Updating\removing BLE related libraries in SDK

[EyalR]

Hi,

I'm using nRF52832 with SDK 17.0.2. We were using the Snyk Vulnerability Database to scan our code and found issues with the libraries mbedtls, lwip-tcpip and micro-ecc.

mbedtls and lwip-tcpip offered version upgrades to fix the issue, while the micro-ecc issue had no solution.

My questions are:

1) How would I go about and manually upgrade mbedtls and lwip-tcpip libraries in the SDK? Is it a simple matter of overwriting the new libraries on top of the old ones?

2) Since we're not using any sort of encryptions or cryptography we don't really need the micro-cc library. How could I remove it from the code without breaking the compilation of the entire solution?

Thanks,

Eyal 

[Simonr]

Are you able to see what prerequisites aren't defined, or see what prerequisites the MBEDTLS certs would need and make sure they're all defined in your project too. Sorry I don't have anything more specific to go on here.

Best regards,

Simon

[EyalR]

I can see the prerequisites I just don't understand where are they defined. I thought conifg.h in the include folder of mbed is the file that holds all of the defines but when I tried commenting on\off various defines it had no affect. is there any other place where those defines could be?

[Simonr]

Can you let me know what prereqs these are exactly that you're looking for, and I'll help you look for them.

[EyalR]

The full error is:

#if defined(MBEDTLS_CERTS_C) && !defined(MBEDTLS_X509_USE_C)
#error "MBEDTLS_CERTS_C defined, but not all prerequisites"
#endif

in check_config.h.

I'm not sure where either MBEDTLS_X509_USE_C or MBEDTLS_CERTS_C are defined.