diff --git a/CMakeLists.txt b/CMakeLists.txt index a6e2076c41..c207be4159 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -143,9 +143,114 @@ if(CMAKE_SOURCE_DIR STREQUAL CMAKE_CURRENT_SOURCE_DIR) FORCE) endif() -# Make MBEDTLS_CONFIG_FILE and MBEDTLS_USER_CONFIG_FILE into PATHs +# Make configuration file options into PATHs set(MBEDTLS_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS config file (overrides default).") set(MBEDTLS_USER_CONFIG_FILE "" CACHE FILEPATH "Mbed TLS user config file (appended to default).") +set(MBEDTLS_CONFIG_BASE_FILE "" CACHE FILEPATH "Mbed TLS config to copy and optionally transform.") +set(MBEDTLS_CONFIG_NAME "" CACHE STRING "Named Mbed TLS configuration (see config.py).") +set(MBEDTLS_CONFIG_SET "" CACHE STRING "Options to set, separated by semicolons (OPTION or OPTION=VALUE).") +set(MBEDTLS_CONFIG_UNSET "" CACHE STRING "Options to unset, separated by semicolons.") + +set(MBEDTLS_CONFIG_TRANSFORMED FALSE) +if(NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_SET}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_UNSET}" STREQUAL "") + set(MBEDTLS_CONFIG_TRANSFORMED TRUE) +endif() + +if(NOT "${MBEDTLS_CONFIG_FILE}" STREQUAL "" AND + (NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_SET}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_UNSET}" STREQUAL "")) + message(FATAL_ERROR + "MBEDTLS_CONFIG_FILE cannot be combined with MBEDTLS_CONFIG_BASE_FILE, " + "MBEDTLS_CONFIG_NAME, MBEDTLS_CONFIG_SET or MBEDTLS_CONFIG_UNSET.") +endif() + +if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_SET}" STREQUAL "" OR + NOT "${MBEDTLS_CONFIG_UNSET}" STREQUAL "") + if("${CMAKE_CURRENT_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_BINARY_DIR}") + message(FATAL_ERROR + "MBEDTLS_CONFIG_BASE_FILE, MBEDTLS_CONFIG_NAME, " + "MBEDTLS_CONFIG_SET and MBEDTLS_CONFIG_UNSET are not supported " + "in an in-tree build.") + endif() + + if(MBEDTLS_CONFIG_TRANSFORMED AND + "${MBEDTLS_PYTHON_EXECUTABLE}" STREQUAL "") + message(FATAL_ERROR "Python 3 is required to generate an Mbed TLS configuration file.") + endif() + + if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "") + set(MBEDTLS_BASE_CONFIG_FILE "${MBEDTLS_CONFIG_BASE_FILE}") + if(NOT EXISTS "${MBEDTLS_BASE_CONFIG_FILE}") + file(RELATIVE_PATH MBEDTLS_CONFIG_BASE_FILE_RELATIVE + "${CMAKE_CURRENT_BINARY_DIR}" "${MBEDTLS_CONFIG_BASE_FILE}") + set(MBEDTLS_BASE_CONFIG_FILE + "${CMAKE_CURRENT_SOURCE_DIR}/${MBEDTLS_CONFIG_BASE_FILE_RELATIVE}") + endif() + else() + set(MBEDTLS_BASE_CONFIG_FILE + "${CMAKE_CURRENT_SOURCE_DIR}/include/mbedtls/mbedtls_config.h") + endif() + if(NOT EXISTS "${MBEDTLS_BASE_CONFIG_FILE}") + message(FATAL_ERROR "Mbed TLS configuration file not found: ${MBEDTLS_BASE_CONFIG_FILE}") + endif() + + set(MBEDTLS_GENERATED_CONFIG_DIR "${CMAKE_CURRENT_BINARY_DIR}/generated/include") + set(MBEDTLS_GENERATED_CONFIG_FILE "${MBEDTLS_GENERATED_CONFIG_DIR}/mbedtls/mbedtls_config.h") + file(MAKE_DIRECTORY "${MBEDTLS_GENERATED_CONFIG_DIR}/mbedtls") + configure_file("${MBEDTLS_BASE_CONFIG_FILE}" + "${MBEDTLS_GENERATED_CONFIG_FILE}" COPYONLY) + + if(MBEDTLS_CONFIG_TRANSFORMED) + set(MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE + "${MBEDTLS_GENERATED_CONFIG_DIR}/psa/crypto_config.h") + file(MAKE_DIRECTORY "${MBEDTLS_GENERATED_CONFIG_DIR}/psa") + configure_file( + "${CMAKE_CURRENT_SOURCE_DIR}/include/psa/crypto_config.h" + "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" COPYONLY) + endif() + + function(mbedtls_configure_generated_file) + execute_process( + COMMAND + ${MBEDTLS_PYTHON_EXECUTABLE} + "${CMAKE_CURRENT_SOURCE_DIR}/scripts/config.py" + --file "${MBEDTLS_GENERATED_CONFIG_FILE}" + --cryptofile "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" + ${ARGN} + RESULT_VARIABLE result + ) + if(result) + message(FATAL_ERROR "Failed to configure the generated Mbed TLS configuration file") + endif() + endfunction(mbedtls_configure_generated_file) + + if(NOT "${MBEDTLS_CONFIG_NAME}" STREQUAL "") + mbedtls_configure_generated_file("${MBEDTLS_CONFIG_NAME}") + endif() + foreach(option IN LISTS MBEDTLS_CONFIG_UNSET) + mbedtls_configure_generated_file(unset "${option}") + endforeach(option) + foreach(option IN LISTS MBEDTLS_CONFIG_SET) + string(FIND "${option}" "=" separator) + if(separator EQUAL -1) + mbedtls_configure_generated_file(--force set "${option}") + else() + string(SUBSTRING "${option}" 0 ${separator} name) + math(EXPR value_start "${separator} + 1") + string(SUBSTRING "${option}" ${value_start} -1 value) + mbedtls_configure_generated_file(--force set "${name}" "${value}") + endif() + endforeach(option) + + set(MBEDTLS_CONFIG_FILE + "$$") +endif() # Create a symbolic link from ${base_name} in the binary directory # to the corresponding path in the source directory. diff --git a/ChangeLog.d/cmake-config.txt b/ChangeLog.d/cmake-config.txt new file mode 100644 index 0000000000..0ee6433a82 --- /dev/null +++ b/ChangeLog.d/cmake-config.txt @@ -0,0 +1,4 @@ +Features + * Add the `MBEDTLS_CONFIG_BASE_FILE`, `MBEDTLS_CONFIG_NAME`, + `MBEDTLS_CONFIG_SET` and `MBEDTLS_CONFIG_UNSET` CMake options for + selecting and customizing compile-time configurations. Fixes #10838. diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt index 2df666118f..d30b1bce01 100644 --- a/include/CMakeLists.txt +++ b/include/CMakeLists.txt @@ -5,6 +5,15 @@ if(INSTALL_MBEDTLS_HEADERS) file(GLOB headers "mbedtls/*.h") file(GLOB psa_headers "psa/*.h") + if(NOT "${MBEDTLS_GENERATED_CONFIG_FILE}" STREQUAL "") + list(REMOVE_ITEM headers + "${CMAKE_CURRENT_SOURCE_DIR}/mbedtls/mbedtls_config.h") + endif() + if(NOT "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" STREQUAL "") + list(REMOVE_ITEM psa_headers + "${CMAKE_CURRENT_SOURCE_DIR}/psa/crypto_config.h") + endif() + install(FILES ${headers} DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) @@ -13,6 +22,17 @@ if(INSTALL_MBEDTLS_HEADERS) DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/psa PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + if(NOT "${MBEDTLS_GENERATED_CONFIG_FILE}" STREQUAL "") + install(FILES "${MBEDTLS_GENERATED_CONFIG_FILE}" + DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls + PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + endif() + if(NOT "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" STREQUAL "") + install(FILES "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" + DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/psa + PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) + endif() + endif(INSTALL_MBEDTLS_HEADERS) # Make mbedtls_config.h available in an out-of-source build. ssl-opt.sh requires it. diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt index 543dcd3d7d..2181c05df9 100644 --- a/library/CMakeLists.txt +++ b/library/CMakeLists.txt @@ -342,6 +342,10 @@ endif(USE_SHARED_MBEDTLS_LIBRARY) foreach(target IN LISTS target_libraries) add_library(MbedTLS::${target} ALIAS ${target}) # add_subdirectory support + if(MBEDTLS_CONFIG_TRANSFORMED) + target_include_directories(${target} + PUBLIC $) + endif() # Include public header files from /include and other directories # declared by /3rdparty/**/CMakeLists.txt. Include private header files # from /library and others declared by /3rdparty/**/CMakeLists.txt. diff --git a/programs/test/cmake_package_install/cmake_package_config.c b/programs/test/cmake_package_install/cmake_package_config.c new file mode 100644 index 0000000000..a5cb9016a3 --- /dev/null +++ b/programs/test/cmake_package_install/cmake_package_config.c @@ -0,0 +1,13 @@ +/* + * Simple program to test an installed Mbed TLS configuration. + * + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#include "mbedtls/build_info.h" + +int main(void) +{ + return 0; +} diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh index 0cdc51a625..f548cd1768 100644 --- a/tests/scripts/components-build-system.sh +++ b/tests/scripts/components-build-system.sh @@ -320,6 +320,139 @@ support_build_cmake_custom_config_file () { support_test_cmake_out_of_source } +component_build_cmake_config_options () { + MBEDTLS_ROOT_DIR="$PWD" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: cmake with MBEDTLS_CONFIG_NAME" + cmake -DMBEDTLS_CONFIG_NAME=full "$MBEDTLS_ROOT_DIR" + make query_compile_time_config + programs/test/query_compile_time_config MBEDTLS_TEST_HOOKS + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: cmake with a false-like option name" + cmake -DMBEDTLS_CONFIG_SET=NO "$MBEDTLS_ROOT_DIR" + grep '^#define NO$' generated/include/mbedtls/mbedtls_config.h + cmake -DMBEDTLS_CONFIG_SET= . + grep '^MBEDTLS_CONFIG_FILE:FILEPATH=$' CMakeCache.txt + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: cmake with MBEDTLS_CONFIG_BASE_FILE only" + cmake -DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \ + "$MBEDTLS_ROOT_DIR" + cmp "$MBEDTLS_ROOT_DIR/configs/config-ccm-psk-tls1_2.h" \ + generated/include/mbedtls/mbedtls_config.h + not test -e generated/include/psa/crypto_config.h + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + launch_dir="$MBEDTLS_ROOT_DIR/cmake-config-launch" + mkdir "$launch_dir" + cd "$launch_dir" + + msg "configure: resolve a base config relative to the launch directory" + cmake -H"$MBEDTLS_ROOT_DIR" -B"$OUT_OF_SOURCE_DIR" \ + -DMBEDTLS_CONFIG_BASE_FILE=../configs/config-ccm-psk-tls1_2.h \ + -DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C + grep '^#define MBEDTLS_DEBUG_C' \ + "$OUT_OF_SOURCE_DIR/generated/include/mbedtls/mbedtls_config.h" + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" "$launch_dir" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: reject MBEDTLS_CONFIG_FILE with transformations" + not cmake -DMBEDTLS_CONFIG_FILE=configs/config-ccm-psk-tls1_2.h \ + -DMBEDTLS_CONFIG_SET=MBEDTLS_DEBUG_C "$MBEDTLS_ROOT_DIR" + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "configure: reject a missing base configuration" + not cmake -DMBEDTLS_CONFIG_BASE_FILE=configs/does-not-exist.h \ + "$MBEDTLS_ROOT_DIR" + + cd "$MBEDTLS_ROOT_DIR" + rm -rf "$OUT_OF_SOURCE_DIR" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + + msg "build: cmake with a base config, MBEDTLS_CONFIG_SET and MBEDTLS_CONFIG_UNSET" + cp "$MBEDTLS_ROOT_DIR/configs/config-ccm-psk-tls1_2.h" base_config.before + cp "$MBEDTLS_ROOT_DIR/include/psa/crypto_config.h" crypto_config.before + cmake -DMBEDTLS_CONFIG_BASE_FILE=configs/config-ccm-psk-tls1_2.h \ + '-DMBEDTLS_CONFIG_UNSET=MBEDTLS_SSL_SRV_C;PSA_WANT_ALG_CMAC;PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128' \ + '-DMBEDTLS_CONFIG_SET=MBEDTLS_SSL_RENEGOTIATION;MBEDTLS_DEBUG_C;MBEDTLS_ERROR_C;MBEDTLS_SSL_IN_CONTENT_LEN=12000' \ + "$MBEDTLS_ROOT_DIR" + make query_compile_time_config + + programs/test/query_compile_time_config MBEDTLS_SSL_PROTO_TLS1_2 + programs/test/query_compile_time_config MBEDTLS_SSL_RENEGOTIATION + programs/test/query_compile_time_config MBEDTLS_DEBUG_C + programs/test/query_compile_time_config MBEDTLS_ERROR_C + not programs/test/query_compile_time_config MBEDTLS_SSL_SRV_C + not programs/test/query_compile_time_config PSA_WANT_ALG_CMAC + [ "$(programs/test/query_compile_time_config MBEDTLS_SSL_IN_CONTENT_LEN)" = \ + "12000" ] + cmp base_config.before \ + "$MBEDTLS_ROOT_DIR/configs/config-ccm-psk-tls1_2.h" + cmp crypto_config.before \ + "$MBEDTLS_ROOT_DIR/include/psa/crypto_config.h" + + msg "install: generated configurations are relocatable" + install_dir="$OUT_OF_SOURCE_DIR.install" + cmake -DCMAKE_INSTALL_PREFIX="$install_dir" . + cmake --build . --target install + cmp generated/include/mbedtls/mbedtls_config.h \ + "$install_dir/include/mbedtls/mbedtls_config.h" + cmp generated/include/psa/crypto_config.h \ + "$install_dir/include/psa/crypto_config.h" + + # The installed targets must not refer to the build tree. + cd "$MBEDTLS_ROOT_DIR" + mv "$OUT_OF_SOURCE_DIR" "$OUT_OF_SOURCE_DIR.moved" + mkdir "$OUT_OF_SOURCE_DIR" + cd "$OUT_OF_SOURCE_DIR" + mkdir consumer + cat >consumer/CMakeLists.txt <