILE="${MBEDTLS_USER_CONFIG_FILE}") endif() - if(TF_PSA_CRYPTO_CONFIG_FILE) + if(NOT "${TF_PSA_CRYPTO_CONFIG_FILE}" STREQUAL "") target_compile_definitions(${target} PUBLIC TF_PSA_CRYPTO_CONFIG_FILE="${TF_PSA_CRYPTO_CONFIG_FILE}") endif() - if(TF_PSA_CRYPTO_USER_CONFIG_FILE) + if(NOT "${TF_PSA_CRYPTO_USER_CONFIG_FILE}" STREQUAL "") target_compile_definitions(${target} PUBLIC TF_PSA_CRYPTO_USER_CONFIG_FILE="${TF_PSA_CRYPTO_USER_CONFIG_FILE}") endif() diff --git a/ChangeLog.d/cmake-config.txt b/ChangeLog.d/cmake-config.txt new file mode 100644 index 0000000000..0ee6433a82 --- /dev/null +++ b/ChangeLog.d/cmake-config.txt @@ -0,0 +1,4 @@ +Features + * Add the `MBEDTLS_CONFIG_BASE_FILE`, `MBEDTLS_CONFIG_NAME`, + `MBEDTLS_CONFIG_SET` and `MBEDTLS_CONFIG_UNSET` CMake options for + selecting and customizing compile-time configurations. Fixes #10838. diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index f76977fbab..6a53a184b2 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -4,10 +4,21 @@ if(INSTALL_MBEDTLS_HEADERS) file(GLOB headers "mbedtls/*.h") + if(NOT "${MBEDTLS_GENERATED_CONFIG_FILE}" STREQUAL "") + list(REMOVE_ITEM headers + "${CMAKE_CURRENT_SOURCE_DIR}/mbedtls/mbedtls_config.h") + endif() + install(FILES ${headers} DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + if(NOT "${MBEDTLS_GENERATED_CONFIG_FILE}" STREQUAL "") + install(FILES "${MBEDTLS_GENERATED_CONFIG_FILE}" + DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls + PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + endif() + file(GLOB private_headers "mbedtls/private/*.h") install(FILES ${private_headers} diff --git a/programs/test/cmake_package_install/cmake_package_config.c b/programs/test/cmake_package_install/cmake_package_config.c new file mode 100644 index 0000000000..a5cb9016a3 --- /dev/null +++ b/programs/test/cmake_package_install/cmake_package_config.c @@ -0,0 +1,13 @@ +/* + * Simple program to test an installed Mbed TLS configuration. + * + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#include "mbedtls/build_info.h" + +int main(void) +{ + return 0; +} diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index bf0262484e..d7bbbb5049 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -284,6 +284,169 @@ support_build_cmake_custom_config_file () { support_test_cmake_out_of_source } +component_build_cmake_config_options () { + MBEDTLS_ROOT_DIR="$PWD" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: cmake with MBEDTLS_CONFIG_NAME" + cmake -DMBEDTLS_CONFIG_NAME=crypto "$MBEDTLS_ROOT_DIR" + make query_compile_time_config + not programs/test/query_compile_time_config MBEDTLS_SSL_TLS_C + programs/test/query_compile_time_config PSA_WANT_ALG_CMAC + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: cmake with a false-like option name" + cmake -DMBEDTLS_CONFIG_SET=NO "$MBEDTLS_ROOT_DIR" + grep '^#define NO$' generated/include/mbedtls/mbedtls_config.h + cmake -DMBEDTLS_CONFIG_SET= . + grep '^TF_PSA_CRYPTO_CONFIG_FILE:FILEPATH=$' CMakeCache.txt + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: cmake with MBEDTLS_CONFIG_BASE_FILE only" + cmake -DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \ + "$MBEDTLS_ROOT_DIR" + cmp "$MBEDTLS_ROOT_DIR/configs/config-ccm-psk-tls1_2.h" \ + generated/include/mbedtls/mbedtls_config.h + not test -e generated/include/psa/crypto_config.h + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + launch_dir="$MBEDTLS_ROOT_DIR/cmake-config-launch" + mkdir "$launch_dir" + cd "$launch_dir" + + msg "configure: resolve a base config relative to the launch directory" + cmake -H"$MBEDTLS_ROOT_DIR" -B"$OUT_OF_SOURCE_DIR" \ + -DMBEDTLS_CONFIG_BASE_FILE=../configs/config-ccm-psk-tls1_2.h \ + -DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C + grep '^#define MBEDTLS_DEBUG_C' \ + "$OUT_OF_SOURCE_DIR/generated/include/mbedtls/mbedtls_config.h" + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" "$launch_dir" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: reject MBEDTLS_CONFIG_FILE with transformations" + not cmake -DMBEDTLS_CONFIG_FILE=configs/config-ccm-psk-tls1_2.h \ + -DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C "$MBEDTLS_ROOT_DIR" + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: reject TF_PSA_CRYPTO_CONFIG_FILE with Mbed TLS transformations" + not cmake \ + -DTF_PSA_CRYPTO_CONFIG_FILE="$MBEDTLS_ROOT_DIR/tf-psa-crypto/include/psa/crypto_config.h" \ + -DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C "$MBEDTLS_ROOT_DIR" + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "build: combine Mbed TLS and TF-PSA-Crypto transformations" + cmake \ + -DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \ + -DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C \ + -DTF_PSA_CRYPTO_CONFIG_BASE_FILE="$MBEDTLS_ROOT_DIR/configs/crypto-config-ccm-psk-tls1_2.h" \ + -DTF_PSA_CRYPTO_CONFIG_UNSET=MBEDTLS_HAVE_TIME \ + "$MBEDTLS_ROOT_DIR" + make query_compile_time_config + programs/test/query_compile_time_config MBEDTLS_DEBUG_C + grep '^#define MBEDTLS_HAVE_TIME' \ + generated/include/psa/crypto_config.h + not programs/test/query_compile_time_config MBEDTLS_HAVE_TIME + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: reject a missing base configuration" + not cmake -DMBEDTLS_CONFIG_BASE_FILE=configs/does-not-exist.h \ + "$MBEDTLS_ROOT_DIR" + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "build: cmake with a base config, MBEDTLS_CONFIG_SET and MBEDTLS_CONFIG_UNSET" + cp "$MBEDTLS_ROOT_DIR/configs/config-ccm-psk-tls1_2.h" base_config.before + cp "$MBEDTLS_ROOT_DIR/tf-psa-crypto/include/psa/crypto_config.h" \ + crypto_config.before + cmake -DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \ + '-DMBEDTLS_CONFIG_UNSET=MBEDTLS_SSL_SRV_C;PSA_WANT_ALG_CMAC;PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128' \ + '-DMBEDTLS_CONFIG_SET=MBEDTLS_SSL_RENEGOTIATION;MBEDTLS_DEBUG_C;MBEDTLS_ERROR_C;MBEDTLS_SSL_IN_CONTENT_LEN=12000' \ + "$MBEDTLS_ROOT_DIR" + make query_compile_time_config + + programs/test/query_compile_time_config MBEDTLS_SSL_PROTO_TLS1_2 + programs/test/query_compile_time_config MBEDTLS_SSL_RENEGOTIATION + programs/test/query_compile_time_config MBEDTLS_DEBUG_C + programs/test/query_compile_time_config MBEDTLS_ERROR_C + not programs/test/query_compile_time_config MBEDTLS_SSL_SRV_C + not programs/test/query_compile_time_config PSA_WANT_ALG_CMAC + [ "$(programs/test/query_compile_time_config MBEDTLS_SSL_IN_CONTENT_LEN)" = \ + "12000" ] + cmp base_config.before \ + "$MBEDTLS_ROOT_DIR/configs/config-ccm-psk-tls1_2.h" + cmp crypto_config.before \ + "$MBEDTLS_ROOT_DIR/tf-psa-crypto/include/psa/crypto_config.h" + + msg "install: generated configurations are relocatable" + install_dir="$OUT_OF_SOURCE_DIR.install" + cmake -DCMAKE_INSTALL_PREFIX="$install_dir" . + cmake --build . --target install + cmp generated/include/mbedtls/mbedtls_config.h \ + "$install_dir/include/mbedtls/mbedtls_config.h" + cmp tf-psa-crypto/include/psa/crypto_config.h \ + "$install_dir/include/psa/crypto_config.h" + + # The installed targets must not refer to the build tree. + cd "$MBEDTLS_ROOT_DIR" + mv "$OUT_OF_SOURCE_DIR" "$OUT_OF_SOURCE_DIR.moved" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + mkdir consumer + cat >consumer/CMakeLists.txt <